Examkin

All practice questions

173 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1Question →

A systems administrator is configuring a newly deployed internal web portal to serve traffic over HTTPS using a certificate issued by the organization's Enterprise Certificate Authority (CA). Place the administrative steps in the correct chronological order required to successfully enroll and enable the TLS certificate on the web portal.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order for enrolling and enabling a TLS certificate is: 1) Generate the local key pair, 2) Construct the Certificate Signing Request (CSR) with public key and SAN, 3) Submit the CSR to the Certificate Authority (CA), 4) Import the issued X.509 certificate and intermediate trust chain onto the server, and 5) Bind the certificate to the web daemon HTTPS listener.
The correct order follows the standard PKI certificate lifecycle. The key pair must be generated on the destination server first to ensure private key protection. The public key is bundled with domain identity parameters (such as the SAN extension) into a CSR. The CSR is transmitted to the CA for signing. After the CA returns the signed X.509 leaf certificate along with intermediate CA certificates, they are imported to the server. Finally, the web service daemon is configured to bind the certificate to port 443 to accept secure incoming HTTPS connections.

Step-by-Step Solution

1
Generate Key Pair locally
A secure private key is retained locally while the matching public key is prepared for inclusion in the request.
Security best practices demand that private keys are generated locally on the end system to prevent key exposure during transit.
2
Create Certificate Signing Request (CSR)
A CSR payload containing identity details (SAN, CN) and the public key is produced.
The CSR acts as the standardized request format that the Certificate Authority processes.
3
Submit CSR to the Certificate Authority (CA)
The CA signs the public key and identity data using its own private key, producing a valid X.509 certificate.
Only a trusted CA can vouch for the authenticity of the server's public key.
4
Import Certificate and Intermediate Chain
The server stores the signed leaf certificate and establishes the chain of trust back to the root CA.
Clients connecting to the server require both the leaf certificate and intermediate certificates to validate the signature hierarchy.
5
Bind Certificate to Port 443 HTTPS Listener
The web daemon presents the installed certificate during incoming TLS handshakes.
Binding connects the network interface daemon to the stored certificate and corresponding private key.

Key Concept

PKI Certificate Lifecycle and CSR Enrollment Workflow
Question 2Question →

An enterprise infrastructure team is deploying an out-of-band Network Security Monitoring (NSM) sensor to monitor network perimeter traffic without introducing inline latency. Place the operational steps for establishing and validating this monitoring capability in the correct sequential order from initial network tap setup to final alert validation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational deployment sequence is: first, configure a hardware TAP or SPAN port on the core switch; second, connect the mirrored feed to a sensor interface in promiscuous mode; third, configure protocol parsing rules and detection signatures; and fourth, transmit synthetic test traffic to verify alert ingestion.
Establishing an out-of-band Network Security Monitoring (NSM) capability follows a logical progression: duplicating traffic via TAP/SPAN ports, connecting the stream to a sensor interface operating in promiscuous mode, activating NIDS detection signatures to digest packets, and finally performing synthetic traffic generation to validate that alerts successfully trigger and flow into security operations management platforms.

Step-by-Step Solution

1
Establish traffic mirroring
Network traffic is replicated to an isolated monitoring port without impacting inline flow.
Out-of-band network monitoring requires duplicating packet streams at the physical or data link layer first.
2
Bind feed to sensor interface in promiscuous mode
The sensor network interface card accepts all frames passed from the switch.
Without promiscuous mode, the NIC drops frames not explicitly addressed to its own MAC address.
3
Load detection signatures and parsers
The NIDS engine actively inspects incoming stream data against signatures and behavioral baselines.
Parsing logic must be active to extract telemetry and identify threat indicators from captured packets.
4
Execute end-to-end synthetic testing
Generated test indicators trigger expected alerts that appear in the central log repository.
Synthetic validation confirms complete pipeline connectivity from network capture to SOC alerting.

Key Concept

Out-of-band network security monitoring architecture and validation sequence
Question 3Question →

An organization is updating its cybersecurity procedures to follow the standard NIST SP 800-61 incident response framework. In which sequential order should the cybersecurity team execute the four primary phases of the incident response lifecycle from beginning to end?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order of the NIST incident response lifecycle phases is Preparation, followed by Detection and Analysis, followed by Containment, Eradication, and Recovery, and ending with Post-Incident Activity.
According to the NIST SP 800-61 guidelines, the standard incident response lifecycle proceeds sequentially through four main phases: Preparation (setting up plans and capabilities), Detection and Analysis (discovering and investigating the security event), Containment, Eradication, and Recovery (limiting impact, eliminating the threat, and restoring systems), and Post-Incident Activity (reviewing lessons learned to refine future response).

Step-by-Step Solution

1
Identify the proactive groundwork phase
Preparation is established as the necessary starting phase before any active incident occurs.
An organization must prepare infrastructure, policies, and response capabilities prior to detecting an attack.
2
Determine the initial reactive phase during an active event
Detection and Analysis follows Preparation.
Once an incident occurs, the team must detect indicators of compromise and analyze logs to confirm the event.
3
Identify the active remediation phase
Containment, Eradication, and Recovery comes third.
After confirming the incident, immediate containment limits damage, eradication removes threat elements, and recovery restores normal operations.
4
Identify the wrap-up and review phase
Post-Incident Activity is the final phase.
Lessons learned and post-mortem analysis can only be completed after systems are fully recovered and stabilized.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Phases
Question 4Question →

An Incident Response Team (IRT) responds to a active command-and-control (C2) beaconing alert on a critical internal database server. Place the following incident response actions in the correct sequential order according to the standard NIST SP 800-61 incident response lifecycle, starting with the earliest action.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential sequence follows the NIST SP 800-61 lifecycle: Network Isolation (Containment) -> Volatile Memory Capture (Evidence Preservation) -> Malware/Persistence Removal (Eradication) -> Clean Backup Restoration (Recovery) -> Lessons-Learned Session (Post-Incident Activity).
Under NIST SP 800-61, incident response progresses strictly through Containment (network isolation), Forensic Evidence Preservation (memory acquisition), Eradication (malware and backdoor removal), Recovery (system restoration from clean backups), and Post-Incident Activity (lessons learned review).

Step-by-Step Solution

1
Execute initial containment by disconnecting the host from the network
Stops active C2 communications and prevents lateral movement.
Containment limits incident scope and stops ongoing damage immediately.
2
Preserve volatile evidence
Obtains volatile RAM and process state while the system remains intact.
Evidence collection must occur before system modifications corrupt forensic artifacts.
3
Perform system eradication
Removes malicious software, persistence mechanisms, and compromise artifacts.
Eradication ensures the adversary cannot re-establish control once restored.
4
Execute operational recovery
Restores database operations from known-good backups and reinstates production status under heightened monitoring.
Recovery safely returns services to production after confirming eradication.
5
Conduct post-incident review (lessons learned)
Identifies root cause, updates playbooks, and addresses operational gaps.
Post-incident analysis improves organizational resilience against future incidents.

Key Concept

NIST SP 800-61 Incident Response Lifecycle
Question 5Question →

An enterprise Security Operations Center (SOC) identifies anomalous database queries originating from an authenticated SSL/TLS VPN remote user session outside of normal business hours. Place the following incident response actions in the correct chronological order from first step to last step according to the standard NIST Incident Response Lifecycle.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence according to the NIST Incident Response Lifecycle is: 1. Analyze logs and correlate alerts (Detection and Analysis), 2. Terminate VPN sessions and isolate database servers (Containment), 3. Revoke compromised credentials and remove persistence mechanisms (Eradication), 4. Restore systems from clean backups and enforce MFA reset (Recovery), and 5. Conduct a post-incident review meeting to update playbooks (Post-Incident Activity).
Standard incident response frameworks (such as NIST SP 800-61 Rev. 2) define a sequential lifecycle: Detection & Analysis, Containment, Eradication, Recovery, and Post-Incident Activity. Security teams must first validate indicators to establish scope (Detection & Analysis), immediately restrict attacker access and isolate affected assets (Containment), eliminate threat artifacts and vulnerabilities (Eradication), restore systems to production under secure conditions (Recovery), and finally document lessons learned to improve playbooks (Post-Incident Activity).

Step-by-Step Solution

1
Identify Detection and Analysis activities
Analyzing VPN logs and SIEM data verifies the unauthorized access and determines the scope of compromise.
Responders must validate that a security incident has occurred and understand its footprint prior to executing operational containment.
2
Identify Containment activities
Terminating active connections and isolating hosts halts active malicious actions and prevents network spread.
Containment limits operational damage while security personnel plan and execute permanent threat eradication.
3
Identify Eradication activities
Revoking compromised tokens, removing backdoor mechanisms, and applying security patches eliminates the adversary's presence.
Eradication removes the root cause so affected hosts can be re-introduced to production safely.
4
Identify Recovery activities
Restoring database systems from known-good backups and re-enabling access brings business operations back online.
Recovery validates system integrity and resumes normal business capabilities under enhanced monitoring.
5
Identify Post-Incident Activity
Conducting a debrief session and updating playbooks documents response efficacy and lessons learned.
Post-incident review improves operational readiness and updates incident response playbooks for future events.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Phases
Estimated Time:1m 30s
Question 6Question →

A security engineer is configuring a Service Provider-initiated SAML 2.0 Single Sign-On (SSO) integration between an enterprise SaaS application (Service Provider) and an external cloud Identity Provider (IdP) with mandatory MFA. In what order should the steps occur to complete a secure authentication and access flow?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with the user requesting access at the Service Provider, followed by the SP generating a SAML AuthnRequest and redirecting the browser to the Identity Provider. Next, the IdP authenticates the user credentials and MFA challenge. After authentication succeeds, the IdP sends a signed SAML response to the SP Assertion Consumer Service endpoint. Finally, the SP validates the signature and token claims before creating the local session.
In a Service Provider (SP)-initiated SAML 2.0 Single Sign-On sequence, the workflow must start at the resource endpoint (SP), redirect to the identity repository (IdP) for credential and MFA verification, return a signed SAML assertion token to the Assertion Consumer Service (ACS) endpoint, and end with cryptographic validation and local session establishment by the SP.

Step-by-Step Solution

1
Identify the initiation point for Service Provider (SP)-initiated SSO
The unauthenticated client request to the application triggers the creation of a SAML AuthnRequest payload.
In SP-initiated flows, access attempts at the target application must precede redirection.
2
Trace the HTTP redirect sequence
The user's browser transfers the AuthnRequest parameter to the IdP endpoint.
The browser acts as the user-agent bridge carrying authentication requests between decoupled domains.
3
Perform centralized identity verification and policy enforcement
The IdP processes primary credentials and enforces secondary MFA challenges.
Authentication and policy evaluation take place entirely on the trusted Identity Provider.
4
Return the signed security token via browser redirect/POST
The IdP constructs a SAML assertion signed with its private key and sends it to the SP Assertion Consumer Service (ACS).
The ACS endpoint is designed to receive and parse federated identity assertions.
5
Validate cryptographic trust and grant local application authorization
The SP checks the IdP's public certificate signature, expiration timestamps, and recipient claims before granting access.
Verification prevents SAML response spoofing and token replay attacks.

Key Concept

SAML 2.0 SP-Initiated SSO Authentication Flow
Question 7Question →

An enterprise web application experienced an unrecoverable infrastructure failure at its primary facility. The incident response team must execute the disaster recovery plan to activate the secondary warm site and minimize service disruption. In what chronological order should the administrator execute the following steps to complete the failover securely while preserving data integrity?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with declaring the disaster, followed by applying pending transaction logs to reach RPO consistency, promoting the standby database replica to read-write mode, running synthetic validation health checks, and finally updating external DNS records to route user traffic.
The proper disaster recovery sequence balances data protection with operational availability. First, formal disaster declaration initiates the procedure. Second, pending database logs are applied to guarantee data integrity up to the defined RPO. Third, the database replica is promoted to read-write primary status. Fourth, health and security validation checks verify system integrity. Fifth, external DNS records are redirected to route live client traffic to the secondary facility.

Step-by-Step Solution

1
Initiate administrative failover authorization
Disaster declaration triggers authorized BCP workflows.
Technical failover tasks should not begin without official management invocation of the plan.
2
Reconcile database logs to satisfy RPO
Outstanding transaction logs are fully committed to the standby instance.
Ensures no data loss occurs prior to promoting the database instance.
3
Promote database instance role
Standby database becomes the active primary read-write database.
Application services require write access to backend storage to fulfill user requests.
4
Perform synthetic operational verification
Application dependencies and health indicators are validated.
Prevents routing users to a partially failed or corrupted secondary environment.
5
Cut over global user routing
DNS records point external users to the new active endpoint.
Directing user traffic is the final cutover mechanism after backend readiness is confirmed.

Key Concept

Disaster Recovery Failover Sequence and RPO/RTO Alignment
Estimated Time:1m 30s
Question 8Question →

A security engineer is configuring a newly deployed Security Information and Event Management (SIEM) system to ingest and analyze multi-source telemetry across the enterprise network. Arrange the core stages of the SIEM log processing pipeline in the correct sequential order from initial intake to operational notice.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of stages in the SIEM log processing pipeline is: Log Collection, Parsing, Normalization, Correlation, and Alerting.
The SIEM log processing pipeline must ingest raw logs before evaluating them. Log Collection receives raw telemetry from source hosts. Next, Parsing extracts discrete fields from unformatted text strings. Once parsed, Normalization maps those fields into a uniform taxonomy so events from different vendors can be understood under a single schema. Correlation then evaluates these normalized events across time windows and sources against threat rules. Finally, Alerting notifies security analysts when rule conditions are satisfied.

Step-by-Step Solution

1
Identify the initial intake phase of event data
Log Collection gathers raw telemetry from endpoints, network devices, and security controls.
Before any processing can begin, raw logs must be collected from their original sources.
2
Structure the unformatted log text into defined fields
Parsing breaks down raw strings into structured data elements like IP addresses, timestamps, and action codes.
SIEM systems cannot efficiently search or evaluate unstructured text without extracting key attributes.
3
Standardize variable field naming across disparate vendor formats
Normalization converts heterogeneous fields (e.g., 'src_ip' vs 'source_address') into a single common schema.
Correlation rules require uniform field names to effectively compare events from different vendors.
4
Evaluate uniform log data against security logic and threat indicators
Correlation cross-examines normalized events to identify suspicious patterns and multi-host activity.
Rule matching must operate on standardized, parsed telemetry to produce reliable threat detection.
5
Notify analysts or triggering automated incident response mechanisms
Alerting dispatches high-priority tickets or push notices for identified threats.
Alerting occurs only after correlation engines determine that specific event thresholds or rules have been triggered.

Key Concept

SIEM Log Processing Pipeline
Question 9Question →

An administrator is designing a multi-tiered secure network path to allow external management traffic to reach a critical database server. Arrange the network segments in the correct order that incoming administration traffic must traverse, starting from the least secure network segment to the most secure network segment.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

Management traffic flows sequentially from the External Management Network, through the Perimeter Screened Subnet (DMZ), into the Internal Application Zone, and finally terminates at the Restricted Database Segment.
Secure network design relies on defense-in-depth by enforcing strict zone boundaries. Traffic originating from an untrusted external network must first pass through a screened subnet (DMZ) hosting jump boxes, transition through internal application tiers, and finally reach the restricted database segment, moving sequentially from the least secure to the most secure zone.

Step-by-Step Solution

1
Identify the origin point of the traffic flow.
The External Management Network is identified as position 1.
External networks lack perimeter controls and represent the untrusted starting point.
2
Identify the initial perimeter security boundary.
Traffic transitions to the Perimeter Screened Subnet (DMZ) as position 2.
Bastion hosts in the DMZ authenticate and inspect incoming sessions before granting access to internal zones.
3
Determine the next internal layer in the zone hierarchy.
Traffic enters the Internal Application Zone as position 3.
Internal application tiers reside behind perimeter firewalls within the trusted enterprise boundary.
4
Identify the most isolated internal enclave.
Traffic terminates at the Restricted Database Segment as position 4.
Databases require maximum defense-in-depth protection and are placed in the innermost restricted tier.

Key Concept

Defense-in-depth network zoning and transit ordering
Question 10Question →

A security administrator is documenting the secure network transit path for a remote system administrator to access a sensitive internal database server via a bastion host. Arrange the following network zones in order from the initial connection point (least secure/untrusted external) to the final destination (most secure internal target).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct network path order from external origin to secure target is: External Public Internet, Perimeter Screened Subnet (DMZ), Bastion Host Management Subnet, and Isolated Backend Database Zone.
The proper administrative connection flow follows defense-in-depth segmentation principles: the remote session starts on the untrusted External Public Internet, enters the Perimeter Screened Subnet (DMZ), authenticates at the Bastion Host Management Subnet, and finally proxies through to the Isolated Backend Database Zone.

Step-by-Step Solution

1
Identify the origin of the remote traffic flow.
The connection starts on the External Public Internet.
Remote administrative requests originate outside the enterprise network boundary.
2
Determine the external boundary entry point.
Traffic enters the Perimeter Screened Subnet (DMZ).
External requests must pass through perimeter security controls before reaching internal management components.
3
Identify the intermediary administrative proxy host zone.
Traffic reaches the Bastion Host Management Subnet.
Secure network architecture mandates terminating administrative sessions on an isolated jump box rather than allowing direct access to backend servers.
4
Identify the final protected target network zone.
The session completes at the Isolated Backend Database Zone.
The database subnet is completely isolated from the internet and accepts connections only from authenticated bastion hosts.

Key Concept

Bastion Host Jump Box and Network Zone Transit Sequence
Estimated Time:45s
Question 11Question →

An organization deploys a centralized Security Information and Event Management (SIEM) platform to monitor enterprise infrastructure. In what sequence does a security log event travel through the SIEM pipeline from initial creation to analyst notification?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of log processing within a SIEM pipeline is: Event Generation -> Log Forwarding -> Parsing and Normalization -> Event Correlation -> Alert Generation.
Log processing follows a logical pipeline: an event must first be generated locally on an endpoint, forwarded to central storage, parsed into standard fields so multi-source data is consistent, evaluated by correlation engines against threat rules, and finally escalated as an alert when suspicious activity is detected.

Step-by-Step Solution

1
Identify the initial event creation step
The local system logs the event.
Data processing starts when an application or host creates a log entry locally.
2
Identify the transmission step
Log agents forward the entry to the SIEM.
Centralized SIEM analysis requires log entries to be transmitted over the network.
3
Identify the data structuring step
The SIEM parses and normalizes the log data into standardized fields.
Heterogeneous vendor logs must be converted into common schemas before cross-source rule matching.
4
Identify the detection rule evaluation step
The correlation engine checks normalized logs against security rules.
Rule matching identifies indicators of compromise across correlated data streams.
5
Identify the final output step
The SIEM generates a security alert.
Notifications are created after correlation conditions are met to notify security staff.

Key Concept

SIEM Log Processing Pipeline Lifecycle
Question 12Question →

A security engineer is optimizing an enterprise Security Information and Event Management (SIEM) data ingestion pipeline to handle heterogeneous log streams from firewalls, web proxies, and endpoint agents. To perform cross-source security analytics without overwhelming system storage or failing complex detection logic, incoming event data must pass through sequential processing phases. What is the correct sequential order of log processing stages within the SIEM pipeline, from initial raw data ingestion to final security analyst escalation?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of SIEM log processing stages is: Field Parsing -> Schema Normalization -> Aggregation and Deduplication -> Correlation Engine Evaluation -> Alert Generation and SOAR Dispatch.
The correct operational workflow of a SIEM log processing architecture follows a logical progression: 1) Field Parsing converts unstructured raw log strings into structured data elements. 2) Schema Normalization standardizes field attributes into a common schema. 3) Aggregation and Deduplication reduces volume by combining repetitive events. 4) Correlation Engine Evaluation compares normalized multi-source events against detection rules and threat intelligence. 5) Alert Generation and SOAR Dispatch creates actionable analyst alerts and triggers automated incident response.

Step-by-Step Solution

1
Identify the initial transformation required on raw syslog and log strings
Raw logs must first undergo Field Parsing to break down unformatted text into structured key-value pairs.
SIEM processing engines cannot analyze raw strings until variables are parsed into discrete fields.
2
Determine how heterogeneous vendor logs are aligned
Extracted fields undergo Schema Normalization to standardize field names across different log vendors into a unified model.
Correlation rules require standardized field names regardless of whether the log originated from a Windows host, Linux server, or Palo Alto firewall.
3
Identify the data reduction stage prior to heavy analytic processing
Normalized events undergo Aggregation and Deduplication.
Filtering duplicate log floods within sliding time windows conserves compute resources before evaluating complex rules.
4
Determine where multi-source security threat detection occurs
Clean, normalized, and aggregated events are passed to the Correlation Engine for rule matching.
Correlation logic depends on historical and real-time cross-source data formatted in a common structure.
5
Identify the output action resulting from a positive detection match
Alert Generation and SOAR Dispatch occurs.
Once correlation conditions fire, the pipeline outputs an actionable alert to analysts or triggers automated mitigation playbooks.

Key Concept

SIEM Log Processing Pipeline Lifecycle
Question 13Question →

A Security Operations Center (SOC) analyst receives a high-severity Endpoint Detection and Response (EDR) alert indicating an active living-off-the-land attack where a compromised workstation is attempting lateral movement via WMI and fileless memory injection. Arrange the following incident response containment and forensic actions in the correct sequential order from first step to last step.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence places host network isolation first, followed by volatile memory collection, active process tree termination, and finally fleet-wide IOC ban rule enforcement.
In security incident response workflows, immediate containment of lateral movement is prioritized first by applying EDR network host isolation. Next, adherence to the order of volatility dictates collecting RAM and process dumps prior to killing active processes. Once volatile evidence is safely captured, active malicious process trees are terminated to stop local adversary activity. Finally, extracted IOCs are distributed enterprise-wide as EDR ban rules to protect remaining fleet endpoints.

Step-by-Step Solution

1
Isolate host using EDR network containment tools.
Network traffic to and from the host is restricted to the EDR cloud sensor, immediately stopping lateral movement.
Containment is the immediate priority during active lateral movement attacks to limit blast radius.
2
Trigger remote volatile RAM and process dump collection.
Volatile memory evidence is stored safely before process alteration.
Order of volatility requires capturing RAM and volatile evidence before altering system memory state.
3
Kill malicious processes and injected execution threads.
Malicious code execution on the endpoint ceases completely.
Terminating processes stops ongoing attacker activity without losing evidence previously captured in Step 2.
4
Distribute IOC ban rules across all enterprise EDR endpoints.
Enterprise-wide protection is established against the identified attack signature.
Remediation and preventive policy enforcement ensure fleet-wide protection after containment.

Key Concept

EDR Incident Containment Sequence & Volatility Management
Question 14Question →

An enterprise Security Operations Center (SOC) team is configuring an automated playbook within their Endpoint Detection and Response (EDR) solution to respond to an active ransomware outbreak involving credential dumping and process injection. Place the incident response steps in the correct operational order from initial containment through complete host restoration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper operational sequence begins with network isolation via the EDR agent, followed by volatile memory collection, process tree termination and token revocation, enterprise-wide IOC block rule propagation, and finally system integrity remediation prior to network restoration.
The correct sequence prioritizes halting threat spread first through EDR agent network isolation, preserving perishable volatile memory next before process termination, killing active malicious code execution third, deploying global block rules to protect other network assets fourth, and finally cleaning host artifacts before restoring network connectivity.

Step-by-Step Solution

1
Isolate the endpoint network connection via EDR software filters.
Halts lateral spread and data exfiltration instantly while keeping EDR communication open.
Immediate containment is mandatory prior to evidence collection or termination.
2
Acquire volatile memory image (RAM capture).
Preserves volatile injected DLLs, unwritten encryption keys, and active process handles.
Terminating malicious processes prior to memory capture permanently destroys critical forensic artifacts.
3
Kill malicious process tree and revoke associated session credentials.
Stops threat execution on the endpoint.
Active threat execution must be halted once volatile forensic data is secured.
4
Propagate newly identified file hashes and network indicators to the global EDR tenant block list.
Protects all uncompromised endpoints across the organization.
Global containment prevents lateral reinfection across non-isolated endpoints.
5
Remediate modified system binaries, verify baseline integrity, and remove host network isolation.
Returns the endpoint safely to normal operational status.
Host un-isolation should only occur after complete cleanup and integrity verification.

Key Concept

EDR Incident Response Playbook Sequencing
Question 15Question →

An enterprise Endpoint Detection and Response (EDR) system alerts a security analyst to an active malicious code injection on a user workstation. Sequence the standard EDR response steps from initial detection to host restoration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with initial behavioral detection and alerting, followed by immediate endpoint network isolation, process termination and forensic telemetry collection, and concludes with host restoration.
The proper incident response workflow following an EDR alert begins with detection, moves immediately to containment (host network isolation), proceeds to eradication and evidence capture (terminating processes and dumping memory), and finishes with recovery (restoring endpoint network access).

Step-by-Step Solution

1
Identify initial threat detection
The EDR agent flags anomalous activity and alerts analysts.
Incident response workflows begin with detection and triage.
2
Contain the threat
Network isolation is applied to the workstation via EDR.
Immediate containment prevents lateral spread while maintaining management connectivity.
3
Eradicate and analyze
Malicious processes are killed and process/memory telemetry is gathered.
Stopping threat activity and capturing volatile evidence enables root cause analysis without losing host context.
4
Restore host operations
The endpoint is verified secure and un-isolated.
Host network access is restored only after containment, investigation, and cleanup are complete.

Key Concept

EDR Incident Containment and Response Sequence
Question 16Question →

A network security architect is designing an ingress traffic transit flow for an enterprise application processing sensitive financial data. External client traffic must traverse multiple physical and logical security zones to interact with the backend database while enforcing strict North-South and East-West control boundaries. Arrange the following network security architecture traversal steps in the correct sequential order from the initial external inbound packet arrival to the final payload processing at the database host.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of network security traversal from untrusted ingress to the isolated database host is: 1) Edge perimeter router stateless packet filtering/DDoS mitigation, 2) DMZ Web Application Firewall (WAF) Layer 7 inspection and TLS termination, 3) Internal NGFW North-South enforcement into the application tier, 4) Virtual switch microsegmentation governing East-West lateral traffic, and 5) Database proxy/jump gateway identity enforcement entering the isolated database zone.
The correct sequence reflects a defense-in-depth network architecture. Untrusted internet traffic is first filtered statelessly at the edge perimeter router to mitigate volumetric attacks. Next, it reaches the screened subnet (DMZ) where a Web Application Firewall decrypts and inspects application layer traffic. Valid requests then cross the internal North-South firewall boundary into the internal application tier. Within this tier, microsegmentation policies govern East-West lateral communications between microservices. Finally, traffic bound for the sensitive database must authenticate through a database proxy gateway before accessing the isolated backend database VLAN.

Step-by-Step Solution

1
Filter perimeter traffic
Untrusted network traffic is cleaned of volumetric anomalies and malformed packets at the outermost edge.
Perimeter routers block malformed packets and mitigate volumetric threats before deep packet inspection components are overwhelmed.
2
Inspect application payload in DMZ
Public HTTP/HTTPS traffic is terminated, decrypted, and evaluated against Web Application Firewall rules.
Screened subnets (DMZs) isolate public-facing ingress points from internal network infrastructure.
3
Enforce North-South zone boundaries
Approved requests transition from the DMZ to the internal application subnet via an internal NGFW.
Internal firewalls prevent compromised DMZ hosts from directly accessing internal corporate assets without strict layer 3/4 and layer 7 policies.
4
Apply microsegmentation to East-West traffic
Application container and virtual machine lateral traffic is restricted to explicitly allowed service channels.
Microsegmentation enforces Zero Trust within the application tier, mitigating lateral movement if an application node is breached.
5
Authenticate and proxy database requests into the isolated subnet
Queries pass through an authenticated proxy/jump host prior to reaching the restricted database VLAN.
Isolating high-value databases behind dedicated access gateways and isolated VLANs prevents direct network path connectivity from general application zones.

Key Concept

Multi-tier Secure Network Design, Zone Traversal, and Microsegmentation
Question 17Question →

A security engineer is configuring an automated failover workflow for an active-passive high-availability database cluster to prevent split-brain conditions and ensure data integrity during an ungraceful primary node failure. Arrange the operational steps in the correct chronological order from initial failure detection to full service restoration on the standby node.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological failover sequence is: 1) Detect primary node heartbeat loss and confirm the failure threshold timeout, 2) Execute a STONITH fencing command against the failed primary node, 3) Verify cluster quorum consensus and formally promote the standby node to the active role, 4) Promote the underlying storage volume to read-write mode and replay uncommitted transaction logs, and 5) Rebind the cluster Virtual IP (VIP) address to the secondary node's network interface controller.
In high-availability failover architectures, maintaining data integrity during ungraceful failures requires a strict order of operations: first, health monitors confirm heartbeat loss beyond the tolerance threshold; second, node fencing (STONITH) forcefully isolates the unresponsive primary to prevent split-brain scenario; third, surviving nodes verify quorum and promote the standby server; fourth, storage volumes are transitioned to read-write state and logs are replayed for crash recovery; fifth, the Virtual IP (VIP) is reassigned to the new primary so application traffic resumes transparently.

Step-by-Step Solution

1
Identify initial failure condition.
Heartbeat failure is confirmed after the configured timer expires.
Prevents premature failover actions caused by transient network spikes.
2
Enforce cluster node fencing (STONITH).
The failed node is physically powered off or isolated via PDU/IPMI controls.
Fencing eliminates the possibility of split-brain conditions where two nodes attempt to access and corrupt shared storage concurrently.
3
Validate cluster quorum and promote node status.
The standby node transitions from secondary to primary status.
Ensures that failover decisions are authorized by a surviving cluster majority.
4
Mount and validate persistent storage state.
Storage volume becomes writable and database state is consistent.
Database operations must achieve crash consistency prior to receiving incoming application queries.
5
Migrate client network traffic.
Gratuitous ARP broadcasts or API calls shift the Virtual IP (VIP) to the new active node.
Reroutes application connections to the newly promoted active server with minimal client re-configuration.

Key Concept

High Availability Cluster Automated Failover and Fencing (STONITH) Sequence
Estimated Time:2m 30s
Question 18Question →

An enterprise IT security team is implementing a major network security policy update to enforce microsegmentation across production database servers. Place the following change management steps in the correct chronological order from first to last to ensure proper security governance and operational continuity.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence begins with performing a security risk assessment and impact analysis, followed by validating rules and rollback procedures in staging. Next, the change request and test evidence are submitted to the Change Advisory Board (CAB) for authorization. After approval, the change is implemented in production during a maintenance window. Finally, post-implementation verification and configuration baseline updates are completed.
A standard security-focused change management workflow follows a linear progression: initial security impact assessment, staging environment validation of the change and rollback plan, CAB review and approval, production execution within an authorized window, and post-implementation review with configuration baseline updating.

Step-by-Step Solution

1
Identify potential security risks, technical dependencies, and business impacts.
Establishes baseline risk parameters and defines scope.
Security impact assessment must precede technical testing and formal review.
2
Execute technical testing and validate rollback steps in a staging environment.
Confirms the change works as designed without causing unintended outages.
Empirical testing in non-production is required to prove feasibility before seeking authorization.
3
Present the change package to the Change Advisory Board (CAB).
Obtains formal business and operational approval for deployment.
CAB approval ensures governance alignment and prevents scheduling conflicts.
4
Implement the configuration change during the scheduled maintenance window.
Applies the new security policies live in production.
Production execution must adhere to authorized timing constraints.
5
Perform post-implementation review (PIR) and update system baselines.
Confirms operational stability and updates security baseline records.
Ensures auditability and records the final post-change state.

Key Concept

Change Control Lifecycle and Security Impact Assessment
Question 19Question →

A network security architect is implementing defense-in-depth segmentation to secure access from external users to an isolated internal backend database. Arrange the network transit points and security control boundaries in the correct sequence through which inbound traffic must flow from the untrusted Internet to the database server.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct ingress sequence flows from the Perimeter WAF in the DMZ, to the Reverse Proxy/API Gateway in the Public Services Subnet, through the Internal Microsegmentation Firewall, and finally to the Database Subnet ACL and Host Firewall.
Secure network architecture mandates a defense-in-depth approach where inbound traffic traverses from public edge boundaries to increasingly restrictive internal zones. Traffic first enters the DMZ via the Perimeter WAF, moves to the API Gateway in the public services tier for authentication, passes through an internal microsegmentation firewall inspecting East-West flows, and lastly encounters the Database Subnet ACL and Host Firewall enforcing strict destination isolation.

Step-by-Step Solution

1
Filter North-South traffic at the network edge
Untrusted external traffic is inspected by the Perimeter WAF in the DMZ.
Perimeter security controls must evaluate incoming public requests first to block common web attacks before traffic reaches internal endpoints.
2
Terminate external connections and validate application requests
The Reverse Proxy/API Gateway handles session termination and request verification.
De-encapsulating and authenticating requests in a public-facing service subnet prevents unverified external clients from directly connecting to internal application instances.
3
Enforce East-West microsegmentation boundaries
The Internal Microsegmentation Firewall evaluates traffic traveling between application tiers.
Microsegmentation prevents lateral movement by explicitly inspecting and controlling data flows transitioning across internal zone boundaries.
4
Apply host and subnet-level isolation controls
Database Subnet ACLs and Host Firewalls enforce zero trust rules at the target resource.
Final line-of-defense controls restrict access strictly to authorized source IP addresses and database-specific communication protocols.

Key Concept

Multi-tier network segmentation and zoning boundaries control the flow of ingress and lateral traffic across security zones based on least privilege and defense-in-depth.
Question 20Question →

A network security team is establishing a zero-trust transit pipeline for remote systems administrators managing a backend database server located in a restricted internal network zone. Place the traffic flow controls and access verification steps in the correct sequential order, from the initial remote connection request to establishing access on the target server.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for administrative transit into a highly segmented database zone begins at the external perimeter VPN gateway with MFA, proceeds to an isolated bastion host in a management DMZ, transitions through internal microsegmentation firewalls evaluating East-West traffic, and culminates with scoped authentication on the target database server.
Secure network architecture mandates defense-in-depth and strict boundary isolation. The correct order ensures that untrusted external traffic is authenticated at the perimeter VPN, proxied through a bastion host in a management DMZ, filtered through internal microsegmentation firewalls for East-West traffic control, and finally authorized at the destination asset using least-privilege credentials.

Step-by-Step Solution

1
Enforce North-South perimeter security and identity verification
Remote administrator connects via TLS VPN with MFA to gain ingress authorization.
Untrusted incoming connections must be encrypted and authenticated at the edge before any internal subnet exposure occurs.
2
Route administrative traffic to a jump server in the management DMZ
The user initiates an administrative proxy session on a hardened bastion host.
Direct management access from client endpoints to high-value internal assets violates secure segmentation principles. Bastions act as controlled proxies.
3
Enforce internal zone boundaries and microsegmentation filtering
Traffic from the jump server is inspected by internal firewalls filtering East-West network paths.
Internal segmentation controls ensure that even within internal zones, traffic crossing boundaries between management and database segments is explicitly validated.
4
Complete target host authentication in the restricted database segment
The session establishes to the target database server using scoped just-in-time credentials.
Final authentication and granular authorization occur directly at the target resource within the most restrictive network zone.

Key Concept

Bastion Transit Rules and Zone-based Microsegmentation Flow Controls
Estimated Time:2m 0s
Page 1 / 9Next
All practice questions — CompTIA Security+ | Examkin