All practice questions

Question 1Question →

A security operations center (SOC) analyst is performing forensic triage on endpoints following an enterprise network intrusion. Analyze the host and network telemetry artifacts, and match each malware classification on the left with its corresponding technical indicator of compromise (IoC) artifact on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Process Hollowing Trojan matches the artifact describing a suspended legitimate process unmapped and reloaded with malicious code; Network Worm matches the artifact detailing automated SMB scanning and self-propagation across network shares; Kernel-Mode Rootkit matches the SSDT function pointer modification in kernel memory; Fileless Cryptominer matches the WMI event subscription executing obfuscated PowerShell payloads in memory.

Each malware category corresponds precisely to its forensic telemetry signature: Process Hollowing Trojans inject code into suspended process shells; Network Worms self-propagate across network protocols (SMB/TCP 445); Kernel-Mode Rootkits alter OS kernel data structures like the SSDT; and Fileless Cryptominers execute memory-resident scripts via WMI/PowerShell without writing files to disk.

Step-by-Step Solution

1

Analyze the first telemetry artifact involving process suspension and memory unmapping.

Identify this mechanism as process hollowing, a technique used by Trojans to conceal malicious execution inside a legitimate process shell.

Process hollowing relies on creating a process in a suspended state, hollowing out its PE headers and sections, and replacing them with a malicious image.

2

Examine the second telemetry artifact detailing SMB TCP 445 scanning and autonomous replication.

Classify this self-propagating behavior as a Network Worm.

Worms are distinguished from Trojans and viruses by their ability to self-replicate across network protocols like SMB without user interaction.

3

Review the third artifact involving SSDT function pointer modifications.

Match this indicator to a Kernel-Mode Rootkit.

SSDT (System Service Descriptor Table) hooking occurs exclusively in kernel memory (Ring 0) to hijack OS API calls and hide malware presence.

4

Evaluate the final artifact featuring WMI event subscriptions and memory-only PowerShell commands.

Link this artifact to a Fileless Cryptominer.

Using WMI and encoded PowerShell scripts enables malware execution entirely in RAM, avoiding disk creation while consuming system CPU resources.

Key Concept

Distinguishing Malware Telemetry Artifacts and Indicators of Compromise

Question 2Question →

Match each third-party risk management agreement or contractual clause to its primary operational purpose.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The correct pairings match each third-party risk management agreement with its functional role: Interconnection Security Agreement (ISA) pairs with technical network connection requirements; Memorandum of Understanding (MOU) pairs with non-binding mutual expectations; Master Services Agreement (MSA) pairs with foundational governance and overarching legal terms; and Right-to-Audit Clause pairs with explicit authority to inspect vendor security operations.

Each agreement instrument fulfills a distinct governance role in third-party risk management. An ISA establishes specific technical security rules for interconnected networks. An MOU documents operational intent and mutual cooperation without binding financial obligations. An MSA provides the baseline legal framework for vendor relationships. A Right-to-Audit clause explicitly permits the customer to inspect and verify the vendor's security controls.

Step-by-Step Solution

1

Analyze technical data-sharing and connectivity mechanisms.

Identify that connecting two distinct networks directly requires formal technical protocols provided by an Interconnection Security Agreement (ISA).

Technical parameters, interface configurations, and data encryption for dedicated links are specifically defined within an ISA.

2

Differentiate formal contract instruments from non-binding agreements.

Recognize that general operational alignment without financial obligations is established through a Memorandum of Understanding (MOU), while overarching legal frameworks are governed by a Master Services Agreement (MSA).

MOUs express mutual goals without binding covenants, whereas MSAs define enforceable terms like indemnification, liability, and dispute mechanisms.

3

Evaluate enterprise oversight and verification mechanisms.

Pair the contractual right to perform security inspections with the Right-to-Audit Clause.

Without an explicit Right-to-Audit clause, organizations lack legal standing to inspect vendor infrastructure or demand internal security documentation.

Key Concept

Third-Party Risk Management Agreements and Governance Frameworks

Question 3Question →

Match each social engineering attack vector on the left with its corresponding attack scenario description on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Typosquatting pairs with registering domain names resembling enterprise portals to capture mistyped URL entries; Vishing pairs with phone calls pretending to be IT support soliciting passwords; Watering Hole Attack pairs with compromising a trusted industry-specific website visited by targeted personnel.

Each social engineering vector matches its specific operational mechanism: Typosquatting takes advantage of mistyped domain names, Vishing uses telephone-based pretexting, and Watering Hole attacks compromise trusted third-party websites visited by target groups.

Step-by-Step Solution

1

Identify the vector relying on domain name spelling errors.

Typosquatting matches the scenario where an attacker registers lookalike domain names to capture credentials from mistyped web addresses.

Typosquatting explicitly leverages common spelling mistakes made by end users.

2

Identify the voice-based social engineering vector.

Vishing matches the scenario where an attacker places phone calls pretending to be IT helpdesk personnel.

Vishing stands for voice phishing and is conducted over telephone or VoIP systems.

3

Identify the vector involving strategic website compromise.

Watering Hole Attack matches the scenario where a frequently visited industry news site is compromised to attack targeted users.

Watering hole attacks target a specific community by infecting a website known to be used by members of that community.

Key Concept

Social Engineering Delivery Vectors

Question 4Question →

An organization is categorizing its security controls based on CompTIA Security+ implementation categories (Technical, Managerial, Operational, Physical) and functional types (Preventive, Deterrent, Detective, Corrective, Compensating, Directive). Match each implemented security control on the left with its correct dual-classification on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Restoring backups matches Technical category and Corrective type; warning signs match Physical category and Deterrent type; security policy documentation matches Managerial category and Directive type; passive NIDS sensors match Technical category and Detective type.

Each mechanism aligns directly with its primary implementation axis and operational goal: system restoration via backups is Technical and Corrective; physical signage dissuading entry is Physical and Deterrent; administrative usage policies are Managerial and Directive; and passive network intrusion monitoring is Technical and Detective.

Step-by-Step Solution

1

Analyze each security control's implementation method to assign the category (Technical, Managerial, Operational, or Physical).

Backups and NIDS are Technical (systems/software); warning signs are Physical (facility fixtures); security policies are Managerial (administrative governance).

CompTIA Security+ defines categories based on how a mechanism is constructed and deployed.

2

Evaluate the functional goal of each security control within the incident timeline (Preventive, Deterrent, Detective, Corrective, Compensating, or Directive).

Backups restore lost state (Corrective); signs warn off intruders (Deterrent); policies mandate rules (Directive); NIDS identifies anomalies (Detective).

Functional types reflect what the control accomplishes when mitigating security risks.

3

Pair each security mechanism with its corresponding category and functional type pair.

All four pairs matched accurately without ambiguity.

Dual-axis classification evaluates implementation method alongside security goal.

Key Concept

Dual-axis security control classification under CompTIA Security+ SY0-701.

Question 5Question →

Match each core Zero Trust Architecture (ZTA) control plane component with its primary operational responsibility in accordance with NIST SP 800-207 standards.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Policy Engine pairs with evaluating access requests and making decision choices; Policy Administrator pairs with issuing control commands to manage sessions; Policy Enforcement Point pairs with gating and monitoring active connections in the data path.

Each Zero Trust Architecture component fulfills a distinct logical role specified in NIST SP 800-207: the Policy Engine acts as the decision maker, the Policy Administrator serves as the controller executing control plane commands, and the Policy Enforcement Point directly controls connection flows in the data plane.

Step-by-Step Solution

1

Identify the primary function of the Policy Engine.

Recognize that the Policy Engine is responsible for the trust decision logic.

It processes subject, resource, and environment attributes against security rules to evaluate access authorization.

2

Identify the primary function of the Policy Administrator.

Recognize that the Policy Administrator translates policy decisions into control signals.

It instructs the Policy Enforcement Point to open or close the specific session path.

3

Identify the primary function of the Policy Enforcement Point.

Recognize that the Policy Enforcement Point sits on the data plane.

It directly intercepts, enables, monitors, and terminates network connections between subjects and targets.

Key Concept

Zero Trust Architecture Control and Data Plane Components

Question 6Question →

Match each vulnerability assessment and security testing method on the left with its appropriate operational description on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Credentialed Vulnerability Scan pairs with using valid host credentials to inspect internal OS configurations and patches; Passive Vulnerability Monitoring pairs with capturing live network traffic packet streams without sending probes; Dynamic Application Security Testing (DAST) pairs with evaluating a running web application from an external perspective; Static Application Security Testing (SAST) pairs with analyzing uncompiled source code prior to application execution.

The methods align accurately with their operational characteristics: Credentialed scanning uses administrative access for internal system auditing; Passive monitoring sniffs network telemetry without active probing; DAST tests live executing applications externally; SAST analyzes static source code prior to deployment.

Step-by-Step Solution

1

Classify application security testing based on execution state.

Identify that SAST evaluates source code in a static state, whereas DAST requires a deployed, running application.

Execution state dictates whether analysis is conducted inside-out (source code) or outside-in (runtime testing).

2

Distinguish between authenticated system scanning and passive network monitoring.

Recognize that credentialed scans log into endpoints for internal inspection, while passive monitoring sniffs packet headers non-intrusively.

Credential access enables deep host-level configuration auditing, while passive capture avoids generating additional network overhead.

Key Concept

Vulnerability Assessment and Security Testing Methods

Question 7Question →

A security analyst is reviewing incident reports to classify different types of malicious software based on their core behavior and primary indicators of compromise. Match each malware type on the left with its corresponding technical indicator or defining behavior on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Ransomware matches file encryption with payment demands; Keylogger matches capturing keystrokes to steal credentials; Rootkit matches modifying kernel routines to conceal processes; Logic Bomb matches remaining dormant until a specific trigger condition occurs.

Each malware type is paired correctly with its defining behavior: Ransomware encrypts data for ransom, Keyloggers record input keystrokes, Rootkits modify OS kernel routines for stealth, and Logic Bombs execute payloads upon specific conditional triggers.

Step-by-Step Solution

1

Analyze Ransomware

Identify that its primary indicator is file encryption paired with a ransom note demanding payment for decryption keys.

Encryption of user files and ransom notifications are unique characteristics of ransomware.

2

Analyze Keylogger

Identify that its primary behavior is recording user input keystrokes.

Keyloggers focus specifically on harvesting input data like passwords and sensitive text.

3

Analyze Rootkit

Identify that its key feature is stealth gained through OS kernel/system file modification.

Rootkits hide presence and maintain administrative control deep within the operating system.

4

Analyze Logic Bomb

Identify that its defining trait is execution triggered by specific pre-defined events or conditions.

Logic bombs lie dormant until a designated trigger activates their payload.

Key Concept

Malware Classification and Telemetry Indicators

Question 8Question →

Match each threat actor type to its primary defining attribute or motivation in cybersecurity. Which pairings accurately reflect each threat actor profile?

Click a left item, then click its matching right item

Show answer & explanation

Answer

Nation-state actor matches high technical sophistication and geopolitical intent; Insider threat matches authorized access to internal systems; Hacktivist matches ideological or political motivation; Script kiddie matches low technical expertise relying on pre-existing tools.

Nation-state actors possess extensive funding and geopolitical objectives; insider threats hold existing authorized privileges; hacktivists are motivated by social or political causes; and script kiddies operate using unoriginal, pre-packaged exploit kits due to limited technical skills.

Step-by-Step Solution

1

Analyze each threat actor category based on their skill level, access rights, and underlying motivation.

Identified nation-state actors as high-resource entities, insiders as credentialed individuals, hacktivists as ideology-driven actors, and script kiddies as low-skilled tool users.

Distinguishing threat actor attributes is essential for accurate threat modeling and risk assessment.

Key Concept

Threat Actor Characteristics and Attributes

Question 9Question →

Match each enterprise security management scenario to the cloud service model that reflects its allocation of customer responsibilities under the Shared Responsibility Model.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Operating system patching and guest firewall configuration match Infrastructure as a Service (IaaS). Application logic and database access control configuration match Platform as a Service (PaaS). User identity governance and data loss prevention for pre-built applications match Software as a Service (SaaS). Event-driven code execution and trigger definitions match Function as a Service (FaaS).

Each cloud service model defines a distinct boundary of ownership under the Shared Responsibility Model: IaaS grants customer control over guest OS and virtual networking; PaaS isolates customer control to application logic and data schemas; SaaS restricts customer management to user access, data protection, and client devices; and FaaS delegates container scaling and OS maintenance to the provider while the customer provides serverless code functions.

Step-by-Step Solution

1

Analyze the customer control boundary for each administrative task scenario.

Tasks range from low-level OS management to high-level application access governance and serverless trigger setup.

The cloud shared responsibility model dictates customer responsibilities based on the abstraction layer of the chosen service model.

2

Associate lower-level infrastructure administration with compute-focused delivery models.

Guest operating system patching and virtual storage encryption belong to IaaS.

IaaS provides virtualized hardware resources where OS maintenance falls on the tenant.

3

Differentiate application runtime management from ephemeral execution.

Persistent application configuration maps to PaaS, while short-lived event-driven function management maps to FaaS.

PaaS abstracts OS management for hosted application frameworks, whereas FaaS abstracts long-running servers completely.

4

Identify complete vendor-hosted software management.

Turn-key applications where the customer manages only access permissions and data map to SaaS.

SaaS abstracts all infrastructure and software maintenance away from the cloud consumer.

Key Concept

Cloud Shared Responsibility Model across Service Models

Question 10Question →

Match each enterprise host, network, or architecture vulnerability scenario to its primary mitigation strategy.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Unpatched router firmware buffer overflow matches with virtual patching via NIPS; Plaintext switch management protocols match with disabling legacy services and enforcing SSHv2/HTTPS; Flat network architecture matches with re-architecting into segmented VLANs with firewall ACLs; EoL OT operating system matches with isolating the host in a restricted network zone via microsegmentation.

Each vulnerability is paired with its appropriate architectural or technical control: virtual patching defends unpatched firmware via inline NIPS inspection; SSHv2/HTTPS eliminates plaintext credential interception; network segmentation prevents lateral movement in flat topologies; and network isolation mitigates the inherent exposure of unpatchable EoL hosts.

Step-by-Step Solution

1

Analyze the firmware buffer overflow vulnerability on the legacy edge router.

Identify that because immediate software patching or device replacement may be delayed, virtual patching via NIPS signatures provides inline mitigation.

Virtual patching intercepts attack vectors at the network layer without modifying firmware.

2

Evaluate the risk of plaintext management protocols (Telnet/HTTP) on core switches.

Determine that migrating to encrypted management standards (SSHv2 and HTTPS) protects credentials from interception.

Plaintext protocols transmit credentials unencrypted across the network.

3

Assess the security impact of a flat enterprise network topology.

Recognize that dividing the network into segmented VLANs with firewall ACLs restricts lateral movement between compromised end-user nodes and backend databases.

Flat networks lack internal boundaries, exposing internal servers to host compromises elsewhere on the subnet.

4

Determine the risk mitigation for an End-of-Life host operating system.

Apply microsegmentation to isolate the unpatchable legacy host from general enterprise traffic.

EoL systems cannot be patched against new vulnerabilities, so compensating controls must restrict network reachability.

Key Concept

Host, Network, and Architecture Vulnerability Mitigations

Question 11Question →

A security analyst is selecting appropriate security assessment methodologies for an enterprise infrastructure audit. Match each vulnerability assessment and security testing method on the left to its corresponding operational characteristic on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Credentialed Vulnerability Scanning matches authenticated local access inspection; Static Application Security Testing (SAST) matches non-running source code evaluation; Dynamic Application Security Testing (DAST) matches runtime black-box executing application testing; Passive Infrastructure Monitoring matches non-intrusive traffic telemetry capture.

Each vulnerability assessment method is accurately paired with its core function: Credentialed Vulnerability Scanning uses privileged system logins to audit internal configurations and patch statuses; SAST evaluates source code in a non-running state; DAST probes functional applications during runtime from an external perspective; and Passive Infrastructure Monitoring observes network traffic without sending active probes.

Step-by-Step Solution

1

Categorize each methodology by execution state and access level.

Identify whether the testing method evaluates code offline, probes running application endpoints, uses privileged host credentials, or observes network traffic passively.

Security assessment techniques differ fundamentally based on whether they require administrative access, access to source code, active application execution, or packet sniffing capabilities.

2

Pair application security testing techniques (SAST and DAST) to their development phase and testing perspective.

SAST matches non-running source code evaluation (white-box/offline), while DAST matches black-box testing of an executing runtime application.

SAST analyzes static code logic during development, whereas DAST injects payloads into live running web services.

3

Pair infrastructure assessment techniques (Credentialed Scanning and Passive Monitoring) to their probing behavior.

Credentialed scanning matches authenticated host configuration and patch inspection, while passive monitoring matches non-intrusive traffic telemetry capture.

Credentialed scanning uses system privileges to log into endpoints directly, whereas passive monitoring observes traffic without transmitting active network packets.

Key Concept

Vulnerability Assessment and Security Testing Methods

Estimated Time:2m 0s

Question 12Question →

Match each cloud service model to the primary component managed by the enterprise customer under the cloud shared responsibility model.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Infrastructure as a Service (IaaS) matches guest operating system maintenance, installed application stacks, and virtual network security settings; Platform as a Service (PaaS) matches application source code and stored data; Software as a Service (SaaS) matches user credential management and data access permissions.

Each cloud service model defines clear boundaries for the shared responsibility model: IaaS requires customer configuration of guest operating systems and virtual networks; PaaS limits customer responsibility to application code and data management; SaaS restricts customer management strictly to user authentication and data access controls.

Step-by-Step Solution

1

Determine customer responsibilities for Infrastructure as a Service (IaaS).

IaaS leaves operating system management, virtual networking, and application security to the customer.

The provider only maintains physical servers, facilities, and the hypervisor layer.

2

Determine customer responsibilities for Platform as a Service (PaaS).

PaaS limits customer control to deployed application code and data.

The provider handles operating system administration, runtime environments, and database engines.

3

Determine customer responsibilities for Software as a Service (SaaS).

SaaS leaves user credentials and data access policies as the primary customer responsibilities.

The provider operates and secures the full application software stack.

Key Concept

Cloud Shared Responsibility Model across IaaS, PaaS, and SaaS service models.

Question 13Question →

A security analyst is reviewing endpoint telemetry and forensic artifacts across several compromised systems. Match each malware classification on the left with its corresponding technical indicator of compromise (IoC) or behavior on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Kernel-Mode Rootkit matches SSDT modification to hide processes; Fileless Malware matches executing payload directly in memory via VirtualAllocEx without disk artifacts; Logic Bomb matches dormant malicious script triggered by a specific event condition; User-Space Keylogger matches API hooking via SetWindowsHookEx with WH_KEYBOARD_LL.

Each malware classification is accurately paired with its distinct technical telemetry indicator: Kernel-mode rootkits manipulate kernel structures like SSDT; Fileless malware runs in memory using native process injection APIs without disk files; Logic bombs await specific logical condition triggers; Keyloggers register keyboard hooks like SetWindowsHookEx.

Step-by-Step Solution

1

Analyze telemetry indicating system-level modification and stealth mechanisms.

Identify that SSDT manipulation at the OS kernel level is characteristic of Kernel-Mode Rootkits.

Rootkits aim to maintain persistent access while cloaking their presence from monitoring tools via kernel hooking.

2

Evaluate memory-only execution signatures without file system footprint.

Correlate VirtualAllocEx injection into legitimate host processes to Fileless Malware.

Fileless malware avoids detection by traditional antivirus by running strictly in memory.

3

Identify event-driven execution triggers embedded in dormant code.

Associate conditional execution based on database changes or user actions with a Logic Bomb.

Logic bombs execute malicious code only when specific logical conditions are satisfied.

4

Examine input event interception telemetry.

Match SetWindowsHookEx keyboard hooking API calls to a User-Space Keylogger.

Keyloggers require mechanisms to intercept and record user inputs across applications.

Key Concept

Identifying Malware Types via Technical Telemetry and Indicators of Compromise (IoCs)

Question 14Question →

During a comprehensive security audit following a series of distinct security events across a global enterprise, threat intelligence analysts are categorizing observed activities by threat actor type, attributes, and primary attack vectors. Match each threat actor profile on the left with the enterprise scenario on the right that best exemplifies its characteristic capabilities, motivation, and attack vector.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Organized Crime Syndicate matches the double-extortion ransomware deployment; Malicious Insider matches the exfiltration of proprietary files using legitimate credentials following a passed-over promotion; Shadow IT / Unintentional Insider matches the unauthorized transmission of databases into an unvetted public cloud AI service; Nation-State APT matches the custom zero-day exploits and Living-off-the-Land persistence.

The correct pairings accurately map threat actor attributes to realistic attack vectors: Organized Crime Syndicate matches the financial extortion ransomware scenario; Malicious Insider matches authorized access abuse driven by internal grievance; Shadow IT / Unintentional Insider matches unsanctioned cloud tool adoption for business tasks; and Nation-State APT matches stealthy, highly sophisticated zero-day and LotL techniques for strategic persistence.

Step-by-Step Solution

1

Analyze threat actor motivations and sophistication levels

Identify financial intent for criminal syndicates, internal access/grievance for insiders, convenience/lack of policy awareness for unintentional actors, and stealth/strategic advantage for nation-states.

Threat actor attributes directly influence their choice of targets, tools, and vectors.

2

Evaluate attack vectors and operational indicators for each scenario

Ransomware and RaaS correlate to organized crime; authorized access abuse correlates to malicious insiders; unsanctioned SaaS usage correlates to shadow IT; zero-days and LotL tactics correlate to nation-state APTs.

Mapping indicators to actor capabilities allows precise classification during threat analysis.

3

Match each actor to its corresponding scenario based on intent, capability, and vector

Pair left_1 with right_2, left_2 with right_1, left_3 with right_3, and left_4 with right_4.

Each pairing represents the defining characteristics of that threat actor profile according to security domain standards.

Key Concept

Threat Actor Attributes, Motivations, and Attack Vectors

Question 15Question →

Match each social engineering attack vector to the enterprise incident scenario that best exemplifies its delivery method and tactics.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Watering Hole Attack matches the compromised industry news portal scenario; Voice Phishing matches the targeted helpdesk phone calls scenario; Typosquatting matches the character substitution domain replica scenario; Baiting matches the malware-laden USB drive parking lot scenario.

Each social engineering vector is uniquely aligned with its underlying vehicle: watering hole targets trusted third-party websites; vishing relies on phone-based social engineering and pretexting; typosquatting targets URL typing mistakes; and baiting exploits curiosity through physical media dropped in accessible areas.

Step-by-Step Solution

1

Analyze the watering hole vector.

Identified that watering hole attacks target websites frequented by a specific organization or demographic to compromise visitors.

Matching to the scenario involving a compromised niche industry news portal frequented by target contractors.

2

Analyze the voice phishing (vishing) vector.

Identified that vishing uses telephony infrastructure to impersonate trusted entities and manipulate victims.

Matching to the scenario involving targeted phone calls to helpdesk staff posing as executives.

3

Analyze the typosquatting vector.

Identified that typosquatting relies on mistyped URLs containing slight character variations.

Matching to the scenario involving a domain registered with subtle character substitutions.

4

Analyze the baiting vector.

Identified that baiting relies on physical or digital promises that entice victims through curiosity or financial incentive.

Matching to the scenario involving USB drives labeled with tempting titles left in a parking lot.

Key Concept

Social Engineering Attack Vectors and Vectors of Influence

Question 16Question →

An aerospace engineering enterprise recently completed a third-party technical audit of its internal infrastructure. Match each security weakness scenario on the left with the corresponding cryptographic or control vulnerability on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Each scenario correctly pairs with its underlying vulnerability: the unauthenticated AES-CBC portal matches the bit-flipping vulnerability; the firmware with identical keys matches key reuse from improper key management; SHA-1 signature verification matches the hash collision vulnerability; and 512-bit Diffie-Hellman negotiation matches weak key exchange implementation.

The correct pairings align each operational scenario with its underlying technical failure: CBC mode without MAC enables ciphertext bit manipulation; shared embedded keys breach isolation principles through key reuse; SHA-1 signature checks are susceptible to collision attacks; and 512-bit DH groups fail to withstand parameter cracking.

Step-by-Step Solution

1

Analyze the session token scenario using AES-CBC without MAC.

Identified bit-flipping vulnerability from unauthenticated cipher mode usage.

Without authentication tags (e.g., HMAC), CBC ciphertext bits can be modified by an adversary to predictably manipulate plaintext values upon decryption.

2

Evaluate the IoT firmware deployment containing a shared key pair.

Identified improper key management resulting in private key reuse.

Hardcoding and reusing a single private key across thousands of endpoints compromises all devices if a single unit is extracted and reverse-engineered.

3

Review the firmware update server using SHA-1 for signature validation.

Identified hash collision vulnerability inherent to deprecated digest algorithms.

SHA-1 is cryptographically broken due to practical collision attacks, allowing forged software binaries to pass verification.

4

Examine the VPN gateway accepting 512-bit Diffie-Hellman parameters.

Identified weak key exchange implementation with low parameter length.

512-bit DH key exchange parameters do not provide adequate work factor security and permit attackers to precompute discrete logs to recover session keys.

Key Concept

Identification and remediation of cryptographic protocol weaknesses and security control flaws

Estimated Time:2m 0s

Question 17Question →

A corporate security operations center is investigating four distinct security incidents involving social engineering vectors across physical, web, domain, and email boundaries. Match each incident description on the left with its corresponding social engineering attack classification on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The incident involving physical access through a restricted entry corresponds to Tailgating; the third-party news portal infection corresponds to a Watering Hole Attack; the domain registration using lookalike characters corresponds to Typosquatting (Homoglyph Attack); and the urgent executive wire transfer directive corresponds to Business Email Compromise (Executive Impersonation).

Each scenario maps directly to its specific social engineering attack vector: physical trailing without authorization is tailgating; compromising a trusted industry forum to infect visitors is a watering hole attack; registering visual lookalike domains with international characters is typosquatting via homoglyphs; and impersonating C-level executives to mandate wire transfers is Business Email Compromise.

Step-by-Step Solution

1

Analyze physical boundary security breach description

Identify that unauthenticated physical entry achieved by closely following authorized personnel is Tailgating.

Tailgating exploits social norms and physical proximity to bypass electronic entry controls.

2

Analyze web portal compromise incident description

Identify that compromising a specialized third-party site trusted and frequented by a target sector is a Watering Hole Attack.

Watering hole attacks leverage the target audience's routine browsing habits to execute drive-by downloads.

3

Analyze domain URL manipulation incident description

Identify that substituting visually indistinguishable foreign characters into a web address is a Homoglyph-based Typosquatting attack.

Typosquatting and homoglyphs exploit visual trickery in web addresses to deceive users during credential entry.

4

Analyze fraudulent financial email incident description

Identify that executive authority impersonation aimed at transferring corporate funds is Business Email Compromise (BEC).

BEC campaigns leverage organizational hierarchy and fake urgency to bypass standard approval checks.

Key Concept

Categorization of social engineering attack vectors across physical, web, domain, and email environments.

Estimated Time:2m 0s

Question 18Question →

A security analyst is establishing baseline service level objectives for system availability and recovery. Match each resiliency metric on the left with its corresponding definition on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Recovery Time Objective (RTO) pairs with maximum acceptable service disruption duration; Recovery Point Objective (RPO) pairs with maximum acceptable data loss time; Mean Time Between Failures (MTBF) pairs with average operational uptime before failure; Mean Time to Repair (MTTR) pairs with average time required to repair a failed component.

Each metric uniquely defines a specific resilience or availability constraint: RTO defines outage duration tolerance, RPO defines data loss age limits, MTBF calculates component reliability, and MTTR measures repair efficiency.

Step-by-Step Solution

1

Differentiate between time-to-recover metrics (RTO) and data-loss metrics (RPO).

