All practice questions

2232 questions

All types2,232 Multiple choice1,151 Multiple select509 Numeric21 Matching378 Ordering173

A security analyst investigates a SIEM alert triggered by the following sequential log entries collected from a Linux authentication server:

Jul 27 14:02:11 host01 sshd[14201]: Failed password for invalid user admin from 198.51.100.44 port 49152 ssh2
Jul 27 14:02:13 host01 sshd[14205]: Failed password for invalid user root from 198.51.100.44 port 49154 ssh2
Jul 27 14:02:15 host01 sshd[14210]: Failed password for user jdoe from 198.51.100.44 port 49156 ssh2
Jul 27 14:02:18 host01 sshd[14214]: Accepted password for user jdoe from 198.51.100.44 port 49160 ssh2
Jul 27 14:02:22 host01 sudo: jdoe : TTY=pts/1 ; PWD=/home/jdoe ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow

Based on these log entries, which of the following best describes the attack sequence and the correlation rule logic required to detect this incident?

A brute-force or password guessing attempt succeeded against a valid user account, followed by privileged local access attempt; the correlation rule should link multiple failed authentication events from a single source IP with a successful logon and subsequent sudo execution within a short time window.

An unauthorized client bypassed access control lists at the network boundary; the correlation rule should filter on network firewall deny logs and alert on authorization failures originating from external IP ranges.

A Cross-Site Scripting (XSS) attack compromised the session cookies of a web application administrator; the correlation rule should look for HTTP GET requests containing embedded script tags in web server access logs.

A rogue insider executed unapproved software; the SIEM rule should apply a compensating control to permanently disable sudo access for all unprivileged users across the enterprise network.

Show answer & explanation

Answer: A brute-force or password guessing attempt succeeded against a valid user account, followed by privileged local access attempt; the correlation rule should link multiple failed authentication events from a single source IP with a successful logon and subsequent sudo execution within a short time window.

Answer

The attack sequence consists of an external password guessing or brute-force attack from IP 198.51.100.44 that succeeds against account 'jdoe', followed immediately by a privilege escalation attempt using sudo to read /etc/shadow. The correlation rule must aggregate sequential host authentication events across SSH and sudo logs within a tight temporal window.

The log sequence displays an external IP attempting passwords against multiple user accounts via SSH. After several failures, a login succeeds for user 'jdoe'. Within four seconds, 'jdoe' executes a sudo command to inspect /etc/shadow, which contains password hashes. Effective SIEM management requires linking these sequential events (failures -> success -> privileged command) from the same source into a unified incident alert.

Step-by-Step Solution

Analyze initial authentication attempts

Identified multiple SSH failed password attempts from external source IP 198.51.100.44 targeting invalid and valid user accounts (admin, root, jdoe).

Establishes the initial access vector (password guessing/brute force).

Analyze successful authentication and subsequent host activity

At 14:02:18, password authentication succeeds for 'jdoe' from the same source IP, followed 4 seconds later by a sudo execution targeting /etc/shadow.

Confirms account compromise and immediate privilege escalation/reconnaissance activity.

Formulate SIEM correlation rule criteria

Design a rule requiring: (Failed SSH Auth Count >= threshold from IP_X) AND (Successful SSH Auth from IP_X) AND (Sudo Execution by authenticated user) within Δt <= 60 seconds.

Captures the multi-stage attack context while suppressing single-event noise.

Key Concept

SIEM Event Correlation and Authentication Log Analysis

Question 782Question →

A security analyst is investigating reports from branch office employees who experienced sudden wireless disconnections followed by prompts to re-enter corporate network credentials on an unfamiliar browser landing page. Wireshark captures and wireless intrusion prevention system (WIPS) logs collected during the incident reveal specific anomalous indicators. Which TWO of the following technical indicators confirm that an Evil Twin attack was executed against the wireless network?

Select all that apply

The broadcasting access point advertises the legitimate corporate SSID but uses an unapproved BSSID MAC address with a vendor prefix that does not match enterprise hardware inventory

A sudden spike in 802.11 management frames containing deauthentication subtypes sent from a spoofed access point MAC address to force client re-association

Sustained high radio frequency noise floor and wideband signal degradation across all 2.4 GHz channels causing high packet error rates

Multiple DHCP DECLINE messages issued by clients following MAC address randomization upon connecting to the primary VLAN switch port

Show answer & explanation

Answer: The broadcasting access point advertises the legitimate corporate SSID but uses an unapproved BSSID MAC address with a vendor prefix that does not match enterprise hardware inventory; A sudden spike in 802.11 management frames containing deauthentication subtypes sent from a spoofed access point MAC address to force client re-association

Answer

The correct indicators are the rogue broadcasting access point exhibiting an unapproved BSSID MAC address with an unauthorized hardware vendor prefix while broadcasting the corporate SSID, and a sudden spike in spoofed 802.11 deauthentication management frames used to disconnect clients and force re-association.

An Evil Twin attack involves deploying a unauthorized rogue access point configured with the target network's exact SSID. Technical indicators verifying this include observing an unauthorized BSSID (MAC address) that does not match enterprise asset registries, along with a stream of 802.11 deauthentication management frames crafted to disconnect target clients from the legitimate access point and push them onto the rogue device.

Step-by-Step Solution

Analyze the scenario attack vector

The scenario describes users being disconnected and prompted for corporate credentials on an unexpected landing page, which aligns with an Evil Twin wireless credential harvesting attack.

Evil Twin attacks rely on creating a duplicate wireless network that mimics a legitimate SSID to deceive clients into connecting and submitting sensitive information.

Evaluate wireless indicators for Evil Twin confirmation

An unauthorized BSSID (MAC address) broadcasting the legitimate corporate SSID identifies rogue hardware. Spoofed 802.11 deauthentication frames explain the sudden client disconnections preceding connection to the rogue AP.

Combining deauthentication frame floods with identical SSID broadcasting from unauthorized BSSID hardware is the classic mechanism used by attackers to operationalize an Evil Twin.

Differentiate from non-relevant wireless and network attack indicators

Channel-wide RF noise floor increases indicate RF jamming (denial of service), while DHCP DECLINE messages point to IP address allocation conflicts, neither of which confirms an Evil Twin scenario.

Accurate threat diagnosis requires distinguishing between availability disruption attacks (jamming) and impersonation/credential theft attacks (Evil Twin).

Key Concept

Evil Twin Attack Indicators

Question 783Question →

Match each security log entry snippet extracted from enterprise monitoring systems to the corresponding attack vector or security incident type it accurately represents.

Click a left item, then click its matching right item

Show answer & explanation

Answer

1. GET request with database CONVERT function syntax maps to Error-Based SQL Injection (SQLi).
2. Firewall drop logs showing rapid sequential destination port connection attempts map to Reconnaissance / Horizontal Port Scanning.
3. Windows Event ID 4769 requesting TGS tickets with RC4 encryption for SPNs maps to Kerberoasting Credential Theft.
4. Multipart POST request containing PHP command execution syntax inside image uploads maps to Unrestricted File Upload / Web Shell Deployment.

Each security log snippet exhibits unique protocol and event attributes: SQL execution syntax in HTTP GET parameters indicates Error-Based SQL Injection; sequential port probes in firewall logs indicate Horizontal Port Scanning; Windows Event ID 4769 with legacy RC4 encryption indicates Kerberoasting; and PHP command injection inside multipart uploads indicates Web Shell Deployment.

Step-by-Step Solution

Analyze the web request URL parameter containing SQL type conversion functions (`CONVERT`).

Identified as Error-Based SQL Injection.

Forcing database conversion errors forces backend SQL engines to output internal state data into application error pages.

Examine firewall drop events originating from a single source host probing sequential port numbers in sub-second intervals.

Identified as Horizontal Port Scanning.

Sequential attempts on standard service ports (FTP/21, SSH/22, Telnet/23) indicate active network reconnaissance.

Evaluate Active Directory Event ID 4769 requesting Kerberos service tickets for Service Principal Names (SPNs) using RC4-HMAC encryption.

Identified as Kerberoasting.

Requesting TGS tickets with legacy RC4 encryption enables threat actors to extract ticket hashes and crack service passwords offline.

Inspect the file upload POST payload containing raw PHP system call instructions within a disguised file extension.

Identified as Web Shell Deployment via Unrestricted File Upload.

Bypassing extension controls to write executable server scripts permits persistent remote administrative control.

Key Concept

SIEM Log Analysis and Threat Signature Pattern Matching

Question 784Question →

An organization is configuring a geographically separated secondary data center to maintain continuous operations for its mission-critical transactional database. The business requirement dictates a Recovery Point Objective (RPO) of zero and automatic failover without human intervention in the event of an site outage. Which of the following technical design choices and infrastructure components must be implemented to fulfill these specific requirements? (Select TWO.)

Select all that apply

Synchronous database replication across both sites

Dynamic Global Server Load Balancing (GSLB) with automated health probes and low TTL DNS records

Daily asynchronous storage snapshots backed up to air-gapped cloud storage

Warm site infrastructure configured with manual DNS record update playbooks

Show answer & explanation

Answer: Synchronous database replication across both sites; Dynamic Global Server Load Balancing (GSLB) with automated health probes and low TTL DNS records

Answer

The necessary technical controls are synchronous database replication and dynamic Global Server Load Balancing (GSLB) with automated health probes.

To achieve RPO = 0, data must be written simultaneously to both locations via synchronous replication. To achieve automated failover, GSLB with continuous health checks automatically updates routing paths when the primary endpoint fails to respond.

Step-by-Step Solution

Analyze RPO requirements

An RPO of zero requires synchronous replication so that transactions are committed simultaneously at both sites without data lag.

Asynchronous methods incur latency gaps resulting in lost data during an unannounced failure.

Analyze automated failover requirements

Automated failover requires GSLB with health monitoring to dynamically detect primary site degradation and redirect user traffic seamlessly.

Manual DNS playbooks introduce human delay and extend recovery time beyond high availability bounds.

Key Concept

High Availability and Active-Active Site Replication

Question 785Question →

A network security technician is reviewing switch port traffic logs after receiving reports of unauthorized network sniffing on a corporate segment. The log packet trace reveals that a newly attached workstation sent dynamic negotiation frames configured with desirable trunking modes, successfully establishing a trunking link with the switch interface. Shortly after, frames with double-encapsulated 802.1Q headers were observed traversing the interface toward an isolated finance VLAN. Which of the following network attack types is indicated by these technical observations?

VLAN Hopping

MAC Flooding

ARP Poisoning

DNS Poisoning

Show answer & explanation

Answer: VLAN Hopping

Answer

VLAN Hopping is the network attack indicated by the technical observations.

The correct answer is VLAN Hopping. An attacker performs VLAN hopping either by spoofing DTP negotiation messages (causing an unmanaged port to become a trunk port) or by sending double-tagged 802.1Q frames. In double tagging, the outer tag matches the native VLAN of the switch port, causing the switch to strip the outer tag and forward the frame along the trunk carrying the inner tag intact to the target VLAN.

Step-by-Step Solution

Analyze the observed technical indicators in the packet trace.

Identified Dynamic Trunking Protocol (DTP) negotiation frames and double-encapsulated 802.1Q VLAN tags.

DTP allows switch interfaces to negotiate trunking links dynamically, while double 802.1Q encapsulation allows packets to jump from an outer access VLAN to an inner target VLAN when trunked.

Correlate the indicators with known Layer 2 attack mechanisms.

Dynamic trunk negotiation (switch spoofing) and double tagging are the two primary techniques used to perform VLAN hopping.

VLAN hopping allows an attacker on one VLAN to gain unauthorized access to traffic on another VLAN without traversing a router or firewall.

Key Concept

VLAN Hopping Attack Indicators

Estimated Time:1m 30s

Question 786Question →

A security architect is designing an enterprise deployment strategy incorporating both virtual machines and application containers. Match each architectural isolation mechanism on the left with its corresponding security function or boundary property on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Control Groups (cgroups) matches with hardware resource limiting; Linux Namespaces matches with resource visibility partitioning; Type 1 Hypervisor matches with direct bare-metal hardware abstraction; Secure Computing Mode (seccomp) matches with syscall filtering.

Control Groups (cgroups) enforce resource allocation limits; Linux Namespaces enforce logical visibility boundaries; Type 1 Hypervisors provide bare-metal hardware abstraction; and Secure Computing Mode (seccomp) restricts kernel system call access.

Step-by-Step Solution

Analyze container resource governance mechanisms.

Control Groups (cgroups) regulate compute, memory, and storage bandwidth limits per container process group.

cgroups prevent resource exhaustion and noisy neighbor issues.

Analyze container visibility isolation controls.

Linux Namespaces segment global system resources (process trees, network devices, filesystem mount points) into isolated process environments.

Namespaces ensure one container cannot see or interact directly with another container's processes or file mounts.

Evaluate hypervisor virtualization architectures.

A Type 1 hypervisor operates directly on raw host hardware, enforcing strong VM boundary separation at the virtual CPU and memory abstraction level.

Type 1 hypervisors eliminate host OS vulnerability exposure present in Type 2 virtualization.

Identify kernel surface attack reduction controls.

Seccomp restricts the system call interface exposed by the host kernel to running container processes.

Filtering unused or dangerous syscalls reduces container escape vulnerabilities.

Key Concept

Virtualization and Containerization Isolation Mechanisms

Question 787Question →

A security analyst is executing an incident response playbook following a confirmed malware alert on a user workstation. Which of the following actions represent appropriate steps during the containment phase of the incident response process? (Select TWO.)

Select all that apply

Disconnecting the workstation from the network by disabling its network interface

Applying temporary ACLs at the perimeter firewall to block outbound communication to known malicious IP addresses

Reimaging the infected system's hard drive using a standard gold master image

Holding a post-incident review session with the incident response team to update playbook documentation

Show answer & explanation

Answer: Disconnecting the workstation from the network by disabling its network interface; Applying temporary ACLs at the perimeter firewall to block outbound communication to known malicious IP addresses

Answer

The appropriate containment steps are disconnecting the workstation from the network by disabling its network interface and applying temporary firewall ACLs to block outbound communication to malicious command-and-control servers.

During the containment phase of incident response, the main priority is stopping the spread of the attack and limiting its impact. Disabling the local network interface isolates the system from internal network assets, stopping lateral movement. Blocking outbound traffic to command-and-control IP addresses prevents ongoing data exfiltration and remote attacker control.

Step-by-Step Solution

Determine the primary objective of the containment phase

Containment focuses on restricting the impact of an incident and preventing further damage or propagation.

Isolating infected systems and blocking active attack vectors stops the incident from spreading while preserving evidence for investigation.

Evaluate response actions against incident response phases

Disabling network connectivity and blocking command-and-control traffic directly restrict threat movement, fitting containment. Reimaging systems belongs to eradication/recovery, and reviewing playbooks belongs to post-incident activities.

Executing eradication or post-incident actions out of order can disrupt evidence collection or leave active threats uncontained.

Key Concept

Incident Response Containment Actions

Question 788Question →

An enterprise network security architect is updating the organization's network architecture to enhance isolation and access control. Match each network design or segmentation technique on the left with its corresponding enterprise implementation requirement on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Air Gap pairs with physical separation from all networks; Microsegmentation pairs with software-defined lateral policy enforcement; Jump Box pairs with a secure, audited administrative access gateway; Screened Subnet pairs with isolating public-facing services between security boundaries.

The concepts correctly align with their standard technical definitions: Air Gaps mandate complete physical isolation; Microsegmentation restricts East-West lateral traffic at the workload level via software policies; Jump Boxes act as secure intermediate administrative access points; and Screened Subnets isolate public-facing assets between perimeter firewalls.

Step-by-Step Solution

Identify absolute isolation without network medium connectivity.

Air Gap corresponds to complete physical network disconnection.

Air-gapping ensures no data can cross network media electronically.

Determine granular lateral traffic controls in virtualized environments.

Microsegmentation corresponds to controlling East-West traffic between individual workloads.

Microsegmentation operates at fine granularity using software-defined security policies.

Locate administrative transit control requirements.

Jump Box corresponds to the intermediate secure gateway for administration.

Jump hosts centralize management authentication and session auditing.

Evaluate perimeter placement for externally exposed services.

Screened Subnet corresponds to placing public-facing services between security boundaries.

Screened subnets shield private internal resources from untrusted internet ingress.

Key Concept

Secure Network Segmentation Archetypes

Question 789Question →

An organization is modernizing its identity and access management (IAM) architecture to support modern web applications and API access controls. Which of the following protocols should the security team implement to provide federated user identity authentication and delegated API authorization? (Select TWO.)

Select all that apply

OpenID Connect (OIDC)

OAuth 2.0

Remote Authentication Dial-In User Service (RADIUS)

IPsec Virtual Private Network (VPN)

Show answer & explanation

Answer: OpenID Connect (OIDC); OAuth 2.0

Answer

The correct open standards are OpenID Connect (OIDC) for identity authentication and OAuth 2.0 for API authorization.

OpenID Connect (OIDC) and OAuth 2.0 work together in modern identity architectures. OIDC provides user authentication by returning an ID token, while OAuth 2.0 handles authorization by granting access tokens for API requests.

Step-by-Step Solution

Identify the standard required for user authentication in web and federated architectures.

OpenID Connect (OIDC) extends OAuth 2.0 by introducing JSON Web Tokens (JWTs) called ID tokens to verify user identity.

OIDC is designed specifically as the authentication protocol layer.

Identify the framework required for delegated API authorization.

OAuth 2.0 issues access tokens that grant applications permission to access protected APIs without sharing passwords.

OAuth 2.0 governs access control and authorization decisions.

Key Concept

Federated Authentication and API Authorization Protocols

Question 790Question →

An enterprise cloud migration team is establishing governance policies for a newly migrated database containing sensitive customer information. During an internal compliance review, auditors discover that while automated backup scripts and database encryption are operational, no formal data retention schedules or sensitivity tiers have been defined for the dataset. The database administrator indicates they only manage infrastructure security safeguards, database schema settings, and daily backups. Which of the following roles is explicitly responsible for assigning the data classification label and approving retention policies for this information asset?

Data owner

Data custodian

Security administrator responsible for managing technical preventive controls

Identity manager responsible for user authentication and access verification

Show answer & explanation

Answer: Data owner

Answer

Data owner

The data owner is typically a senior business manager or executive accountable for the overall governance, sensitivity classification, retention rules, and protection policies of an asset. While technical personnel implement controls, the data owner specifies what requirements those controls must satisfy.

Step-by-Step Solution

Analyze the operational problem presented in the scenario.

Technical controls (encryption, backups) are functioning, but business governance controls (data classification, retention schedules) are missing.

Governance rules dictate how technical controls must be configured to comply with legal and organizational requirements.

Distinguish between technical implementation roles and business accountability roles.

The database administrator is acting as a data custodian focused on hands-on technical management.

Custodians implement security controls and maintain data structure, whereas governance authority resides higher in the business hierarchy.

Identify the role accountable for data classification and retention approval.

The data owner has ultimate business accountability for defining sensitivity levels, retention periods, and privacy compliance guidelines.

According to CompTIA Security+ data governance frameworks, data ownership carries the responsibility to categorize information assets and dictate how data custodians must handle them.

Key Concept

Data Roles and Responsibilities (Data Owner vs. Data Custodian)

Estimated Time:2m 0s

Question 791Question →

A global logistics organization recently discovered that unauthorized personnel gained entry to restricted warehouse areas because employees were allowing unbadged individuals to follow them through access doors and sharing proximity smart cards during shift changes. Which TWO of the following human risk management and security awareness initiatives should the security analyst implement to directly remediate these specific non-technical security violations? (Select TWO.)

Select all that apply

Role-based physical security awareness training tailored to facility staff emphasizing single-person entry compliance and the hazards of badge sharing

Automated anti-passback mechanisms integrated into electronic access control turnstiles at facility perimeter checkpoints

A targeted security campaign reinforcing credential accountability supported by routine, unannounced physical access oversight audits

Quarterly simulated spear-phishing assessments targeting warehouse shift supervisors to evaluate click-through and threat reporting rates

Show answer & explanation

Answer: Role-based physical security awareness training tailored to facility staff emphasizing single-person entry compliance and the hazards of badge sharing; A targeted security campaign reinforcing credential accountability supported by routine, unannounced physical access oversight audits

Answer

The correct responses are role-based physical security awareness training tailored to facility staff emphasizing single-person entry compliance and the hazards of badge sharing, as well as a targeted security campaign reinforcing credential accountability supported by routine, unannounced physical access oversight audits.

