All practice questions

2232 questions

Question 201Question

A security engineer is establishing hardware hardening controls for smart grid embedded devices deployed in physically accessible remote locations. Which of the following hardware-level controls will protect device integrity and prevent unauthorized boot-level tampering? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Implementation of Secure Boot backed by a hardware Root of Trust to verify bootloader cryptographic signatures; Deployment of eFuse technology to permanently lock bootloader settings and disable sensitive hardware debug interfaces

Answer

The correct controls are implementing Secure Boot backed by a hardware Root of Trust and deploying eFuse technology to permanently lock bootloader settings and debug interfaces.
Establishing a hardware Root of Trust for Secure Boot ensures that the system checks cryptographic signatures before running any firmware or boot code. Complementing this with eFuse technology provides a permanent, hardware-enforced lockdown of configuration parameters and debugging interfaces that cannot be reverted through software.

Step-by-Step Solution

1
Analyze the hardware security requirement for embedded systems deployed in unmonitored environments.
Identified the primary requirement: preventing unauthorized firmware modification and enforcing low-level integrity.
Physical accessibility makes remote embedded devices vulnerable to unauthorized bootloader flashing and hardware-level tampering.
2
Select appropriate hardware-rooted integrity mechanisms.
Secure Boot with a Root of Trust verifies firmware signatures at initialization, while eFuses permanently enforce immutable configuration state.
Both mechanisms provide low-level, hardware-backed integrity guarantees against unauthorized code execution.

Key Concept

Hardware-rooted security mechanisms, such as Secure Boot with a Root of Trust and eFuse lockdown, protect device integrity by ensuring only authenticated firmware executes.
Question 202Question

During an incident triage session, security analysts isolate four distinct technical telemetry artifacts collected from host and network sensors. Match each observed technical indicator on the left with its primary malware classification on the right.

Click a left item, then click its matching right item

Items

An EDR alert indicates an unapproved binary disguised as a system management utility that opens an outbound port to accept administrative control commands.
Network security monitoring logs reveal automated, high-volume SMB traffic scanning adjacent subnets to exploit vulnerabilities without user interaction.
Memory forensics reveals shellcode executing dynamically within hijacked system process RAM spaces with no compiled executable written to disk.
Low-level system integrity monitoring detects unauthorized modifications to sector 0 of the primary disk to execute payload code before the operating system kernel initializes.

Matches

Show answer & explanation

Answer

The technical indicators match their malware classifications as follows: The rogue binary establishing backdoor control matches Remote Access Trojan (RAT); automated network scanning and vulnerability exploitation across subnets matches Self-Propagating Worm; memory-only shellcode execution without disk artifacts matches Fileless Malware; and disk sector 0 modification pre-OS boot matches Bootkit.
The disguised administrative access binary matches the Remote Access Trojan because it masquerades as a benign utility while providing covert remote command capability. The network scanning activity targeting port 445 matches the Self-Propagating Worm due to its autonomous spreading nature without victim interaction. The RAM-resident shellcode execution matches Fileless Malware as it avoids traditional disk-based detection. The sector 0 modification matches Bootkit because it alters the storage boot loader to execute code prior to kernel loading.

Step-by-Step Solution

1
Analyze each observed indicator of compromise to determine its primary infection vector and operational mechanism.
Indicator 1 uses disguise for remote control; Indicator 2 uses automated network replication; Indicator 3 operates purely in volatile memory; Indicator 4 targets pre-boot disk sectors.
Accurate malware classification requires identifying key behavioral signatures in system telemetry.
2
Map each behavioral signature to official malware taxonomy definitions.
Disguised remote access tool -> Remote Access Trojan; Autonomous network propagation -> Worm; Volatile memory injection -> Fileless Malware; MBR/pre-kernel persistence -> Bootkit.
Correlating telemetry artifacts to specific taxonomy terms ensures precise threat identification and response.

Key Concept

Malware Types and Indicators of Compromise
Question 203Question

An enterprise cloud security architect is evaluating isolation boundaries for a multi-tenant microservices platform. The platform currently runs multiple containerized services sharing a single host Linux kernel. During a risk assessment, the team identifies a risk where a kernel-level privilege escalation or vulnerability exploitation within one container could allow an attacker to escape to the host host OS and compromise adjacent tenant workloads. Which of the following deployment strategies provides the strongest architectural isolation boundary to mitigate host kernel sharing risks?

Show answer & explanation

Answer: Encapsulating container execution environments inside dedicated lightweight virtual machines (microVMs) with independent kernels

Answer

Encapsulating container execution environments inside dedicated lightweight virtual machines (microVMs) with independent kernels provides the strongest architectural isolation boundary against host kernel exploits.
Encapsulating container workloads inside dedicated lightweight virtual machines (microVMs) provides each instance with a distinct guest kernel managed by hardware-assisted virtualization. This ensures that any exploit targeting kernel vulnerabilities remains isolated within the microVM guest rather than compromising the host OS kernel shared by other tenants.

Step-by-Step Solution

1
Analyze the container threat model in shared-kernel environments
Containers traditionally share the underlying host operating system kernel via system call interfaces.
If a kernel flaw exists, any container making system calls can potentially escape to the host.
2
Evaluate hypervisor vs container isolation boundaries
Hypervisors utilize hardware virtualization extensions (e.g., VT-x/AMD-V) to isolate memory and execution spaces into virtual machines running separate guest kernels.
Lightweight virtual machines (microVMs) combine the quick startup time of containers with hypervisor-enforced kernel isolation.
3
Select the control that eliminates shared kernel vulnerability exposure
Running containers inside individual microVMs ensures that a container escape only compromises the isolated guest kernel of that microVM, not the host hypervisor or host OS.
This architectural pattern provides true defense-in-depth for multi-tenant microservices.

Key Concept

Hypervisor-assisted container isolation (microVMs) vs. kernel-sharing container isolation
Estimated Time:2m 0s
Question 204Question

A enterprise storage architect is designing a secure storage architecture for an off-site media storage facility and cloud synchronization gateway that processes large volumes of sensitive customer transactional data. The solution must ensure bulk encryption of data at rest with minimal CPU overhead, enforce hardware-isolated key protection to prevent key extraction, and prevent unauthorized exfiltration of unencrypted sensitive data across network egress interfaces. Which of the following technological controls should the architect incorporate into the architecture design to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Self-Encrypting Drives (SEDs) leveraging hardware-based AES-256 transparent encryption; Hardware Security Module (HSM) deployed to manage and safeguard root keys and Key Encryption Keys (KEKs)

Answer

The enterprise storage architecture should implement Self-Encrypting Drives (SEDs) utilizing AES-256 hardware encryption alongside a dedicated Hardware Security Module (HSM) for root key protection.
Implementing Self-Encrypting Drives provides high-speed, hardware-based symmetric encryption at rest (AES-256) without host CPU penalties. Pairing SEDs with a Hardware Security Module ensures key generation and protection occur inside a hardware-isolated, tamper-evident boundary.

Step-by-Step Solution

1
Evaluate bulk data encryption requirements for storage at rest.
Self-Encrypting Drives (SEDs) handle hardware-level symmetric bulk encryption directly on the drive controller, ensuring high performance without burdening system CPUs.
Bulk storage requires fast symmetric algorithms (like AES) offloaded to specialized hardware controllers.
2
Identify key management controls for hardware isolation.
A Hardware Security Module (HSM) provides physical and logical tamper-resistant boundaries to generate, store, and manage master keys and KEKs.
HSMs ensure cryptographic keys cannot be extracted in plaintext by unauthorized users or compromised OS layers.

Key Concept

Data Protection at Rest and Storage Hardware Security Architecture
Question 205Question

A security team is conducting a technical audit of an organization's network and application infrastructure. Match each identified cryptographic or security control weakness on the left with the precise risk or impact it presents on the right.

Click a left item, then click its matching right item

Items

Disabling Certificate Revocation List (CRL) and OCSP validation checks on client systems
Configuring block ciphers using Cipher Block Chaining (CBC) mode with static, predictable Initialization Vectors
Deploying Diffie-Hellman Key Exchange configured with a 1024-bit prime group (Group 2)
Embedding static API secret keys directly into compiled client-side mobile application code

Matches

Show answer & explanation

Answer

The correct pairings match each specific cryptographic weakness to its primary security consequence: Disabling CRL/OCSP checking leads to acceptance of revoked certificates; static IVs in CBC mode allow pattern recognition and replay attacks; 1024-bit DH Group 2 allows session decryption through precomputation attacks; hardcoded API keys in client binaries lead to universal key exposure via reverse engineering.
Each weakness is paired with its direct operational impact: Disabling revocation checks allows revoked certificates to be accepted; using static IVs in CBC mode compromises semantic security, enabling pattern leakage; using 1024-bit DH groups permits key exchange cracking via precomputation; hardcoding secret keys allows binary reverse-engineering to expose credentials universally.

Step-by-Step Solution

1
Analyze the impact of ignoring certificate revocation status (CRL/OCSP).
Identify that revoked or compromised certificates will still be trusted by the system.
Revocation validation guarantees that certificates invalidated before their planned expiration date are rejected.
2
Evaluate the mathematical requirement for Initialization Vectors in CBC block cipher mode.
Determine that static or predictable IVs leak information about plaintext patterns.
CBC mode requires unpredictable IVs to ensure identical plaintext blocks produce distinct ciphertext blocks.
3
Assess the cryptographic strength of 1024-bit Diffie-Hellman Key Exchange (Group 2).
Connect low key sizes to vulnerability against precomputation-based MitM attacks.
1024-bit modulus sizes offer insufficient security against modern discrete logarithm precomputation algorithms.
4
Examine the security implications of embedding secret keys within distributed client code.
Recognize that static secrets in client binaries can be extracted through reverse-engineering.
Client applications operate on untrusted hardware where binary disassembly can easily reveal hardcoded secrets.

Key Concept

Cryptographic and Security Control Weaknesses
Estimated Time:2m 0s
Question 206Question

A game development studio migrates its multiplayer matchmaking microservices to a managed Platform as a Service (PaaS) environment hosted by a public cloud provider. As part of defining the organization's cloud security baseline, the architecture team evaluates operational governance duties. Which of the following security responsibilities remains strictly with the game development studio under this cloud service model?

Show answer & explanation

Answer: Configuring application-level identity access management policies and user authentication controls

Answer

Configuring application-level identity access management policies and user authentication controls remains the customer's sole responsibility under Platform as a Service (PaaS).
Under the Platform as a Service (PaaS) shared responsibility model, the cloud provider assumes responsibility for host hardware, physical facility security, hypervisor management, operating system updates, and middleware engine maintenance. The cloud customer remains responsible for application code development, customer data management, and configuring application-level authentication and access control policies.

Step-by-Step Solution

1
Identify the cloud service model specified in the scenario.
The deployment uses Platform as a Service (PaaS).
Service models (IaaS, PaaS, SaaS) dictate how operational and security duties are partitioned between customer and vendor.
2
Analyze responsibility boundaries for PaaS environments.
The CSP manages physical data center security, hardware maintenance, hypervisor virtualization, operating system patching, and runtime stacks. The customer manages application logic, dataset configuration, and identity permissions.
PaaS abstracts underlying infrastructure management to allow developers to focus on software deployment and access management.
3
Determine which option represents a customer-retained security control.
Managing application-level user authentication and access control policies belongs to the customer.
Identity governance, application logic, and user access definitions remain the customer's duty regardless of the cloud service tier.

Key Concept

Cloud Shared Responsibility Model (PaaS)
Question 207Question

Match each specialized enterprise network architectural scenario with the network segmentation control or isolation mechanism that best satisfies its security and operational constraints.

Click a left item, then click its matching right item

Items

A legacy industrial control system (ICS) sensor network running end-of-life firmware must transmit batch operational logs out to an external cloud database while strictly blocking any physical or logical inbound transmission paths.
A multi-tenant containerized microservices application requires workload-to-workload identity verification and dynamically enforced intra-host software policy without relying on static IP subnets or perimeter firewall rules.
A corporate remote access environment requires external third-party auditors to access internal administrative web consoles without granting their client devices direct IP network routing into the internal corporate subnets.
A public access Wi-Fi network deployed across corporate branch offices must allow connected client endpoints to reach the default gateway while prohibiting direct Layer 2 peer-to-peer traffic between clients on the same subnet.

Matches

Show answer & explanation

Answer

The scenarios correctly match as follows: Legacy ICS telemetry requiring strictly one-way egress matches Unidirectional Data Diode with physical layer isolation; Multi-tenant container microservice isolation requiring identity verification matches Service Mesh Microsegmentation using eBPF and mTLS attestation; Third-party remote access without direct subnet routing matches Jump Box / Bastion Host in a DMZ with proxy brokering; Public branch Wi-Fi client-to-client blocking on a shared subnet matches Private VLANs (PVLANs) configured with isolated ports.
Each segmentation technology directly aligns with the operational constraints of the scenario: physical data diodes guarantee hardware-level one-way transmission for sensitive OT logs; eBPF microsegmentation with mTLS enforces identity-based zero trust for ephemeral container workloads; proxy-based jump boxes isolate internal networks from third-party client routing; and PVLAN isolated ports restrict Layer 2 lateral communications on shared wireless subnets.

Step-by-Step Solution

1
Analyze the legacy ICS requirement for guaranteed one-way outbound data movement with zero inbound connectivity.
Identified physical unidirectional data diode enforcement as the only control preventing backchannel traffic hardware-wide.
Firewalls or software ACLs can be misconfigured or bypassed, whereas data diodes enforce hardware-level physical one-way transmission.
2
Evaluate intra-host container microservices dynamic zero-trust requirements.
Identified service mesh microsegmentation using eBPF and mTLS workload attestation.
Dynamic container environments require identity-based policy enforcement rather than static network IP subnet boundaries.
3
Evaluate third-party remote management without network-level access.
Identified jump box / bastion host with application proxy brokering in a DMZ.
Proxying session protocol payloads avoids routing network packets directly from untrusted client endpoints into corporate subnets.
4
Analyze public Wi-Fi peer-to-peer Layer 2 isolation on the same broadcast domain.
Identified Private VLANs (PVLANs) with isolated ports.
PVLAN isolated ports allow frames to flow only to promiscuous ports (gateway) and drop inter-port client communication.

Key Concept

Selecting network architecture controls based on isolation boundaries (physical, microsegmentation, proxy/bastion, and Layer 2 PVLANs).
Question 208Question

A threat hunting team performs memory analysis on a suspected workstation and discovers active network sockets associated with hidden execution threads. Lower-level operating system call tables have been intercepted to filter out these specific process IDs from standard administrative monitoring tools. Which of the following malware types is MOST likely operating on the system?

Show answer & explanation

Answer: Rootkit

Answer

Rootkit
The correct answer is the option identifying a rootkit. Rootkits modify core operating system functions, system call tables, or kernel data structures to mask the presence of files, registry keys, network connections, and process listings from standard management utilities.

Step-by-Step Solution

1
Analyze the technical indicators in the scenario.
Identified system call table interception (API hooking) and intentional hiding of process IDs and active network sockets from user-space administrative tools.
Understanding host telemetry and stealth techniques isolates the fundamental objective of the malware.
2
Compare observed indicators against malware functionality characteristics.
Rootkits operate at deep system levels (kernel or driver level) specifically designed to subvert OS reporting mechanisms and mask unauthorized activities.
Distinguishing stealth/evasion mechanisms from execution or propagation strategies points directly to rootkit functionality.

Key Concept

Rootkit evasive techniques and kernel-level subversion
Question 209Question

A security analyst conducts incident triage on an enterprise server and uncovers two distinct anomalous indicators:

1. The standard administrative utility binary on disk was replaced with a compromised version that allows unauthorized access using a hardcoded master key.
2. A loadable kernel module is actively intercepting system calls to modify process listings, effectively hiding malicious processes and network sockets from diagnostic commands.

Which of the following malware classifications or mechanisms are directly demonstrated by these forensic findings? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Trojan execution via system binary replacement; Rootkit functionality through kernel-level hook interception

Answer

The correct selections are Trojan execution via system binary replacement and Rootkit functionality through kernel-level hook interception.
The scenario demonstrates Trojan malware because a legitimate utility executable was modified to include an unauthorized backdoor. Additionally, rootkit functionality is present because a loadable kernel module subverts system call outputs to hide processes and network connections from administrators.

Step-by-Step Solution

1
Analyze Indicator 1 (Replacing a legitimate administrative utility with a malicious version that includes a master key).
Identify that disguising malicious functionality within legitimate system binaries corresponds to Trojan malware.
Trojans masquerade as or overwrite benign software components to establish unauthorized administrative access.
2
Analyze Indicator 2 (Utilizing a kernel module to intercept system calls and hide running processes/sockets).
Identify that low-level stealth techniques modifying kernel system calls to conceal system state correspond to Rootkits.
Rootkits operate at deep system levels (such as kernel space) to subvert operating system reporting tools and evade detection.
3
Evaluate remaining choices against observed telemetry.
Exclude self-propagating worms and logic bombs because no autonomous network replication or logical execution triggers are indicated.
Worms focus on spreading automatically across networks, while logic bombs require specific event conditions to launch.

Key Concept

Malware Indicators of Compromise (Trojans vs Rootkits)
Question 210Question

A biomedical equipment manufacturer is designing an embedded patient monitoring device intended for hospital environments where physical access to the device cannot be fully restricted. To meet strict regulatory standards, the architecture must guarantee that the initial bootloader execution sequence is validated using one-time programmable, non-volatile hardware fuses burned into the system-on-chip during manufacturing, preventing any subsequent firmware update or physical attacker from altering the initial trust anchor. Which hardware security component best establishes this immutable, non-modifiable foundation for the secure boot process?

Show answer & explanation

Answer: eFuse-backed hardware Root of Trust (RoT)

Answer

The eFuse-backed hardware Root of Trust (RoT) provides an immutable, non-modifiable foundation programmed during manufacturing to validate the initial bootloader prior to execution.
An eFuse-backed hardware Root of Trust establishes an immutable anchor by burning key hashes or configuration flags into the physical chip silicon during manufacturing. Because eFuses cannot be reset or reprogrammed, the processor reliably executes only authentic boot code before handing control to subsequent boot stages.

Step-by-Step Solution

1
Analyze the scenario requirements
Identified the need for an unalterable, manufacturing-level hardware mechanism to validate initial boot code execution under physical access threats.
Embedded systems security requires validating early boot code before loading higher-level software components.
2
Evaluate hardware-level trust mechanisms
eFuse technology irreversibly alters microscopic fuses on-chip during factory provisioning, rendering the stored public key hash or boot configuration permanently read-only.
Only physical, non-reprogrammable hardware states like eFuses ensure non-modifiability even if an attacker possesses physical access.
3
Distinguish from inadequate runtime or external controls
Ruled out external network appliances, symmetric RAM encryption, and OS software integrity monitoring.
These controls operate either outside the local boot stage, target dynamic runtime data confidentiality, or run after kernel load.

Key Concept

eFuse and Hardware Root of Trust (RoT)
Question 211Question

During an incident response investigation, a security analyst reviews an Endpoint Detection and Response (EDR) alert on a enterprise workstation. Telemetry logs show that a user opened a weaponized document that invoked PowerShell. The script executed directly within system memory, injected shellcode into a legitimate system process, established an encrypted reverse shell, and modified registry run keys for persistence without creating executable binary files on the local disk. Which of the following malware classifications best describes this threat?

Show answer & explanation

Answer: Fileless malware

Answer

Fileless malware
Fileless malware operates in volatile memory (RAM) and uses built-in administrative tools such as PowerShell or Command Prompt (living-off-the-land techniques). Because no malicious executable binaries are written to disk, traditional file-based antivirus solutions often fail to detect it.

Step-by-Step Solution

1
Analyze host log indicators and execution path
Identified PowerShell launching from a document macro and executing payload directly in system RAM.
Tracking the execution chain reveals how the initial access vector initiated code execution.
2
Evaluate disk activity and persistence mechanisms
No new executable files (.exe, .dll) were written to disk; persistence relies on registry keys calling built-in utilities.
Absence of traditional disk-based malicious binaries is the hallmark signature of fileless attacks.
3
Synthesize indicators to determine malware type
Memory-resident execution using native OS binaries (Living off the Land) classifies the attack as fileless malware.
Fileless threats leverage system tools (e.g., PowerShell, WMI) to operate inside RAM without dropping files.

Key Concept

Fileless Malware Telemetry and Indicators of Compromise
Estimated Time:1m 30s
Question 212Question

A security analyst reviews a vulnerability scan report for an internal web application server. The scan output displays the following finding:

text
Host: 192.168.10.45:443
Plugin Name: TLS/SSL Server Supports Weak Cipher Suites / Legacy Protocols
Risk Factor: High
Description: The remote service accepts TLS 1.0 and SSL 3.0 protocol negotiations using CBC-mode ciphers.

Which of the following host and infrastructure vulnerabilities is directly identified by this report?

Show answer & explanation

Answer: Implementation of outdated cryptographic protocols and weak encryption ciphers

Answer

Implementation of outdated cryptographic protocols and weak encryption ciphers
The correct answer identifies the underlying flaw: using deprecated protocols (SSL 3.0 and TLS 1.0) and cipher suites. These legacy standards lack modern cipher safeguards and expose transport security to downgrade and man-in-the-middle exploits. Remediating this host vulnerability requires configuring the web server to enforce TLS 1.2 or TLS 1.3 with secure cipher suites.

Step-by-Step Solution

1
Analyze the vulnerability scanner output snippet.
Identified port 443 active services accepting SSL 3.0 and TLS 1.0 connections with CBC ciphers.
Vulnerability scanners flag legacy SSL/TLS versions due to well-known protocol design flaws and cryptographic weaknesses.
2
Evaluate the underlying vulnerability category.
The issue is a host infrastructure configuration flaw regarding supported cryptographic algorithms and protocols.
Host security hardening requires disabling deprecated protocols (SSL 3.0, TLS 1.0, TLS 1.1) and enabling modern protocols (TLS 1.2, TLS 1.3).

Key Concept

Host and Infrastructure Cryptographic Vulnerabilities
Estimated Time:1m 15s
Question 213Question

An incident response team at a critical defense manufacturing contractor is investigating a prolonged network intrusion. Analysis reveals that the attacker leveraged undisclosed zero-day exploits across third-party supply chain software, executed custom fileless malware directly in memory, and maintained persistent command-and-control communications over eight months using domain fronting techniques. The threat group operated during standard business hours of a foreign timezone, conducted targeted reconnaissance without exfiltrating immediate commercial value data or deploying extortion malware, and focused exclusively on long-term technological blueprint espionage. Which threat actor type and attribute profile best categorizes this adversary?

Show answer & explanation

Answer: Nation-state actor operating as an Advanced Persistent Threat (APT) with high technical sophistication, extensive financial resources, and long-term strategic espionage motivation.

Answer

The threat actor is best categorized as a Nation-state actor operating as an Advanced Persistent Threat (APT) with high technical sophistication, extensive financial resources, and long-term strategic espionage motivation.
The scenario describes an adversary with high sophistication (zero-day exploits, memory-only malware, domain fronting), deep resources (multi-month persistent campaign), and strategic motivation (defense sector espionage without financial extortion). These attributes precisely define a Nation-state actor or Advanced Persistent Threat (APT).

Step-by-Step Solution

1
Analyze the technical capabilities demonstrated in the scenario.
The adversary utilized zero-day exploits, supply chain attack vectors, custom memory-only malware, and evasive domain fronting techniques.
These indicators demonstrate high technical sophistication and significant financial backing.
2
Evaluate the temporal pattern and operational profile.
The campaign lasted over eight months with disciplined operations corresponding to foreign business hours.
Advanced persistent persistence and covert activity signal structured, organized entity operations rather than opportunistic attacks.
3
Determine the primary motivation from the adversary's actions.
The adversary prioritized long-term intelligence gathering and defense intellectual property espionage over immediate monetization or public disruption.
Geopolitical espionage and strategic intelligence gathering are core motivators characteristic of state-sponsored APT groups.

Key Concept

Threat Actor Attributes, Motivations, and Attack Vectors
Question 214Question

A security analyst is inspecting a critical legacy host after an automated vulnerability assessment flagged multiple high-severity findings. The scanner provided the following port audit report and service banner details:

PORT STATE SERVICE VERSION / NOTES
21/tcp OPEN ftp vsftpd 2.3.4 (CVE-2011-2523 confirmed exploitable)
23/tcp OPEN telnet Linux telnetd (Plaintext authentication enabled)
80/tcp OPEN http Apache httpd 2.2.15 ((CentOS) OS end-of-life)
443/tcp CLOSED https No TLS listener configured

Which of the following identifies the primary host and architecture root cause vulnerability exposing this server to immediate remote privilege escalation and credential compromise?

Show answer & explanation

Answer: Execution of end-of-life host software containing known backdoor vulnerabilities combined with active unencrypted cleartext management protocols.

Answer

Execution of end-of-life host software containing known backdoor vulnerabilities combined with active unencrypted cleartext management protocols.
The correct option accurately pinpointed the root cause of the host vulnerability: running an end-of-life service version (vsftpd 2.3.4) containing a known remote backdoor exploit alongside unencrypted legacy protocols (Telnet) that expose authentication credentials in cleartext.

Step-by-Step Solution

1
Analyze the vulnerability scan log for specific service flags and CVEs.
Identified vsftpd 2.3.4 (CVE-2011-2523, a known malicious backdoor execution flaw), Telnet (unencrypted protocol), and Apache 2.2.15 (outdated/EOL web service).
Vulnerability assessment logs highlight active vulnerable services and insecure protocol implementations.
2
Evaluate the risk posed by host configuration flaws versus network control dependencies.
The host exposes remote code execution risks via unpatched host software and eavesdropping risks via cleartext transport.
Host security relies primarily on patching applications and removing legacy unencrypted daemons.
3
Determine the root cause underlying the vulnerability state.
The core issue is running unsupported/vulnerable host binaries and legacy cleartext management services.
Addressing host vulnerabilities requires remediating the unpatched/insecure host services directly.

Key Concept

Host and Infrastructure Vulnerabilities (Legacy Software & Cleartext Protocols)
Question 215Question

A security team is selecting security testing methods and assessment techniques for different operational scenarios. Match each security assessment method on the left with its corresponding operational description on the right.

Click a left item, then click its matching right item

Items

Active Vulnerability Scanning
Passive Vulnerability Scanning
Grey-Box Penetration Testing
Dynamic Application Security Testing (DAST)

Matches

Show answer & explanation

Answer

Active Vulnerability Scanning matches with sending crafted packets directly to target hosts; Passive Vulnerability Scanning matches with analyzing network traffic signatures in real time; Grey-Box Penetration Testing matches with simulating an attack using partial internal knowledge; Dynamic Application Security Testing (DAST) matches with evaluating running web applications externally without access to source code.
Each assessment method correctly aligns with its execution context: Active scanning sends direct probes to discover vulnerabilities; Passive scanning non-intrusively monitors traffic; Grey-box testing utilizes partial system information; and DAST evaluates live applications dynamically without access to underlying source code.

Step-by-Step Solution

1
Identify active network testing mechanisms.
Active vulnerability scanning relies on sending probes directly to targets to query system state.
Direct host probing allows detection of specific service versions and missing patches.
2
Identify non-intrusive traffic monitoring techniques.
Passive scanning observes network traffic without injecting probes.
Monitoring packets preserves bandwidth and avoids disruption to sensitive hosts.
3
Differentiate penetration testing knowledge scopes.
Grey-box testing provides limited internal information like credentials or diagrams.
Partial visibility simulates an insider or compromised user threat scenario.
4
Classify application security testing frameworks.
DAST tests operating applications from the outside during execution.
Runtime analysis evaluates application responses without requiring source code.

Key Concept

Vulnerability Assessment and Security Testing Methods
Question 216Question

During a comprehensive security audit for a healthcare enterprise, a security analyst identifies several distinct threat profiles and attack vectors. Match each threat actor type or vector on the left with its defining operational attribute or scenario on the right.

Click a left item, then click its matching right item

Items

Shadow IT Deployment
Hacktivist Collective
Advanced Persistent Threat (APT)
Disgruntled Employee (Intentional Insider)

Matches

Show answer & explanation

Answer

Shadow IT Deployment matches introducing unvetted SaaS tools without IT authorization. Hacktivist Collective matches coordinating website defacements and DDoS attacks driven by political causes. Advanced Persistent Threat (APT) matches executing long-term cyber espionage using zero-day exploits and state resources. Disgruntled Employee matches exfiltrating research using legitimate administrative privileges prior to resignation.
Shadow IT is characterized by unauthorized technology adoption (unvetted SaaS). Hacktivists are driven by social or political motives through disruptive acts (defacement/DDoS). APTs possess nation-state backing and high technical sophistication for persistent espionage. Disgruntled employees abuse authorized access for malicious exfiltration prior to departure.

Step-by-Step Solution

1
Analyze the core motivation, resource capability, and authorization level of each threat actor and vector.
Shadow IT is defined by unvetted internal tool adoption; Hacktivism by political disruption; APT by state-backed sophisticated espionage; Insider by privilege abuse due to grievance.
Accurately categorizing threat actors requires distinguishing between intent, capability, funding, and operational methods.
2
Pair each threat actor or vector with its corresponding operational description.
Shadow IT maps to unvetted SaaS usage; Hacktivists map to political DDoS/defacement; APT maps to state-funded zero-day espionage; Disgruntled Employee maps to privilege abuse prior to resignation.
Each scenario aligns with a unique combination of threat attributes specified in security standards.

Key Concept

Threat Actor Types, Attributes, and Attack Vectors
Question 217Question

During a routine security audit, a security analyst discovers that several Linux web servers hosted in an Infrastructure as a Service (IaaS) environment have diverged from the enterprise's hardened configuration baseline after manual hotfixes were applied by system administrators. Which of the following implementation strategies best provides automated drift detection and continuously enforces the designated configuration baseline across the server fleet?

Show answer & explanation

Answer: Deploying configuration management tools utilizing declarative state files operating in enforcement mode

Answer

Deploying configuration management tools utilizing declarative state files operating in enforcement mode
The correct response utilizes declarative configuration management (such as Ansible, Puppet, or Chef) operating in enforcement mode. These tools continuously audit the system's current state against an authoritative configuration baseline and automatically remediate any detected drift back to the defined security state.

Step-by-Step Solution

1
Analyze the problem requirements
Identified the need to remediate manual configuration drift on IaaS Linux web servers automatically and continuously.
Manual changes lead to unapproved deviations from established security baselines.
2
Evaluate the cloud shared responsibility model and control capabilities
Eliminated relying on the CSP for OS configuration as IaaS places OS management responsibilities on the customer. Eliminated network firewalls and HIPS as they do not provide automated state remediation.
Control selection must directly address host OS configuration enforcement.
3
Select the appropriate configuration management mechanism
Chosen configuration management software executing declarative policy files in enforcement mode.
Declarative tools regularly check system state against the baseline artifact and automatically overwrite unapproved manual edits back to the approved state.

Key Concept

Configuration Baseline Drift Remediation
Question 218Question

An enterprise security team is addressing risks associated with a critical legacy operational technology (OT) monitoring console that cannot be updated or patched without voiding vendor support compliance. To manage this liability, the organization purchases a third-party cybersecurity insurance policy covering unauthorized access incidents and deploys an isolated, read-only out-of-band network monitoring tap to detect suspicious network traffic without interrupting operations. Which of the following risk response strategies are demonstrated in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Risk Transference; Risk Mitigation

Answer

Risk Transference and Risk Mitigation
Purchasing a cyber insurance policy transfers financial liability for security breaches to a third-party insurer (Risk Transference). Implementing out-of-band traffic monitoring reduces the risk profile by providing early threat detection without disrupting legacy system stability (Risk Mitigation).

Step-by-Step Solution

1
Analyze the financial protection strategy described in the scenario.
Obtaining a cybersecurity insurance policy shifts the financial liability of a breach to an external insurer.
Risk transference involves delegating or shifting risk liability to a third party.
2
Analyze the technical security control implemented in the scenario.
Installing an out-of-band read-only tap introduces detective capabilities that lower the risk footprint of the unpatchable asset.
Risk mitigation involves taking action to reduce the probability or impact of a threat.

Key Concept

Risk Response Strategies
Question 219Question

A newly hired security manager at a healthcare technology company is organizing the documentation repository to distinguish between mandatory compliance directives and discretionary guidance. Which of the following documents constitute mandatory elements of an enterprise security governance framework? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: An organizational Information Security Standard mandating minimum encryption strength for stored patient records; An Enterprise Security Policy establishing executive management's overarching directives and commitment to data protection

Answer

The mandatory governance elements are the organizational Information Security Standard and the Enterprise Security Policy.
In security governance hierarchies, policies represent high-level mandatory directives issued by executive management, while standards define mandatory compulsory technical or operational controls required to enforce those policies.

Step-by-Step Solution

1
Distinguish mandatory governance documents from discretionary documents.
Policies and standards are compulsory within an enterprise, while guidelines are advisory and optional.
Governance frameworks rely on policies for authority and standards for mandatory technical implementation rules.
2
Evaluate the candidate options against compulsory governance criteria.
The Information Security Standard enforces mandatory technical specifications, and the Enterprise Security Policy enacts mandatory executive directives.
Both documents establish required compliance rules that personnel must follow.
3
Analyze the remaining distractor options.
Guidelines are optional recommendations, network diagrams are reference artifacts, and access control tables enforce technical authorization.
None of these distractors represent mandatory policy or standard level governance documents.

Key Concept

Security Governance Hierarchy: Mandatory Policies and Standards vs. Discretionary Guidelines
Estimated Time:1m 30s
Question 220Question

Match each business continuity concept on the left with the operational description on the right that best defines its role in disaster recovery planning.

Click a left item, then click its matching right item

Items

Work Recovery Time (WRT)
Maximum Tolerable Downtime (MTD)
Mean Time to Repair (MTTR)
Single Point of Failure (SPOF)

Matches

Show answer & explanation

Answer

The correct pairings align each continuity metric with its precise operational boundary: Work Recovery Time matches the phase for post-restoration business testing; Maximum Tolerable Downtime matches the ultimate time limit before irreversible damage; Mean Time to Repair matches the technical fix duration; and Single Point of Failure matches a critical unredundant component.
Each business continuity concept directly matches its operational definition: Work Recovery Time focuses on business verification after technical recovery; Maximum Tolerable Downtime represents the upper time boundary before critical business collapse; Mean Time to Repair is the average technical restoration speed; and Single Point of Failure is an unredundant bottleneck that can halt an entire service.

Step-by-Step Solution

1
Differentiate between technical restoration metrics and business recovery testing phases.
Identified MTTR as technical repair duration and WRT as business verification time.
MTTR focuses on hardware/software fix speed, whereas WRT occurs after technical restoration to validate business data and processes.
2
Distinguish organizational outage thresholds from system vulnerability concepts.
Associated MTD with total allowable failure time limit and SPOF with architectural vulnerability lacking redundancy.
MTD establishes overall outage limits, while SPOF identifies specific single components capable of taking down whole systems.

Key Concept

Business Continuity Planning and Metrics
PreviousPage 11 / 112Next
All practice questions — CompTIA Security+ | Examkin