Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 621Question →

During an internal security audit, an administrator identifies two host vulnerabilities on an enterprise web server: an unauthenticated REST API endpoint susceptible to directory traversal, and legacy SMB services accepting anonymous NULL session connections. Which TWO of the following remediation measures should the administrator implement to directly resolve these host and architecture vulnerabilities?

Select all that apply

Show answer & explanation

Answer: Apply software patches to enforce strict input sanitization and path validation on API parameters.; Disable legacy NULL session capabilities within the host operating system security configuration.

Answer

The administrator must apply software patches for input sanitization and path validation, and disable legacy NULL sessions in the host operating system configuration.
Remediating host and architecture flaws requires addressing the root causes directly on the host system: validating and sanitizing API path inputs stops directory traversal, and hardening the host OS configuration by disabling NULL sessions prevents anonymous share and user enumeration.

Step-by-Step Solution

1
Address the web application vulnerability.
Implementing path sanitization prevents directory traversal attacks from accessing sensitive files.
Vulnerabilities in software logic require direct code patches or sanitization routines on the host.
2
Address the host protocol vulnerability.
Disabling NULL sessions blocks anonymous IPC$ share enumeration on the server.
Hardening operating system configurations removes unauthenticated information disclosure vectors.

Key Concept

Host Hardening and Vulnerability Remediation
Question 622Question →

An enterprise security team deploys an automated vulnerability scanner to conduct network-based discovery across a newly created subnet housing microservices. Although monitoring tools verify that the microservices are online and actively serving traffic, the scanner's report indicates zero active hosts were discovered on the target subnet. Which of the following best explains why the vulnerability scanner failed to identify the active hosts?

Show answer & explanation

Answer: Network security controls or host firewalls on the target subnet are blocking the initial ICMP echo requests and TCP/UDP discovery probes.

Answer

The vulnerability scanner failed to identify active hosts because network security controls or host firewalls on the target subnet dropped the ICMP echo requests and initial TCP/UDP discovery probes used during host identification.
Vulnerability scanners initiate assessments with a host discovery phase using ICMP echo requests and TCP/UDP probes to identify active targets. When firewalls or network access control lists (ACLs) silently drop these discovery packets, the scanner concludes that no hosts are live at those IP addresses, resulting in a scan report showing zero active systems despite services running.

Step-by-Step Solution

1
Analyze the scanning phase described in the scenario.
The scanner failed during the initial host discovery phase before vulnerability identification took place.
Vulnerability scanners first send lightweight network probes (ICMP, ARP, or standard TCP SYN packets to common ports) to determine if target IP addresses are alive.
2
Evaluate how firewalls impact network discovery probes.
Firewalls configured to drop ICMP packets and unsolicited port requests cause the scanner to register the hosts as unreachable or inactive.
When discovery probes receive no response or are silently dropped, the scanner assumes no host is bound to that IP address and skips further vulnerability assessment on those targets.

Key Concept

Host Discovery Suppressions and Firewall Interferences in Vulnerability Scanning
Question 623Question →

A security engineer is designing network controls for a cloud-hosted e-commerce application processing payment transactions. The architecture requires granular security controls to prevent lateral movement (east-west traffic) between individual cloud workload instances within the cardholder data environment. Which network design strategy best provides granular isolation and controls east-west traffic between individual cloud workloads?

Show answer & explanation

Answer: Implementing workload-level microsegmentation using software-defined policies and host-based firewall agents.

Answer

Implementing workload-level microsegmentation using software-defined policies and host-based firewall agents.
Microsegmentation isolates workloads granularly down to the host or container level by enforcing security policies directly on workload instances (via software agents or cloud security groups). This approach restricts lateral (east-west) traffic movement regardless of subnet boundaries, directly satisfying the requirement for workload isolation in a cloud environment.

Step-by-Step Solution

1
Analyze the core security requirement.
The scenario requires preventing lateral movement (east-west traffic) between individual workload instances operating in a shared cloud environment.
Traditional perimeter security controls North-South (boundary) traffic, whereas internal instance-to-instance traffic requires granular isolation rules.
2
Evaluate microsegmentation versus traditional network zoning.
Microsegmentation creates micro-perimeters around individual instances using software agents, security groups, or hypervisor/cloud API controls.
This enforces granular access policies at Layer 7 or Layer 4 for east-west traffic directly on workloads.
3
Identify why alternative options are unsuitable.
Single perimeter subnets rely on implicit internal trust; physical air gaps break cloud application connectivity; and passive NIDS sensors detect but do not block traffic.
Only workload-level microsegmentation satisfies both connectivity and preventive east-west containment requirements.

Key Concept

Microsegmentation for East-West Cloud Traffic Isolation
Question 624Question →

Match each observed network or wireless attack indicator on the left with its corresponding attack classification on the right.

Click a left item, then click its matching right item

Items

A rogue access point broadcasting the exact SSID of a corporate network to trick users into connecting
Excessive radio frequency signal noise causing high packet loss and sudden loss of wireless connectivity across a floor
A flood of spoofed 802.11 management frames instructing wireless client devices to disconnect from the network
Unsolicited Layer 2 responses associating the default gateway's IP address with an unauthorized MAC address

Matches

Show answer & explanation

Answer

Rogue access point mimicking SSID matches Evil Twin; RF signal noise causing connectivity loss matches RF Jamming; Spoofed 802.11 management frames match Deauthentication Attack; Unsolicited Layer 2 responses matching gateway IP to unauthorized MAC matches ARP Poisoning.
Each indicator matches its respective attack mechanism directly: broadcasting a duplicate enterprise SSID represents an Evil Twin; physical RF spectrum noise represents RF Jamming; sending disassociation management packets represents a Deauthentication attack; and distributing forged IP-to-MAC mappings represents ARP Poisoning.

Step-by-Step Solution

1
Analyze each network or wireless attack indicator in the left column.
Identify key characteristics: SSID spoofing, physical radio interference, 802.11 disassociation/deauthentication frames, and unsolicited MAC-to-IP cache updates.
Matching indicators requires recognizing the fundamental technical mechanism associated with each threat.
2
Pair each indicator with its respective threat classification.
Correlate rogue SSID broadcasting to Evil Twin, RF noise to RF Jamming, disconnect frames to Deauthentication, and ARP cache corruption to ARP Poisoning.
Each security threat leaves distinct Layer 1, Layer 2, or Layer 3 artifacts.

Key Concept

Network and Wireless Attack Indicators
Question 625Question →

During a routine post-incident investigation at a commercial financial auditing firm, security engineers discover an intrusion originating from a compromised third-party software build pipeline. The attack exhibited high technical sophistication, stealthy persistence across multiple network segments, and extensive resource backing, with an operational focus on long-term corporate intelligence gathering rather than immediate financial extortion. Which threat actor profile best aligns with the operational attributes and attack vector observed in this scenario?

Show answer & explanation

Answer: State-sponsored threat group

Answer

State-sponsored threat group
State-sponsored threat groups have the high technical capability, funding, and strategic intent necessary to execute complex supply chain compromises for long-term cyber espionage.

Step-by-Step Solution

1
Analyze the attack vector identified in the scenario
The intrusion entered through a third-party software build pipeline (supply chain vector).
Identifying the vector helps narrow down the sophistication and positioning required by the adversary.
2
Evaluate adversary attributes and motivation
High technical sophistication, stealthy persistence, significant financial backing, and intelligence-gathering motivation.
These attributes align directly with advanced persistence capabilities typical of nation-state actors.
3
Match attributes to threat actor classification
State-sponsored threat group is the only profile matching high sophistication, espionage intent, and supply chain attack capabilities.
Other threat actor profiles lack either the required sophistication, resources, or strategic motivation.

Key Concept

Threat Actor Attributes and Attack Vectors
Question 626Question →

A network administrator inspecting wireless event logs discovers that multiple client devices are repeatedly and abruptly losing connectivity to the enterprise access point. The logs reveal a flood of unencrypted 802.11 management packets sent with the MAC address of the access point, instructing the clients to immediately terminate their session. Which of the following wireless attack types is indicated by these log entries?

Show answer & explanation

Answer: Deauthentication attack

Answer

Deauthentication attack
The correct answer is the deauthentication attack. In 802.11 wireless networks, deauthentication frames are management packets sent to notify a client station that its connection to an access point has been terminated. Because standard 802.11 management frames are unauthenticated and sent in cleartext, an attacker can spoof the source MAC address of the legitimate access point and broadcast continuous deauthentication frames, causing target client devices to lose their Wi-Fi connection.

Step-by-Step Solution

1
Analyze the log indicators provided in the scenario.
The logs show a high volume of unencrypted 802.11 management packets commanding client devices to drop their connections.
Legacy 802.11 management frames are unauthenticated, allowing an attacker to spoof the access point's MAC address.
2
Correlate the packet indicators with the corresponding attack classification.
Broadcasting malicious management frames to force client disconnection defines a deauthentication attack.
Attackers leverage deauthentication frames to perform denial-of-service or to force clients to reconnect to an Evil Twin access point.

Key Concept

Wireless Deauthentication Attack Indicators
Question 627Question →

A financial services organization operates a microservices-based payment engine within a container orchestration cluster. Public API proxies, payment verification services, and sensitive database connectors execute across shared worker nodes. To mitigate lateral movement risks between workloads running on identical physical hosts while satisfying strict audit compliance, which of the following network architecture controls should the security team implement?

Show answer & explanation

Answer: Microsegmentation using network policies and software-defined granular controls to inspect and filter east-west container traffic.

Answer

Microsegmentation using network policies and software-defined granular controls to inspect and filter east-west container traffic.
Microsegmentation uses software-defined network (SDN) rules and container network policy plugins to enforce granular isolation at the individual workload layer (Layer 7 / host network layer). This enables strict control over east-west traffic between microservices, preventing unauthorized lateral movement even when services execute on the exact same worker host node.

Step-by-Step Solution

1
Analyze the architectural requirements and environment constraints.
Identified a container cluster environment sharing physical worker nodes with a requirement to prevent lateral movement between pods on the same host.
Containerized workloads sharing worker node operating system kernels require logical isolation controls below the physical network switch layer.
2
Evaluate traffic patterns requiring control.
Recognized that inter-service communication within a host cluster represents internal east-west network traffic.
Standard perimeter firewalls only filter north-south incoming and outgoing boundary traffic.
3
Select the appropriate network isolation security control.
Determined that microsegmentation utilizing software-defined networking rules enforces pod-level access controls.
Microsegmentation creates fine-grained security zones at the workload level, isolating containerized services regardless of physical placement.

Key Concept

Microsegmentation for East-West Container Traffic Isolation
Estimated Time:2m 0s
Question 628Question →

A network administrator needs to establish a remote management session to perform critical database maintenance from an untrusted external network. Arrange the following network boundary transit steps and control points in the correct order, starting from the external connection initiation to the final session establishment on the internal database server.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with external session initiation, passes North-South inspection at the perimeter firewall into the DMZ, authenticates at the bastion host, undergoes East-West firewall rule evaluation, and terminates at the isolated database server.
In a secure multi-tiered network design, incoming external administrative traffic must first cross the perimeter firewall into a screened network segment (DMZ). The session is authenticated and proxied by a DMZ bastion host before initiating a separate internal connection. This East-West transit from the DMZ to the internal database zone is separately controlled and filtered by an internal firewall before reaching the destination database server.

Step-by-Step Solution

1
Identify the entry point of external network traffic.
The initial step is the remote administrator workstation sending traffic across the Internet toward the enterprise network edge.
Traffic originates at the remote client before reaching internal enterprise security controls.
2
Evaluate perimeter access control and DMZ redirection.
The perimeter firewall processes North-South ingress traffic and restricts access directly to the DMZ bastion host.
Secure network design prohibits direct external access to internal subnets; all management traffic must terminate in a screened zone first.
3
Enforce identity verification and administrative proxy controls.
The DMZ bastion host authenticates the administrator via MFA and establishes a proxy channel.
Jump servers/bastion hosts act as intermediate staging points to validate identity before granting access to internal zones.
4
Inspect inter-zone East-West network traffic.
The internal firewall evaluates rule sets governing traffic moving between the DMZ subnet and the internal database subnet.
Internal segment isolation ensures that only explicitly permitted source IP addresses (the bastion host) can connect across internal zone boundaries.
5
Complete session establishment on the internal target endpoint.
The database server receives and accepts the management session request.
The destination endpoint processes the connection request after all perimeter and internal segmentation controls have validated the flow.

Key Concept

Multi-Tier Network Boundary Segmentation and Jump Server Session Transit Controls
Estimated Time:1m 30s
Question 629Question →

An organization is updating its enterprise security strategy to align with Zero Trust Architecture (ZTA) principles. Which of the following implementations best demonstrates the core Zero Trust tenet of "assume breach"?

Show answer & explanation

Answer: Encrypting all network communications and enforcing microsegmentation regardless of user or device location

Answer

Encrypting all network communications and enforcing microsegmentation regardless of user or device location
The core Zero Trust tenet of 'assume breach' requires organizations to plan defenses as if attackers already have access to the internal network. Encrypting internal communications and implementing microsegmentation ensures that even if an internal host is compromised, lateral movement and unauthorized data interception are strictly controlled.

Step-by-Step Solution

1
Identify the key tenet being evaluated
The core tenet is 'assume breach', which presumes attackers may already be inside the network environment.
Zero Trust assumes no implicit trust based solely on physical or network location.
2
Evaluate the architectural control that minimizes blast radius during a compromise
Microsegmentation and end-to-end encryption ensure lateral movement is prevented and data remains protected even if an internal host is compromised.
This continuously enforces strict access boundaries and limits exposure during an incident.

Key Concept

Assume Breach in Zero Trust Architecture
Estimated Time:45s
Question 630Question →

A system administrator is updating an enterprise security policy to align with core Zero Trust Architecture (ZTA) principles. Which of the following practices represent core tenets of Zero Trust? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Explicitly verify identity, device health, and context for every access request; Enforce least privilege access by restricting user permissions to only what is necessary for specific tasks

Answer

The core tenets of Zero Trust Architecture include explicitly verifying every access request and enforcing least privilege access controls.
Zero Trust Architecture enforces continuous explicit verification for all access requests and limits user rights through least privilege access policies to minimize risk.

Step-by-Step Solution

1
Identify core Zero Trust Architecture tenets
Zero Trust is built on the philosophy of 'never trust, always verify', assuming that threats exist both outside and inside the network.
Traditional perimeter defenses rely on implicit trust, which Zero Trust explicitly replaces with continuous verification.
2
Evaluate the requirement for verification
Explicit verification mandates that all requests are authenticated, authorized, and validated based on user identity, location, device health, and data classification.
This prevents unauthorized movement even if an attacker gains entry to the network.
3
Evaluate the requirement for access restriction
Least privilege access limits user access with Just-In-Time (JIT) and Just-Enough-Access (JEA) policies.
Restricting access reduces the blast radius in the event of a credential compromise.

Key Concept

Zero Trust Architecture Principles
Question 631Question →

An application security engineer analyzes transaction execution traces and thread dumps from a multi-threaded microservice responsible for handling account withdrawals. The application verifies an account's available funds prior to deducting the balance and completing the transfer. During high-concurrency peak load testing, automated monitoring detects instances where account balances drop below zero despite validation checks executing successfully without failure. Code analysis confirms that the check and the update operations are executed as non-atomic statements across separate database connections. Which of the following vulnerabilities is demonstrated in this scenario?

Show answer & explanation

Answer: Time-of-check to time-of-use (TOCTOU) race condition

Answer

Time-of-check to time-of-use (TOCTOU) race condition
The correct option correctly identifies the vulnerability as a Time-of-Check to Time-of-Use (TOCTOU) race condition. TOCTOU occurs when a program checks the state of a resource (e.g., account balance) and then acts upon that resource (e.g., executing a withdrawal), but the state changes in the time window between checking and acting due to concurrent execution threads.

Step-by-Step Solution

1
Analyze the observed system behavior described in the scenario logs.
Identified that validation passes before execution, but state changes occur concurrently under high thread volume.
Understanding why checks pass despite invalid final state points directly to timing gaps.
2
Evaluate the relationship between the validation check and the execution operation.
Determined that the verification (time-of-check) and modification (time-of-use) are non-atomic and exposed to race conditions.
Non-atomic operations across asynchronous or concurrent threads allow state manipulation in the window between check and execution.
3
Select the vulnerability classification matching timing-dependent state flaws.
Confirmed the flaw as a Time-of-Check to Time-of-Use (TOCTOU) race condition.
TOCTOU explicitly describes vulnerability windows created between system condition verification and resource access.

Key Concept

Time-of-Check to Time-of-Use (TOCTOU) and Concurrency Vulnerabilities
Estimated Time:2m 0s
Question 632Question →

During a post-incident investigation of a cloud-native microservices environment, a security analyst determines that an attacker exploited a kernel vulnerability within an application container to break out of the container runtime environment and execute code directly on the host operating system. The application was running as a standard non-root service within an OCI-compliant container ecosystem. Which of the following root causes best explains why containerization failed to isolate the workload compared to a traditional hardware-enforced virtual machine architecture?

Show answer & explanation

Answer: Containers share the host OS kernel and rely on software-based logical abstractions such as namespaces and control groups, allowing kernel-level exploits to compromise the underlying host.

Answer

Containers share the host OS kernel and rely on software-based logical abstractions such as namespaces and control groups, allowing kernel-level exploits to compromise the underlying host.
Containers provide OS-level virtualization by sharing the host operating system kernel while using logical constraints like namespaces (to isolate process trees, mounts, and network interfaces) and control groups (cgroups, to throttle resources). If an application container exploits a vulnerability in the underlying host kernel, the attacker escapes the logical container sandbox and executes code in the context of the host kernel. Virtual machines avoid this specific failure mode because each VM runs its own independent guest kernel managed by a Type-1 or Type-2 hypervisor.

Step-by-Step Solution

1
Analyze the architecture differences between Virtual Machines (VMs) and Containers.
VMs utilize hypervisors to abstract hardware and run full separate guest operating systems with hardware-enforced privilege boundaries. Containers share the host kernel and use OS-level isolation features like Linux namespaces and cgroups.
Understanding the isolation boundary is critical for security architecture analysis.
2
Evaluate the impact of a kernel privilege escalation exploit inside a container.
Because all containers on a host share the underlying operating system kernel, any unpatched kernel vulnerability exploited from within a container grants the attacker execution capabilities within host kernel space.
Logical boundary isolation (namespaces) cannot protect against flaws in the shared kernel executing those namespaces.
3
Select the option that correctly identifies shared kernel architecture as the primary isolation limitation.
The option stating that containers share the host operating system kernel and rely on software logical primitives accurately explains the vulnerability exposure.
This directly answers why container isolation failed where VM hypervisor isolation would have contained the kernel exploit within the guest OS.

Key Concept

Container vs. Virtual Machine Security Boundaries & Kernel Sharing Risk
Question 633Question →

A network security administrator is setting up access rules for an enterprise environment to ensure strict isolation between public web servers and internal databases, while also maintaining secure remote administrative access. Which TWO network architecture and segmentation practices should the administrator implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Place the public-facing web servers inside a Demilitarized Zone (DMZ) to restrict direct traffic to the internal network.; Deploy a jump box (bastion host) to proxy and audit administrative management traffic into sensitive network segments.

Answer

The network security administrator should deploy public web servers inside a Demilitarized Zone (DMZ) and use a jump box (bastion host) to proxy administrative traffic.
Placing public web servers within a DMZ ensures inbound internet traffic is isolated from the private internal network. Using a jump box secures management sessions by funneling administrator access through a single hardened access control point.

Step-by-Step Solution

1
Evaluate perimeter and public service isolation needs.
Identify that public-facing servers should reside in a DMZ so that compromise of a web server does not grant direct access to internal assets.
Segmenting untrusted public traffic prevents direct lateral penetration into internal enterprise networks.
2
Evaluate secure administrative access requirements.
Identify that administrative access should be routed through a dedicated jump box (bastion host).
A jump box provides an isolated gateway for administrative sessions, enforcing MFA, monitoring, and precise access control across network boundaries.

Key Concept

Demilitarized Zone (DMZ) isolation and Jump Box access control in secure network design
Question 634Question →

A security analyst is reviewing the security architecture for a hybrid cloud deployment containing both virtual machines and containerized applications. Match each security mechanism on the left with its primary isolation property on the right.

Click a left item, then click its matching right item

Items

Kernel Namespaces
Control Groups (cgroups)
Type 1 Hypervisor
Microsegmentation

Matches

Show answer & explanation

Answer

Kernel Namespaces match process-level visibility segregation within a shared OS kernel. Control Groups (cgroups) match restricting hardware resource consumption. Type 1 Hypervisor matches abstracting physical hardware for strong VM isolation. Microsegmentation matches enforcing granular network traffic control and boundaries.
Kernel namespaces isolate what processes can see (PIDs, network adapters, filesystems). Control groups (cgroups) control how much host hardware resources a container can use. Type 1 hypervisors run directly on hardware to deliver rigid virtual machine isolation. Microsegmentation creates micro-perimeters around workloads to control east-west network traffic.

Step-by-Step Solution

1
Analyze container OS kernel isolation constructs.
Linux kernel namespaces isolate process visibility (e.g., PID space, mount points), while control groups (cgroups) govern resource usage constraints like CPU and memory limits.
Distinguishing between resource visibility isolation and resource consumption limiting is fundamental to container host hardening.
2
Evaluate hypervisor virtual machine abstraction capabilities.
A Type 1 bare-metal hypervisor mediates guest operating system interactions directly on hardware, creating strong isolation boundaries that prevent inter-VM compromises.
Virtual machines run discrete guest kernels, providing stronger containment than shared-kernel container architectures.
3
Identify network security mechanisms for virtualized environments.
Microsegmentation implements policy-driven network access controls around individual microservices or VMs to restrict east-west lateral traffic.
Network-level isolation complements host-level container and hypervisor execution boundaries.

Key Concept

Virtualization and Container Isolation Mechanisms
Question 635Question →

Match each observed security incident technical indicator on the left with its corresponding malware classification on the right.

Click a left item, then click its matching right item

Items

A scheduled task executing an obfuscated script creates an unauthorized persistent administrator account.
Direct Kernel Object Manipulation (DKOM) modifies active operating system data structures to conceal running processes.
Automated network sweeps over TCP port 445 exploit SMB vulnerabilities to self-replicate payload code to adjacent hosts.
A dormant script executes a malicious routine only when a target enterprise database table exceeds 100,000 records.

Matches

Show answer & explanation

Answer

The scheduled task creating persistent access matches Trojan; kernel memory manipulation to hide processes matches Rootkit; automated port 445 network propagation matches Worm; and environmental trigger execution matches Logic Bomb.
Each indicator aligns with a distinct technical behavior: kernel cloaking via DKOM signifies a Rootkit; autonomous network scanning and SMB exploitation signifies a Worm; pre-configured conditional triggering signifies a Logic Bomb; and hidden persistence via routine operating system utilities signifies a Trojan.

Step-by-Step Solution

1
Analyze item 1 regarding scheduled task obfuscated scripts creating unauthorized accounts.
Identified as a Trojan.
Trojans masquerade as or leverage legitimate functionality to secretly introduce unauthorized capabilities.
2
Analyze item 2 regarding Direct Kernel Object Manipulation (DKOM).
Identified as a Rootkit.
Rootkits operate at kernel privilege levels to alter system structures and mask processes.
3
Analyze item 3 regarding port 445 scanning and self-replication.
Identified as a Worm.
Worms propagate autonomously across network vulnerabilities without requiring user action.
4
Analyze item 4 regarding execution dependent on database record thresholds.
Identified as a Logic Bomb.
Logic bombs trigger malicious execution based on specific operational or logical events.

Key Concept

Distinguishing technical indicators of compromise across fundamental malware classifications.
Question 636Question →

An organization is transitioning several legacy applications to a containerized deployment. A security administrator is explaining to the development team why container security boundaries differ from traditional virtual machine (VM) security boundaries. Which of the following statements accurately describes a fundamental isolation difference between containers and VMs?

Show answer & explanation

Answer: Containers share the host operating system kernel, whereas virtual machines utilize a hypervisor to isolate independent operating systems with dedicated kernels.

Answer

Containers share the host operating system kernel, whereas virtual machines utilize a hypervisor to isolate independent operating systems with dedicated kernels.
Containers operate via OS-level virtualization, sharing the host system's kernel to run application processes in isolated user spaces. In contrast, virtual machines utilize a hypervisor to abstract physical hardware, running separate guest operating systems each with their own dedicated kernel. Understanding this kernel-sharing model is critical because a vulnerability in the shared host kernel can compromise all containers on that system.

Step-by-Step Solution

1
Analyze the architectural boundary of application containers.
Containers run as isolated user-space processes that share the underlying host operating system kernel.
Containerization relies on OS-level virtualization (such as Linux namespaces and cgroups) rather than full hardware emulation.
2
Analyze the architectural boundary of virtual machines.
Virtual machines run complete guest operating systems managed by a hypervisor.
Hypervisors abstract physical hardware, providing hardware-level isolation where each guest VM operates with its own kernel.
3
Select the statement that correctly contrasts container and VM isolation mechanisms.
The statement highlighting host kernel sharing for containers versus hypervisor-based OS isolation for VMs is correct.
This captures the primary security boundary distinction between OS-level containerization and hardware-level virtualization.

Key Concept

Container versus Virtual Machine Isolation Boundaries
Estimated Time:45s
Question 637Question →

A global retail organization is transitioning its legacy transaction processing platform to a hybrid cloud deployment model. The architecture uses Infrastructure as a Service (IaaS) to host legacy relational database instances and Platform as a Service (PaaS) to host modern containerized web frontends. During a cloud architecture security review, the lead security engineer must define operational boundaries under the Shared Responsibility Model for both service types. Which of the following security management tasks remain the exclusive responsibility of the organization across BOTH the IaaS database instances and PaaS web frontends? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Classifying application-layer data assets and configuring data access authorization controls; Configuring Identity and Access Management (IAM) role permissions and API access credentials for application users

Answer

Classifying application-layer data assets and configuring data access authorization controls, along with configuring Identity and Access Management (IAM) role permissions and API access credentials for application users, are tasks exclusively retained by the cloud customer in both IaaS and PaaS environments.
In the cloud Shared Responsibility Model, data management (including data classification, payload security, and access rules) and Identity and Access Management (IAM identity lifecycle and privilege assignment) are customer responsibilities regardless of whether the model is IaaS, PaaS, or SaaS. Therefore, classifying application data assets and configuring IAM permissions for API endpoints are customer-managed duties across both environments.

Step-by-Step Solution

1
Analyze the IaaS responsibility scope
In IaaS, the cloud customer manages the operating system, runtime, middleware, data, and access configurations, while the provider manages physical facilities, hardware, and hypervisors.
Establishing customer baseline responsibilities for the database instances.
2
Analyze the PaaS responsibility scope
In PaaS, the provider assumes responsibility for the underlying operating system, middleware, and database engines/runtimes, leaving the customer responsible for application code, data classification, and IAM policies.
Identifying which tasks shift to the cloud provider when moving from IaaS to PaaS.
3
Determine overlapping customer responsibilities across both models
Data governance/classification and Identity and Access Management (IAM) permissions remain customer duties in both service models, whereas OS kernel patching shifts to the provider in PaaS.
Selecting the two options that are exclusively customer-managed in both IaaS and PaaS.

Key Concept

Shared Responsibility Model boundaries across IaaS and PaaS cloud service models
Estimated Time:2m 0s
Question 638Question →

An enterprise financial organization is redesigning its Storage Area Network (SAN) security architecture to comply with data-at-rest encryption requirements for bulk database backups. The design must eliminate host server CPU overhead during cryptographic operations and safeguard encryption keys against physical tampering or theft from the data center. Which of the following storage security solutions best meets these requirements?

Show answer & explanation

Answer: Implementation of Self-Encrypting Drives (SEDs) backed by an enterprise Hardware Security Module (HSM) for key management

Answer

Deploying Self-Encrypting Drives (SEDs) coupled with an enterprise Hardware Security Module (HSM) for cryptographic key management.
Self-Encrypting Drives (SEDs) offload cryptographic processing to dedicated drive hardware, executing symmetric encryption at full bus speed without host OS performance overhead. Utilizing a Hardware Security Module (HSM) ensures secure, centralized management of the key encryption keys within a physical and logical tamper-evident security boundary, satisfying all performance and security architecture requirements.

Step-by-Step Solution

1
Analyze the performance requirement for bulk storage encryption at rest.
Hardware-based encryption offloaded to drive hardware prevents host server performance degradation.
Self-Encrypting Drives (SEDs) utilize dedicated AES coprocessors on the disk controller to encrypt and decrypt data at line speed without consuming host CPU cycles.
2
Evaluate key protection against physical data center theft.
Centralized key protection requires a tamper-resistant hardware security boundary.
Integrating SEDs with an external Hardware Security Module (HSM) protects Key Encryption Keys (KEKs) and prevents unauthorized access to encrypted drives if physically removed.

Key Concept

Data Protection at Rest & Storage Key Security (SED and HSM)
Question 639Question →

A DevOps team is deploying microservices within a containerized environment on Linux host servers. The system administrator needs to enforce hard limits on CPU usage and memory consumption for individual containers to prevent a single compromised or misconfigured container from exhausting shared host system resources. Which Linux kernel mechanism should be configured to directly enforce these resource limits?

Show answer & explanation

Answer: Control groups (cgroups)

Answer

Control groups (cgroups) are used to limit and isolate physical resource consumption such as CPU and RAM for container processes.
Control groups (cgroups) are the Linux kernel feature designed specifically to restrict, allocate, and measure hardware resources (CPU, RAM, block I/O) assigned to containerized process hierarchies.

Step-by-Step Solution

1
Identify the goal of the control
The requirement is host-level CPU and memory resource governance for containerized applications.
Preventing a single container from starving host resources requires kernel-level resource allocation constraints.
2
Differentiate container kernel mechanisms
Linux namespaces provide visibility isolation (viewing processes, network cards, IPC), whereas control groups (cgroups) regulate hardware resource consumption boundaries.
cgroups explicitly handle resource metering and throttling for process collections.

Key Concept

Resource isolation and constraint mechanisms in container security (cgroups vs namespaces)
Question 640Question →

An enterprise security architect is refining the workload protection matrix for a multi-tenant cloud environment hosting both legacy virtualized infrastructure and microservice containers. Match each virtualization or containerization security control on the left to its corresponding isolation property or policy enforcement mechanism on the right.

Click a left item, then click its matching right item

Items

Control Groups (cgroups)
Linux Namespaces
Type-1 Hypervisor Isolation
CNI Microsegmentation

Matches

Show answer & explanation

Answer

Control Groups (cgroups) matches with enforcing resource utilization quotas; Linux Namespaces matches with providing segregated operational views of system resources; Type-1 Hypervisor Isolation matches with providing dedicated hardware-enforced abstraction directly on physical host processors; CNI Microsegmentation matches with implementing granular packet filtering rules at the virtual network layer.
Each security control aligns directly with its primary system level: cgroups manage hardware resource quotas (CPU/RAM/IO), namespaces isolate kernel object visibility (PID/NET/MNT), Type-1 hypervisors manage bare-metal hardware abstraction for full VM execution isolation, and CNI microsegmentation manages granular software-defined network traffic controls across pods.

Step-by-Step Solution

1
Analyze resource governing mechanisms for OS-level virtualization.
Control Groups (cgroups) strictly manage resource boundaries such as CPU limits, memory quotas, and block I/O rates to stop noisy-neighbor resource exhaustion.
cgroups provide hardware resource allocation control rather than structural visibility isolation.
2
Evaluate process and environment isolation primitives in container engines.
Linux Namespaces provide discrete visibility domains (PID, NET, IPC, MNT, UTS, USER) preventing one container from inspecting or interacting with system objects of another.
Namespaces abstract what a process can see rather than limiting how much CPU or RAM it consumes.
3
Examine hypervisor architectural models and hardware separation boundaries.
Type-1 (bare-metal) hypervisors run directly on underlying physical hardware host chips to enforce VM memory and CPU execution isolation without depending on a general-purpose host OS.
This establishes hardware ring isolation distinct from container kernel-sharing.
4
Determine modern network isolation methods within container orchestration systems.
CNI Microsegmentation utilizes eBPF or iptables at the virtual interface layer to enforce Zero Trust security rules on East-West traffic between container endpoints.
Microsegmentation protects pod-to-pod network pathways rather than host compute resources.

Key Concept

Virtualization and Containerization Security Mechanisms
PreviousPage 32 / 112Next
All practice questions — CompTIA Security+ | Examkin