Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1Question →

A cybersecurity team is deploying deception and disruption technologies within a cloud-native software development environment to detect early-stage credential access and lateral movement. Which of the following components and operational practices should the security team implement to achieve high-fidelity alerting without interfering with legitimate production workflows? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Embed non-functional synthetic API keys (honeytokens) into code repositories that generate alerts upon any authorization attempt.; Deploy low-interaction decoy container endpoints on isolated microsegments to simulate high-value internal management services.

Answer

The correct practices are embedding non-functional synthetic API keys (honeytokens) into code repositories to alert on any access attempt, and deploying low-interaction decoy container endpoints on isolated network segments to detect probing without risking production infrastructure.
Deception strategies rely on deploying assets that serve no legitimate business purpose. The option stating that non-functional synthetic API keys (honeytokens) should be placed in code repositories is correct because any interaction with these keys immediately signals unauthorized discovery or credential harvesting. The option recommending low-interaction decoy container endpoints on isolated microsegments is also correct because it provides a lightweight decoy target to capture lateral movement probes without exposing production systems.

Step-by-Step Solution

1
Analyze the goal of deception technologies in a cloud environment.
Identified that deception mechanisms (like honeytokens and decoys) aim to lure adversaries into interacting with non-production assets to produce high-confidence alerts.
Deception assets have no legitimate operational traffic, making any interaction suspicious.
2
Evaluate the proposed deception components against production safety and intent.
Selected honeytokens in code repositories and low-interaction decoy containers as proper deception tools.
Honeytokens detect credential misuse, and low-interaction containers catch scanning and discovery efforts safely.
3
Differentiate deception tools from standard inline prevention and filtering controls.
Disqualified inline traffic filtering and DNS dropping controls.
Honeypots do not act as inline filtering devices, and DNS filtering is a preventive control rather than a deception technology.

Key Concept

Deception and Disruption Technologies Deployment
Estimated Time:1m 30s
Question 2Question →

A security operations center (SOC) analyst is performing forensic triage on endpoints following an enterprise network intrusion. Analyze the host and network telemetry artifacts, and match each malware classification on the left with its corresponding technical indicator of compromise (IoC) artifact on the right.

Click a left item, then click its matching right item

Items

Process Hollowing Trojan
Network Worm
Kernel-Mode Rootkit
Fileless Cryptominer

Matches

Show answer & explanation

Answer

Process Hollowing Trojan matches the artifact describing a suspended legitimate process unmapped and reloaded with malicious code; Network Worm matches the artifact detailing automated SMB scanning and self-propagation across network shares; Kernel-Mode Rootkit matches the SSDT function pointer modification in kernel memory; Fileless Cryptominer matches the WMI event subscription executing obfuscated PowerShell payloads in memory.
Each malware category corresponds precisely to its forensic telemetry signature: Process Hollowing Trojans inject code into suspended process shells; Network Worms self-propagate across network protocols (SMB/TCP 445); Kernel-Mode Rootkits alter OS kernel data structures like the SSDT; and Fileless Cryptominers execute memory-resident scripts via WMI/PowerShell without writing files to disk.

Step-by-Step Solution

1
Analyze the first telemetry artifact involving process suspension and memory unmapping.
Identify this mechanism as process hollowing, a technique used by Trojans to conceal malicious execution inside a legitimate process shell.
Process hollowing relies on creating a process in a suspended state, hollowing out its PE headers and sections, and replacing them with a malicious image.
2
Examine the second telemetry artifact detailing SMB TCP 445 scanning and autonomous replication.
Classify this self-propagating behavior as a Network Worm.
Worms are distinguished from Trojans and viruses by their ability to self-replicate across network protocols like SMB without user interaction.
3
Review the third artifact involving SSDT function pointer modifications.
Match this indicator to a Kernel-Mode Rootkit.
SSDT (System Service Descriptor Table) hooking occurs exclusively in kernel memory (Ring 0) to hijack OS API calls and hide malware presence.
4
Evaluate the final artifact featuring WMI event subscriptions and memory-only PowerShell commands.
Link this artifact to a Fileless Cryptominer.
Using WMI and encoded PowerShell scripts enables malware execution entirely in RAM, avoiding disk creation while consuming system CPU resources.

Key Concept

Distinguishing Malware Telemetry Artifacts and Indicators of Compromise
Question 3Question →

An enterprise security architect is redesigning identity infrastructure to align with Zero Trust principles for a hybrid workforce. The organization must support real-time token revocation and risk evaluation for SaaS resources when user posture changes, as well as eliminate persistent administrator credentials on legacy infrastructure by enforcing ephemeral privilege allocation. Which TWO of the following identity and access management architecture components or protocols must be implemented to fulfill these requirements?

Select all that apply

Show answer & explanation

Answer: Identity Provider (IdP) integration supporting the Continuous Access Evaluation Protocol (CAEP) and Shared Signals Framework; Privileged Access Management (PAM) vault utilizing Just-In-Time (JIT) provisioning and short-lived ephemeral credentials

Answer

The correct architecture requires integrating an Identity Provider supporting the Continuous Access Evaluation Protocol (CAEP) alongside a Privileged Access Management (PAM) framework utilizing Just-In-Time (JIT) provisioning with ephemeral credentials.
Zero Trust IAM architecture requires continuous risk evaluation and minimization of standing privileges. Implementing CAEP (Continuous Access Evaluation Protocol) allows IdPs and SaaS platforms to exchange real-time security events to revoke access tokens immediately upon risk detection. Implementing a PAM vault with JIT temporary credentials removes standing administrator accounts by dynamically assigning short-lived privileges only when required.

Step-by-Step Solution

1
Analyze requirement 1: Dynamic session revocation and real-time posture risk evaluation across SaaS apps.
Identify that standard OAuth2/OIDC refresh token lifecycles are periodic; Continuous Access Evaluation Protocol (CAEP) / Shared Signals Framework enables real-time event-driven session revocation across identity providers and relying parties.
Enforces continuous verification rather than trusting static long-lived tokens.
2
Analyze requirement 2: Elimination of persistent privileged accounts on internal server infrastructure.
Identify Privileged Access Management (PAM) with Just-In-Time (JIT) credentialing as the standard architectural control for dynamic temporary elevation without standing administrative permissions.
Minimizes the blast radius of credential harvesting by ensuring privileged credentials expire immediately after administrative tasks.

Key Concept

Zero Trust IAM Architecture, CAEP, and Privileged Access Management (PAM)
Question 4Question →

An enterprise security assessment reveals that unprivileged workforce endpoints allow employees to connect unauthorized USB flash drives and execute untrusted software binaries directly from external media. Which of the following host-hardening strategies provides the MOST effective technical control to enforce peripheral hardware restrictions and prevent unauthorized program execution?

Show answer & explanation

Answer: Implement centralized administrative device installation policies paired with endpoint application block rules targeting removable drive locations.

Answer

Implementing centralized administrative device installation policies paired with endpoint application block rules targeting removable drive locations.
The correct answer combines endpoint peripheral control policies with host-based application execution restrictions. Configuring host administrative policies to block USB mass storage class GUIDs prevents the operating system from loading drivers for unauthorized hardware. Additionally, enforcing application control policies prevents execution of binaries from removable drives, mitigating both the physical device risk and the code execution threat.

Step-by-Step Solution

1
Analyze the threat scenario described in the audit finding.
Identified two distinct attack vectors: unauthorized physical hardware mounting (USB mass storage) and local untrusted binary execution.
Effective enterprise hardening requires mitigations operating at the host OS layer where the hardware interfaces and execution calls take place.
2
Evaluate technical mitigation controls matching the identified threat vectors.
Endpoint management policies (such as Group Policy or MDM device control) restrict driver installation for removable storage device classes, and host application control rules prohibit executing binaries residing on external paths.
Combining peripheral control with execution control addresses both physical connection risks and file execution risks on the host.
3
Differentiate preventive host hardening controls from perimeter network defenses and detection technologies.
Network firewalls, VPNs, and honeypots do not prevent local file execution or local hardware mounting on isolated host OS subsystems.
Defenses must align with the specific layer of vulnerability; host security controls are required for local storage and execution threats.

Key Concept

Endpoint Device Control and Application Hardening
Question 5Question →

A enterprise healthcare technology organization is preparing for a mandatory annual compliance review by an independent external auditing firm. The compliance officer must supply an independent attestation document that proves internal data security controls over sensitive electronic protected health information (ePHI) were not only appropriately designed and implemented, but also maintained and operated effectively over a continuous 12-month evaluation window. Which of the following audit reports or attestations fulfills both the time-horizon and operational testing criteria required by the auditors?

Show answer & explanation

Answer: A SOC 2 Type II report assessing security and confidentiality trust services criteria

Answer

A SOC 2 Type II report assessing security and confidentiality trust services criteria is the required attestation because it evaluates both control design suitability and operational effectiveness over a specified testing window (e.g., 12 months).
The option specifying a SOC 2 Type II report is correct because Service Organization Control (SOC) 2 Type II reports evaluate both the design suitability and the operational effectiveness of security controls over an extended testing period (typically 6 to 12 months). This directly satisfies the requirement for proof of continuous control operation across a 12-month window.

Step-by-Step Solution

1
Analyze the audit requirements in the scenario.
Identified two key requirements: (1) verification of control design suitability, and (2) proof of operational effectiveness over a continuous 12-month evaluation window.
Determining the scope (point-in-time vs. evaluation period) and depth (detailed testing vs. public summary) is critical for selecting the correct attestation type.
2
Evaluate the distinction between Type I and Type II attestation reports.
Type I reports cover design suitability at a single point in time. Type II reports assess operating effectiveness over a defined evaluation period.
The scenario explicitly specifies a continuous 12-month evaluation window, eliminating point-in-time assessments.
3
Evaluate the distinction between SOC 2, SOC 3, and technical testing reports.
SOC 2 provides the detailed independent auditor evidence required for compliance oversight, whereas SOC 3 is a general public summary and penetration tests are point-in-time technical evaluations.
Only a SOC 2 Type II report meets all conditions of detailed operational testing over a multi-month period.

Key Concept

Distinction between SOC report types (SOC 1 vs SOC 2 vs SOC 3) and report coverage (Type I point-in-time vs Type II operational period effectiveness).
Estimated Time:2m 0s
Question 6Question →

An organization requires department managers to perform quarterly user access reviews by manually evaluating account permissions and verifying that assigned rights match current job responsibilities. Which of the following best classifies both the security control category and functional type of this process?

Show answer & explanation

Answer: Operational category and Detective functional type

Answer

Operational category and Detective functional type
The correct answer is 'Operational category and Detective functional type'. Under the CompTIA Security+ framework, Operational controls refer to security measures implemented and executed by people through daily procedures and administrative operations. Periodic user access certification conducted by department managers is an operational process. Functionally, reviewing account rights identifies unauthorized permissions or privilege accumulation (privilege creep) that has already occurred, making it a Detective control.

Step-by-Step Solution

1
Determine the security control category
Operational control category
Control categories in CompTIA Security+ SY0-701 are divided into Technical, Managerial, Operational, and Physical. Routine day-to-day security procedures executed by human staff and managers—such as manual log reviews or quarterly user permission audits—fall under the Operational category.
2
Determine the functional type of the control
Detective functional type
Functional types define the operational goal of the control (Preventive, Detective, Corrective, Deterrent, Compensating, Directive). Auditing existing user rights allows organizations to uncover privilege creep or non-compliant permissions after they have been granted, fulfilling a Detective function.
3
Combine category and functional type to identify the correct classification
Operational category and Detective functional type
Combining the category determined in Step 1 with the functional type determined in Step 2 yields Operational category and Detective functional type.

Key Concept

Security Control Categories and Functional Types
Estimated Time:1m 15s
Question 7Question →

A network security monitoring sensor flags an alert for anomalous outbound traffic generated by an internal host. The NIDS sensor recorded the following event log details:

Timestamp: 2026-07-27T10:42:19Z
Source IP: 10.4.12.105
Destination IP: 198.51.100.89
Destination Port: 8443/TCP
Configured Inspection Rule: Expect HTTPS / TLS Application Protocol
Observed Banner Payload: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.1

Which of the following is the most accurate analysis of this network alert?

Show answer & explanation

Answer: Protocol encapsulation mismatch indicating an attempt to tunnel SSH traffic over a non-standard port to evade network egress filtering.

Answer

Protocol encapsulation mismatch indicating an attempt to tunnel SSH traffic over a non-standard port to evade network egress filtering.
The correct analysis recognizes that the NIDS sensor flagged a protocol mismatch where an SSH handshake banner ('SSH-2.0-OpenSSH...') was transmitted over port 8443, a port expected to carry TLS-encapsulated HTTPS traffic. Encapsulating non-HTTP protocols over standard or non-standard SSL/TLS ports is a common technique used to tunnel restricted traffic through network firewalls.

Step-by-Step Solution

1
Analyze the NIDS log fields
Identified that port 8443/TCP was configured to expect TLS/HTTPS traffic, but the observed payload contained the SSH protocol banner 'SSH-2.0-OpenSSH_8.9p1'.
Security monitoring sensors compare expected protocol behavior against inspected packet headers and payload signatures.
2
Determine the attack technique or operational anomaly
Recognized protocol tunneling/encapsulation used for perimeter control evasion.
Attackers or rogue internal hosts often run SSH servers over common HTTPS ports (such as 443 or 8443) to tunnel unauthorized traffic past firewall egress rules.
3
Differentiate correct root cause from distractor controls and attack types
Confirmed that the alert indicates protocol evasion, not SQL injection, WAF misclassification, or honeypot issues.
Deep packet inspection reveals application-layer protocol mismatches regardless of the destination port number used.

