All practice questions

Question 221Question →

An enterprise security organization is restructuring its internal governance documentation to align with ISO/IEC 27001 and NIST SP 800-53 standards. Match each formal security governance document type to the specific operational characteristic and enforcement authority that defines its role in the security program.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Security Policy matches the high-level executive directive. Security Standard matches the mandatory technical specification. Security Baseline matches the minimum compulsory security configuration threshold. Security Guideline matches the discretionary operational advice.

Security Policies set high-level strategic direction from executive leadership; Security Standards define mandatory uniform technical controls; Security Baselines establish minimum system hardening configurations prior to deployment; and Security Guidelines provide advisory non-mandatory best practices.

Step-by-Step Solution

1

Evaluate the governance authority and enforceability spectrum

Categorize documents into executive management directives (Policies), mandatory technical requirements (Standards), minimum system build thresholds (Baselines), and advisory best practices (Guidelines).

Document types are differentiated primarily by their enforcement level and scope of applicability within the security hierarchy.

2

Differentiate mandatory technical requirements from configuration build benchmarks

Standards mandate specific technologies or processes enterprise-wide, whereas Baselines define the precise minimum operational configuration state for a specific asset class before deployment.

Confusing enterprise-wide technical rules with platform-specific system hardening benchmarks is a common operational error.

3

Distinguish compulsory controls from discretionary material

Guidelines are non-mandatory suggestions intended to assist staff, whereas policies, standards, and baselines carry explicit compliance requirements.

Audit enforcement applies strictly to mandatory governance elements.

Key Concept

Security Governance Document Hierarchy and Enforcement Mechanisms

Question 222Question →

A security analyst is triaging log files collected by a SIEM system across web applications, authentication servers, and system logs. Match each log snippet on the left to the corresponding security event or attack vector on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The HTTP snippet containing 'UNION SELECT' matches SQL Injection; the repeated SSH failed authentication log matches SSH Brute-Force; Windows Event ID 4624 with Logon Type 10 matches RDP Interactive Session; and the HTTP request with '../../' sequences matches Directory/Path Traversal.

Each log entry displays distinct forensic indicators: 'UNION SELECT' points directly to SQL injection; repeated SSH authentication failures indicate brute-force attempts; Windows Event 4624 with Logon Type 10 marks remote interactive RDP logons; and dot-dot-slash patterns indicate path traversal attempts.

Step-by-Step Solution

1

Analyze Web Application Logs

Identified SQL query keywords ('UNION SELECT') in the query string of the first log entry and directory navigation dot-dots ('../../') in the fourth entry.

Web logs reveal application-level attacks targeting backend databases or sensitive file paths.

2

Analyze Linux Authentication Logs

Identified high-frequency failed password entries for SSH targeting administrative users from an external IP.

Syslog authentication events with high frequency from single sources characterize automated password guessing.

3

Analyze Windows Event Logs

Correlated Event ID 4624 (Successful Logon) with Logon Type 10.

Logon Type 10 is reserved for RemoteInteractive connections such as RDP, distinguishing it from local (Type 2) or network share (Type 3) logons.

Key Concept

Log Telemetry Analysis and Threat Identification

Question 223Question →

Match each third-party risk management agreement type on the left with its correct operational description on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Service Level Agreement matches performance metrics and uptime guarantees; Non-Disclosure Agreement matches legal confidentiality obligations; Memorandum of Understanding matches mutual intent for collaboration; Interconnection Security Agreement matches technical security requirements for network connections.

Each agreement serves a distinct governance or operational role: Service Level Agreements (SLAs) enforce performance and availability guarantees; Non-Disclosure Agreements (NDAs) enforce confidentiality of sensitive shared data; Memorandums of Understanding (MOUs) document informal or general cooperative goals between organizations; and Interconnection Security Agreements (ISAs) govern the technical security requirements for inter-organizational system connections.

Step-by-Step Solution

1

Identify the purpose of each legal and operational agreement used in third-party risk management.

Categorize each agreement by its focus: performance metrics (SLA), privacy/confidentiality (NDA), general collaboration (MOU), or technical connectivity (ISA).

Different third-party agreements address different aspects of governance, legal protection, operational performance, and technical integration.

2

Match each agreement term to its corresponding definition based on security governance standards.

Pairing SLA with uptime/performance metrics, NDA with confidentiality, MOU with mutual intent/collaboration, and ISA with technical network interconnection parameters.

Accurate pairing ensures correct understanding of third-party contract oversight and compliance.

Key Concept

Third-Party Agreements and Governance Frameworks

Question 224Question →

Match each enterprise identity and access management (IAM) protocol or standard on the left with its primary architectural function on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

OAuth 2.0 matches API authorization delegation; OpenID Connect matches the OAuth 2.0 identity/authentication layer; SAML 2.0 matches XML-based federated Web SSO; SCIM matches automated identity provisioning.

Each protocol serves a distinct architectural purpose in modern enterprise IAM systems: OAuth 2.0 handles delegated API access control, OIDC provides modern OAuth-based user authentication, SAML 2.0 delivers traditional XML-based federated web SSO, and SCIM automates identity lifecycle management and provisioning across cloud and on-premises directories.

Step-by-Step Solution

1

Differentiate authentication vs. authorization frameworks.

Identify OAuth 2.0 as strictly authorization/delegation, and OIDC as the identity authentication extension.

OAuth 2.0 alone provides access tokens for API authorization, whereas OIDC adds ID tokens for user authentication.

2

Identify web federation formats.

Match SAML 2.0 to XML-based security assertions.

SAML 2.0 is the legacy enterprise XML standard for cross-domain SSO federations between IdPs and SPs.

3

Identify identity lifecycle management standards.

Match SCIM to automated cross-domain user provisioning.

SCIM uses standardized REST endpoints and JSON payloads to sync user account states across systems.

Key Concept

Enterprise IAM Architectural Protocols & Standards

Question 225Question →

Match each security governance document type to its corresponding operational characteristic within an enterprise governance framework.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Security Policy matches the high-level directive statement; Security Standard matches the mandatory compliance requirement; Security Guideline matches the discretionary advice; Security Baseline matches the minimum configuration threshold.

In security governance, documents follow a formal hierarchy: Policies provide top-down executive leadership direction; Standards define mandatory procedural and technical requirements; Guidelines offer non-binding best practice advice; and Baselines establish minimum security build configurations for IT assets.

Step-by-Step Solution

1

Identify mandatory versus non-mandatory governance documents.

Guidelines are non-mandatory (discretionary), while policies, standards, and baselines are mandatory.

Governance frameworks explicitly distinguish between mandatory directives and discretionary recommendations.

2

Differentiate high-level strategic directives from implementation-level controls.

Policies reflect executive management intent, whereas standards and baselines detail specific rules and minimum system settings.

Document hierarchy ranges from high-level management objectives down to technical implementation parameters.

3

Map each term to its specific operational definition.

Pair Policy with high-level directive, Standard with mandatory course of action, Guideline with discretionary advice, and Baseline with minimum security configuration.

Each document type fulfills a distinct level of governance within the organizational hierarchy.

Key Concept

Security Governance Document Hierarchy and Enforceability

Question 226Question →

An enterprise security governance team is reviewing its information security documentation hierarchy to resolve audit findings regarding governance ambiguity. Match each governance document type on the left with its corresponding organizational characteristic and legal/enforcement property on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Security Policy matches executive-approved strategic directives; Security Standard matches mandatory technical rules and metric parameters; Security Baseline matches minimum compulsory hardening settings for specific systems; Security Guideline matches non-mandatory recommended operational advice.

Each governance document type fulfills a distinct role in the governance framework hierarchy: Security Policy sets mandatory strategic intent; Security Standard defines compulsory technical specifications; Security Baseline sets mandatory minimum build states for platforms; and Security Guideline offers non-binding advice.

Step-by-Step Solution

1

Analyze the overarching scope and authority of governance documents.

Identify high-level directives originating from senior leadership as Security Policies.

Policies establish top-down management intent and risk tolerance across the enterprise.

2

Differentiate mandatory technical specifications from high-level management intent.

Map compulsory technical rules, algorithms, or operational controls to Security Standards.

Standards operationalize policies by enforcing uniform technical requirements across systems.

3

Identify minimum platform-specific hardening requirements.

Assign minimum required security state parameters to Security Baselines.

Baselines serve as the mandatory foundation for platform configuration consistency and security auditing.

4

Evaluate discretionary documentation.

Match optional recommendations and practical advice to Security Guidelines.

Guidelines assist operational teams without imposing strict legal or regulatory compliance penalties.

Key Concept

Security Governance Documentation Hierarchy (Policy, Standard, Baseline, Guideline)

Estimated Time:2m 0s

Question 227Question →

An organization is updating its security governance hierarchy to resolve operational ambiguities discovered during a regulatory audit. Match each governance document type on the left with its corresponding organizational scope and enforceability characteristic on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Security Policy matches the high-level strategic mandate; Security Standard matches mandatory technical specs and configuration baselines; Security Guideline matches discretionary recommendations and operational advice; Standard Operating Procedure matches step-by-step sequential technical instructions.

Security governance relies on a defined hierarchy where Security Policies provide mandatory high-level strategic direction; Security Standards set compulsory technical configurations; Security Guidelines communicate non-mandatory suggestions; and Standard Operating Procedures provide explicit step-by-step execution tasks.

Step-by-Step Solution

1

Analyze the strategic role and authority level of high-level directives.

Identify that overall strategic directives set by executive leadership correspond to a Security Policy.

Policies sit at the top of the governance hierarchy and establish mandatory security goals across the entire entity.

2

Distinguish between mandatory technical requirements and discretionary recommendations.

Map compulsory technical parameters to Security Standards and non-enforceable recommendations to Security Guidelines.

Standards mandate explicit technical thresholds, whereas guidelines provide flexible, non-binding best practice advice.

3

Examine operational documentation formats.

Assign detailed step-by-step tactical workflows to Standard Operating Procedures.

Procedures define exact sequential operational mechanics required to execute tasks defined by policies and standards.

Key Concept

Information Security Governance Document Hierarchy

Question 228Question →

Match each third-party risk management artifact or supply chain control on the left with its corresponding oversight function on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Right-to-Audit Clause matches with Contractual provision granting direct inspection authority; SOC 2 Type II Report matches with Independent third-party evaluation of operational control effectiveness over time; Hardware Supply Chain Assessment matches with Evaluation process focused on detecting counterfeit components and physical tampering; Vendor Offboarding Protocol matches with Governance process ensuring access revocation and data destruction upon relationship termination.

Each vendor oversight control aligns directly with its operational scope: legal audit clauses enable direct inspection, SOC 2 Type II reports demonstrate sustained control effectiveness, hardware assessments defend against component tampering, and offboarding protocols eliminate residual access when contracts end.

Step-by-Step Solution

1

Analyze contractual verification mechanisms

Identified that the Right-to-Audit Clause explicitly grants authority to inspect vendor operations.

Contractual terms determine legal permissions for active security verification.

2

Differentiate third-party attestation types

Associated the SOC 2 Type II Report with historical, independent verification of control effectiveness over time.

SOC 2 Type II specifically measures operational performance over an extended evaluation window.

3

Evaluate hardware and physical supply chain risks

Linked Hardware Supply Chain Assessment to component integrity, counterfeit detection, and anti-tampering verification.

Physical supply chain oversight ensures hardware devices have not been altered prior to deployment.

4

Review the vendor lifecycle termination requirements

Matched Vendor Offboarding Protocol with access revocation, asset recovery, and secure data sanitization.

Offboarding manages end-of-life supplier risk by revoking rights and retrieving sensitive materials.

Key Concept

Third-Party Risk Management and Supply Chain Oversight

Estimated Time:1m 30s

Question 229Question →

A financial enterprise is evaluating several third-party software and service providers during a comprehensive supply chain risk review. Match each vendor security assessment artifact on the left with the operational compliance or risk verification requirement it satisfies on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The SOC 2 Type II Report pairs with verifying control operating effectiveness over a specified time period. The SOC 3 Report pairs with providing a publicly disclosable general-use summary. The Standardized Vendor Questionnaire pairs with gathering self-reported vendor security practices. The ISO/IEC 27001 Attestation pairs with certifying an audited Information Security Management System (ISMS).

Each artifact corresponds to a specific governance role in third-party risk management: SOC 2 Type II verifies control operating effectiveness over a period of time; SOC 3 provides a publicly shareable general-use summary; vendor questionnaires gather initial self-reported security metrics; and ISO/IEC 27001 attests to an independently audited ISMS framework.

Step-by-Step Solution

1

Differentiate between SOC 2 Type I and SOC 2 Type II reporting scopes.

Identify that Type II includes evidence of operating effectiveness over a period of time, matching the detailed audit testing scenario.

Type I only evaluates control design at a single point in time, whereas Type II tests continuous execution over months.

2

Distinguish public reporting artifacts from restricted confidential audit documentation.

Identify the SOC 3 report as a general-use, publicly shareable executive summary.

SOC 2 reports contain sensitive system descriptions intended only for restricted audiences under NDA, whereas SOC 3 is designed for public confidence.

3

Categorize self-assessment tools versus third-party independent certifications.

Pair the Standardized Questionnaire with self-reported data collection and ISO/IEC 27001 with independent ISMS certification.

Questionnaires capture vendor self-evaluations early in onboarding, while ISO/IEC 27001 represents a formal external audit of management framework compliance.

Key Concept

Third-Party Security Assurance Artifacts and Supply Chain Verification

Question 230Question →

Match each third-party risk management agreement type on the left with its corresponding primary purpose on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Master Services Agreement (MSA) pairs with foundational legal terms and governance for future work orders; Service Level Agreement (SLA) pairs with measurable performance metrics and uptime guarantees; Business Partner Agreement (BPA) pairs with joint venture operational expectations and profit-sharing roles; Non-Disclosure Agreement (NDA) pairs with confidentiality requirements protecting sensitive vendor evaluation data.

Each agreement type fulfills a distinct governance and legal purpose in third-party risk management: Master Services Agreements (MSAs) establish overall legal terms for future work; Service Level Agreements (SLAs) define measurable service metrics and availability targets; Business Partner Agreements (BPAs) define joint partnership operational and financial roles; Non-Disclosure Agreements (NDAs) enforce legal confidentiality on shared information.

Step-by-Step Solution

1

Identify the high-level legal framework agreement governing multi-project contracts.

Match Master Services Agreement (MSA) with foundational legal terms governing future work orders.

MSAs establish overarching terms so future statements of work can reference a unified contractual baseline.

2

Identify the document specifying operational metrics and performance targets.

Match Service Level Agreement (SLA) with specific, measurable performance metrics and availability guarantees.

SLAs focus directly on measurable service metrics like 99.9% uptime and mean time to repair.

3

Identify the agreement suited for joint commercial partnerships.

Match Business Partner Agreement (BPA) with joint venture business expectations and profit-sharing models.

BPAs clarify partner financial arrangements, management roles, and shared security duties.

4

Identify the document protecting proprietary data from disclosure.

Match Non-Disclosure Agreement (NDA) with confidentiality requirements protecting sensitive data.

NDAs obligate receiving parties to maintain confidentiality over shared intellectual property.

Key Concept

Third-Party Risk Agreements and Legal Frameworks

Question 231Question →

A lead security architect is structuring an enterprise third-party risk management (TPRM) framework to mitigate supply chain exposure and enforce regulatory compliance across downstream service providers. Match each third-party oversight mechanism on the left with its primary operational objective on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Each oversight mechanism directly corresponds to its specialized operational objective: SBOM with Component Provenance Attestation matches tracking upstream dependencies; Right-to-Audit Clause matches granting contractual authority for independent evaluations; Service Level Agreement (SLA) matches establishing binding performance benchmarks and patch windows; and BIA-driven Vendor Tiering Matrix matches categorizing providers by MTD to dictate assessment frequency.

Each mechanism serves a distinct function within third-party risk management: Software Bill of Materials (SBOM) provides visibility into software supply chain components; Right-to-Audit clauses grant authority for direct inspections; SLAs set enforceable operational and patch remediation metrics; and BIA-driven risk tiering aligns assessment frequency with organizational risk impact.

Step-by-Step Solution

1

Analyze the operational role of a Software Bill of Materials (SBOM).

Identify that SBOM inventories software supply chain components and libraries.

Tracking software provenance ensures rapid triage of newly reported zero-day vulnerabilities in upstream libraries.

2

Evaluate contractual mechanisms for direct vendor inspection.

Map the Right-to-Audit clause to independent security evaluations.

Without contractual audit rights, an enterprise cannot legally demand on-site or deep logical inspections of vendor infrastructure.

3

Examine legal performance enforcement agreements.

Pair the SLA with defined security metrics, patch windows, and outage penalty terms.

SLAs enforce operational metrics and financial consequences for non-compliance with security performance targets.

4

Determine how vendor assessment rigor is scaled enterprise-wide.

Associate BIA-driven vendor tiering with MTD and data sensitivity categorization.

A Business Impact Analysis defines operational criticality, ensuring high-risk providers receive rigorous oversight commensurate with their impact on business continuity.

Key Concept

Third-Party Risk Management governance mechanisms and supply chain oversight controls

Question 232Question →

An enterprise organization is establishing a comprehensive third-party risk governance program and must evaluate four distinct independent security audit and attestation deliverables submitted by vendor candidates. Match each audit or attestation deliverable on the left with its defining operational scope and objective on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

SOC 2 Type II Attestation Report matches with operational effectiveness evaluation over a sustained monitoring window; ISO/IEC 27001 Stage 2 Audit Report matches with ISMS implementation and operational evaluation for accredited international certification; PCI DSS Attestation of Compliance matches with payment card environment certification following a QSA evaluation; FedRAMP 3PAO Security Assessment Report matches with cloud provider testing against federal security baselines (NIST SP 800-53).

Each deliverable aligns with specific regulatory and operational parameters: SOC 2 Type II assesses control operating effectiveness over time; ISO/IEC 27001 Stage 2 certifies an ISMS; PCI DSS AoC validates cardholder data protection controls; FedRAMP SAR documents NIST SP 800-53 compliance for federal cloud environments.

Step-by-Step Solution

1

Analyze SOC 2 Type II report scope

Identify that Type II attestation reports uniquely require testing the operating effectiveness of controls over an extended time frame (typically 6–12 months).

Differentiates SOC 2 Type II from single-point-in-time assessments such as SOC 2 Type I.

2

Analyze ISO/IEC 27001 Stage 2 audit purpose

Recognize that Stage 2 represents the formal certification audit assessing the practical implementation of an organization's Information Security Management System (ISMS).

Stage 2 verifies operational adherence to ISO/IEC 27001 standards to grant official certification.

3

Analyze PCI DSS AoC requirements

Identify that an AoC is the standardized deliverable certifying merchant or service provider compliance with cardholder data protection controls post-QSA review.

PCI DSS specifically governs payment card environment security.

4

Analyze FedRAMP 3PAO SAR characteristics

Identify that a 3PAO SAR documents control testing results against NIST SP 800-53 security control baselines for federal cloud authorization.

FedRAMP requires independent 3PAO evaluation for cloud services hosting US government data.

Key Concept

Security Audits, Assessments, and Attestations Frameworks

Question 233Question →

During an enterprise security alignment following an international expansion, an organization must formalize its data governance framework. Match each data management role on the left with its corresponding primary operational responsibility on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Data Owner pairs with 'Determines business purpose, establishes classification labels, and maintains ultimate business accountability for data security.' Data Custodian pairs with 'Implements technical safeguards, maintains backup routines, and configures access permissions according to established security baselines.' Data Protection Officer (DPO) pairs with 'Monitors regulatory compliance independently, conducts privacy assessments, and acts as the official liaison to supervisory authorities.' Data Processor pairs with 'Executes record operations on behalf of an external controlling organization strictly under documented legal directives.'

The pairings correctly reflect standard security framework definitions: Data Owners establish classification and hold final accountability; Data Custodians manage daily technical configurations and controls; Data Protection Officers independently oversee privacy compliance; and Data Processors process records under controller instructions.

Step-by-Step Solution

1

Separate governance decision-making authority from operational IT technical administration.

Assign business accountability and data classification policy definition to the Data Owner, while assigning practical access control, encryption enforcement, and backup execution to the Data Custodian.

CompTIA governance specifications dictate that owners hold business accountability whereas custodians manage technical infrastructure.

2

Analyze independent regulatory compliance roles.

Match the Data Protection Officer (DPO) to independent privacy auditing, privacy impact assessment oversight, and regulatory liaison functions.

The DPO requires organizational independence to audit compliance objectively without direct operational management duties.

3

Evaluate third-party data processing contracts.

Associate the Data Processor role with executing dataset operations strictly according to controller mandates.

Processors operate on delegated authority and cannot independently determine data use purpose.

Key Concept

Data Roles and Responsibilities in Governance Frameworks

Question 234Question →

An enterprise security architect is reviewing identity and access management (IAM) controls across network access servers, policy engines, and central logging services. Match each security mechanism on the left with the specific AAA function or protocol capability on the right that best describes its primary operational purpose.

Click a left item, then click its matching right item

Show answer & explanation

Answer

EAP-TLS pairs with Mutual Authentication; XACML PDP pairs with Attribute-Based Authorization; TACACS+ command logging pairs with Administrative Command Accounting; RADIUS start/stop metrics pair with Resource Usage Accounting.

Matching each security control to its primary operational capability correctly distinguishes between authentication methods, authorization policy models, and distinct accounting mechanism granularity.

Step-by-Step Solution

1

Analyze EAP-TLS network negotiation

Identified as requiring X.509 certificates on both client and server sides

Because both endpoints validate each other's credentials, EAP-TLS provides mutual authentication.

2

Analyze XACML PDP policy evaluations

Identified as evaluating dynamic rules based on subject, resource, action, and environment attributes

XACML is the enterprise standard for implementing Attribute-Based Access Control (ABAC) authorization.

3

Analyze TACACS+ command logging capabilities

Identified as tracking specific CLI commands executed during administrator sessions

TACACS+ provides granular administrative command accounting, distinct from general connection logging.

4

Analyze RADIUS session message exchanges

Identified as tracking session stats such as uptime, connect time, and bandwidth consumption

RADIUS accounting focuses primarily on resource usage metrics and overall session auditing.

Key Concept

Core Pillars and Implementations of AAA (Authentication, Authorization, and Accounting)

Estimated Time:2m 0s

Question 235Question →

A security architect is designing an enterprise Zero Trust Architecture (ZTA) baseline aligned with NIST SP 800-207. During a dynamic context evaluation event, distinct logical control plane and data plane components handle distinct duties. Match each Zero Trust logical component on the left with its precise operational role during access decision making and execution on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Policy Engine pairs with evaluating policies and telemetry to make access decisions. Policy Administrator pairs with issuing control plane commands to establish or terminate sessions. Policy Enforcement Point pairs with inline data plane inspection and traffic gating. CDM System pairs with providing host health and vulnerability posture data.

In NIST SP 800-207 Zero Trust Architecture, logical responsibilities are strictly demarcated across control plane and data plane boundaries. The Policy Engine (PE) acts as the decision-making body evaluating authorization rules and contextual signals. The Policy Administrator (PA) acts as the control plane gateway issuing session control commands (establishing or severing connections). The Policy Enforcement Point (PEP) sits in the data plane to directly gate, inspect, or drop traffic to enterprise resources. Continuous Diagnostics and Mitigation (CDM) systems provide ongoing host state metrics as inputs into the Policy Engine.

Step-by-Step Solution

1

Differentiate between control plane decision logic and execution components in Zero Trust Architecture (NIST SP 800-207).

Identified the Policy Engine (PE) as the brain that applies security policy algorithms to reach a decision, and the Policy Administrator (PA) as the control component that communicates that decision.

The Policy Engine evaluates context, while the Policy Administrator translates the decision into command signals (such as issuing short-lived credentials or token revocations).

2

Separate data plane execution from control plane governance.

Identified the Policy Enforcement Point (PEP) as the single data-plane component in direct path of resource traffic.

The PEP gates, inspects, enables, or severs actual network connections to resources based on PA instructions.

3

Map threat intelligence and posture telemetry data sources.

Mapped the Continuous Diagnostics and Mitigation (CDM) System as an external signal feeder to the Policy Engine.

ZTA relies on dynamic context, requiring posture indicators like OS patch levels and threat detection states from CDM systems to continually calculate trust scores.

Key Concept

NIST SP 800-207 Zero Trust Architecture Logical Components (Control Plane vs. Data Plane)

Question 236Question →

Match each deception technology component on the left with its corresponding functional definition on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Honeynet pairs with the network segment of multiple decoy systems. Honeyfile pairs with the deceptive file positioned on storage shares. Low-interaction Honeypot pairs with the decoy service emulating basic protocols. Honeytoken pairs with fake data used to detect exfiltration.

Each deception technology is paired accurately based on its scope and implementation layer: Honeynet matches multi-system network decoys; Honeyfile matches decoy documents on storage systems; Low-interaction Honeypot matches basic protocol emulation services; and Honeytoken matches fake data records used for tracing exfiltration.

Step-by-Step Solution

1

Identify full network decoy implementations.

Honeynet corresponds to an entire simulated network infrastructure.

Honeynets represent multi-system decoy environments rather than isolated files or single services.

2

Identify file-based deception assets.

Honeyfile corresponds to fake documents or files on storage devices.

Honeyfiles are dedicated file objects monitored specifically for unauthorized opening or editing.

3

Identify limited-emulation decoys.

Low-interaction Honeypot corresponds to basic service emulation.

Low-interaction honeypots simulate only necessary network responses without exposing a full operating system.

4

Identify data-centric deception tokens.

Honeytoken corresponds to synthetic data records or fake credentials.

Honeytokens are isolated pieces of data planted in systems or databases to detect unauthorized handling.

Key Concept

Deception and Disruption Technologies

Question 237Question →

An enterprise risk management team is auditing the security controls of an automated insurance claims processing platform. Match each system security implementation on the left to the corresponding security objective (CIA Triad pillar or Non-Repudiation) it primarily satisfies on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Encrypting PII matches Confidentiality; SHA-256 checksum validation matches Integrity; Multi-region load balancing matches Availability; Digital signatures on payout approvals match Non-repudiation.

Each technical safeguard maps directly to one of the four foundational security objectives: encrypting PII ensures Confidentiality; checking SHA-256 hashes ensures Integrity; load balancing ensures Availability; and digital signatures using hardware-backed asymmetric keys ensure Non-repudiation.

Step-by-Step Solution

1

Analyze the control restricting unauthorized viewing of sensitive PII data

AES-256 database encryption protects privacy by hiding content from unauthorized entities, which maps to Confidentiality.

Confidentiality ensures information is accessible only to authorized users.

2

Analyze the control detecting unauthorized modifications to uploaded files

SHA-256 hash checks verify that data remains unaltered during transit, which maps to Integrity.

Integrity guarantees the accuracy and completeness of data by detecting unauthorized changes.

3

Analyze the control providing system uptime and access during high demand

Multi-region load balancing and redundancy maintain service uptime, which maps to Availability.

Availability ensures systems and data are operational and accessible whenever required.

4

Analyze the control preventing a user from denying a specific transaction or approval

Digital signatures using asymmetric cryptography combine authentication with proof of action, which maps to Non-repudiation.

Non-repudiation prevents an individual from denying the authenticity or origin of a signed document or transaction.

Key Concept

CIA Triad and Non-Repudiation Core Security Objectives

Question 238Question →

A lead security analyst is evaluating enterprise cryptographic controls to remediate vulnerabilities identified in a recent security audit. Match each cryptographic mechanism on the left with its primary operational security objective or implementation purpose on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) pairs with providing Perfect Forward Secrecy; PBKDF2 pairs with mitigating offline brute-force attacks on stored credentials; AES-GCM pairs with delivering authenticated encryption (AEAD) providing confidentiality and integrity; and ECDSA pairs with providing non-repudiation and origin authenticity via asymmetric signatures.

Each cryptographic primitive is mapped to its core security objective: ECDHE provides ephemeral session key exchange for Perfect Forward Secrecy; PBKDF2 implements computational key stretching to thwart offline password cracking; AES-GCM delivers authenticated symmetric encryption (AEAD) combining integrity and confidentiality; and ECDSA leverages asymmetric keys to generate digital signatures guaranteeing non-repudiation and origin verification.

Step-by-Step Solution

1

Analyze Ephemeral Elliptic Curve Diffie-Hellman (ECDHE)

ECDHE is an asymmetric key exchange protocol using ephemeral (temporary) keys per session.

Because session keys are regenerated dynamically and discarded, compromising a permanent private key does not decrypt historical session traffic, meeting the requirement for Perfect Forward Secrecy.

2

Analyze Password-Based Key Derivation Function 2 (PBKDF2)

PBKDF2 is a key stretching algorithm utilizing salt and iterative hashing.

Iterative hashing slows down candidate testing, directly counteracting high-speed GPU-based offline brute-force credential cracking.

3

Analyze Galois/Counter Mode (AES-GCM)

AES-GCM is a symmetric authenticated encryption mode (AEAD).

It combines counter mode encryption (confidentiality) with Galois field multiplication (integrity authentication tag) for fast, secure data stream protection.

4

Analyze Elliptic Curve Digital Signature Algorithm (ECDSA)

ECDSA is an asymmetric algorithm used for digital signatures.

Signing hash values using asymmetric private keys establishes verifiable proof of origin, integrity, and non-repudiation.

Key Concept

Cryptographic Concepts and Algorithms

Question 239Question →

During an enterprise Security Operations Center (SOC) investigation, telemetry from various log sources is ingested into a SIEM platform. Match each log snippet on the left with the corresponding event description on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The correct pairings are: HTTP GET log with SQL payload matches the web application SQL injection description; Windows Event ID 4625 matches the failed network logon event; Firewall DROP entry targeting port 445 matches the blocked SMB traffic event; Linux SYSCALL audit log execve matching nc binary matches the executed netcat process description.

Each log entry contains distinctive indicators characteristic of its log source and activity type: HTTP GET request with SQL syntax indicates SQL injection; Windows Event ID 4625 indicates a failed logon; Syslog kernel DROP output targeting port 445 indicates blocked SMB traffic; and Linux auditd syscall 59 referencing /usr/bin/nc indicates netcat process execution.

Step-by-Step Solution

1

Analyze the web server access log snippet.

Identify HTTP GET method containing SQL logic syntax (admin' OR '1'='1), confirming a web application SQL injection attempt.

Log syntax matches standard Nginx/Apache log formatting with embedded web exploit strings.

2

Analyze the Windows Event log snippet.

Identify Event ID 4625 and Logon Type 3, pointing to an unsuccessful network authentication attempt.

Event ID 4625 standardly logs logon failures in Windows Security Event logs.

3

Analyze the firewall syslog snippet.

Identify action DROP and destination port 445 (DPT=445), denoting blocked SMB protocol traffic.

Firewall syslog outputs typically format dropped network traffic with directional IP/port flags.

4

Analyze the Linux auditd snippet.

Identify syscall=59 (execve) along with exe="/usr/bin/nc", pointing to process execution of the Netcat networking tool.

Linux audit daemon logs system calls related to process creation and command execution.

Key Concept

Log Identification and SIEM Telemetry Archetypes

Question 240Question →

A network security consultant is auditing a newly implemented TACACS+ access control solution for datacenter routers. Match each administrative operational activity to its corresponding pillar within the AAA framework.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Presenting credentials to establish identity matches Authentication; evaluating security groups to grant specific command execution privileges matches Authorization; generating timestamped logs of executed commands for auditing matches Accounting.

Authentication is the process of verifying a user's claimed identity using credentials such as passwords or hardware tokens. Authorization determines the specific rights, privileges, and commands permitted for that verified identity. Accounting collects telemetry, session timestamps, and command history to maintain accountability and support forensic auditing.

Step-by-Step Solution

1

Analyze the first activity involving identity proof via username and hardware token passcode.

Identify that credential validation and identity verification fall under Authentication.

Authentication is responsible for confirming the identity of a subject before granting system access.

2

Analyze the second activity involving security group evaluation and command execution restriction.

Identify that granting specific rights based on policy falls under Authorization.

Authorization determines what actions, commands, or resources an authenticated identity is permitted to access.

3

Analyze the third activity involving session logging, timestamp generation, and telemetry transmission.

Identify that tracking user actions for compliance and monitoring falls under Accounting.

Accounting measures resource consumption and maintains detailed logs of subject activity for non-repudiation and auditing.

Key Concept

Authentication, Authorization, and Accounting (AAA)

Estimated Time:1m 30s

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept