All practice questions

2232 questions

Question 1041Question

An organization is designing an updated Identity and Access Management (IAM) architecture for its enterprise applications. The security team needs to support automated user account lifecycle management (creation, updates, and deprovisioning) across multiple third-party SaaS platforms. Additionally, they must implement a fine-grained access control mechanism capable of making real-time authorization decisions based on dynamic contextual attributes such as user location, device security posture, and time of access. Which of the following technologies should the security architect incorporate into the IAM architecture to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: System for Cross-domain Identity Management (SCIM) for automated identity provisioning across cloud platforms; Attribute-Based Access Control (ABAC) for evaluating dynamic contextual risk factors during authorization decisions

Answer

The architecture should incorporate System for Cross-domain Identity Management (SCIM) for user account provisioning and Attribute-Based Access Control (ABAC) for dynamic authorization based on contextual attributes.
The correct options are System for Cross-domain Identity Management (SCIM) and Attribute-Based Access Control (ABAC). SCIM automates user identity exchange and lifecycle provisioning across disparate cloud systems. ABAC enables policy rules based on subject, resource, and environmental attributes (such as location and device posture), allowing real-time context-aware authorization.

Step-by-Step Solution

1
Analyze the account lifecycle management requirement.
System for Cross-domain Identity Management (SCIM) is identified as the standard protocol designed for automated provisioning, updating, and deprovisioning of user identities across cloud platforms.
SCIM standardizes the schema and RESTful APIs for managing user identities across separate security domains.
2
Analyze the access control and authorization decision requirement.
Attribute-Based Access Control (ABAC) is identified as the access control model that evaluates user, resource, and environmental attributes (such as device health and location) to make real-time decisions.
Unlike static Role-Based Access Control (RBAC), ABAC incorporates dynamic contextual conditions into policy enforcement.

Key Concept

IAM protocols and access control models for cloud identity provisioning and dynamic authorization.
Question 1042Question

A technician identifies an active malware infection on an enterprise desktop. To stop lateral movement without losing volatile memory evidence, the technician uses the Endpoint Detection and Response (EDR) console. Which of the following capabilities should the technician execute?

Show answer & explanation

Answer: Perform host network isolation via the EDR agent

Answer

Perform host network isolation via the EDR agent
Performing host network isolation directly through the EDR agent prevents the endpoint from communicating with any local or remote network resources, halting lateral malware propagation while maintaining machine power so security responders can harvest volatile RAM memory.

Step-by-Step Solution

1
Identify the primary operational constraint and goal
The goal is to halt lateral threat movement immediately while preserving volatile system memory (RAM).
Shutting down the host loses volatile evidence, while network-based filtering does not block internal local communication effectively.
2
Evaluate EDR endpoint control capabilities
Host network isolation cuts off all host network interface adapters remotely via the installed EDR agent while keeping system state active.
This isolates the compromised host from the enterprise network without powering down the device.

Key Concept

EDR Host Isolation and Volatile Evidence Preservation
Question 1043Question

A regional energy provider is transitioning its remote field maintenance operations to a Zero Trust Architecture (ZTA). Previously, field technicians authenticated once via Multi-Factor Authentication (MFA) to establish a Virtual Private Network (VPN) session, granting them unrestricted access to internal grid management servers for their entire shift. To align with core Zero Trust principles and eliminate implicit trust, which of the following architectural changes should the security team implement?

Show answer & explanation

Answer: Implement a Policy Decision Point (PDP) that continuously evaluates device security posture and request context before a Policy Enforcement Point (PEP) grants access to individual resources.

Answer

Implement a Policy Decision Point (PDP) that continuously evaluates device security posture and request context before a Policy Enforcement Point (PEP) grants access to individual resources.
The correct option aligns directly with Zero Trust Architecture (ZTA) by removing implicit network trust. In a ZTA framework (such as NIST SP 800-207), access to individual resources is evaluated on a per-request basis by a Policy Decision Point (PDP) using continuous contextual telemetry (such as device compliance, location, and user identity), and enforced at a Policy Enforcement Point (PEP).

Step-by-Step Solution

1
Identify the primary architectural flaw in the existing legacy setup.
The legacy VPN grants implicit network-wide trust after a single perimeter authentication event.
Legacy perimeter security assumes internal traffic is trustworthy once initial authentication succeeds.
2
Apply core Zero Trust Architecture (ZTA) principles (NIST SP 800-207).
Zero Trust mandates explicit verification, least privilege, assumed breach, and continuous per-request evaluation.
Access decisions must rely on dynamic trust criteria rather than physical or virtual network position.
3
Select the component implementation that enforces dynamic policy evaluation and enforcement.
The Policy Decision Point (PDP) evaluates contextual signals (device posture, user identity, threat intelligence) and directs the Policy Enforcement Point (PEP) to allow or block access to specific work workloads.
Decoupling policy decision from enforcement ensures dynamic continuous authorization without implicit trust.

Key Concept

Zero Trust Architecture Principles
Question 1044Question

A security architect is configuring a zero-trust network ingress path for an administrator connecting remotely to a sensitive database in an isolated zone. Arrange the operational steps for establishing this administrative session in the correct chronological sequence, from initial external initiation to final host authorization.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence begins with establishing the encrypted transport session to the DMZ bastion host, authenticating identity via MFA on the bastion host, filtering East-West network traffic at the internal stateful firewall, and enforcing endpoint microsegmentation policy on the database server.
Establishing remote administrative access into a restricted segment requires a defense-in-depth sequence. Initial encrypted transport terminates at a DMZ bastion host, followed by MFA verification. Next, stateful internal firewalls allow East-West transit only from the verified jump host IP. Finally, the target host applies microsegmentation policies to validate process identity and grant connection access.

Step-by-Step Solution

1
Establish perimeter ingress session
Client connects securely to the bastion host interface in the DMZ.
Direct connections from external untrusted networks to internal zones are blocked; traffic must terminate at a designated perimeter host.
2
Authenticate user identity and evaluate posture
Administrator identity is verified and granted temporary jump privileges.
MFA and identity verification prevent unauthorized users from using the bastion as an internal relay.
3
Traverse internal zone boundaries
Internal stateful firewall allows traffic from the bastion IP to the protected subnet.
Network-level access control rules enforce zone separation and restrict East-West traffic to explicit administrative paths.
4
Enforce host-level microsegmentation
Target database workload accepts and decrypts the application connection.
Zero trust architecture dictates that host endpoints perform independent, granular verification of incoming traffic regardless of network perimeter checks.

Key Concept

Secure Jump Host Transit and Microsegmentation Enforcement
Question 1045Question

A forensic analyst is responding to an active security incident involving a bare-metal hypervisor suspected of hosting a sophisticated, memory-resident kernel rootkit that utilizes Direct Memory Access (DMA) to exfiltrate cryptographic keys. To preserve evidence for potential judicial proceedings while adhering strictly to forensic standards, which of the following actions should the analyst perform FIRST?

Show answer & explanation

Answer: Capture the host physical RAM using a validated live hardware or kernel-level acquisition mechanism directly to write-blocked local target media prior to changing system power states or network connectivity.

Answer

Capture the host physical RAM using a validated live hardware or kernel-level acquisition mechanism directly to write-blocked local target media prior to changing system power states or network connectivity.
The correct action is to acquire system RAM live using a validated hardware or kernel acquisition method writing directly to local write-blocked media. System memory (RAM) is near the top of the Order of Volatility. Because memory-resident rootkits exist primarily in volatile memory, any alteration of system power states (such as a system shutdown) destroys the primary evidence.

Step-by-Step Solution

1
Evaluate the evidence types present in the scenario based on the Order of Volatility.
System RAM and CPU registers represent the most volatile state, whereas static disk images are significantly less volatile.
Volatile evidence is lost immediately if system power is interrupted or modified.
2
Determine the proper acquisition sequence for a memory-resident kernel attack.
Acquire physical memory live while the system is powered on using hardware or dedicated kernel tools.
Powering down or restarting the host clears system RAM and destroys the volatile rootkit artifacts.
3
Apply write-blocking and local storage protocols during memory dump collection.
Save the memory image directly to isolated, write-blocked external storage.
Prevents altering system storage or transmitting artifacts over untrusted network connections that could corrupt the evidentiary chain.

Key Concept

Order of Volatility and Volatile Memory Acquisition
Estimated Time:3m 0s
Question 1046Question

A security engineer is establishing host-hardening baselines for web servers to mitigate memory corruption and buffer overflow exploits. The engineer must configure controls that randomize memory locations assigned to system processes and mark stack memory regions as non-executable. Which of the following technical mitigations best satisfies these security requirements?

Show answer & explanation

Answer: Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP)

Answer

Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP)
The correct answer provides the exact combination of host-hardening memory protections needed. Address Space Layout Randomization (ASLR) randomizes the memory locations of key data areas (such as base executable, stack, and heap), making it difficult for an attacker to reliably jump to target memory locations. Data Execution Prevention (DEP), also known as Exec Shield or the NX (No-Execute) bit, prevents code execution from non-executable memory regions such as the stack and heap.

Step-by-Step Solution

1
Analyze the scenario requirements
Identified two specific memory protection requirements: address randomization and non-executable stack enforcement.
Hardening against buffer overflow exploits requires technical controls operating at the OS memory management level.
2
Map requirements to technical security controls
ASLR addresses memory position randomization; DEP (No-Execute / NX bit) prevents binary execution from memory pages designated for data storage.
Combining ASLR and DEP provides comprehensive mitigation against buffer overflows and return-oriented programming (ROP) exploits.

Key Concept

Host Hardening and Exploit Mitigations (ASLR & DEP)
Question 1047Question

A security software engineer is performing a code audit on an enterprise data processing service written in C. The service reads user-supplied binary data streams containing a length header field (lengthlength) and a payload array (datadata). During review, the engineer identifies the following code segment used to process incoming data chunks:

c
unsigned short length = get_user_header_length();
char *buffer = (char *)malloc(length + 1);
if (buffer == NULL) return -1;
memcpy(buffer, user_data, length);
buffer[length] = '\0';

Based on this code snippet, which of the following vulnerabilities and security risks are present in this implementation? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Integer overflow during size calculation that can lead to an undersized memory allocation; Heap-based buffer overflow during copying due to mismatched memory buffer sizing

Answer

The implementation contains an integer overflow vulnerability in the allocation size arithmetic and a subsequent heap-based buffer overflow during the memory copy operation.
An integer overflow occurs when length+1length + 1 wraps to 0 for a maximum 16-bit unsigned short value (6553565535). This causes `malloc(0)` to allocate insufficient heap memory, while `memcpy` attempts to copy 6553565535 bytes into that buffer, resulting in a heap-based buffer overflow.

Step-by-Step Solution

1
Analyze the size calculation arithmetic
If length=65535length = 65535 (the maximum value for a 16-bit unsigned short), computing length+1length + 1 wraps around to 00 due to integer overflow.
Unsigned integer arithmetic wraps around without throwing an exception when a value exceeds the storage capacity of its data type.
2
Evaluate the buffer allocation behavior
The function `malloc(0)` allocates a 0-byte (or minimal chunk header) buffer on the heap.
The memory allocator receives the wrapped arithmetic result (00 bytes) rather than the intended allocation size.
3
Trace the memory copy execution
The `memcpy` function executes using the original lengthlength value (6553565535), writing data far beyond the allocated buffer boundaries.
`memcpy` processes the un-truncated lengthlength variable, resulting in memory corruption on the heap.

Key Concept

Integer Overflow and Heap Buffer Overflow
Question 1048Question

A security analyst confirms that an internal user workstation is infected with active malware that is attempting to communicate with an external command-and-control server. According to standard incident response lifecycle frameworks (such as NIST SP 800-61), which of the following actions should the analyst take immediately after confirming the incident?

Show answer & explanation

Answer: Isolate the compromised workstation from the local network segment.

Answer

Isolate the compromised workstation from the local network segment.
Isolating the affected system from the network is the essential initial containment step. It prevents lateral movement and external command-and-control communication while preserving system state for analysis.

Step-by-Step Solution

1
Identify the current phase of the Incident Response lifecycle.
The incident has just been confirmed during the Detection and Analysis phase.
Determining the current phase dictates the appropriate immediate objective.
2
Determine the next sequential phase in standard frameworks (such as NIST SP 800-61).
The immediate next phase is Containment, Eradication, and Recovery, beginning with Containment.
Containment limits the scope of damage and prevents the malware from spreading or exfiltrating data.
3
Select the action corresponding to containment.
Network isolation of the host isolates the threat while allowing further analysis.
Isolating the workstation stops network transmission without destroying volatile forensic evidence on the host.

Key Concept

Incident Response Lifecycle Phase Order (NIST SP 800-61)
Question 1049Question

During an incident response investigation involving suspected database exfiltration on a live cloud-hosted virtual server, a security analyst must preserve system evidence while maintaining strict chain of custody compliance for potential legal proceedings. Which of the following procedures should the analyst perform immediately following the acquisition of the system's volatile memory?

Show answer & explanation

Answer: Generate a cryptographic hash digest of the captured memory file and record the hash, timestamp, and analyst identity in the custody log.

Answer

Generate a cryptographic hash digest of the captured memory file and record the hash, timestamp, and analyst identity in the custody log.
In digital forensics, establishing evidence integrity requires calculating a cryptographic hash (e.g., SHA-256) immediately after image acquisition. Logging the resulting hash along with acquisition details, timestamps, and investigator credentials establishes a verified chain of custody ensuring the evidence remains untampered.

Step-by-Step Solution

1
Acquire volatile RAM image
Volatile evidence preserved from the live virtual instance.
RAM contains perishable artifacts such as active connections, running processes, and decrypted keys.
2
Generate a cryptographic hash of the memory image
Creates a unique digital fingerprint (e.g., SHA-256 checksum) of the original evidence file.
Establishes a baseline integrity reference to prove the evidence has not been modified.
3
Document transfer in the chain of custody log
Records date, time, practitioner identity, hardware details, and hash digest.
Ensures complete traceability and legal admissibility of evidence from collection through court presentation.

Key Concept

Forensic Evidence Integrity and Chain of Custody Documentation
Estimated Time:2m 0s
Question 1050Question

A security architect is designing an authentication framework for a native mobile application that authenticates users against an enterprise Identity Provider using OpenID Connect. Because native applications are public clients that cannot securely store a static client secret, the architect must mitigate the risk of authorization code interception attacks on the device operating system. Which mechanism should be integrated into the authorization code flow to address this vulnerability?

Show answer & explanation

Answer: Proof Key for Code Exchange (PKCE) to cryptographically bind the token request to the initial authorization request

Answer

Proof Key for Code Exchange (PKCE) to cryptographically bind the token request to the initial authorization request
Proof Key for Code Exchange (PKCE) is an extension to the OAuth 2.0 authorization code flow specifically created for public clients like native mobile apps. It dynamically generates a unique secret (code verifier) and sends a hashed version (code challenge) during the initial authorization request. When exchanging the authorization code for tokens, the app sends the original verifier. Because an eavesdropping app on the device lacks the verifier, intercepted authorization codes cannot be redeemed.

Step-by-Step Solution

1
Analyze the client type and architectural security boundary
Native mobile applications are public clients that cannot maintain confidentiality of static client secrets embedded within app code.
Identifying client security capabilities determines which OAuth 2.0 protocol extensions must be applied.
2
Identify the threat vector described in the enterprise scenario
Malicious local applications on the operating system can register custom URI schemes to intercept authorization codes returned by the browser redirect.
Understanding code interception dictates the need for a dynamic request-binding cryptographic mechanism.
3
Select the standard cryptographic extension designed for public client authorization flows
Proof Key for Code Exchange (PKCE) creates a high-entropy secret (code verifier) and sends its transformation (code challenge) during authorization, validating it at token exchange.
PKCE ensures that even if an authorization code is intercepted, an attacker cannot redeem it for access tokens without the original code verifier.

Key Concept

PKCE in OAuth 2.0 / OIDC IAM Architecture for Public Clients
Question 1051Question

An enterprise Incident Response Team (IRT) detects unauthorized DNS redirection caused by ARP cache poisoning on a critical core network segment. According to standard NIST SP 800-61 incident response frameworks, in what order should the incident response team execute the following operational response steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence follows the standard NIST incident response lifecycle: 1) Preserve evidence during Detection and Analysis, 2) Isolate the attack source during Containment, 3) Purge malicious tools and flush caches during Eradication, 4) Restore operations with monitoring during Recovery, and 5) Perform a lessons-learned review during Post-Incident Activity.
The standard incident response process requires systematically moving through Detection and Analysis (capturing volatile evidence), Containment (blocking rogue switch ports and applying static ARP mappings), Eradication (clearing poisoned ARP tables and deleting malicious scripts), Recovery (restoring standard network behavior under monitoring), and Post-Incident Activity (updating playbooks and holding a lessons-learned meeting).

Step-by-Step Solution

1
Detection & Analysis Evidence Preservation
Network packet captures and volatile RAM are safely preserved without disturbing system artifacts.
Forensic evidence preservation is critical before taking intrusive isolation actions that could alter volatile memory state.
2
Containment
The rogue device's switch port is disabled and static ARP mappings temporarily halt active man-in-the-middle redirection.
Immediate containment prevents further scope expansion and stops unauthorized traffic interception.
3
Eradication
Malicious ARP spoofing tools are removed from compromised systems, and poisoned ARP tables across subnet hosts are cleared.
Eradication eliminates the threat vector and removes corrupted state from the environment.
4
Recovery
Normal dynamic network services are restored while heightened traffic logging verifies system health.
Recovery safely returns infrastructure to operational status under close monitoring to detect any persistence.
5
Post-Incident Activity
A formal lessons learned report is drafted and Network Access Control (NAC) policies are updated.
Post-incident activities complete the lifecycle by enhancing organizational security posture against future attacks.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Phases
Question 1052Question

A security architect is evaluating resilience specifications for an enterprise infrastructure redesign. Match each business availability metric on the left with its corresponding definition on the right.

Click a left item, then click its matching right item

Items

Recovery Time Objective (RTO)
Recovery Point Objective (RPO)
Mean Time Between Failures (MTBF)
Mean Time To Repair (MTTR)

Matches

Show answer & explanation

Answer

Recovery Time Objective (RTO) matches the target duration of time within which a system must be restored. Recovery Point Objective (RPO) matches the maximum acceptable amount of data loss measured in time. Mean Time Between Failures (MTBF) matches the predicted elapsed operational time between failures. Mean Time To Repair (MTTR) matches the average time required to troubleshoot, fix, and restore a failed component.
Each availability metric directly matches its standard security architecture definition: RTO specifies target restoration duration, RPO specifies maximum allowable data loss window, MTBF calculates expected operational lifespan between failures, and MTTR measures repair turnaround time.

Step-by-Step Solution

1
Differentiate downtime metrics (RTO) from data loss metrics (RPO)
RTO focuses on elapsed time to restore service (downtime duration), whereas RPO focuses on point-in-time data tolerance (data loss window).
Business impact analyses rely on distinguishing system recovery duration from data backup currency.
2
Differentiate component reliability metrics (MTBF) from maintainability metrics (MTTR)
MTBF measures expected operational uptime between failures, while MTTR measures the time required to perform repair actions once a failure occurs.
Hardware resilience planning requires separating failure frequency expectations from maintenance restoration speeds.

Key Concept

High Availability and Resilience Business Metrics
Question 1053Question

An incident investigation team is analyzing correlated telemetry captured by an enterprise SIEM from an API Gateway (APIGW) and an Identity Provider (IDP):

text
2026-03-14T08:12:01Z [APIGW] src_ip=198.51.100.44 method=POST uri="/api/v1/auth/login" status=200 user="j_doe"
2026-03-14T08:12:05Z [IDP] user="j_doe" auth_method="MFA_TOTP" status="SUCCESS" src_ip=198.51.100.44
2026-03-14T08:12:12Z [APIGW] src_ip=198.51.100.44 method=GET uri="/api/v1/admin/export" status=403 user="j_doe" error="InsufficientPrivileges"
2026-03-14T08:12:18Z [APIGW] src_ip=198.51.100.44 method=POST uri="/api/v1/users/j_doe/roles" status=200 payload="{\"add_role\":\"GlobalAdmin\"}"
2026-03-14T08:12:25Z [APIGW] src_ip=198.51.100.44 method=GET uri="/api/v1/admin/export" status=200 user="j_doe" bytes_sent=4194304

Based on the log sequence above, which of the following security events occurred?

Show answer & explanation

Answer: The account successfully passed authentication but exploited a broken authorization control to elevate privileges and download restricted data.

Answer

The account successfully passed authentication but exploited a broken authorization control to elevate privileges and download restricted data.
The sequence of SIEM telemetry shows that the account successfully authenticated via multi-factor authentication, received an HTTP 403 Forbidden error when attempting to reach an admin endpoint, successfully issued a request to self-assign the 'GlobalAdmin' role, and subsequently retrieved data from the admin endpoint. This indicates a broken access control vulnerability permitting unauthorized privilege escalation.

Step-by-Step Solution

1
Analyze initial access telemetry
Timestamps 08:12:01Z and 08:12:05Z confirm identity verification (authentication) succeeded using primary credentials and MFA TOTP.
Establishing valid identity precedes assessing access permissions.
2
Evaluate the HTTP 403 response at 08:12:12Z
The user attempted to reach `/api/v1/admin/export` but received HTTP 403 (Forbidden) with `error="InsufficientPrivileges"`.
HTTP 403 demonstrates that while the identity is known, the authorization rule blocked access.
3
Trace privilege escalation and successful exfiltration
At 08:12:18Z, a POST request to `/api/v1/users/j_doe/roles` granted `GlobalAdmin` permissions, enabling the subsequent GET request at 08:12:25Z to return HTTP 200 and transmit 4,194,304 bytes.
Correlating timestamps reveals an unauthorized permission modification that bypassed proper administrative controls.

Key Concept

Distinguishing authentication from authorization failures during SIEM log correlation and identifying privilege escalation attacks.
Question 1054Question

A Security Operations Center (SOC) team is configuring an automated Endpoint Detection and Response (EDR) incident response workflow to handle host-based malicious script execution. In what sequence should the EDR platform execute the containment, mitigation, and post-incident investigation actions?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with initial detection, followed by host network isolation, active process termination and file quarantine, volatile forensic artifact collection, and finally deploying updated IOCs across the enterprise.
Effective EDR incident response relies on a structured sequence: detecting anomalous behavior triggers automated playbooks, network isolation prevents lateral movement while preserving volatile state, process termination and quarantine neutralize host impact, forensic data capture enables root-cause investigation, and enterprise-wide IOC deployment prevents repeat attacks.

Step-by-Step Solution

1
Detect malicious behavior to initiate response
Automated incident playbook is triggered upon rule match.
Containment workflows require an initial detection event or alert threshold.
2
Isolate host network interfaces
Host is logically isolated from network traffic except for the EDR management channel.
Prevents lateral movement across the network immediately without shutting down the system or losing volatile RAM evidence.
3
Terminate malicious process and quarantine binaries
Active threat execution on the endpoint is stopped.
Eliminates ongoing execution on the host while keeping host isolation active.
4
Perform forensic evidence collection
Volatile memory dumps and telemetry logs are extracted for investigation.
Evidence preservation and root-cause analysis can be conducted safely after active threats are contained.
5
Broaden protection across enterprise endpoints
Newly identified IOCs are deployed to all agents.
Ensures enterprise-wide immunity against similar attack vectors in future incidents.

Key Concept

EDR Incident Containment and Remediation Workflow
Question 1055Question

Following an EDR telemetry alert indicating an active credential-harvesting attempt on a Windows domain controller, a SOC analyst must execute an incident response procedure. In what sequence should the analyst execute the following actions to effectively contain the threat, preserve evidence, and remediate the endpoint?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of incident response steps is: Apply logical endpoint network isolation through the EDR console -> Acquire a volatile memory snapshot via live response -> Kill the malicious process tree -> Quarantine binary artifacts and remove persistence -> Release the endpoint from network isolation.
The response sequence follows standardized incident handling rules adapted for EDR capabilities. First, host network isolation is applied to halt C2 communications and lateral movement without severing the management channel. Second, volatile memory and telemetry must be collected while processes remain active to capture memory evidence. Third, the malicious process tree is killed to stop execution. Fourth, persistence mechanisms are purged and malicious binaries quarantined. Finally, network isolation is lifted after verifying the host is clean and compliant.

Step-by-Step Solution

1
Isolate the endpoint logically via EDR software controls
External C2 channels and lateral movement vectors are severed instantly, while the analyst retains full EDR remote command capabilities.
Containment must occur first to minimize damage and prevent attacker exfiltration or pivot operations.
2
Collect volatile RAM and process state telemetry
Critical evidence of in-memory credential harvesting is captured.
Volatile evidence must be captured prior to killing processes or altering system state, as terminating processes destroys in-memory artifacts.
3
Terminate the malicious process tree
Active execution of credential-harvesting code is halted.
Stopping malicious execution prevents further unauthorized activity on the endpoint.
4
Remediate host artifacts and persistence
Malicious files are quarantined and registry/scheduled task persistence mechanisms are purged.
Remediation ensures the threat cannot reactivate automatically when system services restart.
5
Restore host network access
The host resumes normal business operations.
Network access should only be restored after verification that all malicious elements are eradicated and baseline policies are active.

Key Concept

EDR Automated Containment and Sequential Incident Response Workflow
Question 1056Question

An incident responder is preparing to collect digital evidence from a powered-on corporate workstation suspected of compromise. According to standard forensic evidence collection guidelines (Order of Volatility), in what sequence should the responder capture the following components, from MOST volatile to LEAST volatile?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from most volatile to least volatile is: CPU registers and processor cache, System RAM (Random Access Memory), Pagefile / Swap space on the local drive, and Off-site archival backup tape.
Digital forensics principles dictate collecting evidence starting with the most fragile, transient data (CPU cache/registers), moving sequentially through dynamic main memory (RAM), temporary disk files (swap/pagefile), and ending with static offline media (archival tapes).

Step-by-Step Solution

1
Identify the storage locations that lose data almost instantaneously during system execution.
CPU registers and processor cache are prioritized first.
Processor registers and cache change constantly with every instruction cycle and are the most transient data sources.
2
Identify active main memory components that require continuous power.
System RAM is placed second.
Main physical RAM holds active network connections and process structures that disappear upon power loss.
3
Identify temporary virtual memory artifacts stored on persistent media.
Pagefile / Swap space is placed third.
Swap files exist on local hard drives or solid-state drives, making them persistent across reboots despite holding temporary memory structures.
4
Identify long-term static archival media.
Off-site archival backup tape is placed last as the least volatile.
Offline backup media retains data persistently over years without requiring power or active system interaction.

Key Concept

Order of Volatility in Digital Forensics
Question 1057Question

A security analyst is designing an automated threat intelligence integration strategy for an enterprise network. The strategy requires feeds that provide real-time, machine-readable indicators of compromise (IoCs) formatted for direct ingestion into edge firewalls and SIEM systems, as well as trusted sector-specific collaborative threat sharing. Which of the following intelligence sources or delivery mechanisms should the analyst select to meet these specific operational requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Commercial threat intelligence feeds delivered via Trusted Automated eXchange of Intelligence Information (TAXII); Information Sharing and Analysis Center (ISAC) feeds utilizing Automated Indicator Sharing (AIS)

Answer

The correct selections are Commercial threat intelligence feeds delivered via TAXII and Information Sharing and Analysis Center (ISAC) feeds utilizing Automated Indicator Sharing (AIS).
Commercial threat intelligence feeds delivered via TAXII and ISAC feeds utilizing AIS both provide structured, machine-readable threat data (such as STIX) that can be automatically ingested in real time by SIEMs and firewalls. Furthermore, ISACs fulfill the requirement for sector-specific peer intelligence sharing.

Step-by-Step Solution

1
Analyze requirement 1: Automated real-time machine-readable indicators of compromise (IoCs) for security devices.
Identify TAXII as the standardized transport protocol used to deliver structured threat intelligence (STIX) directly to SIEMs and firewalls.
TAXII automates the exchange of cyber threat information in machine-readable formats without human intervention.
2
Analyze requirement 2: Trusted sector-specific collaborative threat sharing among industry peers.
Identify ISACs and AIS as the organizational and technical framework built for industry-specific threat sharing.
ISACs facilitate sector-focused information sharing, while AIS provides the automated mechanism to distribute indicators among members.
3
Evaluate remaining options against the criteria.
Eliminate vulnerability databases (NVD), unstructured OSINT scraping, and manual dark web monitoring.
None of these options provide structured, low-latency, machine-readable IoC feeds designed for direct automated perimeter control updating.

Key Concept

Threat Intelligence Sources and Automated Sharing Protocols
Question 1058Question

Following the detection of suspicious command-and-control beaconing, an enterprise incident response team completes short-term network isolation of a compromised hypervisor host managing critical cloud workloads. The analyst verifies that lateral movement has been halted and containment boundaries are holding. According to standard NIST incident response lifecycle guidelines, which action should the incident response team execute NEXT before initiating eradication procedures?

Show answer & explanation

Answer: Acquire volatile memory dumps and cryptographic forensic images of the host to preserve digital evidence.

Answer

Acquire volatile memory dumps and cryptographic forensic images of the host to preserve digital evidence.
Under NIST SP 800-61 (Handling Computer Security Incidents), once an infected host is isolated to contain an incident, the team must preserve volatile memory (RAM) and generate forensic disk images before modifying host state. This ensures digital evidence is retained for root-cause analysis and potential legal proceedings prior to starting eradication.

Step-by-Step Solution

1
Identify the current phase in the NIST SP 800-61 Incident Response Lifecycle.
The scenario states that short-term network containment has just been successfully established.
Understanding the precise boundary within the Containment, Eradication, and Recovery phase dictates the sequential next step.
2
Determine the necessary sub-step prior to system modification or remediation.
Preserving volatile artifacts (RAM) and acquiring forensic disk images must occur while the system remains isolated.
Executing eradication or rebooting the host before memory acquisition destroys volatile evidence critical for forensic root-cause analysis.
3
Select the option aligned with evidence retention within the containment phase.
Capturing volatile memory and disk forensic images is the correct immediate action.
This maintains chain of custody and adheres to NIST IR playbook sequence rules.

Key Concept

NIST Incident Response Lifecycle (Containment & Evidence Preservation Order)
Question 1059Question

A university network engineering team is designing an architecture to secure a high-containment biomedical research laboratory. The lab contains unpatchable legacy telemetry devices that must transmit real-time experimental data to an on-premises database in the core enterprise data center, but must be prohibited from initiating or receiving any other traffic across the campus network or the internet. Which of the following network design configurations best achieves this isolation while mitigating lateral movement risks?

Show answer & explanation

Answer: Place the legacy devices on an isolated VLAN bounded by strict firewall policies that permit only outbound, single-port East-West traffic destined for the specific database IP address.

Answer

Placing the legacy devices on an isolated VLAN bounded by strict firewall policies that permit only outbound, single-port East-West traffic destined for the specific database IP address.
The correct option applies proper network segmentation principles by establishing an isolated VLAN for vulnerable legacy devices and restricting internal East-West traffic using strict firewall ACLs. Limiting communications exclusively to the database server IP and designated port enforces least privilege network access and blocks lateral movement.

Step-by-Step Solution

1
Analyze network isolation requirements for unpatchable legacy devices
Identified that legacy systems present high vulnerability risk and require strict restriction of network pathways.
Unpatchable endpoints cannot defend against modern exploits and must be restricted to minimal required functionality.
2
Evaluate traffic vector directionality and scope
Traffic flow is internal node-to-internal server (East-West traffic) requiring restricted destination and port enforcement.
North-South perimeter controls do not regulate traffic flowing between internal subnets or zones.
3
Select optimal segmentation topology
Isolated VLAN with explicit stateful firewall rules restricting all non-essential East-West communication.
Prevents unauthorized lateral movement across internal enterprise subnets while enabling necessary telemetry transmission.

Key Concept

Network Segmentation and East-West Traffic Filtering
Estimated Time:1m 30s
Question 1060Question

Following a high-severity alert indicating unauthorized root-level execution on a enterprise hypervisor server, a security analyst is assigned to preserve digital evidence from the active physical host. Which of the following initial steps must the analyst perform to preserve evidence integrity and adhere to forensic best practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Capture the running system's RAM and active network connections prior to acquiring persistent storage images; Calculate cryptographic hashes for all acquired evidence immediately after capture and document them in the chain of custody log

Answer

The analyst should capture the running system's RAM and active network connections before imaging persistent storage, and calculate cryptographic hashes immediately after acquisition while recording them in the chain of custody documentation.
Preserving volatile system memory and active network connections prior to persistent storage imaging correctly adheres to the forensic Order of Volatility. Generating cryptographic hashes immediately following acquisition and logging them in the chain of custody establishes verifiable evidence integrity.

Step-by-Step Solution

1
Identify and capture evidence according to the forensic Order of Volatility.
System RAM and active network sockets are preserved before non-volatile storage is touched.
Volatile data is lost as soon as system power state or process state changes.
2
Compute cryptographic checksums (e.g., SHA-256) for all collected memory dumps and storage images.
An baseline hash value is established for each evidence file.
Comparing hash values later verifies evidence integrity and proves no alterations occurred during transport or analysis.
3
Log all hash values, acquisition timestamps, and handler details into the chain of custody record.
A complete, legally defensible chain of custody record is maintained.
Forensic evidence requires unbroken documentation to remain admissible in legal or compliance proceedings.

Key Concept

Digital Forensics Order of Volatility and Chain of Custody Integrity Verification
PreviousPage 53 / 112Next
All practice questions — CompTIA Security+ | Examkin