All practice questions

378 questions

Question 81Question

An enterprise security architect is establishing a security baseline across diverse cloud deployment and service models. Match each security operational task or control responsibility to the corresponding cloud service or deployment model that correctly allocates primary tenant responsibility.

Click a left item, then click its matching right item

Items

Configuring guest operating system firewall rules, virtual network routing policies, and OS-level security patches
Managing application runtime environments, database engine security updates, and middleware framework dependencies
Defining user access role permissions, data classification rules, and identity governance within fully hosted turnkey applications
Enforcing a shared infrastructure security baseline and compliance governance model across independent organizations with common regulatory mandates

Matches

Show answer & explanation

Answer

Configuring guest OS firewall rules and virtual routing maps to Infrastructure as a Service (IaaS). Managing application runtime environments and database engine updates maps to Platform as a Service (PaaS). Defining user access permissions and data classification rules in turnkey applications maps to Software as a Service (SaaS). Enforcing a shared infrastructure baseline across entities with common compliance requirements maps to Community Cloud.
The allocation of security management responsibilities follows the cloud shared responsibility framework across service models (IaaS, PaaS, SaaS) and deployment structures (Community Cloud). In IaaS, the customer manages everything from the guest OS upwards. In PaaS, the provider manages the host infrastructure and runtime environment, while the customer manages code and data. In SaaS, the provider manages the full application stack, leaving data protection and access administration to the customer. A Community Cloud specifically serves multiple organizations sharing regulatory and operational requirements.

Step-by-Step Solution

1
Analyze task 1 regarding guest OS firewalls and patching.
Identified as IaaS responsibility because the customer controls the OS layer and virtual network configuration while the CSP manages the hypervisor and physical hosts.
IaaS provides raw infrastructure primitives, leaving OS administration to the tenant.
2
Analyze task 2 regarding application runtime engines and middleware patching.
Identified as PaaS responsibility because the provider abstracts away OS and infrastructure maintenance, providing a ready-to-use execution engine for user applications.
PaaS offloads OS and engine maintenance to the CSP while keeping application code under tenant control.
3
Analyze task 3 regarding identity governance in turnkey software applications.
Identified as SaaS responsibility because the entire software product is abstracted, leaving only data security and user access management to the tenant.
SaaS providers deliver complete applications, shifting all infrastructure and application maintenance away from the tenant.
4
Analyze task 4 regarding joint infrastructure baseline enforcement across distinct organizations with shared compliance needs.
Identified as Community Cloud because this deployment model specifically pools infrastructure resources for member organizations operating under a shared security or regulatory umbrella.
Community clouds cater to multi-tenant peer cohorts with unified governance criteria.

Key Concept

Shared Responsibility Model across Cloud Service and Deployment Models
Question 82Question

A global manufacturing corporation is deploying a multi-cloud security architecture to support collaborative supply chain partner integration, internal software engineering teams, and cloud governance monitoring. Match each cloud architecture model or security control placement on the left with its corresponding responsibility boundary or functional description on the right.

Click a left item, then click its matching right item

Items

Community Cloud Deployment Model
Cloud Access Security Broker (CASB) API Integration
Infrastructure as a Service (IaaS) Compute Layer
Platform as a Service (PaaS) Application Layer

Matches

Show answer & explanation

Answer

The Community Cloud Deployment Model matches shared infrastructure operated for member organizations with common compliance goals. The Cloud Access Security Broker API Integration matches out-of-band inspection using native provider interfaces without proxy latency. The Infrastructure as a Service Compute Layer matches the boundary where the customer handles guest OS patching and virtual firewalls while the provider manages physical hardware and hypervisor. The Platform as a Service Application Layer matches the boundary where the provider manages the OS and runtime frameworks while the customer manages application code and access control.
Each cloud architectural concept correctly aligns with its defined operational scope under enterprise cloud governance standards. Community clouds address multi-tenant shared mission domains; API-based CASBs provide non-disruptive out-of-band auditing; IaaS demands guest OS management by the customer; and PaaS abstracts OS/runtime management to the CSP while retaining application and data security on the customer side.

Step-by-Step Solution

1
Identify the deployment model characteristics for joint organization platforms.
Community cloud models serve pooled organizations with shared compliance or operational goals, dividing responsibilities among participants.
Differentiates community cloud from public or private deployment models.
2
Analyze CASB integration modes (inline proxy vs. out-of-band API).
API mode connects via provider administrative endpoints asynchronously, avoiding network latency.
Distinguishes API integration from forward/reverse inline proxy configurations.
3
Differentiate shared responsibility boundaries between IaaS and PaaS models.
IaaS obligates the customer to manage guest OS patching and middleware; PaaS shifts OS and runtime maintenance to the cloud service provider.
Establishes accurate security responsibility assignment across cloud service layers.

Key Concept

Cloud Shared Responsibility Model and Security Architecture Integration Modes
Question 83Question

Match each cloud deployment model to its defining security architecture characteristic.

Click a left item, then click its matching right item

Items

Public Cloud
Private Cloud
Hybrid Cloud
Community Cloud

Matches

Show answer & explanation

Answer

Public Cloud matches multi-tenant third-party infrastructure. Private Cloud matches single-tenant dedicated infrastructure. Hybrid Cloud matches integrated private and public cloud infrastructure. Community Cloud matches shared infrastructure for organizations with common compliance goals.
Each deployment model is defined by its tenant isolation structure and user community: Public Cloud utilizes multi-tenant vendor infrastructure, Private Cloud provides dedicated single-tenant resources, Hybrid Cloud bridges private and public environments, and Community Cloud is shared among specific organizations with common compliance objectives.

Step-by-Step Solution

1
Identify the multi-tenant deployment model hosted by third parties.
Public Cloud is hosted by third parties for external subscribers in a shared multi-tenant environment.
Public cloud resources are pooled by vendors and delivered over public networks to diverse customers.
2
Identify the dedicated single-tenant deployment model.
Private Cloud provides single-tenant isolation dedicated solely to one organization.
Organizations with strict regulatory needs use private clouds to maintain complete control over data storage and governance.
3
Identify the combined environment connecting distinct infrastructure types.
Hybrid Cloud connects on-premises or private infrastructure with public cloud resources.
Hybrid deployment allows organizations to maintain sensitive internal workloads while leveraging cloud elasticity.
4
Identify the model shared among specific organizations with shared industry or compliance requirements.
Community Cloud serves organizations with common regulatory mandates or goals.
Community cloud distributes pool costs and management across a restricted group of aligned entities.

Key Concept

Cloud Deployment Models
Estimated Time:1m 0s
Question 84Question

A security architect is developing a cloud security matrix to clarify operational responsibilities across multi-cloud environments. Match each security operational task to the corresponding cloud service model where the customer is primarily responsible for performing that specific task.

Click a left item, then click its matching right item

Items

Applying security patches to the guest operating system and configuring host network firewalls
Configuring user role permissions and single sign-on (SSO) integration within a fully vendor-managed application
Hardening source code and managing database schemas while the vendor maintains the execution runtime and middleware
Securing custom function trigger logic and API endpoints while the provider manages event orchestration and container execution

Matches

Show answer & explanation

Answer

Guest OS patching and firewalling matches Infrastructure as a Service (IaaS); configuring user role permissions matches Software as a Service (SaaS); source code and schema security matches Platform as a Service (PaaS); securing function logic and API endpoints matches Function as a Service (FaaS / Serverless).
Each service model transfers specific operational responsibilities to the cloud provider. In IaaS, the customer retains control down to the guest OS level. In PaaS, the provider handles the OS and runtime, leaving application code to the customer. In SaaS, the provider manages the entire application stack, leaving access control to the customer. In FaaS, short-lived function code and trigger handling are the customer's focus.

Step-by-Step Solution

1
Analyze the IaaS responsibility boundary
Identify tasks that involve managing operating system kernels, host security policies, and virtual networking.
IaaS provides raw compute resources, making OS maintenance and host firewalling a customer responsibility.
2
Analyze the SaaS responsibility boundary
Identify tasks limited strictly to identity access management and application configuration.
SaaS abstracts all infrastructure and software delivery, leaving customer responsibility focused on data governance and access control.
3
Analyze the PaaS responsibility boundary
Identify tasks managing custom code and application data while relying on provider-managed runtimes.
PaaS relieves the customer of operating system patching while keeping application logic and data within the customer's domain.
4
Analyze the FaaS responsibility boundary
Identify tasks focused purely on event execution logic and API triggers.
FaaS isolates customer responsibility to individual execution functions and endpoint security, abstracting all server host execution.

Key Concept

Cloud Shared Responsibility Model across Service Delivery Models
Estimated Time:1m 30s
Question 85Question

An incident response team at a critical infrastructure firm is investigating several concurrent security incidents involving social engineering vectors. Match each observed incident scenario to the attack vector that best describes the adversary's delivery method.

Click a left item, then click its matching right item

Items

An administrative staff member receives a customized email appearing to originate from the Chief Executive Officer requesting an immediate, out-of-band wire transfer to secure an urgent acquisition.
A remote system engineer receives a phone call from an attacker impersonating enterprise IT helpdesk support, claiming an urgent credential re-verification is required to restore compromised network access.
Employees at a regional facility find promotional USB flash drives scattered across the employee parking lot, which install reverse-shell malware when inserted into workstation ports.
Threat actors compromise a niche online forum popular among industrial control systems engineers, injecting malicious code into the site to serve drive-by exploits to visiting staff.

Matches

Show answer & explanation

Answer

The scenarios match their respective social engineering attack vectors as follows: the executive wire transfer scam matches Whaling; the phone call impersonating IT support matches Vishing; leaving malware-infected USB drives in the parking lot matches Baiting; and compromising a frequently visited industry forum matches a Watering Hole Attack.
Each attack scenario aligns with its specific technical vector definition: executive impersonation email is Whaling; fraudulent IT support telephone call is Vishing; infected physical media in a public area is Baiting; and compromised industry website targeting specific users is a Watering Hole Attack.

Step-by-Step Solution

1
Analyze the communication channel and target of the targeted email scenario.
Identified spear phishing targeting high-level corporate personnel and authority, which corresponds to Whaling.
Whaling specifically target senior executives or impersonates executive authority for financial or high-value gain.
2
Examine the telephone-based credential harvesting scenario.
Identified voice-based social engineering, which corresponds to Vishing.
Vishing relies on phone conversations and pretexting to elicit sensitive credentials from victims.
3
Evaluate the physical media USB scenario.
Identified physical baiting tactics using hardware media left in accessible areas.
Baiting entices victims with physical objects (like USB drives) promising a gain or appealing to curiosity.
4
Evaluate the web forum injection scenario.
Identified strategic web compromise targeting a specific user group, corresponding to a Watering Hole Attack.
Watering hole attacks infect trusted sites frequented by the target demographic to deliver drive-by downloads.

Key Concept

Social Engineering Attack Vector Classification
Question 86Question

A security architect is updating the enterprise security baseline for several subnets and workload environments. Match each network design requirement to the most appropriate architecture technique or isolation mechanism.

Click a left item, then click its matching right item

Items

Completely detaching sensitive legacy industrial control devices from all physical and wireless network connectivity
Restricting lateral East-West traffic flow between virtual machine workloads operating on the same hypervisor host
Placing publicly accessible web application servers in a network boundary separated from internal database servers
Establishing a single, heavily monitored host through which system administrators must authenticate to access remote secure zones

Matches

Show answer & explanation

Answer

Complete network detachment corresponds to Air-gapping; Restricting lateral virtual machine traffic corresponds to Microsegmentation; Separating public web servers from core databases corresponds to Demilitarized Zone (DMZ); Enforcing a single monitored administrative gateway corresponds to Jump box / Bastion host.
Air-gapping ensures absolute isolation from external networks; microsegmentation applies workload-level traffic filtering to limit lateral movement within subnets; a DMZ segregates public-facing resources from internal networks; and a jump box serves as a secured gateway for privileged administrative sessions.

Step-by-Step Solution

1
Evaluate requirement 1 (legacy device isolation without connectivity)
Identified absolute physical/logical separation requirement
Disconnecting systems entirely from networks defines an air gap topology.
2
Evaluate requirement 2 (lateral East-West traffic control between workloads on the same host)
Identified fine-grained workload-level policy enforcement
Controlling communication between individual container/VM workloads on shared subnets is achieved using microsegmentation.
3
Evaluate requirement 3 (isolating internet-exposed services from private networks)
Identified perimeter network isolation pattern
Exposing services to external traffic while keeping internal networks protected behind firewall interfaces defines a DMZ.
4
Evaluate requirement 4 (centralized administrative management entry point)
Identified single-purpose proxy server requirement
Requiring admins to connect through a single secure proxy before reaching target systems describes a jump box.

Key Concept

Network Segmentation Archetypes and Traffic Isolation Controls
Question 87Question

A network security team is establishing security zones and access control mechanisms for an enterprise environment. Match each network segmentation strategy on the left to its primary application scenario on the right.

Click a left item, then click its matching right item

Items

Air Gap
DMZ (Demilitarized Zone)
Microsegmentation
Jump Box

Matches

Show answer & explanation

Answer

Air Gap matches complete physical isolation from external networks; DMZ matches hosting internet-accessible services while buffering internal networks; Microsegmentation matches granular isolation of individual virtual workloads; Jump Box matches serving as a hardened administrative entry point.
Air gaps completely physically separate high-security networks from external connections. DMZs host public-facing services to isolate the internal network from internet threats. Microsegmentation applies granular policy controls between individual virtualized workloads. Jump boxes serve as single hardened entry points for administrative traffic accessing sensitive zones.

Step-by-Step Solution

1
Identify the function of an air gap.
Air gaps provide total physical separation.
Air gaps ensure sensitive environments have zero network connections to outside or untrusted systems.
2
Determine the role of a DMZ.
DMZs host public-facing servers separated from internal subnets.
This architecture buffers internal corporate assets from untrusted internet traffic.
3
Define microsegmentation.
Microsegmentation isolates workloads at the virtual machine or container layer.
It applies zero-trust principles to control East-West network traffic between workload instances.
4
Evaluate the function of a jump box.
A jump box acts as a hardened administrative access portal.
Administrators must first connect and authenticate to the jump box before initiating management sessions into isolated zones.

Key Concept

Secure Network Design and Segmentation Strategies
Estimated Time:1m 0s
Question 88Question

Match each threat intelligence source type to its primary characteristic or operational scope.

Click a left item, then click its matching right item

Items

Open-Source Intelligence (OSINT)
Information Sharing and Analysis Center (ISAC)
Commercial Threat Feed
Vulnerability Database (NVD/CVE)

Matches

Show answer & explanation

Answer

Open-Source Intelligence (OSINT) pairs with publicly accessible security data gathered from open sources. Information Sharing and Analysis Center (ISAC) pairs with a sector-specific trust community established to exchange relevant threat indicators among industry peers. Commercial Threat Feed pairs with a paid subscription service providing vetted, high-fidelity threat indicators. Vulnerability Database (NVD/CVE) pairs with a standardized public catalog detailing known security flaws.
Each threat intelligence source type is accurately mapped to its core delivery mechanism: OSINT relies on publicly available information; ISACs represent sector-specific peer sharing communities; commercial feeds are paid vendor subscriptions; and vulnerability databases provide public catalogs of known software security flaws.

Step-by-Step Solution

1
Identify the defining features of public versus proprietary threat intelligence sources.
OSINT aligns with publicly available information, while Commercial feeds align with paid vendor subscriptions.
Source accessibility and licensing distinguish OSINT from closed/commercial intelligence feeds.
2
Differentiate peer-to-peer industry sharing platforms from general vulnerability repositories.
ISACs handle sector-specific member sharing, whereas Vulnerability Databases (like NVD/CVE) provide a universal reference catalog for software flaws.
ISACs focus on threat actor activity across critical sectors, while CVE repositories detail specific software vulnerabilities.
3
Map each threat intelligence source to its corresponding operational description.
All four intelligence source types are correctly paired with their target definitions.
Each definition precisely captures the primary scope and business model of the respective intelligence source.

Key Concept

Threat Intelligence Sources and Classification
Question 89Question

A security analyst is reviewing endpoint telemetry and forensic evidence following a corporate incident. Match each observed technical Indicator of Compromise (IoC) on the left with its correct malware classification on the right.

Click a left item, then click its matching right item

Items

A process executes a Base64-encoded command directly within volatile memory using PowerShell without dropping a binary file to disk, while establishing persistence via a WMI event subscription.
System call table hooks are identified alongside Direct Kernel Object Manipulation (DKOM) that actively conceals listening network sockets and process IDs from process management utilities.
Network logs show rapid automated probe traffic targeting TCP port 445 across multiple subnets, self-replicating to adjacent unpatched systems without requiring user interaction.
An end user manually launches an executable disguised as a software update utility, which installs the expected application while silently deploying a covert remote access channel.

Matches

Show answer & explanation

Answer

Fileless Malware pairs with in-memory PowerShell execution without disk binaries; Rootkit pairs with kernel-level DKOM and syscall table manipulation to hide processes; Worm pairs with automated network port scanning and self-replication across subnets; Trojan pairs with malicious software disguised as a legitimate setup utility requiring manual execution.
The correct pairings accurately reflect the core mechanisms and telemetry signatures of each malware category. Fileless malware operates purely in volatile memory via scripts or legitimate system utilities like PowerShell. Rootkits install deep within kernel architecture to hook system calls and alter operating system structures (DKOM) to hide artifacts. Worms leverage network service vulnerabilities (such as SMB port 445) to spread autonomously across connected devices. Trojans rely on user interaction, using trickery to conceal malicious functionality within legitimate-looking executable applications.

Step-by-Step Solution

1
Analyze the first telemetry artifact describing in-memory PowerShell execution and WMI event subscription persistence without disk write operations.
Identify this behavior as living-off-the-land techniques characteristic of fileless malware.
Fileless malware resides in volatile memory and leverages standard system tools to avoid detection by traditional file-based antivirus scanners.
2
Analyze the second telemetry artifact detailing DKOM and system call table hooking designed to conceal open network ports.
Identify this behavior as kernel-mode privilege manipulation characteristic of a rootkit.
Rootkits operate with ring 0 privileges to alter system telemetry and hide malicious activity from operating system diagnostics.
3
Analyze the third telemetry artifact showing automated SMB scanning and network propagation without user interaction.
Identify this behavior as autonomous network self-replication characteristic of a worm.
Worms operate independently across network links, taking advantage of vulnerabilities without needing human execution.
4
Analyze the fourth telemetry artifact describing a user executing a program disguised as a legitimate software update.
Identify this social engineering mechanism and hidden payload delivery as a Trojan.
Trojans rely on deceptive packaging to trick users into manually granting execution rights to embedded malicious software.

Key Concept

Malware Types and Indicators of Compromise
Question 90Question

A enterprise security architecture team is revising its infrastructure segmentation strategy to address specific threat models across varied operational zones. Match each network design architectural technique to the security requirement it fulfills.

Click a left item, then click its matching right item

Items

Out-of-band (OOB) management network with a bastion host
Software-defined microsegmentation
Screened subnet (DMZ) with multi-homed firewalls
Physical air-gapping

Matches

Show answer & explanation

Answer

Out-of-band management with a bastion host pairs with administrative switch isolation; Software-defined microsegmentation pairs with restricting East-West lateral workload traffic; Screened subnets with multi-homed firewalls pair with terminating untrusted Internet traffic away from internal databases; Physical air-gapping pairs with preventing remote intrusion into sensitive SCADA systems.
Each architectural pattern matches its specific security objective: Out-of-band management secures network infrastructure access; Microsegmentation halts intra-subnet lateral movement; DMZs secure public endpoints while safeguarding backend assets; Air gaps eliminate remote connectivity risks for critical isolated systems.

Step-by-Step Solution

1
Analyze management plane isolation requirements.
Identified that out-of-band management with jump boxes isolates administrative control interfaces from general user LANs.
Prevents credential sniffing and unauthorized switch access over standard corporate subnets.
2
Evaluate intra-subnet lateral movement controls.
Matched microsegmentation with limiting East-West traffic between individual workloads in shared virtual subnets.
Standard network VLANs allow unrestrained communication within a broadcast domain, whereas microsegmentation enforces workload-to-workload policies.
3
Examine perimeter and backend database protection mechanisms.
Linked screened subnets (DMZs) to untrusted Internet termination and backend database isolation.
Screened subnets proxy or inspect external requests before allowing controlled connections to internal tiers.
4
Determine total physical isolation needs for sensitive operational technology.
Matched physical air-gapping to critical legacy SCADA systems.
Air-gapping ensures complete network disconnection when software patches or logical controls are insufficient.

Key Concept

Secure Network Design and Segmentation Archetypes
Question 91Question

Match each enterprise endpoint hardening practice to the primary security threat or vulnerability vector it mitigates.

Click a left item, then click its matching right item

Items

Application Allowlisting
OS Patch Management
Disabling Unnecessary Services
Host-Based Firewall Configuration

Matches

Show answer & explanation

Answer

Application Allowlisting matches with execution prevention of unauthorized software; OS Patch Management matches with remediation of known software flaws; Disabling Unnecessary Services matches with reducing attack surface from unused background processes; Host-Based Firewall Configuration matches with filtering unauthorized network traffic at the endpoint.
Application allowlisting prevents unauthorized software execution; patch management remediates known software vulnerabilities; disabling unnecessary services reduces the system attack surface; and host-based firewalls restrict local network traffic.

Step-by-Step Solution

1
Identify the primary protective function of Application Allowlisting
It restricts executable environments so only approved applications run, blocking malware and unauthorized software.
Allowlisting operates on binary execution paths and cryptographic hashes.
2
Identify the primary protective function of OS Patch Management
It applies vendor updates to fix known security vulnerabilities in operating system code.
Patching removes known targets exploited by malware and vulnerability kits.
3
Identify the primary protective function of Disabling Unnecessary Services
It reduces the host attack surface by eliminating unnecessary listening daemons and background processes.
Fewer active services mean fewer potential entry points for network attackers.
4
Identify the primary protective function of Host-Based Firewall Configuration
It inspects and controls network traffic entering or leaving the local operating system.
Host firewalls enforce microsegmentation policies directly on local interfaces.

Key Concept

Enterprise Hardening Practices and Security Control Application
Question 92Question

Match each network or wireless security threat on the left with its corresponding technical indicator or observed evidence on the right.

Click a left item, then click its matching right item

Items

Bluesnarfing
Wireless Disassociation Attack
DNS Poisoning
Rogue Access Point

Matches

Show answer & explanation

Answer

Bluesnarfing matches unauthorized exfiltration of contact lists and messages via Bluetooth. Wireless Disassociation Attack matches transmission of spoofed 802.11 management frames forcing clients offline. DNS Poisoning matches corrupted domain name resolution cache entries redirecting web traffic. Rogue Access Point matches an unauthorized physical wireless router connected directly to an internal network port.
Each attack type matches its distinct indicator: Bluesnarfing steals data via Bluetooth; Wireless Disassociation sends spoofed 802.11 management frames to disconnect clients; DNS Poisoning tampers with DNS cache records to misdirect web requests; and a Rogue Access Point is an unapproved physical wireless device connected to an internal network switch port.

Step-by-Step Solution

1
Identify the primary mechanism of Bluesnarfing.
Recognize that Bluesnarfing exploits Bluetooth vulnerabilities to steal private data such as contacts or calendar items.
Bluesnarfing is defined by unauthorized data theft over Bluetooth.
2
Analyze the Wireless Disassociation Attack mechanisms.
Connect this attack to 802.11 wireless management frames that command clients to disassociate from their access point.
Attackers send spoofed deauthentication frames to disrupt connectivity.
3
Examine DNS Poisoning indicators.
Link DNS poisoning to corrupted resolution records residing in DNS caches redirecting domain names to malicious destinations.
DNS poisoning tampers with domain-to-IP mappings.
4
Identify the characteristic of a Rogue Access Point.
Match it with an unauthorized physical wireless access point connected to an internal network port.
Rogue APs bypass perimeter controls by plugging directly into internal switch ports.

Key Concept

Network and Wireless Attack Indicators
Question 93Question

A security operations manager at an electric vehicle charging station network provider is categorizing recent security incidents and threat activity profiles. Match each observed incident scenario on the left with the threat actor attribute or vector on the right that primarily defines it.

Click a left item, then click its matching right item

Items

A disciplined group uses undisclosed zero-day vulnerabilities in charging management firmware to maintain persistent access across power grid gateways over years without exfiltrating funds.
A recently terminated database administrator uses active privileged administrative credentials to wipe system configuration databases.
An activist group executes distributed denial-of-service (DDoS) attacks against public payment portals to protest energy pricing policies.
An external party embeds malicious telemetry code into a widely used third-party open-source software library integrated into the mobile mobile charging app.

Matches

Show answer & explanation

Answer

Each security scenario correctly maps to its defining threat actor profile or vector based on motivation, sophistication, access method, and attack channel.
Threat actors and vectors are categorized by examining their motivation, level of sophistication, funding, intent, and entry mechanism. Persistent zero-day attacks without financial motives correspond to nation-state actors; post-termination credential abuse corresponds to insider threats; public policy protests via DDoS correspond to hacktivists; and open-source dependency tampering corresponds to supply chain attack vectors.

Step-by-Step Solution

1
Analyze the long-term zero-day firmware intrusion scenario.
Identify as a nation-state threat actor.
Nation-state actors possess significant resources required to develop zero-day exploits and maintain long-term covert persistence for geopolitical espionage.
2
Analyze the unauthorized data wiping by a terminated administrator.
Identify as an insider threat.
Insider threats involve individuals with authorized access or specialized knowledge of internal systems who misuse privileges due to personal grievance.
3
Analyze the payment portal denial-of-service attack associated with public policy protests.
Identify as a hacktivist group.
Hacktivists focus on disruption and publicity to bring attention to political, social, or environmental causes.
4
Analyze the malicious telemetry code embedded in an open-source library.
Identify as a supply chain attack vector.
Supply chain attack vectors target third-party components, libraries, or vendors to compromise downstream software applications implicitly trusting those sources.

Key Concept

Threat Actor Attributes, Motivations, and Attack Vectors
Question 94Question

A security analyst is evaluating different testing procedures to incorporate into an organization's vulnerability management policy. Match each security testing method on the left with its corresponding operational characteristic on the right.

Click a left item, then click its matching right item

Items

Credentialed Host Scan
Passive Network Monitoring
Interactive Application Security Testing (IAST)
Wardriving Assessment

Matches

Show answer & explanation

Answer

Credentialed Host Scan matches with leveraging administrative privileges to audit local host configurations; Passive Network Monitoring matches with analyzing packet headers silently without active probing; Interactive Application Security Testing (IAST) matches with deploying runtime agents inside the application engine; Wardriving Assessment matches with using wireless detection equipment around facility perimeters to locate rogue access points.
Each testing method is paired with its specific operational mechanism: credentialed scans use elevated login access for local auditing; passive monitoring relies on packet sniffing without traffic generation; IAST uses embedded agents during execution; and wardriving surveys physical boundaries for wireless emissions and unauthorized access points.

Step-by-Step Solution

1
Analyze Credentialed Host Scan operational requirements
Identify that credentialed scanning requires authentication to target hosts to examine internal configurations and missing hotfixes.
Administrative credentials allow direct querying of local operating system settings and installed updates.
2
Evaluate Passive Network Monitoring characteristics
Match with silent packet header analysis without sending network probes.
Passive monitoring observes existing network traffic on a span/mirror port rather than generating active probe traffic.
3
Examine Interactive Application Security Testing (IAST) architecture
Connect IAST to agent-based runtime application code inspection during execution.
IAST combines aspects of SAST and DAST by placing sensors inside the runtime engine while tests execute.
4
Identify Wardriving Assessment physical and RF footprint parameters
Associate wardriving with perimeter wireless signal detection and rogue access point mapping.
Wardriving specifically tests wireless perimeter security by detecting RF leakage and unauthorized access points.

Key Concept

Vulnerability Assessment and Security Testing Methods
Estimated Time:1m 30s
Question 95Question

Match each host and infrastructure vulnerability scenario to the underlying security weakness or misconfiguration it represents.

Click a left item, then click its matching right item

Items

An internal management host transmitting network monitoring telemetry using SNMPv1 across local subnets.
A third-party background service executable located in a directory with full write permissions assigned to non-administrative users.
An internal database server bound to a public interface without perimeter firewall rules or VLAN isolation.
A legacy host operating system past end-of-life running unpatched network daemons with known exploit modules.

Matches

Show answer & explanation

Answer

The scenarios match their respective security weaknesses as follows: SNMPv1 traffic matches cleartext protocol exposure; weak file permissions on executable directories match local privilege escalation risk; unsegmented database service exposure matches improper network segmentation; and unpatched end-of-life operating systems match unsupported legacy software vulnerability risk.
Each scenario maps directly to its specific vulnerability classification. SNMPv1 does not support encryption, exposing management strings in cleartext. Allowing standard users write access to service binary paths enables local file modification and privilege escalation. Exposing internal database ports directly without firewall or VLAN boundaries represents a breakdown in network segmentation. Continuing to host end-of-life operating systems exposes environments to known unpatched vulnerabilities.

Step-by-Step Solution

1
Analyze each scenario to isolate the core vulnerability mechanism.
Scenario 1 involves plain-text transmission; Scenario 2 involves excessive local file modification rights; Scenario 3 involves lack of network zone controls; Scenario 4 involves unpatched legacy systems.
Proper classification requires pinpointing the root cause vulnerability at the protocol, operating system, or network architecture layer.
2
Pair each scenario with its corresponding architectural or configuration flaw description.
SNMPv1 pairs with cleartext protocol exposure; writeable executable path pairs with privilege escalation; direct external database access pairs with improper network segmentation; end-of-life OS pairs with unsupported legacy software risk.
This establishes clear alignment between technical indicators and vulnerability management classifications.

Key Concept

Host, Network, and Architecture Vulnerabilities
Question 96Question

An enterprise infrastructure security team is implementing system hardening practices to remediate recent penetration test findings. Match each specific technical hardening control to the primary vulnerability mechanism or attack vector it directly suppresses.

Click a left item, then click its matching right item

Items

Implementation of Privileged Access Management (PAM) with ephemeral Just-In-Time (JIT) credentials
Enforcement of Windows Defender Application Control (WDAC) using strict publisher rules
Mandating SMB Signing and disabling legacy LLMNR/NBT-NS protocols
Enabling kernel-level Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP)

Matches

Show answer & explanation

Answer

1. Privileged Access Management with JIT credentials matches persistent abuse of static administrative accounts.
2. Windows Defender Application Control matches execution of untrusted binary payloads and scripts.
3. Mandating SMB Signing and disabling legacy protocols matches adversary-in-the-middle NTLM relay attacks.
4. Enabling ASLR and DEP matches in-memory buffer overflow exploitation.
Each hardening strategy directly targets the underlying architectural vulnerability: PAM with JIT controls privileged account lifecycle; application allowlisting (WDAC) enforces software execution integrity; SMB signing and disabling LLMNR eliminate local MitM relay vectors; and ASLR/DEP defend memory space against execution of buffer overflow exploits.

Step-by-Step Solution

1
Analyze the scope of Privileged Access Management (PAM) with ephemeral credentials.
Identify that JIT credentials directly eliminate standing administrative privileges and static credentials.
Temporary access limits exposure windows for compromised credentials.
2
Evaluate application allowlisting mechanisms such as WDAC.
Determine that strict publisher rules block unauthorized binary execution and rogue DLLs.
Only signed binaries from trusted software vendors are permitted to launch.
3
Assess protocol-level hardening including SMB signing and disabling LLMNR/NBT-NS.
Connect these network configuration changes to mitigating local name resolution spoofing and NTLM relaying.
Disabling unauthenticated broadcast protocols eliminates the MitM vector, and SMB signing ensures packet integrity.
4
Examine memory protection controls like ASLR and DEP.
Link memory location randomization and non-executable memory flags to neutralizing buffer overflow exploits.
DEP stops payload execution in data pages, and ASLR makes memory addresses unpredictable for exploit payloads.

Key Concept

Enterprise System Hardening and Attack Surface Reduction Controls
Question 97Question

A security operations analyst is categorizing threat intelligence sources to build a tiered threat data pipeline. Match each threat intelligence source classification on the left with its primary operational characteristic on the right.

Click a left item, then click its matching right item

Items

Open-Source Intelligence (OSINT)
Information Sharing and Analysis Center (ISAC)
Commercial / Proprietary Threat Intelligence
Vulnerability Databases (e.g., NVD / CVE)

Matches

Show answer & explanation

Answer

Open-Source Intelligence (OSINT) matches unclassified, publicly accessible web data. Information Sharing and Analysis Center (ISAC) matches trusted sector-specific peer indicator sharing. Commercial / Proprietary Threat Intelligence matches fee-based subscriptions for dark web and actor profiling. Vulnerability Databases match standardized public repositories providing CVSS scores and CVE flaw metrics.
Each threat intelligence source corresponds directly to its operational delivery model: Open-Source Intelligence relies on publicly available data without cost; ISACs provide sector-restricted peer collaboration; Commercial/Proprietary feeds deliver paid tailored analytics and dark web visibility; and Vulnerability Databases offer standardized flaw listings with CVSS scoring.

Step-by-Step Solution

1
Identify the governance and access constraints of each intelligence source type.
Distinguish between completely open data, sector-restricted peer data, commercial subscription feeds, and vulnerability registries.
Threat intelligence categorization relies on data origin, access licensing, and intended utility.
2
Map OSINT and Vulnerability Databases to their respective public frameworks.
OSINT pairs with freely available online research; vulnerability databases pair with standardized flaw registries like NVD/CVE.
Both are publicly accessible, but OSINT focuses on broad threat data while NVD focuses on software weakness scoring.
3
Differentiate between collaborative sector sharing and vendor-provided commercial intelligence.
ISAC pairs with peer-to-peer industry sharing; commercial intelligence pairs with paid bespoke threat actor and dark web monitoring.
ISACs operate on non-profit sector collaboration, whereas commercial vendors operate on paid subscription models.

Key Concept

Categorization and Characteristics of Threat Intelligence Sources
Question 98Question

Match each observed log signature or network artifact on the left with its corresponding attack classification on the right.

Click a left item, then click its matching right item

Items

Packet captures reveal a rapid flood of DHCPDISCOVER requests originating from unique, randomly generated MAC addresses, resulting in scope depletion.
Wireless capture logs show an rogue access point broadcasting 802.11 PROBE_RESP frames matching any SSID requested in nearby client probe requests.
Proxy logs indicate incoming HTTP 302 Redirect responses to secure endpoints are stripped to plain HTTP before delivery to the client browser.
An Ethernet frame capture contains nested 802.1Q tags (VID10VID_{10} outer, VID20VID_{20} inner) transmitted over an access port attached to an autonegotiating switch interface.

Matches

Show answer & explanation

Answer

DHCP flood with random MAC addresses matches DHCP Starvation Attack; fake probe responses matching requested SSIDs match KARMA Wireless Attack; converting HTTPS redirects to cleartext HTTP matches SSL Stripping Attack; nested 802.1Q tags match Double-Tagging VLAN Hopping.
Each attack type directly corresponds to distinct frame and header characteristics: DHCP Starvation floods randomized MAC requests, KARMA answers client PNL probes dynamically, SSL Stripping downgrades HTTPS redirects to cleartext HTTP, and Double-Tagging uses nested 802.1Q headers to cross VLAN boundaries.

Step-by-Step Solution

1
Analyze the DHCP frame log showing high-frequency requests with randomized MAC addresses.
Identified as a resource exhaustion vector targeted at DHCP pools (DHCP Starvation Attack).
Spoofed MAC addresses consume all legitimate leases in the scope.
2
Analyze the 802.11 management frames showing PROBE_RESP matching client probe requests.
Identified as a specialized rogue AP probe response manipulation technique (KARMA Attack).
KARMA actively listens to clients' preferred network lists (PNL) and mimics whatever SSID they seek.
3
Examine web traffic proxy logs modifying HTTP 302 HTTPS redirection headers to HTTP.
Identified as cleartext transport protocol manipulation (SSL Stripping Attack).
The attacker intercepts HTTP-to-HTTPS upgrades to maintain visibility over unencrypted traffic.
4
Inspect Ethernet frame headers carrying double 802.1Q VLAN identifiers.
Identified as encapsulation exploitation across trunking switch ports (Double-Tagging VLAN Hopping).
The first switch strips the outer tag matching the native VLAN, allowing the frame to be forwarded to the inner tagged VLAN without routing.

Key Concept

Network and Wireless Attack Indicators
Question 99Question

An IT technician is tasked with applying baseline security hardening controls to enterprise endpoints. Match each system hardening technique on the left with its corresponding security mitigation goal on the right.

Click a left item, then click its matching right item

Items

Disabling Unused Services
Application Allowlisting
Patch Management

Matches

Show answer & explanation

Answer

Disabling Unused Services matches with reducing the attack surface by eliminating unneeded entry points; Application Allowlisting matches with preventing unauthorized files and scripts from executing; Patch Management matches with remediating software flaws and known security vulnerabilities.
Each system hardening strategy addresses a specific risk area: disabling unused services limits active exposure points, application allowlisting enforces approved program execution, and patch management fixes identified software defects.

Step-by-Step Solution

1
Identify the primary mechanism of Disabling Unused Services
Turning off unneeded system daemons and features reduces open ports and background software entry points.
Minimizing active features directly decreases the available attack surface.
2
Identify the primary mechanism of Application Allowlisting
Enforcing an explicit list of authorized executables blocks untrusted or malicious scripts.
Execution control prevents unauthorized software from running.
3
Identify the primary mechanism of Patch Management
Deploying vendor updates addresses known code defects.
Routine updates eliminate security weaknesses that attackers could exploit.

Key Concept

Mitigation Strategies and Enterprise Hardening Practices
Question 100Question

A security analyst is conducting forensic triage on several compromised endpoints following an enterprise network incident. Match each observed technical Indicator of Compromise (IoC) with its corresponding malware classification.

Click a left item, then click its matching right item

Items

Memory forensic analysis reveals Master Boot Record (MBR) modification and code execution prior to operating system kernel initialization.
An automated process silently uses high system GPU resources to perform hashing operations while communicating via the Stratum protocol.
System logs show periodic HTTP POST requests containing encrypted keyboard inputs and clipboard buffers sent to an external C2 server.
Volatile memory inspection reveals WMI scripts executing encoded commands injected into legitimate system processes without creating executable files on disk.

Matches

Show answer & explanation

Answer

1. MBR modification prior to kernel load corresponds to Bootkit. 2. GPU hashing with Stratum protocol corresponds to Cryptominer. 3. Encrypted keystroke/clipboard exfiltration corresponds to Spyware. 4. In-memory WMI execution without disk binaries corresponds to Fileless Malware.
Each malware classification is accurately paired with its primary technical artifact: MBR manipulation indicates a Bootkit, unauthorized GPU hashing over Stratum indicates a Cryptominer, covert keystroke/clipboard exfiltration indicates Spyware, and RAM-only script execution using native OS tooling indicates Fileless Malware.

Step-by-Step Solution

1
Analyze item 1: Execution occurring before OS kernel initialization via MBR modification.
Identify that malware affecting boot sectors prior to OS load is classified as a Bootkit.
Bootkits target the storage boot sector to hijack boot sequence control before security software initializes.
2
Analyze item 2: High GPU utilization performing hashing using the Stratum protocol.
Identify that unauthorized resource consumption for cryptographic hashing matches Cryptominer behavior.
Cryptojacking malware leverages target hardware to compute cryptographic proofs for financial gain via Stratum mining pools.
3
Analyze item 3: Capturing keystrokes and clipboard data for periodic outbound transmission.
Identify that telemetry logging user inputs matches Spyware (keylogger/stealer) characteristics.
Spyware covertly monitors user behavior and harvests credentials or private data.
4
Analyze item 4: Execution strictly within memory using WMI without creating disk files.
Identify that living-off-the-land techniques executing in memory correspond to Fileless Malware.
Fileless malware avoids detection by traditional file-based antivirus scanners by running directly in RAM through legitimate host processes.

Key Concept

Malware Types and Indicators of Compromise
Estimated Time:2m 0s
PreviousPage 5 / 19Next
All practice questions — CompTIA Security+ | Examkin