Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 301Question →

A security analyst is defining standard testing procedures for an enterprise vulnerability management program. Match each security assessment method to its corresponding operational description.

Click a left item, then click its matching right item

Items

Passive Vulnerability Scanning
Credentialed Vulnerability Scanning
Dynamic Application Security Testing (DAST)
Static Application Security Testing (SAST)

Matches

Show answer & explanation

Answer

Passive Vulnerability Scanning corresponds to monitoring network traffic silently without probes. Credentialed Vulnerability Scanning corresponds to logging into target systems with valid accounts to audit configuration and patches. Dynamic Application Security Testing (DAST) corresponds to testing a running application by sending simulated malicious requests. Static Application Security Testing (SAST) corresponds to analyzing source code or binaries offline without code execution.
Each assessment method is paired according to its execution environment and access model: Passive scanning observes network traffic without active probing; Credentialed scanning uses valid host credentials for accurate internal assessment; DAST tests live applications at runtime; SAST analyzes unexecuted source code or binaries.

Step-by-Step Solution

1
Differentiate network-level scanning approaches (passive vs. credentialed active).
Identify that non-intrusive traffic capture maps to passive scanning, while authenticated endpoint auditing maps to credentialed scanning.
Passive scanning relies on packet sniffing, whereas credentialed scanning logs into host operating systems.
2
Differentiate application security testing techniques (SAST vs. DAST).
Identify that SAST operates on source code/binaries statically before execution, whereas DAST operates dynamically on running web applications.
SAST requires access to code without running it, while DAST evaluates real-time HTTP requests and server responses during execution.

Key Concept

Vulnerability Assessment and Security Testing Methods
Question 302Question →

During a post-incident analysis of an unexpected enterprise database outage, incident responders discover dormant malicious SQL routines embedded within a core payroll application stored procedure. Telemetry reveals that the script continuously queries the human resources database to verify whether a specific administrator account remains marked as active. The code contains logic specifying that if the account status changes to inactive, or if a designated calendar date passes, the routine automatically executes commands to purge database logs and overwrite primary table records. Which of the following malware types is described in this scenario?

Show answer & explanation

Answer: Logic bomb

Answer

Logic bomb
The correct answer is Logic bomb. A logic bomb is malicious code deliberately inserted into a software system that remains dormant until specific conditions are met, such as a date/time threshold, an employee termination event, or a database query output. In this scenario, checking the HR database status flag and trigger dates matches the classic IoCs of a logic bomb.

Step-by-Step Solution

1
Analyze the technical indicators of compromise described in the scenario
Identified dormant code embedded inside a legitimate stored procedure that checks for specific system conditions (account status flag and date threshold).
Understanding the execution mechanism is critical to categorizing malware types.
2
Evaluate the trigger condition and payload behavior
The malicious payload executes automatically only when specific logical criteria are fulfilled.
Code that waits for predefined logical or temporal conditions before executing a malicious payload defines a logic bomb.
3
Differentiate from alternative malware classifications
The threat does not self-replicate over a network (worm), hide as a benign application installer (Trojan), or subvert OS kernel functions to maintain stealth (rootkit).
Proper classification requires eliminating mechanisms that do not match the observed IoCs.

Key Concept

Logic Bomb Indicators of Compromise
Question 303Question →

A system administrator captures network traffic between an application host and a centralized authentication server on an internal network segment:

text
14:22:05.819201 IP 172.16.40.12.51234 > 172.16.40.50.389: Flags [P.], length 88: LDAP
bindRequest(1) "cn=svc_auth,ou=services,dc=internal,dc=net" simple

Which of the following is the BEST mitigation strategy to resolve the infrastructure vulnerability demonstrated in this log snippet?

Show answer & explanation

Answer: Reconfigure the directory service and client application to enforce LDAPS over TCP port 636 or enable STARTTLS.

Answer

Reconfigure the directory service and client application to enforce LDAPS over TCP port 636 or enable STARTTLS.
The packet capture shows an unencrypted LDAP simple bind request over standard TCP port 389. Simple bind sends directory credentials in cleartext. Enforcing LDAPS (which encrypts LDAP traffic over TCP port 636) or upgrading to STARTTLS establishes TLS encryption, protecting credentials from being intercepted by unauthorized network sniffing.

Step-by-Step Solution

1
Analyze the network packet capture snippet to identify the active protocol and port.
The log shows traffic destined for TCP port 389 using the LDAP protocol with a 'simple' bind request.
Port 389 running standard LDAP with simple bind authentication transmits directory credentials in cleartext across the network.
2
Determine the security risk associated with cleartext authentication traffic.
An attacker performing network sniffing on the internal segment can intercept and harvest administrative credentials.
Cleartext protocols violate confidentiality requirements and fail to secure credential transport.
3
Select the appropriate protocol-level remediation control.
Upgrade the transport protocol to LDAP over TLS (LDAPS) on port 636 or mandate TLS session negotiation via STARTTLS on port 389.
Encrypting the directory communication channel secures credentials in transit against network interception.

Key Concept

Host and Network Infrastructure Vulnerabilities - Unencrypted Legacy Protocols
Estimated Time:1m 30s
Question 304Question →

During an infrastructure security review of a high-frequency financial transaction processing service, security operations observed that active credentialed vulnerability scanning triggered service account lockouts and unacceptable latency spikes on production database nodes. The engineering team requires an assessment approach that identifies software security flaws and system configuration weaknesses without initiating active network probes, modifying authentication states, or disrupting live operations. Which security testing methodology best addresses these operational constraints?

Show answer & explanation

Answer: Deploy passive network traffic monitoring alongside offline static application security testing (SAST) of codebase repositories.

Answer

Implementing passive network traffic monitoring combined with offline static application security testing (SAST) provides comprehensive vulnerability visibility without sending active network probes, causing latency spikes, or triggering account lockouts on production services.
Combining passive network monitoring with static application security testing (SAST) provides effective vulnerability identification while adhering to strict non-intrusive operational boundaries. Passive scanning inspects network traffic out-of-band without injecting packets or performing authentication attempts, eliminating account lockouts and server latency. SAST inspects source code directly without requiring execution in a live production environment.

Step-by-Step Solution

1
Analyze operational constraints
Identified strict requirements: no active probing, no account state modifications, no latency spikes, and zero disruption to live database nodes.
Active credentialed vulnerability scans currently cause production degradation and lockouts.
2
Evaluate testing methodologies against non-intrusive requirements
Passive network monitoring observes packet headers and signatures via SPAN/TAP ports without generating traffic, while SAST analyzes application logic offline.
Both techniques operate out-of-band and introduce zero overhead to live database processes.
3
Differentiate correct methodology from unsuitable assessment and defense controls
Active fuzzing, inline deception technologies, and network firewalls either fail to assess flaws or actively disrupt live services.
Only non-intrusive passive monitoring paired with static analysis fulfills both flaw identification and operational uptime requirements.

Key Concept

Passive Vulnerability Assessment and Static Testing Methods
Question 305Question →

During an emergency response to a critical zero-day remote code execution vulnerability on an enterprise edge gateway, an administrator bypassed standard Change Advisory Board (CAB) review and applied an emergency patch directly to production systems. Within minutes of application, critical external API endpoints began returning persistent HTTP 500 errors, causing high-priority business service outages. To handle this ongoing operational disruption while adhering to formal change management frameworks, which of the following actions should the security operations team take FIRST?

Show answer & explanation

Answer: Execute the pre-approved emergency rollback plan to restore the last known stable configuration while recording the security impact.

Answer

Execute the pre-approved emergency rollback plan to restore the last known stable configuration while recording the security impact.
The primary objective of change management during a failed emergency deployment is to rapidly minimize business disruption while maintaining security integrity. Executing a documented, pre-approved rollback plan restores the system to a known good baseline state and ensures the security impact is recorded for subsequent review by the Change Advisory Board (CAB).

Step-by-Step Solution

1
Analyze the operational impact of the emergency change
Identified that an unvetted emergency change caused active service degradation across production APIs
Emergency changes carry inherent risk of unexpected operational side effects if not thoroughly tested
2
Select the appropriate change control response procedure
Identified the emergency rollback plan as the immediate prioritized action
Standard change management governance dictates using documented, pre-tested rollback plans to restore baseline operations immediately when a deployment destabilizes production environments
3
Initiate post-implementation security analysis
Captured audit logs and documented security impacts for subsequent CAB review
Even emergency changes and rollbacks require thorough documentation and security impact assessments to refine future change workflows

Key Concept

Emergency Change Control and Rollback Execution
Question 306Question →

A security analyst reviews a network packet capture taken from an internal segment connecting an administrative system to an embedded host management interface. The packet capture reveals the following HTTP request:

GET /api/v1/system/status?session_token=9f8e7d6c5b4a3210 HTTP/1.1
Host: 10.20.30.50:8080
User-Agent: EnterpriseAdminConsole/3.4
Accept: */*

A subsequent vulnerability assessment confirms that the embedded host management server lacks Transport Layer Security (TLS) support and processes cleartext HTTP requests. Which of the following represents the primary host and network vulnerability exposed in this scenario?

Show answer & explanation

Answer: Unencrypted transmission of sensitive session tokens combined with credential exposure in URI query parameters

Answer

The primary vulnerability is the unencrypted transmission of sensitive session tokens over cleartext HTTP combined with credential exposure in URI query parameters.
The correct answer accurately identifies the root vulnerability shown in the packet capture: transmitting sensitive session tokens across an unencrypted transport layer (HTTP over TCP/8080) while simultaneously exposing those tokens inside the URI query string where they can be intercepted or logged.

Step-by-Step Solution

1
Analyze the log snippet and host configuration.
The HTTP GET request reveals `session_token=9f8e7d6c5b4a3210` passed directly in the URL over plain HTTP (port 8080) without TLS encryption.
Cleartext transport allows network eavesdropping (man-in-the-middle attacks), while URI query parameters are regularly recorded in access logs, referrer headers, and browser histories.
2
Identify the underlying host and network vulnerability.
The combination of cleartext protocol usage and insecure credential placement in the request line exposes sensitive authentication tokens.
Host services accepting plain HTTP for administrative actions expose credentials and session integrity to network-level interception.
3
Evaluate candidate answer choices against the observed vulnerability.
The choice identifying unencrypted transmission and URI query token exposure directly accurately pinpoints the root cause.
Other choices either confuse architectural design assumptions (Zero Trust reliance), misclassify web application attack vectors (XSS), or propose ineffective boundary mitigations.

Key Concept

Host and Network Infrastructure Vulnerabilities - Cleartext Protocols and Insecure Data Transmission
Question 307Question →

An organization is conducting a baseline security audit of its internal servers and infrastructure. Match each identified host or architecture vulnerability on the left with its corresponding primary risk on the right.

Click a left item, then click its matching right item

Items

Legacy / End-of-Life Operating System
Open Unnecessary Network Ports
Default Factory Credentials
Unquoted Windows Service Path

Matches

Show answer & explanation

Answer

Legacy / End-of-Life Operating System pairs with absence of vendor security patches; Open Unnecessary Network Ports pairs with unintended expansion of the system attack surface; Default Factory Credentials pairs with high susceptibility to initial unauthorized access using publicly known passwords; Unquoted Windows Service Path pairs with potential for local privilege escalation.
Each host and infrastructure vulnerability directly correlates to its primary risk: unsupported operating systems suffer from a lack of vendor security patches, open ports expand the host network attack surface, default credentials enable trivial authentication bypass, and unquoted service paths enable local privilege escalation.

Step-by-Step Solution

1
Analyze each host and network architecture vulnerability term.
Identify the distinct risk vector introduced by each misconfiguration or unsupported system state.
Host vulnerabilities stem from unpatched software, excessive running services, weak authentication defaults, or file path misconfigurations.
2
Match each vulnerability directly to its primary security consequence.
EOL software corresponds to missing vendor patches; open listening ports correspond to expanded attack surface; default passwords correspond to unauthorized credential access; unquoted service paths correspond to local privilege escalation.
Aligning specific host vulnerabilities with their corresponding exploit mechanics allows proper risk assessment and remediation prioritization.

Key Concept

Host, Network, and Architecture Vulnerabilities
Question 308Question →

Match each threat actor category with its defining attribute or primary motivation.

Click a left item, then click its matching right item

Items

Nation-State Actor
Hacktivist
Insider Threat
Script Kiddie

Matches

Show answer & explanation

Answer

Nation-State Actor matches with highly sophisticated, extensively funded, and focused on long-term geopolitical espionage; Hacktivist matches with driven by political, social, or ideological goals; Insider Threat matches with possesses legitimate, authorized access; Script Kiddie matches with unskilled individual who executes pre-made automated tools.
Nation-state actors are backed by sovereign government resources focused on covert espionage. Hacktivists carry out disruption or defacement for ideological reasons. Insider threats leverage authorized internal privileges. Script kiddies rely on automated exploit kits due to limited personal coding capability.

Step-by-Step Solution

1
Analyze the primary attributes, resources, and motivations that define each threat actor category.
Identified nation-state actors by state resources/espionage, hacktivists by political intent, insiders by legitimate credentials/access, and script kiddies by lack of technical sophistication.
CompTIA Security+ distinguishes threat actors based on sophistication, funding, intent, and access.
2
Pair each threat actor on the left with its corresponding description on the right.
All four threat actor types are accurately paired with their core defining traits.
Validates proper classification against standard threat intelligence taxonomy.

Key Concept

Threat Actor Types and Attributes
Question 309Question →

Match each malware classification to its primary characteristic or technical indicator.

Click a left item, then click its matching right item

Items

Ransomware
Keylogger
Logic Bomb
Rootkit

Matches

Show answer & explanation

Answer

Ransomware matches with encrypting target system data for payment; Keylogger matches with capturing user keystrokes; Logic Bomb matches with lying dormant until specific trigger conditions occur; Rootkit matches with operating at a deep system level to hide unauthorized processes.
Each malware term correctly maps to its defining characteristics: Ransomware locks files for payment, Keyloggers capture keystroke data, Logic Bombs detonate under preset conditions, and Rootkits manipulate operating system routines to evade detection.

Step-by-Step Solution

1
Analyze each malware type on the left
Identified Ransomware, Keylogger, Logic Bomb, and Rootkit.
Each malware type exhibits distinct behavior and indicators of compromise.
2
Map each malware category to its corresponding operational mechanism
Ransomware locks/encrypts files for extortion; Keylogger intercepts keystrokes; Logic Bomb triggers on condition; Rootkit hides deeply within the OS.
Matching technical behaviors to malware definitions provides clear identification during incident analysis.

Key Concept

Malware Types and Indicators of Compromise
Question 310Question →

A security operations team is implementing an active defense strategy across a enterprise network to detect lateral movement and credential theft. Match each deception technology implementation on the left with its corresponding active defense classification on the right.

Click a left item, then click its matching right item

Items

Injecting fake database connection strings into endpoint memory to alert security teams when dumped by malware
Deploying an interconnected subnet of intentionally vulnerable virtual machines simulating a corporate Active Directory infrastructure
Placing an attractive financial audit spreadsheet on a shared network drive embedded with an invisible phone-home beacon
Adding false DNS records and browser history entries to endpoint hosts to steer network scanners toward a monitoring gateway

Matches

Show answer & explanation

Answer

Matching pairs: Endpoint memory strings -> Honeytoken; Interconnected virtual subnet -> Honeynet; Financial audit spreadsheet -> Honeyfile; False DNS records and browser entries -> Breadcrumb.
Each deception technology fulfills a distinct operational role in active defense strategy. Honeytokens are data-level artifacts such as fake keys or connection strings. Honeynets provide comprehensive, multi-system network decoys to observe attacker behavior. Honeyfiles rely on fake documents containing tracking mechanisms. Breadcrumbs consist of host artifacts configured on active production systems to guide threat actors into deceptive environments.

Step-by-Step Solution

1
Analyze each deception deployment scenario by evaluating its deployment layer (data, host, document, network).
Identified specific active defense controls based on structural characteristics.
Deception technologies are classified by whether they represent network segments, decoy files, isolated data elements, or directional lures.
2
Differentiate between host-level directional lures and standalone digital tokens.
Paired endpoint memory injection with honeytoken and false DNS/browser history entries with breadcrumb.
Honeytokens are passive digital data traps, whereas breadcrumbs are directional artifacts specifically placed on legitimate host endpoints to lure attackers away from real assets.
3
Differentiate between decoy files and multi-system infrastructure decoys.
Paired the beaconed spreadsheet with honeyfile and the simulated AD subnet with honeynet.
A honeyfile is a single deceptive data container, whereas a honeynet comprises multiple decoy systems operating together.

Key Concept

Deception and Disruption Technologies
Question 311Question →

A enterprise security operation center (SOC) analyst is categorizing threat actors and attack vectors identified during a comprehensive threat landscape assessment. Match each threat actor type or attack vector on the left with its primary operational attribute or delivery mechanism on the right.

Click a left item, then click its matching right item

Items

Shadow IT
Advanced Persistent Threat (APT)
Software Supply Chain Attack
Insider Threat

Matches

Show answer & explanation

Answer

Shadow IT matches with introducing unapproved software/hardware without IT oversight. Advanced Persistent Threat (APT) matches with high resource capability, stealth, and geopolitical motivations. Software Supply Chain Attack matches with injecting malicious code into trusted third-party updates. Insider Threat matches with leveraging legitimate access rights to exfiltrate data.
Shadow IT is characterized by unauthorized applications or services deployed without IT department knowledge or approval. An APT (Advanced Persistent Threat) is characterized by nation-state funding, extreme sophistication, and persistent stealthy intelligence gathering. A Software Supply Chain attack compromises trusted vendor software build systems to push malicious code into updates. An Insider Threat relies on legitimate access rights granted to an employee, contractor, or partner to bypass perimeter controls.

Step-by-Step Solution

1
Analyze threat actor profiles and operational attributes.
Differentiate nation-state actors (APTs) driven by geopolitical goals from internal personnel (insider threats) possessing authorized credentials.
Threat actors are categorized by funding, sophistication, intent, and access levels.
2
Evaluate attack vector mechanisms.
Distinguish between third-party software supply chain distribution mechanisms and internal deployment of unauthorized infrastructure (Shadow IT).
Vectors specify how access is initially gained or expanded within an target infrastructure.
3
Align each left-side concept with its definitive right-side attribute.
Pair Shadow IT to unapproved systems, APT to nation-state stealth/resources, Supply Chain to compromised upstream software updates, and Insider Threat to legitimate privilege misuse.
Matches align directly with CompTIA Security+ threat taxonomy definitions.

Key Concept

Threat Actor Attributes and Attack Vector Characteristics
Question 312Question →

Match each organizational security management requirement to the cloud service model where the customer retains primary operational responsibility for implementing that control.

Click a left item, then click its matching right item

Items

Configuring guest operating system firewall rules and applying OS security patches on virtual machine instances.
Managing application source code security and configuring database user authorization schemas in a managed database environment.
Configuring user access permissions, multi-factor authentication policies, and data classification tags within a hosted enterprise email service.
Writing stateless function code and configuring execution trigger bindings without managing container runtimes or underlying OS hosts.

Matches

Show answer & explanation

Answer

Under the cloud shared responsibility model: OS patching and host firewall configuration fall under Infrastructure as a Service (IaaS); application code and database schema management fall under Platform as a Service (PaaS); identity governance, access policies, and data classification in hosted applications fall under Software as a Service (SaaS); and stateless function logic with trigger permissions falls under Function as a Service (FaaS / Serverless).
Each deployment model dictates a different division of security controls between cloud service providers (CSPs) and enterprise tenants according to the cloud shared responsibility framework. Moving from IaaS to PaaS, SaaS, and FaaS progressively shifts infrastructure, OS, and runtime platform operational duties to the provider, while data governance and identity authorization remain customer responsibilities across all service models.

Step-by-Step Solution

1
Analyze the scope of responsibility for guest operating systems and network firewalls.
Identify that managing OS patches and guest firewalls requires access at the OS abstraction layer, placing responsibility on the customer in IaaS.
IaaS provides raw compute resources where the provider handles physical and hypervisor layers, leaving OS administration to the tenant.
2
Evaluate the management boundary for database schema configurations and application code on managed platforms.
Determine that application logic and database schema permissions fall under PaaS customer responsibilities.
PaaS abstracts the underlying OS and database engine maintenance, allowing customers to focus on custom code and data schema security.
3
Assess enterprise user access control and data classification in hosted email applications.
Map hosted end-user application identity and data access controls to SaaS.
SaaS providers manage the entire application infrastructure, leaving only data access, identity management, and endpoint security to the customer.
4
Identify event-driven stateless function execution security responsibilities.
Match function logic and trigger configurations to FaaS / Serverless.
FaaS eliminates container and server administration for the customer, isolating their responsibility to the uploaded code and trigger events.

Key Concept

Cloud Shared Responsibility Model Across Service Delivery Models
Question 313Question →

An incident response team investigating a breach at a regional cloud healthcare provider discovers that infrastructure automation scripts were modified to disable TLS verification across internal microservices. Forensic analysis shows the modification was performed using an active API token originally issued to a former system Administrator who recently left the organization on poor terms. Although the connection originated from an anonymized VPN node commonly associated with political hacktivist campaigns, no external software vulnerabilities or social engineering attacks were involved. Which threat actor type and attack vector combination primary characterizes this incident?

Show answer & explanation

Answer: Insider threat utilizing a direct credential access vector

Answer

An insider threat utilizing a direct credential access vector best characterizes the incident.
An insider threat includes current or former employees who retain authentic credentials or possess inside knowledge of infrastructure operations. Because the attack utilized legitimate API keys previously assigned to an offboarded administrator, the primary threat actor classification is an insider threat, and the attack vector is direct credential abuse.

Step-by-Step Solution

1
Analyze the threat actor attributes
The perpetrator is a former employee possessing inside knowledge and pre-existing valid access keys.
Threat actors with current or retained authorized access fall under the insider threat classification, regardless of post-employment political affiliations or routing proxies.
2
Analyze the attack vector
The intrusion relied on valid API tokens directly authenticating to administrative services.
Direct credential access via orphaned or un-revoked keys constitutes a direct administrative vector rather than social engineering, malware, or exploit-based vectors.

Key Concept

Threat Actor Classification and Attack Vector Identification
Estimated Time:2m 30s
Question 314Question →

A security analyst investigates an alert on an infected corporate workstation. Endpoint telemetry shows that a user executed a file disguised as a legitimate printer driver update. Immediately after execution, the process initiated automated network probes on port 445 (SMB) to spread to adjacent unpatched systems without further user intervention. Which of the following malware classifications or behaviors are demonstrated in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Trojan, because the malicious payload relied on tricking the user by masquerading as a legitimate update; Worm, because the malicious process automatically scans the local network to self-replicate across vulnerable hosts

Answer

The scenario demonstrates both Trojan malware delivery (masquerading as a legitimate printer driver update) and Worm self-propagation (automatically probing SMB port 445 to spread across network systems).
The scenario highlights two distinct malware traits: masquerading as benign software (printer driver update), which defines a Trojan, and active, automated network propagation via SMB port 445 to infect adjacent hosts, which defines a Worm.

Step-by-Step Solution

1
Analyze the initial execution mechanism described in the telemetry.
The file was presented as a valid printer driver update to trick the user into executing it, which is the defining characteristic of a Trojan.
Trojans rely on social engineering and deceptive appearances rather than self-replication for initial entry.
2
Analyze the secondary payload behavior following execution.
The process automatically probed SMB port 445 to spread to neighboring machines without requiring additional user actions, which defines a Worm.
Worms are self-propagating malware that leverage network vulnerabilities to spread independently.

Key Concept

Distinguishing malware primary infection vectors (Trojans masquerading as legitimate files) from propagation mechanisms (Worms self-replicating over network ports).
Question 315Question →

A security technician is planning a vulnerability assessment for an enterprise segment that includes legacy operational technology (OT) devices highly sensitive to unexpected network traffic. The technician decides to implement passive vulnerability scanning rather than active scanning. Which TWO of the following statements correctly describe the primary characteristics of passive vulnerability scanning? (Select TWO)

Select all that apply

Show answer & explanation

Answer: It inspects captured network traffic packets in real time without sending active diagnostic probes to host systems.; It significantly reduces the risk of causing service disruption or unexpected system crashes on fragile operational endpoints.

Answer

Passive vulnerability scanning inspects existing network traffic packets in real time without transmitting active probes, which significantly reduces the risk of service disruption on sensitive operational systems.
Passive vulnerability scanning operates non-intrusively by sniffing and analyzing network traffic as it traverses the wire. It identifies hosts, protocols, and vulnerabilities based on packet characteristics without generating probe traffic, thereby preserving uptime on fragile endpoints.

Step-by-Step Solution

1
Analyze the scenario constraints and requirements
The target environment contains sensitive legacy devices where active scanning probes might cause crashes or service interruptions.
Selecting passive vulnerability scanning ensures that network assets are assessed without receiving direct network probes.
2
Identify key operational features of passive vulnerability scanning
Passive scanners observe network traffic passively (via SPAN/TAP ports) to identify host operating systems, running services, and known vulnerabilities.
This non-intrusive approach collects vulnerability data from ongoing network communications while eliminating disruption risk.

Key Concept

Passive Vulnerability Assessment Methods
Question 316Question →

An IT technician is auditing an organization's legacy infrastructure to identify host and network vulnerabilities. Which TWO of the following technical conditions represent significant network or host architecture vulnerabilities that could allow unauthorized access or credential exposure? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Using cleartext management protocols such as Telnet and HTTP for system administration; Running unpatched end-of-life firmware on perimeter routers with known remote code execution flaws

Answer

Using cleartext management protocols (such as Telnet and HTTP) and running unpatched end-of-life firmware on perimeter routers represent significant host and network architecture vulnerabilities.
Cleartext protocols (such as Telnet and HTTP) transmit sensitive authentication credentials unencrypted across the network, enabling passive sniffing attacks. Additionally, unpatched end-of-life router firmware leaves known remote code execution vulnerabilities unmitigated, allowing remote exploitation.

Step-by-Step Solution

1
Analyze each option to determine if it represents a vulnerability or a defensive security control.
Identified cleartext protocols and unpatched router firmware as vulnerable security weaknesses.
Cleartext protocols expose network data to interception, and unpatched firmware provides known exploit paths for attackers.
2
Differentiate defensive controls from infrastructure security weaknesses.
Confirmed firewall filtering, WPA3 wireless encryption, and Zero Trust microsegmentation are security controls, not vulnerabilities.
These controls mitigate threats and protect architecture rather than exposing systems to risk.

Key Concept

Host, Network, and Architecture Vulnerabilities
Question 317Question →

A security analyst evaluates an operational technology (OT) network segment and captures the following service enumeration and vulnerability assessment report for an embedded field controller:

Nmap scan report for 192.168.50.14 (HVAC Controller)
PORT STATE SERVICE VERSION
161/udp open snmp SNMPv1 (public community string enabled)
22/tcp open ssh OpenSSH 4.3 (Linux kernel 2.6.18 - vendor status: End-of-Life)
Host Assessment Alert: Kernel memory corruption vulnerability identified (No vendor patch available).

Based on the report, which of the following specific host and network vulnerabilities are directly present on this controller? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Transmission of cleartext management traffic across the network using an insecure protocol version; Presence of unsupported end-of-life (EOL) operating software that receives no official vendor security patches

Answer

The host and network vulnerabilities directly present are the transmission of cleartext management traffic using an insecure protocol version (SNMPv1) and the presence of unsupported end-of-life (EOL) operating software.
The scan report explicitly documents two distinct flaws: 1) SNMPv1 running on port 161/udp, which is a legacy protocol that transmits management traffic and community strings in unencrypted cleartext; and 2) a Linux 2.6.18 kernel marked as End-of-Life (EOL), indicating that the operating system vendor no longer provides security patches for discovered host memory corruption vulnerabilities.

Step-by-Step Solution

1
Analyze the service enumeration for port 161/udp.
Identified SNMPv1 running with a default public community string, which lacks cryptographic encryption and authentication capabilities.
SNMPv1 transmits community strings and data in cleartext, exposing management information to network sniffing.
2
Analyze the host operating system status from the vulnerability alert and SSH service version.
Identified Linux kernel 2.6.18 designated as End-of-Life with unpatched memory corruption issues.
EOL systems no longer receive security updates from vendors, leaving known host vulnerabilities permanently unpatched.
3
Evaluate distractors against empirical log data.
Eliminated web vulnerability mismatches, control type misclassifications, and non-log-supported network architectural assumptions.
Distractors refer to unrelated web attacks or security control definitions not substantiated by the provided scan output.

Key Concept

Host and Network Vulnerability Identification
Question 318Question →

A cybersecurity team is establishing security testing procedures across various stages of an enterprise application lifecycle and infrastructure deployment. Match each security testing method on the left with its corresponding operational characteristic or execution scenario on the right.

Click a left item, then click its matching right item

Items

Static Application Security Testing (SAST)
Dynamic Application Security Testing (DAST)
Credentialed Vulnerability Scanning
Passive Network Vulnerability Scanning

Matches

Show answer & explanation

Answer

Static Application Security Testing (SAST) pairs with inspecting source code at rest without execution. Dynamic Application Security Testing (DAST) pairs with testing live running applications from an external perspective. Credentialed Vulnerability Scanning pairs with using local system authentication rights to inventory patch levels. Passive Network Vulnerability Scanning pairs with non-intrusive traffic monitoring via SPAN or TAP interfaces.
Each testing method is paired with its defining operational characteristic: SAST analyzes unexecuted source code; DAST tests active applications dynamically; credentialed scanning authenticates locally to check internal patch levels; passive scanning sniffs network traffic non-intrusively without generating network probes.

Step-by-Step Solution

1
Differentiate between static and dynamic application security testing approaches.
SAST operates on non-running source code or binaries early in the SDLC, whereas DAST requires a live running application to simulate runtime attacks.
SAST is a white-box code inspection technique, whereas DAST is a black-box runtime evaluation technique.
2
Differentiate between credentialed active scanning and passive network monitoring.
Credentialed scanning logs directly into operating systems to evaluate configuration state, while passive scanning observes packet flows via network TAPs/SPAN ports without sending traffic.
Credentialed scans minimize false positives by accessing internal host details, whereas passive scans avoid disrupting sensitive operational networks.

Key Concept

Vulnerability Assessment and Security Testing Methods
Estimated Time:2m 0s
Question 319Question →

System telemetry and forensic logs from four compromised endpoints within an enterprise environment reveal distinct technical indicators of compromise (IoCs). Match each observed technical indicator on the left with its correct malware classification on the right.

Click a left item, then click its matching right item

Items

An automated database trigger configured to execute a destructive `DROP TABLE` command if a specific payroll user ID remains inactive in the user directory for 30 consecutive days.
An unpatched server generating widespread lateral SMB scan traffic across adjacent subnets and autonomously executing remote exploit payloads on vulnerable endpoints without credential access or human intervention.
An obfuscated PowerShell script retrieved directly from a persistent registry binary blob and executed strictly inside legitimate system memory (`svchost.exe`) without staging binary files to disk.
A customized system driver executing at privilege level Ring 0 that alters Direct Kernel Object Manipulation (DKOM) structures to suppress specific running process IDs from Task Manager and system auditing utilities.

Matches

Show answer & explanation

Answer

The database trigger condition matches Logic Bomb; autonomous network SMB scanning matches Network Worm; script execution from registry to memory matches Memory-Resident Payload; kernel driver manipulation of process structures matches Kernel Rootkit.
Each indicator uniquely aligns with key malware behaviors: time/event triggers correspond to logic bombs; automated subnet propagation corresponds to worms; in-memory non-disk script execution corresponds to memory-resident payloads; and kernel-level object manipulation (DKOM) to mask processes corresponds to rootkits.

Step-by-Step Solution

1
Analyze the condition-based database trigger indicator.
Identified a dormant malicious script tied to user account status.
Code designed to initiate destructive actions upon specific logical triggers is classified as a logic bomb.
2
Analyze autonomous subnet scanning and SMB payload delivery.
Identified self-propagating network behavior without user interaction.
Malware capable of autonomous replication across network services is classified as a network worm.
3
Analyze in-memory execution via PowerShell and registry binary storage.
Identified complete avoidance of physical binary file storage on host disks.
Malware executing directly within volatile memory and using non-standard file system locations to avoid disk detection is memory-resident/fileless malware.
4
Analyze kernel-level modification (Ring 0 / DKOM) suppressing process visibility.
Identified low-level operating system hooks designed to mask malicious processes from administrative tools.
Software operating with kernel privileges to conceal system artifacts and maintain root access is classified as a rootkit.

Key Concept

Malware Types and Technical Indicators of Compromise
Estimated Time:2m 0s
Question 320Question →

A security analyst is performing host and network triage following a security incident. Match each technical indicator of compromise (IoC) artifact to the correct malware classification.

Click a left item, then click its matching right item

Items

Outbound encrypted command traffic on port 443 originating from an executable launched out of `C:\Users\Public\Downloads\` paired with active reverse RDP tunneling.
Modifications to the Master Boot Record (MBR) executed prior to OS kernel initialization, hiding underlying system process structures from API calls.
An embedded SQL database trigger scheduled to automatically overwrite financial records when an employee ID is removed from the active personnel table.
Unscheduled mass file renaming to `.locked` extensions accompanied by rapid CPU utilization spikes and symmetrical encryption key generation in memory.

Matches

Show answer & explanation

Answer

The telemetry artifacts match their malware classifications as follows: Unauthorized interactive connection and tunneling from abnormal paths corresponds to Remote Access Trojan; pre-boot environment modification and cloaking corresponds to Bootkit; event-triggered malicious database operations correspond to Logic Bomb; and automated bulk file encryption corresponds to Ransomware.
Each artifact presents unambiguous indicators of distinct malware categories: execution from user-writable directories establishing interactive tunnels points to a Remote Access Trojan; pre-kernel boot sector modifications define a Bootkit; condition-triggered malicious database logic represents a Logic Bomb; and automated mass file encryption with appended extensions defines Ransomware.

Step-by-Step Solution

1
Analyze the technical indicators present in each host/network artifact.
Identified four distinct behavior profiles: interactive command tunneling, pre-OS boot sector modification, conditional database trigger, and rapid file payload encryption.
Technical indicators of compromise reveal the operational objectives and execution phases of distinct malware families.
2
Correlate each operational profile to standard malware taxonomy definitions.
Mapped interactive remote access indicators to RAT, MBR hooks to Bootkit, condition-based execution to Logic Bomb, and mass file encryption to Ransomware.
Accurate categorization enables targeted containment and eradication during incident response triage.

Key Concept

Malware Classifications and Technical Indicators of Compromise (IoC)
PreviousPage 16 / 112Next
All practice questions — CompTIA Security+ | Examkin