Key Concept

Network Security Monitoring and Protocol Analysis
Question 8Question →

Match each third-party risk management agreement or contractual clause to its primary operational purpose.

Click a left item, then click its matching right item

Items

Interconnection Security Agreement (ISA)
Memorandum of Understanding (MOU)
Master Services Agreement (MSA)
Right-to-Audit Clause

Matches

Show answer & explanation

Answer

The correct pairings match each third-party risk management agreement with its functional role: Interconnection Security Agreement (ISA) pairs with technical network connection requirements; Memorandum of Understanding (MOU) pairs with non-binding mutual expectations; Master Services Agreement (MSA) pairs with foundational governance and overarching legal terms; and Right-to-Audit Clause pairs with explicit authority to inspect vendor security operations.
Each agreement instrument fulfills a distinct governance role in third-party risk management. An ISA establishes specific technical security rules for interconnected networks. An MOU documents operational intent and mutual cooperation without binding financial obligations. An MSA provides the baseline legal framework for vendor relationships. A Right-to-Audit clause explicitly permits the customer to inspect and verify the vendor's security controls.

Step-by-Step Solution

1
Analyze technical data-sharing and connectivity mechanisms.
Identify that connecting two distinct networks directly requires formal technical protocols provided by an Interconnection Security Agreement (ISA).
Technical parameters, interface configurations, and data encryption for dedicated links are specifically defined within an ISA.
2
Differentiate formal contract instruments from non-binding agreements.
Recognize that general operational alignment without financial obligations is established through a Memorandum of Understanding (MOU), while overarching legal frameworks are governed by a Master Services Agreement (MSA).
MOUs express mutual goals without binding covenants, whereas MSAs define enforceable terms like indemnification, liability, and dispute mechanisms.
3
Evaluate enterprise oversight and verification mechanisms.
Pair the contractual right to perform security inspections with the Right-to-Audit Clause.
Without an explicit Right-to-Audit clause, organizations lack legal standing to inspect vendor infrastructure or demand internal security documentation.

Key Concept

Third-Party Risk Management Agreements and Governance Frameworks
Question 9Question →

A enterprise compliance team is conducting a vendor risk evaluation for a critical cloud-hosted database service. The vendor presents a security document confirming that their security control design was evaluated and validated as of a specific date last month, but it contains no testing results regarding control performance over time. The enterprise requires formal verification that controls operated effectively over a minimum six-month observation window. Which assessment deliverable should the compliance team request from the vendor?

Show answer & explanation

Answer: A SOC 2 Type II report

Answer

The enterprise compliance team should request a SOC 2 Type II report.
A SOC 2 Type II report is specifically designed to audit both the design and operational effectiveness of security controls across an extended period, typically between 6 and 12 months. This satisfies the requirement to prove controls operated consistently over time.

Step-by-Step Solution

1
Analyze the compliance requirement
The organization requires proof of operational effectiveness over a historical period of at least six months.
Point-in-time assessments do not prove that security controls functioned continuously without failure over time.
2
Evaluate the difference between SOC report types
SOC 2 Type I covers control design at a single point in time, while SOC 2 Type II assesses control design and tests operational effectiveness over a defined time window.
Auditing operational effectiveness requires auditors to sample evidence across a declared testing timeframe.
3
Select the appropriate attestation deliverable
The SOC 2 Type II report fulfills the enterprise's vendor risk requirement.
It provides independent third-party verification of control operation throughout the required multi-month period.

Key Concept

Distinction between SOC 2 Type I (point-in-time design) and SOC 2 Type II (historical period operational effectiveness) security attestations.
Question 10Question →

A Security Operations Center (SOC) analyst is reviewing an alert triggered by a perimeter Network Intrusion Detection System (NIDS). The NIDS captured the following HTTP request payload targeting an internal customer portal:

GET /catalog.php?item=42%20UNION%20SELECT%20username,password_hash%20FROM%20user_credentials-- HTTP/1.1
Host: portal.company.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)

Based on this network security monitoring alert, which of the following is the most accurate assessment of the threat and the appropriate immediate analyst action?

Show answer & explanation

Answer: The log indicates a SQL injection attempt aiming to extract database content; the analyst should check Web Application Firewall (WAF) and SIEM logs to verify if the server responded with successful data execution.

Answer

The alert represents a SQL injection attempt targeting database records, requiring the analyst to correlate SIEM web server logs and HTTP response status codes to assess impact.
The payload contains URL-encoded SQL commands (`UNION SELECT`), which signifies a SQL injection attempt targeting the backend database. In network security monitoring, receiving a NIDS alert for an inbound payload requires verifying downstream web server and database logs in the SIEM to check whether the application processed the request successfully.

