All practice questions

A security engineer conducts an architecture review of a hypervisor cluster hosting mission-critical enterprise workloads. The assessment reveals that the Out-of-Band (OOB) Baseboard Management Controller (BMC) interfaces of the physical host servers reside on the same IP subnet as the guest virtual machine data traffic. The organization relies exclusively on the enterprise perimeter firewall to restrict outside access, placing no internal firewall rules, microsegmentation, or access control lists (ACLs) between the guest networks and the BMC interfaces. Which of the following architectural vulnerabilities represents the MOST critical threat to the infrastructure?

Match each vulnerability assessment and security testing method on the left with its appropriate operational description on the right.

A security analyst is reviewing incident reports to classify different types of malicious software based on their core behavior and primary indicators of compromise. Match each malware type on the left with its corresponding technical indicator or defining behavior on the right.

Match each threat actor type to its primary defining attribute or motivation in cybersecurity. Which pairings accurately reflect each threat actor profile?

Match each enterprise security management scenario to the cloud service model that reflects its allocation of customer responsibilities under the Shared Responsibility Model.

Match each enterprise host, network, or architecture vulnerability scenario to its primary mitigation strategy.

A security analyst is selecting appropriate security assessment methodologies for an enterprise infrastructure audit. Match each vulnerability assessment and security testing method on the left to its corresponding operational characteristic on the right.

Match each cloud service model to the primary component managed by the enterprise customer under the cloud shared responsibility model.

A security analyst is investigating severe performance slowdowns on a server transferring large archive files across the network. The investigation reveals that the file transfer service uses RSA asymmetric encryption to encrypt the full content of every file being transmitted, rather than using it solely to negotiate a symmetric session key. Which of the following describes the fundamental cryptographic weakness causing this performance issue?

A security analyst is reviewing endpoint telemetry and forensic artifacts across several compromised systems. Match each malware classification on the left with its corresponding technical indicator of compromise (IoC) or behavior on the right.

During a comprehensive security audit following a series of distinct security events across a global enterprise, threat intelligence analysts are categorizing observed activities by threat actor type, attributes, and primary attack vectors. Match each threat actor profile on the left with the enterprise scenario on the right that best exemplifies its characteristic capabilities, motivation, and attack vector.

An enterprise security architect is designing compensating controls for legacy operational technology (OT) controllers on an industrial network. The controllers run an end-of-life operating system that cannot be patched or upgraded due to critical vendor warranty constraints. Which TWO of the following technical mitigation techniques should the security architect implement to prevent privilege escalation and lateral movement without impacting system stability? (Select TWO.)

A financial institution maintains its core transactional database within an on-premises data center to strictly observe regulatory data sovereignty mandates. During peak quarterly reporting periods, local compute capacity is insufficient. The security team implements an automated architecture that securely extends non-sensitive processing workloads into a third-party public cloud environment while maintaining dedicated encrypted connectivity back to the private data center. Which cloud deployment model is being utilized in this scenario?

An incident response team investigates a physical intrusion where an unauthorized cellular bridge was connected inside a financial firm's network distribution room. Reviewing access logs and security footage reveals that an attacker contacted the facilities desk pretending to be an official state electrical inspector. The attacker claimed an imminent safety violation required an emergency inspection of the transfer switches to avoid immediate facility shutdown. Driven by the fear of operational disruption, the staff member generated a temporary badge and granted unescorted access without cross-referencing the official vendor schedule. Which social engineering attack vector and primary principles of influence were combined to execute this breach?

Match each social engineering attack vector to the enterprise incident scenario that best exemplifies its delivery method and tactics.

A security analyst investigates an incident where an attacker compromised a containerized microservice pod and used stolen service account credentials to move laterally and extract confidential data from an internal backend database. The current environment relies primarily on an ingress Web Application Firewall (WAF) and perimeter firewalls, which permitted all internal pod-to-pod traffic once the perimeter was traversed. Which of the following technical mitigation strategies should the organization implement to enforce least privilege access and restrict lateral movement within the container environment?

A security analyst is investigating anomalous network activity within a corporate VLAN. Systems on the subnet experience intermittent latency, and central syslog feeds capture repeated notifications from the primary switch indicating rapid MAC address movement (flapping) for the default gateway across several access ports. Concurrently, network packet captures reveal that the switch has entered a fail-open state, broadcasting unicast frames meant for specific internal servers out of all physical ports on the VLAN. Which of the following attacks is MOST likely occurring?

During a post-incident investigation, a security analyst discovers that an attacker executed a multi-channel campaign against an organization. First, remote administrators received text messages during a off-hours maintenance window directing them to a fake portal to re-authenticate their multi-factor credentials due to an urgent server outage. Second, the attacker telephoned the helpdesk, impersonated the Chief Information Security Officer, and pressured an technician into bypassing standard identity verification to reset a high-privilege account password immediately. Which of the following social engineering attack vectors and influence principles were demonstrated in this incident? (Select TWO)

A threat intelligence team at a global maritime logistics provider is investigating an intrusion into their vessel tracking and scheduling infrastructure. The investigation reveals that an Advanced Persistent Threat (APT) group maintained continuous, undetected access for nine months after obtaining valid third-party vendor API credentials. Forensic analysis indicates the threat actor deployed proprietary, custom-built malware operating exclusively in volatile memory to conduct long-term intelligence gathering. Which TWO of the following attributes and attack vectors typically characterize this specific category of threat actor in contrast to casual hacktivists or script kiddies?

A financial technology firm processes sensitive payment transactions using a serverless architecture (Function-as-a-Service) and utilizes a third-party Software-as-a-Service (SaaS) platform for customer records management. Which of the following security tasks remain the sole responsibility of the enterprise customer across these cloud deployment models? (Select TWO.)