Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 701Question →

A enterprise network security architect is reviewing the organization's network segmentation model across physical, virtual, and industrial environments. Match each network segmentation approach to the business and architectural requirement it best addresses.

Click a left item, then click its matching right item

Items

Air Gap
Microsegmentation
Screened Subnet (DMZ)
Jump Box (Bastion Host)

Matches

Show answer & explanation

Answer

Air Gap matches physical isolation of OT systems; Microsegmentation matches granular software-defined East-West traffic control between workloads; Screened Subnet matches hosting public-facing services separated from private networks; Jump Box matches providing a single audited administrative transit point into sensitive zones.
Air gapping ensures physical isolation for critical OT systems. Microsegmentation enforces policy-based isolation for East-West cloud workload traffic. A screened subnet isolates internet-accessible assets from internal networks, and a jump box securely bridges administrative access into high-security zones.

Step-by-Step Solution

1
Analyze the operational requirements for high-security OT environments requiring total network disconnect.
Identify Air Gap as the physical isolation technique suited for SCADA/ICS safety systems.
Air gapping completely eliminates network vectors by removing physical connection paths.
2
Analyze requirements for preventing lateral movement within modern data center workload tiers.
Identify Microsegmentation as the appropriate control for granular East-West traffic restriction.
Microsegmentation uses software-defined policies to isolate individual container workloads regardless of physical topology.
3
Analyze requirements for exposing public services securely.
Identify Screened Subnet (DMZ) as the perimeter boundary control.
Screened subnets buffer public traffic between internal and external firewalls.
4
Analyze administrative security access requirements for sensitive zones.
Identify Jump Box (Bastion Host) as the controlled management transit server.
Jump boxes enforce centralized authentication, access controls, and logging for administrative sessions.

Key Concept

Secure Network Segmentation Archetypes and Traffic Control Controls
Question 702Question →

An enterprise airport operations authority is redesigning its security architecture across operational technology (OT), cloud management, tenant infrastructure, and administrative networks. Match each network isolation and control mechanism on the left to its corresponding architectural requirement on the right.

Click a left item, then click its matching right item

Items

Unidirectional Data Diode
Microsegmentation with Host-based Enforcement
Hardened Jump Server with MFA and Session Auditing
Physical Air Gap with Media Sanitization Kiosk

Matches

Show answer & explanation

Answer

Unidirectional Data Diode pairs with outbound-only SCADA telemetry; Microsegmentation pairs with stopping East-West lateral movement between cloud microservices; Hardened Jump Server pairs with audited vendor administrative access; Physical Air Gap pairs with isolating critical runway control hardware via offline media ingestion.
Each isolation mechanism aligns with specific threat model requirements: data diodes physically enforce one-way telemetry streaming; microsegmentation controls internal lateral movement across cloud workloads; jump servers control and audit remote management access; air gaps eliminate all network-based attack vectors against critical physical control systems.

Step-by-Step Solution

1
Evaluate hardware-enforced single-direction communication constraints.
Identify that streaming telemetry outbound while physically blocking inbound traffic requires a Unidirectional Data Diode.
Data diodes utilize physical optical transmitters and receivers that prevent electromagnetic or logical return channels.
2
Evaluate lateral communication controls for cloud workloads.
Match Microsegmentation to the requirement of limiting East-West traffic between individual containerized instances.
Traditional perimeter firewalls cannot inspect or restrict peer-to-peer traffic inside the same virtual layer 2 network segment without software-defined microsegmentation.
3
Evaluate privileged remote management architectures.
Match Hardened Jump Server with MFA and Session Auditing to third-party vendor administrative access requirements.
Jump boxes isolate external administrative sessions from internal infrastructure while recording session activity for compliance and forensics.
4
Evaluate total isolation controls for high-consequence OT infrastructure.
Match Physical Air Gap with Media Sanitization Kiosk to the safety-critical automated runway control systems.
Complete physical separation removes external connectivity attack vectors, using controlled offline kiosks as the sole ingestion path for maintenance files.

Key Concept

Network Segmentation and Isolation Architecture Controls
Estimated Time:2m 0s
Question 703Question →

A logistics enterprise is migrating its fleet tracking telemetry infrastructure to a Zero Trust Architecture (ZTA). The security team is defining architecture baseline policies for API communication between edge gateway devices and core analytical microservices. Which of the following technical requirements directly align with core Zero Trust Architecture principles? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Continuously re-evaluate device security posture and request behavior for every API transaction, regardless of network location.; Enforce microsegmentation and dynamic access controls so edge devices are restricted to the minimal resources necessary for their specific function.

Answer

The correct requirements are to continuously re-evaluate device security posture and request behavior for every API transaction regardless of network location, and to enforce microsegmentation and dynamic access controls so edge devices are restricted to the minimal resources necessary for their specific function.
Zero Trust Architecture (ZTA) eliminates implicit network perimeter trust by mandating continuous explicit verification of every transaction (evaluating security posture, location, and behavior) and applying least privilege through microsegmentation to isolate workloads and minimize blast radius.

Step-by-Step Solution

1
Analyze core tenets of Zero Trust Architecture (ZTA).
ZTA operates under an assumed breach mindset, requiring continuous explicit verification and strict least privilege.
Traditional perimeter-based implicit trust models must be abandoned in favor of dynamic context evaluation.
2
Evaluate requirement for continuous context validation.
Every API request must be continuously authenticated and authorized based on dynamic context metrics.
Re-evaluating posture and request behavior prevents compromised endpoints from abusing persistent session trust.
3
Evaluate requirement for microsegmentation and least privilege access.
Access must be restricted granularly to only the exact microservice endpoints required for the gateway's role.
Microsegmentation prevents lateral movement across microservices if an edge device is compromised.

Key Concept

Zero Trust Architecture Principles: Continuous Explicit Verification and Microsegmentation Least Privilege
Question 704Question →

An IT administrator needs to ensure that all data written to enterprise storage drives is automatically encrypted at the hardware level without placing an operational processing burden on the host operating system. Which of the following storage security solutions best fulfills this requirement?

Show answer & explanation

Answer: Self-Encrypting Drives (SED)

Answer

Self-Encrypting Drives (SED)
Self-Encrypting Drives (SEDs) incorporate dedicated cryptographic hardware directly into the drive controller. This enables transparent, full-disk symmetric encryption at rest without consuming host CPU cycles or requiring operating system software configuration.

Step-by-Step Solution

1
Identify the primary system requirement in the scenario.
The requirement calls for hardware-level encryption of bulk data at rest without consuming host OS processing resources.
Software bulk encryption relies on host CPU cycles, whereas hardware encryption offloads cryptographic tasks.
2
Evaluate storage protection mechanisms against the requirement.
Self-Encrypting Drives (SEDs) contain built-in cryptoprocessors that transparently handle symmetric encryption directly on the drive controller.
This guarantees hardware-level protection without host system latency.

Key Concept

Hardware-Based Storage Encryption and Data-at-Rest Architecture
Question 705Question →

A security manager at a retail organization is establishing a threat research and information-sharing strategy. Management wants to receive timely early warnings regarding cyber threats specifically targeting the retail sector and securely exchange anonymized threat telemetry with industry peers. Which of the following sources or mechanisms best fulfills these organizational requirements?

Show answer & explanation

Answer: Participating in a retail sector Information Sharing and Analysis Center (ISAC)

Answer

Participating in a retail sector Information Sharing and Analysis Center (ISAC)
Participating in a sector-specific Information Sharing and Analysis Center (ISAC) allows organizations within a shared industry (such as retail, financial, or healthcare) to receive targeted threat intelligence alerts and securely exchange anonymized indicators of compromise with peer entities.

Step-by-Step Solution

1
Analyze the organization's requirements
Identified the need for sector-specific (retail) threat intelligence and bi-directional information sharing with industry peers.
The organization needs both tailored early warning data and a mechanism to exchange threat telemetry safely.
2
Evaluate potential intelligence sources against requirements
Recognized that Information Sharing and Analysis Centers (ISACs) cater directly to specific critical infrastructure and commercial sectors.
ISACs provide curated threat alerts, analysis, and anonymized sharing frameworks among member organizations within the same industry sector.
3
Differentiate ISACs from technical controls and general repositories
Selected participating in a retail sector ISAC as the primary mechanism.
Technical controls (WAF, honeypots) and general vulnerability databases (NVD) do not offer peer-to-peer industry threat intelligence exchange.

Key Concept

Information Sharing and Analysis Centers (ISACs)
Question 706Question →

An industrial IoT device manufacturer is designing a field-deployed microcontroller unit that operates in physically untrusted locations. Security engineers need to prevent attackers from executing anti-rollback (firmware downgrade) attacks—where an adversary physically unsolders external flash memory and writes a cryptographically valid, but older and vulnerable, firmware image. Which of the following hardware security controls best mitigates this physical firmware downgrade vector?

Show answer & explanation

Answer: One-Time Programmable (OTP) eFuses configured to permanently increment and enforce the minimum allowable firmware security version.

Answer

One-Time Programmable (OTP) eFuses configured to permanently increment and enforce the minimum allowable firmware security version.
One-Time Programmable (OTP) eFuses provide an immutable, hardware-level state mechanism that is permanently burned whenever a new security version is introduced. Prior to booting, the hardware Root of Trust reads the eFuse register to verify that candidate firmware matches or exceeds the minimum allowed security version. This prevents execution of older, vulnerable firmware even if an attacker physically replaces the SPI flash memory chip.

Step-by-Step Solution

1
Analyze the attack vector specified in the scenario.
The adversary has physical access to the device, allows chip desoldering, and attempts to flash an older, cryptographically valid image to exploit fixed software vulnerabilities (anti-rollback attack).
Asymmetric signature verification alone succeeds on old legitimate firmware builds unless an irreversible hardware state maintains the revoked status of previous versions.
2
Evaluate hardware security primitives designed for non-reversible state retention.
One-Time Programmable (OTP) eFuses physically alter microscopic electrical connections on the chip when blown during firmware updates.
Because blown eFuses cannot be unburned or reset, the internal hardware Root of Trust checks candidate firmware version counters against the eFuse register before handing off execution.

Key Concept

Hardware Anti-Rollback and eFuse Revocation Mechanisms
Question 707Question →

Match each Identity and Access Management (IAM) protocol to its primary architectural use case.

Click a left item, then click its matching right item

Items

SAML 2.0
OAuth 2.0
OpenID Connect (OIDC)
RADIUS

Matches

Show answer & explanation

Answer

SAML 2.0 matches XML-based web SSO federation; OAuth 2.0 matches token-based authorization for API access; OpenID Connect matches the authentication identity layer built on OAuth 2.0; RADIUS matches centralized AAA network access control.
Each IAM protocol satisfies a specific architectural domain: SAML 2.0 facilitates XML web federation across organizations; OAuth 2.0 grants granular authorization tokens to APIs; OpenID Connect adds an authentication identity layer over OAuth 2.0 using JWTs; RADIUS delivers network-level AAA for VPNs and wireless infrastructure.

Step-by-Step Solution

1
Identify the primary architectural function (Authentication vs. Authorization vs. Network AAA) for each protocol.
Categorize SAML 2.0 and OIDC as web identity/SSO authentication, OAuth 2.0 as API authorization, and RADIUS as network AAA.
IAM architecture requires matching protocols to their specific layer in the security stack.
2
Differentiate web federation standards based on message format and structure.
Associate SAML 2.0 with XML assertions and OIDC with JSON Web Tokens (JWT) extending OAuth 2.0.
SAML 2.0 is enterprise XML-focused, while OIDC modernizes web authentication over RESTful/JSON endpoints.
3
Pair RADIUS with network-level authentication mechanisms.
Connect RADIUS to 802.1X port security and VPN access control.
RADIUS is designed for infrastructure device network access control, unlike web application protocols.

Key Concept

IAM Protocol Architectural Selection
Estimated Time:45s
Question 708Question →

A system administrator is auditing isolation and runtime protection controls across a enterprise infrastructure hosting both virtual machines and containerized microservices. Match each security control on the left with the specific operational threat or attack vector it directly mitigates on the right.

Click a left item, then click its matching right item

Items

Hypervisor patch management and memory isolation baselines
Linux Control Groups (cgroups) quota enforcement
Read-only root file system configuration for container runtimes
Static image scanning integrated into the CI/CD deployment pipeline

Matches

Show answer & explanation

Answer

Hypervisor patch management matches VM escape exploitation; Control Groups (cgroups) enforcement matches resource exhaustion denial-of-service; Read-only root file system configuration matches malicious file persistence; Static image scanning matches deployment of unpatched software vulnerabilities.
Each security mechanism directly addresses a distinct layer of virtualization or container architecture: hypervisor patching protects hardware abstraction boundaries; cgroups manage shared kernel resource allocation; read-only root file systems enforce immutability at runtime; and static scanning secures software components in the build pipeline.

Step-by-Step Solution

1
Analyze virtual machine isolation mechanisms.
Identify that hypervisor patching specifically targets vulnerabilities allowing guest-to-host privilege escalation and VM escape.
Hypervisors manage hardware virtualization boundaries; failure to patch allows guest workloads to break out of hardware abstraction.
2
Differentiate container resource boundary controls from namespace isolation.
Map Linux Control Groups (cgroups) directly to resource consumption limits.
cgroups set boundaries on system resources like CPU, memory, and disk I/O, preventing neighbor starvation.
3
Evaluate container file system runtime security.
Connect read-only root file systems to preventing unauthorized file modifications and persistence.
Immutable runtime container storage prevents attackers from dropping binaries or modifying system binaries during runtime compromise.
4
Examine pre-deployment supply chain security controls.
Associate CI/CD static image scanning with identifying known vulnerabilities in container images.
Automated scanning checks container layers against vulnerability databases before code is deployed.

Key Concept

Virtualization vs Containerization Security Boundaries
Question 709Question →

A software development firm hosts its multi-tenant build infrastructure on a high-performance Storage Area Network (SAN). During a security assessment, auditors identified two main storage architecture vulnerabilities: block-level data traffic traversing the storage fabric between compute hypervisors and storage arrays is unencrypted and subject to packet sniffing, and logical unit numbers (LUNs) can potentially be accessed by unauthorized host adapters attached to the same fabric switches. Which set of storage architecture controls most effectively mitigates both identified vulnerabilities?

Show answer & explanation

Answer: Enforce Fibre Channel Security Protocol (FC-SP) with IPsec transport encryption across the fabric, paired with hardware switch zoning and storage array LUN masking.

Answer

Enforcing Fibre Channel Security Protocol (FC-SP) with IPsec transport encryption across the fabric, paired with hardware switch zoning and storage array LUN masking, provides comprehensive protection for both data in transit and volume segregation.
The solution requiring Fibre Channel Security Protocol (FC-SP) with IPsec transport encryption across the fabric, paired with hardware switch zoning and storage array LUN masking, directly addresses both security gaps. FC-SP and IPsec encrypt block-level SAN traffic in transit across the storage network, neutralizing passive sniffing attacks. Hardware zoning on SAN switches isolates HBA port communications, and array-level LUN masking restricts logical volume visibility exclusively to authorized initiator World Wide Names (WWNs) or iSCSI Qualified Names (IQNs).

Step-by-Step Solution

1
Analyze data-in-transit security requirements for SAN storage traffic.
Unencrypted block-level storage traffic across Fibre Channel or IP-based SANs requires transport layer encryption such as FC-SP or IPsec to prevent network sniffing.
Encryption at the fabric layer protects raw block communications between hypervisor initiators and array targets.
2
Analyze volume access isolation requirements at the storage layer.
Restricting volume access to authorized host bus adapters (HBAs) requires a combination of network-layer switch zoning and storage-layer LUN masking.
Zoning controls fabric switch communication paths, while LUN masking ensures only designated initiator WWNs/IQNs can mount specific storage volumes.
3
Synthesize the controls into a unified storage security architecture.
Combining FC-SP/IPsec with zoning and LUN masking directly resolves both fabric sniffing and unauthorized LUN mounting threats.
This strategy applies defense-in-depth across the SAN fabric and storage array control plane.

Key Concept

SAN Data Protection and Storage Network Segregation
Estimated Time:2m 0s
Question 710Question →

A security engineer is hardening a shared Linux host operating system that runs containerized financial processing microservices. To minimize the risk of a container escape and kernel compromise, which TWO security mechanisms should the engineer implement to restrict container privileges and limit interaction with the host kernel?

Select all that apply

Show answer & explanation

Answer: Apply custom seccomp (secure computing mode) profiles to restrict the system calls that container processes can issue to the host kernel.; Configure Linux user namespaces to map container root accounts to unprivileged user IDs on the underlying host operating system.

Answer

Applying custom seccomp profiles to restrict host kernel system calls and configuring Linux user namespaces to map container root accounts to unprivileged host users are the correct controls.
The correct controls are applying seccomp profiles and configuring user namespaces. Seccomp profiles limit the system calls containerized processes can make directly to the host kernel, significantly reducing kernel exploit vulnerabilities. User namespaces ensure that even if an application inside a container runs as root, it is mapped to a non-privileged account on the host OS, preventing root access on the host during a breakout.

Step-by-Step Solution

1
Identify the primary threat vector in containerized shared-host architectures.
Containers share a single host kernel, making syscall interface restriction critical to preventing host compromise.
Restricting kernel interactions decreases the surface area available for container escape exploits.
2
Evaluate privilege boundary controls.
User namespaces remap internal container UIDs (such as UID 0) to unprivileged host UIDs.
This prevents container root processes from executing privileged actions on the host OS if container isolation fails.
3
Evaluate syscall restriction controls.
Seccomp limits which system calls can be made by processes within a container to the Linux kernel.
Disabling unused kernel syscalls blocks unauthorized low-level kernel interaction.

Key Concept

Kernel surface reduction and privilege isolation in container security
Question 711Question →

Match each storage security technology to its primary operational function.

Click a left item, then click its matching right item

Items

Tokenization
Self-Encrypting Drive (SED)
Hardware Security Module (HSM)
Data Loss Prevention (DLP)

Matches

Show answer & explanation

Answer

Tokenization maps to replacing sensitive data fields with non-sensitive surrogate tokens; Self-Encrypting Drive (SED) maps to providing automatic, hardware-level block encryption directly on physical storage media; Hardware Security Module (HSM) maps to safeguarding and managing cryptographic keys inside dedicated physical security hardware; Data Loss Prevention (DLP) maps to monitoring and blocking unauthorized transmission or exfiltration of sensitive information.
Tokenization obfuscates data using surrogate tokens; SED provides automated physical drive encryption; HSM secures cryptographic keys; DLP inspects data to prevent unauthorized transfers.

Step-by-Step Solution

1
Analyze each security technology listed on the left.
Identified Tokenization, SED, HSM, and DLP as primary storage and data protection mechanisms.
Each technology satisfies a specific, distinct function within enterprise storage architecture.
2
Match each technology to its unique functional capability.
Tokenization replaces data with surrogate tokens; SED encrypts disk blocks directly; HSM protects cryptographic keys; DLP prevents exfiltration.
Matching capabilities directly tests core knowledge of data protection and storage security mechanisms.

Key Concept

Storage and Data Protection Controls
Question 712Question →

A fintech enterprise is restructuring its cloud-native microservices architecture to mitigate risks associated with lateral movement after a compromised service credential allowed unauthorized database queries. The security engineering team must align service-to-service communication with core Zero Trust Architecture (ZTA) principles. Which implementation strategy best enforces the Zero Trust principles of explicit verification and dynamic access control for every transaction request?

Show answer & explanation

Answer: Configuring the Policy Decision Point (PDP) to continuously evaluate identity attributes, contextual threat intelligence, and resource compliance state before issuing per-request authorization decisions to the Policy Enforcement Point (PEP).

Answer

Configuring the Policy Decision Point (PDP) to continuously evaluate identity attributes, contextual threat intelligence, and resource compliance state before issuing per-request authorization decisions to the Policy Enforcement Point (PEP).
In a Zero Trust Architecture (ZTA), access decisions are never granted implicitly based on network location or initial login state. Instead, the Policy Decision Point (PDP) continuously evaluates contextual attributes (such as service identity, device compliance, telemetry, and threat risk) for every request, instructing the Policy Enforcement Point (PEP) to enforce fine-grained access control.

Step-by-Step Solution

1
Analyze the core architectural requirements of Zero Trust Architecture (NIST SP 800-207 framework).
Zero Trust requires explicit verification of every access attempt, continuous risk assessment, least privilege access, and strict separation between the control plane and data plane.
Implicit trust based on network location or session duration must be eliminated to prevent lateral movement.
2
Differentiate between the functional roles of the Policy Decision Point (PDP) and Policy Enforcement Point (PEP).
The PDP acts in the control plane to evaluate policy parameters (user identity, device health, risk score, context) and generates authorization decisions. The PEP acts in the data plane to allow or block individual communication flows based on PDP directives.
Decoupling policy computation from traffic forwarding ensures granular, dynamic, and centrally managed security enforcement.
3
Evaluate the choices against Zero Trust tenets.
Evaluating identity attributes and contextual posture per-request via the PDP to instruct the PEP is the only strategy that eliminates implicit perimeter trust and enforces explicit per-request verification.
Options relying on subnet trust, long-lived session tokens, or pure anomaly detection fail to implement dynamic, identity-centric access control.

Key Concept

Zero Trust Architecture Control Plane Separation and Continuous Explicit Verification
Estimated Time:2m 0s
Question 713Question →

A security analyst is investigating an automated SIEM threshold alert triggered by unusual outbound network activity from an internal host (192.168.10.114). The analyst reviews the following DNS query log entries within the SIEM dashboard:

text
27-Jul-2026 14:15:01.123 queries: info: client 192.168.10.114#49152 (a1g4z9x8q.exfil.attacker-domain.com): query: a1g4z9x8q.exfil.attacker-domain.com IN TXT +
27-Jul-2026 14:15:01.450 queries: info: client 192.168.10.114#49152 (b9k2m8p3w.exfil.attacker-domain.com): query: b9k2m8p3w.exfil.attacker-domain.com IN TXT +
27-Jul-2026 14:15:01.890 queries: info: client 192.168.10.114#49152 (c3r7v1q5n.exfil.attacker-domain.com): query: c3r7v1q5n.exfil.attacker-domain.com IN TXT +
27-Jul-2026 14:15:02.210 queries: info: client 192.168.10.114#49152 (d4m9p2k7x.exfil.attacker-domain.com): query: d4m9p2k7x.exfil.attacker-domain.com IN TXT +

Based on the log data, which of the following security events is MOST likely taking place?

Show answer & explanation

Answer: DNS tunneling used for data exfiltration or command-and-control communication

Answer

The log entries indicate DNS tunneling used for data exfiltration or command-and-control communication.
The correct answer identifies DNS tunneling. The log snippet reveals an internal host generating rapid, high-frequency DNS queries requesting TXT records with encoded, randomized subdomains appending an external domain. Because DNS traffic often bypasses strict firewall filters, attackers encapsulate data or C2 traffic inside DNS request and response fields.

Step-by-Step Solution

1
Examine the log structure and source client
Identified client host 192.168.10.114 issuing rapid, high-frequency outbound queries to an external destination domain (attacker-domain.com).
Determining the origin and frequency of requests helps distinguish automated host behavior from regular user browsing.
2
Analyze the query record type and hostname patterns
Queries request TXT records containing randomized/encoded alphanumeric subdomains (e.g., a1g4z9x8q.exfil...).
TXT records allow arbitrary text payload retrieval, and dynamic subdomains are commonly encoded chunks of data sent to an attacker's authoritative name server.
3
Correlate patterns with known threat tactics
High-volume, encoded TXT queries targeting a single sub-domain structure match the signature of DNS tunneling for covert data exfiltration or C2.
DNS traffic is often allowed through firewalls, making it an ideal vector for protocol encapsulation and stealthy data transfer.

Key Concept

DNS Tunneling Detection via SIEM Log Analysis
Question 714Question →

A system administrator is hardening container instances operating on a shared host. Which TWO of the following mechanisms directly enforce kernel-level isolation and resource boundaries for container processes?

Select all that apply

Show answer & explanation

Answer: Linux namespaces and control groups (cgroups); Seccomp profiles restricting allowed system calls

Answer

Linux namespaces and control groups (cgroups), alongside seccomp profiles restricting allowed system calls, provide direct kernel-level process isolation and resource boundary enforcement for containerized environments.
Containers rely on kernel-level primitives. Linux namespaces isolate system resources (such as process trees, mount points, and network stacks), cgroups constrain resource consumption, and seccomp restricts the system calls available to containerized processes.

Step-by-Step Solution

1
Identify container isolation mechanisms operating at the host kernel layer.
Linux namespaces provide process boundary separation, cgroups limit hardware resource allocation, and seccomp limits system call access.
Containers share the host operating system kernel, requiring kernel-level security features to restrict process permissions and resource access.
2
Evaluate and eliminate non-container isolation mechanisms.
Perimeter firewalls filter network traffic rather than host processes, and Type-1 hypervisors provide full VM hardware isolation rather than standard container isolation.
External network controls and hypervisor virtualization do not provide standard process isolation inside a shared OS container environment.

Key Concept

Kernel-level container isolation mechanisms
Question 715Question →

A security operations team at a financial technology firm discovers that an external adversary maintained undetected access inside their cloud development pipeline for over eight months. The adversary utilized custom zero-day exploits, digitally signed binary payloads, and target-tailored command-and-control channels to exfiltrate proprietary trading algorithms without demanding ransom or disrupting services. Which of the following threat actor attributes and attack vectors are demonstrated in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: High operational sophistication and substantial resource backing characteristic of a nation-state threat actor.; Strategic attack vectors leveraging zero-day vulnerabilities and compromised software supply chain components.

Answer

The correct answers identify high operational sophistication with nation-state backing and the use of strategic zero-day and supply chain attack vectors.
The scenario describes an Advanced Persistent Threat (APT) possessing high technical sophistication, extensive financial/technological resources, and long-term patience typical of nation-state threat actors. Furthermore, infiltrating a cloud development environment via zero-day vulnerabilities exemplifies modern supply chain and third-party development attack vectors.

Step-by-Step Solution

1
Analyze the threat actor's attributes from the scenario details.
Eight months of undetected persistence, custom zero-day exploits, and signed binaries indicate extreme technical sophistication, deep resources, and strategic intent rather than opportunistic crime.
Nation-state threat actors (APTs) are defined by high resources, advanced skills, long-term persistence, and strategic exfiltration objectives.
2
Evaluate the attack vector and mechanism employed.
Targeting the cloud development pipeline and leveraging zero-day vulnerabilities align directly with supply chain attack vectors and zero-day exploitation techniques.
Development pipeline compromise allows adversaries to insert malicious code or steal intellectual property directly from the software building process.

Key Concept

Threat Actor Attributes and Attack Vectors
Question 716Question →

A security operations analyst is evaluating several network monitoring alerts and packet captures from an enterprise environment. Match each observed technical indicator on the left with its corresponding attack classification on the right.

Click a left item, then click its matching right item

Items

High volume of 802.11 management frames containing frame subtype 0x000C causing widespread client drops
Unsolicited ICMPv6 Type 134 packets broadcast across a segment overriding client default gateways
Ethernet frames containing dual 802.1Q headers transmitted over a native trunk port to reach an isolated segment
Unsolicited vCard contact details pushed to employee mobile devices via short-range RF connections

Matches

Show answer & explanation

Answer

The technical indicators match their corresponding attack classifications as follows: 802.11 subtype 0x000C frames map to Disassociation Attack; ICMPv6 Type 134 packets map to Rogue IPv6 Router Advertisement; dual 802.1Q headers map to Double Tagging VLAN Hopping; and unsolicited Bluetooth vCards map to Bluejacking.
Each indicator corresponds to a distinct network or wireless attack mechanism: 802.11 disassociation frames (0x000C) break active Wi-Fi sessions; ICMPv6 Type 134 packets distribute rogue default gateway details; dual 802.1Q VLAN headers enable switch trunk hopping; and unsolicited Bluetooth vCards represent Bluejacking.

Step-by-Step Solution

1
Analyze the 802.11 wireless frame indicator
Identify frame subtype 0x000C as an 802.11 disassociation frame.
Spoofed disassociation frames force wireless clients to disconnect from their legitimate access point.
2
Analyze the IPv6 ICMP message type
Identify ICMPv6 Type 134 as a Router Advertisement message.
Unauthorized RA packets alter IPv6 neighbor discovery and divert traffic through a rogue gateway.
3
Analyze the Layer 2 frame header structure
Identify dual 802.1Q VLAN encapsulation tags as double tagging.
Switches processing native VLAN traffic strip the outer header, allowing the inner VLAN tag to bypass switch port isolation.
4
Analyze the mobile short-range wireless activity
Identify unsolicited Bluetooth vCard transfers as Bluejacking.
Bluejacking uses OBEX protocol to send uninvited messages to Bluetooth targets without exfiltrating data.

Key Concept

Distinguishing technical indicators of Layer 2 switch attacks, wireless denial-of-service, and network auto-configuration spoofing.
Question 717Question →

A biopharmaceutical research enterprise is refactoring its data protection and storage security architecture across a hybrid deployment containing high-throughput NVMe Storage Area Network (SAN) arrays and off-site cloud object storage. The design must ensure zero-trust data protection for proprietary genomic data at rest and during transit, enforce cryptographically isolated key management, maintain ultra-low latency bulk encryption, and prevent sensitive data exfiltration from endpoint storage interfaces. Which of the following architectural controls should the security architect select to satisfy these enterprise security objectives? (Select THREE.)

Select all that apply

Show answer & explanation

Answer: Deploy Hardware Security Modules (HSMs) integrated via Key Management Interoperability Protocol (KMIP) to isolate Key Encryption Keys (KEKs) from host systems and manage Data Encryption Key (DEK) wrapping.; Configure Self-Encrypting Drives (SEDs) featuring hardware-based AES bulk encryption and cryptographic erase (crypto-shredding) functionality on the storage array controller.; Implement contextual Data Loss Prevention (DLP) controls at storage egress points and endpoints to monitor pattern signatures and block unauthorized exfiltration.

Answer

The correct controls are deploying HSMs via KMIP for isolated key management, utilizing hardware SEDs for low-latency bulk encryption at rest, and deploying DLP controls to prevent data exfiltration.
The combination of HSM-managed key envelopes via KMIP, array-level SED symmetric encryption, and enterprise DLP deployment provides complete defense-in-depth across data lifecycle states (rest, transit, use) while preserving NVMe SAN performance and regulatory separation of duties.

Step-by-Step Solution

1
Analyze key management and cryptographic isolation requirements.
Identified envelope encryption via HSM and KMIP as the robust standard for isolating Key Encryption Keys (KEKs) and wrapping Data Encryption Keys (DEKs).
Cryptographic key separation ensures storage administrators cannot compromise raw keys directly from storage nodes.
2
Evaluate high-performance bulk data storage encryption methods for NVMe SAN arrays.
Selected hardware-based Self-Encrypting Drives (SEDs) utilizing AES symmetric encryption.
Hardware-based SEDs offload cryptographic overhead from host CPUs, sustaining high NVMe throughput while offering instant crypto-shredding capability.
3
Address data exfiltration threats across storage and endpoint boundaries.
Enforced inline and endpoint Data Loss Prevention (DLP) monitoring.
DLP inspects content pattern markers to restrict unauthorized copying or egress of proprietary intellectual property.

Key Concept

Enterprise Data Protection and Storage Architecture Controls
Question 718Question →

A smart utility metering company is migrating its real-time telemetry processing pipeline to a public cloud environment. The architecture utilizes cloud-hosted virtual machines (IaaS) for running custom protocol ingestion agents and a fully managed database service (PaaS) for long-term data warehousing. Which TWO of the following operational security tasks remain the direct responsibility of the utility company's security team across both service models?

Select all that apply

Show answer & explanation

Answer: Configuring role-based access controls and identity permissions for database objects and virtual machines; Encrypting customer metering data at rest and managing the cryptographic key rotation policies

Answer

The utility company remains directly responsible for configuring role-based access controls and identity permissions, as well as encrypting customer metering data at rest and managing key rotation policies.
Under the cloud Shared Responsibility Model, data security (including data encryption at rest and managing encryption keys) and identity governance (configuring user access permissions and role-based policies) are strictly customer responsibilities regardless of whether IaaS, PaaS, or SaaS is utilized. The cloud service provider manages lower-level physical infrastructure and platform components, but tenant data configuration and access rights are always managed by the customer.

Step-by-Step Solution

1
Analyze the cloud deployment components and service models in the scenario.
The infrastructure uses Infrastructure as a Service (IaaS) for virtual machine ingestion agents and Platform as a Service (PaaS) for the managed data warehouse.
Identifying the service models establishes the division of duties under the Shared Responsibility Model.
2
Evaluate candidate security tasks against customer vs. Cloud Service Provider (CSP) responsibility boundaries.
The CSP manages physical facilities, hypervisors, server hardware, and database engine infrastructure. The customer retains control and responsibility over identity/access management (IAM), data security, data classification, and encryption configuration across both service types.
Under the cloud shared responsibility model, ownership of data and access control configurations always resides with the customer tenant.

Key Concept

Shared Responsibility Model across IaaS and PaaS deployment models
Question 719Question →

A logistics enterprise hosting financial transaction archives on an enterprise Storage Area Network (SAN) must ensure bulk data at rest remains cryptographically protected if physical drives are stolen or improperly decommissioned. The security architecture team mandates that encryption and decryption operations execute directly on the storage controller hardware without host server performance overhead, while key generation and key lifecycle management must remain strictly isolated inside a dedicated FIPS 140-3 validated key management appliance. Which of the following storage security solutions best meets these requirements?

Show answer & explanation

Answer: Deploy Self-Encrypting Drives (SEDs) within the storage array and integrate them with an external Hardware Security Module (HSM) using the Key Management Interoperability Protocol (KMIP).

Answer

Deploying Self-Encrypting Drives (SEDs) integrated with an external Hardware Security Module (HSM) via KMIP is the correct storage security architecture choice.
Combining hardware-based Self-Encrypting Drives (SEDs) with an external Hardware Security Module (HSM) satisfies both performance and key isolation constraints. SEDs perform symmetric encryption directly on the drive controller to eliminate host system overhead, while the HSM acts as a centralized, FIPS-validated appliance for managing root keys via standardized protocols like KMIP.

Step-by-Step Solution

1
Analyze performance and hardware encryption requirements
Self-Encrypting Drives (SEDs) use built-in media encryption keys (MEK) and hardware logic to encrypt/decrypt data at wire speeds without host CPU load.
The scenario requires zero performance overhead on the host OS servers during bulk storage encryption.
2
Analyze external key management requirements
An external Hardware Security Module (HSM) communicating via Key Management Interoperability Protocol (KMIP) securely generates, stores, and manages Key Encryption Keys (KEKs) for the storage array.
The requirement specifies keeping key lifecycle management isolated inside a FIPS 140-3 validated appliance.

Key Concept

Storage Encryption at Rest and HSM-based Key Management Architecture
Estimated Time:1m 30s
Question 720Question →

A network security analyst investigating connectivity issues on a corporate subnet captures traffic from an interface receiving anomalous activity. Packet inspection reveals thousands of broadcast DHCPDISCOVER requests sent within a 10-second window, each specifying a unique, randomized client hardware MAC address. As a result, legitimate clients on the network are receiving IP address APIPA configurations due to scope exhaustion. Which of the following attack indicators is described in this scenario?

Show answer & explanation

Answer: DHCP starvation

Answer

The attack indicator described in the scenario is DHCP starvation.
The correct answer identifies DHCP starvation. In a DHCP starvation attack, an attacker broadcasts a large volume of DHCPDISCOVER frames using randomized MAC addresses. The DHCP server responds by leasing out available IP addresses until the entire address pool scope is depleted. Consequently, legitimate workstations requesting an IP address fail to receive one and fall back to Automatic Private IP Addressing (APIPA).

Step-by-Step Solution

1
Analyze the observed network traffic pattern.
The capture shows rapid broadcast of DHCPDISCOVER frames containing unique, randomized client hardware MAC addresses.
Identifying the protocol and specific message type helps isolate the resource being targeted.
2
Evaluate the operational impact on client endpoints.
Legitimate devices fail to receive IP leases from the server pool and default to APIPA addresses (169.254.x.x169.254.x.x).
Exhaustion of all available pool addresses is the direct outcome of spoofed requests occupying leases.
3
Correlate protocol patterns and impacts with security attack classifications.
Generating spoofed MAC requests to consume all DHCP pool leases defines a DHCP starvation attack.
Distinguishing DHCP starvation from Rogue DHCP or MAC flooding relies on identifying whether the target is the DHCP IP lease pool or Layer 2 switch CAM tables.

Key Concept

DHCP Starvation Attack Indicators
Estimated Time:1m 15s
PreviousPage 36 / 112Next
All practice questions — CompTIA Security+ | Examkin