Step-by-Step Solution

1
Analyze the captured NIDS payload snippet
Identified URL-encoded SQL commands ('UNION SELECT username,password_hash FROM user_credentials--').
Recognizing database syntax within HTTP parameter inputs isolates the threat vector as SQL injection.
2
Determine the scope and target of the attack
The attack targets backend database content via an unformatted web request parameter.
Distinguishing database queries from client-side script payloads ensures proper incident classification.
3
Select the appropriate network monitoring triage step
Query SIEM and web application logs for corresponding HTTP status codes (e.g., 200 OK vs 500 Internal Error) and response payload size.
NIDS alerts indicate detection of request payloads; verifying response logs determines whether the vulnerability was successfully exploited.

Key Concept

NIDS Log Payload Analysis and Attack Triage
Question 11Question →

A systems administrator is configuring a newly deployed internal web portal to serve traffic over HTTPS using a certificate issued by the organization's Enterprise Certificate Authority (CA). Place the administrative steps in the correct chronological order required to successfully enroll and enable the TLS certificate on the web portal.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order for enrolling and enabling a TLS certificate is: 1) Generate the local key pair, 2) Construct the Certificate Signing Request (CSR) with public key and SAN, 3) Submit the CSR to the Certificate Authority (CA), 4) Import the issued X.509 certificate and intermediate trust chain onto the server, and 5) Bind the certificate to the web daemon HTTPS listener.
The correct order follows the standard PKI certificate lifecycle. The key pair must be generated on the destination server first to ensure private key protection. The public key is bundled with domain identity parameters (such as the SAN extension) into a CSR. The CSR is transmitted to the CA for signing. After the CA returns the signed X.509 leaf certificate along with intermediate CA certificates, they are imported to the server. Finally, the web service daemon is configured to bind the certificate to port 443 to accept secure incoming HTTPS connections.

Step-by-Step Solution

1
Generate Key Pair locally
A secure private key is retained locally while the matching public key is prepared for inclusion in the request.
Security best practices demand that private keys are generated locally on the end system to prevent key exposure during transit.
2
Create Certificate Signing Request (CSR)
A CSR payload containing identity details (SAN, CN) and the public key is produced.
The CSR acts as the standardized request format that the Certificate Authority processes.
3
Submit CSR to the Certificate Authority (CA)
The CA signs the public key and identity data using its own private key, producing a valid X.509 certificate.
Only a trusted CA can vouch for the authenticity of the server's public key.
4
Import Certificate and Intermediate Chain
The server stores the signed leaf certificate and establishes the chain of trust back to the root CA.
Clients connecting to the server require both the leaf certificate and intermediate certificates to validate the signature hierarchy.
5
Bind Certificate to Port 443 HTTPS Listener
The web daemon presents the installed certificate during incoming TLS handshakes.
Binding connects the network interface daemon to the stored certificate and corresponding private key.

Key Concept

PKI Certificate Lifecycle and CSR Enrollment Workflow
Question 12Question →

A hospital network evaluates the financial exposure associated with a potential ransomware incident targeting its central Picture Archiving and Communication System (PACS) database server cluster. The estimated Asset Value (AVAV) of the PACS cluster is $800,000\$800,000. Threat intelligence and risk assessment analysts determine that a ransomware outbreak would result in an Exposure Factor (EFEF) of 0.350.35 (35%35\%). Historical risk data indicates an Annualized Rate of Occurrence (AROARO) of 0.250.25 for this type of attack. What is the baseline Annualized Loss Expectancy (ALEALE), in US dollars, for the PACS database cluster prior to implementing any additional security controls?

Show answer & explanation

Answer: 70000

Answer

The baseline Annualized Loss Expectancy (ALE) for the PACS cluster is $70,000.
Quantitative risk calculations determine the expected annual financial loss (ALEALE) using two dependent steps: first computing the Single Loss Expectancy (SLE=AV×EF=$800,000×0.35=$280,000SLE = AV \times EF = \$800,000 \times 0.35 = \$280,000), and then scaling by the annual frequency (ALE=SLE×ARO=$280,000×0.25=$70,000ALE = SLE \times ARO = \$280,000 \times 0.25 = \$70,000).

Step-by-Step Solution

1
Calculate Single Loss Expectancy (SLE)
SLE=$280,000SLE = \$280,000
Single Loss Expectancy is calculated by multiplying the total Asset Value (AV=$800,000AV = \$800,000) by the Exposure Factor (EF=0.35EF = 0.35).
2
Calculate Annualized Loss Expectancy (ALE)
ALE=$70,000ALE = \$70,000
Annualized Loss Expectancy is calculated by multiplying the Single Loss Expectancy (SLE=$280,000SLE = \$280,000) by the Annualized Rate of Occurrence (ARO=0.25ARO = 0.25).

