All practice questions

Match each enterprise system hardening control to its primary technical mitigation objective.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Disabling Unused OS Services matches minimizing the host attack surface; Application Allowlisting matches preventing unauthorized binaries from running; Automated Patch Management matches removing known software flaws (CVEs); and UEFI Secure Boot matches ensuring root-of-trust integrity during startup.

Each hardening control maps directly to its intended technical outcome: disabling services reduces exposed host attack surface, application allowlisting prevents unauthorized code execution, automated patch management fixes known security bugs (CVEs), and UEFI Secure Boot maintains cryptographic boot integrity against bootkits.

Step-by-Step Solution

1

Analyze host attack surface reduction controls.

Identify that turning off unneeded network services and ports eliminates potential avenues for remote exploitation.

Deactivating unused network endpoints directly minimizes host exposure.

2

Evaluate executable binary control mechanisms.

Connect application allowlisting with policies that enforce explicitly trusted executables and scripts.

Allowlisting prevents unauthorized binary execution even if malicious files are downloaded to disk.

3

Assess vulnerability lifecycle remediation.

Link automated patch deployment to addressing publicly reported vulnerabilities.

Patch management updates software binaries to resolve known coding defects (CVEs).

4

Examine pre-boot integrity verification controls.

Associate UEFI Secure Boot with verifying digital signatures of boot components prior to operating system initialization.

Secure Boot prevents rootkits and untrusted drivers from loading into memory before security software initializes.

Key Concept

Enterprise Host Hardening and Security Controls

Question 202Question →

An enterprise security architect is designing an Identity and Access Management (IAM) framework to address several distinct security requirements across a hybrid cloud environment. Match each IAM architectural mechanism on the left with its corresponding enterprise use case on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Ephemeral Credential Broker matches short-lived cloud permissions. Vaulted Credential Session Proxy matches isolating administrative sessions and obfuscating root passwords. SCIM-Based Dynamic Provisioning Engine matches user lifecycle identity synchronization. Certificate-Based Workload mTLS Architecture matches service-to-service authentication for zero-trust microsegments.

Each IAM architecture mechanism directly addresses its respective enterprise design goal: Ephemeral Brokers enable short-lived Just-In-Time access; Session Proxies secure and audit legacy administrator credentials without revealing passwords; SCIM automates account lifecycle management across external platforms; and Workload mTLS enforces mutual cryptographic authentication in microservice networks.

Step-by-Step Solution

1

Analyze the IAM architectural mechanisms to determine their functional capabilities.

Categorized mechanisms into short-lived authorization (ephemeral broker), privileged account proxying (session proxy), user identity lifecycle management (SCIM), and machine identity authentication (mTLS).

Evaluating core capabilities allows proper mapping to security requirements.

2

Match each control mechanism to the enterprise scenario that explicitly requires its technical implementation.

Aligned temporary permissions with JIT brokers, legacy session recording with vault proxies, identity synchronization with SCIM, and zero-trust workload traffic security with mTLS.

Ensures architectural alignment between IAM security controls and specific enterprise operational requirements.

Key Concept

Identity and Access Management Architecture Controls and Protocols

Question 203Question →

A security architect is establishing high availability guidelines for enterprise infrastructure. Which architectural control specification best matches each resilience technology?

Click a left item, then click its matching right item

Show answer & explanation

Answer

NIC Teaming matches adapter-level link aggregation; Geographic Dispersal matches distribution across geographically separate facilities; Active-Passive Clustering matches a primary active node with an idle standby node; Multipath I/O matches redundant physical paths between server hardware and storage arrays.

Each high-availability control is mapped to its appropriate architectural scope: NIC Teaming operates at the network interface layer, Geographic Dispersal mitigates site-level operational risks, Active-Passive Clustering manages compute failover using a dedicated standby node, and Multipath I/O ensures continuous storage fabric availability.

Step-by-Step Solution

1

Identify network interface redundancy controls

Match NIC Teaming to the aggregation of physical network interfaces for adapter failover.

NIC Teaming specifically handles network interface card and link redundancy.

2

Identify site-level resilience mechanisms

Associate Geographic Dispersal with distributing assets across separate physical regions.

Physical separation protects against wide-area site outages.

3

Evaluate high-availability cluster failover modes

Map Active-Passive Clustering to the configuration where a standby secondary node waits for primary node failure.

Active-passive nodes do not process active workloads simultaneously.

4

Analyze storage bus interface redundancy mechanisms

Link Multipath I/O (MPIO) to redundant hardware channels between host servers and SAN storage controllers.

MPIO protects against storage bus, Fibre Channel HBA, or cable disruptions.

Key Concept

High Availability and Infrastructure Redundancy Controls

Estimated Time:1m 30s

Question 204Question →

A security analyst is investigating several network and wireless security alerts recorded across an enterprise network. Match each observed technical attack indicator with its corresponding attack classification.

Click a left item, then click its matching right item

Show answer & explanation

Answer

RF Jamming matches high RF noise floor indicators; ARP Poisoning matches unsolicited ARP reply IP-to-MAC mappings; Bluejacking matches unsolicited Bluetooth messages; Evil Twin matches rogue APs broadcasting identical SSIDs with different BSSIDs.

Each technical indicator maps precisely to its corresponding attack vector based on network protocol behaviors and radio frequency characteristics.

Step-by-Step Solution

1

Analyze physical wireless spectrum indicators.

Identify that elevated noise floors causing frame retransmissions and signal degradation correspond to RF Jamming.

Jamming directly injects RF noise onto wireless frequencies to disrupt communication channels.

2

Analyze Ethernet layer address resolution protocol traffic.

Identify that unsolicited ARP responses redirecting IP mappings to a target MAC correspond to ARP Poisoning.

An attacker sends gratuitous ARP replies to poison neighbor cache entries for man-in-the-middle positioning.

3

Analyze short-range mobile wireless message alerts.

Identify that sending unsolicited messages over Bluetooth without unauthorized data exfiltration corresponds to Bluejacking.

Bluejacking exploits Bluetooth OBEX push protocols to deliver unwanted messages to discoverable devices.

4

Analyze wireless access point parameters.

Identify that a rogue access point mimicking a legitimate SSID with an altered BSSID corresponds to an Evil Twin attack.

Evil Twin setups clone legitimate wireless network profiles to lure users into connecting and revealing credentials.

Key Concept

Network and Wireless Attack Indicators

Question 205Question →

An enterprise organization is deploying Zero Trust Architecture (ZTA) across its cloud and on-premises infrastructure. Match each core Zero Trust principle on the left with its corresponding operational security mechanism on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Explicit Verification corresponds to evaluating identity, location, device compliance, and context before granting access. Least Privilege Access corresponds to restricting rights using Just-In-Time and Just-Enough-Access models. Assume Breach corresponds to limiting lateral movement using microsegmentation and internal network encryption. Continuous Adaptive Monitoring corresponds to re-evaluating risk and adjusting access dynamically during active sessions.

Zero Trust Architecture principles establish explicit enforcement boundaries: Explicit Verification validates identity and posture upfront; Least Privilege Access applies JIT/JEA controls to restrict permission scope; Assume Breach utilizes microsegmentation and encryption to limit blast radius; and Continuous Adaptive Monitoring dynamically re-evaluates active session telemetry.

Step-by-Step Solution

1

Analyze Explicit Verification operational controls

Identify controls requiring multi-factor contextual validation (identity, device compliance, location) before granting access.

Explicit Verification mandates that no request is trusted implicitly based on network location alone.

2

Analyze Least Privilege Access operational controls

Identify controls utilizing JIT and JEA to restrict permissions.

Least privilege limits user capabilities to the bare minimum required for their immediate job role.

3

Analyze Assume Breach operational controls

Identify containment controls such as network microsegmentation and ubiquitous transport encryption.

Assuming an internal intruder requires architectural controls that prevent unimpeded lateral movement.

4

Analyze Continuous Adaptive Monitoring operational controls

Identify controls that inspect live telemetry to adjust active session risk scores dynamically.

Zero Trust treats trust as ephemeral, requiring continuous posture assessment throughout a session.

