All practice questions

378 questions

Question 101Question

An enterprise security architecture team is auditing security responsibility boundaries across diverse cloud deployment models and specialized security integrations. Which operational security responsibility correctly aligns with each cloud architecture or deployment model?

Click a left item, then click its matching right item

Items

API-based Cloud Access Security Broker (CASB)
On-Premises Private Cloud
Managed Platform as a Service (PaaS) Container Service
Community Cloud Deployment

Matches

Show answer & explanation

Answer

API-based CASB matches with enforcing policies out-of-band via direct provider APIs. On-Premises Private Cloud matches with retaining full control over physical hardware, hypervisors, and workloads. Managed PaaS Container Service matches with customer responsibility for application code and container images while provider manages the control plane. Community Cloud Deployment matches with sharing governance and costs among organizations with joint compliance goals.
Each deployment model and cloud architectural control has specific boundaries: API CASBs operate out-of-band via cloud APIs; On-Premises Private Clouds demand full physical and virtualization stack management by the enterprise; PaaS container platforms split responsibility between provider control planes and tenant container content; and Community Clouds distribute shared governance across multiple affiliated entities.

Step-by-Step Solution

1
Analyze API-based CASB operational architecture.
Identify out-of-band API integration as the defining characteristic compared to inline proxies.
API CASBs inspect data at rest and event logs directly via provider interfaces rather than intercepting active inline network traffic.
2
Evaluate On-Premises Private Cloud responsibility boundaries.
Confirm 100% customer responsibility for physical hardware, virtualization layer, and guest OS security.
Private clouds hosted locally do not offload any layer of physical or hypervisor security to a third-party cloud service provider.
3
Delineate PaaS managed container service responsibilities under the shared responsibility model.
Separate container application runtime security from infrastructure control plane security.
The provider secures the host OS, orchestrator nodes, and physical hardware, while the tenant secures container images and application code.
4
Classify Community Cloud deployment governance features.
Link to multi-organizational resource and governance sharing based on joint mission or regulatory needs.
Community clouds exist to service specific groups with common requirements (e.g., healthcare or government agencies).

Key Concept

Cloud Shared Responsibility Model and Cloud Architecture Integrations
Question 102Question

Match each Zero Trust Architecture (ZTA) functional component on the left with its corresponding operational role on the right.

Click a left item, then click its matching right item

Items

Policy Engine (PE)
Policy Administrator (PA)
Policy Enforcement Point (PEP)
Data Plane

Matches

Show answer & explanation

Answer

Policy Engine matches with evaluating security policies and context; Policy Administrator matches with issuing control commands to manage connections; Policy Enforcement Point matches with intercepting traffic and enforcing access controls; Data Plane matches with carrying actual application payload traffic.
Each Zero Trust architecture component serves a distinct role split across the control plane and data plane. The Policy Engine (PE) evaluates policies and context to determine authorization. The Policy Administrator (PA) generates signals and credentials to open or close sessions. The Policy Enforcement Point (PEP) acts as the inline mechanism enforcing access. The Data Plane carries the actual payload once allowed.

Step-by-Step Solution

1
Identify the decision-making brain of Zero Trust Architecture.
The Policy Engine (PE) processes rules and context to make authorization decisions.
ZTA relies on dynamic evaluation of trust before access is decided.
2
Identify the control signaling component.
The Policy Administrator (PA) executes decision commands to control connection establishment.
PA coordinates between the decision engine and enforcement mechanisms.
3
Identify the inline gatekeeper component.
The Policy Enforcement Point (PEP) directly inspects and controls subject access requests.
Enforcement must happen directly at the gateway or endpoint interface.
4
Identify the network layer responsible for user payload.
The Data Plane transports application user data separate from control signals.
NIST SP 800-207 mandates separation between the control plane and data plane.

Key Concept

Zero Trust Functional Components (NIST SP 800-207)
Question 103Question

To optimize threat data collection, an enterprise security operations team must classify different threat intelligence feed types. Pair each threat intelligence category on the left with its defining operational characteristic on the right.

Click a left item, then click its matching right item

Items

Open-Source Intelligence (OSINT)
Sector-Specific ISAC
Commercial Threat Intelligence
Dark Web Intelligence

Matches

Show answer & explanation

Answer

Open-Source Intelligence (OSINT) matches publicly available security information. Sector-Specific ISAC matches non-profit peer network for exchanging industry-specific cyber threat alerts. Commercial Threat Intelligence matches subscription-based compiled feed offering high-confidence indicators. Dark Web Intelligence matches data gathered from anonymized underground marketplaces.
Each threat intelligence source corresponds directly to its defined collection domain: OSINT uses public resources, ISACs facilitate industry peer sharing, commercial feeds offer subscription-based IoCs, and dark web intelligence targets restricted underground channels.

Step-by-Step Solution

1
Identify the collection accessibility of each threat intelligence source.
OSINT is publicly accessible; Commercial feeds require a paid subscription; Dark Web intelligence requires monitoring restricted hidden networks.
Accessibility and origin define the baseline intelligence source type.
2
Evaluate organizational and sharing structures.
ISACs represent member-driven, sector-specific peer sharing communities.
Understanding non-profit peer sharing distinguishes ISACs from commercial vendors and open sources.
3
Pair each threat intelligence term with its matching description based on collection method and access model.
All terms are correctly mapped to their defining descriptions.
Ensures complete alignment across all intelligence categories.

Key Concept

Classification and operational traits of threat intelligence sources
Question 104Question

Match each observed wireless or network anomaly on the left with its corresponding attack classification on the right.

Click a left item, then click its matching right item

Items

Unsolicited contact cards or text messages appearing on a mobile device via short-range wireless connections without requesting data theft.
Frequent transmission of spoofed 802.11 control frames causing immediate dropped wireless connections for connected endpoints.
A massive spike in noise floor levels across 2.4 GHz channels leading to severe degradation of signal-to-noise ratio and complete connection loss.
Switch security alerts indicating that an identical media access control address is registered on two different physical switch ports.

Matches

Show answer & explanation

Answer

Unsolicited short-range messages correspond to Bluejacking; spoofed 802.11 control frames disconnecting clients correspond to a Disassociation Attack; high noise floor across frequency channels corresponds to Radio Frequency Jamming; and identical physical addresses appearing on multiple switch ports corresponds to MAC Spoofing.
Each indicator uniquely points to a distinct network or wireless attack vector based on standard security monitoring signatures: short-range spam maps to Bluejacking, 802.11 frame forgery maps to Disassociation, RF noise flooding maps to Jamming, and duplicate physical layer addressing maps to MAC Spoofing.

Step-by-Step Solution

1
Analyze the indicator involving unsolicited Bluetooth messages.
Identify that pushing unsolicited messages over Bluetooth without unauthorized data retrieval defines Bluejacking.
Bluejacking focuses on message sending, whereas Bluesnarfing involves unauthorized data extraction.
2
Examine the indicator regarding spoofed 802.11 management frames.
Match 802.11 frame manipulation targeted at client disconnection to a Disassociation Attack.
Attackers forge management frames to force clients off the wireless network.
3
Evaluate the RF noise floor anomaly.
Correlate channel-wide noise spikes and degraded signal-to-noise ratio with Radio Frequency Jamming.
Jamming impacts physical layer radio frequencies by overpowering legitimate wireless signals.
4
Inspect the duplicate physical address log alert.
Associate identical hardware addresses on distinct switch ports with MAC Spoofing.
Impersonating another endpoint's network interface card address causes switch table conflicts.

Key Concept

Network and Wireless Attack Indicators
Question 105Question

A Chief Information Security Officer (CISO) is auditing enterprise cloud services to enforce compliance with the cloud shared responsibility model across diverse architectures. Match each cloud service model implementation on the left to the corresponding primary security responsibility retained by the cloud customer on the right.

Click a left item, then click its matching right item

Items

Infrastructure as a Service (IaaS) virtual server cluster
Platform as a Service (PaaS) managed relational database
Function as a Service (FaaS) event-driven microservice
Software as a Service (SaaS) cloud collaboration suite

Matches

Show answer & explanation

Answer

Each cloud service model maps to a specific tier in the shared responsibility matrix based on the level of abstraction provided by the vendor. IaaS requires customer management of OS and networking firewall controls; PaaS requires customer management of data objects and access rights while delegating OS/engine patching to the vendor; FaaS leaves application code and identity execution context to the customer; SaaS limits customer control strictly to data governance, access controls, and policy configurations.
The mapping accurately reflects how responsibility shifts from customer-heavy in IaaS (OS, middleware, network controls) to provider-heavy in SaaS (entire application stack), with PaaS and FaaS delegating runtime and platform maintenance to the cloud provider while keeping data, code, and access governance under customer control.

Step-by-Step Solution

1
Analyze the IaaS virtual server cluster requirements.
IaaS provides bare compute infrastructure and virtualized host space, leaving OS patching, guest firewalls, and application management to the customer.
The provider only controls physical infrastructure and the hypervisor layer in IaaS.
2
Analyze the PaaS managed relational database requirements.
PaaS abstracts the underlying operating system and software engine, leaving database object access control and schema management to the customer.
The provider patches the host OS and DB engine, but cannot manage customer data access or application-level queries.
3
Analyze the FaaS event-driven microservice requirements.
FaaS abstracts both OS and runtime environments, requiring the customer to focus on secure function code and IAM execution roles.
Serverless architectures push infrastructure provisioning to the provider while keeping code and execution policy on the customer side.
4
Analyze the SaaS cloud collaboration suite requirements.
SaaS abstracts the entire hardware and software stack, leaving identity access, tenant settings, and data classification to the customer.
The vendor maintains all software and underlying platforms in SaaS deployments.

Key Concept

Cloud Shared Responsibility Matrix across IaaS, PaaS, FaaS, and SaaS
Question 106Question

An enterprise security architect is designing a defense-in-depth framework across a multi-cloud environment. Match each cloud security technology on the left with its primary operational function on the right.

Click a left item, then click its matching right item

Items

Cloud Access Security Broker (CASB)
Cloud Security Posture Management (CSPM)
Cloud Workload Protection Platform (CWPP)
Secure Access Service Edge (SASE)

Matches

Show answer & explanation

Answer

Cloud Access Security Broker (CASB) matches with policy and DLP enforcement between users and cloud applications; Cloud Security Posture Management (CSPM) matches with continuous audit of cloud resource configurations and compliance drift; Cloud Workload Protection Platform (CWPP) matches with runtime threat detection and vulnerability management for workloads (VMs, containers); Secure Access Service Edge (SASE) matches with the convergence of SD-WAN networking and cloud-delivered security controls.
Each cloud security solution targets a distinct architectural operational boundary: CASB protects application-level usage and data flows; CSPM monitors infrastructure control plane compliance and configuration hygiene; CWPP secures individual compute workload runtimes; and SASE converges network transport infrastructure with edge-delivered security controls.

Step-by-Step Solution

1
Identify the primary scope of Cloud Access Security Broker (CASB).
CASB secures user interaction with cloud applications (SaaS/PaaS) by enforcing governance, authentication, and Data Loss Prevention (DLP).
CASB acts as an intermediary policy enforcement point between endpoints and cloud service providers.
2
Identify the primary scope of Cloud Security Posture Management (CSPM).
CSPM audits cloud management planes for misconfigurations and regulatory compliance drift.
CSPM continuously inspects environment settings against baseline security standards.
3
Identify the primary scope of Cloud Workload Protection Platform (CWPP).
CWPP secures compute resources (VMs, containers, serverless instances) at runtime.
CWPP provides workload-centric security features such as process monitoring and container image scanning.
4
Identify the primary scope of Secure Access Service Edge (SASE).
SASE combines wide-area network routing (SD-WAN) with cloud-delivered security services like ZTNA and SWG.
SASE integrates network routing with cloud-native security enforcement at the edge.

Key Concept

Cloud Security Architecture and Monitoring Solutions
Question 107Question

A cybersecurity incident response team at a global logistics and supply chain enterprise is analyzing four distinct security events across their logistics automation infrastructure. Match each security event description on the left with the most likely threat actor profile on the right.

Click a left item, then click its matching right item

Items

An unauthorized modification to automated warehouse software code committed outside business hours using valid credentials belonging to a recently demoted senior developer.
A sophisticated zero-day exploit targeting core BGP routing infrastructure, combined with custom multi-stage malware designed to observe long-term supply routing data without altering operations.
A widespread double-extortion ransomware attack targeting regional dispatch workstations, coupled with demands for cryptocurrency payment to prevent public release of stolen logistics data.
A distributed denial-of-service (DDoS) campaign targeting customer tracking portals accompanied by a public manifesto protesting corporate environmental policies.

Matches

Show answer & explanation

Answer

Event 1 matches Insider Threat (Malicious User); Event 2 matches Nation-State / APT; Event 3 matches Organized Crime Syndicate; Event 4 matches Hacktivist Collective.
Each event corresponds to key threat actor attributes: malicious code alterations using demoted employee credentials reflect an insider threat; highly covert zero-day exploitation for espionage indicates a nation-state actor; double-extortion ransomware for monetary gain defines organized crime; and ideologically motivated disruption targeting tracking portals highlights hacktivism.

Step-by-Step Solution

1
Analyze the motivation, capability, and attack methods described in each event scenario.
Event 1 shows internal credential misuse after demotion; Event 2 shows highly sophisticated covert espionage; Event 3 shows profit-driven ransomware extortion; Event 4 shows ideologically driven service disruption.
Threat actors are differentiated by their intent, resource level, sophistication, and primary operational goals.
2
Map scenario traits to official threat actor categorizations.
Personal grievance using internal access maps to Insider Threat; state-sponsored espionage maps to Nation-State; financially motivated extortive cybercrime maps to Organized Crime; political protest maps to Hacktivist.
Accurate threat actor identification allows organizations to tailor security controls, threat intelligence matching, and response playbooks.

Key Concept

Threat Actor Classification, Attributes, and Motivations
Question 108Question

A Cyber Threat Intelligence (CTI) analyst is designing an integrated threat research and ingestion framework for an enterprise Security Operations Center (SOC). Match each threat intelligence source or transport mechanism on the left with the operational workflow requirement it directly fulfills on the right.

Click a left item, then click its matching right item

Items

TAXII (Trusted Automated eXchange of Intelligence Information) Transport Protocol
National Vulnerability Database (NVD) & CVE Dictionary
Sector-Specific ISAC (Information Sharing and Analysis Center)
Strategic Vendor Intelligence Whitepapers & Academic Research

Matches

Show answer & explanation

Answer

TAXII Transport Protocol maps to automated machine-to-machine STIX relay into SIEM/firewalls. NVD & CVE Dictionary maps to cross-referencing standardized vulnerability IDs against internal inventory for patch prioritization. Sector-Specific ISAC maps to exchanging anonymized industry-specific telemetry among peer organizations. Strategic Vendor Whitepapers map to long-term analysis of adversary geopolitical motivations for executive leadership.
Each threat intelligence source or protocol mechanism targets a distinct operational layer within the enterprise security lifecycle: TAXII automates technical indicator ingestion over the network, NVD/CVE standardizes vulnerability severity tracking, ISACs facilitate trusted peer-to-peer industry collaboration, and Strategic Reports deliver high-level geopolitical and trend analysis to corporate executives.

Step-by-Step Solution

1
Identify the automated transport mechanism for structured technical indicators.
TAXII provides the RESTful API / HTTPS transport protocol layer for machine-to-machine exchange of STIX threat intelligence feeds.
Technical IOC ingestion requires automated machine-readable transport protocols rather than human-oriented reports.
2
Identify the repository used for standardized software vulnerability scoring.
NVD and CVE store public vulnerability disclosures and CVSS scores used in patch management.
Vulnerability research relies on standardized identifier schemes to match enterprise inventory against published flaws.
3
Identify the collaborative framework for peer-to-peer industry information sharing.
ISACs provide sector-focused threat sharing communities for trust-based exchange among industry peers.
Organizations benefit from early warnings shared by peer entities operating in the same vertical market.
4
Identify the intelligence tier focused on long-term executive planning and threat actor motivation.
Strategic intelligence reports synthesize high-level adversary trends and risk impacts for leadership decision-makers.
Strategic CTI is tailored for high-level governance and policy decisions rather than tactical operational rule updates.

Key Concept

Threat Intelligence Sources, Formats, and Transport Protocols
Question 109Question

Match each network segmentation concept on the left with its defining implementation characteristics on the right. Which pairings correctly connect each segmentation technique to its primary description?

Click a left item, then click its matching right item

Items

Air Gap
Demilitarized Zone (DMZ)
VLAN (Virtual LAN)
Microsegmentation

Matches

Show answer & explanation

Answer

Air Gap matches physical isolation with zero electronic connectivity. Demilitarized Zone (DMZ) matches a perimeter network hosting public services. VLAN matches Layer 2 switch broadcast domain separation. Microsegmentation matches granular workload isolation controlling East-West traffic.
The concepts correctly align with their respective architectural boundaries: Air Gap provides absolute physical disconnection, DMZ insulates internal networks from public service exposure, VLAN separates Layer 2 switch traffic, and Microsegmentation limits lateral movement between virtual workloads.

Step-by-Step Solution

1
Identify the physical versus logical nature of each network segmentation technique.
Air gap is entirely physical, DMZ is perimeter-focused, VLAN operates at Layer 2, and microsegmentation enforces workload-level policies.
Different network architecture goals require distinct physical or logical boundary boundaries.
2
Pair physical separation and perimeter protection terms.
Air Gap connects to complete physical isolation. DMZ connects to the subnetwork hosting public-facing services.
Air gaps ensure no physical or electronic link exists, whereas DMZs allow controlled external access.
3
Pair switch-level and workload-level logical controls.
VLAN connects to Layer 2 broadcast domain partitioning. Microsegmentation connects to granular workload isolation for East-West traffic.
VLANs segment network hardware at the data link layer, while microsegmentation controls traffic flow between virtualized application instances.

Key Concept

Network Segmentation and Boundary Controls
Question 110Question

A security consultant is defining security testing methodologies for an organization's software development lifecycle (SDLC). Match each application security testing method to its corresponding operational characteristic.

Click a left item, then click its matching right item

Items

Static Application Security Testing (SAST)
Dynamic Application Security Testing (DAST)
Interactive Application Security Testing (IAST)
Software Composition Analysis (SCA)

Matches

Show answer & explanation

Answer

Static Application Security Testing (SAST) pairs with analyzing source code offline without executing the application. Dynamic Application Security Testing (DAST) pairs with evaluating a running application externally via black-box HTTP analysis. Interactive Application Security Testing (IAST) pairs with employing runtime instrumentation agents inside the application engine. Software Composition Analysis (SCA) pairs with inspecting open-source components and third-party libraries for known CVEs.
Each application security testing methodology targets a distinct phase or perspective within software security evaluation: SAST inspects static source code, DAST tests external running interfaces, IAST uses runtime instrumentation for internal execution visibility, and SCA identifies risks in third-party software dependencies.

Step-by-Step Solution

1
Identify non-execution code analysis methods.
SAST analyzes source code or bytecode statically without application execution.
SAST is designed to catch implementation vulnerabilities early in the development pipeline before binaries are executed.
2
Differentiate external runtime testing from internal agent-based runtime testing.
DAST evaluates external endpoints without internal visibility, whereas IAST uses internal instrumentation agents.
DAST operates as a black-box tester, while IAST leverages internal execution hooks to provide high accuracy during functional testing.
3
Identify dependency and third-party library scanners.
SCA targets third-party libraries and open-source packages.
SCA ensures the software bill of materials (SBOM) does not contain known security risks or licensing violations.

Key Concept

Application Security Testing Methodologies (SAST, DAST, IAST, SCA)
Estimated Time:1m 30s
Question 111Question

An enterprise security architect is evaluating system hardening controls to address findings from a comprehensive technical vulnerability audit. Match each enterprise hardening practice on the left to its corresponding primary risk mitigation objective on the right.

Click a left item, then click its matching right item

Items

Implementation of eBPF (Extended Berkeley Packet Filter) runtime hooks
Automated deployment of ephemeral short-lived access credentials
Configuration of DNS RPZ (Response Policy Zone) sinkholing
Enforcement of ASLR (Address Space Layout Randomization) paired with DEP/NX flags

Matches

Show answer & explanation

Answer

eBPF runtime hooks match kernel-level system call monitoring and container breakout detection. Automated ephemeral credentials match reducing the exposure window of stolen service tokens. DNS RPZ sinkholing matches blocking outbound C2 domain resolution. ASLR with DEP/NX flags matches neutralizing buffer overflow and code injection exploits.
Each listed hardening control addresses a distinct technical attack vector: eBPF monitors kernel system calls to stop privilege escalation and container escapes; ephemeral access tokens limit credential abuse duration; DNS RPZ intercepts malicious outbound domain queries; and ASLR paired with DEP prevents buffer overflow code execution.

Step-by-Step Solution

1
Analyze the technical operation of eBPF instrumentation.
Determined that eBPF runs sandboxed programs directly within the Linux kernel to trace system calls and enforce container security limits.
Kernel-level visibility directly addresses host and container runtime hardening.
2
Evaluate the risk reduction mechanism of short-lived ephemeral credentials.
Identified that enforcing short validity periods limits credential reuse opportunities during token leakage incidents.
Identity hardening focuses on minimizing threat actor persistence windows.
3
Determine the functional role of DNS Response Policy Zones (RPZ).
Recognized that RPZ filters and redirects DNS lookups for known malicious domains before outbound network connections complete.
Network egress hardening prevents malware C2 callback channels.
4
Examine memory protection controls ASLR and DEP/NX.
Confirmed that memory address randomization combined with non-executable stack/heap flags thwarts exploit payloads relying on static memory offsets.
OS memory hardening prevents binary corruption exploits.

Key Concept

Enterprise mitigation techniques across kernel runtime security, identity lifecycle management, network egress filtering, and OS memory protection.
Question 112Question

Match each enterprise host or infrastructure security scenario to the underlying vulnerability or architectural weakness it represents.

Click a left item, then click its matching right item

Items

An embedded storage controller accessible via Telnet and HTTP across the general user workstation VLAN.
A legacy enterprise server running an operating system that has reached End-of-Life (EOL) without extended security updates.
A hypervisor management interface directly reachable from all non-administrative employee subnets.
A network switch deployed into production retaining factory-configured administrative login accounts.

Matches

Show answer & explanation

Answer

The scenarios match their respective security weaknesses as follows: Telnet and HTTP management maps to Cleartext Management & Insecure Protocols; End-of-Life OS maps to Unsupported / Legacy System; hypervisor interface accessible to user subnets maps to Improper Network Segmentation; and factory login accounts map to Default Configuration & Credentials.
Each scenario directly maps to its primary host and infrastructure vulnerability category: Telnet and HTTP communicate without transport encryption (Cleartext Management & Insecure Protocols); EOL systems lack vendor patch support (Unsupported / Legacy System); hypervisors accessible across general user subnets lack network isolation (Improper Network Segmentation); and factory administrative logins leave systems exposed to unauthorized access (Default Configuration & Credentials).

Step-by-Step Solution

1
Analyze each scenario's technical properties and security flaw.
Identify cleartext transport protocols (Telnet/HTTP), unpatched software lifecycle status (EOL), flat network exposure of host management, and unmanaged factory credentials.
Categorizing the specific technical failure allows mapping each host and infrastructure risk to standard security vulnerability categories.
2
Map the technical failures to their core host and infrastructure vulnerability classifications.
Connect cleartext management traffic to insecure protocols, EOL status to unsupported systems, unrestricted hypervisor routing to improper segmentation, and factory logins to default configurations.
Correlate host lifecycle, network access boundaries, and credential baselines against established enterprise security weakness classifications.

Key Concept

Host, Network, and Architecture Vulnerabilities
Question 113Question

Match each observed wireless attack indicator on the left with its corresponding attack classification on the right.

Click a left item, then click its matching right item

Items

Captive portal clone broadcasting an identical corporate SSID with a stronger RSSI on an unapproved channel alongside injected frame drops
Unsolicited OBEX push messages containing text or contact cards received on mobile endpoints over short-range 2.4 GHz wireless links
A high-frequency burst of 802.11 management frames (subtype 0x000C) forcing wireless clients off the access point
Capture logs demonstrating repeated M4 and M6 message failures during automated PIN registration attempts against an AP

Matches

Show answer & explanation

Answer

1. Captive portal clone broadcasting identical SSID -> Evil Twin Attack; 2. Unsolicited OBEX push messages -> Bluejacking; 3. Burst of 802.11 management subtype 0x000C frames -> Wireless Disassociation Attack; 4. M4/M6 failure messages during PIN registration -> WPS Brute-Force Attack.
Each indicator uniquely aligns with its attack mechanism: Evil Twins impersonate known SSIDs with stronger RSSI; Bluejacking uses OBEX to deliver unsolicited media; Disassociation attacks utilize 802.11 management frames (subtype 0x000C); and WPS brute-forcing triggers M4/M6 handshake errors during PIN validation.

Step-by-Step Solution

1
Analyze the indicator describing an unauthorized access point copying a legitimate network's SSID with higher signal strength.
Identify that spoofing a legitimate SSID to intercept victim traffic defines an Evil Twin attack.
Evil Twins trick client devices into auto-associating due to higher signal strength.
2
Examine the short-range wireless payload involving OBEX push protocol messages.
Match OBEX messaging with Bluejacking.
Bluejacking involves sending unsolicited business cards or text messages via Bluetooth without gaining unauthorized data access.
3
Inspect the 802.11 frame subtype 0x000C metric.
Associate subtype 0x000C (Deauthentication) with a Wireless Disassociation attack.
Spoofed 802.11 deauthentication management frames force targeted endpoints off the wireless network.
4
Identify the protocol failures during M4/M6 handshake messages.
Link WPS PIN handshake message failures to WPS Brute-Force attacks.
WPS exchanges use specific message sequences (M1 through M8); failures at M4/M6 occur when testing invalid 4-digit PIN halves.

Key Concept

Identifying wireless attack signatures and protocols from technical packet indicators and log anomalies.
Question 114Question

A network security architect is reviewing the network segmentation design for an enterprise financial organization. The enterprise must implement appropriate isolation controls across diverse operational environments to satisfy regulatory compliance and mitigate lateral movement risks. Match each network design or segmentation technique on the left with its corresponding enterprise architectural requirement on the right.

Click a left item, then click its matching right item

Items

Microsegmentation
Air Gap
Demilitarized Zone (DMZ)
Jump Box / Bastion Host

Matches

Show answer & explanation

Answer

Microsegmentation connects with granular control of East-West workload traffic. Air Gap connects with complete physical network separation. Demilitarized Zone (DMZ) connects with hosting public-facing services away from internal networks. Jump Box connects with secure, audited administrator gateway access.
Each segmentation technique aligns directly with its primary defensive boundary design: Microsegmentation enforces host-to-host micro-boundaries (East-West); Air Gap enforces total physical isolation; DMZ enforces perimeter service separation (North-South); and a Jump Box enforces secure, centralized administrative entry into secure segments.

Step-by-Step Solution

1
Analyze Microsegmentation requirements
Identified as logical host/workload separation controlling East-West traffic
Microsegmentation isolates workloads at the hypervisor or OS layer within cloud/virtual environments.
2
Analyze Air Gap requirements
Identified as complete physical separation with zero network connectivity
Air-gapping ensures critical infrastructure cannot be targeted via network communication paths.
3
Analyze DMZ requirements
Identified as a screened boundary network for public services
DMZs prevent direct inbound access from public internet clients into internal core segments.
4
Analyze Jump Box requirements
Identified as a hardened management intermediary for privilege access
Bastion hosts centralize authentication, session recording, and access control for administrative tasks.

Key Concept

Network Segmentation and Isolation Controls
Question 115Question

Match each Zero Trust Architecture principle on the left with its corresponding operational description on the right.

Click a left item, then click its matching right item

Items

Explicit Verification
Least Privilege Access
Assume Breach
Microsegmentation

Matches

Show answer & explanation

Answer

Explicit Verification matches authenticating and authorizing every access request based on identity and context; Least Privilege Access matches limiting user rights using JIT and JEA controls; Assume Breach matches operating under the premise that internal systems are compromised; Microsegmentation matches dividing network environments into granular zones to restrict lateral movement.
Each Zero Trust principle accurately maps to its operational definition: Explicit Verification dynamically validates requests; Least Privilege Access enforces minimal permissions; Assume Breach plans for internal compromise; Microsegmentation prevents lateral network movement.

Step-by-Step Solution

1
Identify the concept requiring continuous authentication and contextual authorization for every transaction.
Explicit Verification aligns with validating identity, location, and device status dynamically.
Zero Trust eliminates implicit trust based on network location, mandating explicit validation.
2
Identify the concept designed to restrict user permissions to minimum necessary levels.
Least Privilege Access aligns with implementing JIT (Just-In-Time) and JEA (Just-Enough-Access) controls.
Restricting permissions minimizes potential exposure if credentials are compromised.
3
Identify the architectural mindset assuming active compromise within internal perimeters.
Assume Breach aligns with operating under internal compromise conditions and encrypting all traffic.
Assuming breach forces organizations to contain blast radius and continuously inspect internal communications.
4
Identify the network design strategy used to isolate workloads and stop internal spread.
Microsegmentation aligns with creating granular network boundaries.
Microsegmentation prevents lateral movement across internal subnets and applications.

Key Concept

Core principles and operational tenets of Zero Trust Architecture
Question 116Question

An enterprise security architect is evaluating cloud operational boundaries across various enterprise environments. Match each cloud service or deployment model scenario on the left with the corresponding customer security management responsibility on the right.

Click a left item, then click its matching right item

Items

Infrastructure as a Service (IaaS) instance hosting custom line-of-business applications
Platform as a Service (PaaS) managed container environment
Software as a Service (SaaS) cloud communication and productivity portal
On-premises Private Cloud infrastructure hosting legacy databases

Matches

Show answer & explanation

Answer

In IaaS, the customer manages the guest OS, host firewalls, and application stack. In PaaS, the customer manages application code and access controls while the provider manages the OS and runtime engine. In SaaS, the provider manages the application and infrastructure while the customer manages user access and data governance. In a Private Cloud, the enterprise manages all physical infrastructure, hypervisors, and virtual workloads.
Each cloud service model defines a distinct boundary of ownership. In IaaS, hardware virtualization is provided by the CSP while OS patching, host firewalls, and application management remain customer duties. In PaaS, the CSP manages the OS and runtime environment, while the customer manages code and application access. In SaaS, the CSP manages the full application stack while the customer manages identities and data classification. In a private cloud on-premises setup, the enterprise retains end-to-end control of physical and virtual assets.

Step-by-Step Solution

1
Analyze the IaaS deployment model requirements.
Identify that IaaS leaves the guest operating system, network firewall configurations, and application security under customer administration.
IaaS provides raw virtualized hardware and storage, meaning OS administration remains with the tenant.
2
Evaluate PaaS service boundary expectations.
Determine that PaaS hides the OS management layer from the customer, focusing customer responsibility on custom code and data schema controls.
PaaS abstracts operating system execution environments so developers can focus purely on application delivery.
3
Distinguish SaaS operational limits.
Map SaaS to user identity management, credential governance, and data security policies.
SaaS providers deliver completed application functionality, eliminating customer maintenance of application binaries or platform software.
4
Differentiate Private Cloud infrastructure responsibilities.
Confirm complete organization ownership over hardware, physical controls, and virtualization layers.
Private clouds deployed on-premises do not transfer facility or physical infrastructure management to a third party.

Key Concept

Cloud Shared Responsibility Model and Cloud Deployment Model Boundaries
Question 117Question

A security analyst is reviewing an audit report detailing cryptographic vulnerabilities identified across an enterprise network. Match each observed security incident or technical finding on the left with its underlying cryptographic weakness on the right.

Click a left item, then click its matching right item

Items

An attacker retroactively decrypts historical TLS traffic captured from a web server after stealing its long-term private key.
A database review reveals that identical credit card numbers produce identical ciphertext entries across multiple records.
An attacker recovers plaintext communications from a legacy wireless system by collecting packets transmitted with repeated nonces.
A security audit uncovers an application using a fixed 56-bit symmetric cipher key compiled directly into client software binaries.

Matches

Show answer & explanation

Answer

1. Retroactive decryption of captured traffic maps to Absence of Perfect Forward Secrecy (PFS). 2. Identical ciphertext for identical database inputs maps to Electronic Codebook (ECB) mode. 3. Plaintext recovery from repeated nonces maps to Keystream reuse from static IVs. 4. Compiled 56-bit symmetric key maps to Inadequate key length.
Each security finding correctly pairs with its fundamental cryptographic flaw: compromise of past TLS sessions due to lack of PFS; deterministic identical ciphertexts due to ECB block mode; keystream exposure due to static IV reuse; and weak key entropy due to an obsolete 56-bit key length.

Step-by-Step Solution

1
Analyze the first scenario involving compromise of a private key leading to retroactive session decryption.
Identify that static RSA key exchange allows past traffic to be decrypted if the private key is exposed.
Perfect Forward Secrecy ensures ephemeral session keys are destroyed and cannot be derived from long-term private keys.
2
Analyze the second scenario involving pattern preservation in encrypted database entries.
Identify that deterministic block-by-block encryption without initialization vectors exhibits ECB mode behavior.
ECB mode maps identical plaintext blocks directly to identical ciphertext blocks.
3
Analyze the third scenario involving plaintext recovery via repeated nonces.
Recognize that static IV usage in stream ciphers leads to keystream reuse.
When the same keystream encrypts multiple plaintexts, XORing two ciphertexts cancels out the keystream.
4
Analyze the fourth scenario involving a hardcoded 56-bit symmetric key.
Determine that a 56-bit key size is cryptographically weak due to low key space size.
Modern computing hardware can brute-force a 56-bit key space in hours or minutes.

Key Concept

Cryptographic and Security Control Weaknesses
Question 118Question

An enterprise security architect is updating the organization's network architecture to mitigate lateral threat movement, secure legacy components, and control administrative access across enterprise zones. Match each network design or segmentation technique on the left with its corresponding architectural application on the right.

Click a left item, then click its matching right item

Items

East-West Traffic Microsegmentation
Screened Subnet (DMZ) with Dual-Homed Firewalls
Air-Gapped Out-of-Band Management Network
Software-Defined Perimeter (SDP) Gateway

Matches

Show answer & explanation

Answer

East-West Traffic Microsegmentation maps to enforcing host-level firewall policies between databases in the same subnet; Screened Subnet with Dual-Homed Firewalls maps to terminating internet-facing connections in a perimeter zone; Air-Gapped Out-of-Band Management Network maps to isolating systems without routed external connectivity; Software-Defined Perimeter Gateway maps to dynamically provisioning authenticated access while hiding infrastructure.
Each technique addresses a specific network segmentation boundary requirement: East-West microsegmentation controls internal host-to-host traffic within the same subnet; screened subnets isolate public services at the network perimeter; air-gaps eliminate packet routing paths entirely; and SDP gateways conceal infrastructure behind identity-verified tunnels.

Step-by-Step Solution

1
Analyze East-West traffic flow controls
Identify microsegmentation as the technique that enforces policies on lateral movement between workloads in the same segment.
Traditional perimeter firewalls monitor North-South traffic, whereas microsegmentation monitors East-West internal traffic.
2
Analyze perimeter untrusted access controls
Map screened subnets (DMZ) with dual firewalls to untrusted external perimeter terminations.
Screened subnets provide buffer zones between external networks and protected internal networks.
3
Analyze strict physical and operational isolation requirements
Map air-gapping to systems that require total absence of external packet routing.
Air-gapping guarantees physical or strict logical disconnect from un-trusted networks.
4
Analyze Zero Trust network access mechanisms
Map Software-Defined Perimeter (SDP) to dynamic, identity-based cloaking of services.
SDP creates individual encrypted tunnels to authorized applications while keeping network infrastructure concealed.

Key Concept

Network Segmentation Archetypes and Traffic Control Architecture
Estimated Time:2m 0s
Question 119Question

An enterprise architecture team is designing a NIST SP 800-207 compliant Zero Trust solution to enforce dynamic control plane and data plane boundaries across hybrid environments. Pair each Zero Trust logical component on the left with its precise operational function on the right.

Click a left item, then click its matching right item

Items

Policy Engine (PE)
Policy Administrator (PA)
Policy Enforcement Point (PEP)
Continuous Diagnostics and Mitigation (CDM) System

Matches

Show answer & explanation

Answer

Policy Engine (PE) matches with applying enterprise trust algorithms to determine access decisions; Policy Administrator (PA) matches with executing governance decisions by issuing control commands or credentials to manage the connection path; Policy Enforcement Point (PEP) matches with operating in the data plane to intercept traffic and enforce connection states; Continuous Diagnostics and Mitigation (CDM) System matches with continuously gathering asset health metrics to feed real-time compliance inputs.
In NIST SP 800-207 Zero Trust Architecture, logical responsibilities are strictly separated between decision-making, administration, enforcement, and environmental telemetry. The Policy Engine evaluates trust algorithms to decide access; the Policy Administrator signals session establishment or teardown; the Policy Enforcement Point intercepts data plane traffic to enforce session commands; and the Continuous Diagnostics and Mitigation System provides real-time posture feeds to dynamically reassess trust.

Step-by-Step Solution

1
Differentiate control plane components from data plane components in NIST SP 800-207 Zero Trust Architecture.
Identified Policy Engine and Policy Administrator as control plane entities (PDP), PEP as data plane boundary, and CDM as an external security input source.
Establishing plane separation is required to evaluate structural roles.
2
Differentiate the decision component from the execution component within the control plane.
The Policy Engine evaluates rules to make access decisions, whereas the Policy Administrator commands session creation or termination.
Conflating PE and PA roles is a common architectural error.
3
Identify the data plane component responsible for inline enforcement.
The Policy Enforcement Point directly intercepts subject traffic and enforces PA instructions.
The PEP is the only component listed that resides directly in the traffic flow path.
4
Identify the contextual state feed component.
The CDM System monitors device health, vulnerability data, and patch state to provide continuous diagnostic inputs to the PE.
Zero Trust decisions require real-time dynamic trust scoring provided by CDM telemetry.

Key Concept

NIST SP 800-207 Zero Trust Architecture Components and Control/Data Plane Separation
Question 120Question

Match each virtualization or containerization security control on the left with its corresponding primary isolation capability on the right.

Click a left item, then click its matching right item

Items

Type 1 Hypervisor
Control Groups (cgroups)
Namespaces
Microsegmentation

Matches

Show answer & explanation

Answer

Type 1 Hypervisor pairs with bare-metal hardware execution; Control Groups (cgroups) pair with resource allocation limits; Namespaces pair with kernel view isolation; Microsegmentation pairs with granular network traffic isolation.
Each isolation control serves a specific functional role: Type 1 hypervisors execute on bare-metal hardware, control groups (cgroups) regulate host resource allocation per container, namespaces partition kernel visibility to restrict process boundaries, and microsegmentation enforces granular network traffic rules between virtual workloads.

Step-by-Step Solution

1
Identify the virtualization control executing at the hardware level.
Type 1 Hypervisor operates directly on bare-metal host hardware to isolate VMs.
Type 1 hypervisors sit directly on the physical hardware without needing a host OS.
2
Distinguish between container resource metering and system visibility isolation controls.
cgroups govern resource limits, while namespaces govern resource visibility.
cgroups enforce quantitative bounds on host CPU/RAM usage, whereas namespaces restrict process visibility into host kernel structures.
3
Identify the network security control designed for virtualized container/VM traffic.
Microsegmentation restricts network traffic between individual virtualized instances.
Microsegmentation applies fine-grained network policies to prevent lateral movement across virtual environments.

Key Concept

Virtualization and Container Isolation Mechanisms
PreviousPage 6 / 19Next
All practice questions — CompTIA Security+ | Examkin