All practice questions

Match each vulnerability assessment and security testing method to its corresponding operational characteristic.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Credentialed Scanning pairs with direct host queries using administrative rights; SAST pairs with non-execution analysis of source code; DAST pairs with external black-box testing of running applications; Passive Monitoring pairs with analyzing mirrored packet flows without active probes.

Each security assessment method maps directly to its core function: credentialed scanning uses administrative access for host audits; SAST analyzes uncompiled/static code; DAST tests executing web apps; and passive network monitoring analyzes mirrored traffic safely.

Step-by-Step Solution

1

Identify the operation mode of Credentialed Vulnerability Scanning.

It logs into host operating systems using administrative credentials to check patch levels.

Authenticating directly to target hosts yields internal configuration visibility without relying on network probing.

2

Distinguish SAST from DAST based on application execution status.

SAST checks static code prior to deployment, while DAST tests live, running web applications.

SAST identifies code-level security issues before execution, whereas DAST uncovers runtime configuration and input handling weaknesses.

3

Differentiate passive monitoring from active vulnerability scanning.

Passive monitoring relies on mirrored network telemetry without generating active probe traffic.

Observing traffic non-intrusively protects sensitive environments (such as OT/ICS) from network-induced destabilization.

Key Concept

Selecting appropriate vulnerability testing methodologies based on execution state, authentication level, and operational impact risk.

Question 62Question →

Match each technical telemetry scenario with its corresponding malware classification based on the observed indicators of compromise.

Click a left item, then click its matching right item

Show answer & explanation

Answer

PowerShell memory-only execution matches Fileless Malware; Ring 0 DKOM manipulation matches Rootkit; Conditional script trigger matches Logic Bomb; Autonomous self-propagation matches Worm.

The paired classifications accurately reflect the technical behavior of each malware category: memory-only PowerShell execution represents fileless malware, Ring 0 DKOM manipulation represents a rootkit, conditional payload execution represents a logic bomb, and autonomous SMB scanning represents a worm.

Step-by-Step Solution

1

Analyze the technical indicators in each scenario.

Identified volatile memory execution, kernel-level cloaking, triggered execution, and autonomous network propagation.

Differentiating malware types relies on analyzing execution mechanics, persistence mechanisms, and propagation behavior.

2

Map execution mechanics to malware definitions.

Living-off-the-land memory execution aligns with fileless malware, while Ring 0 system cloaking maps to rootkits.

Fileless malware minimizes disk footprint; rootkits conceal artifacts by altering low-level OS operations.

3

Map trigger conditions and propagation characteristics.

Status-triggered malicious scripts map to logic bombs; self-directed SMB scanning maps to worms.

Logic bombs rely on specific logical triggers, whereas worms actively scan and infect network targets independently.

Key Concept

Malware Types and Indicators of Compromise

Question 63Question →

Match each threat actor profile to the primary attribute combination and attack strategy that most accurately characterizes their operations.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Nation-state adversaries correspond to extensive funding, high sophistication, and geopolitical espionage goals. Hacktivist collectives match ideological motivation with public-facing attacks like DDoS and defacement. Disgruntled insiders possess internal credentials and act out of grievance or financial incentive. Organized crime syndicates deploy profit-driven ransomware operations with high capabilities.

Each threat actor type possesses distinct attributes: nation-states focus on strategic state-sponsored espionage with custom vectors; hacktivists aim for public awareness using disruption tactics; insiders utilize legitimate credentials for malicious exfiltration; and organized crime syndicates operate as sophisticated financial enterprises.

Step-by-Step Solution

1

Analyze the motivation, funding, and sophistication of nation-state actors.

Identified geopolitical espionage, high funding, stealth, and supply chain vectors.

Nation-states focus on long-term intelligence gathering backed by state resources.

2

Evaluate the primary drivers and vectors of hacktivist groups.

Matched to political/social ideology and high-visibility disruption tactics like DDoS.

Hacktivists seek publicity for their cause rather than covert intelligence or monetary gain.

3

Differentiate insider threats from external actors.

Matched to internal access capabilities and grievance-driven exfiltration.

Insiders exploit preexisting legitimate privileges to bypass perimeter controls.

4

Identify the core attributes of organized cybercrime syndicates.

Matched to monetary profit targets and ransomware extortion models.

Organized crime prioritizes financial returns over political or strategic objectives.

