Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 521Question →

A senior threat intelligence analyst at a global financial services firm is architecting an automated threat feed ingestion pipeline. The system must standardize machine-readable cyber threat indicators and automatically transport them directly into the enterprise Security Information and Event Management (SIEM) platform for real-time correlation without requiring manual analyst intervention. Which of the following standards or protocol frameworks are specifically designed to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: STIX (Structured Threat Information eXpression) to standardize the serialization and language schema of the threat indicators.; TAXII (Trusted Automated eXchange of Intelligence Information) to establish the automated transport protocol for transmitting threat feeds over HTTPS.

Answer

STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information) are the required standards for establishing an automated, machine-readable threat intelligence ingestion pipeline.
Building an automated threat intelligence ingestion pipeline requires both a standardized data structure and a secure transport protocol. STIX specifies the standardized, machine-readable format (such as JSON) for representing indicators and threat context. TAXII acts as the dedicated transport mechanism operating over HTTPS to exchange STIX-packaged intelligence between systems automatically.

Step-by-Step Solution

1
Identify the data format requirement for machine-readable indicator standardization.
STIX (Structured Threat Information eXpression) defines the structured taxonomy and serialization format (JSON/XML) for threat indicators.
SIEM and SOAR tools require a unified schema to programmatically parse and correlate threat data from multiple sources.
2
Identify the transmission protocol requirement for automated delivery.
TAXII (Trusted Automated eXchange of Intelligence Information) provides the API and transport mechanism over HTTPS to push or pull STIX data automatically.
Automated ingestion requires an application-layer protocol designed specifically for cyber threat intelligence exchanges.
3
Evaluate and eliminate non-automated or misaligned intelligence sources.
NVD feeds focus on vulnerability scoring rather than threat indicators, ISAC email bulletins require manual human reading, and raw OSINT scraping lacks structured machine readability.
None of these alternatives satisfy both automated transport and standardized machine-readable threat representation.

Key Concept

STIX and TAXII standards for automated threat intelligence ingestion
Question 522Question →

A logistics company migrates its core inventory database to a public cloud Infrastructure as a Service (IaaS) environment using custom virtual machine instances. Under the cloud shared responsibility model, which of the following tasks is the sole operational security responsibility of the customer enterprise?

Show answer & explanation

Answer: Applying operating system security updates and configuring host-based firewalls on virtual machines

Answer

Applying operating system security updates and configuring host-based firewalls on virtual machines is the sole operational security responsibility of the customer enterprise.
In Infrastructure as a Service (IaaS), the cloud provider is responsible for securing the underlying physical infrastructure, virtualization hypervisors, and data center facilities. The customer enterprise retains total administrative responsibility for everything running above the hypervisor layer, including installing, patching, and hardening guest operating systems, as well as managing host-based network controls.

Step-by-Step Solution

1
Identify the cloud service model referenced in the enterprise scenario
The scenario specifies an Infrastructure as a Service (IaaS) deployment model.
Security responsibilities vary depending on whether IaaS, PaaS, or SaaS is implemented.
2
Differentiate shared responsibility boundaries between the Cloud Service Provider (CSP) and the customer for IaaS
The CSP manages physical data centers, physical hardware, power, facility security, and hypervisors. The customer manages guest operating systems, application code, data classification, and virtual network configuration.
IaaS provides raw compute and storage infrastructure, leaving operating system control with the tenant.
3
Select the task aligned with customer-managed IaaS responsibilities
Guest operating system security patching and host firewall configuration fall directly on the customer enterprise.
The CSP cannot access or modify the internal guest OS software stack managed by the customer without explicit tenant access.

Key Concept

Cloud Shared Responsibility Model (IaaS)
Question 523Question →

A security analyst reviews a vulnerability assessment report for an internal Network Attached Storage (NAS) appliance deployed on a dedicated storage management subnet. The audit report identifies two critical host and infrastructure vulnerabilities:

1. The storage management web console accepts cleartext HTTP traffic over TCP port 80 and retains factory default administrator credentials.
2. An unencrypted Telnet service is active on TCP port 23 for command-line access.

Which of the following hardening measures should the security team implement to remediate these specific vulnerabilities? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Disable the Telnet service and enforce SSHv2 for encrypted command-line management access.; Reconfigure the management interface to require HTTPS with TLS 1.3 and change all default administrative passwords.

Answer

The security team should disable Telnet in favor of SSHv2 and reconfigure the management console to enforce HTTPS while updating default credentials.
Remediating infrastructure management vulnerabilities requires enforcing cryptographic protocols (SSHv2 and HTTPS) to protect session data in transit and removing default credentials to ensure proper access control.

Step-by-Step Solution

1
Identify the host and protocol vulnerabilities
The NAS appliance uses cleartext protocols (HTTP and Telnet) for management and retains default administrative credentials.
Unencrypted management channels allow credentials and session data to be captured in transit, while default credentials allow trivial unauthorized access.
2
Select appropriate transport security mitigations
Enforce SSHv2 instead of Telnet for CLI administration and HTTPS (TLS 1.3) instead of HTTP for web management.
Cryptographic transport protocols guarantee confidentiality and data integrity during administrative sessions.
3
Remediate host credential misconfigurations
Change factory default administrator credentials to unique, strong passwords.
Eliminating default passwords prevents attackers from gaining immediate administrative control.

Key Concept

Hardening host interfaces by replacing cleartext management protocols with secure alternatives and remediating default credential risks.
Estimated Time:1m 30s
Question 524Question →

An IT technician is tasked with applying baseline security hardening controls to enterprise endpoints. Match each system hardening technique on the left with its corresponding security mitigation goal on the right.

Click a left item, then click its matching right item

Items

Disabling Unused Services
Application Allowlisting
Patch Management

Matches

Show answer & explanation

Answer

Disabling Unused Services matches with reducing the attack surface by eliminating unneeded entry points; Application Allowlisting matches with preventing unauthorized files and scripts from executing; Patch Management matches with remediating software flaws and known security vulnerabilities.
Each system hardening strategy addresses a specific risk area: disabling unused services limits active exposure points, application allowlisting enforces approved program execution, and patch management fixes identified software defects.

Step-by-Step Solution

1
Identify the primary mechanism of Disabling Unused Services
Turning off unneeded system daemons and features reduces open ports and background software entry points.
Minimizing active features directly decreases the available attack surface.
2
Identify the primary mechanism of Application Allowlisting
Enforcing an explicit list of authorized executables blocks untrusted or malicious scripts.
Execution control prevents unauthorized software from running.
3
Identify the primary mechanism of Patch Management
Deploying vendor updates addresses known code defects.
Routine updates eliminate security weaknesses that attackers could exploit.

Key Concept

Mitigation Strategies and Enterprise Hardening Practices
Question 525Question →

A security architect is designing the network architecture for a manufacturing facility. The site contains a legacy Industrial Control System (ICS) operating sensitive Programmable Logic Controllers (PLCs), alongside an automated telemetry module that needs to push real-time performance metrics to a cloud analytics provider. Enterprise security policy mandates that external cloud systems and corporate IT networks must be strictly prevented from sending incoming traffic back into the ICS network segment. Which of the following network architecture designs best fulfills these security requirements?

Show answer & explanation

Answer: Deploy a unidirectional security gateway (data diode) to enforce hardware-based physical layer flow control, permitting outbound telemetry data while physically preventing any inbound network traffic into the ICS environment.

Answer

Deploying a unidirectional security gateway (data diode) to enforce hardware-based physical layer flow control, permitting outbound telemetry data while physically preventing inbound traffic into the ICS environment.
Deploying a unidirectional security gateway (data diode) physically enforces one-way communication at Layer 1. This allows outbound telemetry flow to cloud systems while physically blocking any inbound connection attempts, perfectly satisfying the requirement to isolate critical ICS assets from external network threats.

Step-by-Step Solution

1
Analyze security and architectural requirements
The requirement specifies outbound telemetry data export to the cloud while enforcing a zero-risk policy against inbound network connections into the legacy ICS network segment.
Legacy Industrial Control Systems (ICS/SCADA) and PLCs often lack modern host security controls, making them highly vulnerable to network-based exploits and lateral movement.
2
Evaluate network isolation technologies
A data diode (unidirectional gateway) provides a physical, hardware-based guarantee that data can only travel in one direction.
Unlike software firewalls or VLAN access control lists (ACLs) that could be misconfigured or bypassed via software flaws, a data diode physically lacks the hardware receiver components in the return direction.
3
Eliminate non-compliant isolation mechanisms
Perimeter firewalls with implicit internal trust, dual-homed jump host bridging, and passive NIDS sensors fail to provide non-bypassable unidirectional isolation.
Firewalls and VLANs remain vulnerable to misconfiguration or logical exploits, while NIDS sensors only detect activity rather than preventing inbound connection establishment.

Key Concept

Unidirectional Data Diodes and OT/ICS Network Segmentation
Estimated Time:1m 30s
Question 526Question →

A security engineering lead at a global telecommunications provider is building an automated workflow to ingest threat indicators into an enterprise SIEM. The threat intelligence vendor supplies standardized, machine-readable data structures representing threat actor TTPs, attack vectors, and observable indicators. To enable automated client-server polling and pushing of these structured data packages over HTTPS, which protocol must be deployed at the application transport layer?

Show answer & explanation

Answer: TAXII (Trusted Automated eXchange of Intelligence Information)

Answer

TAXII (Trusted Automated eXchange of Intelligence Information) is the transport protocol required to exchange threat intelligence over HTTPS.
The Trusted Automated eXchange of Intelligence Information (TAXII) is explicitly designed as the application-layer transport protocol that specifies services and message exchanges to deliver Structured Threat Information eXpress (STIX) threat intelligence over HTTPS.

Step-by-Step Solution

1
Differentiate between threat data representation models and transport protocols
Identified STIX as the structured data format (content language) and TAXII as the container protocol (transport mechanism).
Machine-readable threat intelligence architectures pair STIX for formatting with TAXII for secure network transport.
2
Evaluate the functional requirement specified in the scenario
The requirement calls specifically for client-server polling and pushing over HTTPS.
TAXII defines REST API web services and messaging specs over HTTPS to deliver automated feeds to SIEM/SOAR platforms.

Key Concept

STIX vs. TAXII Architecture in Automated Threat Intelligence
Question 527Question →

A cybersecurity team at a commercial bank wants to collaborate with peer organizations to exchange industry-specific threat alerts, emerging attack vectors, and operational insights tailored specifically to the financial sector. Which of the following resources best satisfies this requirement?

Show answer & explanation

Answer: Information Sharing and Analysis Center

Answer

An Information Sharing and Analysis Center (ISAC) is the correct choice for sector-specific peer threat intelligence sharing.
An Information Sharing and Analysis Center (ISAC) provides trusted resources and mechanisms for member entities within specific industry sectors (such as financial services, healthcare, or energy) to share threat data, attack indicators, and defensive strategies.

Step-by-Step Solution

1
Identify the primary operational requirement.
The organization needs industry-specific threat alerts and peer collaboration tailored to the financial sector.
The scenario explicitly asks for industry-tailored threat intelligence sharing with sector peers.
2
Evaluate potential intelligence sources against sector-specific criteria.
An Information Sharing and Analysis Center (ISAC) explicitly connects organizations within a given industry to exchange actionable threat data.
ISACs exist to serve targeted industry verticals with sector-relevant threat warnings and mitigation insights.

Key Concept

Information Sharing and Analysis Centers (ISACs)
Question 528Question →

A network security architect is implementing defense-in-depth segmentation to secure access from external users to an isolated internal backend database. Arrange the network transit points and security control boundaries in the correct sequence through which inbound traffic must flow from the untrusted Internet to the database server.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct ingress sequence flows from the Perimeter WAF in the DMZ, to the Reverse Proxy/API Gateway in the Public Services Subnet, through the Internal Microsegmentation Firewall, and finally to the Database Subnet ACL and Host Firewall.
Secure network architecture mandates a defense-in-depth approach where inbound traffic traverses from public edge boundaries to increasingly restrictive internal zones. Traffic first enters the DMZ via the Perimeter WAF, moves to the API Gateway in the public services tier for authentication, passes through an internal microsegmentation firewall inspecting East-West flows, and lastly encounters the Database Subnet ACL and Host Firewall enforcing strict destination isolation.

Step-by-Step Solution

1
Filter North-South traffic at the network edge
Untrusted external traffic is inspected by the Perimeter WAF in the DMZ.
Perimeter security controls must evaluate incoming public requests first to block common web attacks before traffic reaches internal endpoints.
2
Terminate external connections and validate application requests
The Reverse Proxy/API Gateway handles session termination and request verification.
De-encapsulating and authenticating requests in a public-facing service subnet prevents unverified external clients from directly connecting to internal application instances.
3
Enforce East-West microsegmentation boundaries
The Internal Microsegmentation Firewall evaluates traffic traveling between application tiers.
Microsegmentation prevents lateral movement by explicitly inspecting and controlling data flows transitioning across internal zone boundaries.
4
Apply host and subnet-level isolation controls
Database Subnet ACLs and Host Firewalls enforce zero trust rules at the target resource.
Final line-of-defense controls restrict access strictly to authorized source IP addresses and database-specific communication protocols.

Key Concept

Multi-tier network segmentation and zoning boundaries control the flow of ingress and lateral traffic across security zones based on least privilege and defense-in-depth.
Question 529Question →

A security analyst inspects an HTTP request sent to an enterprise document service along with the corresponding server response:

http
GET /documents/download?file=..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: portal.example.com

The web server responds with an HTTP 200 OK status code containing the root filesystem account details. Additionally, when a user submits a non-existent path parameter, the application returns a detailed Java stack trace displaying internal file system paths, framework versions, and database connection strings.

Based on these findings, which of the following application vulnerabilities are present? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Directory traversal; Improper error handling

Answer

The application suffers from directory traversal and improper error handling.
Directory traversal occurs when an application fails to sanitize input containing relative directory sequences (like `../` or `%2F`), allowing unauthorized access to arbitrary files on the system host. Improper error handling occurs when verbose diagnostic output, such as unhandled exception stack traces, is revealed directly to end users instead of generic error pages.

Step-by-Step Solution

1
Analyze the HTTP request parameter and payload
The file parameter contains URL-encoded relative path traversal sequences (`..%2F..%2F..%2Fetc%2Fpasswd`), which resolve to local system files (`/etc/passwd`).
This confirms a directory traversal flaw caused by insufficient validation and sanitization of file path parameters.
2
Analyze the server's error output behavior when invalid input is provided
The server exposes detailed stack traces containing internal directory structures, framework versions, and database connection metadata.
Displaying sensitive technical implementation details in client-facing error responses constitutes an improper error handling vulnerability.

Key Concept

Identifying directory traversal attacks and improper error handling disclosures in application security assessments.
Estimated Time:2m 0s
Question 530Question →

A healthcare organization deploys a microservice backend utilizing a serverless Function-as-a-Service (FaaS) architecture on a public cloud platform to ingest patient telemetry. Under the cloud shared responsibility model, which TWO of the following security tasks remain the responsibility of the organization rather than the cloud service provider?

Select all that apply

Show answer & explanation

Answer: Defining granular execution roles and access permissions within the cloud identity and access management framework; Performing static code analysis and enforcing input validation logic within the serverless function source code

Answer

The organization is responsible for defining granular identity and access management policies for function execution roles and performing code-level security mitigations within the serverless application source code.
In serverless (FaaS) architectures, the cloud service provider abstracts and manages the underlying server hardware, operating systems, and runtime execution engines. The customer retains full responsibility for security 'in' the cloud—specifically writing secure application code, sanitizing input data, and defining granular access permissions and identity policies for execution roles.

Step-by-Step Solution

1
Analyze the cloud service model (FaaS/Serverless).
Identify that the provider abstracts server hardware, OS patching, and runtime engine management.
Serverless architectures offload infrastructure provisioning and runtime operational duties to the cloud service provider.
2
Differentiate customer security duties from provider responsibility.
Determine that application logic, source code security, data validation, and IAM role access rights remain customer obligations.
Under the shared responsibility model, security 'in' the cloud (code, data, and access configurations) belongs to the customer, while security 'of' the cloud belongs to the provider.

Key Concept

Shared Responsibility Model in Serverless (FaaS) Architectures
Question 531Question →

An enterprise security team discovers that a bare-metal server's Baseboard Management Controller (BMC) interface running IPMI v2.0 on UDP port 623 is reachable directly from standard workstation VLANs. The IPMI service is configured with Cipher Suite 0, allowing session establishment without authentication and transmitting management traffic in cleartext. Although edge firewalls restrict external internet access to UDP port 623, no internal network segmentation or host-level access control lists exist to restrict internal traffic. Which of the following mitigation strategies BEST addresses the host, protocol, and architectural vulnerabilities described in this scenario?

Show answer & explanation

Answer: Disable insecure IPMI cipher suites, enforce encrypted management protocols, and place the BMC interface on an isolated management VLAN with zero-trust access controls.

Answer

Disable insecure IPMI cipher suites, enforce encrypted management protocols, and place the BMC interface on an isolated management VLAN with zero-trust access controls.
Disabling weak cipher suites, requiring secure encrypted management protocols, and isolating hardware management interfaces (such as IPMI or BMC) onto a segregated management network directly addresses both host protocol weaknesses and network architectural flaws. Adopting microsegmentation aligns with zero trust principles to prevent lateral movement.

Step-by-Step Solution

1
Identify host-level protocol weaknesses
IPMI v2.0 with Cipher Suite 0 allows unauthenticated, unencrypted access on UDP port 623.
Legacy or misconfigured management interfaces expose administrative capabilities over cleartext protocols.
2
Identify network architecture weaknesses
Lack of internal VLAN microsegmentation allows direct network access from untrusted workstation subnets to critical hardware management interfaces.
Perimeter firewalls do not protect against internal lateral movement when hosts reside on flat, unsegmented networks.
3
Select comprehensive mitigation controls
Enforce secure protocols (such as TLS or SSH), disable Cipher Suite 0, and isolate management interfaces onto a dedicated, microsegmented VLAN.
Combining host hardening with network isolation fulfills defense-in-depth and zero-trust security requirements.

Key Concept

Host and Network Architecture Vulnerability Remediation
Question 532Question →

A security administrator needs to prevent smart building environmental sensors from communicating directly with internal servers holding confidential employee files on the company network. Which of the following secure network design techniques provides the most effective logical isolation for these sensors?

Show answer & explanation

Answer: Placing the sensors on a dedicated Virtual Local Area Network (VLAN) with restricted inter-VLAN routing

Answer

Placing the sensors on a dedicated Virtual Local Area Network (VLAN) with restricted inter-VLAN routing is the most effective approach for logically isolating IoT devices from sensitive internal resources.
Placing smart building sensors on a dedicated Virtual Local Area Network (VLAN) isolates their traffic into a distinct logical broadcast domain. With inter-VLAN routing rules or firewalls configured between subnets, lateral movement from compromised IoT devices to confidential internal servers is blocked.

Step-by-Step Solution

1
Identify the risk and segmentation requirement.
The smart sensors represent untrusted or low-security devices that share network access with high-value internal servers.
Unsecured IoT devices can be leveraged as entry points to laterally move across flat internal networks.
2
Evaluate network isolation techniques.
Creating a dedicated VLAN partitions the network at Layer 2/Layer 3, isolating broadcast domains.
Logical segmentation via VLANs coupled with firewall access control lists (ACLs) enforces boundary controls on internal traffic.

Key Concept

Logical Network Segmentation using VLANs
Question 533Question →

A network administrator is designing a wireless architecture for a company branch office. The goal is to provide visitors with internet access while preventing them from accessing sensitive internal servers and local network resources. Which of the following controls should the administrator implement to achieve secure network segmentation? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Place visitor traffic on a dedicated guest VLAN isolated with Access Control Lists (ACLs) that restrict access to internal IP ranges.; Deploy the guest wireless gateway in a perimeter DMZ segment configured to route guest traffic directly to the internet gateway.

Answer

The correct controls are assigning visitor traffic to a dedicated guest VLAN with outbound ACLs and deploying the guest wireless gateway within a perimeter DMZ segment.
Isolating untrusted devices via a dedicated guest VLAN with strict ACLs and routing guest traffic through a perimeter DMZ segment ensures that guest packets cannot reach internal corporate resources while maintaining internet access.

Step-by-Step Solution

1
Identify the primary security requirement.
Visitors require internet connectivity but must be prohibited from communicating with internal corporate networks.
Preventing lateral movement from untrusted guest devices into internal subnets is a core objective of network segmentation.
2
Evaluate network segmentation controls.
Dedicated guest VLANs with ACLs and DMZ perimeter placement logically isolate untrusted traffic.
Both techniques enforce layer 2/3 boundary separation so guest packets cannot traverse into internal administrative zones.

Key Concept

Secure Network Design and Segmentation
Estimated Time:1m 0s
Question 534Question →

A multinational technology company is migrating its customer analytics workloads to a managed Platform as a Service (PaaS) cloud architecture. Under this service model, the Cloud Service Provider (CSP) manages the physical hardware, hypervisors, database engine software, and underlying operating system runtime environments. The company's security engineering team must establish appropriate security architecture controls for the hosted applications and sensitive data. Under the cloud shared responsibility model, which of the following tasks remains the sole responsibility of the customer organization?

Show answer & explanation

Answer: Configuring application-level access permissions, client data classification policies, and database user authorization schemas.

Answer

Configuring application-level access permissions, client data classification policies, and database user authorization schemas.
Under the cloud shared responsibility model for Platform as a Service (PaaS), the cloud service provider manages the physical data center, hardware infrastructure, hypervisor, and operating system runtime environment. The tenant organization retains full ownership and responsibility for securing its application code, user authorization configurations, data classification, and stored datasets.

Step-by-Step Solution

1
Analyze the cloud deployment model specified in the scenario.
The scenario describes a Platform as a Service (PaaS) deployment model.
Identifying the cloud model (PaaS) establishes the boundary line for shared responsibility between the CSP and the tenant.
2
Determine the cloud service provider's operational duties under PaaS.
The CSP manages physical infrastructure, network infrastructure, virtualization, host OS kernel patching, and database engine maintenance.
PaaS abstracts hardware and OS layers away from the customer so developers can focus on application code and data.
3
Determine the customer organization's remaining security responsibilities.
The customer is always responsible for data classification, application logic security, customer user account authorization, and API client configuration.
Regardless of whether IaaS, PaaS, or SaaS is used, ownership of data classification and access authorization remains strictly with the customer organization.

Key Concept

Cloud Shared Responsibility Model in Platform as a Service (PaaS)
Question 535Question →

An organization's security operations team observes that unauthorized software scripts are frequently executing from temporary user directories on endpoint workstations. To restrict hosts so that only explicitly authorized executables and scripts are permitted to run, which of the following technical mitigation controls should be implemented?

Show answer & explanation

Answer: Application allowlisting

Answer

Application allowlisting is the most effective endpoint hardening control to prevent unauthorized binaries and scripts from running.
Application allowlisting (also known as application control) enforces a strict policy where only approved software, scripts, and libraries are allowed to execute. By blocking execution from unverified locations such as user temporary folders, it directly mitigates the unauthorized execution of untrusted scripts.

Step-by-Step Solution

1
Analyze the threat vector
Identified unauthorized executable and script execution occurring on local user endpoint paths.
Understanding where and how code executes isolates host runtime policies as the core defensive boundary.
2
Evaluate mitigation technologies against the objective
Application allowlisting establishes an explicit default-deny rule set for executable binaries, scripts, and DLLs.
Allowlisting prevents unapproved applications from executing regardless of their location on the local file system.

Key Concept

Application Allowlisting and Endpoint Hardening
Question 536Question →

During a post-breach investigation at a software development firm, incident responders trace an initial access event to a multi-stage campaign. The threat actor scattered USB drives branded with the firm's logo and labeled 'Confidential Executive Salaries' across the employee parking area. Concurrently, the actor compromised a popular third-party technical documentation site frequented by the firm's DevOps engineering team, injecting a malicious script that prompted visitors to download a forged browser extension update. Which of the following social engineering techniques and attack vectors were directly executed in this campaign? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Baiting, by placing physical media loaded with malicious code in locations where targeted personnel would find and insert them out of curiosity; Watering hole attack, by infecting a specific legitimate site heavily frequented by the target audience to deliver malware to site visitors

Answer

The correct social engineering techniques executed in this campaign are baiting (using infected physical USB media) and a watering hole attack (compromising a legitimate, frequently visited technical documentation website).
The scenario describes two distinct social engineering tactics: using physical USB media labeled enticingly to exploit curiosity (baiting) and compromising a legitimate website frequently visited by the firm's DevOps engineers to serve malicious payloads (watering hole attack).

Step-by-Step Solution

1
Analyze the physical component of the initial access campaign.
Leaving branded USB drives labeled 'Confidential Executive Salaries' exploits curiosity to entice employees to plug untrusted media into enterprise systems, which defines baiting.
Identifying physical lure delivery methods requires recognizing human psychological triggers like curiosity combined with physical media placement.
2
Analyze the web-based component targeting the DevOps team.
Compromising a legitimate third-party website that a specific target group regularly visits to serve malicious updates defines a watering hole attack.
Watering hole attacks focus on strategic web compromise of sites trusted by specific target organizations rather than broad email phishing.
3
Evaluate and rule out non-applicable social engineering variants.
Pretexting requires direct communication under a fabricated identity, and typosquatting relies on domain name misspelling; neither vector was present in the described incident.
Distinguishing between direct domain registration attacks, active voice impersonation, and strategic site compromise ensures precise attack classification.

Key Concept

Social Engineering Attack Vectors (Baiting vs. Watering Hole)
Question 537Question →

An enterprise financial institution is establishing a multi-tenant Community Cloud deployment model shared exclusively among partner credit unions to host a real-time collaborative fraud detection platform. The platform is constructed using managed Platform as a Service (PaaS) microservices that process customer transactions. The enterprise security architect must define control boundaries according to the cloud shared responsibility model and Zero Trust principles. Which of the following security responsibilities rests exclusively with the participating organization's security team?

Show answer & explanation

Answer: Defining granular application API authorization policies and managing customer data classification logic

Answer

Defining granular application API authorization policies and managing customer data classification logic is the sole responsibility of the tenant organization.
Under the cloud shared responsibility model for Platform as a Service (PaaS) and Community Cloud environments, the cloud service provider manages physical facilities, hypervisors, and runtime infrastructure. The participating customer organizations remain exclusively responsible for securing their data, defining data classification schemes, and configuring application-level access control and API authorization policies.

Step-by-Step Solution

1
Analyze the cloud deployment model (Community Cloud) and service model (Platform as a Service - PaaS).
PaaS abstracts the underlying operating systems, runtime engines, and hardware infrastructure, assigning their maintenance to the cloud service provider.
Understanding the abstraction layer isolates tenant responsibilities from provider responsibilities.
2
Evaluate the cloud shared responsibility boundary for PaaS environments.
The customer is always responsible for data governance, application-layer identity/access management (IAM), data classification, and API security policies.
Regardless of deployment model, customer data and application access controls never shift to the cloud service provider.
3
Align responsibility allocation with architectural constraints (Zero Trust and regulatory requirements).
Defining explicit application authorization logic enforces data isolation across multi-tenant community boundaries.
Proper control placement ensures data protection without misassigning infrastructure duties.

Key Concept

Cloud Shared Responsibility Model in PaaS and Community Cloud Deployments
Question 538Question →

A cybersecurity specialist at a hospital wants to receive sector-specific threat intelligence and exchange real-time attack indicators with peer healthcare entities. Which of the following sources best fulfills this requirement?

Show answer & explanation

Answer: Information Sharing and Analysis Center (ISAC)

Answer

Information Sharing and Analysis Center (ISAC)
Information Sharing and Analysis Centers (ISACs) are resources that facilitate sector-specific threat intelligence gathering and bilateral sharing between industry peers and sector partners.

Step-by-Step Solution

1
Identify the organizational requirement in the scenario.
The requirement calls for a collaborative platform to receive sector-specific intelligence and exchange indicators with industry peers.
Understanding the core need narrows down the appropriate intelligence source type.
2
Evaluate the available threat intelligence sources against sector-specific collaboration needs.
ISACs are designed specifically to facilitate trusted peer-to-peer threat sharing within specific industry sectors.
ISACs provide sector-focused context and actionable indicators shared among peer organizations.

Key Concept

Information Sharing and Analysis Centers (ISACs)
Question 539Question →

A security analyst is conducting forensic triage on several compromised endpoints following an enterprise network incident. Match each observed technical Indicator of Compromise (IoC) with its corresponding malware classification.

Click a left item, then click its matching right item

Items

Memory forensic analysis reveals Master Boot Record (MBR) modification and code execution prior to operating system kernel initialization.
An automated process silently uses high system GPU resources to perform hashing operations while communicating via the Stratum protocol.
System logs show periodic HTTP POST requests containing encrypted keyboard inputs and clipboard buffers sent to an external C2 server.
Volatile memory inspection reveals WMI scripts executing encoded commands injected into legitimate system processes without creating executable files on disk.

Matches

Show answer & explanation

Answer

1. MBR modification prior to kernel load corresponds to Bootkit. 2. GPU hashing with Stratum protocol corresponds to Cryptominer. 3. Encrypted keystroke/clipboard exfiltration corresponds to Spyware. 4. In-memory WMI execution without disk binaries corresponds to Fileless Malware.
Each malware classification is accurately paired with its primary technical artifact: MBR manipulation indicates a Bootkit, unauthorized GPU hashing over Stratum indicates a Cryptominer, covert keystroke/clipboard exfiltration indicates Spyware, and RAM-only script execution using native OS tooling indicates Fileless Malware.

Step-by-Step Solution

1
Analyze item 1: Execution occurring before OS kernel initialization via MBR modification.
Identify that malware affecting boot sectors prior to OS load is classified as a Bootkit.
Bootkits target the storage boot sector to hijack boot sequence control before security software initializes.
2
Analyze item 2: High GPU utilization performing hashing using the Stratum protocol.
Identify that unauthorized resource consumption for cryptographic hashing matches Cryptominer behavior.
Cryptojacking malware leverages target hardware to compute cryptographic proofs for financial gain via Stratum mining pools.
3
Analyze item 3: Capturing keystrokes and clipboard data for periodic outbound transmission.
Identify that telemetry logging user inputs matches Spyware (keylogger/stealer) characteristics.
Spyware covertly monitors user behavior and harvests credentials or private data.
4
Analyze item 4: Execution strictly within memory using WMI without creating disk files.
Identify that living-off-the-land techniques executing in memory correspond to Fileless Malware.
Fileless malware avoids detection by traditional file-based antivirus scanners by running directly in RAM through legitimate host processes.

Key Concept

Malware Types and Indicators of Compromise
Estimated Time:2m 0s
Question 540Question →

An e-commerce retailer is conducting a quantitative risk assessment for its primary inventory management database, which has an Asset Value (AVAV) of $250,000\$250,000. Security analysts estimate that a ransomware outbreak would impact 40%40\% of the system (EF=0.40EF = 0.40). Based on threat intelligence, such an attack is expected to occur once every 55 years (ARO=0.20ARO = 0.20). What is the Annual Loss Expectancy (ALEALE) associated with this risk?

Show answer & explanation

Answer: $20,000\$20,000

Answer

The Annual Loss Expectancy (ALEALE) is $20,000\$20,000.
The correct answer of $20,000\$20,000 is determined using the quantitative risk formula ALE=SLE×ARO=(AV×EF)×AROALE = SLE \times ARO = (AV \times EF) \times ARO. Multiplying an Asset Value of $250,000\$250,000 by an Exposure Factor of 0.400.40 gives an SLESLE of $100,000\$100,000. Multiplying $100,000\$100,000 by an AROARO of 0.200.20 results in an ALEALE of $20,000\$20,000.

Step-by-Step Solution

1
Calculate the Single Loss Expectancy (SLE)
SLE=AV×EF=$250,000×0.40=$100,000SLE = AV \times EF = \$250,000 \times 0.40 = \$100,000
SLE determines the estimated monetary impact each time the risk event occurs.
2
Calculate the Annual Loss Expectancy (ALE)
ALE=SLE×ARO=$100,000×0.20=$20,000ALE = SLE \times ARO = \$100,000 \times 0.20 = \$20,000
ALE converts the single incident loss expectancy into an annualized metric using the occurrence frequency.

Key Concept

Quantitative Risk Analysis (ALE Calculation)
Estimated Time:1m 30s
PreviousPage 27 / 112Next
All practice questions — CompTIA Security+ | Examkin