All practice questions

A educational institution transitions its student portal from an on-premises data center to a public cloud Infrastructure as a Service (IaaS) environment. The portal runs on enterprise Linux virtual machine instances provisioned within the cloud provider's Virtual Private Cloud (VPC). Under the cloud shared responsibility model, which of the following security management tasks remains the sole responsibility of the institution's security team?

A security architect for an electrical power distribution utility is designing network security controls for an operational technology (OT) environment. Remote vendor engineers require targeted maintenance access to programmable logic controllers (PLCs) located within the high-security Control Zone. The solution must ensure that remote connections never terminate directly inside the OT segment, prevent lateral movement between distinct PLC subnets, and log all session activity at the network boundary. Which of the following network architecture designs best fulfills these requirements?

An organization wants to immediately detect unauthorized modifications made to critical system configuration files on a server. Which of the following technical controls is MOST effective for this purpose?

A financial technology company is deploying a novel microservice-based payment gateway using a Cloud Service Provider's (CSP) managed Serverless (Function-as-a-Service) platform and managed API gateway. Under the cloud shared responsibility model, which of the following security tasks are the EXCLUSIVE responsibility of the enterprise customer? (Select TWO.)

An enterprise software vendor distributes signed firmware updates to industrial IoT controllers. A recent security audit reveals that while the vendor uses a 2048-bit RSA key for asymmetric signing, the update process relies on the SHA-1 hashing algorithm to compute message digests. Which of the following best describes the primary security risk created by using SHA-1 for digital signature generation?

A network security administrator is analyzing wireless performance logs after users report sudden network disconnection across an entire office floor. The administrator suspects a physical Radio Frequency (RF) jamming attack rather than an 802.11 deauthentication attack. Which of the following indicators specifically suggest an RF jamming attack is occurring? (Select TWO)

A security engineer is designing the network architecture for a utility company's remote smart grid infrastructure. The environment includes hundreds of field sensor gateways that transmit power usage data back to a centralized analytics server. The engineer must ensure that if an attacker physically tampers with and compromises a field gateway, the attacker cannot move laterally to inspect or access adjacent gateways, nor access administrative systems within the internal enterprise network. Which of the following network segmentation controls best satisfies these security requirements?

A software developer is designing a web application search feature that queries a back-end database using user-supplied input. Which of the following software development practices is the most effective method to prevent SQL injection vulnerabilities in this application?

An organization is deploying Zero Trust Architecture (ZTA) across its network infrastructure. When an employee attempts to access a sensitive human resources portal, which functional component is responsible for evaluating the user's identity, device posture, and enterprise policies to determine whether access should be granted?

During a post-incident analysis of a compromised legacy industrial control jump server, security auditors discover that attackers leveraged an unquoted service path vulnerability combined with permissive folder write permissions to execute arbitrary code with SYSTEM privileges. The jump server cannot be immediately decommissioned or upgraded due to operational uptime dependencies. Which of the following mitigation strategies provides the MOST effective immediate technical control to prevent execution of unauthorized binaries in these writable paths while preserving host stability?

Network monitoring alerts show that a malicious binary on an infected host is actively scanning neighboring subnets over TCP port 445 and automatically exploiting a remote code execution vulnerability on adjacent systems. The malware spreads from machine to machine across the network without requiring any user action, social engineering, or credential theft, after which it encrypts local files and issues a ransom prompt. Which of the following malware classifications best describes this threat?

Match each enterprise host or infrastructure security scenario to the underlying vulnerability or architectural weakness it represents.

A digital media broadcasting network is migrating its video processing pipeline to a cloud-native architecture using a serverless Function-as-a-Service (FaaS) compute layer paired with object storage for asset ingestion. The security engineering team must establish governance over operational tasks according to the cloud shared responsibility model. Which TWO of the following operational tasks remain the sole security responsibility of the broadcasting network?

An industrial engineering firm operates a critical water treatment facility utilizing legacy Programmable Logic Controllers (PLCs) within an Operational Technology (OT) control zone. The organization must transmit continuous operational metrics to a cloud-based Enterprise Resource Planning (ERP) analytics platform. The security architecture team must ensure that telemetry data moves out of the OT environment while physically preventing any inbound control signals, command injection, or unauthorized network traffic from reaching the legacy PLCs. Which of the following network segmentation designs best achieves this objective?

A security administrator must perform regular vulnerability assessments on production enterprise servers hosting critical database applications. The organization requires detailed visibility into missing OS security patches and host configuration compliance, but must avoid destabilizing active production services or triggering target account lockouts. Which vulnerability testing approach should the administrator implement to meet these requirements?

Match each observed wireless attack indicator on the left with its corresponding attack classification on the right.

During an infrastructure security review at an industrial design firm, security analysts discover that several senior hardware engineers were infected with malware after visiting a popular, highly niche third-party CAD community forum. Investigation reveals that threat actors compromised the forum server weeks earlier and modified its code to selectively deliver an exploit payload only to visitors originating from the design firm's corporate IP address range. Which social engineering vector did the threat actor primarily execute to target these specific employees?

During an application security assessment of an enterprise document ingestion pipeline, an analyst reviews crash logs and source code snippets from a C/C++ processing engine that parses uploaded XML metadata and binary graphics. The analysis reveals two distinct flaws:

1. Submitting a specially crafted payload containing `<!ENTITY xxe SYSTEM "file:///etc/passwd">` causes the engine to return confidential system files in the API response.
2. Submitting an image file with an inflated metadata length field causes the application to write incoming payload bytes past the allocated dynamic memory buffer, leading to process memory corruption and instability.

Which of the following software vulnerabilities are present in this ingestion pipeline? (Select TWO).

A security administrator is reviewing findings from a static application security testing (SAST) tool scan on an enterprise web portal. The scan identified several software flaws caused by improper handling of user input. Which of the following software security practices directly mitigate input validation and injection vulnerabilities such as Cross-Site Scripting (XSS) and SQL Injection (SQLi)? (Select TWO.)

An enterprise cloud application utilizes a service mesh architecture to handle communication between internal microservices. To reduce authentication overhead and improve performance, a DevOps engineer proposes issuing a persistent session token after an initial mTLS handshake, allowing subsequent microservice calls to bypass per-request authorization checks. Which of the following statements best explains why this proposed design violates core Zero Trust Architecture principles?