Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 841Question →

An enterprise organization is designing a disaster recovery strategy for its critical e-commerce platform. To ensure continuous business operations, the organization requires an off-site recovery facility that is fully configured with active servers, network infrastructure, and real-time data synchronization, allowing it to immediately assume operational duties if the primary site fails. Which of the following recovery site types best satisfies these requirements?

Show answer & explanation

Answer: Hot site

Answer

A hot site is a fully operational, mirrored facility capable of immediate failover with real-time data replication.
The option specifying a hot site is correct because a hot site provides a fully redundant, operational environment equipped with current hardware, operating systems, applications, and synchronized real-time data feeds. This allows the facility to take over primary operations immediately upon failover with virtually zero data loss.

Step-by-Step Solution

1
Analyze the operational requirements from the scenario.
The requirement specifies an off-site recovery facility with active hardware, pre-configured software, real-time data replication, and immediate failover capabilities.
Identifying the target Recovery Time Objective (RTO) and Recovery Point Objective (RPO) dictates which redundancy facility tier is required.
2
Compare site redundancy tiers against the specified constraints.
Cold sites lack equipment; warm sites lack live data replication; mobile sites provide temporary portable infrastructure; hot sites maintain live mirrored infrastructure ready for immediate operation.
Only a hot site satisfies the near-zero downtime requirement through live data synchronization and ready-to-run systems.

Key Concept

Disaster Recovery Site Types and Redundancy
Question 842Question →

An enterprise security team is implementing enterprise hardening practices for out-of-band management interfaces on network switches to reduce the risk of unauthorized lateral movement. Which TWO of the following technical controls should the team implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Isolate all switch management traffic to a dedicated out-of-band network segment and enforce 802.1X port-based access control.; Disable unencrypted management protocols such as Telnet and HTTP in favor of SSHv2 and HTTPS.

Answer

The correct controls are isolating management traffic to a dedicated out-of-band network segment with 802.1X access control, and disabling unencrypted management protocols such as Telnet and HTTP in favor of SSHv2 and HTTPS.
Hardening network management interfaces requires both physical/logical network isolation and transport security. Segregating management interfaces into a dedicated out-of-band network with port authentication prevents unauthorized internal hosts from communicating with switch consoles. Simultaneously, replacing unencrypted administrative protocols (Telnet/HTTP) with encrypted protocols (SSHv2/HTTPS) secures administrative credentials and sessions from eavesdropping.

Step-by-Step Solution

1
Analyze network management interface exposure and hardening objectives.
Identified the need for secure management access that mitigates lateral movement and prevents unauthorized access or credential sniffing.
Management interfaces are primary targets for adversaries attempting network wide privilege escalation.
2
Evaluate network isolation and access control mechanisms.
Dedicated out-of-band network segments combined with 802.1X access control restrict management access strictly to authorized administrators and endpoints.
Segmenting management interfaces prevents unauthorized hosts on the general corporate network from reaching administrative interfaces.
3
Evaluate protocol security requirements.
Replacing cleartext protocols (Telnet, HTTP) with encrypted alternatives (SSHv2, HTTPS) protects management sessions against packet sniffing.
Unencrypted protocols transmit administrative credentials in plain text across network links.

Key Concept

Out-of-Band Management Hardening and Protocol Security
Question 843Question →

A logistics enterprise is integrating automated freight crane telemetry sensors with its centralized monitoring dashboard. The crane control systems run legacy industrial software that cannot be patched, whereas the monitoring dashboard resides on the corporate administrative network. Which network design control best mitigates the risk of lateral threat movement from the corporate network to the crane controllers while continuing to permit automated telemetry collection?

Show answer & explanation

Answer: Deploying microsegmentation with strict firewall stateful rules that enforce unidirectional traffic flow from the crane network zone to the monitoring dashboard

Answer

Deploying microsegmentation with strict firewall stateful rules that enforce unidirectional traffic flow from the crane network zone to the monitoring dashboard.
Microsegmentation paired with unidirectional stateful filtering allows data to be sent from the critical operational zone to the dashboard zone while blocking any inbound access requests initiated from the administrative network toward the vulnerable legacy crane controllers.

Step-by-Step Solution

1
Analyze the functional requirements and security constraints of the operational environment.
Real-time telemetry data must flow out from the crane controllers to the corporate dashboard, but legacy controllers must be shielded from incoming connections.
Legacy systems are vulnerable to exploit attempts if reachable over the network.
2
Evaluate network architecture controls against threat vectors.
Microsegmentation establishes granular control boundaries around the industrial controllers, allowing outbound telemetry traffic while blocking inbound connections from the corporate network.
Restricting session initiation prevents compromised corporate workstations from moving laterally into the industrial control environment.

Key Concept

Microsegmentation and zone isolation for operational technology (OT) systems
Estimated Time:1m 30s
Question 844Question →

A security team is implementing an access control model that evaluates contextual variables—such as user location, device security compliance, time of request, and resource sensitivity—before granting access. Which access control architecture model natively uses these dynamic characteristics to make authorization decisions?

Show answer & explanation

Answer: Attribute-Based Access Control (ABAC)

Answer

Attribute-Based Access Control (ABAC)
Attribute-Based Access Control (ABAC) evaluates specific characteristics (attributes) belonging to the user, resource, action, and environment—such as IP address, device health, time of day, and data classification—to dynamically determine access permissions.

Step-by-Step Solution

1
Analyze the access control requirement in the scenario.
The requirement specifies making authorization decisions based on dynamic contextual factors such as location, device health, time of request, and data sensitivity.
Understanding the input parameters used for access decisions helps distinguish between static and dynamic access control models.
2
Evaluate the architectural characteristics of Attribute-Based Access Control (ABAC).
ABAC grants access rights through policies that combine subject, resource, action, and environmental attributes.
ABAC is specifically designed to support fine-grained, dynamic, and context-aware authorization policies in modern security architectures.

Key Concept

Attribute-Based Access Control (ABAC)
Estimated Time:45s
Question 845Question →

An organization is deploying a multi-tenant cloud platform where microservices processing sensitive financial records will run alongside third-party analytics services on the same physical host node. The software engineering team proposes relying solely on standard Linux container runtime features, claiming that container namespaces provide security boundary isolation identical to dedicated virtual machines on a Type-1 hypervisor. Which of the following statements best describes the primary security risk associated with this deployment architecture?

Show answer & explanation

Answer: Containers share the underlying host operating system kernel, so a privilege escalation or kernel vulnerability could allow a compromise of one container to break isolation and impact adjacent tenant workloads.

Answer

Container workloads share the underlying host operating system kernel, meaning a kernel flaw or container escape vulnerability could allow an attacker to bypass isolation and access adjacent tenant microservices on the host node.
The correct answer highlights that containers virtualize at the operating system level and share the host kernel. If an attacker exploits a flaw in the kernel or container runtime, they can escalate privileges to the host and access other containers sharing that host kernel.

Step-by-Step Solution

1
Analyze the isolation mechanism of containers versus virtual machines.
Containers share the host operating system kernel and use kernel features (namespaces, cgroups) for isolation, while virtual machines run separate guest operating systems on virtualized hardware managed by a hypervisor.
Understanding the fundamental architectural difference determines the blast radius of a security compromise.
2
Evaluate the risk of running untrusted third-party microservices on a shared container host.
A vulnerability in the shared host kernel or container runtime can be exploited to achieve a container escape.
Because the host kernel is shared across all containers on that host, breaking the kernel boundary compromises all co-located container workloads.

Key Concept

Shared Kernel Isolation Risks in Containerization
Question 846Question →

A security analyst is conducting a vulnerability assessment on a company's web portal source code and server logs. The audit identifies that input from a search field is concatenated directly into a backend database statement without input sanitization. Additionally, users can view arbitrary account records by modifying the user ID parameter in the HTTP GET request line because server-side authorization validation is absent. Which of the following application vulnerabilities are present in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: SQL injection (SQLi); Insecure Direct Object Reference (IDOR)

Answer

The web application exhibits SQL injection due to unsanitized input concatenation into database queries, and Insecure Direct Object Reference (IDOR) due to missing server-side authorization checks on URL resource identifier parameters.
SQL injection occurs when unvalidated user input is directly concatenated into database query statements, allowing attackers to execute arbitrary SQL commands. Insecure Direct Object Reference occurs when an application exposes a reference to an internal implementation object, such as a user identifier parameter, without performing server-side authorization checks to verify user permissions.