Key Concept

Threat Actor Profiling and Attributes

Question 64Question →

An enterprise security architect is establishing an operational governance framework for cloud adoption across multiple business units. Match each security administration task on the left with the primary responsible party under the cloud shared responsibility model on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Guest OS configuration matches Customer responsibility in IaaS; Application and API security match Customer responsibility in PaaS; Identity and data governance match Customer responsibility in SaaS; Physical infrastructure and hypervisor maintenance match Cloud Service Provider baseline responsibility.

The cloud shared responsibility matrix defines operational boundaries based on service abstraction. Infrastructure as a Service requires customers to maintain everything above the hypervisor (including OS patching and host firewall rules). Platform as a Service offloads OS and runtime management to the vendor, leaving application code, API security, and database schemas with the customer. Software as a Service offloads full application maintenance, yet identity lifecycle and data protection remain customer duties. Physical datacenter facilities, hardware, and hypervisor security remain the provider's responsibility across all public cloud service models.

Step-by-Step Solution

1

Evaluate Infrastructure as a Service (IaaS) boundary

Determine that virtual machine OS configuration, kernel settings, and host firewalls fall on the subscriber side of the boundary.

IaaS provides raw compute infrastructure where the provider stops managing at the hypervisor layer.

2

Evaluate Platform as a Service (PaaS) boundary

Determine that managing code, API access tokens, and data schema falls to the subscriber.

PaaS abstracts compute and OS management, allowing subscribers to focus purely on application logic and dataset design.

3

Evaluate Software as a Service (SaaS) boundary

Determine that user authentication policies and data governance remain customer responsibilities.

Even when application hosting and infrastructure are completely managed by a vendor, data ownership and credential security never shift away from the customer.

4

Evaluate Cloud Service Provider baseline obligations

Identify physical datacenter security, power infrastructure, and hypervisor maintenance as universal provider duties.

The provider owns and manages the physical hardware and underlying virtualization layer supporting public cloud instances.

Key Concept

Cloud Shared Responsibility Model across Service Models (IaaS, PaaS, SaaS)

Question 65Question →

A security analyst conducts a comprehensive infrastructure security assessment across enterprise systems. Match each security assessment finding to its corresponding host, network, or architecture vulnerability classification.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Container process namespace escape matches Host Operating System Isolation Vulnerability. Dynamic open RPC endpoint exposure matches Unauthenticated Network Service Exposure. Hardcoded firmware private keys match Embedded System Credential Flaw. Cleartext HTTP session transmission over flat subnets matches Cleartext Protocol Architecture Weakness.

Each security assessment finding maps directly to its specific vulnerability domain: kernel namespace breakouts represent host isolation flaws, open RPC management interfaces represent unauthenticated service exposure, hardcoded embedded keys represent firmware credential weaknesses, and HTTP session token transmission across unsegmented subnets represents cleartext protocol architecture weaknesses.

Step-by-Step Solution

1

Analyze host-level virtualization and container runtime security boundaries.

Determine that escaping container boundaries to access host memory breaks host kernel isolation.

Containers share the host operating system kernel, so kernel exploits compromise host isolation.

2

Evaluate network service configurations and access control policies.

Identify that unauthenticated RPC listener endpoints expose critical infrastructure interfaces to arbitrary network clients.

Exposing internal management services without authentication allows unauthenticated remote execution.

3

Inspect embedded hardware firmware key management implementation.

Classify static private keys burned into firmware images as embedded device credential flaws.

Shared hardcoded keys allow attackers to intercept traffic or impersonate any deployed hardware unit.

4

Review network protocol encryption and network segmentation controls.

Link unencrypted HTTP session token transit on unsegmented subnets to cleartext protocol architecture weaknesses.

Lack of transport-layer security combined with flat network topology permits credential sniffing by adjacent hosts.

Key Concept

Host, Network, and Architecture Vulnerabilities

Question 66Question →

A security analyst is reviewing telemetry logs and incident report artifacts following a series of network anomalies. Match each observed technical telemetry artifact on the left with its corresponding malware classification on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Execution of PowerShell via WMI matches Fileless Malware; VBR modification matches Bootkit; HR database deletion trigger matches Logic Bomb; Word spawning svchost for C2 matches Remote Access Trojan (RAT).

Each telemetry artifact distinctly maps to its underlying malware mechanism: in-memory execution via system binaries matches fileless malware; boot sector modification prior to OS load matches bootkit persistence; event-triggered malicious payloads represent logic bombs; and process tree anomalies establishing remote command channels indicate Remote Access Trojans.

Step-by-Step Solution

1

Analyze memory and file system artifacts

In-memory execution of obfuscated scripts via native tools (WMI/PowerShell) indicates Fileless Malware.

Fileless malware avoids traditional disk-based detection by operating exclusively in volatile memory.

2

Evaluate boot sequence persistence mechanisms

Pre-boot code execution altering the Volume Boot Record indicates a Bootkit.

Bootkits target the storage system's boot sectors to gain control before operating system security controls initiate.

3

Examine event-driven triggers

Code scheduled to run upon HR database user purging matches a Logic Bomb.

Logic bombs lie dormant until specific environmental conditions or administrative events execute the payload.

4

Analyze process tree lineage and network behavior

Productivity software spawning system host processes that initiate outbound command-and-control traffic matches a Remote Access Trojan (RAT).

RATs typically leverage process hollowing or malicious process spawn techniques to conceal C2 communications.

Key Concept

Malware Telemetry and Indicator Classification

Estimated Time:2m 0s

Question 67Question →

Match each enterprise security incident scenario to the primary social engineering attack vector it exemplifies.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The compromised industry news site matches Watering Hole Attack; the tailored executive emails match Spear Phishing; following an employee through a secure doorway matches Tailgating; and the fake IT support text messages match Smishing.

Each incident scenario aligns with a specific vector: Watering Hole attacks infect third-party websites commonly visited by target groups; Spear Phishing uses customized digital messages targeted at specific organizational roles; Tailgating exploits human politeness to breach physical entry points; and Smishing uses mobile SMS messaging to deceive targets.

Step-by-Step Solution

1

Analyze Scenario 1 involving the compromise of a trusted third-party website visited by target personnel.

Identified as a Watering Hole Attack because the vector relies on infecting a site known to be frequented by a specific target group.

This strategy avoids direct communication with targets and exploits implicit trust in external resources.

2

Analyze Scenario 2 involving customized emails sent to specific financial personnel with confidential internal context.

Identified as Spear Phishing because it targets specific individuals using recon-derived information.

Unlike bulk phishing, spear phishing relies on targeted context to increase credibility.

3

Analyze Scenario 3 involving physical entry behind an authorized employee carrying packages.

Identified as Tailgating, a physical social engineering method.

The attacker relies on social courtesy and physical distraction to bypass physical access controls.

4

Analyze Scenario 4 involving fake IT support messages delivered to mobile phones via SMS.

Identified as Smishing (SMS Phishing).

Smishing specifically uses cellular text messaging services to deliver phishing lures.

Key Concept

Classification of Social Engineering Vectors and Tactical Indicators

Question 68Question →

An enterprise security operations center is reviewing four complex, multi-stage security incidents involving targeted human manipulation. Match each social engineering tactical delivery technique on the left to the corresponding operational scenario indicator on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Reverse Social Engineering matches the scenario where an adversary causes network disruptions and advertises a fake helpline so victims call them. MFA Fatigue with Vishing matches the scenario involving repeated push notification prompts coupled with an urgent phone call from a fake technician. Watering Hole Attack matches the scenario where a niche vendor technical forum frequented by engineers is compromised. Pretexting with Typosquatting matches the scenario where a lookalike supplier domain and false narrative are used to modify invoice payment details.

Each attack vector is correctly paired based on operational mechanics: Reverse Social Engineering relies on victim-initiated contact; MFA Fatigue combined with Vishing leverages pushed authentication spam alongside voice coercion; Watering Hole attacks exploit trusted industry watering holes/websites; and Pretexting with Typosquatting combines fraudulent role-play with misleading lookalike domains.

Step-by-Step Solution

1

Analyze the tactical delivery methods

Identify key characteristics of Reverse Social Engineering, MFA Fatigue/Vishing, Watering Hole, and Pretexting with Typosquatting.

Matching requires identifying the core delivery vector and psychological levers used in each attack.

2

Evaluate the first scenario involving breakroom flyers and self-initiated victim calls

Map to Reverse Social Engineering.

In reverse social engineering, the target relies on assistance published by the attacker, initiating the contact themselves.

3

Evaluate the second scenario involving compromised niche vendor forums

Map to Watering Hole Attack.

Watering hole attacks selectively infect websites known to be trusted and frequented by the target demographic.

4

Evaluate the third scenario involving off-hours push prompts and phone calls

Map to MFA Fatigue with Vishing.

Push spamming weakens user resistance through repetitive MFA prompts, while voice phishing reinforces the false urgency.

5

Evaluate the fourth scenario involving lookalike vendor domains and executive impersonation

Map to Pretexting with Typosquatting.

Typosquatting provides technical plausibility via lookalike domains, while pretexting builds the false narrative to redirect funds.

Key Concept

Social Engineering Attack Vectors and Incident Indicators

Question 69Question →

A security technician is categorizing host and network vulnerabilities discovered during an enterprise infrastructure audit. Match each vulnerability descriptor on the left with its primary architectural risk on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Unpatched Out-of-Band (OOB) Baseboard Management Controller (BMC) matches Direct hardware-level control bypassing host operating system security controls; Use of unencrypted SNMPv1 community strings across network subnets matches Interception of telemetry data and management passwords via network sniffing; Unauthenticated HTTP access to Instance Metadata Service (IMDS) matches Temporary cloud identity credential harvesting via Server-Side Request Forgery (SSRF); Unsupported End-of-Life (EOL) operating system on an unsegmented network matches Unmitigated exploit execution enabling rapid lateral movement.

Each host and network vulnerability corresponds to its specific operational impact: BMC management interfaces provide raw hardware control below the OS layer; cleartext SNMPv1 leaks management community strings; IMDS endpoints allow SSRF attacks to harvest temporary cloud security tokens; and unpatched EOL operating systems grant unmitigated exploit opportunities on flat networks.

Step-by-Step Solution

1

Examine the scope and operational layer of each vulnerability listed on the left.

Identified physical out-of-band management controllers, unencrypted management protocols, cloud metadata endpoints, and legacy host operating systems.

Accurate risk classification requires analyzing where each component operates in the enterprise architecture.

2

Correlate out-of-band management (BMC) with low-level hardware risks.

BMCs control server hardware directly and bypass host OS security controls when compromised.

OOB hardware interfaces run dedicated firmware below the main operating system level.

3

Correlate legacy management protocols (SNMPv1) with network eavesdropping risks.

Cleartext transmission permits unauthorized traffic inspection and credential theft.

SNMPv1 does not provide packet encryption or cryptographic authentication.

4

Correlate cloud IMDS endpoints with web/application exploitation vectors.

IMDS exposes sensitive identity role credentials to local application calls, creating SSRF risks.

Cloud instance metadata services reply to unauthenticated HTTP GET requests from internal interfaces.

5

Correlate unsupported EOL operating systems with vulnerability exploitation risks.

Unpatched legacy platforms allow unmitigated exploit execution and rapid network propagation.

Vendors cease issuing security updates for EOL products, leaving known vulnerabilities open.

Key Concept

Host, Network, and Architecture Vulnerabilities

Question 70Question →

Match each malware type on the left with its corresponding technical indicator of compromise (IoC) on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Ransomware pairs with mass file encryption and payment demand; Keylogger pairs with keystroke interception and recording; Logic Bomb pairs with dormant code triggered by specific events; Rootkit pairs with kernel-level modifications hiding processes.

Each malware type directly matches its signature telemetry: Ransomware performs bulk file encryption for extortion; Keyloggers record user input; Logic bombs execute based on predefined system triggers; Rootkits alter kernel structures to maintain stealth.

Step-by-Step Solution

1

Examine the operational objective of each listed malware classification.

Identified key goals: extortion for Ransomware, credential harvesting for Keyloggers, conditional malicious execution for Logic Bombs, and deep OS evasion for Rootkits.

Understanding malware objectives reveals their corresponding technical telemetry.

2

Map each malware category to its distinct primary indicator of compromise (IoC).

Ransomware matches file encryption/ransom instructions; Keylogger matches recorded keystrokes; Logic Bomb matches event/time trigger; Rootkit matches kernel obfuscation.

Correlating telemetry traits enables security analysts to correctly identify and mitigate threats.

Key Concept

Malware Classifications and Technical IoCs

Question 71Question →

Match each threat actor type on the left with its defining capability, access level, or primary motivation on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Nation-state actors correspond to state sponsorship and advanced persistent threat capabilities. Insider threats correspond to existing legitimate privileges. Hacktivists correspond to ideological or political motivations. Script kiddies correspond to low technical sophistication using pre-existing scripts.

Nation-state actors possess high sophistication and state funding. Insider threats leverage authorized internal access. Hacktivists operate based on social/political motives. Script kiddies rely on pre-written tools due to limited skill.

Step-by-Step Solution

1

Analyze each threat actor category based on standard cybersecurity taxonomy.

Identified key threat actors: Nation-state, Insider threat, Hacktivist, and Script kiddie.

Threat actors are categorized by sophistication, motivation, resources, and access levels.

2

Evaluate the distinguishing attributes listed on the right.

Mapped each threat actor to its primary attribute.

Correct alignment demonstrates fundamental knowledge of threat actor profiles and operational risk vectors.

Key Concept

Threat Actor Attributes and Classifications

Question 72Question →

An enterprise security auditor discovers several vulnerabilities across an organization's internal infrastructure during a comprehensive technical posture assessment. Match each identified host and network vulnerability indicator on the left to its corresponding primary security risk on the right. Which of the following correctly pairs each vulnerability indicator with its primary security risk?

Click a left item, then click its matching right item

Show answer & explanation

Answer

The correct pairings match each host/network vulnerability to its specific threat impact: the unquoted service path matches local privilege escalation; SMB null sessions match unauthenticated reconnaissance; weak TLS cipher suites match cryptographic downgrade; and stack-based buffer overflow firmware matches remote code execution.

The pairings correctly connect each technical vulnerability mechanism to its operational security impact. Unquoted service paths expose local execution order bugs used for privilege elevation; SMB IPC$ null sessions expose administrative RPC endpoints for network discovery; legacy cipher suites expose TLS handshakes to algorithm downgrade attacks; and stack-based memory bounds failures permit arbitrary code execution.

Step-by-Step Solution

1

Analyze host-level binary execution vulnerabilities.

Unquoted service paths containing spaces cause Windows to search for executables at each space break. This directly maps to local privilege escalation via path hijacking.

Windows process creation attempts to execute the shortest valid path string when spaces are unquoted.

2

Analyze network protocol misconfigurations for information exposure.

Anonymous SMB null sessions over IPC$ enable unauthenticated RPC queries to list domain objects, mapping directly to unauthenticated reconnaissance.

Legacy NetBIOS/SMB behavior allowed unauthenticated connections to inspect system resources.

3

Evaluate transport layer cryptographic weaknesses.

Supporting 3DES or NULL cipher suites allows attackers to force weak or non-existent encryption during negotiation, mapping directly to cryptographic downgrade and eavesdropping.

Permitting weak algorithms enables protocol downgrade attacks such as POODLE or SWEET32.

4

Evaluate memory corruption flaws in network device firmware.

Unchecked memory writes in firmware lead to instruction pointer overwrites, mapping directly to remote code execution.

Buffer overflow conditions alter control flow execution to arbitrary shellcode.

Key Concept

Host, Network, and Architecture Vulnerabilities

Question 73Question →

Match each cryptographic or security control weakness on the left with its corresponding technical description on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Hardcoded Cryptographic Key matches embedding secret symmetric keys directly within application code; Deprecated/Weak Cipher Suite matches utilizing legacy algorithms with short key lengths or known structural flaws; Expired SSL/TLS Certificate matches failing to renew a digital credential prior to its validity end date; Unsalted Password Hash matches storing password digests without unique random data.

Each security control weakness aligns with its fundamental technical definition. Hardcoding keys puts secrets in binaries; legacy cipher suites rely on flawed algorithms like DES/RC4; expired certificates break the validity lifecycle in PKI; and unsalted hashes expose stored credentials to precomputed rainbow table lookups.

Step-by-Step Solution

1

Analyze 'Hardcoded Cryptographic Key'

Identify that embedding key material inside software code allows attackers who disassemble the software to retrieve the secret key.

Matches the description of embedding secret keys directly within application code or compiled binaries.

2

Analyze 'Deprecated/Weak Cipher Suite'

Identify that older algorithms such as DES or RC4 do not meet modern security baseline requirements.

Matches utilizing legacy algorithms with short key lengths or known structural flaws.

3

Analyze 'Expired SSL/TLS Certificate'

Recognize that digital certificates require active validity windows for trust verification.

Matches failing to renew a digital credential prior to its validity end date.

4

Analyze 'Unsalted Password Hash'

Recall that cryptographic salts add unique randomness to prevent hash collisions across identical passwords.

Matches storing password digests without unique random data.

Key Concept

Cryptographic and Security Control Weaknesses

Question 74Question →

Match each threat actor category with its primary motivation and characteristic attack vector in an enterprise environment.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Nation-State Threat Actor pairs with geopolitical espionage using supply chain compromises and zero-day exploits. Organized Crime Threat Group pairs with financial motivation using stolen credentials for extortion software. Shadow IT / Unintentional Insider pairs with convenience motivation using unauthorized cloud services. Hacktivist Collective pairs with ideological motivation using DDoS and web defacements.

Each threat actor category aligns directly with its characteristic motivation, capability level, and preferred attack vector: Nation-state actors seek geopolitical intelligence via zero-days and supply chain exploits; organized crime seeks financial gain through ransomware and credential theft; shadow IT stems from non-malicious employee convenience via unauthorized SaaS tools; and hacktivists seek publicity for political causes using DDoS and defacement.

Step-by-Step Solution

1

Identify the primary motivation and sophistication level for each threat actor.

Nation-state actors focus on espionage, organized crime on money, hacktivists on ideology, and shadow IT on convenience.

Threat actor categorization starts by distinguishing core intent and capability bounds.

2

Map each threat actor profile to its matching attack vector and operational objective.

Espionage maps to supply chain/zero-days, financial extortion maps to credential compromise/ransomware, convenience maps to unauthorized cloud/web vectors, and ideological disruption maps to DDoS/defacement.

Attack vectors reflect the resources, persistence requirements, and targets typical of each actor category.

Key Concept

Threat Actor Profiles, Motivations, and Vectors

Question 75Question →

Match each malware classification on the left with its corresponding technical indicator of compromise (IoC) or telemetry profile on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Rootkit pairs with kernel telemetry showing SSDT modifications; Logic Bomb pairs with the script triggered by user account status changes; Fileless Malware pairs with in-memory execution via WMI; Remote Access Trojan pairs with disguised utility establishing outbound C2 communication.

Rootkit matches kernel-level SSDT modification and API evasion. Logic Bomb matches the conditional trigger tied to user account changes. Fileless Malware matches memory-only WMI/PowerShell execution. Remote Access Trojan matches the disguised utility creating outbound C2 traffic.

Step-by-Step Solution

1

Examine stealth and kernel-level manipulation telemetry.

Link SSDT modifications and hidden process enumeration to Rootkit functionality.

Rootkits focus on stealth by hooking API routines and altering operating system kernel structures.

2

Analyze event-driven payload execution triggers.

Match account disability conditions to Logic Bomb behavior.

Logic bombs remain inactive until predefined logical or temporal conditions occur.

3

Analyze non-persistent, memory-only execution signatures using native tools.

Match WMI and memory-only command execution to Fileless Malware.

Fileless malware avoids traditional file-based detection by executing code within RAM via trusted binaries.

4

Examine backdoor capabilities hidden within legitimate-looking software.

Match disguised utility establishing external C2 tunnels to Remote Access Trojan (RAT).

RATs provide full operational control to attackers via covert outbound channels while pretending to be harmless applications.

Key Concept

Malware Classifications and Telemetry Artifacts

Estimated Time:1m 30s

Question 76Question →

A cybersecurity team is establishing testing procedures for an enterprise security audit. Match each security testing method on the left with its primary operational objective on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Software Composition Analysis (SCA) matches with evaluating project dependencies; Dynamic Application Security Testing (DAST) matches with automated runtime testing of a live application; Gray-Box Penetration Testing matches with simulating an attack using limited credentials and partial documentation; Credentialed Vulnerability Scanning matches with using administrative credentials to audit local patch levels and configurations.

Each testing methodology serves a specific operational function during an assessment: Software Composition Analysis evaluates open-source components and software supply chain vulnerabilities; Dynamic Application Security Testing tests live web services without source code visibility; Gray-Box Penetration Testing assesses systems using partial knowledge and limited accounts; and Credentialed Vulnerability Scanning performs internal configuration audits with administrative access.

Step-by-Step Solution

1

Analyze the primary focus of Software Composition Analysis (SCA).

SCA targets third-party libraries, packages, and open-source dependencies incorporated into software products.

Security vulnerabilities often stem from outdated external software modules rather than custom code.

2

Differentiate runtime application assessment (DAST) from static code review.

DAST tests a live application from an external interface perspective without requiring source code access.

DAST discovers vulnerabilities such as SQL injection or cross-site scripting while the application runs.

3

Distinguish access levels in penetration testing methodologies.

Gray-box testing provides assessors with partial knowledge or low-privilege user credentials to test realistic insider user threat vectors.

Black-box provides zero prior knowledge, whereas white-box provides complete internal access and source code.

4

Evaluate the mechanism of credentialed vulnerability scanning.

Credentialed scanning logs directly into endpoints using valid system credentials.

Authenticated access allows low-impact inspection of OS patch levels, software registries, and internal configuration details.

Key Concept

Vulnerability Assessment and Security Testing Methods

Question 77Question →

Match each host, network, or infrastructure vulnerability scenario on the left with its corresponding primary remediation strategy on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The correct pairings match each security vulnerability scenario to its targeted technical control: SMBv1 exposure pairs with legacy protocol deprecation and SMBv3 enforcement; public cloud storage credential exposure pairs with IAM bucket restrictions and secrets management; open recursive DNS resolving pairs with recursive client restrictions and Response Rate Limiting; unencrypted embedded controller traffic with default credentials pairs with firmware hardening, credential replacement, and TLS transport encryption.

Each vulnerability scenario represents a failure at a distinct layer of the architecture (host OS protocol, cloud infrastructure access control, network core services, or embedded endpoint security). remediations must directly address the specific root cause flaw at that layer rather than relying on generic perimeter controls.

Step-by-Step Solution

1

Analyze host protocol vulnerability (left item 1)

Identified SMBv1 legacy protocol risk

SMBv1 lacks modern security features and is susceptible to exploitation, requiring protocol deprecation and migration to SMBv3.

2

Analyze cloud infrastructure vulnerability (left item 2)

Identified public bucket and cleartext secret exposure

Cloud storage configuration issues are resolved by enforcing strict IAM access controls and externalizing secret management.

3

Analyze network infrastructure vulnerability (left item 3)

Identified open DNS recursive resolver exposure

Open DNS resolvers facilitate amplification attacks, requiring ACLs to limit recursive queries to trusted internal clients.

4

Analyze embedded architecture vulnerability (left item 4)

Identified weak authentication and unencrypted operational technology traffic

Embedded systems must be hardened by changing default credentials and enforcing encrypted transport protocols.

Key Concept

Host, Network, and Architecture Vulnerability Remediation

Question 78Question →

An enterprise security architect is mapping security governance duties across various cloud service models during a multi-cloud initiative. Match each cloud service model on the left with the customer's primary security responsibility on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Infrastructure as a Service (IaaS) matches with configuring guest operating system security patches, virtual machine firewalls, and installed middleware applications. Platform as a Service (PaaS) matches with managing application code and database schemas while relying on the provider to maintain the operating system and runtime framework. Software as a Service (SaaS) matches with configuring user identity access permissions and monitoring data access policies while the provider maintains all application code, runtime, and infrastructure. Function as a Service (FaaS) matches with managing event trigger permissions and stateless code execution logic while the provider completely abstracts infrastructure host provisioning and scaling.

Each cloud service model defines a distinct boundary of ownership under the shared responsibility framework. In Infrastructure as a Service (IaaS), customer responsibility extends from the guest OS upward (including OS patching and virtual network security). Platform as a Service (PaaS) shifts OS and runtime maintenance to the provider, leaving code and database management to the customer. Software as a Service (SaaS) shifts application code management to the provider, leaving identity governance and data access to the customer. Function as a Service (FaaS) abstracts server infrastructure entirely, limiting customer responsibility to discrete event-driven function code.

Step-by-Step Solution

1

Analyze the scope of customer control in Infrastructure as a Service (IaaS).

Identify that IaaS grants full control down to the operating system level, making OS patch management and virtual firewalls customer duties.

Under the cloud shared responsibility model for IaaS, virtualization hardware is provider-managed, but guest OS and compute configurations belong to the customer.

2

Analyze Platform as a Service (PaaS) boundaries.

Determine that PaaS abstracts OS and runtime management, limiting customer duties to code development and database management.

PaaS providers manage the framework and environment to streamline application development for enterprise developers.

3

Evaluate Software as a Service (SaaS) responsibility scope.

Recognize that SaaS offloads all application maintenance to the vendor, restricting customer duties to identity, access, and data security.

SaaS solutions deliver fully formed applications where customers only govern data and access permissions.

4

Determine Function as a Service (FaaS) responsibility.

Confirm that serverless execution removes host management completely, focusing customer effort strictly on short-lived function logic and execution triggers.

FaaS dynamic execution models isolate customer responsibility to individual units of deployed logic and authorization policies.

Key Concept

Cloud Shared Responsibility Model across Service Delivery Architecture Types

Question 79Question →

An enterprise security architect is mapping enterprise hardening controls to specific vulnerability findings identified during a comprehensive threat assessment. Match each enterprise mitigation strategy on the left with the threat or attack vector on the right that it is primarily designed to counter.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Each enterprise mitigation strategy accurately maps to its corresponding risk: DNS sinkholing counters command-and-control (C2) channel establishing via DNS hijacking/tunneling; microsegmentation mitigates internal lateral movement across compromised workloads; application allowlisting blocks unauthorized zero-day software execution; and Privileged Access Management with JIT access eliminates standing rights to prevent insider privilege abuse.

The correct pairings align each defense-in-depth control with the primary attack vector it neutralizes: DNS sinkholing and DNSSEC address malicious domain resolution and C2 tunneling; host-level microsegmentation controls east-west traffic to halt lateral movement; application allowlisting enforces code-signing requirements to prevent unauthorized code execution; and PAM with JIT access revokes standing administrative rights to prevent insider abuse and unauthorized privilege exploitation.

Step-by-Step Solution

1

Analyze the technical mechanism of DNS sinkholing with DNSSEC validation.

Identified that inspecting and redirecting DNS queries directly targets malicious domain lookup behavior typical of malware calling home via domain generation algorithms (DGAs) or DNS tunneling.

DNS-level mitigations specifically operate on domain resolution traffic to neutralize outbound C2 channels.

2

Evaluate the architectural purpose of host-based microsegmentation.

Determined that enforcing strict policy boundaries between host workloads prevents network traversal between internal nodes.

Microsegmentation is explicitly designed to contain blast radiuses by preventing unauthorized lateral (east-west) traffic flow.

3

Assess the operational mechanism of application allowlisting via code-signing enforcement.

Recognized that blocking execution based on digital signature certificates prevents unauthorized scripts, DLLs, and binary executables from running.

Allowlisting explicitly blocks untrusted binaries and zero-day executables that lack pre-approved publisher attestations.

4

Review Privileged Access Management (PAM) with Just-In-Time (JIT) and dual-operator controls.

Matched temporary privilege elevation and secondary approval workflows to the mitigation of standing administrative access abuse.

Removing persistent standing privileges and enforcing peer verification addresses insider threats and unauthorized administrative modifications.

Key Concept

Mitigation Strategies and Enterprise Hardening Practices

Question 80Question →

An enterprise security operations center (SOC) detects anomalous network and wireless activity across multiple site logs during a synchronized red-team exercise. Match each observed technical log snippet or packet capture indicator to its corresponding network or wireless attack classification.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The correct pairings match each technical log snippet to its distinct attack indicator: 802.11 Reason Code 7 management frames indicate a Deauthentication attack; mismatched ARP gateway MAC bindings indicate ARP Poisoning; a high-RSSI unauthorized AP matching corporate SSID indicates an Evil Twin; and unauthorized IP resolution via forged records indicates DNS Cache Poisoning.

Each indicator uniquely aligns with standard protocol behaviors under attack: 802.11 disassociation frames force client disconnections; gratuitous ARP replies corrupt local MAC resolution tables; unauthorized high-power BSSIDs spoofing corporate SSIDs represent Evil Twins; and corrupt DNS response mappings indicate DNS cache poisoning.

Step-by-Step Solution

1

Analyze the wireless management frame log snippet (802.11 Reason Code 7).

Reason Code 7 signifies disassociation due to class 3 frame receipt from a nonassociated station. Mass broadcast indicates a wireless disassociation/deauthentication attack.

Identify wireless denial-of-service or credential-harvesting pre-attack indicators.

2

Analyze the ARP packet capture log.

Discrepancy between broadcasted ARP reply MAC addresses and physical switch port MAC tables points to gratuitous/unsolicited ARP spoofing used for on-path interception.

Distinguish ARP poisoning indicators from normal network ARP traffic.

3

Analyze the wireless beacon frame capture for Corp-Secure.

An unauthorized BSSID advertising the legitimate SSID with an unusually high RSSI indicates a malicious rogue AP configured as an Evil Twin.

Recognize rogue wireless infrastructure masquerading as legitimate corporate access points.

4

Analyze the DNS resolution anomaly log.

Forged responses updating cached IP mapping for internal domain names demonstrate DNS cache poisoning.

Differentiate protocol spoofing at layer 7 (DNS) from layer 2 (ARP) and layer 1/2 (Wireless).

Key Concept

Identification and analysis of network and wireless attack indicators including ARP poisoning, DNS cache poisoning, Evil Twin access points, and 802.11 disassociation attacks.

Estimated Time:3m 0s

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept