Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 481Question →

A security team needs to perform continuous vulnerability assessment on legacy enterprise servers that are prone to crashing when subjected to heavy network port probes. The solution must accurately detect missing operating system patches and misconfigurations without generating extra network traffic or risking application instability. Which of the following security assessment methods should the team implement?

Show answer & explanation

Answer: Deploying host-based vulnerability assessment agents directly on the legacy servers

Answer

Deploying host-based vulnerability assessment agents directly on the legacy servers is the most appropriate method.
Host-based vulnerability agents execute directly within the target operating system. They evaluate system files, installed patches, and configurations locally without transmitting probe traffic across the network, ensuring complete vulnerability visibility while preventing accidental crashes of fragile legacy services.

Step-by-Step Solution

1
Analyze the operational constraints of the target environment.
Identified key constraints: fragile legacy servers that crash under network probes, requirement for low network overhead, and need for accurate patch detection.
Selecting an effective vulnerability assessment technique requires matching scanning methods to host stability and network impact constraints.
2
Compare host-based agent architecture with network-based scanning methods.
Host-based agents inspect installed packages, OS build numbers, and registry settings locally, bypassing network probe traffic entirely.
Agent-based scanning eliminates network transmission overhead and prevents service disruption on sensitive hosts.

Key Concept

Host-based Vulnerability Assessment Agents vs. Network-based Scans
Question 482Question →

An organization is updating its cloud-native architecture for a healthcare portal processing Sensitive Personal Health Information (PHI). The security architecture team must enforce strict isolation between individual microservices to prevent lateral movement, continuously authenticate every service-to-service communication path, and inspect East-West traffic without relying solely on perimeter boundary firewalls. Which of the following network architecture strategies best satisfies these requirements?

Show answer & explanation

Answer: Implement microsegmentation using a Service Mesh architecture enforcing mutual TLS (mTLS) and dynamic identity-based network policies.

Answer

Implementing microsegmentation using a Service Mesh architecture enforcing mutual TLS (mTLS) and dynamic identity-based network policies.
Microsegmentation divides cloud environments into distinct security segments down to the individual workload level. Using a Service Mesh with mTLS ensures cryptographic identity verification and encrypted session enforcement for all East-West microservice traffic, aligning with Zero Trust secure network design principles.

Step-by-Step Solution

1
Analyze the architectural requirements
Identified the need for granular service-to-service isolation (East-West control), continuous identity verification, and prevention of lateral movement within cloud microservices.
Traditional perimeter firewalls cannot inspect microservice-to-microservice traffic efficiently or enforce identity-based access control.
2
Evaluate segmentation strategies for cloud-native microservices
Microsegmentation using a Service Mesh decouples security policies from network topology, enforcing cryptographic identity via mTLS and zero trust access rules at layer 7.
This guarantees granular isolation without relying on implicit perimeter trust.
3
Differentiate from incorrect legacy architecture controls
Eliminated broad VLAN perimeter placement, air-gapping operational microservices, and passive detective sensors.
Perimeter reliance allows unchecked lateral movement, air gaps break cloud microservice functionality, and passive NIPS cannot actively block inline traffic.

Key Concept

Microsegmentation and Zero Trust Architecture in Network Design
Estimated Time:2m 0s
Question 483Question →

During a security assessment of a critical server, anomalous network connections are observed originating from a system process. Standard endpoint detection tools running on the native operating system report no suspicious processes or modified system binaries. However, when inspecting the host via an offline forensic image, an unauthorized kernel driver is discovered that hooks system calls to hide its running processes and network sockets from native operating system APIs. Which of the following malware types best describes this behavior?

Show answer & explanation

Answer: Rootkit

Answer

Rootkit
The correct answer is Rootkit because rootkits operate at a deep system level (often kernel-mode) and modify or hook operating system API calls, effectively cloaking processes, open ports, and files from local administration and antivirus utilities.

Step-by-Step Solution

1
Analyze the observed indicators of compromise
Identified anomalous network traffic that is invisible to security monitoring software running within the active host operating system.
Security tools relying on native OS APIs fail to detect the process because the underlying system calls are manipulated.
2
Evaluate the forensic evidence from offline disk image analysis
Discovered an unauthorized kernel driver hooking system calls to conceal active processes and open sockets.
Operating at the kernel layer to intercept API requests and cloak system artifacts is the primary capability of rootkit malware.
3
Map technical findings to standard malware categories
Conclude that the behavioral telemetry aligns with a kernel-mode rootkit.
Rootkits maintain persistent, privileged access while actively hiding their components from native system administration utilities.

Key Concept

Rootkits subvert operating system integrity by hooking API calls and kernel structures to conceal files, processes, and network connections from detection tools.
Question 484Question →

A security analyst is reviewing endpoint telemetry and forensic evidence following a corporate incident. Match each observed technical Indicator of Compromise (IoC) on the left with its correct malware classification on the right.

Click a left item, then click its matching right item

Items

A process executes a Base64-encoded command directly within volatile memory using PowerShell without dropping a binary file to disk, while establishing persistence via a WMI event subscription.
System call table hooks are identified alongside Direct Kernel Object Manipulation (DKOM) that actively conceals listening network sockets and process IDs from process management utilities.
Network logs show rapid automated probe traffic targeting TCP port 445 across multiple subnets, self-replicating to adjacent unpatched systems without requiring user interaction.
An end user manually launches an executable disguised as a software update utility, which installs the expected application while silently deploying a covert remote access channel.

Matches

Show answer & explanation

Answer

Fileless Malware pairs with in-memory PowerShell execution without disk binaries; Rootkit pairs with kernel-level DKOM and syscall table manipulation to hide processes; Worm pairs with automated network port scanning and self-replication across subnets; Trojan pairs with malicious software disguised as a legitimate setup utility requiring manual execution.
The correct pairings accurately reflect the core mechanisms and telemetry signatures of each malware category. Fileless malware operates purely in volatile memory via scripts or legitimate system utilities like PowerShell. Rootkits install deep within kernel architecture to hook system calls and alter operating system structures (DKOM) to hide artifacts. Worms leverage network service vulnerabilities (such as SMB port 445) to spread autonomously across connected devices. Trojans rely on user interaction, using trickery to conceal malicious functionality within legitimate-looking executable applications.

Step-by-Step Solution

1
Analyze the first telemetry artifact describing in-memory PowerShell execution and WMI event subscription persistence without disk write operations.
Identify this behavior as living-off-the-land techniques characteristic of fileless malware.
Fileless malware resides in volatile memory and leverages standard system tools to avoid detection by traditional file-based antivirus scanners.
2
Analyze the second telemetry artifact detailing DKOM and system call table hooking designed to conceal open network ports.
Identify this behavior as kernel-mode privilege manipulation characteristic of a rootkit.
Rootkits operate with ring 0 privileges to alter system telemetry and hide malicious activity from operating system diagnostics.
3
Analyze the third telemetry artifact showing automated SMB scanning and network propagation without user interaction.
Identify this behavior as autonomous network self-replication characteristic of a worm.
Worms operate independently across network links, taking advantage of vulnerabilities without needing human execution.
4
Analyze the fourth telemetry artifact describing a user executing a program disguised as a legitimate software update.
Identify this social engineering mechanism and hidden payload delivery as a Trojan.
Trojans rely on deceptive packaging to trick users into manually granting execution rights to embedded malicious software.

Key Concept

Malware Types and Indicators of Compromise
Question 485Question →

A enterprise security architecture team is revising its infrastructure segmentation strategy to address specific threat models across varied operational zones. Match each network design architectural technique to the security requirement it fulfills.

Click a left item, then click its matching right item

Items

Out-of-band (OOB) management network with a bastion host
Software-defined microsegmentation
Screened subnet (DMZ) with multi-homed firewalls
Physical air-gapping

Matches

Show answer & explanation

Answer

Out-of-band management with a bastion host pairs with administrative switch isolation; Software-defined microsegmentation pairs with restricting East-West lateral workload traffic; Screened subnets with multi-homed firewalls pair with terminating untrusted Internet traffic away from internal databases; Physical air-gapping pairs with preventing remote intrusion into sensitive SCADA systems.
Each architectural pattern matches its specific security objective: Out-of-band management secures network infrastructure access; Microsegmentation halts intra-subnet lateral movement; DMZs secure public endpoints while safeguarding backend assets; Air gaps eliminate remote connectivity risks for critical isolated systems.