Step-by-Step Solution

1
Examine the database input processing mechanism
Unsanitized user search input concatenated into backend query strings exposes the database to SQL injection (SQLi).
Database calls must use parameterized queries or input sanitization to prevent untrusted data from altering query execution structure.
2
Evaluate the parameter-based resource access model
Manipulating request URL parameters to fetch other users' profile data without authorization checks indicates Insecure Direct Object Reference (IDOR).
Applications must perform explicit server-side access control validation whenever internal object references are supplied by clients.

Key Concept

Application and Software Vulnerabilities
Question 847Question →

A security handler confirms that a cloud administrator host is actively exporting database backups to an unapproved external storage endpoint using hijacked API credentials. Following standard incident response procedures, which of the following actions should the security handler take FIRST?

Show answer & explanation

Answer: Revoke the compromised API credentials and restrict the host's network connectivity.

Answer

Revoke the compromised API credentials and restrict the host's network connectivity.
In standard incident response frameworks (such as NIST SP 800-61), once an active breach or exfiltration event is detected, containment is the immediate priority. Revoking compromised API keys and isolating the affected system prevents further data loss without altering offline forensic evidence.

Step-by-Step Solution

1
Analyze the incident scenario and determine the current phase of incident response.
An active data exfiltration incident is occurring via hijacked administrative credentials.
Immediate containment is required to minimize exposure and halt ongoing unauthorized access.
2
Select the appropriate immediate containment action according to standard NIST IR playbooks.
Revoking session keys/credentials and isolating the administrator host halts exfiltration immediately.
Containment actions must precede eradication (reimaging) or recovery (restoring from backups).

Key Concept

Incident Response Lifecycle - Containment Phase
Question 848Question →

Match each storage security technology on the left with its primary enterprise implementation role on the right.

Click a left item, then click its matching right item

Items

Self-Encrypting Drive (SED)
Hardware Security Module (HSM)
Storage Area Network (SAN) LUN Masking
Endpoint Data Loss Prevention (DLP)

Matches

Show answer & explanation

Answer

Self-Encrypting Drive pairs with transparent hardware-based disk encryption at the drive controller level. Hardware Security Module pairs with tamper-resistant hardware storage for securing key lifecycles. SAN LUN Masking pairs with restricting host access to specific logical volumes based on HBA identifiers. Endpoint DLP pairs with inspecting data write operations to prevent unencrypted sensitive data transfers to removable media.
Each technology fulfills a distinct role within enterprise storage architecture: SEDs provide transparent drive controller-level hardware encryption; HSMs secure key storage in hardened modules; SAN LUN masking restricts volume access by host identifier; and endpoint DLP enforces data content protection policies on endpoint write actions.

Step-by-Step Solution

1
Analyze storage encryption controls
Identify that Self-Encrypting Drives execute transparent encryption at the drive controller level, avoiding host CPU performance hits.
SEDs rely on dedicated hardware inside the drive casing rather than host OS crypto modules.
2
Evaluate key management architecture
Match Hardware Security Module to centralized, tamper-evident master key storage.
HSMs protect master keys and perform cryptoprocessing in secure physical boundaries.
3
Analyze block storage isolation mechanisms
Associate LUN Masking with restricting access to specific SAN storage volumes by checking host bus adapter WWNs/identifiers.
LUN masking acts as access control on storage arrays to prevent unauthorized servers from mounting raw storage volumes.
4
Analyze data exfiltration prevention tools
Link Endpoint Data Loss Prevention to real-time content inspection blocking writes to external storage devices.
DLP evaluates file content against classification rules before allowing write operations to endpoint peripherals.

Key Concept

Data Protection and Storage Security Architecture
Question 849Question →

A security analyst is investigating a high-fidelity SIEM alert generated from cloud infrastructure audit logs. The analyst retrieves the following sequential log events originating from external IP address 198.51.100.4:

text
2026-06-14T09:12:01Z cloudtrail: User="j.smith" Event="ConsoleLogin" Status="Failure" SourceIP="198.51.100.4"
2026-06-14T09:12:03Z cloudtrail: User="m.davis" Event="ConsoleLogin" Status="Failure" SourceIP="198.51.100.4"
2026-06-14T09:12:05Z cloudtrail: User="a.wilson" Event="ConsoleLogin" Status="Failure" SourceIP="198.51.100.4"
2026-06-14T09:12:10Z cloudtrail: User="r.taylor" Event="ConsoleLogin" Status="Success" SourceIP="198.51.100.4"
2026-06-14T09:12:18Z cloudtrail: User="r.taylor" Event="CreateAccessKey" Status="Success" SourceIP="198.51.100.4"

Based on these log entries, which of the following security events has occurred?

Show answer & explanation

Answer: A password spraying attack resulted in a successful login for account r.taylor, followed by the generation of API credentials for persistence.

Answer

A password spraying attack resulted in a successful login for account r.taylor, followed by the generation of API credentials for persistence.
The correct option accurately identifies the log signature of a password spraying attack (multiple different target accounts tested from one IP address in rapid succession) leading to account compromise and post-exploitation persistence setup via API access key creation.

Step-by-Step Solution

1
Analyze the log entries for authentication activity patterns.
Identify that the same source IP (198.51.100.4) attempted login requests across multiple distinct user accounts (j.smith, m.davis, a.wilson, r.taylor) within seconds.
Sequential failed logins across multiple accounts from a single IP address indicate a horizontal brute-force technique known as password spraying.
2
Evaluate the outcome of the authentication attempts.
Account r.taylor logged in successfully at 09:12:10Z.
Determines that the password spraying attempt successfully identified a valid credential pair.
3
Correlate post-authentication actions.
Account r.taylor executed CreateAccessKey successfully 8 seconds after logging in.
Threat actors frequently create programmatic access keys immediately after account compromise to ensure persistent command-line or API access.

Key Concept

Log Correlation and Password Spraying Detection
Question 850Question →

A security analyst is evaluating packet captures and log entries following a network intrusion alert. Match each observed technical indicator to its corresponding network or wireless attack classification.

Click a left item, then click its matching right item

Items

Radio frequency frames captured with rapidly repeating 24-bit Initialization Vector (IV) values across a WEP-encrypted network segment.
Unsolicited IPv6 Router Advertisement (RA) messages broadcasting fraudulent prefix information to reconfigure client default gateways.
Inbound DNS response packets carrying forged IP addresses arriving before legitimate authoritative replies with matching transaction IDs.
Layer 2 Ethernet frames encapsulating two distinct 802.1Q tags to traverse unauthorized switch Virtual Local Area Networks.

Matches

Show answer & explanation

Answer

Repeating 24-bit IV values correspond to IV Attack; unsolicited IPv6 Router Advertisements correspond to Rogue RA Attack; forged DNS response packets arriving early correspond to DNS Poisoning; Ethernet frames with double 802.1Q headers correspond to VLAN Hopping.
The technical indicators specifically map to their corresponding attack mechanisms: repeating 24-bit IVs indicate an IV attack against WEP; unauthenticated IPv6 ICMPv6 router messages represent a Rogue RA attack; premature forged DNS replies represent DNS poisoning; and double 802.1Q header encapsulation represents VLAN hopping.

Step-by-Step Solution

1
Analyze the wireless packet capture indicator showing repeating initialization vectors.
Identify that reused 24-bit IVs under WEP encryption facilitate key mathematical derivation.
WEP uses small 24-bit IVs; frequent reuse enables keystream recovery in an IV attack.
2
Examine the network layer broadcast log showing unsolicited IPv6 Router Advertisements.
Determine that unauthorized RA broadcasts alter host routing paths.
Rogue RA attacks exploit IPv6 stateless address autoconfiguration (SLAAC) to redirect traffic.
3
Evaluate the application layer network log showing early DNS responses.
Recognize that forged DNS answers supplied ahead of valid authoritative resolvers corrupt cache records.
Race conditions in DNS resolution allow attackers to poison resolver caches with malicious IP mappings.
4
Inspect the data link layer encapsulation log showing multiple VLAN tags.
Identify that double 802.1Q tagging allows traffic to cross VLAN boundaries bypassing switch isolation.
Switches processing double-tagged frames strip the first tag and forward the frame onto the inner VLAN tag.

Key Concept

Network and Wireless Attack Indicators
Question 851Question →

A security operations team responds to an active breach involving a malicious third-party OAuth application that gained consent to access executive mailboxes in a cloud SaaS environment. The application is actively exporting sensitive financial emails via automated API calls. According to standard incident response playbooks for cloud containment, which TWO of the following actions should the team perform immediately? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Revoke all active OAuth access and refresh tokens linked to the malicious application.; Disable the application registration and revoke permissions for its service principal in the identity tenant.

Answer

The correct containment steps are revoking active OAuth access and refresh tokens and disabling the application registration with its service principal permissions.
In cloud identity environments, containing malicious third-party OAuth app activity requires severing active API authorizations. Revoking current access and refresh tokens immediately stops ongoing session traffic, while disabling the enterprise application registration and its service principal prevents the attacker from generating fresh tokens or maintaining persistent API access.

Step-by-Step Solution

1
Identify the vector of active exfiltration
Exfiltration is occurring via API calls using compromised OAuth tokens tied to an authorized application registration.
Containment must target the exact access vector without destroying system evidence or impacting unrelated services.
2
Invalidate existing session tokens
Revoking access and refresh tokens instantly severs current API connections established by the attacker.
Token revocation stops ongoing data transfer in real time during the containment phase.
3
Disable application credentials
Disabling the application registration and its service principal prevents the application from generating new authorization tokens.
This isolates the malicious application within the identity tenant, completing initial containment.

Key Concept

Cloud SaaS Incident Response and OAuth Application Containment
Estimated Time:2m 0s
Question 852Question →

A healthcare organization is deploying a patient engagement application using virtual machine instances hosted on an Infrastructure as a Service (IaaS) cloud platform. The security architect is defining the operational security responsibilities between the organization and the cloud service provider (CSP). According to the cloud shared responsibility model, which of the following tasks is the sole responsibility of the customer?

Show answer & explanation

Answer: Configuring security baselines and applying security patches to the guest operating systems

Answer

Configuring security baselines and applying security patches to the guest operating systems
In Infrastructure as a Service (IaaS) cloud deployments, operational responsibility for everything built above the hypervisor belongs to the customer. This includes configuring guest operating systems, installing OS patches, managing installed applications, and implementing network access control lists on virtual interfaces.

Step-by-Step Solution

1
Identify the cloud service model referenced in the scenario.
The scenario specifies an Infrastructure as a Service (IaaS) deployment model.
Operational responsibility boundaries vary depending on whether IaaS, PaaS, or SaaS is deployed.
2
Differentiate customer duties from cloud service provider duties under IaaS.
The provider manages the physical infrastructure, facilities, hardware, and hypervisor layer. The customer manages the guest OS, middleware, applications, network firewall rules, and data.
The shared responsibility model defines ownership of security controls across cloud service tiers.
3
Evaluate the listed tasks against the customer's operational boundary.
Hardening and patching virtual machine guest operating systems falls directly within the customer's domain of control.
The CSP does not have administrative access or ownership of tenant-provisioned guest operating systems.

Key Concept

Cloud Shared Responsibility Model in Infrastructure as a Service (IaaS)
Question 853Question →

A systems administrator is configuring a critical database server to eliminate single points of failure at both the power source and internal storage levels. Which of the following hardware and physical redundancy solutions directly satisfy these resilience requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Dual power supplies connected to independent Uninterruptible Power Supply (UPS) units; RAID 1 mirrored disk configuration

Answer

The correct solutions are installing dual power supplies connected to independent Uninterruptible Power Supply (UPS) units and utilizing a RAID 1 mirrored disk configuration.
High availability and hardware resilience require immediate, real-time failover mechanisms for physical components. Dual power supplies connected to separate UPS circuits ensure continuous electrical power if one power path fails. A RAID 1 mirrored drive setup maintains real-time data access and system operation if a physical hard drive fails.

Step-by-Step Solution

1
Identify the power redundancy requirement
Dual power supplies plugged into separate UPS units ensure continuous power delivery even if one circuit or power module fails.
Eliminates power supply unit and utility circuit failures as single points of failure.
2
Identify the storage redundancy requirement
RAID 1 duplicates data across two drives in real time, maintaining system availability if one disk fails.
Provides real-time storage fault tolerance without interrupting system operations.

Key Concept

Real-Time Hardware Fault Tolerance and Redundancy
Question 854Question →

Place the core stages of the Security Information and Event Management (SIEM) log processing pipeline in the correct sequential order from initial intake to analyst notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the SIEM log processing pipeline is Log Collection, followed by Parsing and Normalization, then Event Correlation, and finally Alert Generation.
The standard SIEM data ingestion workflow begins with raw Log Collection from enterprise systems. These logs undergo Parsing and Normalization so that events from diverse operating systems and security appliances fit a common data model. Once normalized, the SIEM executes Event Correlation across logs to detect complex multi-host attack patterns. When correlation threshold rules are met, the system performs Alert Generation to notify security analysts.

Step-by-Step Solution

1
Identify the initial data ingestion phase
Log Collection occurs first as raw logs must be collected from disparate endpoint and network sources before processing.
Downstream parsing and analysis tools require raw event data to operate.
2
Identify the data structuring phase
Parsing and Normalization occurs second to reformat incoming raw text logs into standard, structured fields.
SIEM engines require consistent field definitions across different log vendors to execute detection logic.
3
Identify the threat detection and analysis phase
Event Correlation occurs third to analyze structured logs against rule sets and baseline behaviors.
Correlation logic depends on pre-normalized fields to associate related events across different systems.
4
Identify the incident escalation phase
Alert Generation occurs last when correlation conditions indicate a potential security event.
Alerting informs analysts only after potential threat indicators have been identified and prioritized.

Key Concept

SIEM Log Processing Pipeline
Question 855Question →

During a routine traffic audit of an enterprise perimeter router, a security team examines the following network telemetry log generated by a passive Network Security Monitoring (NSM) sensor inspecting outbound UDP traffic:

Timestamp: 2026-07-27T14:22:01Z
Sensor_ID: NSM-PERIMETER-02
Src_IP: 10.4.18.99 (Internal Workstation)
Dst_IP: 198.51.100.45 (External Name Server)
Proto/Port: UDP/53
Query_Type: TXT
Query_String: a1b2c3d4e5f67890abcdef1234567890.sub.exfil-domain.example
Packet_Count: 14,250 queries/5 min
Avg_Payload_Size: 480 bytes

Which of the following is the most accurate assessment of the threat indicated by this alert and the security operational classification of the sensor mechanism?

Show answer & explanation

Answer: The traffic indicates network data exfiltration using DNS covert tunneling, and the monitoring sensor operates as a detective security control.

Answer

The traffic indicates network data exfiltration using DNS covert tunneling, and the monitoring sensor operates as a detective security control.
The correct option accurately identifies the high-frequency UDP/53 TXT query anomaly as DNS covert tunneling used for exfiltrating data across network boundaries. It also correctly categorizes the passive network telemetry sensor as a detective security control because it gathers log evidence and triggers alerts without intercepting or dropping packets inline.

Step-by-Step Solution

1
Analyze the protocol, query type, payload length, and traffic volume in the telemetry log.
The log reveals an abnormally high volume (14,250 queries within 5 minutes) of UDP port 53 TXT record requests carrying long encoded subdomains to an external destination.
Legitimate DNS resolution consists of low-volume, short lookup requests. Large payloads sent rapidly via TXT queries strongly indicate DNS tunneling used for covert data exfiltration.
2
Differentiate between database/web application exploit traffic and network-level covert tunneling.
The payload is encoded data embedded inside domain subdomains for DNS routing, not relational database manipulation queries (SQL injection).
DNS tunneling encapsulates data within protocol packets to bypass perimeter firewalls, distinct from web application injection vulnerabilities.
3
Classify the operational role of the passive Network Security Monitoring (NSM) sensor.
The passive NSM sensor observes network traffic and records telemetry/alerts, serving a detective control function.
Preventive controls block traffic inline (like firewalls or NIPS), whereas passive network monitoring mechanisms detect and report events.

Key Concept

DNS Covert Tunneling Detection and Detective Security Controls
Question 856Question →

An incident response team is executing a playbook following the detection of an active unauthorized remote access Trojan on an enterprise workstation. Which of the following actions represent appropriate steps to take specifically during the containment phase of the incident response lifecycle? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Isolating the compromised workstation from the local network by disabling its network interface; Blocking the remote command-and-control server's IP address at the perimeter firewall

Answer

The correct containment steps are isolating the compromised workstation from the local network by disabling its network interface, and blocking the remote command-and-control server's IP address at the perimeter firewall.
The containment phase aims to limit the blast radius of a confirmed security incident. Isolating the workstation from the network stops malware from spreading laterally across internal segments. Blocking command-and-control IP addresses at the firewall halts outbound control channels and data exfiltration while keeping evidence intact.

Step-by-Step Solution

1
Determine the core purpose of the containment phase in the incident response framework.
Containment focuses on restricting the spread of an active incident and mitigating damage while keeping systems stable and preserving evidence.
Stopping lateral movement and external C2 communications isolates the risk before permanent removal or rebuilding steps begin.
2
Map each option to its appropriate incident response lifecycle phase.
Host network isolation and perimeter firewall blocking limit breach scope (Containment). System reimaging purges the malware (Eradication). Post-incident reviews document lessons learned (Post-Incident Activity).
Distinguishing containment actions from eradication and post-incident activities ensures proper operational sequencing according to NIST SP 800-61 guidelines.

Key Concept

Incident Response Containment Strategies
Question 857Question →

An organization is updating its enterprise security architecture to streamline user access across external cloud applications. The security team needs to implement standards that support federated single sign-on (SSO) and automated account lifecycle management between the corporate identity provider and SaaS platforms. Which TWO of the following open standards should the team integrate into the IAM architecture to fulfill these specific requirements?

Select all that apply

Show answer & explanation

Answer: Security Assertion Markup Language (SAML); System for Cross-domain Identity Management (SCIM)

Answer

Security Assertion Markup Language (SAML) and System for Cross-domain Identity Management (SCIM) are the two open standards designed for federated single sign-on and cross-domain user provisioning.
Security Assertion Markup Language (SAML) provides the XML framework required to federate identity assertions between an Identity Provider and cloud Service Providers for single sign-on. System for Cross-domain Identity Management (SCIM) works alongside federated SSO by providing a standardized REST API payload format to automatically create, update, and remove user identity records across external cloud services.

Step-by-Step Solution

1
Identify the requirement for federated single sign-on across third-party SaaS services.
Recognize that Security Assertion Markup Language (SAML) enables secure exchange of authentication assertions between an Identity Provider (IdP) and Service Providers (SP).
Federated SSO relies on standard protocols like SAML or OIDC to pass identity tokens securely.
2
Identify the requirement for automated user lifecycle and account provisioning.
Recognize that System for Cross-domain Identity Management (SCIM) automates creating, updating, and deprovisioning user accounts across distinct identity domains.
SCIM uses RESTful APIs to sync user store changes automatically.

Key Concept

Federated Identity and Automated Provisioning Standards
Estimated Time:1m 0s
Question 858Question →

A security architect is establishing high availability and resilience specifications for a mission-critical infrastructure deployment. Match each resiliency requirement or architectural challenge on the left with its corresponding technical mechanism or metric on the right.

Click a left item, then click its matching right item

Items

Eliminating single points of failure across web servers while seamlessly preserving active user sessions during node outages
Defining the maximum tolerable duration of data loss measured in time prior to an unplanned service disruption
Preventing data corruption caused by concurrent writes when heartbeat communication fails between cluster nodes
Providing storage-level disk redundancy allowing continuous operations despite a single drive failure

Matches

Show answer & explanation

Answer

The correct pairings are: 1. Preserving active user sessions across web server outages matches with Stateful Load Balancing with VIP failover; 2. Maximum tolerable duration of data loss matches with Recovery Point Objective (RPO); 3. Preventing data corruption during heartbeat failure matches with Node Fencing / STONITH; 4. Disk redundancy for continuous operation matches with RAID 5 / RAID 1 array configuration.
Each requirement directly aligns with its corresponding architectural control: RPO defines acceptable data loss interval; stateful load balancing preserves persistent connections across redundant nodes; STONITH node fencing prevents split-brain corruption in active-active/active-passive clusters; and RAID provides local disk fault tolerance.

Step-by-Step Solution

1
Analyze session-handling and network redundancy requirements.
Matched session preservation during server outage to Stateful Load Balancing with VIP failover.
Stateful load balancers track session state tables across cluster nodes, ensuring users remain logged in when traffic shifts.
2
Evaluate availability metrics for data recovery.
Matched data loss time threshold to Recovery Point Objective (RPO).
RPO measures acceptable data loss currency in units of time, whereas RTO measures acceptable duration of service disruption.
3
Analyze high-availability clustering split-brain safeguards.
Matched split-brain data corruption prevention to Node Fencing / STONITH.
When heartbeat lines fail, automated fencing mechanisms disable the disconnected node to guarantee exclusive write lock on shared storage.
4
Identify hardware-level redundancy controls.
Matched single-drive failure protection to RAID configurations.
RAID 1 (mirroring) and RAID 5 (striping with parity) provide hardware fault tolerance for storage volumes.

Key Concept

Resilience, High Availability, and Redundancy Mechanisms
Question 859Question →

A security analyst investigating a cloud-hosted infrastructure detects that an OAuth 2.0 refresh token assigned to an automated microservice was compromised. Real-time monitoring confirms an unauthorized external entity is actively exploiting this token to execute bulk queries and exfiltrate sensitive financial records from a database endpoint. According to standard incident response lifecycle frameworks, which of the following represents the IMMEDIATE next step the incident response team should take?

Show answer & explanation

Answer: Revoke the compromised API access token and apply temporary network isolation rules to halt active data exfiltration.

Answer

Revoke the compromised API access token and apply temporary network isolation rules to halt active data exfiltration.
The correct response prioritizes containment above eradication and recovery during an active security incident. In standard frameworks (such as NIST SP 800-61), once an incident is detected and validated, the immediate priority is limiting the scope of impact and preventing further exfiltration. Revoking the compromised OAuth token invalidates the active credential, while temporary network isolation prevents further unauthorized API interaction.

Step-by-Step Solution

1
Analyze the current state of the security incident based on scenario telemetry.
Identified active data exfiltration occurring via a compromised OAuth token.
Determining whether an active threat is in progress dictates the immediate priority in the incident response process.
2
Determine the appropriate incident response phase according to standard NIST SP 800-61 / ISO 27035 guidelines.
The incident is actively occurring, requiring immediate Containment.
The priority during active breach scenarios is to limit damage and prevent further unauthorized data movement before initiating remediation.
3
Select the response action that fulfills the containment objective.
Revoking the compromised token and isolating the affected endpoint stops ongoing data leakage immediately.
Invalidating stolen active session/token credentials and isolating network pathways directly halts unauthorized data access without jumping ahead to eradication or recovery.

Key Concept

Incident Response Lifecycle Containment Phase Priorities
Question 860Question →

An enterprise security architect is evaluating modern Identity and Access Management (IAM) controls to enforce Zero Trust principles and streamline federated access across a multi-cloud enterprise. Match each identity architecture protocol or mechanism on the left to its corresponding architectural implementation on the right.

Click a left item, then click its matching right item

Items

Continuous Access Evaluation Protocol (CAEP)
System for Cross-domain Identity Management (SCIM)
Privileged Access Management (PAM) with Ephemeral Credentials
OAuth 2.0 Demonstration of Proof-of-Possession (DPoP)

Matches

Show answer & explanation

Answer

Continuous Access Evaluation Protocol (CAEP) matches real-time session state and posture event sharing; System for Cross-domain Identity Management (SCIM) matches automated identity lifecycle provisioning across SaaS applications; Privileged Access Management (PAM) with Ephemeral Credentials matches eliminating static administrative credentials via short-lived access rights; and OAuth 2.0 Demonstration of Proof-of-Possession (DPoP) matches cryptographically binding tokens to client key pairs to prevent replay attacks.
Continuous Access Evaluation Protocol (CAEP) allows identity providers and relying parties to exchange real-time security events such as session revocation or risk score changes. System for Cross-domain Identity Management (SCIM) standardizes user provisioning workflows to automate account lifecycle events between identity stores and SaaS applications. Privileged Access Management (PAM) with ephemeral credentials reduces attack surfaces by dynamically issuing short-lived administrative credentials on demand rather than maintaining standing privileges. OAuth 2.0 Demonstration of Proof-of-Possession (DPoP) secures API access by binding OAuth tokens to a client's private key, preventing intercepted bearer tokens from being replayed.

Step-by-Step Solution

1
Analyze the functional scope of each identity architecture protocol and component listed on the left.
CAEP provides real-time event-driven access evaluation; SCIM handles automated user account lifecycle management; PAM with ephemeral credentials handles short-lived privileged access; DPoP enforces token sender-constraining.
Determining the primary architectural boundary addressed by each standard is required to pair them correctly.
2
Correlate each architectural component to its matching enterprise use case on the right.
CAEP correlates to real-time posture event sharing for immediate session revocation; SCIM correlates to identity provisioning across cloud SaaS platforms; PAM ephemeral credentials correlate to eliminating standing credentials with just-in-time access; DPoP correlates to binding tokens to client private keys to stop token replay.
Each mechanism addresses a specific aspect of modern IAM architecture, including session security, identity lifecycle, privilege management, and API token security.

Key Concept

Enterprise IAM Architecture Protocols and Control Frameworks
PreviousPage 43 / 112Next
All practice questions — CompTIA Security+ | Examkin