Role-based physical security awareness training directly addresses high-risk employee behaviors by educating staff on physical entry protocols and the dangers of card sharing. Additionally, combining credential accountability campaigns with unannounced physical access audits provides operational oversight and reinforces behavioral compliance across facility staff.

Step-by-Step Solution

Analyze the reported security incident and identify the underlying risk vectors.

The incidents stem from human risk behaviors: tailgating (social engineering/complacency) and physical credential sharing.

Correct mitigation requires selecting human risk and awareness program controls tailored specifically to physical access violations.

Evaluate the administrative and operational awareness controls against the scenario requirements.

Role-based physical security training educates employees on tailgating, while credential accountability campaigns paired with access audits enforce operational compliance.

These controls directly target the human factors involved in physical security policy breaches.

Differentiate administrative/awareness controls from technical controls and mismatched threat vectors.

Anti-passback is a technical control rather than an awareness initiative, and phishing simulations target digital vector attacks rather than physical breaches.

CompTIA Security+ requires distinguishing administrative awareness solutions from technical physical security controls.

Key Concept

Role-based awareness training and operational human risk management strategies for physical security compliance.

Question 792Question →

A security operations team is standardizing its threat intelligence collection and distribution architecture. Match each threat intelligence technology or source type on the left with its correct technical definition or exchange role on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

TAXII matches the HTTPS application-layer transport protocol. STIX matches the standardized language format for threat indicators. ISAC matches the sector-specific sharing organization. Commercial/Proprietary Feed matches the paid subscription service for curated threat data.

Each threat intelligence source or protocol performs a distinct operational role: TAXII is the transport protocol over HTTPS; STIX is the structured JSON/XML data representation language; ISAC is the sector-specific collaborative trust network; and Commercial/Proprietary feeds are subscription-based, vendor-curated intelligence services.

Step-by-Step Solution

Differentiate transport protocols from data formatting languages in threat intelligence automation.

Identified TAXII as the protocol for transmitting data and STIX as the language format describing threat data.

TAXII specifies how threat intelligence is communicated, whereas STIX specifies what is contained inside the payload.

Differentiate peer-to-peer industry sharing entities from vendor-supplied intelligence services.

Mapped ISAC to sector-specific peer sharing and Commercial Feeds to paid vendor subscriptions.

ISACs rely on member-driven information exchange within specific critical infrastructure sectors, while commercial feeds sell specialized proprietary intelligence collected by vendors.

Key Concept

Threat Intelligence Standards, Protocols, and Source Classifications

Question 793Question →

An energy company is deploying smart grid Remote Terminal Units (RTUs) in unmonitored utility field enclosures. During a physical security assessment, penetration testers attached high-speed logic analyzers to the exposed printed circuit board (PCB) traces connecting the microcontroller to external system RAM, successfully intercepting plaintext cryptographic keys transmitted across the bus during normal runtime operations. Which of the following hardware security controls should the security architect specify to mitigate this vulnerability?

Bus encryption

Secure Boot with a hardware Root of Trust

Network-attached Hardware Security Module (HSM)

Asymmetric RSA-4096 code signing of flash memory partitions

Show answer & explanation

Answer: Bus encryption

Answer

Bus encryption dynamically encrypts data in transit over physical memory buses between processing units and external RAM, preventing attackers with physical probing tools from intercepting cleartext key material.

Bus encryption (such as inline memory encryption) continuously encrypts data and address lines between the processor and RAM using hardware-based cryptographic engines. This prevents physical side-channel and bus-sniffing attacks from capturing sensitive data or keys from exposed circuit traces.

Step-by-Step Solution

Analyze the threat vector described in the deployment scenario.

The attack involves physical probe attachment (logic analyzers) to printed circuit board (PCB) traces between the main microcontroller and external system RAM to capture cleartext data in transit.

Identifying the specific physical attack vector narrows down the required hardware-level security control.

Evaluate candidate hardware security mechanisms against physical bus sniffing.

Bus encryption (inline memory encryption) uses hardware engines to encrypt data written to external memory and decrypt it upon read operations, rendering intercepted signals on PCB traces unreadable.

Cryptographic protection must occur at the bus layer to protect signal lines operating outside chip packaging.

Differentiate bus encryption from boot integrity and asymmetric signature controls.

Controls like Secure Boot and asymmetric code signing ensure firmware integrity at launch, but do not provide runtime confidentiality across hardware interconnects.

Distinguishing integrity controls from runtime bus confidentiality controls confirms the correct selection.

Key Concept

Bus Encryption and Hardware Bus Protection

Question 794Question →

A security analyst is reviewing application event logs following a report of data exposure in a web portal. The log entries indicate that authenticated users are altering the `user_id` query parameter in the HTTP GET request (`GET /api/v1/profile?user_id=8834`) to retrieve private profile data belonging to other accounts without any server-side validation of ownership. Which of the following security vulnerabilities is demonstrated in this scenario, and what is the most appropriate control to remediate it?

Broken Authentication; remediate by enforcing multi-factor authentication (MFA) and shorter session timeouts across all portal endpoints.

Insecure Direct Object Reference (IDOR); remediate by implementing server-side object-level authorization checks.

Cross-Site Scripting (XSS); remediate by applying contextual HTML output encoding to user-supplied query parameters.

Insecure Direct Object Reference (IDOR); remediate by deploying an edge Web Application Firewall (WAF) to filter inspectable HTTP request headers.

Show answer & explanation

Answer: Insecure Direct Object Reference (IDOR); remediate by implementing server-side object-level authorization checks.

Answer

Insecure Direct Object Reference (IDOR); remediate by implementing server-side object-level authorization checks.

The correct answer identifies the vulnerability as Insecure Direct Object Reference (IDOR) and recommends server-side object-level access control. IDOR occurs when an application uses client-provided input to access objects directly (such as database keys or account numbers in URL parameters) without performing server-side authorization checks to verify that the requester owns or is permitted to view the requested data.

Step-by-Step Solution

Analyze the log entries and exploit pattern.

Identified that authenticated users manipulate a direct parameter (`user_id=8834`) to access records belonging to other users.

Direct reference manipulation to bypass access constraints is the defining characteristic of an Insecure Direct Object Reference (IDOR) flaw.

Distinguish between authentication failure and authorization failure.

Determined that the system successfully verified identity (authentication) but failed to restrict access based on resource ownership (authorization).

Remediation requires validating whether the logged-in session identity is authorized to access the specific record requested.

Select the appropriate server-side mitigation control.

Selected server-side object-level authorization checks.

Enforcing access controls directly at the code/data layer ensures every request verifies the user's permission to access that specific object key.

Key Concept

Insecure Direct Object Reference (IDOR) and Object-Level Access Control

Question 795Question →

A security review of an e-commerce platform's legacy vault database reveals that stored payment tokens are encrypted using the Data Encryption Standard (DES) algorithm operating in Cipher Block Chaining (CBC) mode. Additionally, the system uses a single, hardcoded Initialization Vector (IV) for every database record encryption operation. Which TWO cryptographic weaknesses are present in this architecture? (Select TWO)

Select all that apply

Use of a deprecated cipher with a short key length vulnerable to brute-force attacks

Reuse of a static Initialization Vector (IV), resulting in predictable ciphertexts for matching plaintext inputs

Failure to utilize asymmetric RSA key pairs for bulk data encryption at rest

Misconfiguration of database encryption logs as a preventive control rather than a detective control

Show answer & explanation

Answer: Use of a deprecated cipher with a short key length vulnerable to brute-force attacks; Reuse of a static Initialization Vector (IV), resulting in predictable ciphertexts for matching plaintext inputs

Answer

The two cryptographic weaknesses are the reliance on a deprecated cipher with a short key size (DES) and the implementation of a static Initialization Vector (IV) across CBC operations.

The system suffers from two distinct cryptographic flaws: first, DES relies on a legacy 56-bit key size that is vulnerable to key recovery attacks; second, reusing a static IV with CBC mode breaks semantic security, allowing attackers to detect matching plaintext blocks across stored records.

Step-by-Step Solution

Evaluate the encryption algorithm specified in the scenario.

DES uses a 56-bit key length, which provides inadequate key space against modern computing power.

Legacy algorithms with small key sizes do not provide sufficient confidentiality guarantees.

Analyze the Initialization Vector (IV) management within Cipher Block Chaining (CBC) mode.

Using a static, non-random IV for every encryption operation allows pattern recognition across ciphertexts.

CBC mode requires a unique, unpredictable IV per operation to prevent deterministic ciphertexts.

Key Concept

Cryptographic Weaknesses in Cipher Selection and Mode Implementation

Question 796Question →

An enterprise financial institution is designing a storage architecture for high-throughput transaction databases hosted on a Storage Area Network (SAN). Security requirements specify that bulk data at rest must be encrypted at the drive hardware level to eliminate host CPU performance degradation, and all storage keys must be centrally managed using a standardized network protocol integrated with a Hardware Security Module (HSM). Which of the following storage security solutions best meets these requirements?

Self-Encrypting Drives (SEDs) managed via Key Management Interoperability Protocol (KMIP) connected to an enterprise HSM

Host-based software Full Disk Encryption (FDE) utilizing local Trusted Platform Modules (TPMs) for volume key storage

Bulk volume encryption using asymmetric RSA-4096 keys generated natively on host operating systems

Inline network Data Loss Prevention (DLP) appliances positioned between host bus adapters and SAN fabric switches

Show answer & explanation

Answer: Self-Encrypting Drives (SEDs) managed via Key Management Interoperability Protocol (KMIP) connected to an enterprise HSM

Answer

Self-Encrypting Drives (SEDs) managed via Key Management Interoperability Protocol (KMIP) connected to an enterprise HSM

Self-Encrypting Drives (SEDs) utilize dedicated, on-board cryptoprocessors to encrypt and decrypt data at wire speed without burdening host system CPU cycles. Using the Key Management Interoperability Protocol (KMIP) enables seamless integration between storage hardware controllers and a dedicated enterprise Hardware Security Module (HSM) for automated key lifecycle management.

Step-by-Step Solution

Analyze the hardware encryption performance requirement.

Identified that performing bulk encryption directly on drive hardware (Self-Encrypting Drives) offloads cryptographic processing from host CPUs.

Software-based host encryption introduces processing latency and CPU overhead on database host servers.

Evaluate key management and protocol standards.

Determined that Key Management Interoperability Protocol (KMIP) provides the standardized interface required to communicate between storage controllers and a centralized Hardware Security Module (HSM).

KMIP normalizes key lifecycle management across heterogeneous enterprise storage arrays and key vaults.

Key Concept

Hardware-based storage encryption with centralized key management protocols

Estimated Time:1m 30s

Question 797Question →

A cybersecurity architect for a critical infrastructure energy provider is aligning enterprise security controls with foundational Zero Trust Architecture (ZTA) principles to protect operational technology (OT) and cloud control systems. Match each Zero Trust principle on the left with its corresponding operational security implementation on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Assume Breach pairs with enforcing mTLS encryption and inspecting all internal and external network traffic as untrusted; Explicit Verification pairs with evaluating multi-factor identity, device health, and risk signals for every request; Microsegmentation pairs with establishing isolated perimeters around individual workloads to restrict lateral movement; Least Privilege Access pairs with granting just-in-time permissions limited strictly to minimum required operations.

Each Zero Trust principle correctly aligns with its core architectural intent: Assume Breach treats internal traffic as inherently untrusted; Explicit Verification dynamically checks identity and context for every request; Microsegmentation contains threat proliferation by isolating individual workloads; and Least Privilege Access limits temporal and operational privileges to the bare minimum.

Step-by-Step Solution

Analyze the principle of 'Assume Breach' within Zero Trust Architecture.

Identify that assuming breach means treating internal network zones as untrusted, necessitating pervasive encryption (mTLS) and telemetry monitoring across all internal flows.

Legacy perimeter security relies on trusted internal zones, whereas Zero Trust presumes internal network segments may already harbor compromised nodes.

Analyze the principle of 'Explicit Verification'.

Identify that explicit verification requires continuous, multi-attribute policy evaluation (identity, device posture, location, threat context) prior to authorizing access.

Explicit verification replaces single-point-in-time authentication with dynamic, context-aware validation for every transaction.

Analyze the architectural concept of 'Microsegmentation'.

Identify that microsegmentation isolates workload boundaries to restrict lateral movement across network segments.

Placing fine-grained ingress and egress policy enforcement points around workloads prevents compromise propagation.

Analyze the principle of 'Least Privilege Access'.

Identify that least privilege access limits permissions via just-in-time elevation and tight operational scoping.

Minimizing active permissions limits potential damage if credentials or accounts are intercepted.

Key Concept

Core Zero Trust Architecture Principles and Controls

Estimated Time:2m 0s

Question 798Question →

A fintech platform is designing its microservices-based API infrastructure. The mobile application client must request access to user data across multiple independent backend services on behalf of authenticated users. The architecture requires that microservices independently verify scoped permissions statelessly without querying a central authentication service on every request, while avoiding exposure of user credentials. Which of the following identity and access management architecture designs best satisfies these requirements?

Implement an OAuth 2.0 authorization server that issues digitally signed JSON Web Tokens (JWTs) carrying user scopes and claims for decentralized verification by downstream microservices.

Enforce network-edge Web Application Firewall (WAF) filtering combined with IP address whitelisting as the primary mechanism for authenticating microservice requests.

Configure a centralized RADIUS server to perform real-time LDAP directory lookups for user credentials on every API request processed by backend microservices.

Deploy a SAML 2.0 web browser single sign-on profile using HTTP POST bindings to transmit XML authorization assertions between microservice endpoints.

Show answer & explanation

Answer: Implement an OAuth 2.0 authorization server that issues digitally signed JSON Web Tokens (JWTs) carrying user scopes and claims for decentralized verification by downstream microservices.

Answer

Implement an OAuth 2.0 authorization server that issues digitally signed JSON Web Tokens (JWTs) carrying user scopes and claims for decentralized verification by downstream microservices.

The correct solution uses an OAuth 2.0 authorization server issuing digitally signed JSON Web Tokens (JWTs). In a microservices architecture, JWTs allow individual microservices to perform stateless token verification using public key cryptography while evaluating authorization scopes directly from the payload without querying a central server.

Step-by-Step Solution

Analyze the core architectural requirements

Identified the need for delegated authorization, stateless verification at the microservice level, fine-grained access control (scopes), and protection of user credentials.

Microservices require lightweight, scalable authorization that scales independently without centralized bottlenecks.

Evaluate protocol suitability for microservice API security

OAuth 2.0 paired with JSON Web Tokens (JWTs) provides token-based delegated authorization where tokens are self-contained and digitally signed by the authorization server.

JWTs contain claims and scopes embedded directly in the payload, allowing each backend service to verify the signature using the authorization server's public key statelessly.

Eliminate inappropriate architectural designs

Perimeter IP whitelisting relies on network trust, RADIUS/LDAP lookups add synchronous central bottlenecks, and SAML 2.0 is designed primarily for web browser authentication flows.

These alternatives fail to meet Zero Trust, performance, or API design constraints.

Key Concept

Stateless Delegated API Authorization with OAuth 2.0 and Signed JWTs

Question 799Question →

A security architect is designing a high-availability infrastructure for an enterprise core database server connected to a Storage Area Network (SAN) using dual Host Bus Adapters (HBAs) connected across separate SAN fabrics. During failure simulation testing, disconnecting one fiber channel link caused the database operating system to freeze due to input/output timeouts rather than redirecting I/O operations through the secondary healthy storage fabric. Which of the following operating system level capabilities should the architect configure to enable seamless storage path failover and traffic load distribution?

Multipath I/O (MPIO) software with active-active path management

Link Aggregation Control Protocol (LACP) on the primary network interfaces

Synchronous block-level replication to an off-site disaster recovery data center

Active-passive server clustering with a cloud witness node for quorum isolation

Show answer & explanation

Answer: Multipath I/O (MPIO) software with active-active path management

Answer

Multipath I/O (MPIO) software with active-active path management

Multipath I/O (MPIO) provides operating system level fault tolerance and load balancing across redundant physical paths (such as host bus adapters and switches) connecting a server to a storage array. When configured, MPIO masks multiple physical storage paths as a single logical drive and diverts block traffic automatically if one path experiences a cable or port failure.

Step-by-Step Solution

Analyze the technical scenario requirements and underlying failure condition.

The server has physical hardware redundancy (dual HBAs and redundant SAN fabrics), but the operating system fails to recognize and switch between redundant storage paths when one path fails.

Without host-level multipathing logic, the operating system treats each physical connection as a separate storage device or locks I/O queues when a single path drops.

Evaluate candidate high-availability storage and network technologies against SAN HBA path redundancy.

Multipath I/O (MPIO) is specifically designed to abstract redundant storage connections (Fibre Channel/iSCSI) into a single logical device while performing continuous path monitoring, automatic failover, and load balancing.

MPIO integrates directly into the storage driver stack of the operating system to prevent I/O timeouts and kernel freezes.

Differentiate MPIO from network aggregation, remote disaster recovery, and compute clustering.

LACP handles network layer interfaces rather than HBA storage buses, synchronous site replication targets disaster recovery objectives, and active-passive clustering manages node failover rather than internal storage bus path management.

Only MPIO addresses the specific fault boundary described in the scenario.

Key Concept

Multipath I/O (MPIO) and Storage Path Resilience

Question 800Question →

A security engineer is designing a secure storage architecture for an enterprise financial organization migrating sensitive customer records to a public cloud object storage environment. To meet compliance standards and protect data at rest against unauthorized cloud administrator access and physical disk theft, which of the following controls should the engineer implement? (Select TWO).

Select all that apply

Client-side bulk data encryption using symmetric AES-256 with key management integrated into a dedicated Hardware Security Module (HSM)

Storage-integrated Data Loss Prevention (DLP) policies paired with automated data classification tags

Asymmetric RSA-4096 block-level encryption for high-throughput bulk database volume storage

Standalone SHA-256 cryptographic file hashing to establish non-repudiation against internal data deletion

Inline Web Application Firewall (WAF) filtering configured as a corrective security control to repair corrupted storage sectors

Show answer & explanation

Answer: Client-side bulk data encryption using symmetric AES-256 with key management integrated into a dedicated Hardware Security Module (HSM); Storage-integrated Data Loss Prevention (DLP) policies paired with automated data classification tags

Answer

The correct controls to implement are client-side bulk data encryption using symmetric AES-256 with HSM key management, and storage-integrated Data Loss Prevention (DLP) policies paired with automated data classification tags.

Client-side symmetric encryption (AES-256) backed by an HSM ensures high-speed bulk data protection and complete customer key ownership before data reaches public cloud storage. Storage-integrated DLP with automated classification enforces content-aware authorization and exfiltration monitoring across the storage repository.

Step-by-Step Solution

Analyze storage encryption requirements for bulk data at rest.

Identify that client-side bulk storage protection requires fast symmetric encryption (AES-256) managed via dedicated key management hardware (HSM) to protect data before it reaches third-party infrastructure.

Symmetric ciphers provide efficient bulk encryption, while client-side HSM key management prevents unauthorized access by cloud administrators or compromised physical storage media.

Analyze data discovery and access monitoring controls.

Identify that Data Loss Prevention (DLP) coupled with data classification tags prevents unauthorized exfiltration and enforces policy compliance on sensitive customer records.

DLP mechanisms contextualize data based on sensitivity labels and monitor access patterns within the storage architecture.

Evaluate remaining choices against cryptographic and security control principles.

Reject asymmetric RSA for bulk storage due to performance constraints, reject hashing for non-repudiation because hashes lack origin proof/digital signatures, and reject WAF as a storage sector repair tool because WAFs are application-layer preventive filters.

Aligns with core principles regarding cipher selection, AAA/integrity mechanisms, and security control functional classification.

Key Concept

Data Protection and Storage Security Architecture

PreviousPage 40 / 112Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept