Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 241Question →

A security architect is designing an Identity and Access Management (IAM) architecture for a microservices-based application deployed across multiple cloud environments. To align with Zero Trust principles, the architecture must issue short-lived, cryptographically verifiable identities to service workloads and decouple fine-grained authorization enforcement from application code. Which of the following protocols or architectural components should the architect integrate to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: SPIFFE/SPIRE framework to automatically mint and distribute short-lived cryptographic workload identities to running services.; Decoupled Policy Decision Points (PDP) running as sidecar proxies alongside services to evaluate centralized authorization policies.

Answer

The architecture should implement the SPIFFE/SPIRE framework for workload identity attestation and decoupled Policy Decision Points (PDPs) as sidecar proxies for centralized authorization evaluation.
Implementing SPIFFE/SPIRE provides cryptographically verifiable, short-lived workload identities (SVIDs) for microservices across dynamic environments. Integrating decoupled Policy Decision Points (PDPs) via sidecar proxies allows authorization policies to be updated and evaluated centrally without altering microservice application logic.

Step-by-Step Solution

1
Identify workload identity requirements for dynamic microservice containers.
Recognize that SPIFFE/SPIRE establishes automated, short-lived, cryptographically verifiable identity documents (SVIDs) for workloads without relying on IP addresses or static credentials.
Microservices require dynamic workload attestation and identity propagation across cloud boundaries under Zero Trust.
2
Determine the appropriate pattern for decoupling fine-grained authorization logic.
Select sidecar-based Policy Decision Points (PDPs) that intercept requests and enforce access policies centrally.
Decoupling authorization logic from application code ensures consistent policy enforcement across heterogeneous services.

Key Concept

Workload Identity and Decoupled Authorization in IAM Architecture
Question 242Question →

A security analyst is evaluating code remediation requirements following an assessment of an enterprise web portal. The evaluation identified two primary software flaws: database queries constructed by concatenating unsanitized user inputs, and user-submitted data reflected directly into rendered HTML responses without escaping. Which of the following mitigation strategies must developers implement to address these specific application vulnerabilities? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Implement parameterized queries (prepared statements) for all database interactions; Apply context-aware output encoding on user data rendered in web pages

Answer

Developers must implement parameterized queries (prepared statements) for database interactions and apply context-aware output encoding on rendered web page data.
The correct mitigations directly address the root causes of the vulnerabilities: parameterized queries (prepared statements) prevent SQL injection by treating input strictly as data parameters, while context-aware output encoding neutralizes Cross-Site Scripting (XSS) by rendering client-side scripts as plain text rather than executable browser code.

Step-by-Step Solution

1
Identify the specific software vulnerability types described in the scenario
Dynamic database string concatenation corresponds to SQL Injection (SQLi), while unescaped user input reflected in HTML corresponds to Reflected Cross-Site Scripting (XSS).
Accurate vulnerability identification is required to select effective code-level mitigations.
2
Determine the appropriate software remediation for SQL Injection
Using parameterized queries (prepared statements) binds user inputs as strongly-typed data values rather than executable code statements.
Prepared statements ensure the database engine compiles the query structure prior to inserting user parameters.
3
Determine the appropriate software remediation for Reflected XSS
Applying context-aware output encoding translates special characters (such as angle brackets and quotes) into harmless HTML entity equivalents prior to rendering.
Output encoding prevents the browser from interpreting user strings as inline executable scripts.

Key Concept

Application Input Validation and Output Sanitization Controls
Estimated Time:1m 30s
Question 243Question →

A defense technology organization is implementing Zero Trust Architecture (ZTA) for field operations. Mobile tactical command units must access centralized intelligence databases across untrusted wireless channels. To strictly adhere to Zero Trust principles, the architecture must decouple control plane policy evaluation from data plane enforcement. Which of the following implementations correctly demonstrates this architectural separation?

Show answer & explanation

Answer: A centralized policy engine evaluates real-time device health, user context, and threat intelligence to issue dynamic access decisions, while local gateway proxies inspect and enforce those authorization decisions on incoming data streams.

Answer

The implementation where a centralized policy engine evaluates real-time context and dynamic risk factors to issue access decisions, while local gateway proxies enforce those authorization decisions on data streams.
Decoupling control plane policy decisions from data plane enforcement is a foundational Zero Trust Architecture principle. The centralized engine acts as the Policy Decision Point (PDP), using dynamic trust signals (user identity, device posture, location) to decide access, while the gateway proxy acts as the Policy Enforcement Point (PEP) to grant or drop sessions dynamically.

Step-by-Step Solution

1
Identify the core Zero Trust components required for decoupling control plane evaluation from data plane enforcement.
The control plane is represented by the Policy Decision Point (PDP), while the data plane is represented by the Policy Enforcement Point (PEP).
Zero Trust relies on separate functional components to make access decisions (PDP) and apply those decisions to network traffic (PEP).
2
Evaluate the role of the centralized policy engine versus the local gateway proxy.
The centralized policy engine functions as the PDP by continually assessing trust factors, whereas the inline gateway proxy functions as the PEP by granting or denying individual packet flows.
This guarantees per-request explicit verification without allowing implicitly trusted zones.

Key Concept

Decoupling Policy Decision Points (PDP) from Policy Enforcement Points (PEP) in Zero Trust Architecture
Question 244Question →

During a forensic investigation of a compromise on a critical database host, an incident handler needs to collect evidence while the system remains powered on. To minimize data loss, which of the following evidence acquisition steps should be executed FIRST according to the order of volatility?

Show answer & explanation

Answer: Dump system RAM and active CPU cache registers.

Answer

Dumping system RAM and active CPU cache registers is the correct first step.
Dumping system RAM and active CPU cache registers is correct because the order of volatility requires capturing evidence from the most ephemeral (volatile) sources first. CPU cache, memory registers, and main system RAM lose all contents when power is interrupted or when overwritten by OS operations, whereas local disk drives and archived backups retain data persistently.

Step-by-Step Solution

1
Identify the volatility level of candidate evidence sources on the live database host.
CPU cache, registers, and system RAM are determined to be extremely short-lived volatile data sources.
The order of volatility dictates collecting evidence starting from the most volatile (easily lost) components to the least volatile.
2
Prioritize capture tools to acquire RAM and CPU state prior to persistent storage.
Volatile memory is successfully preserved before any disk writes or power state modifications alter system memory contents.
Interacting with disk storage or shutting down the machine irreversibly modifies running process state and RAM contents.

Key Concept

Order of Volatility in Digital Forensics
Estimated Time:1m 30s
Question 245Question →

A Security Operations Center (SOC) analyst receives a high-severity Endpoint Detection and Response (EDR) alert indicating an active living-off-the-land attack where a compromised workstation is attempting lateral movement via WMI and fileless memory injection. Arrange the following incident response containment and forensic actions in the correct sequential order from first step to last step.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence places host network isolation first, followed by volatile memory collection, active process tree termination, and finally fleet-wide IOC ban rule enforcement.
In security incident response workflows, immediate containment of lateral movement is prioritized first by applying EDR network host isolation. Next, adherence to the order of volatility dictates collecting RAM and process dumps prior to killing active processes. Once volatile evidence is safely captured, active malicious process trees are terminated to stop local adversary activity. Finally, extracted IOCs are distributed enterprise-wide as EDR ban rules to protect remaining fleet endpoints.

Step-by-Step Solution

1
Isolate host using EDR network containment tools.
Network traffic to and from the host is restricted to the EDR cloud sensor, immediately stopping lateral movement.
Containment is the immediate priority during active lateral movement attacks to limit blast radius.
2
Trigger remote volatile RAM and process dump collection.
Volatile memory evidence is stored safely before process alteration.
Order of volatility requires capturing RAM and volatile evidence before altering system memory state.
3
Kill malicious processes and injected execution threads.
Malicious code execution on the endpoint ceases completely.
Terminating processes stops ongoing attacker activity without losing evidence previously captured in Step 2.
4
Distribute IOC ban rules across all enterprise EDR endpoints.
Enterprise-wide protection is established against the identified attack signature.
Remediation and preventive policy enforcement ensure fleet-wide protection after containment.

Key Concept

EDR Incident Containment Sequence & Volatility Management
Question 246Question →

A security analyst evaluates an enterprise environment where legacy monitoring agents running on internal host servers transmit host telemetry data using unencrypted broadcast traffic across a flat management subnet. Additionally, internal host-to-host administrative communication is automatically permitted based strictly on subnetwork IP address origin without requiring continuous session verification or microsegmentation.

Which of the following vulnerabilities are present in this architectural deployment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Implicit trust reliance on network perimeter boundaries rather than zero trust verification; Use of cleartext transmission protocols for host telemetry and network communication

Answer

The correct vulnerabilities are implicit trust reliance on network perimeter boundaries rather than zero trust verification, and the use of cleartext transmission protocols for host telemetry and network communication.
The scenario highlights two distinct architectural vulnerabilities: transmitting telemetry over unencrypted broadcast channels represents a cleartext protocol exposure, while permitting host communication based solely on subnet origin demonstrates implicit perimeter trust instead of Zero Trust continuous verification.

Step-by-Step Solution

1
Analyze the network transmission security described in the scenario.
Identified that legacy monitoring agents broadcast telemetry data in an unencrypted state.
Unencrypted broadcast traffic permits eavesdropping and packet sniffing, indicating a cleartext protocol vulnerability.
2
Analyze the access control and architectural design.
Identified that host-to-host connections are trusted based purely on subnet IP origin without continuous authentication.
Relying on network placement for access privileges constitutes implicit perimeter trust, violating microsegmentation and Zero Trust tenets.
3
Select the matching vulnerabilities corresponding to these findings.
Matched cleartext telemetry to cleartext transmission protocol vulnerability, and matched IP origin trust to implicit perimeter reliance.
These two findings directly map to host and network architecture weaknesses.

Key Concept

Host, Network, and Architecture Vulnerabilities (Perimeter Trust vs. Zero Trust & Cleartext Protocols)
Question 247Question →

A telecommunications enterprise security team detects covert data staging on an internal jump host. The activity was conducted during off-peak hours using valid domain administrative credentials, bypassing perimeter firewalls without triggering external traffic alerts. The entity utilized native system administration tools to clear system logs and pivot into restricted intellectual property repositories. Which TWO of the following threat actor attributes or capabilities are most characteristic of this adversary profile? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Pre-existing legitimate authentication credentials and system access permissions; Intimate familiarity with internal organizational workflows, auditing mechanisms, and security controls

Answer

The threat actor profile is characterized by pre-existing legitimate authentication credentials and intimate familiarity with internal organizational workflows and security controls.
The scenario describes an adversary operating from within the network perimeter using valid domain administrator credentials and living-off-the-land techniques (native administration scripts and log suppression). These actions directly reflect an insider threat profile characterized by pre-existing legitimate access permissions and deep familiarity with internal security controls and auditing procedures.

Step-by-Step Solution

1
Analyze the attack indicators and operational tactics described in the scenario.
The adversary leveraged valid domain administrator accounts, operated during off-peak hours, used built-in administrative tools, cleared local audit logs, and avoided perimeter detection.
Identifying specific behavioral patterns allows analysts to differentiate between external opportunistic attackers and malicious insiders or advanced persistent threats.
2
Match the observed tactics to threat actor attributes.
Using valid internal credentials demonstrates pre-existing legitimate access, while clearing logs with internal utilities demonstrates detailed knowledge of environment defenses.
Insider threats possess innate privileges and operational familiarity that enable them to bypass standard perimeter security controls seamlessly.

Key Concept

Threat Actor Attributes: Insider Threats vs. External Attackers
Question 248Question →

A security analyst conducts an internal infrastructure assessment of an enterprise application environment. The assessment reveals two critical architectural findings:

1. Web application microservices communicate with back-end database servers across an unsegmented internal subnet using standard unencrypted HTTP endpoints.
2. No host-based firewalls or network access control lists (ACLs) are configured to restrict traffic between adjacent application servers on the same subnet.

Which of the following host, network, or architecture vulnerabilities are directly present in this environment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Transmission of sensitive internal communication over unencrypted cleartext protocols; Lack of network microsegmentation allowing unrestricted lateral movement

Answer

The environment suffers from transmission of sensitive internal communication over unencrypted cleartext protocols and a lack of network microsegmentation allowing unrestricted lateral movement.
The correct answers identify the specific architectural weaknesses in the scenario: sending data via HTTP is an unencrypted cleartext protocol flaw, and lacking host firewalls or ACLs on a flat subnet creates a microsegmentation flaw that permits lateral movement.

Step-by-Step Solution

1
Analyze finding 1 regarding unencrypted HTTP communications.
HTTP transfers data in plain text without cryptographic protection, representing a cleartext protocol vulnerability.
Internal communications transporting data over HTTP expose sensitive information to packet sniffing.
2
Analyze finding 2 regarding flat subnets without host firewalls or ACLs.
The absence of internal traffic controls or subnet boundaries constitutes an architecture vulnerability.
Without microsegmentation or host-based firewall rules, compromised hosts allow unchecked lateral movement across the internal network.

Key Concept

Host, Network, and Architecture Vulnerabilities (Cleartext Protocols & Microsegmentation)
Question 249Question →

A financial organization is migrating an existing legacy internal application to a public Infrastructure as a Service (IaaS) environment. Under the cloud shared responsibility model, which of the following security management tasks are the direct responsibility of the organization? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Patching operating system vulnerabilities on deployed virtual instances; Configuring network access rules and host-based firewalls on virtual servers

Answer

The organization is responsible for patching operating system vulnerabilities on deployed virtual instances and configuring network access rules and host-based firewalls on virtual servers.
In an Infrastructure as a Service (IaaS) cloud architecture, the cloud service provider (CSP) takes responsibility for securing physical data centers, host hardware, and hypervisors. The customer assumes responsibility for securing the guest operating systems (including applying OS patches) and managing access traffic through virtual firewall configurations and host-based security rules.

Step-by-Step Solution

1
Identify the cloud deployment and service model described in the scenario
The scenario specifies an Infrastructure as a Service (IaaS) public cloud environment.
Responsibility boundaries vary significantly based on whether IaaS, PaaS, or SaaS is deployed.
2
Determine the cloud provider versus customer responsibilities in IaaS
The cloud service provider manages physical facilities, hardware, network infrastructure, and hypervisors. The customer manages guest operating systems, application code, data classification, and virtual network configuration.
Under the shared responsibility model for IaaS, control of everything above the hypervisor layer is retained by the tenant.
3
Select the correct security controls assigned to the customer
Operating system security patching and host-based firewall configurations fall squarely within customer management, whereas hypervisor firmware updates and physical security belong to the provider.
Distinguishing between underlying cloud infrastructure management and tenant server configuration establishes correct operational control boundaries.

Key Concept

Shared Responsibility Model in IaaS Cloud Architecture
Estimated Time:1m 30s
Question 250Question →

A threat hunting team analyzes workstation artifacts following reports of compromised privileged account credentials. Network telemetry and host activity reveal an unauthorized background program that captures input typed into authentication forms and periodically exfiltrates this data to an external server over port 443. The software was installed after an employee executed a third-party utility download, does not attempt to scan or self-replicate across local subnet subnets, and does not modify kernel-level system routines. Which of the following malware classifications best describes this threat?

Show answer & explanation

Answer: Spyware

Answer

Spyware (specifically keylogging functionality) is the malware classification that covertly monitors user activity, collects credentials, and exfiltrates input data.
Spyware is designed to run covertly on a device to record user activities, capture sensitive credentials or keystrokes, and exfiltrate the collected telemetry to an external command-and-control server.

Step-by-Step Solution

1
Analyze the observed malware behaviors and telemetry indicators in the scenario.
The malware captures user keystrokes/authentication input and transmits the gathered data to an external server via port 443.
Identifying the primary function (data collection and exfiltration) narrows down the malware family.
2
Evaluate the propagation mechanism and operational footprint.
The malware relies on user execution of a downloaded utility and lacks automated self-replication capabilities.
This rules out self-propagating threats like network worms.
3
Compare against malware taxonomy classifications.
Malware that covertly monitors and exfiltrates user input without altering kernel hooks or encrypting files is classified as spyware.
Spyware targets user data and activities while remaining passive to avoid detection.

Key Concept

Spyware and Keylogger Indicators of Compromise
Question 251Question →

A security technician conducts an assessment of an embedded building control device connected to an enterprise network. A vulnerability scan produces the following finding:

Host: 192.168.4.12
Port: 8080/tcp (HTTP)
Finding: Embedded Web Interface Hardcoded Credentials
Risk Level: High
Description: The device firmware contains fixed administrative credentials transmitted in cleartext over HTTP. No vendor security patches are available.

The legacy device must remain operational for business operations. Which of the following architecture-level mitigations is the BEST solution to protect the enterprise from this host vulnerability?

Show answer & explanation

Answer: Place the embedded device onto an isolated management VLAN accessible only via an encrypted jump host with strict access controls.

Answer

Placing the embedded device onto an isolated management VLAN accessible only via an encrypted jump host with strict access controls is the best mitigation.
Placing unpatchable legacy embedded devices onto an isolated management VLAN and requiring access through an encrypted jump host isolates the host vulnerability, prevents cleartext exposure over general networks, and restricts access strictly to authenticated administrators.

Step-by-Step Solution

1
Analyze the vulnerability scan report and constraints.
Identified an unpatchable embedded host vulnerability involving hardcoded credentials and cleartext administrative HTTP access on port 8080.
Because the vendor offers no patches, host-level remediation is impossible, requiring network architecture mitigations.
2
Evaluate compensating security controls for unpatchable legacy systems.
Microsegmentation and out-of-band management restrict access to authorized administrators only.
Isolating legacy hosts behind strict VLAN segmentation and encrypted jump hosts reduces the attack surface and prevents unauthorized lateral access.

Key Concept

Host and Architecture Vulnerabilities Mitigation via Network Segmentation
Estimated Time:1m 30s
Question 252Question →

A cybersecurity analyst needs to assess internal enterprise servers for missing software security patches and configuration flaws without sending intrusive exploit payloads or generating heavy network traffic across the subnet. Which of the following vulnerability assessment methods should the analyst perform?

Show answer & explanation

Answer: A credentialed vulnerability scan

Answer

The analyst should perform a credentialed vulnerability scan.
A credentialed vulnerability scan uses valid system credentials to authenticate directly onto host systems. This permits the scan engine to inspect internal registry keys, patch management records, and software configurations with minimal network bandwidth usage and without executing invasive attack probes.

Step-by-Step Solution

1
Analyze the operational requirements
The assessment must identify missing patches and local configuration flaws while avoiding high network overhead and intrusive probes.
Uncredentialed scans rely on network-based probes that generate high traffic and can miss internal configuration flaws.
2
Select the appropriate scanning methodology
A credentialed scan authenticates locally on the host to read configuration settings and patch status directly.
Authenticating locally minimizes network footprint and provides accurate inventory without executing intrusive exploits.

Key Concept

Credentialed Vulnerability Scanning
Estimated Time:50s
Question 253Question →

A security operations team is designing a vulnerability assessment strategy for a legacy operational technology (OT) network housing fragile programmable logic controllers (PLCs). Prior active network vulnerability scans against these devices caused unexpected buffer overflows, triggering critical system resets and operational downtime. Which of the following approaches should the analyst implement to safely identify known software vulnerabilities on these OT assets without risking system instability?

Show answer & explanation

Answer: Implement passive network traffic monitoring and asset identification combined with offline configuration file auditing.

Answer

Implement passive network traffic monitoring and asset identification combined with offline configuration file auditing.
The correct answer advocates for passive network traffic monitoring paired with offline static configuration audits. Passive monitoring inspects mirrored network traffic (e.g., via SPAN ports or TAPs) to identify protocols, firmware versions, and known vulnerabilities without sending a single packet to fragile endpoints. Offline configuration auditing checks static backups, eliminating any chance of causing operational disruption to critical legacy PLCs.

Step-by-Step Solution

1
Analyze environment constraints and historical failure modes
Identified fragile legacy PLCs in an OT environment that experience crashes during active probe transmission.
Legacy embedded systems lack robust TCP/IP stacks and fail gracefully when exposed to unexpected scan traffic.
2
Evaluate vulnerability assessment methodologies based on risk
Distinguished between active network scanning, agent-based assessment, and passive assessment.
Active network sweeps and local agents introduce operational risk or technical incompatibilities on OT hardware.
3
Select non-intrusive assessment controls
Determined passive packet analysis and offline static configuration analysis satisfy security requirements safely.
Passive techniques collect network banners and asset indicators out-of-band without generating network overhead or sending packets to sensitive endpoints.

Key Concept

Passive Vulnerability Assessment vs. Active Scanning in OT/ICS Environments
Question 254Question →

A smart manufacturing facility is updating its industrial control network to align with Zero Trust Architecture (ZTA) principles. Currently, field sensor nodes and automated robotic assembly controllers communicate freely within an internal operational technology (OT) network segment once inside the network perimeter. Which of the following architectural modifications best implements the core Zero Trust principle of continuous explicit verification for these device communications?

Show answer & explanation

Answer: Requiring every communication session between sensor nodes and assembly controllers to be dynamically authenticated and authorized based on real-time device health and contextual policy before granting access.

Answer

Requiring every communication session between sensor nodes and assembly controllers to be dynamically authenticated and authorized based on real-time device health and contextual policy before granting access.
Zero Trust Architecture fundamentally operates under the principle of 'never trust, always verify.' Requiring every connection request between internal devices to be explicitly authenticated and authorized using dynamic contextual attributes ensures that network location alone never grants implicit access rights.

Step-by-Step Solution

1
Identify current architecture security flaws
The current setup relies on implicit trust within the internal OT network perimeter.
Perimeter-based models assume internal network traffic is inherently safe once inside, leaving systems vulnerable to lateral movement.
2
Apply Zero Trust Architecture tenets
Zero Trust mandates explicit verification and continuous evaluation of every access request regardless of network placement.
Under Zero Trust, access decisions must be dynamic, continuous, and based on contextual identity and asset health metrics.
3
Select the control that enforces dynamic session evaluation
Enforcing real-time, policy-driven authentication and authorization per session fulfills the explicit verification requirement.
This eliminates implicit network location trust and forces granular, continuous validation for every transaction.

Key Concept

Zero Trust Explicit Verification and Continuous Authentication
Question 255Question →

Match each vulnerability assessment scan approach with its corresponding operational description.

Click a left item, then click its matching right item

Items

Credentialed Scan
Non-Credentialed Scan
Intrusive Scan

Matches

Show answer & explanation

Answer

Credentialed Scan pairs with using administrative access for internal patch checks; Non-Credentialed Scan pairs with examining unauthenticated network services; Intrusive Scan pairs with actively exploiting weaknesses with disruption risk.
Credentialed scanning uses administrative privileges to check internal host states, non-credentialed scanning evaluates exposed network services without access permissions, and intrusive scanning actively verifies vulnerability exploitability with potential operational impact.

Step-by-Step Solution

1
Analyze the authentication requirement of each scanning method.
Credentialed scans use authorized accounts to perform inside-out administrative checks, whereas non-credentialed scans inspect systems outside-in without credentials.
Differentiating access capabilities defines host-level vs network-level inspection.
2
Evaluate the operational impact and active testing behavior.
Intrusive scanning actively simulates exploits to verify vulnerability presence, distinguishing it from passive or non-intrusive measurement techniques.
Identifying operational risk separates discovery scans from exploitation attempts.

Key Concept

Vulnerability scanning modes and operational characteristics
Estimated Time:1m 0s
Question 256Question →

An enterprise Security Operations Center (SOC) team is configuring an automated playbook within their Endpoint Detection and Response (EDR) solution to respond to an active ransomware outbreak involving credential dumping and process injection. Place the incident response steps in the correct operational order from initial containment through complete host restoration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper operational sequence begins with network isolation via the EDR agent, followed by volatile memory collection, process tree termination and token revocation, enterprise-wide IOC block rule propagation, and finally system integrity remediation prior to network restoration.
The correct sequence prioritizes halting threat spread first through EDR agent network isolation, preserving perishable volatile memory next before process termination, killing active malicious code execution third, deploying global block rules to protect other network assets fourth, and finally cleaning host artifacts before restoring network connectivity.

Step-by-Step Solution

1
Isolate the endpoint network connection via EDR software filters.
Halts lateral spread and data exfiltration instantly while keeping EDR communication open.
Immediate containment is mandatory prior to evidence collection or termination.
2
Acquire volatile memory image (RAM capture).
Preserves volatile injected DLLs, unwritten encryption keys, and active process handles.
Terminating malicious processes prior to memory capture permanently destroys critical forensic artifacts.
3
Kill malicious process tree and revoke associated session credentials.
Stops threat execution on the endpoint.
Active threat execution must be halted once volatile forensic data is secured.
4
Propagate newly identified file hashes and network indicators to the global EDR tenant block list.
Protects all uncompromised endpoints across the organization.
Global containment prevents lateral reinfection across non-isolated endpoints.
5
Remediate modified system binaries, verify baseline integrity, and remove host network isolation.
Returns the endpoint safely to normal operational status.
Host un-isolation should only occur after complete cleanup and integrity verification.

Key Concept

EDR Incident Response Playbook Sequencing
Question 257Question →

An enterprise Endpoint Detection and Response (EDR) system alerts a security analyst to an active malicious code injection on a user workstation. Sequence the standard EDR response steps from initial detection to host restoration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with initial behavioral detection and alerting, followed by immediate endpoint network isolation, process termination and forensic telemetry collection, and concludes with host restoration.
The proper incident response workflow following an EDR alert begins with detection, moves immediately to containment (host network isolation), proceeds to eradication and evidence capture (terminating processes and dumping memory), and finishes with recovery (restoring endpoint network access).

Step-by-Step Solution

1
Identify initial threat detection
The EDR agent flags anomalous activity and alerts analysts.
Incident response workflows begin with detection and triage.
2
Contain the threat
Network isolation is applied to the workstation via EDR.
Immediate containment prevents lateral spread while maintaining management connectivity.
3
Eradicate and analyze
Malicious processes are killed and process/memory telemetry is gathered.
Stopping threat activity and capturing volatile evidence enables root cause analysis without losing host context.
4
Restore host operations
The endpoint is verified secure and un-isolated.
Host network access is restored only after containment, investigation, and cleanup are complete.

Key Concept

EDR Incident Containment and Response Sequence
Question 258Question →

An organization plans to deprecate legacy cryptographic protocols across all internal application gateways during a scheduled maintenance window. Following the change execution, several mission-critical legacy internal applications lose connection to the centralized authentication service, causing widespread business disruption. Investigation reveals that while the protocol deprecation was approved by the Change Advisory Board (CAB), the technical change request did not evaluate application-level dependency on legacy protocol suites. Which of the following change management practices was omitted prior to submission?

Show answer & explanation

Answer: Performing a security impact assessment and system dependency analysis to identify technical prerequisites and legacy integration requirements.

Answer

Performing a security impact assessment and system dependency analysis to identify technical prerequisites and legacy integration requirements.
The correct answer emphasizes performing a security impact assessment and dependency analysis. Before any major infrastructure modification is presented to a Change Advisory Board (CAB), administrators must evaluate how security configuration changes affect existing applications and inter-service dependencies. Identifying these legacy requirements ahead of time ensures necessary adjustments or exceptions are addressed before deployment.

Step-by-Step Solution

1
Analyze the change management failure scenario.
Identified that cryptographic protocol removal caused cascading authentication failures due to unmapped dependencies.
Changes to security settings must be thoroughly evaluated for technical interdependencies before implementation.
2
Evaluate the required pre-implementation change control phase.
A thorough security impact assessment and dependency mapping would have highlighted legacy application reliance on the protocol.
Change management workflows require assessing operational and security impacts to ensure backout plans and compatibility checks are established.

Key Concept

Security Impact Assessment and Dependency Analysis in Change Management
Question 259Question →

A system administrator notifies the incident response team after discovering that a critical internal database server containing confidential customer records is actively opening outbound connections to an unknown remote IP address. Endpoint monitoring confirms an unauthorized background process executing with administrative privileges and sending encrypted data packages outside the enterprise network boundary. According to standard incident response frameworks, which of the following actions should the team take FIRST?

Show answer & explanation

Answer: Isolate the affected database server from the network segment to halt active data exfiltration.

Answer

Isolate the affected database server from the network segment to halt active data exfiltration.
According to the NIST SP 800-61 Incident Response framework, once an incident involves active data exfiltration or command-and-control activity, the immediate next phase is Containment. Isolating the server from the network stops active data exfiltration while preserving system state and volatile RAM for digital forensic analysis.

Step-by-Step Solution

1
Identify the current phase of the Incident Response lifecycle based on the scenario.
The incident is actively occurring with ongoing data exfiltration detected.
Determining the phase ensures appropriate incident response playbook procedures are followed.
2
Select the immediate response priority following Detection and Analysis.
Containment must be executed prior to eradication or recovery.
The primary objective during active exfiltration is to minimize damage and prevent further unauthorized data transfer.
3
Determine the containment action that halts network communication without destroying volatile forensic evidence.
Network isolation detaches the compromised host from the network while preserving RAM and system logs.
Disconnecting or isolating network access stops malicious C2/exfiltration traffic while keeping volatile evidence intact for investigators.

Key Concept

Incident Response Containment Phase
Estimated Time:1m 30s
Question 260Question →

A security analyst is reviewing the risk register for an organization's legacy operational technology (OT) environment. Due to vendor constraints, the OT systems cannot be updated with recent security patches, leaving them vulnerable to remote code execution exploits. To address this risk without disrupting active business operations or decommissioning the equipment, which of the following response strategies and control implementations should the analyst recommend? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Implement network microsegmentation and strict access control lists around the legacy OT network segment to lessen the likelihood of exploitation.; Acquire a specialized cyber liability insurance policy to cover potential financial losses resulting from operational downtime.

Answer

The analyst should recommend implementing network microsegmentation (risk mitigation) and acquiring a cyber liability insurance policy (risk transference).
Implementing network microsegmentation reduces attack vector surface area and limits exploitation likelihood, serving as a compensating control for risk mitigation. Purchasing cyber insurance transfers the residual financial burden of a potential incident to a third-party insurer (risk transference). Both actions satisfy the requirement to manage risk without pulling legacy OT equipment offline.

Step-by-Step Solution

1
Analyze the operational constraints and risk requirements
The systems cannot be patched or decommissioned (ruling out risk avoidance by removal), meaning risk must be managed through controls or financial shifting.
Risk identification requires understanding business limits before selecting appropriate risk response strategies.
2
Evaluate technical safeguard options for reducing risk likelihood
Network microsegmentation isolates vulnerable systems, lowering the likelihood of attack propagation without requiring system modification.
Applying compensating security controls to decrease exposure is the definition of risk mitigation.
3
Evaluate residual financial risk handling
Cyber insurance policies absorb residual monetary consequences caused by operational disruptions.
Shifting financial impact to a third party fulfills the criteria for risk transference.

Key Concept

Risk Response Strategies (Mitigation and Transference)
Estimated Time:1m 30s
PreviousPage 13 / 112Next
All practice questions — CompTIA Security+ | Examkin