All practice questions
2232 questions
An organization is aligning its cybersecurity procedures with the NIST SP 800-61 incident response framework. Place the core phases of the incident response process in the correct chronological order from first to last.
Drag items to arrange them in the correct order
An enterprise organization updates its endpoint compliance architecture by deploying Mobile Device Management (MDM) software across all remote corporate devices. When an endpoint fails continuous compliance checks or exhibits unauthorized system modifications, the MDM agent automatically executes a remotely triggered cryptographic wipe script to isolate and sanitize the stored sensitive data. A security auditor asks the architecture team to classify this automated software action. Which of the following classifications correctly identifies both the primary category and functional type of this security control?
An enterprise network administrator notices that several workstations on a local subnet are unexpectedly routing their outbound traffic through an unfamiliar host outside the designated gateway pool. Inspection of network packet captures reveals that workstations renewing their dynamic network configurations are accepting DHCPACK packets from a secondary, unauthorized server that responds faster than the corporate server. Which of the following attack indicators is demonstrated in this scenario?
Match each Identity and Access Management (IAM) protocol or standard to its primary architectural function in an enterprise environment.
Click a left item, then click its matching right item
Items
Matches
A SOC analyst is reviewing diverse log artifacts collected across enterprise infrastructure. Match each security log artifact signature to the corresponding incident activity or event type it indicates.
Click a left item, then click its matching right item
Items
Matches
A security administrator is hardening a container runtime environment hosting third-party microservices on a shared host node. To minimize the blast radius of a potential container exploit, the administrator needs to enforce strict privilege boundary controls on container processes. Which TWO of the following security configurations should be implemented to meet these requirements? (Select TWO.)
Select all that apply
A network security architect is establishing ingress and zone traversal inspection controls for a public-facing e-commerce platform. The architecture requires multi-tiered network segmentation to isolate external web traffic from sensitive internal backend databases. In what order should inbound network traffic pass through these security controls and network zones, starting from initial external ingress to the final destination in the isolated database zone?
Drag items to arrange them in the correct order
A security analyst is reviewing authentication logs from a Linux server (`/var/log/auth.log`) after a SIEM alert fired:
May 12 14:02:11 auth-srv sshd[4102]: Failed password for root from 192.0.2.45 port 49152 ssh2
May 12 14:02:14 auth-srv sshd[4102]: Failed password for root from 192.0.2.45 port 49154 ssh2
May 12 14:02:17 auth-srv sshd[4102]: Failed password for root from 192.0.2.45 port 49156 ssh2
May 12 14:02:22 auth-srv sshd[4102]: Accepted password for root from 192.0.2.45 port 49160 ssh2
May 12 14:02:23 auth-srv pam_unix(sshd:session): session opened for user root by (uid=0)
Based on the log snippet above, which of the following statements regarding the incident and appropriate response actions are correct? (Select TWO.)
Select all that apply
A cybersecurity consultant is designing an automated threat intelligence enrichment pipeline for an enterprise security team. The architecture requires ingesting open-source, standardized vulnerability data alongside automated, machine-readable threat indicator feeds from external partners over HTTPS. Which of the following sources or protocols should the consultant integrate into the pipeline to achieve these specific goals? (Select TWO.)
Select all that apply
During a security audit of a native C application, an analyst evaluates a logging routine designed to capture user-submitted feedback. The code snippet under review is as follows:
c
void log_user_feedback(char *user_input) {
FILE *log_file = fopen("/var/log/app_feedback.log", "a");
if (log_file != NULL) {
fprintf(log_file, user_input);
fclose(log_file);
}
}
The analyst notes that input submitted directly by remote users is passed to `fprintf` as the primary formatting parameter without explicit format specifiers. Which of the following application vulnerabilities is directly present in this code?
A Security Operations Center (SOC) analyst receives a validated alert indicating unauthorized administrative credential usage and potential persistence mechanisms on a critical internal server. According to standard incident response frameworks and playbooks, the analyst must focus on immediate containment and evidence preservation. Which of the following actions should the analyst perform at this stage? (Select TWO.)
Select all that apply
During a suspected breach investigation, a security handler observes that an API gateway server hosting sensitive internal workflows is attempting unauthorized outbound network traffic to a known command-and-control server following a successful zero-day exploit execution. According to standard NIST incident response guidelines, which of the following actions should the handler execute FIRST?
Match each enterprise security vulnerability finding on the left with the most effective technical hardening mitigation on the right.
Click a left item, then click its matching right item
Items
Matches
An e-commerce enterprise is deploying an automated cloud storage repository for sensitive database backups containing customer personally identifiable information (PII). Regulatory compliance mandates that all bulk data must be encrypted at rest with high throughput, while key lifecycle management must be secured by a dedicated hardware root of trust to prevent key extraction. Which architecture best fulfills both performance and key protection requirements?
An enterprise e-commerce organization is migrating its real-time product recommendation system to a serverless Function-as-a-Service (FaaS) architecture hosted by a public cloud service provider (CSP). Which TWO of the following security tasks remain the direct responsibility of the enterprise organization under the cloud shared responsibility model?
Select all that apply
A security analyst is reviewing the following Linux authentication and system logs aggregated by an enterprise SIEM platform from host `srv-prod-02`:
syslog
2026-07-27T10:14:02Z srv-prod-02 sshd[8812]: Failed password for invalid user admin from 192.0.2.140 port 51102 ssh2
2026-07-27T10:14:05Z srv-prod-02 sshd[8815]: Failed password for invalid user root from 192.0.2.140 port 51106 ssh2
2026-07-27T10:14:12Z srv-prod-02 sshd[8820]: Accepted password for user svc_web from 192.0.2.140 port 51112 ssh2
2026-07-27T10:14:25Z srv-prod-02 sudo[8840]: svc_web : TTY=pts/1 ; PWD=/var/www/html ; USER=root ; COMMAND=/usr/bin/python3 -c 'import pty; pty.spawn("/bin/sh")'
Based on the SIEM event sequence above, which of the following statements correctly analyze the activity and impact of this security incident? (Select TWO.)
Select all that apply
A Security Operations Center (SOC) analyst receives a high-priority alert indicating that an employee workstation is actively encrypting local files and attempting outbound communication with a malicious command-and-control server. According to standard incident response procedures, which of the following steps should the analyst perform FIRST?
An enterprise security architecture team is redesigning identity federations across several vendor SaaS applications. To align with Zero Trust principles, the organization requires immediate session termination and access token revocation across all connected SaaS applications the moment an identity risk signal (such as impossible travel or device compliance failure) is detected at the central Identity Provider (IdP), rather than waiting for OAuth access tokens or SAML assertions to expire naturally. Which of the following identity architectural mechanisms best fulfills this real-time session security requirement?
A security analyst is reviewing the following firewall Syslog entries forwarded to a SIEM collector:
`Jul 27 10:15:01 fw01 kernel: [FW_DROP]: IN=eth0 OUT= SRC=192.0.2.50 DST=10.0.1.10 PROTO=TCP SPT=49152 DPT=22`
`Jul 27 10:15:01 fw01 kernel: [FW_DROP]: IN=eth0 OUT= SRC=192.0.2.50 DST=10.0.1.10 PROTO=TCP SPT=49153 DPT=80`
`Jul 27 10:15:01 fw01 kernel: [FW_DROP]: IN=eth0 OUT= SRC=192.0.2.50 DST=10.0.1.10 PROTO=TCP SPT=49154 DPT=443`
`Jul 27 10:15:01 fw01 kernel: [FW_DROP]: IN=eth0 OUT= SRC=192.0.2.50 DST=10.0.1.10 PROTO=TCP SPT=3389 DPT=3389`
Which of the following network activities is best indicated by this log sequence?
A biotechnology company needs to isolate its laboratory network housing unpatchable legacy gene-sequencing equipment. The laboratory devices must push telemetry data and analysis reports outward to a central server in the enterprise corporate zone, but the security architecture must strictly guarantee that no incoming connection requests or lateral traffic can reach the laboratory network from the corporate zone. Which of the following network controls best fulfills these security constraints?