Key Concept

Quantitative Risk Assessment (ALE Calculation)
Question 13Question →

An enterprise network security team deploys a centralized RADIUS architecture to manage access to infrastructure devices. During a post-implementation audit, a security analyst notes the following behavior: when network administrators log in, the system successfully validates their multi-factor credentials. However, upon login, all authenticated administrators are granted identical, unrestricted administrative permissions across all switches and firewalls, regardless of their specific role or group membership in the directory service. Meanwhile, session start/end timestamps and data transfer metrics are accurately recorded in central logs. Which component of the AAA framework failed to be properly configured to restrict administrative privileges?

Show answer & explanation

Answer: Authorization controls enforcing role-based access limits

Answer

Authorization controls enforcing role-based access limits
Authorization is the AAA pillar responsible for granting or denying access rights and privileges to resources once an identity is verified. In this scenario, credentials are confirmed (Authentication) and sessions are logged (Accounting), but permissions are unconstrained due to missing or misconfigured role-based authorization controls.

Step-by-Step Solution

1
Analyze the AAA functions described in the enterprise scenario
Identity verification via multi-factor credentials succeeds (Authentication is functional). Session tracking and log metrics are recorded (Accounting is functional).
Differentiating between identity verification, permission granting, and logging is required to isolate the failure.
2
Identify the misconfiguration in permission assignment
All authenticated identities receive universal full access without evaluating specific user roles or directory attributes.
Determining permissions and enforcing principle of least privilege is the explicit responsibility of the Authorization pillar.
3
Select the missing or misconfigured AAA pillar
Authorization controls failed to enforce role-based access boundaries.
Without proper authorization policies (such as RADIUS VSAs or TACACS+ command authorization rules), authentication alone results in over-privileged access.

Key Concept

Role-based Authorization within AAA Framework
Question 14Question →

A network engineer notices that users connecting to the enterprise Wi-Fi are successfully validating their domain credentials against a centralized RADIUS server. However, after successful login, all users—including system administrators—are placed into a restricted guest VLAN instead of being assigned their appropriate department VLANs. Which aspect of the AAA framework is failing to execute correctly in this scenario?

Show answer & explanation

Answer: Assigning dynamic network access rights and group privileges upon successful identification

Answer

Assigning dynamic network access rights and group privileges upon successful identification
The scenario describes a successful authentication phase where the RADIUS server validates credentials. However, the system fails during the authorization phase because it does not apply role-based access rules or assign the correct network attributes (such as VLAN IDs) based on user permissions.

Step-by-Step Solution

1
Analyze the AAA phase results in the scenario.
Domain credential validation against RADIUS succeeded, confirming authentication is working.
Authentication verifies identity, which occurred without error.
2
Identify the point of failure after login.
Users are incorrectly assigned to a restricted guest VLAN regardless of their group roles.
Determining what resources or network segments a user can access post-login is authorization.
3
Match the failed function to the correct AAA component.
The failure to grant appropriate VLAN permissions is an authorization failure.
Authorization enforces access rights based on identity and policy.

Key Concept

Distinction between Authentication (verifying identity) and Authorization (granting permissions/access)
Question 15Question →

An automated algorithmic trading platform logs high-frequency order requests to an external compliance vault. Following a significant financial anomaly, a senior trader asserts that a series of unauthorized trades attributed to their user account were forged by a malicious internal microservice rather than initiated from their terminal. To resolve the dispute, the security audit team must provide irrefutable proof of the trader's authorship as well as guarantee that the order data was not tampered with after creation. Which of the following security mechanisms best fulfills these requirements?

Show answer & explanation

Answer: Digital signatures generated using the trader's asymmetric private key paired with a public key infrastructure timestamping service

Answer

Digital signatures generated using the trader's asymmetric private key paired with a public key infrastructure timestamping service
Digital signatures fulfill non-repudiation because they rely on asymmetric cryptography. Only the owner possesses the private key used to sign the transaction payload, creating a unique cryptographic proof of origin. Recipients verify signature validity using the sender's public key. Timestamping further ensures proof of existence at a specific time, preventing the trader from denying trade initiation.

Step-by-Step Solution

1
Analyze the operational security requirement in the compliance scenario
Identified the requirement for non-repudiation (proving authorship so the sender cannot deny originating the transaction) and integrity (ensuring the payload was not altered post-submission).
The trader claims an internal service forged their order, requiring cryptographic evidence that uniquely ties transaction creation to the trader.
2
Evaluate candidate cryptographic controls against non-repudiation principles
Asymmetric digital signatures uniquely bind the transaction payload to the private key owner, which cannot be forged by other services possessing only public keys or shared secrets.
Symmetric encryption and plain cryptographic hashes rely on shared keys or public hash functions, allowing any component with key access to build valid signatures and failing proof-of-origin tests.
3
Select the control combination providing both integrity and non-repudiation
Digital signatures with PKI timestamping satisfy both requirements.
The asymmetric private key guarantees non-repudiation of origin while hash-based digital signing guarantees message integrity.

Key Concept

Non-Repudiation vs Integrity in Asymmetric Cryptography
Question 16Question →

A network administrator configures a centralized syslog server to record user login timestamps, executed command histories, and session resource usage for auditing compliance. Which core component of the AAA framework is being implemented?

Show answer & explanation

Answer: Accounting

Answer

Accounting
Accounting is responsible for tracking user actions, monitoring session durations, and maintaining log entries of system resource consumption. This data provides accountability and essential records for security auditing.

Step-by-Step Solution

1
Identify the primary operational activity described in the scenario
The activity involves capturing timestamps, command histories, and system resource usage into log files.
Determining the functional goal (logging activity vs granting access vs checking credentials) isolates the correct AAA pillar.
2
Map the identified activity to the AAA framework pillars
Tracking usage data and generating audit logs directly corresponds to Accounting.
Accounting measures resource usage and collects audit information for billing, capacity planning, and security investigations.

Key Concept

Authentication, Authorization, and Accounting (AAA)
Question 17Question →

A network security administrator is evaluating access control mechanisms following an audit of an enterprise infrastructure. The current deployment utilizes RADIUS for network access control and TACACS+ for network device management. During the audit, management observed that while remote administrative login attempts are logged, the security team cannot verify which specific commands were executed by individual engineers on edge routers during maintenance sessions. Additionally, permission checks fail to evaluate individual command authorizations dynamically. Which TWO of the following architectural distinctions or protocol changes should the administrator implement to resolve these issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Migrate administrative router sessions to TACACS+, which decouples authentication, authorization, and accounting to support granular per-command authorization and accounting.; Implement TACACS+ command authorization profiles to evaluate each CLI command requested by an administrator against central policy before execution.

Answer

The administrator must migrate administrative sessions to TACACS+ to separate AAA services for per-command logging and implement TACACS+ command authorization profiles to dynamically check individual CLI commands before execution.
TACACS+ is designed specifically for device administration because it separates authentication, authorization, and accounting into independent functions. This separation enables network devices to send authorization queries to the server for every individual command an administrator attempts to execute and generate distinct accounting records for each executed command. The selections recommending TACACS+ session migration and command authorization profile enforcement directly fulfill these security objectives.

Step-by-Step Solution

1
Analyze the technical deficit described in the scenario
Identified missing granular command-level authorization and command execution accounting during administrative SSH/console sessions.
The scenario requires tracking specific executed CLI commands and controlling permission checks per command.
2
Evaluate protocol capabilities between RADIUS and TACACS+
RADIUS combines authentication and authorization and provides session-level accounting. TACACS+ separates AAA functions into distinct processes and encrypts all packet payloads.
Separating AAA allows TACACS+ to perform authorization checks for each individual command entered on a network device.
3
Select the appropriate controls to fulfill both requirements
Using TACACS+ for administrative sessions provides the required granular command accounting, while configuring command authorization profiles enforces per-command privilege checks.
These controls directly resolve the inability to track CLI command history and enforce fine-grained authorization.

Key Concept

AAA Protocol Differences (RADIUS vs. TACACS+ Granularity)
Question 18Question →

A security analyst is investigating an incident where an attacker compromised a low-privileged service account's API key. The API gateway successfully verified the key's digital signature and validated the identity of the service account. However, due to a missing role-mapping rule on the API gateway, the request was granted access to an internal database management endpoint intended exclusively for domain administrators. Additionally, because the gateway was configured to log only initial connection handshakes rather than detailed endpoint requests, security teams cannot determine which database commands were executed. Which of the following correctly identifies the AAA pillar that failed to restrict endpoint access, and the AAA pillar whose configuration deficiency prevents auditing the executed actions?

Show answer & explanation

Answer: Authorization failed to enforce role-based access restrictions, while Accounting failed to record endpoint transaction logs.

Answer

Authorization failed to enforce role-based access restrictions, while Accounting failed to record endpoint transaction logs.
The correct answer accurately separates the duties of the AAA framework. Authentication succeeded because the service account's API key signature was validated. Authorization failed because the gateway did not evaluate role boundaries or ACLs before granting access to the administrator endpoint. Accounting failed because the logging configuration captured only connection handshakes instead of granular transaction logs, preventing post-incident forensic analysis.

Step-by-Step Solution

1
Analyze the credential verification phase to evaluate Authentication.
The API gateway verified the digital signature and confirmed the service account identity. Authentication functioned correctly.
Authentication is strictly responsible for verifying identity claims using credentials, certificates, or tokens.
2
Analyze the endpoint access decision phase to evaluate Authorization.
Missing role-mapping rules allowed a low-privileged account to reach an admin endpoint. Authorization failed.
Authorization determines access rights, privileges, and resource permissions once identity is established.
3
Analyze the event tracking and auditing phase to evaluate Accounting.
Failure to log specific API endpoints and commands leaves no audit trail. Accounting failed.
Accounting logs subject activity, tracking resource consumption, commands executed, and session details for non-repudiation and analysis.

Key Concept

Distinct roles of Authentication (identity verification), Authorization (permission enforcement), and Accounting (activity logging and auditing) in AAA security architecture.
Question 19Question →

Match each social engineering attack vector on the left with its corresponding attack scenario description on the right.

Click a left item, then click its matching right item

Items

Typosquatting
Vishing
Watering Hole Attack

Matches

Show answer & explanation

Answer

Typosquatting pairs with registering domain names resembling enterprise portals to capture mistyped URL entries; Vishing pairs with phone calls pretending to be IT support soliciting passwords; Watering Hole Attack pairs with compromising a trusted industry-specific website visited by targeted personnel.
Each social engineering vector matches its specific operational mechanism: Typosquatting takes advantage of mistyped domain names, Vishing uses telephone-based pretexting, and Watering Hole attacks compromise trusted third-party websites visited by target groups.

Step-by-Step Solution

1
Identify the vector relying on domain name spelling errors.
Typosquatting matches the scenario where an attacker registers lookalike domain names to capture credentials from mistyped web addresses.
Typosquatting explicitly leverages common spelling mistakes made by end users.
2
Identify the voice-based social engineering vector.
Vishing matches the scenario where an attacker places phone calls pretending to be IT helpdesk personnel.
Vishing stands for voice phishing and is conducted over telephone or VoIP systems.
3
Identify the vector involving strategic website compromise.
Watering Hole Attack matches the scenario where a frequently visited industry news site is compromised to attack targeted users.
Watering hole attacks target a specific community by infecting a website known to be used by members of that community.

Key Concept

Social Engineering Delivery Vectors
Question 20Question →

A security operations team is deploying internal code-signing certificates generated through an enterprise two-tier PKI consisting of an offline root Certificate Authority (CA) and an online intermediate issuing CA. Developers submit Certificate Signing Requests (CSRs) for binary signing. During testing on isolated target systems that already have the offline root CA certificate installed in their trusted root store, verification fails because the operating system cannot build the certification path to validate the signature. Further inspection reveals that the intermediate CA certificate was neither bundled with the signature nor pre-installed on the target machines. Which of the following is the most appropriate action to resolve this certificate chain validation failure?

Show answer & explanation

Answer: Configure the AIA (Authority Information Access) extension in issued certificates to provide a reachable URI for the intermediate CA certificate.

Answer

Configure the AIA (Authority Information Access) extension in issued certificates to provide a reachable URI for the intermediate CA certificate.
Configuring the AIA (Authority Information Access) extension allows validating client software to fetch the missing intermediate CA certificate via HTTP or LDAP during path building. This enables the client to successfully construct and verify the full certificate chain from the end-entity code-signing certificate up to the offline root CA.

Step-by-Step Solution

1
Identify the cause of the trust chain validation failure.
Client systems have the offline root CA trusted, but cannot build the validation path because the intermediate CA certificate is missing.
PKI certificate validation requires a complete chain of trust from the end-entity certificate up through all intermediate CAs to an installed root CA.
2
Evaluate standard PKI mechanisms for resolving missing intermediate certificates.
The Authority Information Access (AIA) extension specifies pointers (URIs) where clients can dynamically retrieve intermediate CA certificates during path building.
Including the AIA extension enables automated certificate discovery and path construction without manual distribution of intermediate certificates to all endpoints.
3
Select the proper administrative resolution.
Configuring the AIA extension ensures clients can fetch the intermediate certificate and complete path building successfully.
This maintains the multi-tier hierarchy and offline status of the root CA while ensuring seamless signature validation.

Key Concept

Public Key Infrastructure (PKI) Certificate Chain Building and Authority Information Access (AIA)
Estimated Time:2m 0s
Page 1 / 112Next