All practice questions
2232 questions
An organization is designing an updated Identity and Access Management (IAM) architecture for its enterprise applications. The security team needs to support automated user account lifecycle management (creation, updates, and deprovisioning) across multiple third-party SaaS platforms. Additionally, they must implement a fine-grained access control mechanism capable of making real-time authorization decisions based on dynamic contextual attributes such as user location, device security posture, and time of access. Which of the following technologies should the security architect incorporate into the IAM architecture to satisfy these requirements? (Select TWO.)
Select all that apply
A technician identifies an active malware infection on an enterprise desktop. To stop lateral movement without losing volatile memory evidence, the technician uses the Endpoint Detection and Response (EDR) console. Which of the following capabilities should the technician execute?
A regional energy provider is transitioning its remote field maintenance operations to a Zero Trust Architecture (ZTA). Previously, field technicians authenticated once via Multi-Factor Authentication (MFA) to establish a Virtual Private Network (VPN) session, granting them unrestricted access to internal grid management servers for their entire shift. To align with core Zero Trust principles and eliminate implicit trust, which of the following architectural changes should the security team implement?
A security architect is configuring a zero-trust network ingress path for an administrator connecting remotely to a sensitive database in an isolated zone. Arrange the operational steps for establishing this administrative session in the correct chronological sequence, from initial external initiation to final host authorization.
Drag items to arrange them in the correct order
A forensic analyst is responding to an active security incident involving a bare-metal hypervisor suspected of hosting a sophisticated, memory-resident kernel rootkit that utilizes Direct Memory Access (DMA) to exfiltrate cryptographic keys. To preserve evidence for potential judicial proceedings while adhering strictly to forensic standards, which of the following actions should the analyst perform FIRST?
A security engineer is establishing host-hardening baselines for web servers to mitigate memory corruption and buffer overflow exploits. The engineer must configure controls that randomize memory locations assigned to system processes and mark stack memory regions as non-executable. Which of the following technical mitigations best satisfies these security requirements?
A security software engineer is performing a code audit on an enterprise data processing service written in C. The service reads user-supplied binary data streams containing a length header field () and a payload array (). During review, the engineer identifies the following code segment used to process incoming data chunks:
c
unsigned short length = get_user_header_length();
char *buffer = (char *)malloc(length + 1);
if (buffer == NULL) return -1;
memcpy(buffer, user_data, length);
buffer[length] = '\0';
Based on this code snippet, which of the following vulnerabilities and security risks are present in this implementation? (Select TWO)
Select all that apply
A security analyst confirms that an internal user workstation is infected with active malware that is attempting to communicate with an external command-and-control server. According to standard incident response lifecycle frameworks (such as NIST SP 800-61), which of the following actions should the analyst take immediately after confirming the incident?
During an incident response investigation involving suspected database exfiltration on a live cloud-hosted virtual server, a security analyst must preserve system evidence while maintaining strict chain of custody compliance for potential legal proceedings. Which of the following procedures should the analyst perform immediately following the acquisition of the system's volatile memory?
A security architect is designing an authentication framework for a native mobile application that authenticates users against an enterprise Identity Provider using OpenID Connect. Because native applications are public clients that cannot securely store a static client secret, the architect must mitigate the risk of authorization code interception attacks on the device operating system. Which mechanism should be integrated into the authorization code flow to address this vulnerability?
An enterprise Incident Response Team (IRT) detects unauthorized DNS redirection caused by ARP cache poisoning on a critical core network segment. According to standard NIST SP 800-61 incident response frameworks, in what order should the incident response team execute the following operational response steps?
Drag items to arrange them in the correct order
A security architect is evaluating resilience specifications for an enterprise infrastructure redesign. Match each business availability metric on the left with its corresponding definition on the right.
Click a left item, then click its matching right item
Items
Matches
An incident investigation team is analyzing correlated telemetry captured by an enterprise SIEM from an API Gateway (APIGW) and an Identity Provider (IDP):
text
2026-03-14T08:12:01Z [APIGW] src_ip=198.51.100.44 method=POST uri="/api/v1/auth/login" status=200 user="j_doe"
2026-03-14T08:12:05Z [IDP] user="j_doe" auth_method="MFA_TOTP" status="SUCCESS" src_ip=198.51.100.44
2026-03-14T08:12:12Z [APIGW] src_ip=198.51.100.44 method=GET uri="/api/v1/admin/export" status=403 user="j_doe" error="InsufficientPrivileges"
2026-03-14T08:12:18Z [APIGW] src_ip=198.51.100.44 method=POST uri="/api/v1/users/j_doe/roles" status=200 payload="{\"add_role\":\"GlobalAdmin\"}"
2026-03-14T08:12:25Z [APIGW] src_ip=198.51.100.44 method=GET uri="/api/v1/admin/export" status=200 user="j_doe" bytes_sent=4194304
Based on the log sequence above, which of the following security events occurred?
A Security Operations Center (SOC) team is configuring an automated Endpoint Detection and Response (EDR) incident response workflow to handle host-based malicious script execution. In what sequence should the EDR platform execute the containment, mitigation, and post-incident investigation actions?
Drag items to arrange them in the correct order
Following an EDR telemetry alert indicating an active credential-harvesting attempt on a Windows domain controller, a SOC analyst must execute an incident response procedure. In what sequence should the analyst execute the following actions to effectively contain the threat, preserve evidence, and remediate the endpoint?
Drag items to arrange them in the correct order
An incident responder is preparing to collect digital evidence from a powered-on corporate workstation suspected of compromise. According to standard forensic evidence collection guidelines (Order of Volatility), in what sequence should the responder capture the following components, from MOST volatile to LEAST volatile?
Drag items to arrange them in the correct order
A security analyst is designing an automated threat intelligence integration strategy for an enterprise network. The strategy requires feeds that provide real-time, machine-readable indicators of compromise (IoCs) formatted for direct ingestion into edge firewalls and SIEM systems, as well as trusted sector-specific collaborative threat sharing. Which of the following intelligence sources or delivery mechanisms should the analyst select to meet these specific operational requirements? (Select TWO.)
Select all that apply
Following the detection of suspicious command-and-control beaconing, an enterprise incident response team completes short-term network isolation of a compromised hypervisor host managing critical cloud workloads. The analyst verifies that lateral movement has been halted and containment boundaries are holding. According to standard NIST incident response lifecycle guidelines, which action should the incident response team execute NEXT before initiating eradication procedures?
A university network engineering team is designing an architecture to secure a high-containment biomedical research laboratory. The lab contains unpatchable legacy telemetry devices that must transmit real-time experimental data to an on-premises database in the core enterprise data center, but must be prohibited from initiating or receiving any other traffic across the campus network or the internet. Which of the following network design configurations best achieves this isolation while mitigating lateral movement risks?
Following a high-severity alert indicating unauthorized root-level execution on a enterprise hypervisor server, a security analyst is assigned to preserve digital evidence from the active physical host. Which of the following initial steps must the analyst perform to preserve evidence integrity and adhere to forensic best practices? (Select TWO.)
Select all that apply