All practice questions

Question 181Question →

Security Information and Event Management (SIEM) systems aggregate and correlate raw telemetry from heterogeneous operating systems and network devices. Match each raw security log entry snippet to the specific security attack vector or operational event type it indicates.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Each log snippet corresponds to its distinct event pattern: web access logs containing SQL syntax match SQL Injection exfiltration; rapid daemon SSH failures match SSH authentication brute-force; oversized TXT DNS queries with subdomains match DNS tunneling; and Windows Event ID 4672 with administrative privileges matches Windows sensitive privilege assignment.

Security event telemetry is categorized by analyzing protocol identifiers, signature payloads, and event codes. Web server logs containing SQL operators represent SQL Injection. Syslog authentication logs recording high-frequency failures represent SSH brute-force attacks. DNS logs displaying encoded subdomains and large TXT outputs represent DNS tunneling exfiltration. Windows Security Event ID 4672 specifically identifies administrative user privilege assignments upon session establishment.

Step-by-Step Solution

1

Analyze web server HTTP access log parameter syntax

Identified 'UNION SELECT' operators in the query parameters as an active SQL Injection exfiltration attempt

The attacker forces the database to evaluate structural SQL commands and join user credential tables into the response

2

Analyze Linux Syslog sshd authentication events

Identified repeated failed password events (120 attempts within 30 seconds) as an SSH brute-force attack

Automated authentication tools rapidly attempt candidate credentials against exposed remote access interfaces

3

Analyze network protocol log showing DNS query details

Identified encoded subdomain strings inside TXT record queries carrying large data payloads as DNS tunneling

Malicious software encapsulates data inside DNS queries to bypass standard web proxy and firewall filtering

4

Analyze Windows Security Event log ID and privilege list

Identified Event ID 4672 alongside SeDebugPrivilege assignment as Windows sensitive privilege assignment

Windows Security Auditing generates Event ID 4672 whenever elevated privileges are attached to a newly created security token

Key Concept

Log signature identification and SIEM telemetry classification across heterogeneous enterprise security controls

Question 182Question →

A security architect is updating the enterprise storage protection strategy to safeguard sensitive data at rest and during access operations. Match each storage security control on the left with its primary operational mechanism on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

SAN LUN Masking maps to restricting storage volume access by host WWNs/iSCSI initiators. Hardware Security Module (HSM) maps to tamper-resistant hardware key lifecycle management. Database Tokenization maps to replacing sensitive data elements with non-sensitive surrogate tokens. Endpoint Data Loss Prevention (DLP) maps to monitoring local drive and removable media operations to prevent unauthorized data extraction.

Each storage security control fulfills a distinct architectural role: SAN LUN masking controls host-level access to SAN storage volumes, HSM safeguards root cryptographic keys in dedicated physical hardware, Tokenization obfuscates sensitive values without mathematical key ciphering, and Endpoint DLP prevents local data exfiltration.

Step-by-Step Solution

1

Analyze storage access controls.

SAN LUN masking configures storage controllers to restrict logical unit number exposure to authorized host identifiers (WWNs/iSCSI initiators).

This enforces storage isolation in SAN environments.

2

Analyze cryptographic hardware controls.

HSM protects key management operations inside tamper-evident physical boundaries.

This prevents root key exposure or theft.

3

Analyze data protection and obfuscation controls.

Tokenization substitutes sensitive fields with non-sensitive tokens while storing mapping tables securely.

This reduces regulatory scope while preserving database formatting.

4

Analyze data loss prevention controls.

Endpoint DLP inspects local endpoints to prevent unauthorized copying of sensitive files to removable storage.

This mitigates insider threat and accidental data exfiltration.

Key Concept

Enterprise Data Protection and Storage Architecture Controls

Question 183Question →

Match each threat intelligence source classification on the left with its primary enterprise operational use case on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Open-Source Intelligence (OSINT) matches with gathering freely available security research from public sources; Information Sharing and Analysis Center (ISAC) matches with sharing sector-specific, confidential threat warnings with industry peers; Proprietary Threat Intelligence Feed matches with ingesting paid, commercial indicator streams from specialized vendors; National Vulnerability Database (NVD) matches with correlating software inventory against standardized CVE identifiers and CVSS risk scores.

Open-Source Intelligence (OSINT) involves analyzing publicly accessible security data without cost. Information Sharing and Analysis Centers (ISACs) provide trusted peer-to-peer threat sharing specifically tailored to industry sectors like finance or healthcare. Proprietary threat feeds offer commercially licensed, high-fidelity threat indicators for specialized SOC ingestion. The National Vulnerability Database (NVD) acts as the primary repository for standardized CVE records and CVSS scoring to drive vulnerability management.

Step-by-Step Solution

1

Analyze the access model and distribution method of each threat intelligence source.

OSINT is publicly accessible; ISAC is peer-shared within an industry sector; Proprietary feeds are commercial/paid; NVD is a public standardized database.

Differentiating sources by cost, access controls, and target usage enables correct alignment with operational workflows.

2

Match each intelligence source to its intended security outcome.

Public research maps to OSINT; sector peer sharing maps to ISAC; paid vendor feeds map to Proprietary Intelligence; vulnerability scoring maps to NVD.

Security operations rely on specific intelligence types for different tasks such as patch management, alert enrichment, or peer warning.

Key Concept

Categorization and Application of Threat Intelligence Sources

Question 184Question →

An enterprise security architect is reviewing infrastructure resilience mechanisms to ensure continuous availability and disaster recovery readiness. Match each high-availability control on the left with the operational failover behavior or risk mitigation on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Active-Active Clustering matches simultaneous load distribution across online nodes. Dual-PDU Redundant Power Wiring matches protection against upstream circuit breaker power feed failures. Geographically Dispersed Warm Site matches pre-installed infrastructure requiring data restoration. Heartbeat-monitored Active-Passive Failover matches promoting a standby node upon primary signal loss.

Active-Active clustering actively distributes live production traffic across all nodes. Dual-PDU power wiring mitigates power feed line and circuit breaker failures. A warm site maintains hardware readiness but requires periodic or manual data updates. Active-Passive failover relies on heartbeat signaling to promote a standby secondary node when the primary node stops responding.

Step-by-Step Solution

1

Analyze load distribution controls.

Active-Active clustering active state processing matches real-time workload balancing across all active nodes.

Active-Active configurations explicitly process live traffic across all available nodes concurrently.

2

Identify electrical fault tolerance controls.

Dual-PDU redundant wiring matches protection against independent electrical circuit failures.

Connecting redundant power supplies to separate PDUs prevents single utility or circuit breaker failures from downing servers.

3

Evaluate offsite disaster recovery site models.

Warm sites match pre-provisioned hardware infrastructure that requires data restoration before resuming operations.

Warm sites balance cost and recovery speed by maintaining hardware readiness while accepting delayed data sync.

4

Examine stateful failover monitoring.

Heartbeat-monitored active-passive failover matches promoting a standby node when keep-alive signals drop.

Heartbeat protocols continuously verify primary node health and automate secondary node takeover.

Key Concept

Distinguishing architectural controls for system resilience, electrical redundancy, clustering models, and recovery site operational profiles.

Question 185Question →

In a Zero Trust Architecture (ZTA) implementation following NIST SP 800-207, distinct logical components handle policy decisions, enforcement, and data boundaries. Match each Zero Trust functional component on the left with its core operational responsibility on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The Policy Engine maps to evaluating contextual risk and policy to render access decisions; the Policy Administrator maps to signaling enforcement points and issuing session credentials; the Policy Enforcement Point maps to intercepting and gating resource connections; the Control Plane maps to serving as the administrative communication network for management traffic.

NIST SP 800-207 specifies a clear separation of responsibilities within Zero Trust Architecture: the Policy Engine acts as the decision brain, the Policy Administrator serves as the control dispatcher issuing dynamic credentials, the Policy Enforcement Point mediates raw application data flows, and the Control Plane establishes the secure administrative network connecting PDP and PEP entities.

Step-by-Step Solution

1

Identify the primary role of the Policy Engine within the Policy Decision Point (PDP).

The Policy Engine serves as the decision maker, utilizing enterprise rules and dynamic trust scores to decide if access should be granted.

Zero Trust separates the decision logic from the execution and enforcement layers.

2

Identify the operational execution role of the Policy Administrator.

The Policy Administrator translates the Policy Engine's approval into actionable commands, issuing control signals and temporary credentials.

The Policy Administrator acts as the execution controller that communicates with the enforcement points.

3

Determine where the Policy Enforcement Point (PEP) operates.

The PEP operates on the data plane, physically or logically gating subject-to-resource connection requests.

PEPs act as gatekeepers that enforce decisions passed down from the PDP.

4

Distinguish the Control Plane from the Data Plane.

The Control Plane isolates administrative signaling and component-to-component management communication from user data traffic.

Decoupling control signals from payload traffic prevents unauthorized access to management interfaces.

Key Concept

Zero Trust Architecture Logical Components (PDP, PEP, Control Plane)

Estimated Time:1m 30s

Question 186Question →

A Security Operations Center (SOC) team is organizing its Security Information and Event Management (SIEM) data pipeline. Match each SIEM data processing phase on the left with its primary operational function on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Parsing corresponds to extracting structured key-value pairs from raw log strings. Normalization corresponds to mapping disparate log field names to a common standard schema. Aggregation corresponds to consolidating duplicate log events. Correlation corresponds to analyzing relationships among events across diverse log sources over time.

Each SIEM processing phase has a distinct function: Parsing extracts key-value pairs from raw log text; Normalization maps extracted fields to a common taxonomy; Aggregation deduplicates log events to save storage; and Correlation analyzes logic across multiple sources to identify complex security incidents.

Step-by-Step Solution

1

Identify the primary purpose of log parsing.

Parsing interprets raw log syntax to extract discrete data fields.

Raw logs arrive as unstructured text and must be broken into usable fields.

2

Identify the primary purpose of log normalization.

Normalization aligns field names across different vendors into a unified schema.

Different devices name fields differently (e.g., src_ip vs client_ip).

3

Identify the primary purpose of log aggregation.

Aggregation combines repeating identical log entries into summary records.

High-volume logging can quickly deplete storage if duplicates are not consolidated.

4

Identify the primary purpose of event correlation.

Correlation evaluates multi-source log rules over time windows.

Detecting complex attacks requires evaluating sequences of events across multiple hosts.

Key Concept

SIEM Log Ingestion and Processing Pipeline

Question 187Question →

A security architect at a pharmaceutical enterprise is designing the network architecture for a new automated production facility. Match each network design or segmentation technique on the left to its corresponding security application requirement on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Air Gap matches with isolating legacy PLCs by completely disconnecting them; Microsegmentation matches with restricting lateral movement between individual cloud microservices; Jump Server matches with providing a hardened administrative proxy entry point; Demilitarized Zone (DMZ) matches with exposing public web servers while isolating the internal network.

Air Gap provides absolute physical isolation for legacy PLCs. Microsegmentation enforces workload-level controls against lateral movement. Jump Server provides a hardened management proxy for database access. DMZ buffers internet-exposed services from internal networks.

Step-by-Step Solution

1

Identify the extreme isolation requirement for high-risk legacy PLCs.

Complete physical and logical disconnection maps directly to an Air Gap.

Air gapping eliminates all network-based attack vectors by removing physical and logical network connectivity.

2

Analyze the requirement for controlling East-West traffic between cloud microservices.

Granular workload-level policy enforcement maps to Microsegmentation.

Microsegmentation creates fine-grained security zones around individual application components to prevent lateral movement.

3

Evaluate administrative access into internal database segments.

A single proxy entry point for admin sessions maps to a Jump Server.

Jump servers channel, authenticate, and monitor privileged administrative management connections into sensitive internal zones.

4

Determine the perimeter control technique for public web endpoints.

Buffering external services from internal assets maps to a DMZ.

A DMZ isolates internet-facing services on a dedicated subnet separated by firewalls from internal corporate assets.

Key Concept

Network Design Archetypes and Segmentation Controls

Question 188Question →

Match each storage security technology on the left with its corresponding enterprise functional mechanism on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Envelope Encryption Architecture pairs with DEK/KEK key hierarchy; SAN LUN Masking pairs with host HBA WWN array restriction; Database Field Tokenization pairs with vault-mapped surrogate replacement; Self-Encrypting Drive (SED) pairs with hardware disk encryption and cryptographic erase.

Each storage security architecture component directly addresses a distinct operational requirement across key management, storage network isolation, application data transformation, and physical drive security: Envelope Encryption manages hierarchical DEK/KEK keys; SAN LUN Masking restricts host access by WWN at the storage controller; Tokenization replaces sensitive fields with vault-mapped surrogates; and SEDs provide hardware media encryption.

Step-by-Step Solution

1

Analyze storage encryption key management structures.

Identify envelope encryption as the pattern utilizing Data Encryption Keys (DEKs) wrapped by Key Encryption Keys (KEKs).

This decouples local file encryption performance from centralized key access control.

2

Evaluate Storage Area Network (SAN) logical separation controls.

Associate LUN masking with storage array controller ACLs filtering by host HBA World Wide Names (WWNs).

LUN masking prevents unauthorized host servers from detecting or attaching to SAN volumes.

3

Differentiate data obfuscation methods for structured databases.

Map tokenization to vault-backed surrogate replacement.

Tokenization replaces original data with non-secret lookup identifiers rather than mathematical ciphertexts.

4

Identify physical block storage media protection mechanisms.

Match Self-Encrypting Drives (SEDs) to hardware-level disk encryption and crypto-erase.

SEDs implement cryptographic processing directly on the storage device controller.

Key Concept

Data Protection and Storage Security Architecture Controls

Question 189Question →

Match each observed network or wireless technical indicator on the left with its corresponding attack classification on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Unsolicited ARP replies map to ARP Poisoning; EAPOL-Start frame volume maps to Wireless EAPOL Flooding; Low TTL DNS response rotation maps to DNS Fast-Flux; Rogue AP mimicking enterprise SSID maps to Evil Twin.

Each observed technical indicator uniquely corresponds to its underlying attack vector: ARP poisoning alters Layer 2 mapping, EAPOL flooding targets 802.1X authentication state, DNS fast-flux rotates domain IP resolution with brief TTLs to evade IP blocking, and an Evil Twin spoofs wireless ESSID credentials.

Step-by-Step Solution

1

Analyze the Layer 2 traffic pattern of unsolicited ARP replies mapping multiple IPs to one MAC address.

Identified as ARP Poisoning/Spoofing.

Attacker is poisoning IP-to-MAC resolution tables on local hosts to intercept network traffic.

2

Analyze the wireless 802.1X authentication telemetry showing excessive EAPOL-Start frames.

Identified as Wireless EAPOL Flooding.

Generating constant authentication requests exhausts backend authentication resources.

3

Examine DNS resolution behavior exhibiting extremely short TTLs and constantly changing IP addresses.

Identified as DNS Fast-Flux.

Fast-flux DNS dynamically changes A records to hide malicious hosting infrastructure behind compromised proxies.

4

Evaluate the WIPS alert describing an unauthorized AP broadcasting a corporate network name with a modified BSSID and high power.

Identified as an Evil Twin attack.

Evil Twins attempt to trick wireless clients into auto-associating with an attacker-controlled access point.

Key Concept

Network and Wireless Attack Indicators

Estimated Time:1m 30s

Question 190Question →

Match each threat intelligence source classification on the left with its corresponding operational security use case on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Proprietary Threat Feed pairs with vendor-curated commercial indicator feeds; Information Sharing and Analysis Center (ISAC) pairs with exchanging sector-specific attack data among trusted peers; Open-Source Intelligence (OSINT) pairs with analyzing publicly available technical research blogs and repositories; Vulnerability Database pairs with reviewing standardized CVSS metrics and technical patch advisories.

Each threat intelligence source corresponds directly to its defined operational role: Proprietary feeds supply commercial, vendor-curated indicators; ISACs provide a trust network for sector-specific peer sharing; OSINT relies on freely available web information; and Vulnerability Databases offer standardized risk scores (CVSS) and patch advisories.

Step-by-Step Solution

1

Analyze the scope, access level, and governance model of each threat intelligence source.

Differentiate between commercial vendor services, sector-specific peer communities, open public platforms, and standardized vulnerability archives.

Threat intelligence sources serve distinct operational needs based on trust boundaries, access permissions, and data content.

2

Map each threat intelligence source to its primary enterprise operational application.

Match Proprietary feeds to paid C2 blocking feeds, ISACs to sector peer sharing, OSINT to open web analysis, and Vulnerability Databases to CVSS/CVE patch evaluation.

Aligning intelligence sources with appropriate operational workflows ensures efficient risk management and incident prevention.

Key Concept

Operational applications and classification of threat intelligence sources

Estimated Time:1m 30s

Question 191Question →

An autonomous electric vehicle (EV) charging network operator is updating its management plane and edge gateway infrastructure to comply with NIST SP 800-207 Zero Trust Architecture (ZTA) principles. Match each Zero Trust logical component to its core operational responsibility within the enterprise architecture.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Policy Engine (PE) matches with evaluating access requests against policies and risk algorithms. Policy Administrator (PA) matches with translating decisions into control plane commands and session keys. Policy Enforcement Point (PEP) matches with operating in the data plane to intercept, inspect, enable, and terminate active connection sessions. Continuous Diagnostics and Mitigation (CDM) System matches with monitoring endpoint posture and vulnerability state for real-time contextual intelligence.

NIST SP 800-207 divides Zero Trust Architecture into distinct logical components across the control plane and data plane. The Policy Engine evaluates policy and telemetry to make access decisions. The Policy Administrator receives those decisions and commands Policy Enforcement Points to open, monitor, or close sessions. The Policy Enforcement Point acts as the inline barrier in the data plane to manage connection traffic. Continuous Diagnostics and Mitigation systems gather device state telemetry to provide the ongoing context necessary for dynamic trust evaluation.

Step-by-Step Solution

1

Differentiate between the Control Plane components (Policy Engine and Policy Administrator) and the Data Plane component (Policy Enforcement Point).

Identified the Policy Engine as the decision maker, the Policy Administrator as the control signal manager, and the Policy Enforcement Point as the inline data traffic gatekeeper.

Zero Trust Architecture enforces a strict functional separation between access decision logic and data path enforcement.

2

Identify the contextual support role of telemetry systems such as Continuous Diagnostics and Mitigation (CDM).

Mapped CDM to endpoint health state, vulnerability metrics, and continuous compliance monitoring.

Zero Trust dynamic access evaluations require real-time posture context rather than static perimeter trust assumptions.

3

Map each component to its exact functional description as specified in NIST SP 800-207.

Verified accurate component-to-responsibility pairings.

Ensures standard alignment with standard Zero Trust Architecture control plane and data plane models.

Key Concept

Zero Trust Architecture Control Plane vs. Data Plane Component Responsibilities

Estimated Time:1m 30s

Question 192Question →

A security architect is evaluating resilience specifications for an enterprise infrastructure redesign. Match each business availability metric on the left with its corresponding definition on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Recovery Time Objective (RTO) matches the target duration of time within which a system must be restored. Recovery Point Objective (RPO) matches the maximum acceptable amount of data loss measured in time. Mean Time Between Failures (MTBF) matches the predicted elapsed operational time between failures. Mean Time To Repair (MTTR) matches the average time required to troubleshoot, fix, and restore a failed component.

Each availability metric directly matches its standard security architecture definition: RTO specifies target restoration duration, RPO specifies maximum allowable data loss window, MTBF calculates expected operational lifespan between failures, and MTTR measures repair turnaround time.

Step-by-Step Solution

1

Differentiate downtime metrics (RTO) from data loss metrics (RPO)

RTO focuses on elapsed time to restore service (downtime duration), whereas RPO focuses on point-in-time data tolerance (data loss window).

Business impact analyses rely on distinguishing system recovery duration from data backup currency.

2

Differentiate component reliability metrics (MTBF) from maintainability metrics (MTTR)

MTBF measures expected operational uptime between failures, while MTTR measures the time required to perform repair actions once a failure occurs.

Hardware resilience planning requires separating failure frequency expectations from maintenance restoration speeds.

Key Concept

High Availability and Resilience Business Metrics

Question 193Question →

A Security Operations Center (SOC) analyst is reviewing raw log telemetry streams collected from web servers, authentication systems, and perimeter firewalls inside a SIEM environment. Match each log snippet pattern on the left with its corresponding attack vector or security event classification on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Each log entry pattern corresponds to a specific attack taxonomy: Log 1 matches SQL Injection data exfiltration; Log 2 matches Password spraying authentication attack; Log 3 matches Internal lateral movement network boundary drop; Log 4 matches Insecure Direct Object Reference (IDOR) authorization bypass.

The correct matches accurately map log syntax and operational telemetry to their definitive attack classifications based on payload structure, protocol ports, and event codes.

Step-by-Step Solution

1

Analyze the web application log payload structure in the first log snippet.

Identified 'UNION SELECT' syntax targeting database tables, indicating SQL Injection.

URL parameters containing SQL syntax reveal attempts to force the database backend to execute arbitrary queries.

2

Evaluate the Windows Security Log event parameters and frequency in the second snippet.

Identified Event ID 4625 with SubStatus 0xC000006A repeated across multiple endpoints, indicating password spraying.

A single account attempted across many endpoints in a short window avoids single-host lockout policies while testing credentials broadly.

3

Inspect the network firewall drop log syntax in the third snippet.

Identified internal IP to internal IP traffic blocked on SMB port 445.

Internal segmentation drops on management/sharing ports indicate unauthorized lateral movement attempts within internal zones.

4

Examine the sequential URL access pattern in the fourth log snippet.

Identified automated/manual increment of object identifiers using a single authenticated session, indicating IDOR.

Accessing contiguous resource IDs without authorization parameter checks is a classic signature of broken object-level authorization.

Key Concept

Log Correlation and Telemetry Pattern Identification

Question 194Question →

Match each enterprise system hardening practice to the specific security risk or operational vulnerability it is primarily designed to mitigate.

Click a left item, then click its matching right item

Show answer & explanation

Answer

File Integrity Monitoring pairs with unauthorized modifications to system files; Host-based Microsegmentation pairs with lateral movement between workloads; TPM-bound Disk Encryption pairs with data exposure from physical drive theft; Automated Patch Orchestration pairs with exploitation of unpatched software vulnerabilities.

Matching each hardening control to its primary operational target ensures precise threat mitigation: File Integrity Monitoring detects unauthorized configuration or file changes; Host-based Microsegmentation prevents lateral movement across internal network workloads; TPM-bound Disk Encryption secures data against physical drive theft; and Automated Patch Orchestration eliminates software vulnerability exposure.

Step-by-Step Solution

1

Analyze host security auditing controls.

File Integrity Monitoring (FIM) tracks alterations to system files and alerts on unauthorized changes.

FIM compares current file hashes against an established baseline to detect unexpected tampering.

2

Analyze network isolation controls.

Host-based microsegmentation limits east-west communication between internal systems.

Enforcing firewall and network access rules on individual host endpoints prevents lateral movement after an initial compromise.

3

Analyze physical and data-at-rest protection controls.

TPM-bound disk encryption protects stored data when system hardware is powered off or stolen.

Full disk encryption uses a Trusted Platform Module to verify system boot integrity before releasing decryption keys.

4

Analyze vulnerability mitigation practices.

Automated patch orchestration systematically remediates software defects and security flaws.

Deploying verified patches automatically minimizes the time window available for threat actors to execute exploits.

Key Concept

Enterprise Hardening Practices and Risk Mitigation

Estimated Time:1m 30s

Question 195Question →

Match each security log entry or SIEM telemetry event to the attack vector or operational activity it most accurately demonstrates.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Matching pairs: Web log with UNION SELECT matches SQL Injection (SQLi); SSH failed password burst matches SSH Automated Password Guessing (Brute Force); Firewall drop on TCP port 3389 matches Blocked Unauthorized RDP Access Attempt; High-volume encoded DNS TXT queries match DNS Tunneling / Covert Data Exfiltration.

Each log line provides specific indicators of compromise (IoCs): database keywords indicate SQL injection; high-rate SSH authentication failure indicates brute force; firewall drops on port 3389 indicate blocked remote access attempts; and continuous encoded DNS query patterns indicate DNS tunneling.

Step-by-Step Solution

1

Analyze the web server log entry containing URL query parameters.

Identified 'UNION SELECT' syntax targeting database tables, indicating SQL Injection (SQLi).

Attackers inject database queries into input parameters to extract unauthorized data.

2

Examine the SSH daemon authentication log snippet and timestamp frequency.

Identified 850 failed root password attempts in 60 seconds, indicating SSH Automated Password Guessing (Brute Force).

Rapid successive authentication failures from a single host demonstrate automated dictionary or brute-force attacks.

3

Evaluate the firewall packet filtering log telemetry.

Identified dropped inbound traffic on destination port 3389, indicating Blocked Unauthorized RDP Access Attempt.

TCP port 3389 is the default port for Remote Desktop Protocol, and the DENY action reflects perimeter firewall mitigation.

4

Inspect the SIEM correlation alert for outbound protocol anomalies.

Identified repeated encoded TXT sub-domain queries, indicating DNS Tunneling / Covert Data Exfiltration.

DNS tunneling encodes arbitrary payload data inside subdomains or TXT records to bypass standard security filters.

Key Concept

Log Analysis and SIEM Correlation

Estimated Time:1m 30s

Question 196Question →

An enterprise security architecture team is categorizing identity standards and protocols for a multi-cloud infrastructure deployment. Match each Identity and Access Management (IAM) protocol or standard on the left to its corresponding architectural use case on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

SAML 2.0 matches XML-based web SSO federation; OpenID Connect matches the JWT identity layer for user authentication; OAuth 2.0 matches the delegated authorization API token framework; RADIUS matches the centralized network access control protocol.

Each IAM protocol is paired with its exact architectural design pattern: SAML 2.0 uses XML for web SSO federation, OpenID Connect uses JWT ID tokens for user identity verification, OAuth 2.0 delivers token-based authorization delegated access for APIs, and RADIUS supplies UDP-based AAA network connection management.

Step-by-Step Solution

1

Identify the primary architectural transport and payload structure for web federation

Matched SAML 2.0 with XML-based web single sign-on federation.

SAML 2.0 relies on XML security assertions transferred via browser HTTP bindings for enterprise web SSO.

2

Differentiate delegated access from user authentication in modern API-driven architectures

Matched OAuth 2.0 with delegated API authorization access tokens, and OpenID Connect with JWT-based user identity authentication.

OAuth 2.0 strictly governs API resource authorization using tokens, whereas OpenID Connect adds an identity authentication layer on top using ID tokens.

3

Categorize network-level AAA protocols

Matched RADIUS to centralized network device and remote access authentication over UDP.

RADIUS is a legacy AAA protocol operating over UDP, dedicated to network perimeter access controls like 802.1X and VPNs.

Key Concept

Identity and Access Management Architecture and Protocol Selection

Question 197Question →

Match each vulnerability scanning concept on the left with its corresponding operational description on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Credentialed Scan pairs with using administrative privileges for internal inspection; Non-Credentialed Scan pairs with probing target services without log-in credentials; Passive Scan pairs with observing network traffic without sending probes; Intrusive Scan pairs with executing active verification scripts that risk disrupting system stability.

Each scanning technique directly aligns with its specific operational characteristic: credentialed scans log in locally, non-credentialed scans probe externally without authentication, passive scans sniff network traffic without transmitting packets, and intrusive scans run verification checks that may disrupt target services.

Step-by-Step Solution

1

Evaluate authentication requirements for scanning modes.

Credentialed scanning requires valid system credentials for internal host access, whereas non-credentialed scanning operates without log-in access.

Privilege access determines whether the scanner inspects internal settings or external interfaces.

2

Evaluate traffic generation and system impact levels.

Passive scanning silently inspects passing network traffic without sending packets, while intrusive scanning sends active probes that can disrupt target services.

Operational safety dictates whether silent packet capture or active impact testing is appropriate.

Key Concept

Vulnerability assessment tools vary by privilege level (credentialed vs. non-credentialed) and network impact (passive vs. intrusive).

Question 198Question →

A security analyst is investigating network and wireless security alerts recorded in an enterprise environment. Match each observed technical attack indicator on the left with its corresponding attack classification on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

ICMPv6 Router Advertisement packets match Rogue IPv6 Router Advertisement Attack; continuous 802.11 disassociation management frames match Wireless Disassociation Attack; unsolicited ARP reply packets with mismatched bindings match ARP Cache Poisoning; high RF noise floor causing CSMA/CA failure matches Radio Frequency (RF) Jamming.

Each indicator uniquely aligns with its layer and protocol signature: ICMPv6 RA frames reflect IPv6 routing manipulation; spoofed 802.11 management frames indicate disassociation; forged ARP replies indicate ARP poisoning; and elevated channel noise indicates RF jamming.

Step-by-Step Solution

1

Analyze the ICMPv6 RA indicator.

ICMPv6 Router Advertisements configure SLAAC/gateway settings; rogue messages indicate a IPv6 RA attack attempting on-path traffic redirection.

ICMPv6 Type 134 packets are specifically used by IPv6 routers to advertise gateway capabilities.

2

Analyze the 802.11 disassociation frame indicator.

Disassociation frames are 802.11 management packets that terminate client association with a WAP.

Forged management frames exploiting lack of Protected Management Frames (802.11w) characterize disassociation attacks.

3

Analyze the ARP packet indicator.

Unsolicited ARP responses overwrite local ARP caches with malicious layer 2 address maps.

Gratuitous ARP replies modified to point the default gateway IP to an unauthorized MAC address define ARP cache poisoning.

4

Analyze the RF noise floor indicator.

Physical layer noise blocking Wi-Fi channels represents deliberate radio frequency interference.

Jamming operates at Layer 1 by raising the noise floor above usable signal-to-noise ratio levels.

Key Concept

Identifying technical indicators and signatures of network layer and wireless attacks.

Question 199Question →

Match each core Zero Trust Architecture (ZTA) functional component to its primary operational responsibility within an enterprise security infrastructure.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Policy Engine pairs with evaluating security policies and context to render access decisions. Policy Administrator pairs with issuing control commands and managing session tokens. Policy Enforcement Point pairs with intercepting traffic and enforcing data plane connections. Continuous Diagnostics and Mitigation pairs with gathering asset posture and vulnerability telemetry.

Zero Trust Architecture explicitly separates control plane operations from data plane execution. The Policy Engine determines access authorization, the Policy Administrator handles control signaling and session token distribution, the Policy Enforcement Point gates data plane traffic, and Continuous Diagnostics and Mitigation feeds real-time posture intelligence to inform ongoing access evaluations.

Step-by-Step Solution

1

Differentiate between policy decision logic and control plane session management.

Identify that the Policy Engine evaluates policy rules to make the access decision, while the Policy Administrator acts on that decision to manage session controls.

Decoupling decision logic (PE) from execution signals (PA) ensures strict separation of duties within the control plane.

2

Identify the operational boundary component handling active user traffic.

Associate the Policy Enforcement Point with direct data plane traffic inspection, gating, and session termination.

The PEP acts as the perimeter-less gatekeeper directly between the requester and enterprise workload.

3

Identify the supporting telemetry system providing contextual state data.

Associate Continuous Diagnostics and Mitigation with tracking endpoint compliance, patch levels, and device integrity.

Zero Trust demands explicit, continuous verification supported by ongoing threat and posture monitoring systems.

Key Concept

Zero Trust Architecture Functional Component Roles (NIST SP 800-207)

Estimated Time:1m 30s

Question 200Question →

A systems engineer is hardening enterprise endpoints, embedded controllers, and server infrastructure. Match each hardware security feature on the left with its primary operational function on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Trusted Platform Module (TPM) pairs with local endpoint integrity measurements and host key storage. Hardware Security Module (HSM) pairs with centralized high-volume cryptographic processing. Physically Unclonable Function (PUF) pairs with deriving unique device keys from silicon manufacturing variations. eFuse pairs with permanently locking hardware configurations via one-time programmable physical blown traces.

Each hardware security feature corresponds strictly to its targeted operational profile: TPM provides endpoint host boot measurement; HSM handles centralized server cryptographic acceleration; PUF generates unique chip keys based on physical silicon variations; and eFuse permanently alters chip capabilities by burning physical internal fuses.

Step-by-Step Solution

1

Differentiate endpoint-focused hardware roots of trust from server-centric cryptographic appliances.

TPM is identified as an endpoint-level crypto microcontroller for boot integrity, whereas HSM is identified as an enterprise device for server key management.

TPMs are deployed locally on client systems, while HSMs serve high-availability, multi-tenant server infrastructure.

2

Distinguish between silicon fingerprint generation and permanent circuit path modification.

PUF relies on intrinsic silicon variations to derive secret keys, whereas eFuse physically alters internal micro-wiring to permanently set configurations.

PUF yields dynamic identity evaluation without stored keys, while eFuses act as irreversible state controls.

Key Concept

Hardware-based security controls and roots of trust

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept