All practice questions

A financial institution is refactoring a monolithic legacy application into a serverless Function-as-a-Service (FaaS) architecture managed via a public cloud provider's API gateway. The cloud provider maintains the underlying physical infrastructure, host hypervisors, and serverless execution runtimes. During an architecture security review, the lead security engineer must establish control placement and operational duties aligned with the cloud shared responsibility model and Zero Trust principles. Which of the following architectural strategies correctly defines the division of security responsibilities between the organization and the cloud provider?

During a comprehensive security audit of an enterprise microservices web platform, an analyst examines two service implementations. Service 1 is an avatar generator that receives a user-supplied web URL via an HTTP POST request, fetches the image resource directly from that URL using a server-side HTTP client, and stores it in internal object storage without restricting target IP addresses or domains. Service 2 is a catalog search service that accepts input strings from search queries and directly concatenates them into dynamic SQL strings executed against the backend database.

Which of the following vulnerability classifications are present in these microservices, and which recommended controls effectively mitigate them? (Select THREE.)

An aerospace engineering enterprise recently completed a third-party technical audit of its internal infrastructure. Match each security weakness scenario on the left with the corresponding cryptographic or control vulnerability on the right.

An organization hosts its web application using a Platform as a Service (PaaS) model from a public cloud service provider. Under the cloud shared responsibility model, which TWO of the following tasks remain the responsibility of the customer?

A security technician is analyzing a compromised workstation log after an administrative staff member manually ran an executable disguised as a printer driver update. Forensic analysis reveals that upon execution, the payload established persistence via Windows Task Scheduler to maintain access across reboots and initiated command-and-control traffic. The telemetry confirms the file did not perform automated network vulnerability scans or attempt self-replication to other network hosts. Which of the following malware characteristics and operational indicators are demonstrated in this scenario? (Select TWO.)

A hospital security team wants to join a trusted non-profit network to exchange sector-specific threat intelligence with peer healthcare organizations. Which of the following resources best fulfills this requirement?

A logistics enterprise is migrating its legacy inventory management platform to a cloud-hosted Infrastructure as a Service (IaaS) environment. As part of establishing the operational security baseline, the security team is defining the boundary of duties between the customer organization and the cloud service provider (CSP). Based on the cloud shared responsibility model, which of the following security tasks is the exclusive responsibility of the customer organization?

An organization's finance department receives an email requesting an immediate change to a trusted vendor's direct deposit bank account details before a scheduled wire transfer. The email features legitimate company logos, uses appropriate financial terminology, and references recent specific purchase order numbers, but originates from a slightly altered external domain. Which of the following social engineering attacks is depicted in this scenario?

During an incident response investigation on a compromised domain controller, a security team suspects the persistent presence of a rootkit alongside other malicious artifacts. Which of the following technical indicators of compromise (IoCs) specifically confirm the presence of a rootkit on the host? (Select TWO.)

A security architect is updating the network architecture for a pharmaceutical company's laboratory. The network contains legacy instrument controllers operating on legacy software alongside modern cloud-connected analytics platforms. The legacy controllers must transmit processed test metrics to an internal staging database, but must be prohibited from initiating connections to the internet or directly communicating with general corporate workstations. Which of the following controls should the security architect implement to enforce isolation while accommodating operational needs? (Select TWO.)

A pharmaceutical research firm integrates an on-premises high-performance compute cluster with a cloud-managed Platform as a Service (PaaS) database pipeline to process sensitive genomic records across a hybrid cloud model. To protect data in transit and control unauthorized access, the security team implements an inline Cloud Access Security Broker (CASB) alongside microsegmentation. When evaluating security responsibility boundaries under this PaaS architecture, which security management task remains exclusively the responsibility of the cloud customer?

A security administrator is drafting baseline policies to align the enterprise network with Zero Trust Architecture (ZTA) principles. Which of the following fundamental tenets should be included in these guidelines? (Select TWO.)

A Security Operations Center (SOC) analyst investigates alerts from a managed network switch. The syslog outputs reveal that a single switch port learned over 100,000 unique source MAC addresses in less than one minute. Subsequent packet analysis shows that unicast traffic intended for specific hosts on VLAN 10 is now being broadcast to all physical ports on the switch, allowing an unauthorized system to capture unencrypted data frames. Which of the following attack types is indicated by these log entries, and what primary operational state change causes the switch to exhibit this behavior?

A corporate security operations center is investigating four distinct security incidents involving social engineering vectors across physical, web, domain, and email boundaries. Match each incident description on the left with its corresponding social engineering attack classification on the right.

An organization plans to host a critical public web application with a third-party cloud service provider. To protect against potential loss of revenue due to service outages, the organization negotiates a Service Level Agreement (SLA) that obligates the vendor to pay financial remedies if uptime falls below 99.9%. Which of the following risk response strategies is the organization implementing with this contractual provision?

An enterprise security team is evaluating alert telemetry generated by a network intrusion detection system (NIDS) and netflow collectors monitoring a DMZ web server (IP address $192.168.50.14$). Flow telemetry demonstrates persistent outbound TCP connections initiated every $300$ seconds to an external IP address ($198.51.100.45$) over port $443$. However, NIDS packet payload analysis reveals that the outbound traffic consists of raw, unencrypted HTTP POST requests containing base64-encoded strings rather than valid TLS handshake negotiations. Which of the following conclusions best explains this alert scenario?

A Security Operations Center (SOC) analyst is reviewing identity logs following an automated alert. The logs record two successful authentication events for the same employee account within a short timeframe:

- 14:02:11 UTC | Account: j.smith | Location: New York, USA | Method: Password + TOTP | Status: SUCCESS
- 14:05:30 UTC | Account: j.smith | Location: Tokyo, Japan | Method: Password + Push Prompt | Status: SUCCESS

Based on these logs, which of the following identifies the most likely operational security issue and the correct immediate response?

A financial institution is expanding its open-banking API integration platform. The Chief Risk Officer directs the security architecture team to publish an enterprise-wide governance document establishing mandatory, technology-neutral technical rules—such as requiring TLS 1.3 for all external communication endpoints and mandating a 15-minute maximum session idle timeout—that all development teams must satisfy. The document must enforce strict compliance across all business units without specifying platform-dependent implementation steps or command-line syntax. Which type of governance document should the security architecture team publish to fulfill this directive?

An organization's security team is enhancing its software supply chain risk management practices for newly acquired third-party applications. To proactively verify that external vendor applications do not introduce known vulnerabilities from embedded open-source libraries, which of the following artifacts should the organization require vendors to provide?

An organization's security team integrates an automated SOAR playbook with their container orchestration platform to terminate and redeploy application pods whenever runtime security threats are detected. Following a threat feed update, a high volume of false-positive alerts triggers continuous pod terminations, resulting in an application service outage. Which of the following workflow modifications best prevents this cascading operational disruption while preserving automated remediation capabilities?