Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 941Question →

Match each threat intelligence source classification on the left with its primary enterprise operational use case on the right.

Click a left item, then click its matching right item

Items

Open-Source Intelligence (OSINT)
Information Sharing and Analysis Center (ISAC)
Proprietary Threat Intelligence Feed
National Vulnerability Database (NVD)

Matches

Show answer & explanation

Answer

Open-Source Intelligence (OSINT) matches with gathering freely available security research from public sources; Information Sharing and Analysis Center (ISAC) matches with sharing sector-specific, confidential threat warnings with industry peers; Proprietary Threat Intelligence Feed matches with ingesting paid, commercial indicator streams from specialized vendors; National Vulnerability Database (NVD) matches with correlating software inventory against standardized CVE identifiers and CVSS risk scores.
Open-Source Intelligence (OSINT) involves analyzing publicly accessible security data without cost. Information Sharing and Analysis Centers (ISACs) provide trusted peer-to-peer threat sharing specifically tailored to industry sectors like finance or healthcare. Proprietary threat feeds offer commercially licensed, high-fidelity threat indicators for specialized SOC ingestion. The National Vulnerability Database (NVD) acts as the primary repository for standardized CVE records and CVSS scoring to drive vulnerability management.

Step-by-Step Solution

1
Analyze the access model and distribution method of each threat intelligence source.
OSINT is publicly accessible; ISAC is peer-shared within an industry sector; Proprietary feeds are commercial/paid; NVD is a public standardized database.
Differentiating sources by cost, access controls, and target usage enables correct alignment with operational workflows.
2
Match each intelligence source to its intended security outcome.
Public research maps to OSINT; sector peer sharing maps to ISAC; paid vendor feeds map to Proprietary Intelligence; vulnerability scoring maps to NVD.
Security operations rely on specific intelligence types for different tasks such as patch management, alert enrichment, or peer warning.

Key Concept

Categorization and Application of Threat Intelligence Sources
Question 942Question →

A cybersecurity responder is acquiring digital evidence from a running Linux enterprise server suspected of executing an in-memory malware payload. Adhering strictly to the Order of Volatility (RFC 3227), in what order should the responder capture the following evidence components from most volatile to least volatile?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from most volatile to least volatile is: Processor cache memory and CPU registers, followed by System RAM and active kernel process tables, Swap space and temporary file systems (/tmp), Local solid-state drive (SSD) persistent storage, and finally Archived remote log repositories and cloud backups.
According to RFC 3227 evidence collection guidelines, forensic data must be gathered starting from the shortest lifespan to the longest lifespan to prevent evidence destruction. CPU registers and cache fluctuate constantly and are lost first. Main memory (RAM) contains volatile active state data. Swap space and temporary directories exist on storage controllers but undergo constant churn. Local persistent drives preserve non-volatile disk blocks across power events. Remote log repositories and backups are offsite and immutable, sitting at the bottom of the volatility hierarchy.

Step-by-Step Solution

1
Identify the highest volatility layer in system hardware.
Processor cache memory and CPU registers are placed first.
Registers and CPU cache operate at system clock speed and lose contents immediately upon state changes or interruption.
2
Identify active dynamic system memory components.
System RAM and kernel process tables are placed second.
System RAM holds transient runtime structures, active network connections, and decrypted payloads that disappear when power is removed.
3
Identify transient disk storage structures.
Swap space and temporary file systems are placed third.
Paging files and temporary directories are stored on disk but are heavily modified during normal system activity.
4
Identify persistent local storage media.
Local solid-state drive (SSD) persistent storage is placed fourth.
Local disk storage maintains data without active electrical power and persists across system reboots.
5
Identify offsite and immutable archival sources.
Archived remote log repositories and cloud backups are placed fifth.
Centralized logs and remote backups are insulated from local system changes and represent stable long-term evidence.

Key Concept

Order of Volatility in Digital Forensics
Question 943Question →

During an insider threat investigation, a security analyst physically disconnects a target workstation's secondary storage drive to perform forensic acquisition. Before connecting the drive to the analysis workstation to capture a bit-stream image, which of the following steps should the analyst take to prevent accidental modification of metadata or timestamps?

Show answer & explanation

Answer: Attach the target drive to a hardware write-blocker prior to connecting it to the forensic workstation.

Answer

Attaching the target drive to a hardware write-blocker prior to connecting it to the forensic workstation is the essential first step to preserve evidence integrity.
Connecting the storage device through a dedicated hardware write-blocker ensures that all write requests issued by the forensic station's operating system are physically intercepted and blocked. This prevents any alteration of access times, file metadata, or sector data, maintaining the cryptographic integrity of the original media.

Step-by-Step Solution

1
Identify the risk of connecting raw storage media to an analysis workstation.
Recognize that standard operating systems automatically modify disk volume metadata, journal logs, and access timestamps upon mounting.
Host OS automatic background writes taint digital evidence unless explicitly blocked.
2
Select the appropriate forensic control to block hardware write operations.
Utilize a hardware write-blocker between the suspect storage drive and the forensic analysis station.
Hardware write-blockers intercept read-write signaling at the controller interface, guaranteeing read-only access regardless of host OS behavior.
3
Proceed with forensic acquisition and verification.
Generate bit-stream disk images and compute verification hash values safely without altering original evidence.
Ensures forensic admissibility in legal and regulatory proceedings.

Key Concept

Forensic Write-Blocking and Evidence Preservation
Question 944Question →

A security analyst monitoring a Security Information and Event Management (SIEM) dashboard receives an alert showing an internal web application server actively executing unauthorized PowerShell scripts launched via a web shell. The web shell was uploaded through a newly exploited file upload vulnerability. According to standard incident response playbooks, which of the following should be the analyst's immediate next action?

Show answer & explanation

Answer: Disconnect the affected web server from the network segment while maintaining host power.

Answer

Disconnect the affected web server from the network segment while maintaining host power.
In accordance with standard NIST/ISO incident response frameworks, once an active compromise is confirmed, the immediate priority is containment. Isolating the server from the network stops active command-and-control channels and lateral movement while keeping the system powered on to preserve volatile RAM evidence for forensic capture.

Step-by-Step Solution

1
Identify the current incident response phase based on the scenario.
An active compromise (web shell executing unauthorized commands) is verified, requiring immediate containment.
Containment limits the scope of damage and prevents the attacker from escalating privileges or moving laterally.
2
Select the appropriate containment technique that preserves forensic evidence.
Network isolation detaches the host from the corporate network without powering off the machine.
Maintaining system power ensures volatile data stored in RAM remains available for digital forensics.

Key Concept

Incident Response Lifecycle - Containment Phase
Question 945Question →

An enterprise security architect is reviewing infrastructure resilience mechanisms to ensure continuous availability and disaster recovery readiness. Match each high-availability control on the left with the operational failover behavior or risk mitigation on the right.

Click a left item, then click its matching right item

Items

Active-Active Clustering
Dual-PDU Redundant Power Wiring
Geographically Dispersed Warm Site
Heartbeat-monitored Active-Passive Failover

Matches

Show answer & explanation

Answer

Active-Active Clustering matches simultaneous load distribution across online nodes. Dual-PDU Redundant Power Wiring matches protection against upstream circuit breaker power feed failures. Geographically Dispersed Warm Site matches pre-installed infrastructure requiring data restoration. Heartbeat-monitored Active-Passive Failover matches promoting a standby node upon primary signal loss.
Active-Active clustering actively distributes live production traffic across all nodes. Dual-PDU power wiring mitigates power feed line and circuit breaker failures. A warm site maintains hardware readiness but requires periodic or manual data updates. Active-Passive failover relies on heartbeat signaling to promote a standby secondary node when the primary node stops responding.

Step-by-Step Solution

1
Analyze load distribution controls.
Active-Active clustering active state processing matches real-time workload balancing across all active nodes.
Active-Active configurations explicitly process live traffic across all available nodes concurrently.
2
Identify electrical fault tolerance controls.
Dual-PDU redundant wiring matches protection against independent electrical circuit failures.
Connecting redundant power supplies to separate PDUs prevents single utility or circuit breaker failures from downing servers.
3
Evaluate offsite disaster recovery site models.
Warm sites match pre-provisioned hardware infrastructure that requires data restoration before resuming operations.
Warm sites balance cost and recovery speed by maintaining hardware readiness while accepting delayed data sync.
4
Examine stateful failover monitoring.
Heartbeat-monitored active-passive failover matches promoting a standby node when keep-alive signals drop.
Heartbeat protocols continuously verify primary node health and automate secondary node takeover.

Key Concept

Distinguishing architectural controls for system resilience, electrical redundancy, clustering models, and recovery site operational profiles.
Question 946Question →

A security analyst is executing an incident response playbook following the detection of an unauthorized rogue wireless access point connected to an enterprise network switch. According to the NIST Incident Response Framework (NIST SP 800-61 Rev. 2), in what chronological order should the analyst perform the response actions below?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence follows the NIST Incident Response lifecycle: 1) Validate the alert via WIPS logs (Detection & Analysis), 2) Disable the switch port (Containment), 3) Physically remove the rogue access point and configure 802.1X (Eradication & Recovery), and 4) Hold a post-incident review meeting (Post-Incident Activity).
The standard incident response framework dictates four major sequential phases: Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity. The response begins by validating the alert through WIPS log analysis to confirm the threat. Next, the switch port is disabled to contain network traffic and limit potential compromise. Following containment, the physical rogue device is eradicated and port security controls are applied for recovery. Finally, post-incident activities occur to document lessons learned and update operational playbooks.

Step-by-Step Solution

1
Execute Detection and Analysis
The incident is verified as a true positive rogue access point.
Initial analysis confirms the scope and validity of the threat before initiating containment.
2
Execute Containment
Network access for the unauthorized device is terminated at the switch layer.
Immediate containment limits exposure and prevents attacker lateral movement or eavesdropping.
3
Execute Eradication and Recovery
The physical device is removed and port security controls are reinforced.
Eradication removes the unauthorized artifact and recovery ensures the infrastructure returns to a secure baseline.
4
Execute Post-Incident Activity
Incident details are documented and response playbooks are refined.
Lessons learned activities occur post-mitigation to institutionalize improvements for future incidents.

Key Concept

NIST Incident Response Lifecycle (NIST SP 800-61 Rev. 2)
Estimated Time:1m 30s
Question 947Question →

An enterprise security team is defining enterprise hardening requirements for a fleet of Linux-based edge compute gateways deployed at remote industrial facilities. A recent security audit highlighted two critical vulnerabilities: field technicians currently perform local configuration updates using a shared administrative account, and automated firmware updates are downloaded over unencrypted channels without integrity verification. Which TWO of the following mitigation controls should the team implement to directly address these findings?

Select all that apply

Show answer & explanation

Answer: Enforce SSH public key authentication linked to unique identity provider accounts and disable interactive password logins for administrative accounts.; Configure hardware-backed Trusted Platform Module (TPM) chips to cryptographically verify firmware digital signatures prior to installation.

Answer

The team should enforce SSH public key authentication linked to unique identity provider accounts while disabling interactive password logins, and configure hardware-backed Trusted Platform Module (TPM) chips to cryptographically verify firmware digital signatures prior to installation.
The correct controls directly resolve both audit findings. Enforcing individual SSH public keys tied to unique identity accounts eliminates shared credential usage and establishes full accountability. Hardware-backed TPM verification checks the digital signature of firmware binaries before execution, ensuring code authenticity regardless of the transit path.

Step-by-Step Solution

1
Analyze the credential management vulnerability identified in the audit finding.
Shared administrative accounts prevent individual accountability and increase credential exposure risk.
Replacing shared local account passwords with centralized, individual SSH public key authentication enforces least privilege and non-repudiation.
2
Analyze the firmware deployment vulnerability identified in the audit finding.
Unencrypted downloads without validation allow potential tampering or man-in-the-middle software injection.
Cryptographic signature validation anchored in a hardware Trusted Platform Module (TPM) verifies that firmware originates from a trusted vendor and remains unaltered before installation.
3
Evaluate and discard ineffective distractor controls.
Inline NIPS cannot modify or validate binary signatures, and perimeter trust models fail to enforce Zero Trust security.
Technical controls must directly address the specific root vulnerabilities identified in the audit.

Key Concept

Mitigation Strategies and Enterprise Hardening Practices
Question 948Question →

A security analyst is investigating an unalerted data breach involving an e-commerce platform. The SIEM correlated the following log snippets from the Web Application Firewall (WAF) and database server:

[WAF_LOG] 2026-07-27T14:22:10Z | src=198.51.100.45 | uri=/catalog.php?cat_id=5%20UNION%20SELECT%20usr,pwd_hash%20FROM%20admin-- | action=PASS | status=200
[DB_LOG] 2026-07-27T14:22:11Z | user=db_web_app | query="SELECT * FROM items WHERE cat_id=5 UNION SELECT usr,pwd_hash FROM admin--" | status=SUCCESS | rows_returned=4500

Based on these log entries, which of the following best describes the attack vector and the appropriate SIEM correlation enhancement required to detect future attempts?

Show answer & explanation

Answer: A SQL injection attack successfully extracted database credentials; the SIEM correlation rule should be updated to trigger an alert when a WAF HTTP 200 response coincides with an anomalous spike in database rows returned.

Answer

A SQL injection attack successfully extracted database credentials; the SIEM correlation rule should be updated to trigger an alert when a WAF HTTP 200 response coincides with an anomalous spike in database rows returned.
The log entries exhibit a classic SQL injection payload ('UNION SELECT usr,pwd_hash FROM admin--') that passed through the WAF and executed against the underlying database server, returning 4,500 records. Enhancing SIEM correlation rules to link successful web HTTP responses containing SQL manipulation patterns with abnormally high backend database row return counts provides effective detection for successful application-layer exfiltration.

Step-by-Step Solution

1
Analyze the WAF log payload string
The parameter value '/catalog.php?cat_id=5 UNION SELECT usr,pwd_hash FROM admin--' contains SQL syntax intended to append database query commands.
Identifying SQL syntax structure confirms the attack is a SQL Injection (SQLi) attack.
2
Correlate WAF response with Database audit log
The WAF passed the request (action=PASS, status=200), and the database executed it successfully, returning 4,500 rows.
This confirms successful database data extraction despite WAF inspection.
3
Determine SIEM rule modification
Correlating successful HTTP status codes (200 OK) containing SQL input structures with high row count returns from the database backend effectively detects successful SQLi exfiltration.
Traditional single-event rules failed because WAF passed the traffic; multi-source correlation across web and DB logs bridges the detection gap.

Key Concept

Log Correlation across Web Firewall and Database Logs for SQL Injection Detection
Estimated Time:2m 0s
Question 949Question →

During an operational shift, a security analyst receives a high-fidelity alert indicating that an internal database server containing confidential HR records has established an active session with an external command-and-control (C2) server via encrypted DNS over HTTPS (DoH) tunnels. Memory analysis confirms an active process executing malicious commands, but lateral movement to adjacent servers has not yet been observed. According to standard incident response lifecycle guidelines (such as NIST SP 800-61), which action should the analyst perform FIRST?

Show answer & explanation

Answer: Isolate the compromised database server from the network segment to halt C2 communications while preserving system volatility for forensic examination.

Answer

Isolate the compromised database server from the network segment to halt C2 communications while preserving system volatility for forensic examination.
According to standard incident response frameworks (NIST SP 800-61), once an active compromise with command-and-control communication is confirmed during detection/analysis, the immediate next step is Containment. Network isolation of the compromised host stops data exfiltration and lateral movement while preserving volatile memory for digital forensics.

Step-by-Step Solution

1
Identify the current phase of the Incident Response lifecycle.
The incident has been detected and triaged; the active C2 session indicates an ongoing security breach.
Once an active breach is confirmed, containment must immediately take precedence to prevent data exfiltration and lateral movement.
2
Select the action that aligns with the Containment phase of NIST SP 800-61.
Network isolation detaches the system from internal and external networks while maintaining volatile RAM state.
Containment limits the blast radius of the attack prior to initiating eradication or recovery procedures.
3
Evaluate alternative responses to verify correct phase sequencing.
Re-imaging, live process removal, and network-wide logging adjustments represent out-of-order phase actions or ineffective control applications.
Eradication and recovery steps performed prematurely undermine incident containment and evidence preservation.

Key Concept

Incident Response Lifecycle Containment Phase
Question 950Question →

During a routine operational monitoring check, a system administrator confirms that a workstation in the assembly plant was infected with malware after a user inserted an unauthorized flash drive. The incident response team has just validated the active incident. According to standard NIST/ISO incident response frameworks, which action should the responder execute FIRST during the containment phase?

Show answer & explanation

Answer: Disconnect the infected workstation from the network segment to isolate the device.

Answer

Disconnect the infected workstation from the network segment to isolate the device.
In standard incident response playbooks, the immediate priority upon confirming a malware infection is containment. Disconnecting the affected host isolates the endpoint and prevents lateral propagation across adjacent network resources.

Step-by-Step Solution

1
Determine the current phase in the incident response lifecycle.
The incident has just been confirmed, placing the team at the beginning of the Containment phase.
Containment limits the scope of impact before permanent remediation steps are undertaken.
2
Identify the primary containment objective for an infected host.
Network isolation prevents lateral movement and external command-and-control activity.
Stopping malware spread takes precedence over eradication, recovery, or post-incident review.

Key Concept

Incident Response Process and Playbooks
Question 951Question →

During a security assessment of a web application's user search module, an analyst inspects the backend implementation and observes two main security weaknesses:
1. User input from the search query parameter is directly concatenated into a dynamic database command string without prior validation or parameterization.
2. The raw search input is included verbatim in the application's HTML response page to display the search term without sanitization or output encoding.

Which of the following application vulnerabilities are present in this module? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: SQL Injection; Reflected Cross-Site Scripting

Answer

The application suffers from SQL Injection and Reflected Cross-Site Scripting.
SQL Injection occurs because user input is concatenated directly into SQL queries without parameterization, allowing arbitrary command execution on the database. Reflected Cross-Site Scripting occurs because untrusted input is reflected immediately in the HTML output without context-aware encoding, allowing client-side script execution in the victim's browser.

Step-by-Step Solution

1
Analyze the first implementation flaw.
Directly concatenating untrusted user input into database query strings allows attackers to alter query logic, constituting SQL Injection.
Input parameterization or prepared statements are required to separate code execution from user-supplied data.
2
Analyze the second implementation flaw.
Reflecting raw user input back into the browser's rendered HTML response without output encoding enables malicious scripts to execute in the client context, constituting Reflected Cross-Site Scripting.
Context-aware HTML and JavaScript output encoding is required to render user input safely.
3
Evaluate distractors.
Insecure Direct Object Reference involves unauthorized access via object identifiers, and Buffer Overflow involves memory bounds violations; neither flaw matches the scenario description.
Accurate vulnerability identification ensures proper selection of mitigation controls.

Key Concept

Identifying application vulnerabilities from data handling and backend code flaws.
Question 952Question →

An e-commerce platform requires local disk storage resilience for its transaction database host. The requirement states that if a single physical drive experiences a total hardware failure, the database must remain fully operational without service disruption or data loss while the failed hardware is replaced. Which of the following resilience controls best satisfies this requirement?

Show answer & explanation

Answer: A RAID 5 array configured with hot-swappable drives

Answer

A RAID 5 array configured with hot-swappable drives
Configuring a RAID 5 array with hot-swappable drives provides disk-level fault tolerance through distributed parity. If a single drive fails, data remains immediately accessible without system downtime, and hot-swappable hardware allows drive replacement while the system remains fully online.

Step-by-Step Solution

1
Identify the primary operational constraint and failure domain
The requirement specifies real-time local storage fault tolerance to survive a single drive hardware failure without downtime or data loss.
Distinguishing drive failure from electrical power loss or site disasters isolates storage-level high availability as the target domain.
2
Evaluate candidate storage fault-tolerance mechanisms
RAID 5 distributes parity across multiple drives so data can be dynamically reconstructed on-the-fly during a single drive crash.
Hot-swappable drive bays permit physical disk replacement without shutting down the operational host.
3
Differentiate fault tolerance controls from backup and power controls
Daily snapshots and cold sites involve recovery downtime, while dual power supplies resolve power grid failures rather than drive failures.
Selecting RAID 5 with hot-swappable drives uniquely satisfies all scenario requirements.

Key Concept

Disk Fault Tolerance and RAID Storage Resilience
Question 953Question →

Place the core phases of the NIST SP 800-61 Incident Response Lifecycle in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of the NIST Incident Response Lifecycle phases is Preparation, Detection and Analysis, Containment, Eradication, and Recovery, and Post-Incident Activity.
The standard NIST SP 800-61 incident response framework follows a logical four-stage lifecycle. It begins with Preparation to establish capabilities, moves to Detection and Analysis to uncover and assess security events, continues to Containment, Eradication, and Recovery to mitigate and recover from the threat, and concludes with Post-Incident Activity to analyze lessons learned.

Step-by-Step Solution

1
Identify the foundation step required before any attack occurs.
Preparation is established first to equip the team with training and resources.
Without preparation, an organization cannot effectively detect or respond to security threats.
2
Determine the step that follows once operational monitoring begins.
Detection and Analysis comes second to identify security events and validate incidents.
An incident must be detected and analyzed before any mitigation measures can be applied.
3
Identify the active response phase after confirming an incident.
Containment, Eradication, and Recovery takes place third.
Once an incident is identified, responders work to stop threat propagation, eliminate the malware or malicious artifacts, and restore systems.
4
Identify the final phase following system restoration.
Post-Incident Activity concludes the lifecycle.
After operations return to normal, documenting lessons learned ensures continuous improvement of the security posture.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Phases
Question 954Question →

An incident response team discovers that an attacker uploaded a malicious script disguised as an image file to a public web application's uploads directory. The web server process subsequently executed the script, providing the attacker with an interactive remote command shell. Investigation reveals that the file upload folder resides on a standard file system volume where the web daemon user account has both write and execute permissions. Which of the following host hardening practices is the MOST effective mitigation strategy to prevent web shell execution from this directory?

Show answer & explanation

Answer: Mount the upload directory on a dedicated partition configured with noexec flags and restrict script engine execution rights for the web daemon.

Answer

Mounting the upload storage directory with no-execute flags and restricting web service account permissions is the most effective host hardening control.
The correct response highlights the practice of mounting user-writable directories (such as upload folders) with no-execute flags and restricting web service daemon execution rights. This directly mitigates web shell threats by ensuring that even if a file is uploaded, the operating system kernel and web application server will refuse to execute it as code.

Step-by-Step Solution

1
Analyze the attack vector and root cause.
The attacker leveraged arbitrary file upload functionality combined with execution permissions in the web server's upload folder to execute a web shell.
Identifying that the vulnerability stems from host file system permissions points directly to host hardening controls.
2
Evaluate technical host hardening mitigations.
Disabling execution permissions on the upload partition (e.g., using noexec mount options or disabling CGI/script execution in web server configuration) prevents the OS/runtime from running scripts uploaded by users.
User content directories should strictly store static media and never allow script execution.
3
Compare against network and deception controls.
Perimeter network filtering and honeypots do not fix improper file system permissions on the host.
Host-level security controls must enforce principle of least privilege and execution boundary limits directly at the resource layer.

Key Concept

Host Hardening and Directory Execution Restriction
Estimated Time:1m 30s
Question 955Question →

In a Zero Trust Architecture (ZTA) implementation following NIST SP 800-207, distinct logical components handle policy decisions, enforcement, and data boundaries. Match each Zero Trust functional component on the left with its core operational responsibility on the right.

Click a left item, then click its matching right item

Items

Policy Engine (PE)
Policy Administrator (PA)
Policy Enforcement Point (PEP)
Control Plane

Matches

Show answer & explanation

Answer

The Policy Engine maps to evaluating contextual risk and policy to render access decisions; the Policy Administrator maps to signaling enforcement points and issuing session credentials; the Policy Enforcement Point maps to intercepting and gating resource connections; the Control Plane maps to serving as the administrative communication network for management traffic.
NIST SP 800-207 specifies a clear separation of responsibilities within Zero Trust Architecture: the Policy Engine acts as the decision brain, the Policy Administrator serves as the control dispatcher issuing dynamic credentials, the Policy Enforcement Point mediates raw application data flows, and the Control Plane establishes the secure administrative network connecting PDP and PEP entities.

Step-by-Step Solution

1
Identify the primary role of the Policy Engine within the Policy Decision Point (PDP).
The Policy Engine serves as the decision maker, utilizing enterprise rules and dynamic trust scores to decide if access should be granted.
Zero Trust separates the decision logic from the execution and enforcement layers.
2
Identify the operational execution role of the Policy Administrator.
The Policy Administrator translates the Policy Engine's approval into actionable commands, issuing control signals and temporary credentials.
The Policy Administrator acts as the execution controller that communicates with the enforcement points.
3
Determine where the Policy Enforcement Point (PEP) operates.
The PEP operates on the data plane, physically or logically gating subject-to-resource connection requests.
PEPs act as gatekeepers that enforce decisions passed down from the PDP.
4
Distinguish the Control Plane from the Data Plane.
The Control Plane isolates administrative signaling and component-to-component management communication from user data traffic.
Decoupling control signals from payload traffic prevents unauthorized access to management interfaces.

Key Concept

Zero Trust Architecture Logical Components (PDP, PEP, Control Plane)
Estimated Time:1m 30s
Question 956Question →

A Security Operations Center (SOC) team is organizing its Security Information and Event Management (SIEM) data pipeline. Match each SIEM data processing phase on the left with its primary operational function on the right.

Click a left item, then click its matching right item

Items

Parsing
Normalization
Aggregation
Correlation

Matches

Show answer & explanation

Answer

Parsing corresponds to extracting structured key-value pairs from raw log strings. Normalization corresponds to mapping disparate log field names to a common standard schema. Aggregation corresponds to consolidating duplicate log events. Correlation corresponds to analyzing relationships among events across diverse log sources over time.
Each SIEM processing phase has a distinct function: Parsing extracts key-value pairs from raw log text; Normalization maps extracted fields to a common taxonomy; Aggregation deduplicates log events to save storage; and Correlation analyzes logic across multiple sources to identify complex security incidents.

Step-by-Step Solution

1
Identify the primary purpose of log parsing.
Parsing interprets raw log syntax to extract discrete data fields.
Raw logs arrive as unstructured text and must be broken into usable fields.
2
Identify the primary purpose of log normalization.
Normalization aligns field names across different vendors into a unified schema.
Different devices name fields differently (e.g., src_ip vs client_ip).
3
Identify the primary purpose of log aggregation.
Aggregation combines repeating identical log entries into summary records.
High-volume logging can quickly deplete storage if duplicates are not consolidated.
4
Identify the primary purpose of event correlation.
Correlation evaluates multi-source log rules over time windows.
Detecting complex attacks requires evaluating sequences of events across multiple hosts.

Key Concept

SIEM Log Ingestion and Processing Pipeline
Question 957Question →

An online education platform stores terabytes of static video assets on a high-throughput network-attached storage (NAS) array. To comply with data privacy standards, the organization must protect the stored media files against physical drive theft from the data center without creating CPU bottlenecks on the storage array controllers. The development team initially suggested using asymmetric RSA-4096 encryption for every file written to disk. Which storage security architecture should the security engineer recommend to meet both performance and data-at-rest confidentiality requirements?

Show answer & explanation

Answer: Deploying Self-Encrypting Drives (SEDs) using hardware-based symmetric AES encryption managed by a central key management system.

Answer

Deploying Self-Encrypting Drives (SEDs) using hardware-based symmetric AES encryption managed by a central key management system.
The option advocating Self-Encrypting Drives (SEDs) with symmetric AES encryption is correct because SEDs perform media encryption directly within the drive controller hardware using dedicated AES chips. This guarantees data-at-rest confidentiality against physical drive theft while completely offloading cryptographic calculations from the main storage array CPUs.

Step-by-Step Solution

1
Identify the primary operational constraint and security requirement.
The requirement calls for data-at-rest protection against physical drive theft while avoiding CPU performance bottlenecks on the storage controllers.
Bulk storage encryption must be hardware-accelerated and transparent to maintain throughput.
2
Evaluate cipher selection for bulk data encryption.
Symmetric ciphers (such as AES-256) must be used for bulk data rather than asymmetric ciphers (such as RSA).
Asymmetric ciphers carry high mathematical complexity and severe performance overhead when encrypting large media files.
3
Select the appropriate storage hardware control mechanism.
Self-Encrypting Drives (SEDs) satisfy the requirement by executing AES encryption on dedicated drive controller chips upon write and decrypting upon read.
SEDs offload cryptographic operations completely from host and storage array CPUs, providing zero performance degradation and immediate cryptographic erasure capabilities upon disk removal.

Key Concept

Data at Rest Encryption and Self-Encrypting Drives (SEDs)
Question 958Question →

A Security Operations Center (SOC) analyst detects anomalous activities in an enterprise cloud environment. An unknown adversary compromised a privileged user account via session hijacking and registered a malicious OAuth application to maintain persistent access. The attacker is currently executing automated API requests to enumerate and exfiltrate sensitive cloud storage buckets. According to NIST incident response guidelines, which of the following actions should the analyst execute during the CONTAINMENT phase to restrict the threat while preserving forensic evidence? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Revoke all active OAuth refresh tokens and session keys associated with the compromised user account and malicious application.; Apply an inline access control rule or Conditional Access policy to block requests originating from the adversary's command-and-control (C2) IP ranges.

Answer

The correct containment actions are revoking active OAuth tokens/sessions and applying conditional access rules to block the adversary's C2 IP addresses.
During the containment phase, the primary objective is to limit the scope of an incident and stop active adversary operations while maintaining forensic integrity. Revoking active OAuth refresh tokens/session keys cuts off API access immediately, while applying network filtering rules against known command-and-control IP addresses stops data exfiltration without modifying forensic artifacts.

Step-by-Step Solution

1
Analyze the incident phase requirements based on NIST SP 800-61 Rev. 2 framework.
The current task requires identifying actions specific to Containment, which isolates affected resources and prevents further damage without destroying forensic evidence.
Containment must precede eradication and recovery to stop ongoing threat activity while retaining environment state for analysis.
2
Evaluate token revocation and conditional access policy enforcement.
Revoking OAuth sessions immediately stops API access, and blocking C2 IP ranges prevents network communication.
Both steps contain the adversary's active access vectors cleanly without tampering with historic security logs or tenant artifacts.
3
Evaluate the incorrect options regarding evidence destruction and phase ordering.
Deleting identity stores or clearing audit logs disrupts forensic investigation and jumps out of sequence into eradication/recovery.
Log deletion destroys digital evidence and tenant redeployment is a recovery phase operation.

Key Concept

Incident Response Containment Phase Strategies and Evidence Preservation
Question 959Question →

During off-hours monitoring, a Security Operations Center (SOC) analyst detects an unauthorized PowerShell script executing on an internal domain-joined workstation. EDR telemetry confirms the script is actively performing Kerberoasting by requesting Service Principal Name (SPN) tickets with weak RC4 encryption across the internal subnet to prepare for offline password cracking. According to standard incident response lifecycle frameworks, which of the following actions should the analyst perform FIRST?

Show answer & explanation

Answer: Isolate the compromised workstation from the network using host-level isolation controls.

Answer

Isolate the compromised workstation from the network using host-level isolation controls.
In standard incident response frameworks (such as NIST SP 800-61), once an active threat is detected on a system, the immediate priority is Containment. Disconnecting or isolating the compromised endpoint from the network stops the ongoing Kerberoasting attack from reaching other Domain Controllers or pivoting laterally across the internal subnet, while keeping the machine powered on for volatile memory capture.

Step-by-Step Solution

1
Analyze the incident lifecycle stage based on the SOC telemetry.
The incident is currently in the active execution/containment phase where an internal endpoint is performing unauthorized credential harvesting.
Before performing remediation or forensic cleanup, active spread and communication must be halted.
2
Determine the mandatory initial response phase per NIST SP 800-61 incident response guidelines.
Containment must take precedence over eradication and recovery.
Failing to contain the active host allows the attacker to continue harvesting tickets or pivot deeper into the enterprise network.
3
Select the action that achieves effective host containment without destroying immediate evidence or jumping to eradication.
Endpoint network isolation prevents lateral movement while allowing volatile memory to remain intact for investigation.
Host-level EDR isolation disconnects network interfaces while keeping the machine running for live memory forensics.

Key Concept

Incident Response Containment Phase Prioritization
Question 960Question →

In Security Information and Event Management (SIEM) workflow, log data undergoes several processing stages from initial ingestion to analyst notification. Which sequence correctly places the stages of SIEM log processing in chronological order from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of SIEM log processing stages is Log Collection, Log Parsing, Log Normalization, Event Correlation, and Alerting.
The standard SIEM data ingestion and processing flow follows five sequential steps: first, raw data is gathered (Log Collection); second, raw log strings are split into field elements (Log Parsing); third, parsed fields are mapped into common standard formats across all vendor logs (Log Normalization); fourth, normalized events are evaluated across time and sources against security correlation rules (Event Correlation); and finally, confirmed security incidents generate notifications for security analysts (Alerting).

Step-by-Step Solution

1
Identify the initial ingestion phase
Log Collection is identified as the mandatory first step to gather raw data from sources.
Data cannot be processed until it is ingested by the collector or agent.
2
Determine data structure and standard format conversion
Log Parsing occurs prior to Log Normalization.
Raw unstructured logs must first be parsed into individual key-value fields before those fields can be mapped to a standardized taxonomy.
3
Identify analytical logic execution and final output
Event Correlation runs on normalized logs, followed by Alerting as the final output.
Correlation rules require standardized fields across different logs to evaluate patterns, and alerts are only generated after correlation triggers a rule match.

Key Concept

SIEM Log Processing Pipeline
PreviousPage 48 / 112Next
All practice questions — CompTIA Security+ | Examkin