RTO measures duration of downtime, while RPO measures volume/age of data loss.

RTO focuses on service restoration speed, whereas RPO focuses on data restoration limits.

2

Distinguish system reliability metrics (MTBF) from maintenance efficiency metrics (MTTR).

MTBF quantifies how long a system operates reliably without failing, while MTTR quantifies how quickly repairs are completed after a failure occurs.

MTBF reflects system durability, whereas MTTR reflects incident resolution speed.

Key Concept

High Availability and Resilience Metrics (RTO, RPO, MTBF, MTTR)

Question 19Question →

Match each enterprise security assessment requirement with the vulnerability scanning method or configuration best suited to satisfy it.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Each assessment scenario correctly maps to its ideal vulnerability assessment approach: evaluating remote endpoint drift locally without VPN overhead requires Agent-Based Scanning; assessing sensitive legacy OT systems without active probe disruption requires Passive Network Scanning; testing live web applications for runtime flaws requires Dynamic Application Security Testing (DAST); and conducting authenticated central scans across network hosts using domain privileges requires Credentialed Network-Based Scanning.

Matching each scanning scenario requires balancing assessment goals against operational constraints. Agent-based scanning minimizes network overhead for remote laptops by executing locally. Passive scanning prevents fragile OT system crashes by analyzing existing network traffic. Dynamic Application Security Testing (DAST) assesses live web applications without source code. Credentialed network scanning provides deep visibility into network-connected hosts using administrative accounts.

Step-by-Step Solution

1

Analyze the constraint of remote worker endpoints and VPN bandwidth limitations.

Local host execution is required to avoid heavy network traffic over VPN, pointing directly to agent-based assessment.

Agent-based assessment offloads processing and scan execution locally to the endpoint.

2

Evaluate the sensitivity of legacy Operational Technology (OT) equipment.

Active scanning packets can overload fragile legacy stacks; non-intrusive traffic inspection (passive scanning) is required.

Passive scanners observe mirror/SPAN ports without sending traffic to target OT controllers.

3

Determine the application security testing methodology for live web applications.

Black-box assessment of a running web application corresponds to Dynamic Application Security Testing (DAST).

DAST interacts with running application interfaces to detect runtime flaws.

4

Identify the network scan configuration utilizing elevated permissions across a LAN.

Connecting remotely over the network with administrative privileges describes credentialed network scanning.

Credentialed network scans leverage administrative access over network management protocols to inspect internal configurations.

Key Concept

Vulnerability Scanning Methodologies and Deployment Models

Question 20Question →

Match each hardware security mechanism on the left to its corresponding primary functional capability on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Self-Encrypting Drive (SED) matches hardware-level full-disk encryption; Physically Unclonable Function (PUF) matches key derivation from unique silicon variations; Hardware Security Module (HSM) matches centralized high-throughput cryptographic operations and key management; Baseboard Management Controller (BMC) matches isolated out-of-band system administration.

Each hardware component aligns with its dedicated role: SEDs provide disk-level encryption, PUFs derive device identity from silicon manufacturing variances, HSMs manage enterprise crypto operations centrally, and BMCs provide out-of-band system management capabilities.

Step-by-Step Solution

1

Analyze Self-Encrypting Drive (SED)

Matched SED to transparent controller-level storage encryption.

SEDs feature built-in cryptoprocessors to encrypt stored blocks automatically without operating system assistance.

2

Analyze Physically Unclonable Function (PUF)

Matched PUF to key generation via semiconductor physical variance.

PUF technology exploits tiny, random physical variations introduced during silicon wafer fabrication to form a digital fingerprint.

3

Analyze Hardware Security Module (HSM)

Matched HSM to enterprise cryptographic offloading and key lifecycle management.

HSMs securely store master keys and execute sensitive cryptographic functions in centralized, high-security hardware.

4

Analyze Baseboard Management Controller (BMC)

Matched BMC to isolated out-of-band hardware management.

BMCs connect to dedicated management networks to enable remote server maintenance regardless of main CPU or OS performance.

Key Concept

Hardware Security Mechanisms and Embedded System Architecture

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept