Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 261Question →

A security team at a regional retail corporation is investigating a security incident involving unauthorized access to internal file servers. The attacker gained access using valid employee credentials purchased from an online broker, deployed commercially available ransomware within two hours of access, and left a ransom note demanding an immediate cryptocurrency payment. The investigation confirmed that no sensitive intellectual property was exfiltrated and no attempts were made to establish long-term persistence. Which threat actor category and attribute profile are most consistent with this attack?

Show answer & explanation

Answer: Organized crime motivated by financial gain utilizing commoditized tools

Answer

Organized crime motivated by financial gain utilizing commoditized tools
Organized crime threat actors are primarily motivated by financial profit. They frequently leverage compromised credentials purchased from access brokers and deploy off-the-shelf or ransomware-as-a-service (RaaS) toolkits to achieve fast monetization, matching all indicators in the scenario.

Step-by-Step Solution

1
Analyze the attacker's primary objective described in the scenario.
The adversary deployed ransomware and demanded a cryptocurrency ransom without exfiltrating espionage targets or maintaining persistence.
Immediate financial extortion directly aligns with the primary motivation of organized cybercrime groups.
2
Evaluate the tactics, techniques, and procedures (TTPs) and resource attributes.
The attacker used dark web brokers for credential access and deployed off-the-shelf commodity ransomware quickly.
These attributes indicate moderate sophistication and reliance on commoditized resources rather than state-funded custom exploits or insider privilege abuse.
3
Synthesize the actor profile based on motivation and capability.
The threat actor is an organized crime entity.
Matching financial motivation and commodity tool capability correctly identifies the threat actor type.

Key Concept

Threat Actor Classification and Motivation Profiling
Question 262Question →

A security operations team is organizing its threat intelligence pipeline to improve context, automation, and threat response capabilities across different enterprise monitoring tools. Match each threat intelligence source type on the left to its corresponding operational characteristic or operational capability on the right.

Click a left item, then click its matching right item

Items

Information Sharing and Analysis Center (ISAC)
Commercial / Proprietary Threat Feed
Open-Source Intelligence (OSINT)
National Vulnerability Database (NVD)

Matches

Show answer & explanation

Answer

Information Sharing and Analysis Center (ISAC) matches sector-specific peer sharing; Commercial/Proprietary Feed matches curated SLA-backed data; Open-Source Intelligence (OSINT) matches freely accessible public threat insights; National Vulnerability Database (NVD) matches standardized CVE and CVSS repositories.
Each intelligence source type is matched to its primary operational framework: ISACs provide sector-specific peer sharing, Commercial feeds provide SLA-backed curated intelligence, OSINT provides freely accessible public research, and NVD provides standardized vulnerability tracking with CVE/CVSS identifiers.

Step-by-Step Solution

1
Analyze the operational role of ISACs
Identify ISACs as trusted platforms for industry-specific threat sharing (e.g., FS-ISAC for financial services).
ISACs focus on sector-specific peer intelligence sharing.
2
Distinguish between proprietary feeds and OSINT
Commercial feeds offer vendor SLAs and curated indicators, whereas OSINT is gathered from publicly accessible sources without SLAs.
Paid feeds trade cost for SLA guarantees and lower false-positive rates compared to unvetted public feeds.
3
Map vulnerability database characteristics
NVD provides public, structured vulnerability records categorized by CVEs and evaluated with CVSS metrics.
Vulnerability databases focus on flaw scoring rather than active adversary threat actor feeds.

Key Concept

Threat Intelligence Sources and Research
Question 263Question →

A systems administrator observes that unauthenticated, network-based vulnerability scans are failing to detect internal software patch status and host misconfigurations due to strict host-based firewall rules blocking network probes on corporate endpoints. The administrator needs to collect detailed vulnerability data across all endpoints without altering network firewall policies or exposing administrative credentials across network subnets. Which of the following vulnerability assessment methods should the administrator implement?

Show answer & explanation

Answer: Deploy agent-based vulnerability scanning software directly onto each endpoint target.

Answer

Deploying agent-based vulnerability scanning software directly onto each endpoint target.
Deploying agent-based vulnerability scanning software places lightweight software agents directly on target hosts. The agent performs local assessment of installed packages, missing patches, and system registry configurations without requiring open inbound network ports or sending privileged credentials across the network.

Step-by-Step Solution

1
Analyze the operational constraints presented in the scenario.
Network-based scanning is blocked by host-based firewalls, and passing administrative credentials across subnets must be avoided.
Host firewalls block unauthenticated network probes, preventing standard external scanning engines from probing open ports and banner information.
2
Evaluate assessment methods against local access requirements.
Agent-based scanning runs locally on endpoints with local administrative privileges.
Local agents execute host checks directly inside the operating system, bypassing network-level filtering and eliminating the need to transmit high-privilege credentials across the network.

Key Concept

Agent-based versus network-based vulnerability scanning techniques
Question 264Question →

During a routine internal audit of an enterprise infrastructure, a security analyst reviews a vulnerability scan report for an Active Directory server host. The scan highlights that a custom system service executable path is configured as C:\Program Files\Enterprise Apps\Service Manager\service.exe without quotation marks, and the directory C:\Program Files\Enterprise Apps has write permissions granted to unprivileged users. Which of the following host vulnerabilities does this specific configuration represent?

Show answer & explanation

Answer: Unquoted service path vulnerability enabling privilege escalation via executable hijacking

Answer

Unquoted service path vulnerability enabling privilege escalation via executable hijacking
The correct answer identifies an unquoted service path vulnerability. When Windows launches a service whose file path contains spaces and lacks surrounding quotation marks, the Windows Service Control Manager interprets spaces as argument delimiters. It attempts to launch executable candidates in order, such as C:\Program.exe, C:\Program Files\Enterprise.exe, etc. Because unprivileged users have write access to the directory, an attacker can drop a malicious binary at one of those locations, achieving local privilege escalation when the service executes.

Step-by-Step Solution

1
Analyze the host configuration report
Identify that the service binary path contains spaces without quotes (C:\Program Files\Enterprise Apps\Service Manager\service.exe) and weak folder write permissions.
Windows service executable paths containing spaces without surrounding quotation marks cause the Service Control Manager to evaluate candidate paths prior to each space.
2
Determine the impact of user write permissions
Unprivileged users can write files to intermediate path folders such as C:\Program Files\Enterprise Apps.
If a user writes an executable named Enterprise.exe in that directory, the operating system will execute it under the service's privileges (typically SYSTEM) upon service start.
3
Match the weakness to host vulnerability definitions
Confirm that this specific flaw is classified as an unquoted service path privilege escalation vulnerability.
It represents a classic host service configuration vulnerability where path parsing behavior allows local binary hijacking.

Key Concept

Host Service Path Hardening and Privilege Escalation Vulnerabilities
Question 265Question →

A Incident Response Team is responding to an ongoing breach where an adversary compromised an automated CI/CD pipeline build runner service account. The attacker injected malicious code into build scripts and is actively exfiltrating deployment credentials over an encrypted tunnel. Playbook analysis indicates the attack payload includes an automated anti-forensic wiper script that triggers upon service account termination or system reboot. Which TWO of the following immediate actions should the incident response handler perform to isolate the threat and preserve volatile evidence? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply a hypervisor-level network isolation filter to block network traffic from the build runner host while keeping the virtual machine powered on.; Perform a volatile memory (RAM) capture of the compromised build runner system prior to terminating active sessions or credentials.

Answer

The incident response handlers should isolate the host at the hypervisor network boundary to cut off adversary connectivity without disturbing the operating environment, and take a full volatile RAM capture to preserve running processes and decryption keys before taking destructive actions.
Correct containment and evidence preservation strategy requires isolating the system from the network without altering volatile system state or powering off the machine. Hypervisor-level network isolation prevents command-and-control communication and data exfiltration while keeping the host active. Capturing volatile memory (RAM) prior to taking destructive actions ensures evidence integrity according to the RFC 3227 order of volatility.

Step-by-Step Solution

1
Assess incident risks and order of volatility preservation constraints.
Identified that rebooting or revoking credentials immediately will trigger anti-forensic wiping scripts and destroy RAM contents.
NIST SP 800-61 Rev. 2 guidelines mandate preserving volatile evidence and preventing active exfiltration before initiating intrusive eradication tasks.
2
Execute non-disruptive network containment.
Network communication between the CI/CD runner host and external networks is restricted at the hypervisor layer.
Hypervisor network isolation halts C2 and data exfiltration while avoiding OS-level signal triggers that could detonate destructive payloads.
3
Capture volatile RAM.
System memory image acquired and cryptographically hashed for forensic integrity.
Preserves memory-resident payloads, active network sockets, and temporary credentials prior to credential revocation or host destruction.

Key Concept

Incident Containment Strategy and Order of Volatility Preservation
Question 266Question →

An enterprise security audit reveals that workstations in a software development subnet can establish direct, unmonitored SSH and remote execution sessions to production database servers without passing through a centralized management gateway. Which of the following mitigation strategies should the security team implement FIRST to enforce strict administrative boundary isolation and prevent unauthorized lateral movement?

Show answer & explanation

Answer: Enforce microsegmentation policies requiring all administrative access to originate from designated jump servers protected by multi-factor authentication

Answer

Enforce microsegmentation policies requiring all administrative access to originate from designated jump servers protected by multi-factor authentication.
Enforcing microsegmentation along with jump servers and mandatory multi-factor authentication directly restricts network pathways and verifies identity before granting administrative access to sensitive production database servers. This preventive control establishes strict administrative boundary isolation and halts lateral movement.

Step-by-Step Solution

1
Analyze the security audit finding
Direct network access from workstation endpoints to production database subnets exposes critical infrastructure to lateral movement without centralized access control or MFA enforcement.
Identifying the network architecture vulnerability is necessary to select an appropriate preventive security control.
2
Evaluate mitigation controls for lateral movement prevention
Restricting network traffic via microsegmentation rules and funneling administrative access through secure jump servers requires explicit authorization and multi-factor authentication.
Enterprise hardening mandates limiting east-west network traffic and establishing secure management pathways.
3
Select the primary preventive mitigation strategy
Microsegmentation paired with secure jump servers directly eliminates direct endpoint-to-database connections.
Preventive access isolation effectively secures administrative boundaries across distinct enterprise network zones.

Key Concept

Enterprise Hardening and Microsegmentation
Question 267Question →

A security analyst reviews device logs following reports of abnormal wireless activity on an executive's smartphone during an off-site conference. The logs indicate that the smartphone first accepted an unsolicited vCard contact file over an unauthenticated Bluetooth Object Exchange (OBEX) connection. Immediately after, an unauthorized background process queried and exfiltrated the device's internal calendar entries and contact lists over Bluetooth without requesting user pairing approval. Based on these technical indicators, which of the following wireless attacks occurred? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Bluejacking, indicated by the unsolicited transmission of messages or contact cards to a Bluetooth-enabled device.; Bluesnarfing, indicated by the unauthorized access and exfiltration of sensitive information from a Bluetooth device.

Answer

The scenario demonstrates both Bluejacking (receipt of unsolicited vCard data over Bluetooth OBEX) and Bluesnarfing (unauthorized access and exfiltration of device contacts and calendar schedules).
The scenario describes two distinct Bluetooth exploits. Bluejacking is characterized by sending unsolicited messages or contact files (vCards) to a recipient device over Bluetooth. Bluesnarfing occurs when an attacker gains unauthorized access to steal private device data, such as calendars, emails, and contact lists, without user consent.

Step-by-Step Solution

1
Analyze the first observed behavior in the audit log.
The device received an unsolicited vCard contact file via Bluetooth OBEX push without prior authorization.
This behavior fits the definition of Bluejacking, where an attacker pushes unwanted text or contact cards to a target device.
2
Analyze the second observed behavior in the audit log.
An unauthorized background query accessed and retrieved internal device data (contacts and calendar items).
This behavior fits the definition of Bluesnarfing, which specifically target the unauthorized reading and theft of sensitive data stored on a Bluetooth-enabled device.
3
Distinguish from non-applicable wireless attack indicators.
Discard options related to 802.11 Wi-Fi Rogue APs (Evil Twin) or physical layer signal disruption (RF Jamming).
The indicators in the scenario explicitly concern Bluetooth OBEX protocol exploitation, not 802.11 Wi-Fi impersonation or RF signal degradation.

Key Concept

Bluetooth Wireless Attack Indicators (Bluejacking vs. Bluesnarfing)
Estimated Time:1m 30s
Question 268Question →

A security engineer at a utility organization oversees a fleet of distributed industrial edge gateways. Following a vendor firmware patch rollout, a security audit reveals that multiple gateways experienced configuration drift, automatically re-enabling legacy, unencrypted management protocols that violate organizational hardening standards. The engineer must implement a solution that continuously detects non-compliant settings and automatically restores all gateways to their authorized security baseline without manual intervention. Which of the following is the BEST solution to meet these requirements?

Show answer & explanation

Answer: Deploy an automated configuration orchestration tool enforcing declarative baseline templates to continuously audit and remediate unauthorized setting changes.

Answer

Deploying an automated configuration orchestration tool enforcing declarative baseline templates is the best solution because it continuously monitors for configuration drift and automatically restores system settings to the authorized security baseline without manual intervention.
Deploying an automated configuration orchestration tool using declarative baseline templates directly addresses configuration drift. It continuously audits device configurations against the golden baseline standard and automatically enforces compliance by reverting unauthorized setting changes, ensuring endpoints remain hardened without requiring manual intervention.

Step-by-Step Solution

1
Analyze organizational requirements
Identified the need for continuous configuration drift detection and automated remediation to enforce hardening baselines.
The scenario highlights host-level setting changes resulting from a patch deployment that must be automatically rectified.
2
Evaluate control types for configuration management
Configuration orchestration (such as IaC or configuration management agents) directly maintains system state against baseline templates.
Preventive and compensating network controls (NIPS, firewalls) or periodic detective tools (vulnerability scanners) do not restore local endpoint baselines automatically.
3
Select the optimal solution
Chosen automated configuration orchestration tool enforcing declarative templates.
This fulfills both continuous auditing and automated remediation requirements.

Key Concept

Configuration Baseline Enforcement and Automated Drift Remediation
Estimated Time:2m 0s
Question 269Question →

A security administrator at a financial institution is auditing Privileged Access Management (PAM) logs following an automated night-shift batch job failure. The log analysis reveals that a dedicated service account was locked out because a recently updated global security baseline enforced interactive multi-factor authentication (MFA) and a 30-day password expiration policy across all privileged identities. Which of the following is the MOST appropriate operational remedy to ensure unattended batch processing succeeds without compromising privileged security controls?

Show answer & explanation

Answer: Migrate the process to use a Group Managed Service Account (gMSA) with automated password rotation, excluding non-interactive identities from interactive MFA enforcement rules.

Answer

Migrate the batch process to utilize a Group Managed Service Account (gMSA) with automated password rotation while scoping interactive MFA policies strictly to human interactive logins.
Automated batch processing requires non-interactive identity controls. Group Managed Service Accounts (gMSAs) automate password management within domain environments and allow organizations to exempt service identities from interactive human prompts while maintaining strong credential protection.

Step-by-Step Solution

1
Identify the operational cause of the authentication failure.
Recognize that automated non-interactive service accounts cannot fulfill interactive Multi-Factor Authentication (MFA) challenges.
Policy baselines requiring interactive prompts break automated, unattended scheduled tasks.
2
Evaluate identity lifecycle and IAM operational management options for service accounts.
Determine that Group Managed Service Accounts (gMSAs) or managed workload identities provide centralized, programmatic credential rotation.
gMSAs eliminate static passwords and human management overhead while fulfilling security control requirements.
3
Adjust Identity Provider (IdP) Conditional Access policies.
Enforce interactive MFA specifically on user identities, using non-interactive certificate-based or workload identity controls for service accounts.
Ensures strong authentication controls without breaking unattended system operations.

Key Concept

Privileged Account Lifecycle and Service Account Management
Estimated Time:1m 30s
Question 270Question →

A security analyst is configuring an internal vulnerability assessment for a enterprise web platform located behind a reverse proxy. The platform includes legacy application services that are highly sensitive to traffic spikes. The analyst needs to obtain precise host vulnerability data while preventing service outages on legacy components. Which of the following scanner configurations and techniques should the analyst implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Utilize credentialed scanning parameters to inspect local software package registries directly on host operating systems.; Configure scan rate throttling and select non-intrusive check modules during the scan execution.

Answer

The analyst should use credentialed scanning to examine internal package registries on hosts directly, while enabling scan rate throttling and non-intrusive checks to safeguard legacy services.
Credentialed scanning provides direct, internal access to host package managers and OS registries, yielding accurate vulnerability identification. Combining credentialed access with scan rate throttling and non-intrusive test modules ensures high detection fidelity while maintaining service stability on sensitive legacy infrastructure.

Step-by-Step Solution

1
Determine the scanning method that provides high host accuracy without relying on proxy responses.
Selecting credentialed scanning allows the scanner to log into target systems and inspect local package manager databases and configurations directly.
Unauthenticated network scans behind a reverse proxy only observe front-end proxy headers, leading to high false-positive rates.
2
Establish operational parameters to protect fragile legacy backend systems.
Enabling scan throttling and non-intrusive vulnerability test modules prevents excessive concurrent traffic and unsafe payload delivery.
Legacy systems are vulnerable to denial-of-service conditions when exposed to high request volumes or intrusive test vectors.

Key Concept

Vulnerability scanning configuration parameters (credentialed vs unauthenticated scanning and intrusive vs non-intrusive test controls)
Estimated Time:1m 30s
Question 271Question →

During a security incident investigation on an enterprise server host, security analysts discover that an attacker exploited a vulnerability within a containerized application process to inject a malicious kernel module. This kernel module allowed the attacker to escape the application environment, gain full root control over the underlying host operating system, and access data across all neighboring tenant applications on that physical node. Which of the following fundamental architectural weaknesses enabled this cross-tenant host compromise, and what control provides the required isolation boundary?

Show answer & explanation

Answer: Containers share the host operating system kernel, meaning a kernel exploit compromises the host; executing workloads inside virtual machines with dedicated guest kernels provides hypervisor-enforced hardware isolation.

Answer

Containers share the host operating system kernel, meaning a kernel exploit compromises the host; executing workloads inside virtual machines with dedicated guest kernels provides hypervisor-enforced hardware isolation.
The correct answer highlights the core architectural difference between containerization and hardware virtualization. Standard containers run as isolated user-space processes on top of a single shared host kernel. If a containerized process successfully executes a kernel exploit or loads a malicious kernel driver, it compromises the shared kernel, granting the attacker host-level access across all co-located containers. Virtual machines prevent this by using a hypervisor (Type 1 or Type 2) to allocate dedicated virtual hardware and separate guest OS kernels for each workload.

Step-by-Step Solution

1
Analyze the incident details
The attacker executed a kernel-level exploit from inside a containerized application to compromise the host OS.
Identifying that the kernel itself was exploited points to shared-kernel architecture as the primary attack vector.
2
Evaluate container vs. virtual machine security boundaries
Containers share the underlying host kernel via namespaces and cgroups, whereas VMs run isolated guest operating systems managed by a hypervisor.
If an attacker achieves arbitrary kernel module loading within a standard container, the shared kernel boundary fails entirely.
3
Determine the effective remediation mechanism
Migrating sensitive multi-tenant workloads to virtual machines (or hypervisor-backed micro-VM runtimes) establishes dedicated kernel boundaries.
Hypervisors abstract physical hardware, isolating memory and execution states so that a guest kernel compromise does not grant access to the hypervisor host or adjacent VMs.

Key Concept

Virtualization vs. Containerization Isolation Boundaries
Estimated Time:2m 0s
Question 272Question →

A security analyst at a municipal emergency dispatch center is investigating a targeted network breach. The adversary gained initial access through compromised supply chain vendor credentials, utilized custom zero-day exploits to maintain persistent access across system reboots, and subtly modified dispatch routing tables without demanding a ransom or exfiltrating data. Threat intelligence reports indicate the threat group operates with state-sponsored backing, high technical sophistication, and extensive financial resources aimed at critical infrastructure disruption. Which of the following threat actor categories best describes the adversary behind this attack?

Show answer & explanation

Answer: Nation-state actor

Answer

Nation-state actor
The correct answer is the nation-state actor because the scenario describes state-sponsored backing, custom zero-day development, high financial resources, and stealthy operational disruption of critical public safety infrastructure without a financial motive.

Step-by-Step Solution

1
Analyze threat actor attributes from the scenario context
Identified high technical sophistication (custom zero-day exploits), state-sponsored funding, supply chain vector, and intent targeted at critical infrastructure disruption rather than financial extortion.
Threat actor categorization depends on aligning observed tactics, techniques, procedures (TTPs), funding level, and primary motivation.
2
Evaluate motivations and capabilities against standard threat actor profiles
Nation-state actors are characterized by advanced persistent threat (APT) capabilities, substantial backing, stealthy persistence, and strategic intent against vital infrastructure.
Differentiating nation-state actors from cybercriminals or hacktivists requires matching resource depth and operational goals.

Key Concept

Threat Actor Types, Attributes, and Motivations
Question 273Question →

A security analyst reviews a vulnerability assessment report for an internal application server host. The report contains the following network service scan snippet:

Host: 192.168.4.15
Port: 1099/TCP
Service: Java JMX RMI
Finding: Remote JMX agent accepting unauthenticated connections. Anonymous users can register MBeans and execute arbitrary code with host system privileges.

Which of the following represents the BEST remediation strategy to address this host vulnerability?

Show answer & explanation

Answer: Enable authentication and TLS transport security on the JMX agent configuration while restricting listener access.

Answer

The best remediation strategy is to enable authentication and TLS transport security directly on the JMX agent configuration and restrict network listener access.
Enabling native authentication and TLS encryption on the JMX agent addresses the vulnerability at its source by requiring valid credentials before any remote management commands or MBean registrations can take place.

Step-by-Step Solution

1
Analyze the vulnerability scan report.
Identified an unauthenticated Java JMX RMI service listening on port 1099/TCP that allows anonymous arbitrary code execution.
Understanding the specific host service vulnerability indicates whether application, protocol, or host configuration changes are needed.
2
Evaluate potential mitigations based on host hardening principles.
Disabling anonymous access and requiring authenticated, encrypted sessions prevents unauthorized invocation of management MBeans.
Host security vulnerabilities caused by insecure default service configurations must be hardened at the service level.
3
Assess alternative control choices for efficacy.
Perimeter firewalls, WAFs, and IDS controls either fail to block internal lateral movement, cannot parse RMI protocols, or merely detect rather than prevent exploitation.
Defense-in-depth requires root-cause host hardening rather than relying solely on secondary or misaligned network controls.

Key Concept

Host Service Hardening and Misconfiguration Remediation
Estimated Time:1m 30s
Question 274Question →

A network security architect is designing an ingress traffic transit flow for an enterprise application processing sensitive financial data. External client traffic must traverse multiple physical and logical security zones to interact with the backend database while enforcing strict North-South and East-West control boundaries. Arrange the following network security architecture traversal steps in the correct sequential order from the initial external inbound packet arrival to the final payload processing at the database host.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of network security traversal from untrusted ingress to the isolated database host is: 1) Edge perimeter router stateless packet filtering/DDoS mitigation, 2) DMZ Web Application Firewall (WAF) Layer 7 inspection and TLS termination, 3) Internal NGFW North-South enforcement into the application tier, 4) Virtual switch microsegmentation governing East-West lateral traffic, and 5) Database proxy/jump gateway identity enforcement entering the isolated database zone.
The correct sequence reflects a defense-in-depth network architecture. Untrusted internet traffic is first filtered statelessly at the edge perimeter router to mitigate volumetric attacks. Next, it reaches the screened subnet (DMZ) where a Web Application Firewall decrypts and inspects application layer traffic. Valid requests then cross the internal North-South firewall boundary into the internal application tier. Within this tier, microsegmentation policies govern East-West lateral communications between microservices. Finally, traffic bound for the sensitive database must authenticate through a database proxy gateway before accessing the isolated backend database VLAN.

Step-by-Step Solution

1
Filter perimeter traffic
Untrusted network traffic is cleaned of volumetric anomalies and malformed packets at the outermost edge.
Perimeter routers block malformed packets and mitigate volumetric threats before deep packet inspection components are overwhelmed.
2
Inspect application payload in DMZ
Public HTTP/HTTPS traffic is terminated, decrypted, and evaluated against Web Application Firewall rules.
Screened subnets (DMZs) isolate public-facing ingress points from internal network infrastructure.
3
Enforce North-South zone boundaries
Approved requests transition from the DMZ to the internal application subnet via an internal NGFW.
Internal firewalls prevent compromised DMZ hosts from directly accessing internal corporate assets without strict layer 3/4 and layer 7 policies.
4
Apply microsegmentation to East-West traffic
Application container and virtual machine lateral traffic is restricted to explicitly allowed service channels.
Microsegmentation enforces Zero Trust within the application tier, mitigating lateral movement if an application node is breached.
5
Authenticate and proxy database requests into the isolated subnet
Queries pass through an authenticated proxy/jump host prior to reaching the restricted database VLAN.
Isolating high-value databases behind dedicated access gateways and isolated VLANs prevents direct network path connectivity from general application zones.

Key Concept

Multi-tier Secure Network Design, Zone Traversal, and Microsegmentation
Question 275Question →

An organization notices that several corporate laptops used by remote employees have failed to apply a critical operating system security patch dispatched by the patch management server. Investigation reveals that the employees continuously opted to defer the required system restart, causing their devices to fall out of compliance with the enterprise security configuration baseline. Which of the following technical controls would most effectively enforce compliance and ensure the required patch installation before granting endpoints access to internal network resources?

Show answer & explanation

Answer: Configure Network Access Control posture assessment policies to isolate non-compliant devices to a remediation network until the update is installed.

Answer

Configure Network Access Control posture assessment policies to isolate non-compliant devices to a remediation network until the update is installed.
Network Access Control (NAC) posture assessment performs pre-admission or continuous checks on connecting devices to verify compliance with configuration baselines (such as installed OS patches and updates). Devices failing posture checks are placed in a quarantined or remediation network segment where required updates can be completed before full network access is granted.

Step-by-Step Solution

1
Analyze the security operational requirement
Identified the core requirement: enforcing patch compliance and reboot completion on non-compliant endpoints before allowing access to network resources.
Remote devices falling behind on security baselines create vulnerable entry points into the enterprise network.
2
Evaluate technical controls for posture evaluation and enforcement
Network Access Control (NAC) posture checking validates patch status, antivirus signatures, and configurations during host connection.
If an endpoint fails the health check (posture assessment), NAC can restrict access or place the device into a quarantined remediation VLAN where patches and restarts are executed automatically.
3
Distinguish between technical enforcement and administrative or misapplied controls
Select the NAC posture assessment control over WAF rules, system rollbacks, or administrative reminders.
NAC provides automated technical enforcement directly aligned with patch management and host configuration baseline compliance.

Key Concept

Endpoint Posture Assessment and Remediation via Network Access Control (NAC)
Estimated Time:1m 30s
Question 276Question →

A security analyst reviewing a Security Information and Event Management (SIEM) log aggregator observes the following consecutive Kerberos event entries generated by internal endpoint `10.0.12.88` within a 90-second time window:

text 2026-07-27T11:02:14Z | EventID: 4769 | TargetUser: [email protected] | ServiceName: MSSQLSvc/sql01.corp.local:1433 | TicketEncryption: 0x17 (RC4-HMAC) | Status: 0x0 2026-07-27T11:02:41Z | EventID: 4769 | TargetUser: [email protected] | ServiceName: BackupSvc/storage01.corp.local | TicketEncryption: 0x17 (RC4-HMAC) | Status: 0x0 2026-07-27T11:03:12Z | EventID: 4769 | TargetUser: [email protected] | ServiceName: HTTP/webserver01.corp.local | TicketEncryption: 0x17 (RC4-HMAC) | Status: 0x0

Based on the log output, which attack technique is taking place, and what correlation rule condition should the analyst configure in the SIEM to detect this activity?

Show answer & explanation

Answer: Kerberoasting; configure a correlation rule that triggers when a single source IP generates multiple Event ID 4769 Ticket Granting Service (TGS) requests requesting RC4 encryption (0x17) for Service Principal Names (SPNs) within a short time threshold.

Answer

Kerberoasting; configure a correlation rule that triggers when a single source IP generates multiple Event ID 4769 Ticket Granting Service (TGS) requests requesting RC4 encryption (0x17) for Service Principal Names (SPNs) within a short time threshold.
The provided log snippet shows multiple Windows Security Event ID 4769 (Kerberos Service Ticket Request) events returning status code 0x0 (Success) within a 90-second window. All requests target service accounts (`svc_*`) with SPNs and explicitly request encryption type `0x17` (RC4-HMAC). This pattern is characteristic of Kerberoasting, an attack where an adversary requests Kerberos service tickets for accounts with SPNs to extract the ticket hashes from memory and attempt offline password cracking. Effective SIEM detection requires creating a correlation rule that flags a single IP or user requesting multiple 4769 events with RC4 (0x17) encryption over a short time threshold.

Step-by-Step Solution

1
Analyze the event codes and fields in the log entries.
Identified Event ID 4769 (A Kerberos service ticket was requested) with successful status 0x0, target users designated as service accounts (`svc_*`), and ticket encryption type 0x17.
Event ID 4769 logs specifically track TGS ticket requests submitted to Domain Controllers for accessing resources bound to Service Principal Names (SPNs).
2
Evaluate the encryption type indicator (`0x17`).
Recognized `0x17` as the cipher identifier for legacy RC4-HMAC encryption in Windows Kerberos implementations.
Attacking tools (such as Rubeus or GetUserSPNs.py) explicitly request RC4 encryption because RC4-HMAC password hashes are significantly faster to crack offline using brute-force tools compared to AES-128/256.
3
Correlate the observed pattern to determine the attack vector and detection strategy.
Rapid sequential TGS requests for multiple service accounts requesting legacy RC4 encryption from a single host indicates a Kerberoasting reconnaissance/extraction phase. A SIEM correlation rule looking for multiple Event ID 4769 events with encryption type 0x17 within a short time frame directly identifies this threat.
Normal enterprise traffic utilizes modern AES encryption for Kerberos tickets unless legacy constraints exist; rapid bursts of RC4-encrypted TGS requests across diverse SPNs are a signature indicator of Kerberoasting.

Key Concept

Kerberoasting Log Analysis and SIEM Correlation Rule Logic
Question 277Question →

A enterprise healthcare provider relies on a software-as-a-service (SaaS) vendor for managing patient scheduling. The vendor provided a SOC 2 Type II attestation report covering the twelve-month period ending September 30. However, the healthcare provider's annual compliance audit occurs on December 31, resulting in a three-month gap between the vendor's audit end date and the healthcare provider's fiscal year end. Which of the following documents should the vendor provide to confirm that no material changes affected the control environment during this gap period?

Show answer & explanation

Answer: A bridge letter signed by vendor management attesting that controls remained effective

Answer

A bridge letter signed by vendor management attesting that controls remained effective
A bridge letter (also called a gap letter) is provided by vendor management to cover the interim period between the end of a SOC audit reporting period and the client's fiscal year end. It confirms that the internal control environment has not undergone material changes and that controls continue to operate effectively.

Step-by-Step Solution

1
Analyze the compliance gap scenario.
Identified a three-month period between the end date of the vendor's SOC 2 Type II report (September 30) and the customer's audit date (December 31).
Auditors require assurance that security controls remained operational throughout the entire fiscal year.
2
Evaluate standard audit mechanisms for handling temporal gaps in third-party attestations.
Determined that commissioning a full new audit for three months is inefficient, whereas a bridge letter fills the gap.
A bridge letter issued by vendor management attests that no material changes occurred in the control environment during the interim period.

Key Concept

Bridge Letters (Gap Letters) in Third-Party Attestation
Estimated Time:1m 15s
Question 278Question →

A financial technology platform operating in North America provides automated payroll processing software to publicly traded enterprise clients. During an internal audit, security team members discover that system administrators can directly modify system logs and executive compensation reporting data without triggering an independent approval workflow or producing an immutable audit record. Which legal or regulatory requirement mandates the implementation of strict internal controls to guarantee the integrity, oversight, and auditability of these financial records?

Show answer & explanation

Answer: Sarbanes-Oxley Act internal control mandates governing accounting record integrity and financial reporting transparency

Answer

Sarbanes-Oxley Act internal control mandates governing accounting record integrity and financial reporting transparency
The correct response identifies the Sarbanes-Oxley Act (SOX). SOX enforces strict internal financial controls, audit trail integrity, and accountability measures for publicly traded entities and their technology service providers to prevent financial fraud and unauthorized manipulation of accounting records.

Step-by-Step Solution

1
Analyze the operational context and affected data type described in the scenario.
The scenario involves executive compensation records and system logs at a payroll software provider serving publicly traded clients.
Identifying the target data type (financial reporting data) eliminates regulations focused purely on healthcare (HIPAA) or consumer privacy (GLBA).
2
Identify the primary deficiency and compliance gap.
System administrators can alter financial records and logs without approval workflows or immutable auditability.
This directly violates statutory requirements for internal accounting controls, segregation of duties, and audit trail integrity.
3
Map the compliance gap to the governing legal statute.
The Sarbanes-Oxley Act (SOX) dictates strict internal control frameworks over financial data reporting for public companies and their technology vendors.
SOX requires verification that financial reports are accurate and protected against unauthorized tampering.

Key Concept

Sarbanes-Oxley Act (SOX) Compliance and Internal Financial Controls
Question 279Question →

An enterprise software company is updating its data governance program following an internal compliance assessment. A senior database administrator has been tasked with configuring database permissions, executing automated daily backups, and applying technical data loss prevention tags. The product management team requests that a key customer telemetry dataset be reclassified from Restricted to Confidential to enable easier integration with an external analytics vendor. Which of the following best describes the correct operational procedure for handling this request?

Show answer & explanation

Answer: The business data owner must evaluate and approve the reclassification request, while the database administrator acts as the data custodian responsible for technical enforcement.

Answer

The business data owner must evaluate and approve the reclassification request, while the database administrator acts as the data custodian responsible for technical enforcement.
In enterprise data governance, the business data owner holds ultimate accountability for defining data classification rules and approving access rights. The database administrator functions as the data custodian, responsible for applying technical safeguards, managing access controls, and maintaining backups under the direction of the data owner.

Step-by-Step Solution

1
Differentiate governance roles between data owner and data custodian.
Identified that the business department head or data owner holds policy authority, whereas technical staff (DBA) fulfill custodian duties.
Data governance frameworks require separation between business accountability and operational management.
2
Evaluate the request to modify data classification levels.
Determined that changing sensitivity from Restricted to Confidential requires formal approval from the data owner.
Reclassifying data affects risk exposure, compliance compliance, and access entitlement rules across the enterprise.
3
Assign technical implementation duties to the data custodian.
The database administrator implements the owner's decision by updating access control lists and enforcement policies.
Custodians execute security controls and maintain data structure based on established governance decisions.

Key Concept

Data Owner vs. Data Custodian Responsibilities
Question 280Question →

An enterprise organization recently deployed a critical application database server equipped with redundant hot-swappable power supplies and a RAID 5 disk array to fulfill a high-availability SLA. Following a malicious script execution, essential database tables were logically corrupted and encrypted. The network administrator confirmed that all hard drives and hardware components remained fully operational with active green status indicators, yet data restoration from the local array was impossible. Which of the following best explains why this high-availability configuration failed to preserve data access, and what control should be implemented?

Show answer & explanation

Answer: RAID provides hardware fault tolerance against disk failures but does not protect against logical corruption; versioned offsite data backups are required.

Answer

The correct answer states that RAID provides hardware fault tolerance against physical disk failures but does not protect against logical corruption, requiring versioned offsite backups to ensure data recovery.
The correct option highlights the fundamental distinction between high-availability fault tolerance and data backup recovery. RAID 5 provides redundancy at the hardware layer, allowing a system to stay online if a physical disk fails. However, because RAID transparently duplicates all write operations, logical corruption or malicious encryption is written across the array instantly. To recover from logical corruption, an organization must maintain independent, versioned backups separated from the live system.

Step-by-Step Solution

1
Analyze the technical requirements and failure condition described in the scenario.
The server's physical disks and power supplies remained functional, but the data itself suffered logical corruption from a malicious script.
Identifying the root cause requires distinguishing between physical hardware component failure and logical data integrity loss.
2
Evaluate the capabilities of the existing redundancy control (RAID 5).
RAID 5 uses disk striping with distributed parity to tolerate the physical failure of a single drive without downtime.
Hardware fault tolerance mechanisms automatically write and mirror all disk operations—including corrupting commands—across all member drives.
3
Determine the optimal missing security control to satisfy business continuity requirements.
Isolated, versioned data backups (such as offsite, immutable, or point-in-time snapshots) allow restoring clean data prior to the corruption incident.
High availability/fault tolerance ensures continuous infrastructure uptime, whereas backups provide data recoverability after logical destruction.

Key Concept

High Availability and Fault Tolerance vs. Data Backup and Recovery
Estimated Time:1m 30s
PreviousPage 14 / 112Next
All practice questions — CompTIA Security+ | Examkin