All practice questions

A security posture assessment identified several vulnerability findings across an enterprise environment. Match each vulnerability finding on the left to its corresponding infrastructure exposure category on the right.

A senior security engineering team is formalizing an enterprise security assessment policy spanning corporate workstations, custom web microservices, software build pipelines, and sensitive industrial control network segments. Match each security testing methodology on the left to the operational execution characteristic on the right that correctly defines its technical application.

A security analyst is performing a comprehensive assessment across an enterprise environment. Match each host, network, or infrastructure vulnerability scenario observed during the assessment to its corresponding vulnerability category.

Match each enterprise technical assessment finding to its primary host, network, or architecture vulnerability classification.

During a comprehensive threat landscape assessment for a global logistics management enterprise, the security operations team identified four distinct threat threat actor profiles active against the organization's ecosystem. Match each threat actor incident profile on the left with its defining combination of attributes, intent, and primary attack vector on the right.

Match each active deception technology component on the left with its corresponding operational implementation function on the right.

An administrator needs to perform a vulnerability scan on internal servers to accurately detect missing software patches without installing host software agents. Which of the following scanning methods should the administrator use?

A security engineer aims to detect unauthorized internal reconnaissance and credential scraping within private source code repositories without provisioning decoy server infrastructure or altering existing network routing. The engineer inserts inactive, traceable API access keys into public test environment files. Any attempt to authenticate using these fake credentials triggers an immediate high-fidelity alert containing the origin IP address and request details. Which of the following deception technologies did the security engineer deploy?

A system administrator discovers that a server in the data center is running an operating system version for which the vendor has permanently discontinued all technical support and security updates. Which of the following host vulnerabilities best describes this situation?

During a proactive security audit of a mission-critical database server, a security engineer compares user-mode system monitoring logs with low-level kernel telemetry. Standard operating system process enumeration APIs display 48 active processes, but a direct memory analysis of kernel structures reveals an additional executive process block (EPROCESS) decoupled from the ActiveProcessLinks doubly linked list. The unlisted process actively hooks system calls to subvert detection. Which of the following malware classifications best describes this threat?

An enterprise security architect is reviewing the security boundaries for a newly deployed application utilizing Function as a Service (FaaS) within a public cloud provider. To ensure governance and compliance, the security team must establish clear operational boundaries under the cloud shared responsibility model. Which of the following management tasks remains the primary responsibility of the customer in this serverless architecture deployment?

A municipal public transit organization discovers that its public announcement website was defaced with political slogans during an election cycle. Incident responders determine that the attacker utilized pre-built exploit scripts downloaded from an open forum, without customizing code or attempting to establish long-term persistence. Which of the following threat actor types is most likely responsible for this incident?

A security analyst at an e-commerce firm discovers unauthorized administrative access on an internal transactional database. Investigation reveals that the intruder gained access by compromising an automated software update pipeline managed by an external service contractor trusted by the organization. Which of the following attack vectors was primarily exploited to achieve initial access?

A security engineer is designing a vulnerability assessment strategy for a legacy medical telemetry network containing sensitive embedded firmware devices that crash when receiving unexpected port probes or high packet volumes. The organization must identify known software vulnerabilities and unauthorized device configuration changes without causing operational downtime or system instability. Which of the following security assessment methods should the engineer implement to meet these requirements?

Forensic examination of an compromised enterprise host reveals anomalous system behavior where administrative utilities fail to display running processes and active network sockets that are visibly present in raw memory captures. Further inspection demonstrates that kernel-level System Service Descriptor Table (SSDT) function pointers have been redirected to execute code in unallocated memory addresses, effectively intercepting and filtering operating system API responses. Which of the following malware classifications is primarily indicated by these technical indicators of compromise?

A financial services organization discovers an unauthorized persistent presence within its internal software build pipeline infrastructure. Analysis shows that the attackers compromised stolen code-signing certificates to sign custom fileless payloads, established covert command-and-control communication using DNS tunneling, and conducted low-and-slow exfiltration of proprietary quantitative trading models over an eight-month period without causing service disruption or demanding a ransom. Which threat actor classification and attribute profile are most consistent with this activity?

A security consultant is evaluating vulnerability assessment strategies for an enterprise hybrid environment that contains both standard server infrastructure and sensitive legacy Operational Technology (OT) systems. The consultant must recommend assessment techniques that accurately identify missing patches and host misconfigurations while minimizing the risk of system instability or network interruption on sensitive legacy segments. Which of the following approaches should the consultant recommend? (Select TWO.)

A university research laboratory discovers that confidential quantum computing project files were accessed by an unauthorized external party. The investigation reveals that a lead researcher had set up an unapproved personal cloud storage folder to easily share files with external colleagues, bypassing university security controls. The external party accessed the folder by running automated public scripts that guessed default administrative credentials on the storage service. Which of the following threat actor attributes and attack vectors are demonstrated in this scenario? (Select TWO.)

A security team is designing a vulnerability assessment and testing strategy for an enterprise hybrid environment hosting critical financial microservices. The team must satisfy two core requirements: first, obtain granular, host-level visibility into operating system patch levels and local security misconfigurations; second, continuously analyze external runtime exposure without injecting active scan traffic that could disrupt live user transactions or impact service availability. Which of the following security assessment methods should the team implement to meet these operational goals? (Select TWO.)

A consortium of regional financial institutions establishes a shared cloud infrastructure to process payment transactions while meeting common regulatory compliance standards. Which of the following characteristics accurately describe this cloud deployment model? (Select TWO.)