Step-by-Step Solution

1
Analyze management plane isolation requirements.
Identified that out-of-band management with jump boxes isolates administrative control interfaces from general user LANs.
Prevents credential sniffing and unauthorized switch access over standard corporate subnets.
2
Evaluate intra-subnet lateral movement controls.
Matched microsegmentation with limiting East-West traffic between individual workloads in shared virtual subnets.
Standard network VLANs allow unrestrained communication within a broadcast domain, whereas microsegmentation enforces workload-to-workload policies.
3
Examine perimeter and backend database protection mechanisms.
Linked screened subnets (DMZs) to untrusted Internet termination and backend database isolation.
Screened subnets proxy or inspect external requests before allowing controlled connections to internal tiers.
4
Determine total physical isolation needs for sensitive operational technology.
Matched physical air-gapping to critical legacy SCADA systems.
Air-gapping ensures complete network disconnection when software patches or logical controls are insufficient.

Key Concept

Secure Network Design and Segmentation Archetypes
Question 486Question →

A systems administrator is hardening a newly deployed web server before placing it into the production environment. To reduce the server's attack surface by ensuring only necessary network communications and operating system functions are active, which of the following host mitigation practices should the administrator perform FIRST?

Show answer & explanation

Answer: Disabling unneeded services and network protocols

Answer

Disabling unneeded services and network protocols is the primary host-hardening technique used to reduce attack surface.
Disabling unnecessary services and network protocols reduces the overall attack surface of a server by turning off unused network ports and background processes, preventing attackers from exploiting unneeded running applications.

Step-by-Step Solution

1
Identify the primary administrative goal described in the scenario
The goal is host hardening to minimize the attack surface by stopping unnecessary ports and system functions.
Hardening a host system requires eliminating unneeded entry points.
2
Evaluate the effective control for reducing host attack surface
Disabling unneeded applications, daemons, and network protocols directly removes potential vulnerability vectors.
Fewer active services mean fewer potential targets for software exploitation or unauthorized network access.

Key Concept

Host Hardening and Attack Surface Reduction
Question 487Question →

An organization is transitioning from a traditional perimeter-based security model to a Zero Trust Architecture (ZTA). Which of the following fundamental principles must the organization implement as part of this new architectural framework? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Assume all network traffic is untrusted, even if originating within the internal network.; Perform explicit verification for every access request using dynamic identity, context, and policy evaluation.

Answer

The correct principles are assuming all network traffic is untrusted regardless of origin and explicitly verifying every access request using dynamic context and policy evaluation.
Zero Trust Architecture replaces legacy boundary-based trust with two foundational tenets: assuming that network traffic is inherently untrusted regardless of source location ('assume breach'), and enforcing explicit verification on every access request using identity, context, and policy evaluation.

Step-by-Step Solution

1
Identify the foundational trust model of Zero Trust Architecture.
Zero Trust operates under an 'assume breach' philosophy.
Internal network traffic can no longer be assumed secure simply because it originates behind a perimeter firewall.
2
Determine the required access evaluation process.
Every request must undergo explicit verification before access is granted.
Verification must continuously consider user identity, device security posture, and request context.

Key Concept

Zero Trust Core Tenets: Assume Breach and Explicit Verification
Question 488Question →

A security analyst conducts an audit of an internal management server and inspects the following listening socket bindings and active process report:

Proto Local Address Foreign Address State PID/Program name
tcp 0.0.0.0:21 0.0.0.0:* LISTEN 812/vsftpd
tcp 0.0.0.0:5900 0.0.0.0:* LISTEN 1044/vncserver
tcp 127.0.0.1:9090 0.0.0.0:* LISTEN 1120/cockpit-daemon

Further investigation confirms that `vncserver` is configured without password authentication and accepts connections from any source IP. Which of the following represents the primary root cause host and architecture vulnerability in this deployment?

Show answer & explanation

Answer: Insecure service configuration allowing unauthenticated binding to wildcard network interfaces

Answer

Insecure service configuration allowing unauthenticated binding to wildcard network interfaces
The socket audit shows VNC bound to `0.0.0.0:5900`, exposing the service across all network interfaces. Combined with disabled authentication, any internal network host can establish a remote desktop session. The root vulnerability is the insecure host service configuration.

Step-by-Step Solution

1
Analyze the socket output
The process `vncserver` is listening on `0.0.0.0:5900`, which means it listens on all network interfaces.
Identifying the socket binding reveals the exposure surface of the service.
2
Evaluate the service configuration details
The VNC service requires no password authentication.
Determining authentication requirements exposes the root security vulnerability.
3
Identify the primary architecture flaw
An unauthenticated remote desktop daemon listening on all host network interfaces creates an immediate unauthorized access risk.
Host security configuration dictates whether network exposure leads to compromise.

Key Concept

Host and Architecture Vulnerabilities - Insecure Service Configuration and Network Socket Exposure
Question 489Question →

Match each enterprise endpoint hardening practice to the primary security threat or vulnerability vector it mitigates.

Click a left item, then click its matching right item

Items

Application Allowlisting
OS Patch Management
Disabling Unnecessary Services
Host-Based Firewall Configuration

Matches

Show answer & explanation

Answer

Application Allowlisting matches with execution prevention of unauthorized software; OS Patch Management matches with remediation of known software flaws; Disabling Unnecessary Services matches with reducing attack surface from unused background processes; Host-Based Firewall Configuration matches with filtering unauthorized network traffic at the endpoint.
Application allowlisting prevents unauthorized software execution; patch management remediates known software vulnerabilities; disabling unnecessary services reduces the system attack surface; and host-based firewalls restrict local network traffic.

Step-by-Step Solution

1
Identify the primary protective function of Application Allowlisting
It restricts executable environments so only approved applications run, blocking malware and unauthorized software.
Allowlisting operates on binary execution paths and cryptographic hashes.
2
Identify the primary protective function of OS Patch Management
It applies vendor updates to fix known security vulnerabilities in operating system code.
Patching removes known targets exploited by malware and vulnerability kits.
3
Identify the primary protective function of Disabling Unnecessary Services
It reduces the host attack surface by eliminating unnecessary listening daemons and background processes.
Fewer active services mean fewer potential entry points for network attackers.
4
Identify the primary protective function of Host-Based Firewall Configuration
It inspects and controls network traffic entering or leaving the local operating system.
Host firewalls enforce microsegmentation policies directly on local interfaces.

Key Concept

Enterprise Hardening Practices and Security Control Application
Question 490Question →

An enterprise security team is implementing a Platform as a Service (PaaS) managed container environment to host web microservices. Under the shared responsibility model, the Cloud Service Provider (CSP) maintains the underlying hardware, hypervisors, and orchestrator control plane. Which of the following operational tasks remains the primary responsibility of the enterprise security team?

Show answer & explanation

Answer: Configuring application-level access controls and remediating vulnerabilities in custom container image code.

Answer

Configuring application-level access controls and remediating vulnerabilities in custom container image code is the primary responsibility of the customer enterprise.
Under the cloud shared responsibility model for Platform as a Service (PaaS), the cloud service provider manages the physical infrastructure, network layer, hypervisor, and container orchestrator engine. The customer remains responsible for application code security, data classification, and access control configuration.

Step-by-Step Solution

1
Analyze the cloud service model specified in the scenario.
The scenario describes a Platform as a Service (PaaS) environment where container orchestration and physical infrastructure are managed by the Cloud Service Provider.
Understanding the service model boundaries determines the baseline division of duties under the shared responsibility model.
2
Differentiate between provider-managed responsibilities and customer-managed responsibilities for PaaS.
The CSP manages physical facility security, hypervisor updates, host OS patching, and control plane orchestration. The customer manages application code, runtime configurations, identity governance, and customer data security.
PaaS offloads hardware and system administration tasks to the CSP while leaving application security with the tenant.
3
Select the option representing customer-side responsibilities.
Application access controls and container image code security belong to the customer domain.
Customers retain ownership and accountability for data, identity governance, and custom application code regardless of cloud service model.

Key Concept

Cloud Shared Responsibility Model in PaaS Environments
Estimated Time:1m 30s
Question 491Question →

A software developer discovers that a user feedback form concatenates untrusted input directly into a database query string, allowing arbitrary database command execution. Which of the following is the MOST effective coding practice to mitigate this vulnerability?

Show answer & explanation

Answer: Implement parameterized queries using prepared statements

Answer

Implementing parameterized queries using prepared statements is the most effective mitigation control.
Implementing parameterized queries (prepared statements) guarantees that the database engine treats user input strictly as literal data rather than executable SQL instructions. This prevents SQL injection vulnerabilities regardless of the characters supplied in the web form.

Step-by-Step Solution

1
Analyze the reported software vulnerability in the scenario
Concatenating untrusted user input directly into database queries creates a SQL injection vulnerability.
Identifying the root cause allows selection of the appropriate application-level security control.
2
Evaluate secure coding controls designed to neutralize query syntax manipulation
Prepared statements (parameterized queries) ensure input is handled purely as data rather than executable SQL code.
Pre-compiling the SQL query ensures user input cannot alter the intended database command structure.

Key Concept

SQL Injection Remediation via Parameterized Queries
Question 492Question →

A security engineer is optimizing the vulnerability assessment program for a enterprise high-frequency transaction cluster located behind inline firewalls and web application firewalls (WAFs). Non-credentialed network scans previously returned zero high-severity findings, but network traffic analysis revealed several outdated service daemons running on internal nodes. The engineer must obtain accurate, detailed patch level and configuration data across all hosts while preventing latency spikes, network congestion, and false-positive results caused by network security controls. Which of the following assessment strategies should the engineer implement to meet these requirements?

Show answer & explanation

Answer: Deploy local agent-based vulnerability scanners on each cluster host to execute authenticated system checks directly on the endpoints.

Answer

Deploy local agent-based vulnerability scanners on each cluster host to execute authenticated system checks directly on the endpoints.
Deploying agent-based vulnerability scanners is the most effective approach for high-availability, low-latency production environments. Agents execute authenticated audits directly on the host operating system, providing complete visibility into missing security patches, registry settings, and local software inventories without generating network traffic spikes or being impacted by inline network firewalls and WAFs.

Step-by-Step Solution

1
Analyze the operational constraints and requirements of the environment.
Identified high-frequency transaction cluster requiring zero latency impact, minimal network overhead, and immunity to network security control interference (firewalls/WAFs).
Network-based scanning can be blocked, throttled, or distorted by inline network security controls and can introduce latency.
2
Compare credentialed scanning methods (network-based credentialed vs. agent-based).
Agent-based scanners execute locally on host OS resources, leveraging local administrative context without generating heavy network scan traffic.
Local agents provide deep visibility into patch levels and local configurations while bypassing network security boundaries safely.
3
Select the optimal vulnerability scanning architecture.
Agent-based scanning satisfies all requirements by ensuring accurate vulnerability identification without network performance degradation.
It addresses both the failure of non-credentialed scans and the performance/firewall constraints of network-based scanning.

Key Concept

Agent-Based vs. Network-Based Credentialed Vulnerability Scanning
Estimated Time:2m 0s
Question 493Question →

Match each network or wireless security threat on the left with its corresponding technical indicator or observed evidence on the right.

Click a left item, then click its matching right item

Items

Bluesnarfing
Wireless Disassociation Attack
DNS Poisoning
Rogue Access Point

Matches

Show answer & explanation

Answer

Bluesnarfing matches unauthorized exfiltration of contact lists and messages via Bluetooth. Wireless Disassociation Attack matches transmission of spoofed 802.11 management frames forcing clients offline. DNS Poisoning matches corrupted domain name resolution cache entries redirecting web traffic. Rogue Access Point matches an unauthorized physical wireless router connected directly to an internal network port.
Each attack type matches its distinct indicator: Bluesnarfing steals data via Bluetooth; Wireless Disassociation sends spoofed 802.11 management frames to disconnect clients; DNS Poisoning tampers with DNS cache records to misdirect web requests; and a Rogue Access Point is an unapproved physical wireless device connected to an internal network switch port.

Step-by-Step Solution

1
Identify the primary mechanism of Bluesnarfing.
Recognize that Bluesnarfing exploits Bluetooth vulnerabilities to steal private data such as contacts or calendar items.
Bluesnarfing is defined by unauthorized data theft over Bluetooth.
2
Analyze the Wireless Disassociation Attack mechanisms.
Connect this attack to 802.11 wireless management frames that command clients to disassociate from their access point.
Attackers send spoofed deauthentication frames to disrupt connectivity.
3
Examine DNS Poisoning indicators.
Link DNS poisoning to corrupted resolution records residing in DNS caches redirecting domain names to malicious destinations.
DNS poisoning tampers with domain-to-IP mappings.
4
Identify the characteristic of a Rogue Access Point.
Match it with an unauthorized physical wireless access point connected to an internal network port.
Rogue APs bypass perimeter controls by plugging directly into internal switch ports.

Key Concept

Network and Wireless Attack Indicators
Question 494Question →

A security analyst is reviewing a vulnerability scan report for a company web application. The report indicates that an attacker can access arbitrary files on the server's file system by inserting relative path sequences (such as `../../etc/passwd`) into a file request parameter. Which of the following application vulnerabilities is described in this scenario?

Show answer & explanation

Answer: Directory traversal

Answer

Directory traversal
The correct answer is directory traversal because the inclusion of dot-dot-slash (`../`) sequences in input fields specifically aims to bypass access controls and navigate out of the web server root directory to read arbitrary files from the operating system.

Step-by-Step Solution

1
Analyze the attack payload described in the scenario
The input uses directory navigation symbols (`../../`) to traverse system directories
Sequences like `../` move up one level in the file system directory structure
2
Map the vulnerability mechanism to standard security taxonomy
The flaw allows accessing files outside the web root directory (path traversal)
Insufficient input validation combined with unsafe file path construction results in directory traversal

Key Concept

Directory Traversal / Path Traversal Vulnerability
Estimated Time:45s
Question 495Question →

A security analyst is auditing an e-commerce platform's microservice that processes promotional discount codes. During testing, the analyst discovers that when a user sends multiple concurrent asynchronous API requests utilizing the same single-use discount voucher, the application processes several of the requests simultaneously before updating the voucher's status flag to used in the persistent database. Which of the following application vulnerabilities is present, and what is the most effective code-level mitigation strategy?

Show answer & explanation

Answer: Race condition (Time-of-Check to Time-of-Use); implement atomic database transactions with thread synchronization or row-level locking.

Answer

Race condition (Time-of-Check to Time-of-Use); implement atomic database transactions with thread synchronization or row-level locking.
The scenario describes a classic Time-of-Check to Time-of-Use (TOCTOU) race condition where concurrent requests exploit the time delta between verifying a voucher's validity and recording its usage. The proper solution is to enforce atomicity through thread synchronization, row-level database locking, or isolation levels that ensure only one thread can verify and modify the record at a time.

Step-by-Step Solution

1
Analyze the operational behavior described in the scenario.
Identified that multiple concurrent threads check state independently before any single thread commits a state change, creating an exploit window.
This behavior is characteristic of a Time-of-Check to Time-of-Use (TOCTOU) race condition flaw.
2
Evaluate the underlying root cause of the vulnerability.
The voucher verification logic lacks atomicity and concurrency controls.
Without locking mechanisms, parallel requests read stale state data before the write operation completes.
3
Determine the appropriate remediation control.
Select atomic database operations, thread synchronization, or mutex locks to ensure exclusive processing.
Code-level locking ensures that checking and updating the voucher status occurs as an indivisible, single operation.

Key Concept

Race Conditions and TOCTOU Vulnerabilities
Estimated Time:2m 0s
Question 496Question →

A security analyst is investigating a newly reported software vulnerability and needs to review its official description, standardized Common Vulnerability Scoring System (CVSS) metrics, and vendor patch links. Which threat intelligence source is specifically designed to provide this centralized repository of public vulnerability data?

Show answer & explanation

Answer: National Vulnerability Database (NVD)

Answer

National Vulnerability Database (NVD)
The National Vulnerability Database (NVD) is a public repository maintained by NIST that integrates with the CVE dictionary to offer standardized vulnerability details, CVSS severity scores, and remediation links.

Step-by-Step Solution

1
Identify the required data types described in the scenario.
The analyst requires standardized vulnerability descriptions, CVSS scores, and official patch references.
These attributes are characteristic of standardized public vulnerability databases.
2
Evaluate the primary role of open-source vulnerability repositories.
The National Vulnerability Database (NVD) aggregates CVE records and provides structured vulnerability scoring and technical analysis.
NVD is freely accessible and specifically designed for standardized vulnerability research.

Key Concept

Public Vulnerability Databases (NVD/CVE)
Question 497Question →

A security operations manager at an electric vehicle charging station network provider is categorizing recent security incidents and threat activity profiles. Match each observed incident scenario on the left with the threat actor attribute or vector on the right that primarily defines it.

Click a left item, then click its matching right item

Items

A disciplined group uses undisclosed zero-day vulnerabilities in charging management firmware to maintain persistent access across power grid gateways over years without exfiltrating funds.
A recently terminated database administrator uses active privileged administrative credentials to wipe system configuration databases.
An activist group executes distributed denial-of-service (DDoS) attacks against public payment portals to protest energy pricing policies.
An external party embeds malicious telemetry code into a widely used third-party open-source software library integrated into the mobile mobile charging app.

Matches

Show answer & explanation

Answer

Each security scenario correctly maps to its defining threat actor profile or vector based on motivation, sophistication, access method, and attack channel.
Threat actors and vectors are categorized by examining their motivation, level of sophistication, funding, intent, and entry mechanism. Persistent zero-day attacks without financial motives correspond to nation-state actors; post-termination credential abuse corresponds to insider threats; public policy protests via DDoS correspond to hacktivists; and open-source dependency tampering corresponds to supply chain attack vectors.

Step-by-Step Solution

1
Analyze the long-term zero-day firmware intrusion scenario.
Identify as a nation-state threat actor.
Nation-state actors possess significant resources required to develop zero-day exploits and maintain long-term covert persistence for geopolitical espionage.
2
Analyze the unauthorized data wiping by a terminated administrator.
Identify as an insider threat.
Insider threats involve individuals with authorized access or specialized knowledge of internal systems who misuse privileges due to personal grievance.
3
Analyze the payment portal denial-of-service attack associated with public policy protests.
Identify as a hacktivist group.
Hacktivists focus on disruption and publicity to bring attention to political, social, or environmental causes.
4
Analyze the malicious telemetry code embedded in an open-source library.
Identify as a supply chain attack vector.
Supply chain attack vectors target third-party components, libraries, or vendors to compromise downstream software applications implicitly trusting those sources.

Key Concept

Threat Actor Attributes, Motivations, and Attack Vectors
Question 498Question →

During a security assessment of a web portal's user profile microservice, a security analyst reviews the API request handling logic. The microservice accepts a JSON payload for profile updates and automatically maps all incoming key-value pairs directly to the backend database user model without filtering. Furthermore, when users supply a web URL to import a profile avatar, the server issues an HTTP request to retrieve the image using service privileges without validating the target destination host or IP address. Which of the following application vulnerabilities are present in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Server-Side Request Forgery (SSRF); Mass Assignment

Answer

The correct vulnerabilities are Server-Side Request Forgery (SSRF) and Mass Assignment.
The scenario demonstrates two specific software flaws: issuing server-side HTTP requests to client-provided URLs without destination validation is Server-Side Request Forgery (SSRF), and automatically mapping untrusted JSON input fields directly into the backend database object is Mass Assignment.

Step-by-Step Solution

1
Analyze the remote avatar fetching behavior
The application issues outbound HTTP requests based on user-supplied URLs without restricting target IP addresses or domain names.
Allowing an untrusted client input to trigger backend network requests to arbitrary destinations defines Server-Side Request Forgery (SSRF).
2
Analyze the profile payload processing behavior
The application automatically binds all client-provided JSON key-value pairs directly to the backend database object.
Unfiltered binding of client HTTP request parameters to internal object properties defines Mass Assignment.

Key Concept

Identifying Software and API Vulnerabilities (SSRF and Mass Assignment)
Question 499Question →

A security analyst is evaluating different testing procedures to incorporate into an organization's vulnerability management policy. Match each security testing method on the left with its corresponding operational characteristic on the right.

Click a left item, then click its matching right item

Items

Credentialed Host Scan
Passive Network Monitoring
Interactive Application Security Testing (IAST)
Wardriving Assessment

Matches

Show answer & explanation

Answer

Credentialed Host Scan matches with leveraging administrative privileges to audit local host configurations; Passive Network Monitoring matches with analyzing packet headers silently without active probing; Interactive Application Security Testing (IAST) matches with deploying runtime agents inside the application engine; Wardriving Assessment matches with using wireless detection equipment around facility perimeters to locate rogue access points.
Each testing method is paired with its specific operational mechanism: credentialed scans use elevated login access for local auditing; passive monitoring relies on packet sniffing without traffic generation; IAST uses embedded agents during execution; and wardriving surveys physical boundaries for wireless emissions and unauthorized access points.

Step-by-Step Solution

1
Analyze Credentialed Host Scan operational requirements
Identify that credentialed scanning requires authentication to target hosts to examine internal configurations and missing hotfixes.
Administrative credentials allow direct querying of local operating system settings and installed updates.
2
Evaluate Passive Network Monitoring characteristics
Match with silent packet header analysis without sending network probes.
Passive monitoring observes existing network traffic on a span/mirror port rather than generating active probe traffic.
3
Examine Interactive Application Security Testing (IAST) architecture
Connect IAST to agent-based runtime application code inspection during execution.
IAST combines aspects of SAST and DAST by placing sensors inside the runtime engine while tests execute.
4
Identify Wardriving Assessment physical and RF footprint parameters
Associate wardriving with perimeter wireless signal detection and rogue access point mapping.
Wardriving specifically tests wireless perimeter security by detecting RF leakage and unauthorized access points.

Key Concept

Vulnerability Assessment and Security Testing Methods
Estimated Time:1m 30s
Question 500Question →

Match each host and infrastructure vulnerability scenario to the underlying security weakness or misconfiguration it represents.

Click a left item, then click its matching right item

Items

An internal management host transmitting network monitoring telemetry using SNMPv1 across local subnets.
A third-party background service executable located in a directory with full write permissions assigned to non-administrative users.
An internal database server bound to a public interface without perimeter firewall rules or VLAN isolation.
A legacy host operating system past end-of-life running unpatched network daemons with known exploit modules.

Matches

Show answer & explanation

Answer

The scenarios match their respective security weaknesses as follows: SNMPv1 traffic matches cleartext protocol exposure; weak file permissions on executable directories match local privilege escalation risk; unsegmented database service exposure matches improper network segmentation; and unpatched end-of-life operating systems match unsupported legacy software vulnerability risk.
Each scenario maps directly to its specific vulnerability classification. SNMPv1 does not support encryption, exposing management strings in cleartext. Allowing standard users write access to service binary paths enables local file modification and privilege escalation. Exposing internal database ports directly without firewall or VLAN boundaries represents a breakdown in network segmentation. Continuing to host end-of-life operating systems exposes environments to known unpatched vulnerabilities.

Step-by-Step Solution

1
Analyze each scenario to isolate the core vulnerability mechanism.
Scenario 1 involves plain-text transmission; Scenario 2 involves excessive local file modification rights; Scenario 3 involves lack of network zone controls; Scenario 4 involves unpatched legacy systems.
Proper classification requires pinpointing the root cause vulnerability at the protocol, operating system, or network architecture layer.
2
Pair each scenario with its corresponding architectural or configuration flaw description.
SNMPv1 pairs with cleartext protocol exposure; writeable executable path pairs with privilege escalation; direct external database access pairs with improper network segmentation; end-of-life OS pairs with unsupported legacy software risk.
This establishes clear alignment between technical indicators and vulnerability management classifications.

Key Concept

Host, Network, and Architecture Vulnerabilities
PreviousPage 25 / 112Next
All practice questions — CompTIA Security+ | Examkin