Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 681Question →

A security analyst is configuring a new Security Information and Event Management (SIEM) solution. Place the core stages of the SIEM log processing pipeline in the correct sequential order from initial log entry to analyst notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of stages in a SIEM log processing pipeline is: Log Collection, Parsing, Normalization, Correlation, and Alerting.
In a standard SIEM processing pipeline, raw log data is gathered via Log Collection, extracted into data fields via Parsing, converted to a unified taxonomy during Normalization, cross-analyzed against rules during Correlation, and dispatched to analysts during Alerting.

Step-by-Step Solution

1
Identify the initial log ingestion activity.
Log Collection occurs first as raw data must be received from source devices before processing.
Data cannot be parsed or analyzed until it is ingested by the SIEM collector.
2
Extract raw fields from collected logs.
Parsing splits unstructured log strings into discrete key-value pairs.
Specific attributes must be recognized within raw log strings before standardizing formats.
3
Standardize variable names and field formats.
Normalization converts heterogeneous fields into a unified system schema.
Standardized data structures allow consistent cross-source log analysis.
4
Evaluate normalized data against rule engines.
Correlation cross-references standardized events across different logs to identify indicators of compromise.
Pattern identification requires normalized inputs from multiple security sources.
5
Dispatch notification of identified incidents.
Alerting informs analysts or triggers security orchestration when correlation logic fires.
Alerting is the final outcome of pipeline processing intended to initiate human or automated incident response.

Key Concept

SIEM Log Processing Pipeline
Question 682Question →

A security engineer is hardening a shared Linux host operating system that runs multiple microservices inside runtime containers. To prevent a compromised container process from escalating privileges on the host or compromising adjacent workloads sharing the same host kernel, which TWO security mechanisms should the engineer implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply custom secure computing mode (seccomp) profiles to restrict unneeded system calls available to containerized applications.; Utilize Linux kernel namespaces and control groups (cgroups) to isolate process environments and strictly limit resource consumption.

Answer

The engineer should apply custom secure computing mode (seccomp) profiles to restrict system call access and utilize Linux kernel namespaces and control groups (cgroups) to isolate process resources and limit consumption.
Because containerized workloads share the host operating system kernel, securing them requires kernel-level isolation controls. Applying custom secure computing mode (seccomp) profiles restricts the specific host system calls accessible to container processes, minimizing the impact of potential kernel exploits. Utilizing Linux kernel namespaces provides process, mount, and network interface isolation, while control groups (cgroups) set resource limits to prevent container workloads from consuming excessive host CPU or memory.

Step-by-Step Solution

1
Analyze container isolation architecture and risks
Containers execute as user-space processes directly on the host kernel, making system call access and resource boundary enforcement essential defenses against kernel exploitation and host denial-of-service.
Unlike virtual machines, containers share kernel resources, requiring OS-level primitives for isolation.
2
Identify system call restriction controls
Applying custom seccomp profiles blocks unnecessary host system calls from being executed by container processes.
Restricting system calls limits the host kernel surface exposed to potential exploits.
3
Identify process isolation and boundary controls
Configuring kernel namespaces partitions system views (PID, NET, IPC, MNT), while cgroups enforce memory and CPU quotas.
Namespaces restrict visibility into host processes and network interfaces, and cgroups prevent container resource exhaustion.

Key Concept

Kernel-level isolation and surface reduction for containerized environments
Estimated Time:2m 0s
Question 683Question →

A retail chain is redesigning its store network architecture to satisfy payment card industry compliance requirements. Each store location operates on-site Point-of-Sale (POS) terminals connected to a shared local switch alongside store manager workstations and guest access points. To minimize audit scope and prevent lateral threat movement if a single terminal is compromised, POS terminals must be blocked from communicating directly with one another on the local switch while retaining full access to the router default gateway for transaction processing. Which network design control should the security engineer implement on the local switch?

Show answer & explanation

Answer: Private VLANs (PVLANs) with POS terminals configured on isolated ports and the router connected to a promiscuous port

Answer

Private VLANs (PVLANs) with POS terminals configured on isolated ports and the router connected to a promiscuous port
Private VLANs (PVLANs) provide Layer 2 isolation within the same IP subnet. Configuring POS terminal ports as isolated ports ensures that frames sent between POS terminals are blocked at the switch layer. Configuring the router connection on a promiscuous port enables all isolated ports to communicate upstream with the default gateway for transaction processing.

Step-by-Step Solution

1
Analyze the technical requirement and isolation boundary
POS terminals reside on the same Layer 2 switch segment but must be prevented from sending East-West traffic to one another while continuing to send North-South traffic to the gateway.
Restricting lateral movement inside a shared subnet limits malware spread and reduces compliance audit boundaries.
2
Evaluate Layer 2 microsegmentation capabilities
Private VLANs (PVLANs) partition a VLAN into primary and secondary domains, providing granular port-level isolation without requiring separate subnets per host.
Isolated ports drop all frames directed to other isolated ports, forwarding traffic only to designated promiscuous ports.
3
Select the correct switch configuration
Assign POS switch ports as isolated ports and the default gateway router port as a promiscuous port.
This setup allows terminals to reach external payment networks via the gateway while completely blocking intra-VLAN communication.

Key Concept

Private VLAN (PVLAN) Microsegmentation
Estimated Time:1m 30s
Question 684Question →

A global transport logistics enterprise operates edge processing nodes in regional data centers to handle real-time vehicle telematics. High-frequency microservices exchange East-West traffic with strict low-latency requirements, while aggregate telematics summaries are transmitted North-South to the central corporate cloud. A security assessment revealed that external vendor technicians connect to administrative interfaces using direct subnets, creating significant risk of lateral movement across internal services. Which of the following network architecture designs best secures the edge processing environment while preserving performance and administrative isolation?

Show answer & explanation

Answer: Implement software-defined microsegmentation using an eBPF service mesh for internal East-West microservice traffic, paired with a dedicated jump server inside an isolated management DMZ for external technician administrative access.

Answer

The optimal design uses software-defined microsegmentation (via an eBPF service mesh) for East-West microservice traffic and an isolated management DMZ jump server for third-party administrative access.
Combining eBPF-based service mesh microsegmentation with a management DMZ jump server enforces Zero Trust principles. Microsegmentation secures East-West microservice communication with sub-millisecond overhead, while the jump box restricts external vendor access to a monitored, single entry point, preventing lateral movement into internal telemetry networks.

Step-by-Step Solution

1
Analyze traffic vectors and operational requirements.
Identified two primary traffic paths: East-West microservice telematics processing (demanding minimal latency) and North-South reporting/administrative access.
Different traffic types require tailored security controls to avoid latency bottlenecks while maintaining isolation.
2
Evaluate internal East-West control mechanisms.
Selected eBPF service mesh microsegmentation to enforce identity-based access policies directly at the host/kernel level with minimal overhead.
Traditional network firewalls introduce latency and lack container/microservice visibility, whereas microsegmentation prevents lateral movement inside the network.
3
Select administrative remote access controls.
Routed third-party technician access through a centralized jump box (bastion host) within a dedicated management DMZ.
Direct subnet access by vendors presents high risk; a jump server ensures strict authentication, session logging, and isolation from critical microservice networks.

Key Concept

Secure Network Design and Microsegmentation
Question 685Question →

A security analyst is investigating a alert on an internal Linux server and reviews the following authentication log entries:

text
Jul 27 14:10:02 auth-server sshd[4102]: Failed password for root from 203.0.113.5 port 49152 ssh2
Jul 27 14:10:03 auth-server sshd[4105]: Failed password for root from 203.0.113.5 port 49154 ssh2
Jul 27 14:10:04 auth-server sshd[4109]: Failed password for root from 203.0.113.5 port 49156 ssh2
Jul 27 14:10:05 auth-server sshd[4112]: Failed password for root from 203.0.113.5 port 49158 ssh2

Which type of security event is directly indicated by these log entries?

Show answer & explanation

Answer: An SSH password brute-force attack against the root user account

Answer

An SSH password brute-force attack against the root user account
The correct answer is correct because the SSH log entries (`sshd`) show repeated, consecutive `Failed password` messages for the privileged `root` user originating from the same source IP (`203.0.113.5`) in one-second intervals, which is a classic signature of an automated brute-force login attack.

Step-by-Step Solution

1
Examine the log service process and message type.
The process `sshd` indicates Secure Shell daemon logs reporting `Failed password` for the user `root`.
Identifying the daemon and status clarifies that authentication attempts are failing.
2
Analyze timestamps and source address pattern.
Consecutive login failures occur every second from IP `203.0.113.5`.
Rapid, automated repeat attempts from a single source address confirm an automated password brute-force pattern.

Key Concept

SSH Authentication Log Analysis
Question 686Question →

A municipal water utility is designing a network architecture to allow its corporate analytics platform to pull daily operational telemetry logs from a Supervisory Control and Data Acquisition (SCADA) server located inside a high-security Operational Technology (OT) zone. The organization's security policy strictly forbids any inbound network connections into the SCADA zone and prohibits direct bi-directional TCP/IP session establishment between the corporate network and the OT environment. Which of the following network architecture controls best fulfills these requirements?

Show answer & explanation

Answer: Deploy a unidirectional gateway (data diode) that physically enforces one-way hardware data transmission from the SCADA zone to a historian server in the corporate DMZ.

Answer

Deploy a unidirectional gateway (data diode) that physically enforces one-way hardware data transmission from the SCADA zone to a historian server in the corporate DMZ.
Deploying a unidirectional gateway (data diode) physically enforces one-way data flow using optical emitters and receivers. This guarantees that SCADA telemetry can be sent to an enterprise DMZ server without allowing any inbound electrical signals or network connection requests back into the SCADA network.

Step-by-Step Solution

1
Analyze the security constraints specified in the scenario.
Identified two strict rules: zero inbound network connections permitted into the OT/SCADA zone, and no bi-directional TCP/IP sessions allowed between IT and OT.
Security controls must enforce absolute traffic directionality to protect critical infrastructure OT environments from corporate network compromise.
2
Evaluate potential network segmentation technologies against the constraints.
Standard firewalls, VLAN ACLs, and jump boxes all rely on software logic or enable bi-directional TCP handshakes, allowing potential inbound requests.
Only hardware-enforced unidirectional transmission (data diodes) physically prevents optical or electrical signal propagation in the reverse direction.
3
Select the optimal control mechanism.
A unidirectional gateway (data diode) transmitting SCADA telemetry outbound to a corporate DMZ historian server satisfies all requirements.
This architecture allows external systems to consume telemetry without exposing the SCADA network to inbound connection attempts.

Key Concept

Unidirectional Data Diodes and OT/ICS Segmentation
Question 687Question →

A system administrator needs to protect sensitive data stored on enterprise storage drives against physical theft while ensuring that the underlying cryptographic keys are securely generated and managed using a dedicated hardware appliance. Which of the following technical controls should be implemented to fulfill these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Self-Encrypting Drives (SEDs) to perform automatic hardware-level data-at-rest encryption; Hardware Security Module (HSM) for centralized, secure cryptographic key generation and storage

Answer

The correct technical controls are implementing Self-Encrypting Drives (SEDs) for hardware-level data-at-rest encryption and deploying a Hardware Security Module (HSM) for secure key management.
Implementing Self-Encrypting Drives (SEDs) ensures that data on physical disk drives is encrypted automatically at rest, safeguarding data against physical drive theft. Pairing SEDs with a Hardware Security Module (HSM) provides a hardened, dedicated physical appliance to securely generate, store, and manage the cryptographic keys required for storage protection.

Step-by-Step Solution

1
Identify the control required for hardware-level data-at-rest protection against physical theft
Self-Encrypting Drives (SEDs) encrypt disk sectors automatically via onboard hardware, preventing unauthorized data access if the drive is physically removed.
SEDs provide disk encryption at rest directly on the storage hardware.
2
Identify the dedicated hardware control for cryptographic key management
A Hardware Security Module (HSM) provides a tamper-resistant environment specialized for key generation, storage, and protection.
HSMs meet the requirement for centralized and secure key lifecycle operations.

Key Concept

Data Protection at Rest and Cryptographic Storage Architecture
Estimated Time:1m 0s
Question 688Question →

During the deployment of a new Security Information and Event Management (SIEM) system, a security engineer is configuring the automated pipeline for handling enterprise security events. Arrange the stages of the SIEM data processing pipeline in the correct chronological order from initial log intake to final analyst notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of the SIEM log processing pipeline is: Log Collection and Ingestion -> Parsing and Normalization -> Event Correlation -> Alert Generation and Dispatch.
The correct sequence reflects the standard data lifecycle within a SIEM: raw log streams are ingested from hosts and networks, normalized into standard field formats, evaluated by correlation logic to detect multi-event attack patterns, and finally dispatched as actionable alerts to security analysts.

Step-by-Step Solution

1
Identify the initial data intake phase
Log Collection and Ingestion occurs first as raw data must be gathered from sources before processing.
Without raw log intake, no downstream parsing or analysis can occur.
2
Identify the data formatting phase
Parsing and Normalization occurs second to standardize field names and structures across disparate sources.
Correlation rules require standardized fields (like source IP or username) to evaluate events across different log sources.
3
Identify the detection and rule evaluation phase
Event Correlation occurs third as normalized data is evaluated against threat logic and correlation rules.
SIEM rules analyze relationships between parsed events to identify multi-source security incidents.
4
Identify the notification phase
Alert Generation and Dispatch occurs last when correlation rules trigger security alerts for SOC analysts.
Alerting is the output produced after an incident scenario is identified by correlation logic.

Key Concept

SIEM Log Processing Pipeline
Question 689Question →

An organization needs to monitor and prevent sensitive data, such as personally identifiable information (PII), from being copied onto unauthorized USB storage devices or uploaded to unauthorized web services by internal users. Which of the following data protection solutions is designed to inspect file contents and enforce access policies based on data classification rules?

Show answer & explanation

Answer: Data Loss Prevention (DLP)

Answer

Data Loss Prevention (DLP) is the correct control because it inspects file contents against policy rules to identify sensitive data and restrict unauthorized data transfers.
Data Loss Prevention (DLP) tools dynamically inspect file content and metadata against organizational security policies, allowing administrators to block sensitive data transfers to removable storage devices or external web destinations.

Step-by-Step Solution

1
Analyze the operational requirement.
The requirement calls for inspecting file contents to identify sensitive data and preventing unauthorized copying to external storage or cloud destinations.
Identifying sensitive data during user activities requires content-aware inspection.
2
Evaluate available storage security technologies.
Data Loss Prevention (DLP) operates by analyzing data pattern signatures and classifications to enforce contextual copy and upload restrictions.
Other storage controls like FDE, HSM, or SAN zoning protect physical volumes, manage keys, or isolate network storage rather than monitoring endpoint content movement.

Key Concept

Data Loss Prevention (DLP) controls for data in use and data in motion
Estimated Time:45s
Question 690Question →

A enterprise payment processing organization needs to protect sensitive credit card Primary Account Numbers (PAN) stored within a centralized relational database. The security architecture team must ensure that if an unauthorized user or database administrator queries the storage tables, the sensitive numerical data is not exposed. Additionally, downstream analytics applications must be able to process database records without altering the underlying database schema length or data format. Which of the following storage data protection mechanisms best meets these architectural requirements?

Show answer & explanation

Answer: Tokenization of sensitive data fields

Answer

Tokenization of sensitive data fields is the most appropriate control because it substitutes sensitive values with non-sensitive tokens while preserving data format and length for database compatibility.
Tokenization replaces sensitive numbers with non-sensitive surrogate tokens that match the original data type and format. This prevents unauthorized users and database administrators from viewing raw sensitive data while allowing existing application schemas and analytics jobs to function without structural modifications.

Step-by-Step Solution

1
Analyze the operational requirements
The requirements demand protecting sensitive records against internal database query exposure while maintaining length and format compatibility for downstream reporting.
Database schema preservation prevents downstream application failures while securing sensitive fields at rest.
2
Evaluate data protection controls against format-preserving requirements
Tokenization maps sensitive records to format-preserving surrogate values without exposing original data to unauthorized queries.
Tokenization isolates the underlying sensitive data in a token vault while providing safe surrogate values to database consumers.

Key Concept

Data Tokenization and Format-Preserving Protection
Question 691Question →

An enterprise network administrator needs to add a dedicated hardware appliance to the data center to handle high-volume cryptographic processing and securely protect master private keys. Which of the following hardware security controls best satisfies this requirement?

Show answer & explanation

Answer: Hardware Security Module (HSM)

Answer

Hardware Security Module (HSM)
A Hardware Security Module (HSM) is a dedicated, physical crypto-processor designed specifically for generating, storing, and managing digital keys while accelerating heavy cryptographic calculations across network systems.

Step-by-Step Solution

1
Identify the operational requirements described in the scenario
The requirement specifies a dedicated hardware appliance capable of high-volume cryptographic processing and secure master key storage.
Enterprise servers require specialized physical security boundary hardware when handling high cryptographic loads and sensitive keys.
2
Evaluate the candidate hardware security controls against the requirements
A Hardware Security Module (HSM) is specifically designed as a network-attached or plug-in physical device for centralized key management and cryptographic acceleration.
Unlike endpoint chips like TPMs or software cipher suites, an HSM provides dedicated, tamper-evident hardware dedicated to cryptographic operations.

Key Concept

Hardware Security Module (HSM) vs endpoint security hardware
Estimated Time:45s
Question 692Question →

An enterprise cloud security architect is establishing baseline control requirements for host operating systems, hypervisors, and container runtime environments across a hybrid infrastructure. Match each security mechanism to its corresponding isolation property or security enforcement role.

Click a left item, then click its matching right item

Items

Linux Namespaces
Linux Control Groups (cgroups)
Type-1 Bare-Metal Hypervisor
Secure Computing Mode (seccomp)

Matches

Show answer & explanation

Answer

Linux Namespaces match isolated process views of system resources; Linux Control Groups (cgroups) match limiting hardware resource consumption; Type-1 Bare-Metal Hypervisor matches executing directly on host hardware for virtual machine separation; Secure Computing Mode (seccomp) matches filtering host kernel system calls.
Each mechanism aligns directly with its underlying operating system or hypervisor security control role: Namespaces restrict system visibility, cgroups control resource limits, Type-1 hypervisors provide bare-metal hardware separation, and seccomp limits system call access to the host kernel.

Step-by-Step Solution

1
Analyze container kernel isolation controls.
Identify that Linux Namespaces control resource visibility (what a process can see), whereas cgroups control resource allocation (how much a process can consume).
Differentiating process boundaries from resource constraint enforcement is essential in container runtime security.
2
Analyze kernel interface reduction mechanisms.
Identify seccomp as the Linux security capability that restricts privileged kernel syscall execution.
Syscall filtering mitigates container escape vulnerabilities that target host kernel flaws.
3
Analyze hypervisor virtualization mechanisms.
Identify Type-1 hypervisors as bare-metal software layers enforcing hardware abstraction for guest VMs.
Hardware-assisted hypervisors create a distinct security boundary separate from container OS-level virtualization.

Key Concept

Virtualization vs. Containerization Isolation Primitives
Question 693Question →

A commercial maritime cargo fleet operator is upgrading the network architecture of its oceanic container vessels. Each vessel operates an onboard Integrated Platform Management System (IPMS) that manages engine propulsion, steering control, and ballast sensors. The operations team requires continuous, real-time diagnostic telemetry transmitted from the IPMS to a cloud-based monitoring portal via an onboard satellite communications transceiver. However, strict maritime cybersecurity standards dictate that no inbound communication vectors or return-path network packets may ever reach the critical IPMS control network segment. Which of the following network architecture controls BEST satisfies the operational telemetry requirement while enforcing absolute inbound traffic prevention?

Show answer & explanation

Answer: Deploying a unidirectional security gateway (data diode) between the IPMS control segment and the satellite transceiver network.

Answer

Deploying a unidirectional security gateway (data diode) between the IPMS control segment and the satellite transceiver network is the optimal control.
Deploying a unidirectional security gateway (data diode) provides physical, optical-level single-direction communication. An LED transmitter on the IPMS side sends light signals to a photodiode receiver on the satellite network side without any reverse optical transceiver existing on the cable. This enables continuous outbound telemetry stream exporting while guaranteeing that no inbound packets, exploit payloads, or TCP ACK signals can ever traverse back into the IPMS control zone.

Step-by-Step Solution

1
Analyze the operational and security requirements
Real-time telemetry must flow outbound from the IPMS control segment to the satellite transceiver, but zero inbound communications/packets must be allowed back into the IPMS control segment.
Maritime safety standards require absolute isolation against remote command injection, inbound attacks, or backchannel manipulation of critical propulsion systems.
2
Evaluate candidate network isolation mechanisms against physical vs. logical controls
Logical controls (firewalls, PVLANs, jump servers) preserve bidirectional physical pathways and rely on software configurations, whereas a data diode enforces hardware-based unidirectional data transfer (typically via LED sender and photodiode receiver).
Hardware-enforced unidirectional gateways guarantee that return packets, acknowledgement signals, or inbound exploit attempts are physically blocked at the physical layer.
3
Select the option providing absolute non-reversible isolation
The unidirectional security gateway (data diode) meets both the outbound monitoring requirement and the absolute zero-inbound isolation constraint.
It eliminates the risk of software bypass, misconfiguration, or protocol exploitation that affects purely logical segmentation methods.

Key Concept

Unidirectional Network Security Gateways (Data Diodes) and Industrial Control System (ICS/OT) Segmentation
Estimated Time:2m 0s
Question 694Question →

A security analyst is evaluating deployment options for a high-security workload that requires strong, hardware-level isolation from other applications sharing the same physical server. Which of the following deployment technologies provides this hardware-level abstraction by running a separate guest operating system on top of a hypervisor?

Show answer & explanation

Answer: Virtual machines managed by a Type 1 hypervisor

Answer

Virtual machines managed by a Type 1 hypervisor provide hardware-level isolation by virtualizing physical hardware resources and executing complete, isolated guest operating systems.
Virtual machines running on a bare-metal (Type 1) hypervisor abstract physical hardware components, enabling each virtual machine to run its own independent guest operating system kernel. This provides strong, hardware-level isolation boundaries between tenant workloads on the same physical host.

Step-by-Step Solution

1
Identify the required level of isolation
The requirement specifies hardware-level isolation between workloads on shared physical hardware.
Different virtualization models isolate at different layers (hardware vs OS kernel).
2
Evaluate the architectural boundary of virtual machines
Virtual machines use a hypervisor layer to abstract hardware, giving each VM its own dedicated kernel and OS space.
This establishes hardware abstraction and prevents guest workloads from directly sharing host kernel memory.

Key Concept

Virtual Machine vs Container Isolation Boundaries
Question 695Question →

An enterprise financial network is deploying a high-throughput NVMe Storage Area Network (SAN) array to process ultra-low latency trading transactions containing sensitive data. The lead security architect must ensure all data at rest is cryptographically protected against physical drive theft or unauthorized removal from the data center without degrading storage controller IOPS performance. Furthermore, drive decommissioning must support instant cryptographic erasure without requiring manual degaussing or physical drive shredding, while root keys must be bound to a centralized enterprise key management architecture over Key Management Interoperability Protocol (KMIP). Which architectural design strategy best satisfies all of these operational and cryptographic requirements?

Show answer & explanation

Answer: Deploy hardware-based Self-Encrypting Drives (SEDs) utilizing symmetric AES Media Encryption Keys (MEKs) generated on-drive, wrapped by Key Encryption Keys (KEKs) managed centrally by an enterprise Hardware Security Module (HSM) over KMIP.

Answer

Deploy hardware-based Self-Encrypting Drives (SEDs) utilizing symmetric AES Media Encryption Keys (MEKs) generated on-drive, wrapped by Key Encryption Keys (KEKs) managed centrally by an enterprise Hardware Security Module (HSM) over KMIP.
Self-Encrypting Drives (SEDs) perform bulk data-at-rest encryption inside dedicated drive controller ASICs using symmetric AES keys (MEKs). By integrating with a centralized Hardware Security Module (HSM) via KMIP to manage Key Encryption Keys (KEKs), the organization achieves offloaded hardware-rate performance, centralized key lifecycle control, and instant cryptographic erasure upon drive retirement through KEK revocation.

Step-by-Step Solution

1
Evaluate storage performance and data confidentiality requirements
Bulk encryption must be executed at hardware wire-speed (on-drive encryption/SEDs using symmetric ciphers like AES) to avoid latency overhead on host CPUs and storage controllers.
Host-based software encryption or asymmetric ciphers add substantial computational overhead incompatible with ultra-low latency NVMe SAN trading platforms.
2
Evaluate key management and sanitization/decommissioning requirements
Cryptographic erasure (crypto-shredding) is achieved by revoking or zeroizing the Key Encryption Key (KEK) or Media Encryption Key (MEK).
When the KEK managed in the central HSM is destroyed or access revoked via KMIP, data on the drive instantly becomes unrecoverable plaintext, fulfilling zeroization mandates without physical destruction.
3
Synthesize key management integration
Centralizing KEK governance within a Hardware Security Module (HSM) using KMIP integrates enterprise key management with localized SED hardware encryption.
This establishes a robust root of trust while enforcing separation of duties between storage hardware and key storage.

Key Concept

Storage Security Architecture, SEDs, HSM Key Hierarchy, and Cryptographic Erasure
Question 696Question →

During a routine security assessment of hypervisor hosts in an enterprise data center, a security analyst reviews the following vulnerability scan report snippet:

Host: 192.168.42.15
Port: 427/TCP, 427/UDP
Service: Service Location Protocol (SLP)
Vulnerability: Remote Code Execution via Pre-Authentication Heap Overflow
CVSS Score: 9.8 (Critical)
Summary: Unauthenticated remote users can execute arbitrary code with root privileges on the hypervisor host by sending crafted SLP requests.

Which of the following network architecture and host hardening controls represents the MOST effective immediate remediation to eliminate this exposure without disrupting guest virtual machine operations?

Show answer & explanation

Answer: Disable the SLP service on the hypervisor host and isolate the management interface within a dedicated out-of-band management VLAN.

Answer

Disable the SLP service on the hypervisor host and isolate the management interface within a dedicated out-of-band management VLAN.
Disabling the vulnerable SLP service directly eliminates the pre-authentication root exploit vector on the host. Restricting management access to an out-of-band management VLAN enforces network segmentation so that hypervisor administration is isolated from general network segments and guest VM traffic.

Step-by-Step Solution

1
Analyze the vulnerability report to identify the target service and layer.
The target is port 427 (Service Location Protocol - SLP) running natively on the hypervisor management operating system, permitting pre-authentication root-level execution.
Identifying the affected component determines whether host-level or application-level mitigations are required.
2
Evaluate remediation options for host service exposure.
Disabling the vulnerable host daemon (SLP) removes the attack surface directly, and restricting access via a dedicated out-of-band VLAN prevents unauthorized internal reachability.
Disabling unnecessary host services and implementing microsegmentation/VLAN isolation are core host hardening and network architecture best practices.

Key Concept

Host Service Hardening and Out-of-Band Management Architecture
Question 697Question →

A financial enterprise archives encrypted network packet captures of client communications for long-term compliance auditing. During a security review, an analyst notes that the legacy web application server is configured to prioritize static RSA key exchange cipher suites (such as TLS_RSA_WITH_AES_256_GCM_SHA384). If an adversary obtains the server's private key at a future date, which of the following security control weaknesses poses the greatest threat to the archived data?

Show answer & explanation

Answer: Lack of perfect forward secrecy, enabling retroactive decryption of recorded sessions

Answer

Lack of perfect forward secrecy, enabling retroactive decryption of recorded sessions
In static RSA key exchange cipher suites, the client encrypts the pre-master secret with the server's public key. If an attacker records the encrypted traffic and later gains access to the server's private key, they can decrypt the pre-master secret and derive the session key for every archived session. Implementing cipher suites that support Perfect Forward Secrecy (PFS)—such as those using Ephemeral Elliptic Curve Diffie-Hellman (ECDHE)—ensures that a compromised long-term private key cannot be used to decrypt past communications.

Step-by-Step Solution

1
Analyze the cipher suite specification
Identified the use of standard RSA key exchange (TLS_RSA_WITH_AES_256_GCM_SHA384) without ephemeral Diffie-Hellman key exchange (DHE/ECDHE).
Static RSA key exchange relies directly on the server's static private key to encrypt or exchange secret session material.
2
Evaluate the risk of private key compromise against recorded traffic
Determined that possessing the server's static private key allows deriving the master secret for any recorded handshake using that key.
Without Perfect Forward Secrecy (PFS), session keys are mathematically linked to the long-term private key.
3
Identify the required cryptographic control
Selected Perfect Forward Secrecy (PFS) via ephemeral Diffie-Hellman key agreement (e.g., ECDHE) as the necessary mitigation.
PFS generates unique, temporary session keys for each connection that cannot be derived retroactively even if the long-term server key is compromised.

Key Concept

Perfect Forward Secrecy (PFS) and Cipher Suite Weaknesses
Question 698Question →

A software development team is deploying a microservice application using containerization on a shared Linux host operating system. To mitigate the risk of a compromised container issuing malicious system calls directly to the host OS kernel, the security administrator needs to restrict syscall availability for the container runtime environment. Which of the following is the most effective security control to achieve this requirement?

Show answer & explanation

Answer: Implementing a custom Secure Computing Mode (seccomp) profile for the container runtime

Answer

Implementing a custom Secure Computing Mode (seccomp) profile for the container runtime
Seccomp (Secure Computing Mode) is a security feature in the Linux kernel that allows an administrator to filter the system calls a container process can issue. By applying a restrictive seccomp profile, malicious or unnecessary syscalls are blocked before reaching the host kernel.

Step-by-Step Solution

1
Identify the primary threat vector in the scenario
A compromised process in a container invoking unauthorized host kernel system calls (syscalls).
Containers share the host operating system kernel, making kernel syscall exploitation a major privilege escalation vector.
2
Evaluate technical controls for limiting syscall access
Seccomp profiles allow administrators to define specific syscall whitelist/blacklist rules for processes.
Restricting syscalls via seccomp minimizes the attack surface against kernel-level vulnerabilities.
3
Differentiate seccomp from other container management mechanisms
cgroups limit resource allocation, namespaces isolate visibility, while seccomp restricts syscall capability.
Choosing the precise kernel restriction tool directly addresses system call privilege containment.

Key Concept

Container Hardening via System Call Filtering (Seccomp)
Estimated Time:1m 30s
Question 699Question →

During a routine audit at an aerospace software supplier, cybersecurity analysts discover that a lead avionics developer installed an unapproved third-party cloud synchronization tool on a secure build workstation. The investigation reveals the developer used the application to bypass network throttling and meet a tight project deadline, with no intent to exfiltrate data or compromise systems. Which threat actor classification and primary attribute best describe this developer's actions?

Show answer & explanation

Answer: Shadow IT / Non-malicious insider characterized by lack of malicious intent and unauthorized workaround of corporate security controls

Answer

Shadow IT / Non-malicious insider characterized by lack of malicious intent and unauthorized workaround of corporate security controls
The correct answer identifies the individual as a non-malicious insider operating under Shadow IT because the developer is an authorized internal user who deployed unauthorized software solely to complete work duties faster, lacking any hostile or malicious intent.

Step-by-Step Solution

1
Analyze the actor's relationship to the organization and intent
The actor is an internal employee (developer) who had no malicious intent to harm systems or steal data.
Threat actor classification depends heavily on location (internal vs external) and intent (malicious vs non-malicious).
2
Evaluate the attack vector and security control status
The developer installed unapproved software to bypass bandwidth controls to complete job tasks faster.
Deploying unapproved applications or hardware to circumvent security protocols defines Shadow IT.
3
Synthesize the findings to select the correct threat actor profile
The combination of an internal employee, lack of harmful intent, and usage of unapproved software maps precisely to a non-malicious insider utilizing Shadow IT.
This matches standard cybersecurity threat actor attribute definitions.

Key Concept

Threat Actor Attributes and Shadow IT
Estimated Time:1m 15s
Question 700Question →

An enterprise organization is designing a high-availability infrastructure for a mission-critical financial application. The business requirements state that the system must maintain a Recovery Point Objective (RPO) of zero and support automated failover across geographically separated data centers. The lead architect proposes an active-passive dual-datacenter configuration utilizing asynchronous storage volume replication and dynamic DNS routing to switch client traffic upon primary site failure. Which of the following evaluations best explains why this proposed design fails to meet the organization's requirements?

Show answer & explanation

Answer: Asynchronous storage replication allows transactions to commit locally before remote confirmation, creating a window for data loss that violates an RPO of zero during an unannounced failure.

Answer

Asynchronous storage replication allows transactions to commit locally before remote confirmation, creating a window for data loss that violates an RPO of zero during an unannounced failure.
Synchronous storage replication requires data to be written and acknowledged at both primary and secondary sites before a transaction is marked complete. Asynchronous storage replication, while offering lower latency across geographic distances, allows the primary storage system to acknowledge writes before they are transmitted to the secondary site. Consequently, if the primary site fails unexpectedly, any data in transit or queued for replication is lost, directly violating the requirement of an RPO of zero.

Step-by-Step Solution

1
Analyze the core architectural requirement
The requirement specifies an RPO (Recovery Point Objective) of zero, meaning no data loss is permitted during a failover event.
RPO defines the maximum tolerable period during which data might be lost due to a major incident.
2
Evaluate the capabilities of asynchronous storage replication
Asynchronous replication writes data to the primary storage first and acknowledges the write to the application immediately, sending data to the remote replica asynchronously.
This introduces a latency buffer where un-replicated transactions pending transfer will be lost if the primary site goes offline.
3
Identify the correct high-availability control required
Synchronous storage replication must be used to guarantee RPO = 0, as it requires write confirmation from both sites before committing.
Only synchronous replication ensures that no uncommitted data exists solely on the failing primary node.

Key Concept

Synchronous vs. Asynchronous Replication and RPO Bounds in High Availability Architectures
PreviousPage 35 / 112Next
All practice questions — CompTIA Security+ | Examkin