Key Concept

Core Zero Trust Architectural Principles and Tenets

Question 206Question →

Match each enterprise security assessment objective on the left with the scanning configuration or methodology best suited to satisfy it on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The correct pairings match each specific enterprise constraint with its appropriate scanning methodology: assessing short-lived auto-scaling nodes requires Agent-Based Vulnerability Scanning; inspecting application libraries pre-deployment requires Static Container & Dependency Scanning; testing authenticated web applications without lockout requires Credentialed Dynamic Web Application Scanning with Throttled Authentication Scripts; and discovering assets on sensitive SCADA networks requires Passive Network Monitoring.

Each assessment methodology addresses distinct operational constraints. Agent-based scanning is ideal for ephemeral cloud workloads because the scanner software executes locally as soon as the instance boots, sending results back to a central console without needing network probe access. Static container and dependency scanning shifts security left into the software development life cycle, analyzing manifest files and container layers before software reaches production. Credentialed dynamic web scanning allows deep inspection of post-authentication application logic, but requires specific throttling rules so automated fuzzing does not trigger account lockouts. Passive network monitoring reads raw traffic copies (SPAN/TAP) to build an asset inventory on sensitive industrial SCADA networks without generating active network traffic that could cause device crashes.

Step-by-Step Solution

1

Analyze the technical constraints and risk profiles for each enterprise deployment environment.

Identified key operational boundaries: ephemeral lifetime in cloud nodes, shift-left pipeline security for dependencies, lockout sensitivity in web apps, and system instability risks in SCADA networks.

Matching scanning methods to enterprise scenarios requires balancing coverage depth against network and operational impact.

2

Select the scanning architecture tailored to mitigate each specific operational drawback.

Local agents solve cloud host ephemerality; pipeline integration catches build defects early; throttled dynamic scanners prevent web account lockouts; passive packet capturing avoids SCADA crashes.

Each vulnerability assessment method operates at a distinct layer (host, pipeline, application layer, or passive wire level) designed for specific operational constraints.

Key Concept

Selecting and configuring vulnerability assessment methods appropriate for cloud, pipeline, web application, and operational technology (OT) environments.

Estimated Time:2m 30s

Question 207Question →

Match each enterprise identity and access management (IAM) protocol to its corresponding architectural use case and operational characteristic.

Click a left item, then click its matching right item

Show answer & explanation

Answer

OAuth 2.0 matches delegated API authorization; OpenID Connect matches user authentication extensions on OAuth 2.0; RADIUS matches UDP-based combined network AAA; TACACS+ matches fully encrypted TCP-based administrator device access.

Each protocol is paired according to its native architectural function: OAuth 2.0 provides delegated authorization, OIDC adds user authentication via ID tokens, RADIUS provides combined UDP-based network AAA, and TACACS+ provides fully encrypted, decoupled TCP device management AAA.

Step-by-Step Solution

1

Differentiate between authorization frameworks and identity layers for web applications.

Identify OAuth 2.0 as the core delegated authorization framework and OIDC as the identity authentication layer.

OAuth 2.0 issues access tokens for APIs, while OIDC adds ID tokens for user identity.

2

Analyze network access protocols vs device administration AAA protocols.

Identify RADIUS for UDP network access AAA and TACACS+ for TCP administrator AAA.

RADIUS combines auth/authz over UDP, whereas TACACS+ separates auth/authz and encrypts full payloads over TCP.

Key Concept

Identity and Access Management Architecture Protocols

Question 208Question →

An enterprise security architect is transitioning legacy perimeter security controls to align with Zero Trust Architecture (ZTA) design tenets. Match each Zero Trust architectural concept on the left to its corresponding operational function on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Implicit Trust Zone Removal corresponds to eliminating default trust based on network location. Continuous Adaptive Risk Evaluation corresponds to dynamically re-evaluating session state and context throughout an active connection. Microsegmentation corresponds to dividing network environments into small isolated zones to restrict lateral movement. Control Plane and Data Plane Separation corresponds to decoupling policy decision logic from application traffic paths.

Each Zero Trust term matches its core architectural operational responsibility: removing implicit trust strips location-based assumptions; continuous adaptive evaluation continuously monitors session context; microsegmentation restricts internal lateral movement; and control/data plane separation decouples policy management from data transit paths.

Step-by-Step Solution

1

Analyze the core premise of Zero Trust regarding network location and implicit trust.

Identify that removing implicit trust eliminates reliance on physical or IP-based network location.

Legacy networks trust internal IP segments; Zero Trust demands zero inherent trust regardless of location.

2

Evaluate session lifetime management principles in Zero Trust.

Map Continuous Adaptive Risk Evaluation to ongoing context and behavioral re-validation.

Authentication and authorization must not be static single-point-in-time checks.

3

Analyze containment strategies within Zero Trust Architecture.

Map Microsegmentation to creating granular isolated zones around workloads to prevent lateral movement.

Breach containment relies on restricting traffic between workload segments.

4

Examine architectural component separation.

Map Control Plane and Data Plane Separation to isolating policy evaluation logic from data traffic transmission.

Policy engines and administrators process control requests independently of raw data forwarding paths.

Key Concept

Zero Trust Architecture Principles

Question 209Question →

During an enterprise security audit, an incident response team identifies four distinct technical indicators across wireless and wired network segments. Match each observed technical anomaly on the left to its corresponding attack classification on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The technical anomalies match their respective attack categories based on protocol-specific indicators: 802.11 management deauth frames match Deauthentication Attack; unsolicited ARP responses match ARP Poisoning; unauthorized IPv6 Neighbor Advertisements match NDP Spoofing; and rogue APs broadcasting legitimate SSIDs match Evil Twin Attack.

Each technical log indicator aligns directly with its underlying protocol behavior: 802.11 management deauthentication frames force client disconnects (Deauthentication Attack); gratuitous ARP replies corrupt local ARP caches (ARP Poisoning); unsolicited ICMPv6 Neighbor Advertisements corrupt IPv6 neighbor caches (NDP Spoofing); and rogue APs broadcasting identical SSIDs with higher RF signal levels manipulate wireless roaming decisions (Evil Twin Attack).

Step-by-Step Solution

1

Analyze the 802.11 management frame anomaly with reason code 7.

Reason code 7 explicitly denotes explicit wireless disassociation/deauthentication requesting disconnect, matching Deauthentication Attack.

Deauthentication frames are unauthenticated in legacy 802.11 standards and used to force disconnects.

2

Examine the unsolicited ARP response packet capture.

Mapping the gateway IP to an unknown host MAC address manipulates the switch IPv4 neighbor cache, confirming ARP Poisoning.

ARP lacks authentication mechanisms, allowing malicious hosts to spoof mapping responses.

3

Evaluate the IPv6 Neighbor Advertisement anomaly.

NDP Neighbor Advertisements perform address resolution in IPv6 analogous to ARP in IPv4, making unsolicited NA broadcasts indicative of NDP Spoofing.

Without SEND (Secure Neighbor Discovery), NDP messages can be spoofed to divert IPv6 traffic.

4

Identify the rogue AP broadcasting the legitimate corporate SSID.

Mimicking a valid wireless network name with higher power output to trick station roaming algorithms matches the Evil Twin classification.

Wireless clients typically prefer APs with stronger RSSI operating under known SSIDs.

Key Concept

Network and Wireless Attack Indicators

Question 210Question →

Match each vulnerability assessment scan type to its defining operational characteristic.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Credentialed Scan pairs with using system-level privileges for internal inspection; Non-Credentialed Scan pairs with unauthenticated external probing of exposed services; Passive Scan pairs with silently monitoring traffic flow without sending probes; Intrusive Scan pairs with executing tests that risk system instability or service disruption.

Each vulnerability scan type aligns with its specific operational profile: credentialed scans access host interiors using privileges, non-credentialed scans inspect external attack surfaces without privileges, passive scans collect intelligence from network traffic without packet injection, and intrusive scans run aggressive tests that may disrupt target availability.

Step-by-Step Solution

1

Identify the authentication level of the scan types.

Credentialed scans use local privileges for deep inspection, whereas non-credentialed scans simulate unauthenticated external observers.

Differentiating authentication capabilities clarifies internal inventory auditing versus surface attack view.

2

Analyze the operational impact and network traffic generation of the remaining scan types.

Passive scans capture existing traffic without transmitting data, while intrusive scans actively interact with vulnerabilities and risk causing service outages.

Understanding network traffic generation helps separate non-interfere monitoring from high-impact active testing.

Key Concept

Vulnerability assessment scan classifications (Credentialed, Non-Credentialed, Passive, Intrusive)

Question 211Question →

A security operations team is refining its enterprise vulnerability management program to address scanning anomalies, deployment gaps, and risk prioritization metrics across diverse infrastructure assets. Match each vulnerability scanning scenario to its most appropriate operational response or root cause analysis.

Click a left item, then click its matching right item

Show answer & explanation

Answer

1. The scenario involving SMB authentication failure pairs with verifying service account permissions, firewall ingress rules, and remote administrative interface access.
2. The scenario involving host isolation and air-gapped network segmentation reducing exploitability pairs with adjusting environmental and temporal CVSS metrics in the risk tracking system.
3. The scenario involving short-lived ephemeral containers missing scheduled scan windows pairs with shifting to continuous container registry scanning and CI/CD pipeline integration.
4. The scenario involving vendor backporting of security patches resulting in incorrect software version flags pairs with classifying the finding as a false positive, verifying package logs, and documenting an exception.

Each scenario represents a distinct operational operational challenge in vulnerability management: authentication troubleshooting for incomplete scans, CVSS environmental metric tailoring for isolated assets, container image registry scanning for ephemeral cloud workloads, and false positive exception handling for backported security patches.

Step-by-Step Solution

1

Analyze authentication failure logs in credentialed vulnerability scans.

Recognize that authentication failures revert credentialed scans to less comprehensive non-credentialed probes, requiring administrative credential and network access troubleshooting.

Credentialed scans require local host access via SMB/SSH to enumerate missing patches accurately.

2

Evaluate risk scoring contextual adjustments for compensating security controls.

Determine that environmental CVSS scoring factors in existing infrastructure mitigations such as air-gapping and network isolation.

CVSS Base Scores assess intrinsic vulnerability severity, whereas Environmental Scores reflect specific deployment contexts.

3

Address visibility gaps associated with dynamic microservices and cloud workloads.

Select static image scanning in registries and CI/CD pipelines over periodic network IP scanning.

Short-lived container lifecycles expire before scheduled network scanning passes occur.

4

Identify signature-based scanner inaccuracies caused by enterprise Linux patch backporting.

Confirm false positive status through local package verification and establish scanner exception rules.

Banner-grabbing scanners frequently fail to detect backported patches that leave main version strings unchanged.

Key Concept

Operational Assessment, Vulnerability Scanner Troubleshooting, and Environmental Risk Prioritization

Question 212Question →

A security architect is evaluating hardware security controls for enterprise hardware and embedded system deployments. Match each hardware security component on the left to its corresponding security capability on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The correct matches pair Secure Element (SE) with tamper-resistant credential storage; Baseboard Management Controller (BMC) with out-of-band remote management; Memory Protection Unit (MPU) with hardware memory region isolation; and Hardware Root of Trust (eFuse / Immutable ROM) with unalterable boot validation.

Each hardware component is correctly mapped to its essential function: Secure Elements handle isolated credential and key storage; Baseboard Management Controllers perform out-of-band remote administration; Memory Protection Units enforce internal memory access restrictions; and Hardware Roots of Trust anchor secure boot validation using immutable hardware.

Step-by-Step Solution

1

Evaluate the functional scope of a Secure Element (SE).

Identified as a specialized, tamper-resistant chip designed to store sensitive tokens and biometric data securely.

SE provides physical and logical isolation from the main operating system for crypto operations.

2

Evaluate the architectural role of a Baseboard Management Controller (BMC).

Identified as out-of-band motherboard hardware that enables remote administration.

BMCs function independently of the main processor and host operating system.

3

Evaluate the mechanism of a Memory Protection Unit (MPU).

Identified as micro-architectural hardware that restricts execution regions and memory access.

MPUs enforce boundary protection in embedded hardware to block buffer overflows and privilege escalation.

4

Evaluate the purpose of a Hardware Root of Trust built on eFuse or Immutable ROM.

Identified as the static cryptographic foundation for boot validation.

Write-once or read-only hardware cannot be overwritten by software malware, forming an immutable trust anchor.

Key Concept

Hardware Security Components and Embedded Controls

Question 213Question →

Match each resilience and redundancy mechanism on the left with the corresponding operational requirement or architecture scenario on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The correct pairings match Automatic Transfer Switch (ATS) to single-corded utility power delivery via seamlessly transferred electrical loads; Geographic Asynchronous Replication to maintaining distant data availability with a non-zero RPO; Multipath I/O (MPIO) to storage access path aggregation over redundant HBAs; and Dynamic BGP Multihoming to enterprise boundary traffic rerouting across multiple ISP links.

Each redundancy technology directly targets a specific physical or logical component failure domain: ATS addresses single-corded power feed failure, MPIO addresses storage channel and HBA adapter failure, BGP multihoming addresses WAN ISP link failure, and Asynchronous Replication addresses regional datacenter failure without application performance degradation.

Step-by-Step Solution

1

Analyze power redundancy requirements for single-corded hardware.

An Automatic Transfer Switch (ATS) is required to feed single-corded appliances from redundant PDUs without power interruption.

ATS handles power source failover at the rack level when a PDU or utility feed loses power.

2

Evaluate long-distance database disaster recovery methods.

Geographic Asynchronous Replication allows cross-datacenter sync over WAN without local commit latency constraints.

Asynchronous replication tolerates network latency across geographic sites while accepting a minor RPO delta.

3

Assess host-to-SAN storage link redundancy.

Multipath I/O (MPIO) aggregates multiple Host Bus Adapter (HBA) paths into a redundant logical channel.

MPIO protects host storage connectivity against individual HBA, cable, or fiber channel switch failures.

4

Examine WAN perimeter network resilience.

Dynamic BGP Multihoming maintains network connectivity across independent Internet service provider links.

BGP detects link failure and updates routing tables to direct inbound and outbound traffic over functional paths.

Key Concept

High Availability and Infrastructure Redundancy Controls

Question 214Question →

Match each telemetry log snippet to the corresponding security event or attack vector.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Log entry 1 matches SQL injection; Log entry 2 matches SSH brute-force; Log entry 3 matches RDP remote interactive logon; Log entry 4 matches SMB traffic burst scanning.

Each log archetype displays distinct key indicators: database commands inside HTTP query strings signify SQL injection; repeated rapid SSH password failures indicate brute-force login attempts; Event ID 4624 with LogonType 10 represents RDP remote logins; and high-volume blocked TCP 445 packets represent SMB scanning.

Step-by-Step Solution

1

Analyze web access log parameters

Identify HTTP query string containing 'UNION SELECT 1,username,password FROM users--', confirming SQL injection.

Web server logs capture HTTP parameters that expose malicious payload structures.

2

Inspect authentication server syslog entries

Identify 150 failed password attempts within 30 seconds for root over SSH.

High frequency of failed SSH logons points directly to automated brute-force attacks.

3

Evaluate Windows Event ID and LogonType attributes

Confirm EventID 4624 with LogonType 10 corresponds to Remote Desktop Protocol (RDP) sessions.

LogonType 10 specifically designates RemoteInteractive access in Windows Security event logs.

4

Review firewall drop rules and destination ports

Associate DENY TCP traffic targeting port 445 in high bursts with SMB port scanning or automated lateral movement probes.

TCP port 445 is utilized for Server Message Block (SMB) services.

Key Concept

SIEM Log Pattern Recognition and Event Analysis

Estimated Time:1m 30s

Question 215Question →

Match each Identity and Access Management (IAM) architectural component to its primary role within an access evaluation control framework.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Policy Decision Point (PDP) matches authorization evaluation; Policy Enforcement Point (PEP) matches traffic interception and enforcement; Policy Information Point (PIP) matches contextual attribute retrieval; Policy Administration Point (PAP) matches policy creation and management.

In modern access control and Zero Trust architectures, access evaluation is divided across specialized functional entities. The Policy Decision Point (PDP) evaluates request parameters against access policies. The Policy Enforcement Point (PEP) enforces the resulting decision at network or application boundary gates. The Policy Information Point (PIP) supplies requisite contextual attributes (such as user attributes or threat telemetry) to the PDP. The Policy Administration Point (PAP) acts as the governance interface for policy creation and maintenance.

Step-by-Step Solution

1

Identify the component that computes authorization logic.

Policy Decision Point (PDP) is paired with evaluating access requests to issue decisions.

The PDP evaluates rules against subject and resource attributes to generate a permit or deny outcome.

2

Identify the gateway component sitting inline with traffic.

Policy Enforcement Point (PEP) is paired with intercepting requests and enforcing decisions.

The PEP acts as a gatekeeper that blocks or permits user access based on the PDP's determination.

3

Identify the entity responsible for supplying external context.

Policy Information Point (PIP) is paired with retrieving contextual attributes.

The PIP feeds environmental variables, user group memberships, and device compliance context into the evaluation engine.

4

Identify the administration interface for policy lifecycle management.

Policy Administration Point (PAP) is paired with creating and storing policy rules.

The PAP is the administrative system where security policies are authored and published.

Key Concept

IAM Architecture Control Points (PDP, PEP, PIP, PAP)

Question 216Question →

Match each vulnerability scanning approach to its corresponding operational characteristic or primary benefit.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Credentialed Scan pairs with internal software inventory and patch details; Non-Credentialed Scan pairs with simulating an external attacker's perspective; Passive Scan pairs with silently monitoring network traffic without probes; Agent-Based Scan pairs with assessing off-network endpoints continuously.

Vulnerability assessment modalities differ fundamentally by access rights, deployment model, and network footprint: credentialed scans perform local patch audits, non-credentialed scans map external surface vulnerabilities, passive scans monitor packet headers without sending probes, and agent-based scans gather host posture locally on mobile devices.

Step-by-Step Solution

1

Analyze host authentication privileges vs network probing.

Identify that authenticating to a host provides deep local configuration data (Credentialed), whereas unauthenticated network discovery shows external exposure (Non-Credentialed).

Privilege level dictates visibility into internal system patches versus network perimeter posture.

2

Analyze network traffic impact and agent deployment mechanics.

Determine that packet sniffer-style assessment creates zero active traffic (Passive), while locally installed software reports posture regardless of network location (Agent-Based).

Scanning architecture determines traffic overhead and visibility into remote or fragile assets.

Key Concept

Vulnerability Scanning Types and Deployment Methodologies

Question 217Question →

A security operations team is updating its vulnerability management strategy across diverse operational environments. Match each vulnerability scanning methodology on the left to the enterprise scenario on the right that best justifies its deployment.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Host-based Agent Scanning pairs with auditing roaming remote endpoints; Passive Network Monitoring pairs with identifying assets on sensitive SCADA networks; Authenticated Network Scanning pairs with assessing hosts via service accounts without local agents; Intrusive Active Scanning pairs with verifying exploitability in staging environments despite potential crash risks.

Matching scanning methodologies to enterprise environments requires balancing operational risk, network architecture, credential access, and intrusive potential. Host-based agents cater to remote endpoints; passive monitoring protects sensitive OT/SCADA devices; authenticated network scans gather detailed host data remotely without agents; and intrusive active scans confirm exploitability where downtime is tolerable.

Step-by-Step Solution

1

Analyze the connectivity constraints of remote/roaming devices.

Devices outside the network perimeter require host-installed agents to collect local configuration and patch data independently of network location.

Traditional network scans cannot reliably reach hosts operating outside internal subnets.

2

Evaluate the sensitivity of SCADA and industrial control systems (ICS).

Non-intrusive, passive monitoring via SPAN/TAP ports is required to prevent crash events caused by active network probes.

Legacy embedded systems often fail when receiving non-standard or heavy probe traffic.

3

Assess agentless internal host vulnerability auditing requirements.

Authenticated network scanning leverages valid credentials to query missing patches remotely without host software installation overhead.

Using service account credentials reduces false positives compared to unauthenticated port scans while avoiding endpoint agent deployment.

4

Differentiate non-intrusive vulnerability discovery from intrusive exploit verification.

Intrusive scanning executes payload tests to confirm exploitability (such as RCE), acceptable primarily in non-production or staging environments.

Intrusive methods simulate actual attack vectors and may destabilize target applications.

Key Concept

Selecting Vulnerability Assessment and Scanning Methodologies Based on Operational Risk and Environmental Constraints

Estimated Time:2m 0s

Question 218Question →

Match each enterprise identity and access management (IAM) architectural component on the left to its primary functional responsibility on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

SAML Assertion Consumer Service (ACS) matches receiving and validating signed XML assertions from an external IdP; OAuth 2.0 Authorization Server matches authenticating resource owners and issuing scoped access tokens; SCIM Provisioning Service matches automating identity account creation and de-provisioning via RESTful APIs; Kerberos Key Distribution Center (KDC) matches granting Ticket Granting Tickets and service tickets for internal domain authentication.

Each IAM component performs a specific architectural role in identity lifecycle management, federated web single sign-on, API authorization delegation, or local domain ticket authentication.

Step-by-Step Solution

1

Identify SAML Assertion Consumer Service (ACS) function

Matches XML assertion processing at the Service Provider endpoint during federated SSO.

SAML reliance on XML signatures and HTTP posts to the ACS endpoint is characteristic of web-based SP-initiated or IdP-initiated federation.

2

Identify OAuth 2.0 Authorization Server function

Matches issuing scoped tokens for API authorization access.

OAuth 2.0 delegates authority through token issuance without sharing credentials with the client application.

3

Identify SCIM Provisioning Service function

Matches automated lifecycle management across external application identity stores.

SCIM defines schema models and HTTP operations for syncing user identity lifecycles.

4

Identify Kerberos Key Distribution Center (KDC) function

Matches issuing Ticket Granting Tickets (TGT) within a local Active Directory domain.

Kerberos relies on a trusted KDC to grant ticket-based mutual authentication on internal networks.

Key Concept

Enterprise IAM Architecture Components and Protocols

Question 219Question →

A security administrator is reviewing high-availability cluster resilience and failover mechanisms for mission-critical enterprise services. Match each clustering component or condition on the left with its corresponding operational definition or control mechanism on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Split-brain condition matches the state where isolated partitions simultaneously claim active role; Quorum matches the minimum voting node requirement for authority; STONITH matches the automated node power-down/isolation mechanism; Heartbeat link matches the dedicated keep-alive telemetry path.

Each clustering concept represents a specific mechanism essential for maintaining cluster integrity and high availability: the heartbeat link continuously monitors peer health; quorum requires a majority vote before changing active status; split-brain occurs when lost communication causes dual active nodes; and STONITH forcibly isolates or powers down problematic nodes to prevent split-brain write corruption.

Step-by-Step Solution

1

Identify the primary functions of node monitoring, partition consensus, and conflict resolution in high-availability clusters.

Determined that heartbeat links monitor health, quorum establishes state consensus, split-brain describes dual-active partition conflicts, and fencing (STONITH) enforces physical node isolation.

Clustering resilience relies on distinguishing health signaling from decision consensus and active fencing controls.

2

Pair each clustering concept on the left with its matching definition on the right.

Mapped Split-brain condition to dual active assumption, Quorum to voting node threshold, STONITH to automated power down, and Heartbeat link to dedicated monitoring path.

Accurate pairing aligns cluster design terminology with concrete resilience and failover controls.

Key Concept

High-Availability Clustering Controls and Partition Fault Tolerance Mechanisms

Estimated Time:1m 30s

Question 220Question →

Match each security governance document type on the left with its corresponding characteristic on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Security Policy matches High-level management statement establishing mandatory security goals; Security Standard matches Mandatory course of action or technical requirement establishing uniform compliance rules; Security Baseline matches Mandatory minimum security configuration required for a specific system; Security Guideline matches Discretionary recommendation providing advisory guidance.

Security Governance documents are categorized by scope and enforcement level: Policies set high-level executive intent, Standards dictate specific mandatory rules, Baselines enforce minimum system build configurations, and Guidelines offer discretionary advice.

Step-by-Step Solution

1

Identify the mandatory vs. discretionary nature of each document type.

Policies, Standards, and Baselines are mandatory, while Guidelines are discretionary (optional).

Guidelines serve as recommendations, whereas policies, standards, and baselines enforce compliance.

2

Differentiate high-level strategic intent from specific technical requirements.

Policy represents high-level organizational goals, Standard defines mandatory operational/technical rules, and Baseline specifies minimum system configuration levels.

Governance documents follow a hierarchical structure from general management direction down to technical implementation details.

Key Concept

Security Policy Hierarchy and Document Classification

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept