Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 881Question →

A security operations team is configuring an enterprise Security Information and Event Management (SIEM) data pipeline to process heterogeneous log sources across cloud and on-premises environments. In what sequential order does the SIEM pipeline process incoming event data from initial receipt to alert generation?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order for processing raw event data into an actionable alert in a SIEM pipeline is: 1) Log Aggregation & Transport, 2) Parsing & Field Extraction, 3) Data Normalization, 4) Contextual Enrichment, and 5) Correlation & Rule Evaluation.
The standard SIEM data ingestion pipeline follows a strict logical flow: raw logs are ingested and transported to the collector, parsed into discrete field tokens, normalized into a uniform data schema, enriched with external contextual metadata (such as threat intelligence and asset ownership), and finally processed by the correlation engine to evaluate detection logic and trigger alerts.

Step-by-Step Solution

1
Receive raw log stream from endpoints and security appliances
Log Aggregation & Transport moves raw events from source hosts to the central collector.
Data must arrive at the SIEM collector before processing can take place.
2
Break down raw log strings into key-value pairs
Parsing & Field Extraction converts unstructured text strings into indexed attributes.
Raw string data must be tokenized into discrete attributes like IP addresses and usernames.
3
Standardize variable names into a unified vendor-agnostic schema
Data Normalization aligns disparate field names across vendor products into a single field taxonomy.
Unified querying across firewall, OS, and application logs requires a standardized schema.
4
Augment normalized log attributes with contextual threat and identity data
Contextual Enrichment attaches threat intelligence feed scores, GeoIP location data, and LDAP user roles.
Rule engines need rich contextual indicators to calculate risk scores accurately.
5
Execute correlation rules against normalized and enriched event streams
Correlation & Rule Evaluation checks events against multi-stage detection logic to generate security alerts.
Correlation is performed on fully normalized and enriched logs to minimize false positives and detect complex attacks.

Key Concept

SIEM Ingestion and Event Processing Pipeline Architecture
Question 882Question →

A chief information security officer (CISO) at a regional healthcare network wants to establish a secure, bidirectional threat intelligence sharing channel to exchange sector-specific cyber threat indicators and attacker tactics directly with peer healthcare organizations. Which threat intelligence source or framework is best suited to fulfill this requirement?

Show answer & explanation

Answer: Information Sharing and Analysis Center (ISAC)

Answer

Information Sharing and Analysis Center (ISAC)
An Information Sharing and Analysis Center (ISAC) is a non-profit organization that provides a central resource for gathering and sharing cyber threat information between entity peers within specific industry sectors (such as healthcare, financial services, or aviation). It fulfills the requirement for trusted, bidirectional indicator exchange.

Step-by-Step Solution

1
Analyze the operational requirements stated in the scenario.
The scenario requires bidirectional, sector-specific threat intelligence sharing among peer healthcare institutions within a trusted framework.
Identifying key constraints (sector-specific, bidirectional sharing, peer trust) filters out non-collaboration intelligence sources.
2
Evaluate the available threat intelligence sources against these requirements.
An Information Sharing and Analysis Center (ISAC) is explicitly established to facilitate trusted cyber threat sharing across specific critical infrastructure sectors.
Healthcare ISACs (H-ISAC) enable member organizations to exchange real-time threat indicators, remediation strategies, and emerging vector data.

Key Concept

Information Sharing and Analysis Centers (ISACs)
Question 883Question →

An organization is modernizing its deployment architecture by hosting multiple containerized microservices on a shared host operating system. During a technical audit, a security analyst discovers that microservices run with standard system privileges, exposing the host operating system kernel to potential privilege escalation via unauthorized system calls if a container is compromised. Which of the following controls should the security team implement on the container host to restrict the specific system calls available to container processes?

Show answer & explanation

Answer: Apply custom Secure Computing Mode (seccomp) profiles to filter syscall access for container processes.

Answer

Apply custom Secure Computing Mode (seccomp) profiles to filter syscall access for container processes.
Applying Secure Computing Mode (seccomp) profiles allows administrators to define explicit whitelist filters for system calls (syscalls). Since containers share the underlying host kernel, restricting unneeded syscalls effectively mitigates kernel privilege escalation and container escape attacks.

Step-by-Step Solution

1
Analyze the container risk environment
Containers execute directly on the host host operating system and share the host Linux kernel.
Because kernel code is shared across all containers running on the host, a kernel vulnerability or unrestrained system call execution could allow container escape.
2
Evaluate system call restriction mechanisms
Seccomp acts as a kernel-level system call filter that limits which syscalls a container process can make.
Restricting available syscalls via seccomp profiles prevents containers from calling unnecessary or high-risk kernel routines.

Key Concept

Kernel System Call Filtering (Seccomp) in Container Security
Question 884Question →

A security architect is designing an identity and access management (IAM) infrastructure for an enterprise microservices environment. The organization requires that OAuth 2.0 access tokens issued to client applications are sender-constrained, ensuring that if a token is intercepted in transit, it cannot be replayed by an unauthorized third party to access downstream APIs. Which of the following architectural solutions best satisfies this security requirement?

Show answer & explanation

Answer: Implement Demonstration of Proof-of-Possession (DPoP) to cryptographically bind access tokens to a client-generated key pair.

Answer

Demonstration of Proof-of-Possession (DPoP) cryptographically binds access tokens to a client-generated key pair to prevent token replay attacks.
Demonstration of Proof-of-Possession (DPoP) is an extension to OAuth 2.0 that binds access tokens to a specific cryptographic key pair owned by the client. When making API requests, the client must generate and sign a fresh DPoP proof header using its private key. Because an attacker intercepting the token lacks the corresponding private key, they cannot generate a valid signature, effectively neutralizing token replay attacks.

Step-by-Step Solution

1
Analyze the architectural requirement.
The scenario requires sender-constraining OAuth 2.0 access tokens so that stolen or intercepted tokens cannot be reused by an adversary (preventing bearer token replay).
Standard bearer tokens can be used by any party holding them, making sender-binding essential for Zero Trust API security architectures.
2
Evaluate potential cryptographic token binding mechanisms.
Demonstration of Proof-of-Possession (DPoP) forces the client to present a unique signed DPoP proof header containing a public key matched to the issued token.
This binds the access token explicitly to the client's private key, rendering intercepted tokens useless to an attacker without access to that private key.
3
Differentiate from incorrect IAM standards and perimeter controls.
SCIM manages user account provisioning, SAML POST handles web browser single sign-on, and perimeter WAFs rely on network edge inspection rather than end-to-end client-bound token proofs.
None of these alternatives provide cryptographic sender-constraining of API access tokens.

Key Concept

OAuth 2.0 Token Binding and Sender-Constrained Tokens (DPoP)
Question 885Question →

During a late-night monitoring shift, a security analyst identifies an active outbound socket connection transferring encrypted data from a CI/CD build node to an unrecognized external IP address. Initial investigation confirms that an unauthorized process is exfiltrating proprietary code repositories. According to standard incident response lifecycle frameworks, which of the following actions should the analyst perform FIRST?

Show answer & explanation

Answer: Isolate the CI/CD build node from the network to halt active exfiltration while preserving volatile system memory.

Answer

Isolate the CI/CD build node from the network to halt active exfiltration while preserving volatile system memory.
Isolating the compromised host from the network represents the containment phase of incident response. Once an active threat and exfiltration attempt are identified, containment must occur immediately to prevent further data loss and limit damage while keeping system memory intact for volatile forensic data collection.

Step-by-Step Solution

1
Analyze the incident state and identify the current lifecycle phase.
The incident is actively occurring with ongoing exfiltration confirmed during detection and analysis.
Determining the active phase dictates the next mandatory phase in standard incident response frameworks.
2
Select the immediate next phase according to NIST/ISO incident response standards.
The immediate next phase after confirming an active breach is Containment.
Containment limits the scope of damage and prevents further data exfiltration.
3
Identify the proper containment action among the available options.
Isolating the host from the network stops active data transfer while keeping RAM evidence intact.
Disconnecting or segmenting the device achieves containment without executing premature eradication or recovery steps.

Key Concept

Incident Response Lifecycle Phase Order (Containment)
Estimated Time:1m 30s
Question 886Question →

A security analyst is investigating network security logs following user complaints of sudden, repeated disconnections from the corporate Wi-Fi network. Shortly after being disconnected, several user devices automatically reconnected to an unauthorized access point broadcasting the corporate ESSID. Which TWO of the following wireless network indicators specifically point to an active disassociation and Evil Twin attack sequence?

Select all that apply

Show answer & explanation

Answer: A sudden flood of unencrypted 802.11 management frames containing deauthentication reason codes transmitted with the spoofed MAC address of the legitimate access point; Beacon frames broadcasting the corporate ESSID on a different RF channel using a distinct BSSID with significantly higher signal strength than the authorized access points

Answer

The correct indicators of an active disassociation and Evil Twin attack sequence are a sudden flood of unencrypted 802.11 management frames containing deauthentication reason codes sent from the spoofed MAC address of the legitimate access point, and beacon frames broadcasting the corporate ESSID on a different RF channel with higher signal strength than authorized access points.
In a combined disassociation and Evil Twin attack, the attacker first transmits spoofed 802.11 deauthentication frames using the MAC address of the legitimate access point to break active client connections. Simultaneously or immediately following, the attacker's rogue access point broadcasts 802.11 beacon frames configured with the corporate ESSID (often operating on a different channel with higher transmission power), causing client devices to automatically reconnect to the malicious AP.

Step-by-Step Solution

1
Analyze the reported scenario to identify the specific attack vectors
The scenario describes clients being forcibly disconnected from Wi-Fi and subsequently connecting to a rogue access point mimicking the corporate network.
Forforced disconnections followed by rogue connections characteristic of a wireless Deauthentication attack paired with an Evil Twin deployment.
2
Evaluate wireless frame indicators associated with forced disconnection
Identify that 802.11 deauthentication management frames spoofing the legitimate AP's MAC address cause clients to disconnect.
Standard 802.11 management frames (unless protected by 802.11w) lack authentication, allowing adversaries to forge origin MAC addresses.
3
Evaluate wireless frame indicators associated with rogue access point positioning
Identify that broadcasting beacon frames with the matching ESSID, a different BSSID/channel, and higher RF signal power entices client auto-reconnection.
Wireless clients prioritize access points broadcasting known ESSIDs that offer stronger Received Signal Strength Indicator (RSSI) values.

Key Concept

Wireless Disassociation and Evil Twin Attack Indicators
Question 887Question →

During a threat hunting exercise on an enterprise SCADA network, a SOC analyst identifies an unauthorized background service executing on a primary operational jump server. The rogue process is actively establishing covert encrypted DNS tunnels to external command-and-control (C2) servers to exfiltrate system telemetry. The incident response playbook mandates immediate threat containment while strictly maintaining volatile RAM evidence for subsequent forensics. Which of the following operational steps should the security team perform FIRST to adhere to the containment phase protocols?

Show answer & explanation

Answer: Apply a microsegmentation isolation policy at the managed switch port and firewall to sever outbound network connectivity while keeping the host powered on.

Answer

The operational team should isolate the jump server at the network level by applying microsegmentation firewall and switch port restrictions while preserving host power state for forensic acquisition.
Network-level microsegmentation isolates the compromised host from the network, immediately stopping data exfiltration and external command-and-control channels without interrupting power, thereby preserving volatile system RAM for forensic memory analysis.

Step-by-Step Solution

1
Analyze the incident context and requirements.
Identified an active C2 covert DNS tunnel exfiltrating data on a critical server, with a requirement to contain threat activity without losing volatile RAM evidence.
Containment must balance stopping malicious traffic/exfiltration while upholding the order of volatility for digital forensics.
2
Evaluate containment actions against NIST/ISO incident response lifecycle phases.
Network-level isolation (microsegmentation) blocks outbound C2 traffic while preserving RAM.
Powering off or rebooting destroys volatile memory; reimaging belongs in recovery; alert suppression fails to contain the threat.
3
Select the correct immediate containment step.
Isolating the network connection while maintaining system uptime.
This directly fulfills containment objectives without destroying forensic artifacts.

Key Concept

Containment Strategy & Order of Volatility in Incident Response Playbooks
Question 888Question →

A Security Operations Center (SOC) team is investigating a multi-stage enterprise breach. A SIEM correlation engine collected logs across web application firewalls, endpoint detection agents, and Windows Domain Controllers. Based on log signatures and attack techniques, arrange the following log events in the correct chronological order of the attacker's progression through the cyber kill chain (from initial access to persistence).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order of the intrusion progression is: (1) SQL injection web access log, (2) Obfuscated PowerShell execution from web daemon, (3) LSASS process memory dump via comsvcs.dll, (4) Network Logon Type 3 lateral movement using NTLMv2, and (5) Scheduled Task creation for persistence.
Analyzing log artifacts chronologically requires mapping specific event signatures to the Cyber Kill Chain / MITRE ATT&CK framework: 1. Web exploitation (SQL Injection in web access logs) provides Initial Access. 2. Web daemon spawning encoded PowerShell (EDR log) represents Execution. 3. Dumping LSASS memory via comsvcs.dll (Event 4688) represents Credential Access. 4. Using stolen credentials to log into an internal system via network authentication (Event 4624 Type 3) represents Lateral Movement. 5. Creating a scheduled task (Event 4698) on the internal target host represents Persistence.

Step-by-Step Solution

1
Identify Initial Access / Exploitation phase
Recognize the web server log showing a HTTP POST request containing 'UNION SELECT SQL injection payload as the initial attack vector.
Attacks begin with initial perimeter exposure or application exploitation before internal execution can occur.
2
Identify Execution / Payload delivery phase
Locate EDR process creation log showing the web process (www-data) spawning cmd.exe and encoded PowerShell.
Exploitation of web vulnerabilities is immediately followed by shell command execution to establish operational control.
3
Identify Credential Access / Privilege Escalation phase
Identify Windows Event 4688 executing rundll32.exe comsvcs.dll MiniDump to dump LSASS memory.
Once on a host, attackers dump memory to extract cleartext credentials or hashes required for lateral movement.
4
Identify Lateral Movement phase
Correlate Windows Event 4624 (Logon Type 3) originating from the compromised web server (10.0.4.15) using DomainAdmin credentials.
Harvested credentials enable network authentication to access other internal enterprise systems.
5
Identify Persistence phase
Identify Windows Event 4698 indicating a scheduled task creation running an encoded PowerShell script.
After establishing access on internal high-value targets, persistent mechanisms (scheduled tasks, registry run keys) ensure continuous access.

Key Concept

Multi-Source Log Correlation and Attack Lifecycle Reconstruction
Question 889Question →

A cloud security architect is designing a resilient infrastructure for a critical financial transaction service deployed across two geographically distant cloud regions. To satisfy business requirements, the architecture must achieve a Recovery Point Objective (RPO) of zero (zero data loss) and a Recovery Time Objective (RTO) of near-zero in the event of an entire regional failure. Which TWO of the following architectural mechanisms must be deployed together to meet these strict availability and resilience targets?

Select all that apply

Show answer & explanation

Answer: Active-active multi-region application deployment utilizing synchronous database replication across regions; Global Server Load Balancing (GSLB) configured with real-time health monitoring and dynamic latency/failover routing

Answer

The correct architecture requires combining an active-active multi-region deployment utilizing synchronous database replication with Global Server Load Balancing (GSLB) featuring real-time health monitoring.
Achieving RPO = 0 (zero data loss) requires synchronous replication so that every write operation is committed in real time across geographically distributed database nodes. Achieving RTO = near-zero requires an active-active deployment supported by Global Server Load Balancing (GSLB), which continuously probes service health and instantly reroutes ingress traffic away from an impaired region to the surviving active region.

Step-by-Step Solution

1
Analyze RPO requirements for zero data loss
Identified that synchronous replication across active nodes is mandatory so that transactions are committed to both sites simultaneously prior to transaction confirmation.
Asynchronous replication or periodic snapshots allow data gaps between write intervals, failing the RPO = 0 mandate.
2
Analyze RTO requirements for near-zero downtime
Identified that active-active processing coupled with automated dynamic traffic distribution (GSLB) is necessary.
Both regions must actively process traffic or stand ready with live synchronized state so traffic rerouting occurs seamlessly without provisioning delays.
3
Evaluate and eliminate non-compliant disaster recovery approaches
Rejected point-in-time snapshots (causes data loss) and cold standby provisioning (causes service downtime).
Disaster recovery backups and cold sites are recovery controls, not continuous high-availability or zero-loss fault-tolerant controls.

Key Concept

High Availability, Synchronous Replication, and Global Load Balancing
Question 890Question →

A maritime shipping container logistics terminal is modernizing its operational technology (OT) network and port management systems. The security architecture team is adopting Zero Trust Architecture (ZTA) principles to prevent unauthorized access between automated gantry crane control systems, IoT tracking sensors, and cloud management consoles. Which of the following architectural requirements represent core tenets of Zero Trust Architecture that must be implemented in this design? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Treat all network traffic as inherently untrusted regardless of whether the source originates from inside or outside the physical enterprise perimeter.; Dynamically evaluate and continuously verify trust factors and security posture throughout the entirety of an active session.

Answer

The core tenets of Zero Trust Architecture include assuming no implicit trust based on network location (treating all traffic as untrusted regardless of origin) and continuously re-evaluating trust and posture dynamically throughout active sessions.
Zero Trust Architecture relies on the tenets of 'never trust, always verify' and 'assume breach'. Traffic originating from internal subnets must be treated with the same scrutiny as external traffic. Furthermore, access decisions are dynamic and subjected to continuous verification during active sessions rather than relying on a single login event.

Step-by-Step Solution

1
Analyze core principles of Zero Trust Architecture (NIST SP 800-207)
Identified that Zero Trust mandates explicit verification, assumed breach, least privilege access, and continuous monitoring regardless of network location.
Traditional perimeter-based security models fail when internal networks are assumed to be safe.
2
Evaluate the requirement for perimeter-independent trust management
Selecting the requirement to treat all traffic as untrusted regardless of origin aligns directly with the 'assume breach' and 'explicit verification' tenets.
Location within an enterprise network does not guarantee security or non-malicious behavior.
3
Evaluate continuous authentication vs. static initial checks
Selecting continuous dynamic posture evaluation ensures sessions are reassessed continuously as contextual risk attributes change.
Initial authentication checks cannot detect mid-session compromises or device posture degradation.

Key Concept

Zero Trust Architecture Principles
Question 891Question →

A security analyst is examining raw log snippets collected by a SIEM system from various network resources. Match each log entry pattern on the left to the corresponding security event or attack type on the right.

Click a left item, then click its matching right item

Items

192.168.1.105 - - [27/Jul/2026:14:22:10 +0000] "GET /login.php?user=admin' OR '1'='1" 200 452
Jul 27 14:23:01 authserver sshd[4921]: Failed password for root from 10.0.0.45 port 52112 ssh2 (repeated 500 times in 1 minute)
192.168.1.50 - - [27/Jul/2026:14:25:30 +0000] "GET /profile.php?name=<script>alert('cookie')</script>" 200 1200
Jul 27 14:26:05 firewall filterlog: drop in on em0 proto TCP from 192.168.1.200 to 10.0.0.15 across destination ports 1 through 1024

Matches

Show answer & explanation

Answer

The HTTP GET request with SQL syntax matches SQL Injection; the repeated SSH authentication failures match SSH Brute Force; the script tag payload matches Cross-Site Scripting; and the sequential port connections match Port Scan / Reconnaissance.
Each log snippet exhibits explicit operational indicators: SQL control characters indicate SQL Injection, high-frequency authentication failures indicate SSH Brute Force, client-side script tags indicate XSS, and sequential port sweep drops indicate a network Port Scan.

Step-by-Step Solution

1
Analyze web server request parameters in the first log entry
Identified the payload ' OR '1'='1 which manipulates database query logic.
This is a classic signature of SQL Injection.
2
Evaluate authentication log rates in the second entry
Identified 500 failed root login attempts via SSH within 60 seconds.
Rapid repetitive authentication failures indicate password brute forcing.
3
Inspect input strings in the third log entry
Found inline client-side code execution tags (<script>).
Injecting client-side script elements into URL parameters is indicative of XSS.
4
Review firewall drop event patterns in the fourth entry
Observed connections dropped across a broad range of consecutive ports (1-1024).
Probing multiple sequential ports identifies host service reconnaissance.

Key Concept

Log Pattern Analysis and Threat Identification
Estimated Time:1m 0s
Question 892Question →

A security operations center (SOC) analyst confirms an active Golden Ticket attack originating from a compromised Active Directory Domain Controller within an enterprise network. Arrange the following incident response procedures in the correct chronological order according to standard NIST incident response lifecycle guidelines, starting with the earliest step.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order follows the standard NIST SP 800-61 r2 Incident Response Lifecycle: Containment (network isolation and session revocation) → Eradication (double krbtgt password reset and malware removal) → Recovery (backup restoration, service re-engagement, and monitoring) → Post-Incident Activity (after-action review and playbook updates).
According to standard NIST incident response guidelines (SP 800-61 r2), containment must always precede eradication to restrict adversary movement. Once isolated, eradication eliminates the root cause and attacker access methods (such as invalidating Kerberos TGTs via a double krbtgt reset). Recovery follows to safely restore verified services into production under heightened monitoring, and post-incident activities take place last to document lessons learned and refine security controls.

Step-by-Step Solution

1
Identify the initial Containment action.
Network isolation of the Domain Controller and revocation of administrative sessions prevents the attacker from propagating across the enterprise.
Containment must occur first upon confirming an intrusion to limit the scope of compromise.
2
Identify the Eradication action.
Resetting the krbtgt account password twice invalidates all existing Ticket Granting Tickets (including forged Golden Tickets), and removing backdoors eliminates root access vectors.
Eradication neutralizes the threat completely so that systems can be safely brought back online.
3
Identify the Recovery action.
Restoring directory services from clean backups, resuming domain authentication, and closely monitoring ticket traffic confirms operational integrity.
Recovery restores impacted infrastructure to normal operational status in a controlled, monitored environment.
4
Identify the Post-Incident Activity action.
Performing an after-action debriefing, updating incident playbooks, and implementing stronger access controls enhances enterprise resilience.
Lessons learned activities document the incident response performance and refine operational defenses against future attacks.

Key Concept

NIST Incident Response Lifecycle (Containment, Eradication, Recovery, Post-Incident Activity)
Question 893Question →

A pharmaceutical research organization is updating its storage architecture to host confidential genomic sequencing datasets. The security architect must satisfy two primary requirements: guarantee bulk data encryption at rest on storage area network (SAN) arrays without degrading host processing performance, and prevent research data from being copied to unauthorized physical media or unapproved endpoints. Which of the following technical security solutions should the architect select to meet these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Deploy Self-Encrypting Drives (SEDs) utilizing hardware-based cryptographic controllers on the SAN storage arrays; Deploy an enterprise Data Loss Prevention (DLP) solution configured with endpoint and storage monitoring policies

Answer

The architect should deploy Self-Encrypting Drives (SEDs) on the SAN storage arrays and implement an enterprise Data Loss Prevention (DLP) solution with endpoint monitoring policies.
Deploying Self-Encrypting Drives (SEDs) satisfies the requirement for transparent, hardware-accelerated bulk data encryption without imposing software encryption overhead on host CPUs. Implementing Data Loss Prevention (DLP) directly controls data movements on endpoints, enforcing rules to inspect content and block unauthorized file transfers to removable media.

Step-by-Step Solution

1
Evaluate the requirement for high-performance bulk data encryption at rest.
Determine that hardware-based encryption using Self-Encrypting Drives offloads crypto operations from the CPU, maintaining storage performance.
Software bulk encryption adds heavy computational overhead on host processors.
2
Evaluate the requirement to prevent unauthorized copying of sensitive datasets to removable drives or unapproved endpoints.
Determine that an enterprise Data Loss Prevention (DLP) agent on endpoints can monitor and block unauthorized egress and USB copying.
DLP specifically monitors data in use and data on endpoints to enforce compliance rules against data exfiltration.

Key Concept

Data Protection and Storage Security Architecture
Question 894Question →

A system administrator reviews the following web server access log entries associated with an internal audit endpoint:

192.168.1.45 - - [27/Jul/2026:14:22:01 +0000] "POST /api/v1/query HTTP/1.1" 200 4520 "id=101+UNION+SELECT+username,password_hash+FROM+users--" "Mozilla/5.0"
192.168.1.45 - - [27/Jul/2026:14:22:05 +0000] "POST /api/v1/query HTTP/1.1" 200 5120 "id=101' OR '1'='1" "Mozilla/5.0"

Which type of attack vector do these log entries demonstrate, and what is the most effective application-level mitigation?

Show answer & explanation

Answer: SQL injection (SQLi); mitigate by implementing parameterized queries and prepared statements.

Answer

SQL injection (SQLi); mitigate by implementing parameterized queries and prepared statements.
The log entries clearly display classic SQL injection patterns (`UNION SELECT` attempting data exfiltration from `users` and `' OR '1'='1` attempting boolean bypass). Parameterized queries (prepared statements) enforce strong type separation between code and data at the application layer, neutralizing SQL injection vulnerabilities.

Step-by-Step Solution

1
Analyze the request payload parameters in the HTTP POST log entries.
Identified SQL command keywords (`UNION SELECT`, `FROM users`, `' OR '1'='1`) embedded in the `id` parameter.
Log analysis requires inspecting user-supplied input strings to recognize attack signature patterns.
2
Determine the targeted system component and vulnerability class.
The payload targets the backend database interpreter via untrusted input concatenated into SQL statements (SQL Injection).
Distinguishing database command syntax from client-side script syntax clarifies the specific flaw.
3
Identify the primary preventive developer mitigation for SQL Injection.
Use parameterized queries (prepared statements) to separate data inputs from database code execution.
Pre-compiling SQL queries ensures user inputs are never parsed as executable SQL commands.

Key Concept

Identifying SQL Injection signatures in HTTP logs and applying parameterized query mitigations
Question 895Question →

An organization is updating its cybersecurity incident response plan according to the standard NIST SP 800-61 framework. In what sequential order should the core phases of the incident response lifecycle be performed from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order of the NIST incident response lifecycle phases is Preparation, followed by Detection and Analysis, then Containment, Eradication, and Recovery, and finally Post-Incident Activity.
According to NIST SP 800-61, the standard incident response process follows four sequential phases: Preparation (setting up response tools, policies, and training), Detection and Analysis (identifying security events and determining their scope), Containment, Eradication, and Recovery (limiting impact, purging threat actors or artifacts, and restoring systems), and Post-Incident Activity (conducting lessons-learned analysis to improve future readiness).

Step-by-Step Solution

1
Identify the foundational phase established prior to security incidents.
Preparation is the initial phase.
An incident response team must prepare infrastructure, tools, and playbooks before attacks occur.
2
Identify the phase triggered by suspicious activity or system alerts.
Detection and Analysis follows Preparation.
Security operations teams must detect anomalies, validate security events, and analyze threat vectors.
3
Identify the phase dedicated to stopping the threat and restoring operational baselines.
Containment, Eradication, and Recovery follows Detection and Analysis.
Once an incident is confirmed and analyzed, responders must limit its spread, clean infected hosts, and bring systems back online securely.
4
Identify the concluding evaluation phase after threat resolution.
Post-Incident Activity is the final phase.
After the incident is mitigated and operations are restored, the team holds lessons-learned meetings to update playbooks and improve future response.

Key Concept

NIST Incident Response Lifecycle Phases
Question 896Question →

A Security Operations Center (SOC) analyst is standardizing correlation rules in an enterprise Security Information and Event Management (SIEM) system. Match each log entry pattern on the left to its corresponding security event or attack vector on the right.

Click a left item, then click its matching right item

Items

CEF:0|Security|SIEM|1.0|4625|Account Logon Failed|5|src=192.168.1.50 dst=10.0.0.5 suser=admin targetUser=admin count=450
192.168.1.88 - - [27/Jul/2026:11:04:15 +0000] "GET /search.php?q=1%27%20UNION%20SELECT%20null,table_name%20FROM%20information_schema.tables-- HTTP/1.1" 200 5120
{"eventTime":"2026-07-27T10:15:30Z","eventSource":"iam.amazonaws.com","eventName":"PutUserPolicy","errorCode":"AccessDenied","user":"app_user"}
type=SYSCALL arch=c000003e syscall=59 success=yes exe="/bin/bash" euid=0 egid=0 auid=1002 key="root_shell"

Matches

Show answer & explanation

Answer

Matching pairs: The Common Event Format (CEF) failed logon log corresponds to the Automated brute-force authentication event; the web access log containing UNION SELECT corresponds to the In-band SQL injection attack; the AWS CloudTrail log with AccessDenied corresponds to the Cloud IAM authorization policy failure; and the Linux auditd syscall log spawning root bash corresponds to the Local privilege escalation execution.
Each log archetype displays distinct header and payload indicators: Windows CEF Event ID 4625 with high event counts reflects brute-force authentication activity; UNION SELECT web requests signify SQL injection attempts; CloudTrail AccessDenied events on policy operations reflect authorization rule enforcement; and Linux syscall 59 launching bash with euid=0 from unprivileged auid=1002 demonstrates local privilege escalation.

Step-by-Step Solution

1
Analyze Windows Event ID 4625 and CEF aggregate fields in the first log entry.
Identify Event ID 4625 as a failed logon attempt and count=450 as rapid repeated failures indicative of automated credential brute-forcing.
High-frequency failed logon events targeting authentication endpoints reflect brute-force authentication attempts.
2
Inspect URI query parameters in the second log entry.
Recognize URL-encoded SQL keywords ('UNION SELECT', 'information_schema.tables') used to query database structures.
Injecting database commands into web input parameters is the core indicator of in-band SQL injection.
3
Examine AWS CloudTrail JSON fields in the third log entry.
Evaluate 'eventName: PutUserPolicy' paired with 'errorCode: AccessDenied' as an unauthorized permission modification attempt.
'AccessDenied' during an API authorization check demonstrates role permission enforcement stopping unauthorized policy attachments.
4
Analyze Linux auditd syscall log fields in the fourth log entry.
Correlate syscall 59 (execve) spawning binary '/bin/bash' with effective UID 0 (root) from unprivileged audit identity AUID 1002.
Transitioning execution context from an unprivileged user (auid=1002) to effective root privileges (euid=0) represents local privilege escalation.

Key Concept

Log Analysis and SIEM Correlation
Estimated Time:2m 0s
Question 897Question →

Match each Identity and Access Management (IAM) protocol to its primary architectural function in enterprise security environments.

Click a left item, then click its matching right item

Items

OAuth 2.0
OpenID Connect (OIDC)
SAML 2.0
RADIUS

Matches

Show answer & explanation

Answer

OAuth 2.0 pairs with delegated API authorization; OIDC pairs with identity authentication using JWTs over OAuth 2.0; SAML 2.0 pairs with XML-based web browser federation and SSO; RADIUS pairs with centralized AAA network access management.
Each IAM protocol serves a distinct architectural purpose: OAuth 2.0 provides delegated API authorization, OIDC adds RESTful authentication using JWTs on top of OAuth 2.0, SAML 2.0 facilitates XML-based enterprise web SSO federation, and RADIUS delivers centralized AAA for network infrastructure connection request management.

Step-by-Step Solution

1
Identify the primary role of OAuth 2.0.
Recognize that OAuth 2.0 handles authorization and token delegation for APIs rather than user authentication.
OAuth 2.0 is an authorization framework, not an authentication protocol.
2
Identify the primary role of OpenID Connect (OIDC).
Associate OIDC with RESTful/JSON-based user authentication overlaying OAuth 2.0.
OIDC adds an identity layer (ID token in JWT format) to OAuth 2.0.
3
Identify the primary role of SAML 2.0.
Match SAML 2.0 to XML-based web SSO federation between identity providers and service providers.
SAML uses XML assertions for cross-domain browser single sign-on.
4
Identify the primary role of RADIUS.
Link RADIUS to legacy network access authentication (AAA) for VPNs and wireless networks.
RADIUS is a dedicated network access AAA protocol.

Key Concept

IAM Protocol Selection and Architectural Scoping
Question 898Question →

A pharmaceutical enterprise has implemented a Zero Trust Architecture (ZTA) to secure access to proprietary clinical research data. During an active database session initiated via multi-factor authentication, the remote endpoint's client security agent reports that host firewall services were unexpectedly disabled. Which of the following actions best reflects the core tenets of Zero Trust in this scenario?

Show answer & explanation

Answer: The Policy Decision Point (PDP) re-evaluates the asset's dynamic trust score using telemetry and signals the Policy Enforcement Point (PEP) to alter or terminate session permissions.

Answer

The Policy Decision Point (PDP) re-evaluates the asset's dynamic trust score using telemetry and signals the Policy Enforcement Point (PEP) to alter or terminate session permissions.
In Zero Trust Architecture, access decisions are dynamic and subject to continuous verification. When endpoint compliance degrades mid-session, host telemetry alerts the Policy Decision Point (PDP) to re-evaluate the risk score and instruct the Policy Enforcement Point (PEP) to modify or terminate the active session.

Step-by-Step Solution

1
Analyze the security telemetry change reported during the session.
Disabling the host firewall degrades the device security posture and increases risk.
Zero Trust mandates continuous monitoring of endpoint health and compliance throughout active sessions.
2
Determine how the Zero Trust control plane processes posture changes.
The Policy Decision Point (PDP) recalculates the dynamic trust score based on incoming telemetry.
The PDP is responsible for making logical access decisions based on real-time contextual data.
3
Identify how the policy decision is operationalized at the network and application layer.
The Policy Enforcement Point (PEP) receives the updated instruction from the PDP and restricts or drops the connection.
The PEP executes session control functions based on direction from the PDP.

Key Concept

Continuous Verification and PDP/PEP Dynamic Authorization
Estimated Time:1m 30s
Question 899Question →

A security engineering team is automating its enterprise threat intelligence workflow to improve SIEM alert enrichment. The solution requires a standardized data format for expressing structured cyber threat information alongside an automated protocol for machine-to-machine transport over HTTPS. Which of the following standards should the team implement to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: STIX (Structured Threat Information eXpression); TAXII (Trusted Automated eXchange of Intelligence Information)

Answer

The team should implement STIX for standardized threat data representation and TAXII for automated machine-to-machine transport.
The combination of STIX and TAXII enables end-to-end automation of threat intelligence pipelines. STIX provides the structured language (JSON-based schema) to represent threat concepts, while TAXII defines the web services and protocols to transmit that structured data reliably between systems.

Step-by-Step Solution

1
Identify the data format requirement
STIX (Structured Threat Information eXpression) is selected as the standardized language to represent cyber threat data objects.
STIX defines standardized structures for threat indicators, tactics, techniques, and procedures (TTPs).
2
Identify the automated transport protocol requirement
TAXII (Trusted Automated eXchange of Intelligence Information) is selected to transmit STIX-formatted intelligence over HTTPS.
TAXII is designed specifically to support secure machine-to-machine exchange of STIX content without human intervention.

Key Concept

STIX/TAXII Threat Intelligence Standards
Estimated Time:1m 30s
Question 900Question →

A security architect for an enterprise organization is designing network isolation controls across various operational environments. Match each security design requirement on the left to the network segmentation mechanism on the right that best satisfies it.

Click a left item, then click its matching right item

Items

Isolating legacy industrial control hardware that requires complete protection from remote network vectors and has no requirement for network communication.
Restricting East-West network traffic between individual containerized microservices hosted within the same virtualized cluster.
Providing a hardened, audited entry point for administrators to establish remote management sessions into internal infrastructure.
Placing public-facing application servers in a perimeter zone to prevent direct network traversal to internal corporate databases.

Matches

Show answer & explanation

Answer

Legacy hardware isolation matches Air gap; Container microservices restriction matches Microsegmentation; Administrative entry point matches Jump box / Bastion host; Public-facing server perimeter matches Demilitarized Zone (DMZ).
Each requirement directly aligns with standard network segmentation mechanisms: Air gap provides total network detachment for highly sensitive/legacy hardware; Microsegmentation provides granular control over East-West traffic between container workloads; Jump boxes act as secure gateways for admin sessions; DMZs buffer public-facing web servers from private internal database zones.

Step-by-Step Solution

1
Analyze the security requirement for complete isolation without external network connectivity.
Identify that an Air gap removes all physical or logical network connections, which is required for vulnerable or isolated legacy hardware.
Air gapping eliminates remote network attack vectors entirely.
2
Evaluate intra-cluster granular isolation needs between virtualized workloads.
Identify Microsegmentation as the control that governs lateral (East-West) traffic between virtual machines or containerized services.
Traditional perimeter firewalls cannot inspect or block traffic between adjacent workloads inside the same host cluster.
3
Determine the control required for secure admin access into sensitive internal segments.
Match Jump box / Bastion host as the hardened proxy system through which administrative traffic is funneled and monitored.
Jump hosts prevent direct remote access connections from reaching internal production environments.
4
Determine the control for isolating public services from internal databases.
Match Demilitarized Zone (DMZ) as the perimeter architecture isolating public web servers from internal data stores.
A DMZ restricts ingress to untrusted internet traffic while enforcing strict inspection on traffic attempting to reach internal zones.

Key Concept

Network Segmentation Mechanisms and Architecture
PreviousPage 45 / 112Next
All practice questions — CompTIA Security+ | Examkin