All practice questions

During a security review of a modern document processing web service, an analyst examines crash logs and source code after an unexpected service degradation. The backend endpoint accepts a JSON request containing a document rendering configuration. The service fetches remote custom template assets via HTTP based on a user-provided URL and parses binary header blocks into a fixed-size internal C-style buffer without checking the size of the incoming string. Log analysis reveals that an attacker submitted a payload pointing to $http://169.254.169.254/latest/meta-data/$ alongside a $4,096$-byte header string into a $512$-byte memory buffer, causing an application crash and sensitive cloud infrastructure credential exposure. Which of the following mitigation controls should the security team implement to remediate these specific software vulnerabilities? (Select TWO)

A system administrator tests a diagnostic page on an internal network dashboard that allows users to test ping utility responses by submitting an IP address. The web application passes the input string directly to a server-side shell script without sanitization. When the administrator inputs `127.0.0.1; cat /etc/passwd`, the output displays the server's user account database. Which of the following application vulnerabilities is present?

An enterprise security administrator needs to isolate public-facing web servers from the internal corporate network to ensure that external internet traffic cannot directly reach internal database servers. Which network design boundary should the administrator implement to host these public services?

A systems administrator is applying baseline security configurations to newly provisioned enterprise servers. To minimize the host attack surface, the administrator closes unneeded network ports and stops background services such as Telnet and FTP that are not required for business operations. Which of the following enterprise hardening practices is the administrator performing?

A security analyst reviews a vulnerability assessment report for legacy environmental monitoring sensors installed across a data center. The report reveals that the sensors transmit operational telemetry in cleartext using SNMPv1 with default community strings. The vendor confirms the embedded hardware cannot support firmware updates, protocol upgrade to SNMPv3, or host-level encryption. Which of the following architectural security controls represents the MOST effective mitigation to protect against internal eavesdropping and unauthorized control commands?

An enterprise security architect is designing a defense-in-depth framework across a multi-cloud environment. Match each cloud security technology on the left with its primary operational function on the right.

A United States software vendor hosts a cloud-based clinical trial management platform that collects personal data from research subjects located across European Union member states. All trial telemetry processed in the US data center is encrypted at rest using AES-256. However, the organization relies solely on standard commercial service agreements for cross-border data movement. Which of the following mechanisms is required under the General Data Protection Regulation (GDPR) to lawfully authorize this ongoing transfer of personal data to a third country lacking an adequacy decision?

A network security administrator monitoring enterprise switch logs notices that a single Media Access Control (MAC) address is rapidly alternating between two different physical switch ports. This constant port-flapping anomaly is causing frame misdirection across the local subnet. Which of the following attack types is most likely occurring?

An industrial manufacturing company needs to isolate its operational technology (OT) network controlling factory machinery from the corporate IT network. The security policy mandates complete physical separation with no logical network connections, wireless links, or shared switching hardware between the two environments. Which network design technique fulfills this requirement?

A cybersecurity incident response team at a global logistics and supply chain enterprise is analyzing four distinct security events across their logistics automation infrastructure. Match each security event description on the left with the most likely threat actor profile on the right.

A security analyst is reviewing an assessment report for a web application that identified a Cross-Site Request Forgery (CSRF) vulnerability in a user profile management module. Which of the following strategies directly mitigate this specific vulnerability? (Select TWO).

During an application security audit of a cloud-native microservices platform, an analyst inspects API logs for a customer profile service. The service accepts HTTP POST updates in JSON format. The analyst discovers that an attacker sent a modified JSON request payload containing an unadvertised field: `"is_admin": true`. The backend REST framework automatically instantiated the incoming JSON parameters directly into the internal user account object, successfully elevating the standard user's privileges without triggering any schema errors. Which software vulnerability is demonstrated in this scenario, and what primary remediation should developers implement?

An online gaming enterprise is transitioning its matchmaking service to a cloud provider's Function-as-a-Service (FaaS) event-driven architecture integrated with a managed API Gateway. As part of establishing the enterprise cloud security baseline, the lead architect must define operational boundaries under the shared responsibility model. Which of the following tasks remain the sole responsibility of the enterprise customer? (Select TWO.)

A Cyber Threat Intelligence (CTI) analyst is designing an integrated threat research and ingestion framework for an enterprise Security Operations Center (SOC). Match each threat intelligence source or transport mechanism on the left with the operational workflow requirement it directly fulfills on the right.

Match each network segmentation concept on the left with its defining implementation characteristics on the right. Which pairings correctly connect each segmentation technique to its primary description?

A security consultant is defining security testing methodologies for an organization's software development lifecycle (SDLC). Match each application security testing method to its corresponding operational characteristic.

A healthcare organization is updating its network architecture to secure legacy medical imaging endpoints (DICOM equipment) that cannot accept local security agents or operating system patches. The operational design requires these endpoints to stream telemetry outbound to an off-site analytics platform while allowing internal system administrators to perform maintenance. Which of the following network architecture and segmentation controls should the security team implement to isolate the legacy endpoints while satisfying operational requirements? (Select TWO.)

An enterprise security architect is evaluating system hardening controls to address findings from a comprehensive technical vulnerability audit. Match each enterprise hardening practice on the left to its corresponding primary risk mitigation objective on the right.

A security technician is tasked with implementing host-level hardening controls on enterprise web servers. Which of the following technical mitigation practices directly reduce the host's attack surface? (Select TWO.)

A healthcare software provider hosts its primary electronic health record (EHR) database within an on-premises data center while leveraging a public cloud Infrastructure as a Service (IaaS) environment for high-throughput batch analytics. The environments are linked via a dedicated direct network connection. During a security baseline review of the public cloud IaaS infrastructure, the security architect must clarify operational duties under the cloud shared responsibility model. Which of the following security controls remains the sole responsibility of the healthcare software provider within the public cloud IaaS segment?