All practice questions
2232 questions
A security operations engineer is responding to an incident where an attacker maintained access to enterprise cloud resources after an employee reported a compromised password. The security analyst immediately performed a password reset, but log reviews show the attacker continued performing administrative actions using an active Single Sign-On (SSO) session and active refresh tokens for several hours afterward. Which of the following operations should the security team perform to remediate this vulnerability and ensure immediate containment during credential resets?
Match each threat intelligence concept on the left with its primary operational role within an enterprise security framework on the right.
Click a left item, then click its matching right item
Items
Matches
A security analyst is reviewing HTTP logs for a web application dashboard generator. During security testing, an tester supplied the parameter payload `{{7*7}}`, which resulted in the server returning a web page displaying `49`. A subsequent request containing the payload `{{self.__init__.__globals__.__builtins__.__import__('os').popen('whoami').read()}}` executed on the backend host and returned the web server execution account context. Which of the following application vulnerabilities is present in this system?
An IT auditor inspects syslog entries forwarded to an enterprise SIEM aggregator from a Linux server. The log stream records the following sequential events:
`2026-07-27T14:15:02Z host1 sshd[4821]: Failed password for invalid user root from 198.51.100.45 port 42102 ssh2`
`2026-07-27T14:15:03Z host1 sshd[4825]: Failed password for invalid user admin from 198.51.100.45 port 42104 ssh2`
`2026-07-27T14:15:04Z host1 sshd[4830]: Failed password for invalid user service from 198.51.100.45 port 42108 ssh2`
Which malicious activity is most directly demonstrated by these log entries?
An enterprise security architect is designing a modern Identity and Access Management (IAM) architecture to support a hybrid enterprise workforce. The solution must provide phishing-resistant, passwordless authentication for corporate users accessing cloud services, while automatically synchronizing user onboarding, role updates, and offboarding privileges from the central Identity Provider (IdP) to external Software as a Service (SaaS) platforms in near real-time. Which of the following protocols or standards should the architect integrate into the IAM architecture to fulfill these requirements? (Select TWO.)
Select all that apply
An incident response specialist is preparing to collect evidence from an active, powered-on server involved in a security incident. In what sequence should the specialist acquire the following digital evidence sources to strictly adhere to the Order of Volatility, moving from most volatile to least volatile?
Drag items to arrange them in the correct order
A security engineer is establishing defense-in-depth security controls for an enterprise cloud platform hosting both application containers and virtual machines. Match each security control mechanism to its primary protective function.
Click a left item, then click its matching right item
Items
Matches
A network administrator receives an alert from an Intrusion Detection System (IDS) displaying the following log entries captured from a local subnet:
[WARN] Unsolicited ARP Reply detected: 192.168.1.1 is at 00:11:22:AA:BB:CC (Previous MAC: 00:00:0C:07:AC:01)
[WARN] Unsolicited ARP Reply detected: 192.168.1.1 is at 00:11:22:AA:BB:CC (Host 192.168.1.45 ARP cache updated)
[INFO] Traffic for default gateway 192.168.1.1 rerouted through 00:11:22:AA:BB:CC
Based on these technical indicators, which of the following network attacks is actively occurring?
A security operations team has confirmed a active malware infection on a financial database administrator's workstation. Arrange the incident response playbook actions in the correct chronological order from first to last.
Drag items to arrange them in the correct order
A security engineer is configuring a high-availability perimeter firewall pair using Virtual Router Redundancy Protocol (VRRP) to eliminate single points of failure at the default gateway. During failover testing, when the primary firewall is forcibly rebooted, downstream clients experience dropped sessions and must re-authenticate and re-establish all TCP connections, even though the standby appliance immediately claims the virtual IP address. Which mechanism must be implemented alongside virtual IP redundancy to preserve established network sessions during an unexpected failover?
A security analyst is investigating an anomaly in an e-commerce platform's reward point redemption API. During peak traffic events, logs reveal that multiple concurrent API requests using the same single-use discount coupon resulted in repeated point deductions beyond the user's actual balance. Code review shows that the application checks the remaining balance in one database query and updates the record in a subsequent query without synchronization. Which of the following vulnerabilities and mitigation strategies are identified in this scenario? (Select TWO.)
Select all that apply
An enterprise web application accepts XML-based configuration files uploaded by system administrators. During a code security audit of the backend parser, an analyst discovers that the XML parser is configured to parse inline Document Type Definitions (DTDs) and resolve external entity references by default. Which of the following vulnerabilities is directly created by this parser configuration flaw?
During a routine SOC escalation, an analyst discovers that a compromised staging CI/CD build server is executing unauthorized outbound SSH tunnels to an external IP address while pulling credentials from an internal vault. The server maintains active service accounts with administrative privileges to production clusters. Following standard NIST SP 800-61 incident response guidelines, which of the following actions should the analyst perform FIRST?
A Security Operations Center (SOC) analyst is evaluating DNS server query logs forward-collected by a SIEM platform after an internal endpoint exhibited anomalous egress bandwidth usage. The analyst extracts the following sample log entries from internal host 10.0.12.85 over a brief period:
text
2026-07-27T08:14:02Z client 10.0.12.85#49152 query: v1-dGhpcyBpcyBhIHRlc3Q.data.corp-update.net IN TXT + (10.0.0.2)
2026-07-27T08:14:05Z client 10.0.12.85#49153 query: v1-c2VjcmV0IGRvY3VtZW50.data.corp-update.net IN TXT + (10.0.0.2)
2026-07-27T08:14:09Z client 10.0.12.85#49154 query: v1-ZXhmaWx0cmF0ZWQgZGF0YQ.data.corp-update.net IN TXT + (10.0.0.2)
Standard volume-based DNS threshold alerts failed to trigger because the query frequency remained low. Which of the following SIEM correlation rule enhancements would be MOST effective for detecting this specific exfiltration technique while minimizing false positives?
A Security Operations Center (SOC) analyst is investigating suspicious network and system activity. The analyst extracts the following aggregated log entries from a public-facing web server (web-srv-01) and an internal DNS resolver (dns-core-01):
Log Snippet 1 (Web Server Access & Audit Logs):
2026-07-27T14:22:05Z web-srv-01 nginx: 192.168.10.45 - - [27/Jul/2026:14:22:05 +0000] "POST /api/v1/upload HTTP/1.1" 200 4512 "-" "python-requests/2.31.0"
2026-07-27T14:22:12Z web-srv-01 auditd[1420]: type=EXECVE msg=audit(1785162132.102:402): argc=3 a0="/bin/sh" a1="-c" a2="base64 -d <<< 'aW1wb3J0IG9z...' | python3"
Log Snippet 2 (DNS Query Logs):
2026-07-27T14:22:15Z dns-core-01 named[882]: client 10.0.4.15#52104 (aW5mby5leGZpbHRyYXRpb24.attacker-c2.net): query: aW5mby5leGZpbHRyYXRpb24.attacker-c2.net IN TXT + (10.0.4.1)
2026-07-27T14:22:16Z dns-core-01 named[882]: client 10.0.4.15#52105 (c2VjcmV0ZGF0YS5leGZpbHRyYXRpb24.attacker-c2.net): query: c2VjcmV0ZGF0YS5leGZpbHRyYXRpb24.attacker-c2.net IN TXT + (10.0.4.1)
Based on the log analysis, which of the following conclusions and SIEM detection strategies are correct? (Select TWO.)
Select all that apply
A security analyst is reviewing web server access logs collected by a Security Information and Event Management (SIEM) system. The log stream displays the following entry:
`192.168.1.45 - - [27/Jul/2026:14:22:10 +0000] "GET /products.php?id=1%20UNION%20SELECT%20username,password%20FROM%20users-- HTTP/1.1" 200 452`
Which of the following attack types is directly indicated by this log entry?
An IT administrator is deploying a centralized log server that must remain operational without downtime if an individual hard drive suffers a physical failure. Which of the following technologies should the administrator implement to provide this real-time storage fault tolerance?
An enterprise aerospace contractor is modernizing its IT infrastructure across diverse cloud environments. Match each enterprise workload scenario on the left with the corresponding cloud service or deployment model on the right that best represents its architecture.
Click a left item, then click its matching right item
Items
Matches
A security analyst confirms that an employee workstation has been infected with self-propagating malware that is actively scanning the local subnet for vulnerable hosts. According to standard incident response frameworks, which action should the analyst take FIRST?
A security administration team needs to centralize management for administrative console logins across enterprise network routers and switches. The architectural requirements specify that authentication must be decoupled from authorization to enforce granular per-command permissions, and the entire transmission packet body must be encrypted. Which protocol should the team implement?