All practice questions

2232 questions

All types2,232 Multiple choice1,151 Multiple select509 Numeric21 Matching378 Ordering173

An enterprise Security Information and Event Management (SIEM) pipeline is being configured to ingest, analyze, and respond to authentication anomalies across a hybrid environment. Place the following stages of the SIEM log processing pipeline in the correct sequential order from initial endpoint activity to final incident response.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order of stages in a SIEM log processing pipeline is: (1) Telemetry Collection, (2) Parsing and Extraction, (3) Data Normalization, (4) Event Correlation, and (5) Alerting and Orchestration.

The correct sequence mirrors the standard data lifecycle within a SIEM pipeline: Telemetry Collection gathers raw logs; Parsing extracts specific variables from text; Normalization standardizes field names across multi-vendor log sources; Correlation applies stateful detection logic across normalized events; and Alerting/Orchestration triggers notifications and automated response playbooks.

Step-by-Step Solution

Identify the entry point of event data into the log management pipeline.

Telemetry Collection is established as the initial stage where raw events are emitted and received.

Data must be gathered from endpoints, firewalls, and application servers before any processing can begin.

Determine how unstructured log payloads are converted into usable data fields.

Parsing and Extraction follows Collection.

Raw string messages (e.g., Syslog headers or Windows XML) must be broken down into discrete attributes such as IP addresses and event IDs.

Standardize variable attributes across multiple vendor platforms.

Data Normalization occurs after Parsing.

Mapping diverse vendor keys (e.g., 'src_ip' vs 'SourceAddress') to a unified schema is required so correlation rules can evaluate events uniformly.

Analyze structured, uniform data against security rule logic.

Event Correlation takes place post-normalization.

Correlation engines compare normalized telemetry against detection rules across time windows to detect multi-stage attacks.

Identify the response and notification phase resulting from correlation matches.

Alerting and Orchestration is the final stage.

Notifications, ticketing, and automated mitigation actions via SOAR occur only after rule logic identifies a verified threat condition.

Key Concept

SIEM Log Processing Pipeline

Question 1122Question →

During an incident investigation on a critical Linux application server, system administrators report that an attacker executed a fileless payload by injecting malicious code directly into the memory space of a legitimate running daemon. To hide their tracks, the attacker wiped the local bash history, deleted event logs from disk, and terminated the interactive shell session. Despite these anti-forensic measures, the Endpoint Detection and Response (EDR) agent successfully captured the complete process lineage, parent-child relationships, and exact memory allocation calls. Which of the following capabilities enabled the EDR agent to maintain continuous behavioral visibility in this scenario?

Kernel-level system event hooking and sensor callbacks that record process execution telemetry independently of local storage and user-space shells

Signature-based antivirus file scanning configured to perform real-time disk sanitization upon detecting unverified process memory allocations

Perimeter network firewall inspection that decrypts ingress NetFlow sessions and maps host sockets to network segment policies

Automated host vulnerability scanning that audits daemon configuration baselines and local file permissions against standard benchmarks

Show answer & explanation

Answer: Kernel-level system event hooking and sensor callbacks that record process execution telemetry independently of local storage and user-space shells

Answer

Kernel-level system event hooking and sensor callbacks that record process execution telemetry independently of local storage and user-space shells

The correct response highlights kernel-level event hooking and sensor callbacks. Modern EDR solutions install lightweight sensors that integrate deeply with the operating system kernel. These sensors capture execution events, thread creation, memory allocations, and process tree relationships in real time as they occur in memory. Because telemetry is transmitted continuously to an isolated monitoring collector, local anti-forensic actions—such as clearing bash histories or deleting log files from disk—have no effect on the agent's recorded process history.

Step-by-Step Solution

Analyze the attack techniques and anti-forensic steps in the scenario.

The attack involves fileless execution (in-memory code injection into a daemon process) accompanied by anti-forensic techniques (wiping local bash history and disk logs).

Identifying the nature of the attack reveals why traditional disk-based or log-file-dependent controls fail.

Evaluate how Endpoint Detection and Response (EDR) captures telemetry during fileless execution.

EDR agents operate sensor drivers at the operating system kernel level (e.g., eBPF in Linux, OS kernel callbacks) to continuously observe process calls, API hooks, and memory allocations in real time.

Kernel hooks sit below user-space applications and disk storage, ensuring telemetry stream generation cannot be disabled or erased by user-space log wiping.

Select the choice that correctly describes this EDR mechanism.

Kernel-level system event hooking provides real-time, independent telemetry capture unaffected by disk log destruction.

This directly matches the technical requirement for tracking fileless process lineage.

Key Concept

Kernel-Level EDR Telemetry and Fileless Threat Visibility

Question 1123Question →

A security analyst is reviewing the following web server access log snippet captured by an enterprise SIEM during a routine alert review:

192.168.1.45 - - [27/Jul/2026:14:32:10 +0000] "GET /login.php HTTP/1.1" 200 4502
192.168.1.45 - - [27/Jul/2026:14:32:12 +0000] "POST /login.php HTTP/1.1" 401 1240
192.168.1.45 - - [27/Jul/2026:14:32:15 +0000] "POST /login.php HTTP/1.1" 401 1240
192.168.1.45 - - [27/Jul/2026:14:32:18 +0000] "POST /login.php HTTP/1.1" 200 5830
192.168.1.45 - - [27/Jul/2026:14:32:25 +0000] "GET /admin/db_export.php?id=1%20OR%201=1 HTTP/1.1" 403 342

Based on the web server log snippet provided, which of the following statements correctly interprets the sequence of security events?

The client successfully authenticated after two failed attempts, but was subsequently blocked by authorization controls when requesting an administrative resource.

The client failed to authenticate to the server because the final request returned a credential failure status code.

The log telemetry indicates that the client successfully executed a stored cross-site scripting attack against the database endpoint.

The SIEM correlation rule misidentified the traffic because the timestamps indicate out-of-order packet delivery without any valid login session.

Show answer & explanation

Answer: The client successfully authenticated after two failed attempts, but was subsequently blocked by authorization controls when requesting an administrative resource.

Answer

The client successfully authenticated after two failed attempts, but was subsequently blocked by authorization controls when requesting an administrative resource.

The log entries record two failed authentication attempts (HTTP 401) followed by a successful login response (HTTP 200). Subsequently, the client attempted to access an administrative endpoint containing a SQL injection syntax pattern, which triggered an HTTP 403 Forbidden response. HTTP 403 demonstrates that authorization controls effectively restricted access to the protected administrative resource.

Step-by-Step Solution

Analyze HTTP response status codes for authentication requests

Two consecutive POST requests to /login.php returned HTTP 401 (Unauthorized), followed by a third POST request returning HTTP 200 (OK).

HTTP 401 indicates failed identity verification (authentication failure), whereas HTTP 200 confirms successful authentication.

Examine post-authentication request payload and response status code

The request to /admin/db_export.php included a SQL injection pattern (id=1 OR 1=1) and returned HTTP 403 (Forbidden).

HTTP 403 confirms that the user was authenticated but lacked authorization permissions to access the administrative resource.

Key Concept

Log analysis and correlation of HTTP status codes to differentiate between authentication failures (HTTP 401) and authorization denials (HTTP 403).

Estimated Time:1m 30s

Question 1124Question →

A security analyst needs to assess internal enterprise workstations for missing operating system patches and local configuration weaknesses without sending administrative credentials across the network during the scan. Which of the following scanning methods should the analyst deploy to achieve this goal?

Agent-based vulnerability scanning

Non-credentialed network vulnerability scanning

Passive network traffic monitoring

Web application vulnerability scanning

Show answer & explanation

Answer: Agent-based vulnerability scanning

Answer

Agent-based vulnerability scanning provides direct host-level visibility into missing patches and local configurations without requiring administrative credentials over the network.

Agent-based scanning installs a lightweight agent directly on target endpoints. Because the agent runs locally within the operating system, it can thoroughly audit installed updates, local registry keys, and software configurations without transmitting domain or host credentials over the network.

Step-by-Step Solution

Identify the primary assessment requirements.

The target environment requires host-level patch inspection without transmitting elevated network authentication credentials.

Transmitting administrative credentials over network segments introduces unnecessary security risk.

Compare scanning implementation architectures.

Agent-based scanners run locally with elevated host permissions, retrieving accurate patch data without relying on network authentication protocols.

Local agents execute internal checks directly on the endpoint and transmit encrypted findings back to a management console.

Key Concept

Agent-based vs. network-based vulnerability scanning

Question 1125Question →

A Security Operations Center (SOC) team is responding to a fileless attack on an enterprise server, where an adversary is executing malicious commands directly in RAM by abusing legitimate process handles spawned by a web daemon. The SOC analyst must leverage Endpoint Detection and Response (EDR) platform capabilities to detect ongoing malicious behavior and execute host containment without destroying volatile RAM evidence. Which of the following actions should the analyst implement using the EDR solution? (Select TWO.)

Select all that apply

Enable process lineage tracking and behavioral monitoring to analyze parent-child process relationships and API execution patterns in real time.

Execute software-based host isolation through the EDR agent to quarantine the server from network communication while keeping system power on.

Update edge perimeter firewall Access Control Lists to block incoming IP traffic destined for the web daemon service.

Initiate an automated system reboot and immediately restore the operating system from a pristine golden disk image.

Show answer & explanation

Answer: Enable process lineage tracking and behavioral monitoring to analyze parent-child process relationships and API execution patterns in real time.; Execute software-based host isolation through the EDR agent to quarantine the server from network communication while keeping system power on.

Answer

The analyst should enable process lineage tracking and behavioral monitoring to identify anomalous in-memory process execution, and perform host-level isolation via the EDR agent to cut network communications while preserving volatile RAM.

Process lineage tracking provides real-time visibility into process tree creation and API activity, allowing SOC analysts to identify unauthorized command shells spawned in RAM by web services. Host isolation issued via EDR disconnects network interface communications while keeping the machine powered, effectively halting lateral movement and C2 traffic while preserving volatile RAM for incident response forensics.

Step-by-Step Solution

Identify the EDR detection mechanism suitable for fileless memory execution.

Process lineage and API telemetry capture parent-child execution paths, revealing malicious sub-processes launched by web daemons.

Fileless memory attacks bypass traditional static file signatures, necessitating behavioral process tracing.

Select the host containment method that preserves volatile system state.

Host-level software network isolation quarantines network interfaces at the OS driver level while leaving power intact.

Host isolation blocks lateral movement and C2 traffic without clearing volatile RAM evidence needed for forensic investigation.

Evaluate invalid distractor controls against incident response principles.

Perimeter network rules fail to contain internal host actions, and rebooting wipes RAM prior to evidence collection.

Incident response workflows require host isolation before eradication and recovery activities.

Key Concept

EDR Behavioral Telemetry & Host-Level Network Isolation

Question 1126Question →

Match each enterprise system hardening control to its primary technical mitigation objective.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Disabling Unused OS Services matches minimizing the host attack surface; Application Allowlisting matches preventing unauthorized binaries from running; Automated Patch Management matches removing known software flaws (CVEs); and UEFI Secure Boot matches ensuring root-of-trust integrity during startup.

Each hardening control maps directly to its intended technical outcome: disabling services reduces exposed host attack surface, application allowlisting prevents unauthorized code execution, automated patch management fixes known security bugs (CVEs), and UEFI Secure Boot maintains cryptographic boot integrity against bootkits.

Step-by-Step Solution

Analyze host attack surface reduction controls.

Identify that turning off unneeded network services and ports eliminates potential avenues for remote exploitation.

Deactivating unused network endpoints directly minimizes host exposure.

Evaluate executable binary control mechanisms.

Connect application allowlisting with policies that enforce explicitly trusted executables and scripts.

Allowlisting prevents unauthorized binary execution even if malicious files are downloaded to disk.

Assess vulnerability lifecycle remediation.

Link automated patch deployment to addressing publicly reported vulnerabilities.

Patch management updates software binaries to resolve known coding defects (CVEs).

Examine pre-boot integrity verification controls.

Associate UEFI Secure Boot with verifying digital signatures of boot components prior to operating system initialization.

Secure Boot prevents rootkits and untrusted drivers from loading into memory before security software initializes.

Key Concept

Enterprise Host Hardening and Security Controls

Question 1127Question →

A regional healthcare network is redesigning its infrastructure to align with Zero Trust Architecture (ZTA) principles for biomedical IoT equipment, such as infusion pumps and vital sign monitors. Historically, once a biomedical device successfully completed initial 802.1X authentication on an internal switch port, it was granted persistent trust and unmonitored network access to servers containing electronic health records (EHR). Which of the following implementations best fulfills the Zero Trust requirement for resource access control in this scenario?

Positioning a Policy Enforcement Point (PEP) to gate all access requests and dynamically enforce decisions made by the Policy Engine based on continuous assessment of device state and context.

Configuring core network switches to automatically grant full internal network trust to any MAC address that completes port-level authentication successfully.

Issuing long-lived client certificates to devices so initial identity verification grants perpetual authorization for all subsequent API requests.

Deploying signature-based network intrusion prevention rules at the perimeter firewall to inspect incoming external web traffic.

Show answer & explanation

Answer: Positioning a Policy Enforcement Point (PEP) to gate all access requests and dynamically enforce decisions made by the Policy Engine based on continuous assessment of device state and context.

Answer

Positioning a Policy Enforcement Point (PEP) to gate all access requests and dynamically enforce decisions made by the Policy Engine based on continuous assessment of device state and context.

The core tenets of Zero Trust Architecture (as defined in NIST SP 800-207) mandate that all communication is secured regardless of network location, access to resources is granted on a per-session basis, and access rights are determined dynamically by a Policy Engine and enforced by a Policy Enforcement Point (PEP). Implementing a PEP to gate resource requests based on continuous evaluation of device health and context fulfills these requirements.

Step-by-Step Solution

Analyze the legacy architecture vulnerability in the scenario.

The current model relies on implicit trust following an initial port-level authentication check.

Zero Trust assumes breach and dictates that no device or traffic flow should be implicitly trusted based on its network location or prior authentication.

Evaluate Zero Trust Architecture architectural components (NIST SP 800-207).

Access decisions must be evaluated by a Policy Engine/Policy Administrator (Policy Decision Point) and enforced per request by a Policy Enforcement Point (PEP).

Every resource request must be explicitly verified, evaluating device posture, user context, and transaction threat level before granting access.

Identify the option that enforces continuous explicit verification and PEP placement.

The approach placing a PEP to gate requests based on dynamic evaluation by the Policy Engine directly aligns with ZTA requirements.

This guarantees microsegmentation, explicit verification, and continuous risk assessment.

Key Concept

Zero Trust Policy Decision Point (PDP) and Policy Enforcement Point (PEP) Architecture

Question 1128Question →

An organization discovers that an exposed API key associated with a cloud storage container was leaked on a public repository, allowing unauthorized external downloading of sensitive customer backups. Place the following incident response workflow steps in the correct chronological order according to standard incident handling frameworks.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order of the incident response workflow is: (1) Analyze cloud audit logs to confirm scope, (2) Revoke the exposed API key and restrict storage access, (3) Rotate service accounts and purge unauthorized persistence, (4) Restore normal bucket operations and monitor access, and (5) Conduct an after-action review to update playbooks.

According to NIST SP 800-61 incident response guidelines, response follows a defined sequence: Detection & Analysis (analyzing cloud logs to determine scope), Containment (revoking the leaked key and restricting bucket permissions), Eradication (rotating service accounts and remediating access vulnerabilities), Recovery (restoring production access with monitoring), and Post-Incident Activity (conducting an after-action review).

Step-by-Step Solution

Detection & Analysis

Confirm leak details, identify compromised credentials, and establish incident scope.

Accurate scope assessment is necessary prior to implementing targeted containment measures.

Containment

Revoke leaked access keys and block further unauthorized data downloads.

Immediate containment stops ongoing exfiltration and mitigates risk to enterprise assets.

Eradication

Remove invalid credentials and remediate security posture weaknesses.

Eradication eliminates root threat components from the environment.

Recovery

Return systems to clean operational state under heightened monitoring.

Recovery ensures secure operational continuity.

Post-Incident Activity

Document lessons learned and update operational security playbooks.

Post-incident review improves future incident response capabilities and controls.

Key Concept

NIST Incident Response Lifecycle Phases (Detection/Analysis -> Containment -> Eradication -> Recovery -> Post-Incident Activity)

Question 1129Question →

A tier-2 incident response analyst investigating an alert observes an unknown binary executing child processes that modify critical system registry keys and initiate outbound command-and-control (C2) traffic over non-standard ports on a remote workstation. To immediately prevent lateral movement across the internal subnet while retaining live telemetry, remote command shell access, and memory inspection capability via the agent console, which action should the analyst take?

Initiate agent-based host isolation on the affected endpoint through the EDR platform console.

Terminate the parent binary process and immediately issue a remote system reboot script.

Update perimeter firewall rules to block the remote IP address and non-standard port identified in the alert.

Reclassify the enterprise EDR agent policy setting from a detective control mode to a passive auditing control mode.

Show answer & explanation

Answer: Initiate agent-based host isolation on the affected endpoint through the EDR platform console.

Answer

Initiate agent-based host isolation on the affected endpoint through the EDR platform console.

Host isolation implemented directly by the EDR agent restricts all inbound and outbound host network communications except for the dedicated control channel between the agent and the EDR management console. This effectively neutralizes lateral movement and command-and-control communication while preserving volatile RAM state and allowing SOC analysts to run commands, extract memory, and execute playbooks remotely.

Step-by-Step Solution

Analyze the incident requirements

The analyst must mitigate lateral movement across the internal network while keeping management channels open for memory investigation and live triage.

Standard network block options kill remote management, while doing nothing permits adversary lateral propagation.

Evaluate EDR containment capabilities

Host isolation (also known as endpoint network isolation) cuts off peer-to-peer and general outbound network access on the endpoint while maintaining an encrypted tunnel back to the EDR cloud or management platform.

This specific capability meets both operational demands: isolation from internal assets and continued analyst access.

Select the optimal response action

Applying agent-based host isolation fulfills all scenario requirements without destroying volatile system memory state.

It stops lateral movement immediately without requiring physical disconnection or network infrastructure changes.

Key Concept

Endpoint Detection and Response Host Isolation

Estimated Time:2m 0s

Question 1130Question →

A security team conducts an audit on a cloud-native microservices application and identifies two critical software defects in the API gateway:

1. An endpoint accepts user-supplied URL parameters to fetch remote image assets, allowing an attacker to compel the server to send HTTP requests to internal cloud metadata IP addresses ( $169.254.169.254$ ).
2. Logged-in users can view and update other customers' private profile records simply by altering an account ID integer in the request parameters.

Which of the following vulnerability classifications and remediation strategies correctly address these security findings? (Select TWO).

Select all that apply

The issue involving forced internal request generation is Server-Side Request Forgery (SSRF), which should be remediated by implementing strict URL allowlists and blocking access to cloud metadata IP addresses.

The issue involving unauthorized access via modified parameter identifiers is an Insecure Direct Object Reference (IDOR), which should be remediated by enforcing server-side object-level authorization checks.

The parameter manipulation issue is caused by a missing authentication control, which should be resolved by prompting users to re-enter credentials before processing profile updates.

Deploying a perimeter stateful network firewall is the primary code-level control required to neutralize the server-initiated HTTP request vulnerability.

Show answer & explanation

Answer: The issue involving forced internal request generation is Server-Side Request Forgery (SSRF), which should be remediated by implementing strict URL allowlists and blocking access to cloud metadata IP addresses.; The issue involving unauthorized access via modified parameter identifiers is an Insecure Direct Object Reference (IDOR), which should be remediated by enforcing server-side object-level authorization checks.

Answer

The findings represent Server-Side Request Forgery (SSRF), which requires URL allowlisting and blocking metadata IP addresses, and Insecure Direct Object Reference (IDOR), which requires enforcing server-side object-level authorization checks.

The first defect allows an attacker to manipulate server-initiated requests to internal infrastructure (such as cloud instance metadata services), defining Server-Side Request Forgery (SSRF). Effective remediation requires URL allowlisting and restricting access to internal IP ranges. The second defect allows authenticated users to access resources belonging to others by modifying record identifiers, defining Insecure Direct Object Reference (IDOR). Effective remediation requires enforcing object-level authorization checks on the server.

Step-by-Step Solution

Analyze finding 1 involving server-initiated HTTP requests to internal metadata IP addresses.

Identify the flaw as Server-Side Request Forgery (SSRF) because the web application acts as a proxy to send requests to untrusted or internal destinations.

SSRF occurs when an attacker manipulates parameters to make the server initiate requests to unintended internal network locations.

Analyze finding 2 involving manipulation of account ID integers in request parameters.

Identify the flaw as Insecure Direct Object Reference (IDOR) / Broken Object Level Authorization (BOLA).

IDOR occurs when user input directly references database keys or file paths without server-side validation of object ownership.

Evaluate appropriate remediation techniques for both identified vulnerabilities.

SSRF requires restricting target domains/IPs via URL allowlisting and blocking internal endpoints like

169.254.169.254

. IDOR requires server-side access control checks verifying object-level authorization.

Secure application design requires input restriction for outbound requests and context-aware authorization for data access.

Key Concept

Application Vulnerability Identification and Remediation (SSRF and IDOR/BOLA)

Question 1131Question →

A Security Operations Center analyst investigates a network intrusion detection system (NIDS) alert generated by telemetry from an internal application gateway servicing database queries. The raw payload captured in the monitoring alert log reads as follows:

http
POST /api/v1/query HTTP/1.1
Host: dbgateway.internal.net
User-Agent: CustomClient/2.4
Content-Type: application/x-www-form-urlencoded
Payload: account_id=1092%27+OR+%271%27%3D%271&session_token=8f9a2b

The security monitoring dashboard erroneously categorized this incident as a client-side Cross-Site Scripting (XSS) event and initiated an automated ticket to update client browser security policies. Based on the network telemetry provided, which of the following response and remediation measures should the analyst take? (Select TWO).

Select all that apply

Reclassify the alert within the SIEM as a server-side SQL injection attempt and adjust signature parsing rules for encoded database attack patterns.

Deploy or tune an inline Web Application Firewall (WAF) to inspect application-layer HTTP POST parameters for database manipulation strings.

Enforce Document Object Model (DOM) sanitization policies across endpoints to block script execution in browser environments.

Reconfigure perimeter deception honeypots to operate inline directly on the API gateway segment to filter out malicious network packets.

Show answer & explanation

Answer: Reclassify the alert within the SIEM as a server-side SQL injection attempt and adjust signature parsing rules for encoded database attack patterns.; Deploy or tune an inline Web Application Firewall (WAF) to inspect application-layer HTTP POST parameters for database manipulation strings.

Answer

The analyst should reclassify the event as a server-side SQL injection attempt while adjusting NIDS parsing signatures, and implement or tune a Web Application Firewall (WAF) to inspect HTTP POST application parameters.

The captured HTTP POST payload contains the URL-encoded sequence `%27+OR+%271%27%3D%271`, which decodes to `' OR '1'='1`. This syntax is a classic SQL injection vector targeting backend database logic rather than client-side script execution. Consequently, the analyst must reclassify the SIEM alert to reflect a server-side SQL injection attack and update NIDS detection rules. Additionally, implementing or tuning a Web Application Firewall (WAF) provides the necessary application-layer (Layer 7) packet inspection to block malicious SQL parameters prior to reaching backend gateways.

Step-by-Step Solution

Analyze the URL-encoded payload contained within the network monitoring alert.

Decoded payload `%27+OR+%271%27%3D%271` translates to `' OR '1'='1`, which is a standard SQL injection pattern intended to bypass authentication or database query boundaries.

Accurate alert interpretation prevents misdirected incident response procedures.

Identify the incorrect SIEM alert classification and remediation directive.

The dashboard misclassified a server-side database injection attempt as a client-side Cross-Site Scripting (XSS) attack.

Updating SIEM correlation rules and NIDS signatures ensures proper alert triage and future signature matching accuracy.

Select the appropriate network security control to block web application database attacks.

A Web Application Firewall (WAF) provides Layer 7 payload inspection capabilities to detect and drop SQL injection attempts in real time.

Standard network-level firewalls or deception systems (honeypots) do not function as inline application payload filters.

Key Concept

Network Security Alert Analysis and Application Layer Control Selection

Question 1132Question →

An organization is updating its enterprise access architecture to grant external partner employees access to web applications hosted in a private cloud. The security team requires a federated identity solution that allows partners to authenticate using their own Identity Provider (IdP) and transmit digitally signed XML security assertions to the relying application without syncing credentials or exposing internal directory endpoints. Which of the following identity standards should the security team implement?

Security Assertion Markup Language (SAML)

Remote Authentication Dial-In User Service (RADIUS)

Lightweight Directory Access Protocol over TLS (LDAPS)

Kerberos with cross-realm trust

Show answer & explanation

Answer: Security Assertion Markup Language (SAML)

Answer

Security Assertion Markup Language (SAML) is the correct selection because it uses digitally signed XML tokens transmitted over HTTP to establish cross-organizational web single sign-on without sharing account passwords.

Security Assertion Markup Language (SAML) is the standard protocol for web-based federated single sign-on (SSO). It allows an Identity Provider (IdP) to authenticate a user and securely pass digitally signed XML security assertions to a Service Provider (SP) via standard HTTP browser redirections, enabling secure cross-organizational access without sharing or synchronizing user credentials.

Step-by-Step Solution

Analyze the functional requirements of the identity architecture scenario.

The scenario requires cross-organizational federation, web application support, use of digitally signed XML assertions, and zero user credential synchronization.

Identifying protocol requirements filters out legacy network AAA and centralized directory query protocols.

Evaluate candidate protocols against XML assertion and web federation criteria.

SAML (Security Assertion Markup Language) specifically uses XML formatted security assertions generated by an IdP to authorize user sessions at a Service Provider.

SAML is the standard open format for browser-based federated SSO utilizing XML payloads.

Key Concept

Federated Identity Architecture and Web Single Sign-On (SAML)

Estimated Time:1m 0s

Question 1133Question →

A Security Operations Center (SOC) analyst receives a high-severity alert showing that an automated ransomware script is actively executing on an enterprise endpoint and encrypting shared network folders. The analyst confirms the active file encryption via endpoint telemetry. According to standard incident response frameworks, which of the following actions should the analyst take FIRST?

Isolate the compromised endpoint from the network by disabling its network adapter.

Reimage the system hard drive and restore files from the most recent offline backup.

Modify enterprise group policies to prevent PowerShell script execution across all domain workstations.

Convene an incident response review meeting with executive leadership to complete a lessons-learned report.

Show answer & explanation

Answer: Isolate the compromised endpoint from the network by disabling its network adapter.

Answer

Isolate the compromised endpoint from the network by disabling its network adapter.

In accordance with standard incident response playbooks (such as NIST SP 800-61), containment must occur immediately after an active incident is confirmed to prevent further damage or data loss. Isolating the infected host from the network stops the ransomware from communicating with Command & Control (C2) servers and encrypting additional network resources while preserving the system state for forensic investigation.

Step-by-Step Solution

Identify the current incident response phase based on the scenario.

The scenario describes an ongoing attack actively spreading across network shares (Detection & Analysis moving into Containment).

Determining the correct phase ensures actions follow the NIST/ISO Incident Response Life Cycle.

Determine the primary immediate objective during active ransomware propagation.

The immediate objective is containment—stopping the ransomware from reaching additional hosts or shared drives.

Containment limits the scope and blast radius of the security incident.

Select the option that achieves immediate containment without destroying volatile forensic evidence.

Network isolation stops network activity while leaving volatile system memory intact for analysis.

Network isolation is the standard first containment step in playbooks for active network-aware malware.

Key Concept

Incident Response Lifecycle Phases and Containment Strategy

Estimated Time:1m 15s

Question 1134Question →

A security administrator is establishing a SIEM log handling pipeline for enterprise endpoint and network telemetry. Place the following stages of SIEM log processing in the correct sequential order, starting from the initial arrival of raw security telemetry to final analyst notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of SIEM log processing stages from ingestion to response is: Log Data Collection, Parsing and Field Normalization, Data Indexing and Storage, Event Correlation Engine Processing, and Alert Generation and Incident Dispatch.

The standard SIEM data pipeline follows a strict logical workflow: raw telemetry is collected from endpoints and network devices (Log Data Collection), converted into a unified structure (Parsing and Field Normalization), stored with fast retrieval keys (Data Indexing and Storage), evaluated across sources against security logic (Event Correlation Engine Processing), and finally escalated to analysts when malicious conditions are matched (Alert Generation and Incident Dispatch).

Step-by-Step Solution

Identify the ingress stage of raw log telemetry.

Log Data Collection occurs first as telemetry is gathered from diverse source devices.

Raw logs cannot be processed, searched, or analyzed before they are gathered by SIEM agents or collectors.

Determine how diverse log formats are converted into standardized fields.

Parsing and Field Normalization immediately follows log collection.

Different operating systems and applications format logs differently; normalization translates raw strings into common fields like source IP, destination IP, and event ID.

Identify how processed logs are prepared for rapid search and retention.

Data Indexing and Storage is applied to normalized log records.

Indexing creates fast lookup structures so complex queries and correlation algorithms can run efficiently over high-volume data.

Analyze how pattern detection occurs across stored events.

Event Correlation Engine Processing evaluates indexed data against defined logic.

Correlation requires access to structured, indexed events to match multi-event patterns across disparate log sources.

Determine the final output stage triggering analyst workflow.

Alert Generation and Incident Dispatch occurs after correlation logic flags suspicious behavior.

Alerts are generated only after correlation logic successfully detects a policy violation or threat indicator.

Key Concept

SIEM Log Processing Pipeline

Question 1135Question →

During an ongoing threat hunting investigation within a Linux database cluster, an automated Endpoint Detection and Response (EDR) agent alerts on suspicious ptrace system calls initiating in-memory execution of anonymous memory segments from an unprivileged web server process. To immediately mitigate lateral movement and preserve essential volatile evidence for detailed analysis, which TWO of the following actions should the SOC analyst initiate directly through the EDR management platform? (Select TWO.)

Select all that apply

Enable software-based host network isolation while preserving persistent administrative agent command-and-control channels.

Trigger remote volatile memory acquisition and endpoint telemetry log collection before terminating suspect process lineages.

Reconfigure edge network firewall access control lists (ACLs) to drop inbound traffic destined for internal database subnets.

Deploy a SOAR playbook that executes an immediate hard system reboot across all cluster nodes upon alert trigger.

Show answer & explanation

Answer: Enable software-based host network isolation while preserving persistent administrative agent command-and-control channels.; Trigger remote volatile memory acquisition and endpoint telemetry log collection before terminating suspect process lineages.

Answer

The SOC analyst should enable software-based host network isolation while maintaining EDR agent management connectivity, and trigger remote volatile memory acquisition alongside telemetry log collection before terminating processes.

Enabling host network isolation directly through the EDR agent isolates network adapters to halt lateral movement while preserving the out-of-band management link. Simultaneously acquiring volatile RAM evidence before killing suspect processes ensures forensic artifacts associated with fileless memory injection are retained intact.

Step-by-Step Solution

Isolate the compromised host at the endpoint software layer using EDR network containment.

Network traffic to and from the host is restricted to prevent lateral propagation while keeping management channels alive.

Prevents attacker movement while allowing security analysts to conduct remote investigation.

Perform remote volatile memory (RAM) and endpoint process telemetry acquisition.

In-memory fileless payloads and execution artifacts are captured prior to process disruption.

Preserves transient evidence following proper digital forensic order of volatility.

Key Concept

Endpoint Detection and Response (EDR) Host Containment and Volatile Evidence Preservation

Question 1136Question →

A Security Operations Center (SOC) analyst is investigating a high-severity alert triggered by a SIEM correlation rule on an enterprise Linux server. The log stream displays the following chronologically ordered events:

text
Jul 27 14:15:02 auth-srv pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.51.100.45 user=root
Jul 27 14:15:05 auth-srv pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.51.100.45 user=root
Jul 27 14:15:09 auth-srv sshd[4102]: Accepted password for deploy_admin from 198.51.100.45 port 52144 ssh2
Jul 27 14:15:22 auth-srv sudo: deploy_admin : TTY=pts/1 ; PWD=/home/deploy_admin ; USER=root ; COMMAND=/usr/bin/useradd -m -g sudo backdoor_admin

Which of the following security incidents is most accurately indicated by this log telemetry?

A successful password-guessing attack against a valid user account followed by unauthorized administrative privilege escalation and local user creation.

A Cross-Site Scripting (XSS) attack that injected malicious client-side scripts into the PAM authentication service to bypass user credentials.

An authorization boundary failure where the system granted root shell access without first completing identity verification.

A SIEM correlation rule misinterpretation caused by log collection tools classifying failed logins as a preventive firewall block action.

Show answer & explanation

Answer: A successful password-guessing attack against a valid user account followed by unauthorized administrative privilege escalation and local user creation.

Answer

The log telemetry indicates a successful password-guessing attack against a valid user account followed by unauthorized administrative privilege escalation and local user creation.

The correct answer accurately synthesizes the event sequence across multiple host log entries. The initial entries demonstrate automated password guessing (brute force) targeting the root user from IP 198.51.100.45. Shortly after, the attacker successfully authenticates into the deploy_admin user account from the same IP address. Once logged in, the attacker executes a sudo command to create a new local account named backdoor_admin with administrative privileges, which represents post-exploitation activity.

Step-by-Step Solution

Analyze the authentication failure logs

Identified two failed SSH authentication attempts for the root user from source IP address 198.51.100.45 within a 3-second window.

Rapid sequential failed login attempts from a single IP indicate credential brute-forcing or password guessing.

Analyze the successful authentication log entry

Observed an accepted SSH password login for user deploy_admin four seconds later from the exact same source IP (198.51.100.45).

Correlation of the source IP connects the initial failed guessing attempts with the subsequent successful login into a valid account.

Evaluate the post-authentication command log entry

Determined that deploy_admin used sudo to run useradd with root privileges to create a new user named backdoor_admin.

Executing privileged commands immediately after a suspicious authentication event points to post-exploitation activity and privilege escalation.

Key Concept

SIEM Multi-Source Telemetry Correlation & Log Analysis

Question 1137Question →

A global telecommunications enterprise is migrating its remote network maintenance infrastructure to align with Zero Trust Architecture (ZTA) principles. Field engineers require frequent administrative access to edge router control planes located across dispersed datacenters. Which of the following architectural requirements must be satisfied to uphold core Zero Trust tenets? (Select TWO.)

Select all that apply

Continuous verification of user identity, device posture, and contextual risk factors throughout the duration of each administrative session.

Microsegmentation and least-privilege policy enforcement applied strictly at the individual resource boundary.

Implicit trust granted to all traffic originating within the internal management network once authenticated through the perimeter gateway.

Replacing application-level access authorization controls entirely with static IP-based packet filtering rules at external firewalls.

Show answer & explanation

Answer: Continuous verification of user identity, device posture, and contextual risk factors throughout the duration of each administrative session.; Microsegmentation and least-privilege policy enforcement applied strictly at the individual resource boundary.

Answer

The correct requirements are continuous verification of user identity, device posture, and contextual risk factors throughout each session, as well as microsegmentation and least-privilege policy enforcement applied strictly at the individual resource boundary.

Zero Trust Architecture mandates explicit, continuous verification of identity, device health, and environmental context throughout the duration of a session, combined with microsegmentation and least-privilege access to minimize lateral movement.

Step-by-Step Solution

Analyze the scenario against Zero Trust Architecture core principles.

Zero Trust requires explicit verification, assumed breach mindset, continuous evaluation, and least-privilege access regardless of network location.

Traditional perimeter security models that implicitly trust internal network traffic fail to mitigate lateral threat movement.

Evaluate the requirement for continuous authentication and contextual authorization.

Session access must be continually evaluated using identity, endpoint posture, and contextual risk signals.

Initial authentication alone is insufficient because device risk posture or user context can change during an active session.

Evaluate the requirement for network control boundaries.

Enforcing microsegmentation and resource-level access control limits blast radius and enforces least privilege.

Granular resource-level boundaries prevent lateral movement across enterprise segments.

Key Concept

Zero Trust Architecture Principles (Continuous Verification & Microsegmentation)

Question 1138Question →

A system administrator needs to deploy a security control to enterprise endpoints that continuously monitors local host activity, logs process execution lineage, and enables immediate network isolation of compromised devices. Which of the following security solutions best meets these requirements?

Endpoint Detection and Response (EDR)

Stateful Packet Inspection Firewall

Signature-based Antivirus (AV)

Network Intrusion Detection System (NIDS)

Show answer & explanation

Answer: Endpoint Detection and Response (EDR)

Answer

Endpoint Detection and Response (EDR)

Endpoint Detection and Response (EDR) solutions utilize host agents to gather real-time process execution metrics, analyze process trees for anomalous behavior, and provide immediate containment mechanisms such as host-level network isolation.

Step-by-Step Solution

Analyze the operational requirements provided in the scenario.

Identified the need for host telemetry logging, process lineage tracking, and automated host isolation.

These controls require an agent running directly on the operating system capable of inspecting system behavior and altering network adapter connectivity.

Compare candidate security tools against the required capabilities.

Endpoint Detection and Response (EDR) provides real-time process monitoring, behavioral detection, and automated host isolation features.

EDR specifically expands beyond legacy static signature scanning to capture host execution contexts and enable active incident containment.

Key Concept

Endpoint Detection and Response (EDR) Core Capabilities

Estimated Time:45s

Question 1139Question →

An enterprise data center security team is deploying new high-density rack servers equipped with Baseboard Management Controllers (BMCs). To protect against persistent firmware-level compromise, the security architect must ensure that the BMC initial boot code cannot be altered and that attackers cannot downgrade the firmware to a previously signed version containing known security vulnerabilities. Which of the following hardware security mechanisms should the architect specify to fulfill these requirements?

Hardware Root of Trust anchored in One-Time Programmable (OTP) eFuses with anti-rollback version tracking

Inline network intrusion prevention system (NIPS) configured to inspect and drop unapproved firmware flashing payloads

Continuous SIEM event log monitoring and alert rules targeting unauthorized management portal access

AES-256 symmetric encryption keys stored in flash memory to decrypt incoming firmware binaries prior to installation

Show answer & explanation

Answer: Hardware Root of Trust anchored in One-Time Programmable (OTP) eFuses with anti-rollback version tracking

Answer

Hardware Root of Trust anchored in One-Time Programmable (OTP) eFuses with anti-rollback version tracking

Establishing a hardware Root of Trust (RoT) anchored in One-Time Programmable (OTP) eFuses ensures that the initial boot code validation key is burned directly into silicon during manufacturing and cannot be altered. When combined with eFuse-backed anti-rollback version counters, the processor compares the version number of any incoming firmware against the hardware counter. If an attacker attempts to flash an older, vulnerable firmware version (even if validly signed by the vendor in the past), the hardware anti-rollback check fails and halts execution.

Step-by-Step Solution

Analyze the scenario requirements

Identified two primary hardware protection needs: immutable boot integrity verification and protection against firmware version downgrade attacks on out-of-band controllers.

Baseboard Management Controllers run low-level microcode that requires hardware-backed verification to prevent rootkits.

Evaluate hardware security mechanisms for boot integrity and anti-rollback

One-Time Programmable (OTP) eFuses store cryptographically hashed keys permanently in silicon, establishing an unalterable Root of Trust (RoT). eFuse counters are blown during firmware updates to enforce anti-rollback.

Software-based or flash-based storage can be overwritten, whereas eFuses cannot be reversed once blown.

Differentiate correct hardware control from network, detective, or symmetric crypto alternatives

Select the option that combines hardware Root of Trust via OTP eFuses with anti-rollback logic.

Network controls (NIPS), detective controls (SIEM), and symmetric keys in flash do not provide immutable hardware boot chain validation.

Key Concept

Hardware Root of Trust and Anti-Rollback Protection

Estimated Time:1m 30s

Question 1140Question →

A security analyst is reviewing centralized authentication and privileged access logs during an investigation. The following event log snippet was captured:

Based on the log entries above, which of the following represents the MOST likely incident root cause and the immediate identity and access management (IAM) operational response?

An impossible travel anomaly indicates valid credential compromise; the security team must immediately terminate active user sessions and disable the account.

A network security control failure occurred; the analyst should add public IP 203.0.113.19 to the perimeter firewall blocklist to prevent further authentication attempts.

An authorization policy flaw exists in the SAML Single Sign-On configuration that incorrectly granted identity verification permissions to an unauthorized identity provider.

The internal connection from IP 192.168.10.45 is inherently secure, so no containment action is necessary as long as privileged account checkout policies were followed.

Show answer & explanation

Answer: An impossible travel anomaly indicates valid credential compromise; the security team must immediately terminate active user sessions and disable the account.

Answer

An impossible travel anomaly indicates valid credential compromise; the security team must immediately terminate active user sessions and disable the account.

The log snippet reveals two successful logons for user [email protected] occurring 74 seconds apart from New York and London. This represents a classic 'impossible travel' anomaly, proving that valid account credentials or session tokens have been compromised. In IAM operations, the primary immediate containment action is to revoke all active tokens, end open sessions, and disable the account to prevent unauthorized domain administrator escalation.

Step-by-Step Solution

Analyze authentication log timestamps and locations

Identified two successful SAML SSO logons for the same user account from New York, USA and London, UK within 74 seconds of each other.

Physical travel between these locations in under two minutes is impossible, indicating credential compromise (such as token hijacking or credential harvesting).

Evaluate downstream actions taken by the compromised account

The compromised account successfully performed a privileged vault checkout for domain admin access on critical infrastructure.

Threat actors frequently leverage stolen standard account credentials to escalate privileges via Privileged Access Management (PAM) workflows.

Determine the appropriate IAM containment operation

Revoke active session tokens, invalidate refresh tokens, and temporarily disable the account.

Immediate account lifecycle suspension and active session termination stops ongoing unauthorized access across all enterprise services.

Key Concept

Impossible travel detection and immediate incident containment in IAM operations

Estimated Time:1m 30s

PreviousPage 57 / 112Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept