Examkin

All practice questions

378 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 41Question →

Match each technical host telemetry artifact and indicator of compromise with its corresponding malware classification.

Click a left item, then click its matching right item

Items

Kernel callback object modification paired with active process unlinking via Direct Kernel Object Manipulation (DKOM) in kernel memory structures.
Persistent WMI event subscription executing an obfuscated PowerShell payload directly in RAM via reflective DLL injection without writing binary files to disk.
System process executing commands to disable volume shadow copies while recursively encrypting specific file headers using AES-GCM algorithms.
Dormant code segment embedded in a legitimate application that monitors Active Directory domain controller time and executes a destructive payload upon reaching a specified date.

Matches

Show answer & explanation

Answer

Kernel memory modification via DKOM matches Kernel-level Rootkit; WMI persistent memory injection matches Fileless Malware; cryptographic file encryption and shadow copy deletion match Ransomware; condition-triggered dormant execution matches Logic / Time Bomb.
Each malware classification is accurately paired with its distinct technical operational footprint: kernel rootkits modify core OS memory structures via Ring 0 privileges; fileless malware executes in RAM without traditional disk artifacts; ransomware inhibits host recovery while encrypting data storage; and logic/time bombs depend on specific environmental triggers.

Step-by-Step Solution

1
Analyze the telemetry artifact describing kernel memory manipulation and hidden execution pathways.
Identified DKOM and kernel callbacks operating in Ring 0 context.
Rootkits at the kernel layer modify OS data structures to evade detection.
2
Analyze the telemetry artifact referencing non-disk execution mechanisms.
Identified WMI persistence and reflective RAM injection.
Fileless malware relies on living-off-the-land techniques and memory resident code execution.
3
Evaluate indicators of data unavailability combined with recovery inhibitor commands.
Identified AES-GCM encryption paired with volume shadow copy purge.
Ransomware actively prevents recovery while denying access to user data.
4
Evaluate the trigger-based execution criteria.
Identified date-based execution criteria within dormant host code.
Logic and time bombs require specified pre-conditions before detonating.

Key Concept

Distinguishing Malware Categories via Technical Telemetry and Indicators of Compromise
Question 42Question →

A security analyst is defining standard testing procedures for an enterprise vulnerability management program. Match each security assessment method to its corresponding operational description.

Click a left item, then click its matching right item

Items

Passive Vulnerability Scanning
Credentialed Vulnerability Scanning
Dynamic Application Security Testing (DAST)
Static Application Security Testing (SAST)

Matches

Show answer & explanation

Answer

Passive Vulnerability Scanning corresponds to monitoring network traffic silently without probes. Credentialed Vulnerability Scanning corresponds to logging into target systems with valid accounts to audit configuration and patches. Dynamic Application Security Testing (DAST) corresponds to testing a running application by sending simulated malicious requests. Static Application Security Testing (SAST) corresponds to analyzing source code or binaries offline without code execution.
Each assessment method is paired according to its execution environment and access model: Passive scanning observes network traffic without active probing; Credentialed scanning uses valid host credentials for accurate internal assessment; DAST tests live applications at runtime; SAST analyzes unexecuted source code or binaries.

Step-by-Step Solution

1
Differentiate network-level scanning approaches (passive vs. credentialed active).
Identify that non-intrusive traffic capture maps to passive scanning, while authenticated endpoint auditing maps to credentialed scanning.
Passive scanning relies on packet sniffing, whereas credentialed scanning logs into host operating systems.
2
Differentiate application security testing techniques (SAST vs. DAST).
Identify that SAST operates on source code/binaries statically before execution, whereas DAST operates dynamically on running web applications.
SAST requires access to code without running it, while DAST evaluates real-time HTTP requests and server responses during execution.

Key Concept

Vulnerability Assessment and Security Testing Methods
Question 43Question →

An organization is conducting a baseline security audit of its internal servers and infrastructure. Match each identified host or architecture vulnerability on the left with its corresponding primary risk on the right.

Click a left item, then click its matching right item

Items

Legacy / End-of-Life Operating System
Open Unnecessary Network Ports
Default Factory Credentials
Unquoted Windows Service Path

Matches

Show answer & explanation

Answer

Legacy / End-of-Life Operating System pairs with absence of vendor security patches; Open Unnecessary Network Ports pairs with unintended expansion of the system attack surface; Default Factory Credentials pairs with high susceptibility to initial unauthorized access using publicly known passwords; Unquoted Windows Service Path pairs with potential for local privilege escalation.
Each host and infrastructure vulnerability directly correlates to its primary risk: unsupported operating systems suffer from a lack of vendor security patches, open ports expand the host network attack surface, default credentials enable trivial authentication bypass, and unquoted service paths enable local privilege escalation.

Step-by-Step Solution

1
Analyze each host and network architecture vulnerability term.
Identify the distinct risk vector introduced by each misconfiguration or unsupported system state.
Host vulnerabilities stem from unpatched software, excessive running services, weak authentication defaults, or file path misconfigurations.
2
Match each vulnerability directly to its primary security consequence.
EOL software corresponds to missing vendor patches; open listening ports correspond to expanded attack surface; default passwords correspond to unauthorized credential access; unquoted service paths correspond to local privilege escalation.
Aligning specific host vulnerabilities with their corresponding exploit mechanics allows proper risk assessment and remediation prioritization.

Key Concept

Host, Network, and Architecture Vulnerabilities
Question 44Question →

Match each threat actor category with its defining attribute or primary motivation.

Click a left item, then click its matching right item

Items

Nation-State Actor
Hacktivist
Insider Threat
Script Kiddie

Matches

Show answer & explanation

Answer

Nation-State Actor matches with highly sophisticated, extensively funded, and focused on long-term geopolitical espionage; Hacktivist matches with driven by political, social, or ideological goals; Insider Threat matches with possesses legitimate, authorized access; Script Kiddie matches with unskilled individual who executes pre-made automated tools.
Nation-state actors are backed by sovereign government resources focused on covert espionage. Hacktivists carry out disruption or defacement for ideological reasons. Insider threats leverage authorized internal privileges. Script kiddies rely on automated exploit kits due to limited personal coding capability.

Step-by-Step Solution

1
Analyze the primary attributes, resources, and motivations that define each threat actor category.
Identified nation-state actors by state resources/espionage, hacktivists by political intent, insiders by legitimate credentials/access, and script kiddies by lack of technical sophistication.
CompTIA Security+ distinguishes threat actors based on sophistication, funding, intent, and access.
2
Pair each threat actor on the left with its corresponding description on the right.
All four threat actor types are accurately paired with their core defining traits.
Validates proper classification against standard threat intelligence taxonomy.

Key Concept

Threat Actor Types and Attributes
Question 45Question →

Match each malware classification to its primary characteristic or technical indicator.

Click a left item, then click its matching right item

Items

Ransomware
Keylogger
Logic Bomb
Rootkit

Matches

Show answer & explanation

Answer

Ransomware matches with encrypting target system data for payment; Keylogger matches with capturing user keystrokes; Logic Bomb matches with lying dormant until specific trigger conditions occur; Rootkit matches with operating at a deep system level to hide unauthorized processes.
Each malware term correctly maps to its defining characteristics: Ransomware locks files for payment, Keyloggers capture keystroke data, Logic Bombs detonate under preset conditions, and Rootkits manipulate operating system routines to evade detection.

Step-by-Step Solution

1
Analyze each malware type on the left
Identified Ransomware, Keylogger, Logic Bomb, and Rootkit.
Each malware type exhibits distinct behavior and indicators of compromise.
2
Map each malware category to its corresponding operational mechanism
Ransomware locks/encrypts files for extortion; Keylogger intercepts keystrokes; Logic Bomb triggers on condition; Rootkit hides deeply within the OS.
Matching technical behaviors to malware definitions provides clear identification during incident analysis.

Key Concept

Malware Types and Indicators of Compromise
Question 46Question →

A security operations team is implementing an active defense strategy across a enterprise network to detect lateral movement and credential theft. Match each deception technology implementation on the left with its corresponding active defense classification on the right.

Click a left item, then click its matching right item

Items

Injecting fake database connection strings into endpoint memory to alert security teams when dumped by malware
Deploying an interconnected subnet of intentionally vulnerable virtual machines simulating a corporate Active Directory infrastructure
Placing an attractive financial audit spreadsheet on a shared network drive embedded with an invisible phone-home beacon
Adding false DNS records and browser history entries to endpoint hosts to steer network scanners toward a monitoring gateway

Matches

Show answer & explanation

Answer

Matching pairs: Endpoint memory strings -> Honeytoken; Interconnected virtual subnet -> Honeynet; Financial audit spreadsheet -> Honeyfile; False DNS records and browser entries -> Breadcrumb.
Each deception technology fulfills a distinct operational role in active defense strategy. Honeytokens are data-level artifacts such as fake keys or connection strings. Honeynets provide comprehensive, multi-system network decoys to observe attacker behavior. Honeyfiles rely on fake documents containing tracking mechanisms. Breadcrumbs consist of host artifacts configured on active production systems to guide threat actors into deceptive environments.

Step-by-Step Solution

1
Analyze each deception deployment scenario by evaluating its deployment layer (data, host, document, network).
Identified specific active defense controls based on structural characteristics.
Deception technologies are classified by whether they represent network segments, decoy files, isolated data elements, or directional lures.
2
Differentiate between host-level directional lures and standalone digital tokens.
Paired endpoint memory injection with honeytoken and false DNS/browser history entries with breadcrumb.
Honeytokens are passive digital data traps, whereas breadcrumbs are directional artifacts specifically placed on legitimate host endpoints to lure attackers away from real assets.
3
Differentiate between decoy files and multi-system infrastructure decoys.
Paired the beaconed spreadsheet with honeyfile and the simulated AD subnet with honeynet.
A honeyfile is a single deceptive data container, whereas a honeynet comprises multiple decoy systems operating together.

Key Concept

Deception and Disruption Technologies
Question 47Question →

A enterprise security operation center (SOC) analyst is categorizing threat actors and attack vectors identified during a comprehensive threat landscape assessment. Match each threat actor type or attack vector on the left with its primary operational attribute or delivery mechanism on the right.

Click a left item, then click its matching right item

Items

Shadow IT
Advanced Persistent Threat (APT)
Software Supply Chain Attack
Insider Threat

Matches

Show answer & explanation

Answer

Shadow IT matches with introducing unapproved software/hardware without IT oversight. Advanced Persistent Threat (APT) matches with high resource capability, stealth, and geopolitical motivations. Software Supply Chain Attack matches with injecting malicious code into trusted third-party updates. Insider Threat matches with leveraging legitimate access rights to exfiltrate data.
Shadow IT is characterized by unauthorized applications or services deployed without IT department knowledge or approval. An APT (Advanced Persistent Threat) is characterized by nation-state funding, extreme sophistication, and persistent stealthy intelligence gathering. A Software Supply Chain attack compromises trusted vendor software build systems to push malicious code into updates. An Insider Threat relies on legitimate access rights granted to an employee, contractor, or partner to bypass perimeter controls.

Step-by-Step Solution

1
Analyze threat actor profiles and operational attributes.
Differentiate nation-state actors (APTs) driven by geopolitical goals from internal personnel (insider threats) possessing authorized credentials.
Threat actors are categorized by funding, sophistication, intent, and access levels.
2
Evaluate attack vector mechanisms.
Distinguish between third-party software supply chain distribution mechanisms and internal deployment of unauthorized infrastructure (Shadow IT).
Vectors specify how access is initially gained or expanded within an target infrastructure.
3
Align each left-side concept with its definitive right-side attribute.
Pair Shadow IT to unapproved systems, APT to nation-state stealth/resources, Supply Chain to compromised upstream software updates, and Insider Threat to legitimate privilege misuse.
Matches align directly with CompTIA Security+ threat taxonomy definitions.

Key Concept

Threat Actor Attributes and Attack Vector Characteristics
Question 48Question →

Match each organizational security management requirement to the cloud service model where the customer retains primary operational responsibility for implementing that control.

Click a left item, then click its matching right item

Items

Configuring guest operating system firewall rules and applying OS security patches on virtual machine instances.
Managing application source code security and configuring database user authorization schemas in a managed database environment.
Configuring user access permissions, multi-factor authentication policies, and data classification tags within a hosted enterprise email service.
Writing stateless function code and configuring execution trigger bindings without managing container runtimes or underlying OS hosts.

Matches

Show answer & explanation

Answer

Under the cloud shared responsibility model: OS patching and host firewall configuration fall under Infrastructure as a Service (IaaS); application code and database schema management fall under Platform as a Service (PaaS); identity governance, access policies, and data classification in hosted applications fall under Software as a Service (SaaS); and stateless function logic with trigger permissions falls under Function as a Service (FaaS / Serverless).
Each deployment model dictates a different division of security controls between cloud service providers (CSPs) and enterprise tenants according to the cloud shared responsibility framework. Moving from IaaS to PaaS, SaaS, and FaaS progressively shifts infrastructure, OS, and runtime platform operational duties to the provider, while data governance and identity authorization remain customer responsibilities across all service models.

Step-by-Step Solution

1
Analyze the scope of responsibility for guest operating systems and network firewalls.
Identify that managing OS patches and guest firewalls requires access at the OS abstraction layer, placing responsibility on the customer in IaaS.
IaaS provides raw compute resources where the provider handles physical and hypervisor layers, leaving OS administration to the tenant.
2
Evaluate the management boundary for database schema configurations and application code on managed platforms.
Determine that application logic and database schema permissions fall under PaaS customer responsibilities.
PaaS abstracts the underlying OS and database engine maintenance, allowing customers to focus on custom code and data schema security.
3
Assess enterprise user access control and data classification in hosted email applications.
Map hosted end-user application identity and data access controls to SaaS.
SaaS providers manage the entire application infrastructure, leaving only data access, identity management, and endpoint security to the customer.
4
Identify event-driven stateless function execution security responsibilities.
Match function logic and trigger configurations to FaaS / Serverless.
FaaS eliminates container and server administration for the customer, isolating their responsibility to the uploaded code and trigger events.

Key Concept

Cloud Shared Responsibility Model Across Service Delivery Models
Question 49Question →

A cybersecurity team is establishing security testing procedures across various stages of an enterprise application lifecycle and infrastructure deployment. Match each security testing method on the left with its corresponding operational characteristic or execution scenario on the right.

Click a left item, then click its matching right item

Items

Static Application Security Testing (SAST)
Dynamic Application Security Testing (DAST)
Credentialed Vulnerability Scanning
Passive Network Vulnerability Scanning

Matches

Show answer & explanation

Answer

Static Application Security Testing (SAST) pairs with inspecting source code at rest without execution. Dynamic Application Security Testing (DAST) pairs with testing live running applications from an external perspective. Credentialed Vulnerability Scanning pairs with using local system authentication rights to inventory patch levels. Passive Network Vulnerability Scanning pairs with non-intrusive traffic monitoring via SPAN or TAP interfaces.
Each testing method is paired with its defining operational characteristic: SAST analyzes unexecuted source code; DAST tests active applications dynamically; credentialed scanning authenticates locally to check internal patch levels; passive scanning sniffs network traffic non-intrusively without generating network probes.

Step-by-Step Solution

1
Differentiate between static and dynamic application security testing approaches.
SAST operates on non-running source code or binaries early in the SDLC, whereas DAST requires a live running application to simulate runtime attacks.
SAST is a white-box code inspection technique, whereas DAST is a black-box runtime evaluation technique.
2
Differentiate between credentialed active scanning and passive network monitoring.
Credentialed scanning logs directly into operating systems to evaluate configuration state, while passive scanning observes packet flows via network TAPs/SPAN ports without sending traffic.
Credentialed scans minimize false positives by accessing internal host details, whereas passive scans avoid disrupting sensitive operational networks.

Key Concept

Vulnerability Assessment and Security Testing Methods
Estimated Time:2m 0s
Question 50Question →

System telemetry and forensic logs from four compromised endpoints within an enterprise environment reveal distinct technical indicators of compromise (IoCs). Match each observed technical indicator on the left with its correct malware classification on the right.

Click a left item, then click its matching right item

Items

An automated database trigger configured to execute a destructive `DROP TABLE` command if a specific payroll user ID remains inactive in the user directory for 30 consecutive days.
An unpatched server generating widespread lateral SMB scan traffic across adjacent subnets and autonomously executing remote exploit payloads on vulnerable endpoints without credential access or human intervention.
An obfuscated PowerShell script retrieved directly from a persistent registry binary blob and executed strictly inside legitimate system memory (`svchost.exe`) without staging binary files to disk.
A customized system driver executing at privilege level Ring 0 that alters Direct Kernel Object Manipulation (DKOM) structures to suppress specific running process IDs from Task Manager and system auditing utilities.

Matches

Show answer & explanation

Answer

The database trigger condition matches Logic Bomb; autonomous network SMB scanning matches Network Worm; script execution from registry to memory matches Memory-Resident Payload; kernel driver manipulation of process structures matches Kernel Rootkit.
Each indicator uniquely aligns with key malware behaviors: time/event triggers correspond to logic bombs; automated subnet propagation corresponds to worms; in-memory non-disk script execution corresponds to memory-resident payloads; and kernel-level object manipulation (DKOM) to mask processes corresponds to rootkits.

Step-by-Step Solution

1
Analyze the condition-based database trigger indicator.
Identified a dormant malicious script tied to user account status.
Code designed to initiate destructive actions upon specific logical triggers is classified as a logic bomb.
2
Analyze autonomous subnet scanning and SMB payload delivery.
Identified self-propagating network behavior without user interaction.
Malware capable of autonomous replication across network services is classified as a network worm.
3
Analyze in-memory execution via PowerShell and registry binary storage.
Identified complete avoidance of physical binary file storage on host disks.
Malware executing directly within volatile memory and using non-standard file system locations to avoid disk detection is memory-resident/fileless malware.
4
Analyze kernel-level modification (Ring 0 / DKOM) suppressing process visibility.
Identified low-level operating system hooks designed to mask malicious processes from administrative tools.
Software operating with kernel privileges to conceal system artifacts and maintain root access is classified as a rootkit.

Key Concept

Malware Types and Technical Indicators of Compromise
Estimated Time:2m 0s
Question 51Question →

A security analyst is performing host and network triage following a security incident. Match each technical indicator of compromise (IoC) artifact to the correct malware classification.

Click a left item, then click its matching right item

Items

Outbound encrypted command traffic on port 443 originating from an executable launched out of `C:\Users\Public\Downloads\` paired with active reverse RDP tunneling.
Modifications to the Master Boot Record (MBR) executed prior to OS kernel initialization, hiding underlying system process structures from API calls.
An embedded SQL database trigger scheduled to automatically overwrite financial records when an employee ID is removed from the active personnel table.
Unscheduled mass file renaming to `.locked` extensions accompanied by rapid CPU utilization spikes and symmetrical encryption key generation in memory.

Matches

Show answer & explanation

Answer

The telemetry artifacts match their malware classifications as follows: Unauthorized interactive connection and tunneling from abnormal paths corresponds to Remote Access Trojan; pre-boot environment modification and cloaking corresponds to Bootkit; event-triggered malicious database operations correspond to Logic Bomb; and automated bulk file encryption corresponds to Ransomware.
Each artifact presents unambiguous indicators of distinct malware categories: execution from user-writable directories establishing interactive tunnels points to a Remote Access Trojan; pre-kernel boot sector modifications define a Bootkit; condition-triggered malicious database logic represents a Logic Bomb; and automated mass file encryption with appended extensions defines Ransomware.

Step-by-Step Solution

1
Analyze the technical indicators present in each host/network artifact.
Identified four distinct behavior profiles: interactive command tunneling, pre-OS boot sector modification, conditional database trigger, and rapid file payload encryption.
Technical indicators of compromise reveal the operational objectives and execution phases of distinct malware families.
2
Correlate each operational profile to standard malware taxonomy definitions.
Mapped interactive remote access indicators to RAT, MBR hooks to Bootkit, condition-based execution to Logic Bomb, and mass file encryption to Ransomware.
Accurate categorization enables targeted containment and eradication during incident response triage.

Key Concept

Malware Classifications and Technical Indicators of Compromise (IoC)
Question 52Question →

A security posture assessment identified several vulnerability findings across an enterprise environment. Match each vulnerability finding on the left to its corresponding infrastructure exposure category on the right.

Click a left item, then click its matching right item

Items

Default administrative credentials remaining enabled on network-attached security cameras
Transmission of cleartext management traffic using unencrypted SNMPv1
Unpatched kernel memory flaw on a legacy server operating system past its end-of-life date
Permissive security group rule allowing inbound public access to a database listener port

Matches

Show answer & explanation

Answer

Default camera credentials map to Embedded / IoT System Vulnerability; SNMPv1 cleartext management traffic maps to Network Protocol Weakness; unpatched legacy kernel flaw maps to Host Operating System Vulnerability; public database security group rule maps to Cloud Infrastructure Misconfiguration.
Each vulnerability finding aligns with a specific architecture category. Factory credentials on IP cameras affect embedded IoT devices. Cleartext SNMPv1 represents an insecure legacy network protocol. Kernel vulnerabilities on unpatched operating systems target host platforms. Publicly accessible cloud security group rules represent cloud resource misconfigurations.

Step-by-Step Solution

1
Analyze the technical layer affected by each finding.
Identify whether the issue stems from hardware/firmware, network protocols, operating system software, or virtual network policy controls.
Different vulnerabilities require distinct remediation strategies based on their architectural layer.
2
Match embedded hardware and protocol risks.
Default camera passwords map to Embedded / IoT System Vulnerability, and SNMPv1 cleartext traffic maps to Network Protocol Weakness.
IoT devices frequently suffer from default credential issues, while legacy management protocols lack transit encryption.
3
Match operating system and virtual access control risks.
Kernel bugs map to Host Operating System Vulnerability, and open port rules map to Cloud Infrastructure Misconfiguration.
Kernel patches apply directly to host OS instances, whereas security group rules govern access boundaries in cloud environments.

Key Concept

Host, Network, and Architecture Vulnerabilities
Question 53Question →

A senior security engineering team is formalizing an enterprise security assessment policy spanning corporate workstations, custom web microservices, software build pipelines, and sensitive industrial control network segments. Match each security testing methodology on the left to the operational execution characteristic on the right that correctly defines its technical application.

Click a left item, then click its matching right item

Items

Credentialed Vulnerability Assessment
Dynamic Application Security Testing (DAST)
Static Application Security Testing (SAST)
Passive Network Vulnerability Monitoring

Matches

Show answer & explanation

Answer

Credentialed Vulnerability Assessment matches with internal remote host configuration auditing via OS management protocols; Dynamic Application Security Testing (DAST) matches with black-box runtime application fault injection; Static Application Security Testing (SAST) matches with non-executing source code/binary analysis; Passive Network Vulnerability Monitoring matches with non-intrusive traffic packet analysis via mirrored ports.
Each security testing technique is accurately paired based on its operational state and execution mechanics: Credentialed assessment queries host internals via logged-in OS protocols; DAST tests live running application web endpoints; SAST inspects uncompiled source code statically; Passive network monitoring listens to mirrored packet traffic asynchronously.

Step-by-Step Solution

1
Analyze host assessment methodologies for privilege usage
Identified Credentialed Vulnerability Assessment as requiring elevated user privileges to inspect local OS registries and missing patches via remote management protocols.
Authentic internal auditing requires credentials to bypass external firewall boundaries and query host internals directly.
2
Differentiate application security testing modes (SAST vs DAST)
Matched SAST to static non-running code analysis in build pipelines, and DAST to active runtime black-box testing against executing web interfaces.
SAST evaluates code structure before deployment, whereas DAST evaluates application runtime response and input validation under execution.
3
Evaluate non-intrusive network testing techniques for fragile environments
Matched Passive Network Vulnerability Monitoring with mirrored traffic packet inspection without active packet injection.
Passive monitoring relies on SPAN/TAP packet captures, preventing active network scans from crashing sensitive OT/ICS controllers.

Key Concept

Vulnerability Assessment and Security Testing Methods
Question 54Question →

A security analyst is performing a comprehensive assessment across an enterprise environment. Match each host, network, or infrastructure vulnerability scenario observed during the assessment to its corresponding vulnerability category.

Click a left item, then click its matching right item

Items

A web application proxy hosted on a cloud server allows external requests to fetch internal resources, enabling unauthorized retrieval of IAM role credentials from http://169.254.169.254.
An internal operational technology (OT) host on an industrial network crashes regularly because an application repeatedly requests dynamic heap memory without releasing unused memory blocks.
An enterprise network switch maintains an unencrypted management interface exposing cleartext administrative credentials and allowing unauthenticated firmware updates.
An internal database server containing sensitive employee records is reachable directly from the corporate Wi-Fi subnet without any intervening firewall or access control restrictions.

Matches

Show answer & explanation

Answer

Each scenario maps directly to its underlying architectural or host vulnerability: 1) Cloud proxy credential access maps to Cloud Instance Metadata Service (IMDS) Exposure; 2) Application memory failure maps to Host Resource Exhaustion via Memory Leak; 3) Unencrypted switch management maps to Insecure Embedded System Management Interface; 4) Unrestricted database access from Wi-Fi maps to Missing Network Segmentation and Microsegmentation Controls.
Each scenario correctly isolates a distinct domain of host and network vulnerabilities. Cloud metadata endpoints (169.254.169.254) reflect cloud architecture host vulnerabilities; memory management bugs lead to host resource exhaustion; legacy/unencrypted switch interfaces represent embedded management vulnerabilities; and unrestricted inter-subnet access highlights network architecture segmentation deficiencies.

Step-by-Step Solution

1
Analyze the cloud proxy scenario
Identified the IP address 169.254.169.254 as the link-local address for cloud instance metadata services
Requesting metadata via an exposed application proxy exposes internal role credentials through IMDS vulnerability.
2
Analyze the OT application crash scenario
Identified unreleased dynamic heap allocations causing system instability
Failure to release allocated memory constitutes a memory leak leading to host resource exhaustion.
3
Analyze the enterprise network switch scenario
Identified unencrypted management interfaces and unauthenticated firmware options
Network appliances and hardware management consoles with insecure communication protocols suffer from insecure embedded management interfaces.
4
Analyze the database network path scenario
Identified direct connectivity from wireless user subnets to sensitive database servers
Lack of network boundaries between standard client subnets and critical host assets indicates missing network segmentation.

Key Concept

Classification and identification of host, network, and cloud infrastructure vulnerabilities.
Question 55Question →

Match each enterprise technical assessment finding to its primary host, network, or architecture vulnerability classification.

Click a left item, then click its matching right item

Items

An assessment of an industrial gateway reveals an unpatched memory corruption flaw within the embedded Real-Time Operating System (RTOS) kernel microcode.
A network packet capture across internal management VLANs shows administrator credentials and system configurations being polled over unencrypted SNMPv1 and HTTP protocols.
A cloud security audit flags a production database security group configured with an ingress rule allowing unrestricted traffic from 0.0.0.0/0 on port 5432.
A security audit on a shared compute platform demonstrates that speculative execution side-channel flaws allow a malicious guest virtual machine to read kernel memory space from co-located tenant VMs.

Matches

Show answer & explanation

Answer

The embedded RTOS microcode flaw matches Embedded System and Microcode Firmware Vulnerability; cleartext SNMPv1 and HTTP traffic matches Cleartext Administrative Protocol and Insecure Transport Weakness; database security group access from 0.0.0.0/0 matches Cloud Security Group Misconfiguration and Inadequate Perimeter Isolation; cross-VM speculative execution leakage matches Virtualization Multi-Tenancy Breakdown and Hardware Side-Channel Vulnerability.
Each scenario targets a specific vulnerability domain: embedded microcode bugs represent host/firmware issues; cleartext management protocols represent transport vulnerabilities; over-permissive cloud rules represent infrastructure misconfigurations; and CPU side-channels represent virtualization isolation failures.

Step-by-Step Solution

1
Analyze the embedded RTOS finding.
Identified as a specialized OS/firmware flaw running on hardware control units.
Embedded systems often run lightweight RTOS kernels with firmware vulnerabilities requiring vendor microcode updates.
2
Analyze the SNMPv1 and HTTP packet capture finding.
Identified as insecure network transport exposing sensitive administrative telemetry in cleartext.
SNMPv1 lacks encryption and strong authentication, and HTTP transmits data unencrypted over TCP port 80.
3
Analyze the cloud database security group finding.
Identified as an over-permissive infrastructure rule causing public exposure.
Permitting 0.0.0.0/0 ingress to database services violates network microsegmentation and zero-trust perimeter isolation principles.
4
Analyze the cross-VM memory leakage finding.
Identified as a hypervisor multi-tenancy isolation failure rooted in hardware microarchitecture side-channels.
Speculative execution vulnerabilities bypass CPU boundary protections to read memory across virtualized isolation boundaries.

Key Concept

Host, Network, and Architecture Vulnerability Categorization
Question 56Question →

During a comprehensive threat landscape assessment for a global logistics management enterprise, the security operations team identified four distinct threat threat actor profiles active against the organization's ecosystem. Match each threat actor incident profile on the left with its defining combination of attributes, intent, and primary attack vector on the right.

Click a left item, then click its matching right item

Items

Incident Profile 1: A covert adversary maintains prolonged, undetected access within the build pipeline of a shipping telematics software vendor, modifying firmware binaries prior to distribution to gather geopolitical movement data without disruption.
Incident Profile 2: A syndicate leverages compromised third-party contractor credentials and unpatched edge VPN vulnerabilities to encrypt core logistics database clusters, demanding a multimillion-dollar cryptocurrency payment.
Incident Profile 3: A senior database administrator exfiltrates proprietary route-optimization source code and client PII directly to an unapproved personal cloud repository shortly after a performance review.
Incident Profile 4: A loose coalition conducts a large-scale volumetric DDoS attack against public-facing tracking portals while defacing marketing sites to protest corporate fuel consumption policies.

Matches

Show answer & explanation

Answer

Incident Profile 1 matches the Nation-State / APT attributes (software supply chain vector, extreme sophistication, espionage intent); Incident Profile 2 matches Organized Crime attributes (financial extortion, perimeter VPN and credential vectors); Incident Profile 3 matches Insider Threat attributes (legitimate internal privilege, personal grievance intent, direct exfiltration vector); Incident Profile 4 matches Hacktivist attributes (ideological intent, public availability disruption and defacement vectors).
Matching each incident profile requires evaluating the specific alignment between threat actor motivations (espionage, financial gain, personal grievance, ideological publicity), resource levels (state-funded, commercial extortion syndicate, internal privilege, public botnet resources), and vector types (supply chain code injection, perimeter VPN credential exploitation, internal authorized exfiltration, public web DDoS/defacement).

Step-by-Step Solution

1
Analyze Incident Profile 1 for key indicators of actor type, intent, sophistication, and vector.
The profile involves silent software pipeline manipulation, custom firmware modifications, long-term intelligence gathering, and high stealth, which are definitive hallmarks of a Nation-State / Advanced Persistent Threat (APT) using a supply chain vector.
Nation-state threat actors possess the resources and sophistication required to execute complex supply chain compromise campaigns for geopolitical espionage.
2
Analyze Incident Profile 2 for motivation and vector.
The profile highlights double-extortion ransomware and multi-million dollar ransom demands via compromised credentials and edge vulnerabilities, matching an Organized Crime syndicate.
Organized crime actors prioritize monetary gain and leverage high-yield extortion techniques over unpatched remote access infrastructures.
3
Analyze Incident Profile 3 to evaluate access level and motive.
The profile indicates a database administrator taking proprietary data post-performance review via personal storage, representing an Insider Threat.
Insider threats possess legitimate system credentials and bypass perimeter defenses entirely, often acting on personal grievances or financial incentives.
4
Analyze Incident Profile 4 for political/social intent and disruption vectors.
The profile describes public web defacement and DDoS attacks stemming from environmental protests, matching a Hacktivist collective.
Hacktivists aim to make political or social statements by targeting public visibility and availability rather than monetary theft.

Key Concept

Threat Actor Classifications, Attributes, and Attack Vector Alignments
Question 57Question →

Match each active deception technology component on the left with its corresponding operational implementation function on the right.

Click a left item, then click its matching right item

Items

Honeytoken
Honeynet
Honeyfile
Breadcrumb

Matches

Show answer & explanation

Answer

Honeytoken pairs with simulated credential or API key; Honeynet pairs with high-interaction network segment of decoy systems; Honeyfile pairs with enticing decoy document on an audited file share; Breadcrumb pairs with client-side artifact planted to direct attackers toward decoy infrastructure.
Each deception technology matches its specific deployment role: Honeytokens represent fake credentials or data elements; Honeynets constitute multi-host decoy network environments; Honeyfiles are audited decoy documents; and Breadcrumbs serve as endpoint lure artifacts that steer threat actors toward decoy assets.

Step-by-Step Solution

1
Identify the data-centric deception element intended for credential/data harvesting detection.
Associate Honeytoken with fake credentials, database entries, or API keys embedded in production repositories.
Honeytokens focus specifically on monitoring unauthorized usage of non-production data values.
2
Differentiate macro-level network decoy environments from single-host artifacts.
Associate Honeynet with the complete simulated network segment containing multiple decoy systems.
Honeynets provide multi-system telemetry to observe broad attack vectors and lateral movement techniques.
3
Distinguish between monitored document files and endpoint redirection lures.
Associate Honeyfile with decoy documents stored on file shares, and Breadcrumb with host-level artifacts that direct attackers to honeypots.
Honeyfiles monitor data access directly, whereas breadcrumbs manipulate adversary reconnaissance paths on host systems.

Key Concept

Deception and Disruption Technologies in Active Defense Architecture
Question 58Question →

During a comprehensive enterprise security architecture assessment of a cloud-native platform, an auditor identified several critical cryptographic and security control deficiencies across different operational subsystems. Match each identified security deficiency on the left with its corresponding root cause vulnerability or architectural flaw on the right.

Click a left item, then click its matching right item

Items

A legacy API gateway accepting incoming TLS 1.0 connections using 3DES in cipher block chaining (CBC) mode with SHA-1 signatures.
An internal identity provider accepting JWT authentication tokens signed with asymmetric public keys evaluated under symmetric HMAC algorithms.
A microservices application cluster relying exclusively on corporate IP subnet filtering for service-to-service access without end-to-end identity checks.
An enterprise certificate authority storing root private keys directly on a standard server OS filesystem protected only by local DACLs.

Matches

Show answer & explanation

Answer

The 3DES TLS gateway matches the Sweet32 collision weakness; the identity provider key mismatch matches the algorithm confusion vulnerability; the IP subnet microservices restriction matches the implicit perimeter reliance defect; and the Root CA key on filesystem matches the insecure key management lacking HSM protection.
Each security weakness is mapped to its underlying technical vulnerability: 3DES CBC and SHA-1 suffer from collision flaws (Sweet32); JWT public key verification under HMAC leads to algorithm confusion forgery; IP-based microservice boundaries suffer from perimeter-reliance defects; and software filesystem storage of Root CA keys represents weak key management lacking HSM protection.

Step-by-Step Solution

1
Analyze the cryptographic cipher flaws in the legacy TLS configuration.
Identify that 3DES uses 64-bit blocks vulnerable to Sweet32 collision attacks and SHA-1 is cryptographically broken.
64-bit block ciphers in CBC mode expose session keys to collision attacks after approximately 32 GB of data.
2
Evaluate the authentication token key misconfiguration.
Recognize key confusion where public keys are treated as symmetric secrets to forge signatures.
In algorithm confusion attacks (e.g., RS256 swapped to HS256), the receiver verifies an HMAC using the public key, enabling signature forgery.
3
Examine the network segment access control strategy for microservices.
Identify perimeter reliance and failure to enforce Zero Trust microsegmentation and mutual TLS (mTLS).
Subnet IP checks create implicit trust zones susceptible to IP spoofing and lateral movement.
4
Review the PKI root private key storage mechanism.
Classify software-based private key storage without hardware isolation as inadequate key protection.
Root CA private keys require specialized cryptographic hardware (HSMs) to prevent unauthorized exfiltration.

Key Concept

Cryptographic and Security Control Weaknesses
Question 59Question →

Match each cloud computing service model to the primary architectural boundary managed by the cloud service provider.

Click a left item, then click its matching right item

Items

Infrastructure as a Service (IaaS)
Platform as a Service (PaaS)
Software as a Service (SaaS)

Matches

Show answer & explanation

Answer

Infrastructure as a Service (IaaS) matches physical hardware, facilities, core networking, and hypervisor virtualization layer; Platform as a Service (PaaS) matches underlying infrastructure, operating system, middleware, and application runtime environment; Software as a Service (SaaS) matches complete software application stack, application maintenance, platform, and underlying infrastructure.
Each cloud service model defines a distinct demarcation point under the shared responsibility model. Infrastructure as a Service (IaaS) limits provider management to physical facilities and hardware virtualization. Platform as a Service (PaaS) extends provider control to the operating system and runtime environment. Software as a Service (SaaS) places responsibility for the entire application stack on the cloud provider.

Step-by-Step Solution

1
Identify provider management responsibilities for Infrastructure as a Service (IaaS).
IaaS providers handle physical hardware, data center security, networking hardware, and the virtualization hypervisor.
IaaS supplies basic computing resources, leaving higher OS and software management to the client.
2
Identify provider management responsibilities for Platform as a Service (PaaS).
PaaS providers manage the operating system, database engines, web servers, and runtime execution frameworks in addition to physical resources.
PaaS abstracts operating system and runtime maintenance away from developers.
3
Identify provider management responsibilities for Software as a Service (SaaS).
SaaS providers manage the entire application service end-to-end.
SaaS delivers ready-to-use software directly to end users without requiring client infrastructure administration.

Key Concept

Cloud Shared Responsibility Model across Service Models
Question 60Question →

Match each infrastructure risk scenario to its corresponding host, network, or architecture vulnerability classification.

Click a left item, then click its matching right item

Items

An enterprise server running an operating system past its vendor End-of-Life (EOL) date without security updates
A network management service transmitting administrative credentials across the local network in unencrypted plain text
A newly deployed network switch operating with factory administrative username and password settings
A corporate network environment designed without VLANs or subnet boundaries between guest users and critical database servers

Matches

Show answer & explanation

Answer

The enterprise server past EOL matches Unsupported software vulnerability; the network management service transmitting plain text credentials matches Cleartext transmission vulnerability; the network switch with factory credentials matches Default configuration vulnerability; and the corporate network without subnets or VLANs matches Architecture / Lack of network segmentation vulnerability.
Each scenario directly illustrates a core infrastructure vulnerability category: operating an unpatched EOL system creates an unsupported software vulnerability; transmitting unencrypted credentials creates a cleartext transmission vulnerability; retaining factory passwords creates a default configuration vulnerability; and placing all devices on a flat, unsegmented network creates an architecture vulnerability.

Step-by-Step Solution

1
Analyze host-level system lifecycle status
Identify that running software beyond vendor support end date leaves unpatched flaws exposed
Systems past EOL represent unsupported software vulnerabilities.
2
Analyze network protocol transmission behavior
Identify that transmitting sensitive administrative data without cryptographic protection allows packet sniffing
Unencrypted traffic constitutes a cleartext transmission vulnerability.
3
Evaluate system configuration hardening
Identify that active factory credentials on network hardware enable easy unauthorized initial access
Using factory settings creates a default configuration vulnerability.
4
Evaluate network topology and boundaries
Identify that missing subnets or logical isolation allow unrestricted network traffic between low-trust guests and high-trust servers
A flat network lacking isolation represents an architecture vulnerability.

Key Concept

Host, Network, and Architecture Vulnerabilities
PreviousPage 3 / 19Next
All practice questions — CompTIA Security+ | Examkin