All practice questions

A healthcare provider is adopting a multi-tenant Software as a Service (SaaS) application to manage patient records across several remote clinics. The security architect must ensure that sensitive patient data transmitted to and from the SaaS application is monitored for policy violations, encrypted in transit, and protected against unauthorized data exfiltration without modifying the underlying cloud provider infrastructure. Which of the following solutions should the security team implement to meet these governance and control requirements?

An organization's security operations center (SOC) detects an ongoing multi-vector attack targeting executive administrative assistants. The adversary uses spoofed Voice over IP (VoIP) calls to impersonate the Chief Financial Officer (CFO), claiming an urgent regulatory filing requires immediate authorization. Simultaneously, target personnel receive SMS messages containing links to a look-alike domain designed to clone the organization's single sign-on (SSO) authentication portal. Which of the following social engineering attack vectors and associated principles of influence are demonstrated in this campaign? (Select TWO).

A Lead DevSecOps Engineer is configuring automated security testing within a continuous integration and continuous deployment (CI/CD) staging environment for a WebAssembly-based microservice application. The company requires a vulnerability assessment solution that evaluates the application while it executes, using embedded software agents within the runtime environment to correlate dynamic runtime behavior with the exact lines of source code causing vulnerabilities, thereby minimizing false positives. Which of the following security testing methods best fulfills these requirements?

During an incident response investigation at a commercial satellite communications control facility, security analysts discover that several ground station modems were flashed with rogue firmware updates. The attackers compromised a third-party hardware vendor's build server nearly a year prior to steal private cryptographic signing keys, allowing the malicious firmware to pass signature validation without triggering alerts. The intrusion targeted long-term collection of orbital telemetry data without altering operational availability or attempting monetary extortion. Which threat actor type and attribute profile is primarily demonstrated in this scenario?

An enterprise security operations center (SOC) detects an incident where remote executive assistants received customized SMS text messages appearing to originate from the corporate IT department. The messages contained links to a credential-harvesting landing page hosted on a typosquatted domain and warned that email access would be permanently suspended within two hours unless password re-verification was completed immediately. Which social engineering attack vector and primary principle of influence were executed in this scenario?

Match each cloud computing service model to the primary architectural boundary managed by the cloud service provider.

Match each infrastructure risk scenario to its corresponding host, network, or architecture vulnerability classification.

Match each vulnerability assessment and security testing method to its corresponding operational characteristic.

Match each technical telemetry scenario with its corresponding malware classification based on the observed indicators of compromise.

Match each threat actor profile to the primary attribute combination and attack strategy that most accurately characterizes their operations.

An enterprise IT security team is implementing a major network security policy update to enforce microsegmentation across production database servers. Place the following change management steps in the correct chronological order from first to last to ensure proper security governance and operational continuity.

An enterprise security architect is establishing an operational governance framework for cloud adoption across multiple business units. Match each security administration task on the left with the primary responsible party under the cloud shared responsibility model on the right.

A security analyst conducts a comprehensive infrastructure security assessment across enterprise systems. Match each security assessment finding to its corresponding host, network, or architecture vulnerability classification.

A security analyst is reviewing telemetry logs and incident report artifacts following a series of network anomalies. Match each observed technical telemetry artifact on the left with its corresponding malware classification on the right.

An organization hosts a customer database in a cloud environment where the cloud provider manages the physical server hardware, data center access, and hypervisor virtualization layer. The organization's internal IT team remains responsible for configuring, updating, and patching the guest operating systems and application software. Which cloud service model is the organization currently using?

An administrator reviewing host infrastructure discovers an unauthenticated monitoring service running on an internal host inside the enterprise network. The service exposes internal environment variables and process memory to any connected endpoint. The service was left unauthenticated under the assumption that internal network segments are inherently secure. Which of the following vulnerabilities is primarily illustrated in this architecture scenario?

Match each enterprise security incident scenario to the primary social engineering attack vector it exemplifies.

An enterprise Endpoint Detection and Response (EDR) agent raises a high-severity security alert on a database server. Inspection reveals a legitimate Windows system process, `svchost.exe`, executing inline PowerShell commands using encoded arguments directly in system memory without writing any executable binaries to disk. System monitoring logs show scheduled tasks calling WMI repositories to maintain execution across system reboots. Which of the following malware classifications is demonstrated by these indicators of compromise?

A security technician is preparing to deploy a new server host into an enterprise network. To reduce common host-based vulnerabilities and strengthen the system's baseline security posture, which of the following hardening actions should the technician implement? (Select TWO).

A financial clearing house experiences a silent, prolonged intrusion where an adversary maintained persistence for nine months without disrupting operations or attempting immediate data exfiltration. Threat intelligence analysts discover custom-compiled memory-only implants, specialized zero-day exploits targeting perimeter security appliances, and detailed reconnaissance focused on critical national infrastructure dependencies. Which of the following threat actor types and attribute profiles most accurately characterizes this adversary?