Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1201Question →

A financial enterprise is deploying specialized infrastructure across regional offices to process centralized database transaction encryption. The security team requires a dedicated hardware-based solution capable of performing high-throughput cryptographic operations while securely storing master keys. The device must ensure keys cannot be extracted even if an adversary gains root access to the host operating system or opens the chassis physical casing. Which of the following hardware security controls best meets these requirements?

Show answer & explanation

Answer: Hardware Security Module (HSM)

Answer

A Hardware Security Module (HSM) is the appropriate control because it provides physical tamper-responsive protection and isolated cryptographic processing for master keys independent of host operating system security.
A Hardware Security Module (HSM) is a hardened, plug-in or external device dedicated to safeguarding digital keys and accelerating cryptographic operations. HSMs feature specialized physical security measures (such as tamper-detecting covers and zeroization circuits) that protect stored keys against both physical access and host system compromise.

Step-by-Step Solution

1
Identify the core requirements from the scenario
Requirements demand a hardware device that isolates cryptographic keys, processes high-throughput transactions, resists physical chassis intrusion, and remains secure even if host OS root access is compromised.
Analyzing security constraints guides selecting between platform microcontrollers, storage controls, and specialized cryptographic appliances.
2
Evaluate hardware security mechanisms against requirements
An HSM is specifically engineered as a tamper-resistant hardware security enclave designed for dedicated master key lifecycle management and isolated cryptographic processing.
Host-bound microcontrollers (like TPMs) and local disk encryption (like SEDs) do not fulfill high-throughput centralized key appliance demands with active physical zeroization.

Key Concept

Hardware Security Module (HSM) functionality and tamper protection
Question 1202Question →

A Security Operations Center (SOC) analyst receives a high-severity alert indicating that an industrial control system (ICS) building automation gateway has initiated unauthorized outbound encrypted connections to a known malicious external IP address. The analyst confirms that unauthorized administrative access occurred and malicious code is actively running on the gateway. According to the NIST Incident Response Framework, which action should the responder perform FIRST?

Show answer & explanation

Answer: Apply an isolated quarantine VLAN profile to the connected switch port to halt external communications.

Answer

Apply an isolated quarantine VLAN profile to the connected switch port to halt external communications.
According to the NIST Incident Response Framework (SP 800-61), once an incident is detected and confirmed, responders must immediately move to the Containment phase. Placing the switch port into an isolated quarantine VLAN stops command-and-control (C2) communication and lateral movement while keeping the system powered on so volatile memory can be preserved for forensics.

Step-by-Step Solution

1
Identify the current incident phase based on the scenario
Detection and analysis are complete; an active compromise with C2 outbound traffic is confirmed.
Once an incident is confirmed active, the immediate next phase in NIST SP 800-61 is Containment.
2
Select the proper containment strategy for an active network attack
Apply network-level isolation (quarantine VLAN) to block C2 traffic.
Network containment prevents lateral movement and external data exfiltration while preserving powered-on system state for volatile memory capture.

Key Concept

NIST Incident Response Lifecycle (Containment Phase)
Question 1203Question →

During a threat monitoring shift, a security analyst receives an alert indicating that a built-in operating system binary (`mshta.exe`) executed an unencoded command shell directly in system memory and initiated an encrypted outbound connection to an unknown external IP address. A traditional signature-based antivirus scan on the host reports no infected files on disk. Which capability of an Endpoint Detection and Response (EDR) solution enabled the detection of this activity, and what is the most appropriate initial containment action?

Show answer & explanation

Answer: Behavioral telemetry monitoring of process interactions; isolate the affected host from the network using the EDR management console.

Answer

Behavioral telemetry monitoring of process interactions allows the EDR system to detect fileless execution of legitimate system binaries in RAM, and software-level host isolation via the EDR console is the immediate containment action.
Behavioral telemetry monitoring tracks runtime behavior and anomalous process chains, enabling EDR tools to flag living-off-the-land attacks where native binaries behave maliciously. Performing software-level host isolation directly through the EDR console prevents lateral spread across the network while maintaining the control channel required for incident investigation.

Step-by-Step Solution

1
Analyze the alert context and execution vector
The attack utilizes a native system binary (`mshta.exe`) running malicious code in memory without dropping files to disk, bypassing static hash-based detection.
Living-off-the-land (LotL) and fileless techniques require continuous behavioral telemetry inspection rather than traditional file scanning.
2
Identify the core EDR detection mechanism
Behavioral telemetry monitoring captures anomalous process behavior, such as a dual-purpose system tool spawning a shell and establishing outbound sockets.
EDR agents monitor API calls, process lineage, and behavioral anomalies continuously.
3
Determine the proper incident containment response
Initiate software-based host network isolation via the EDR agent console.
Host isolation blocks internal network communications to prevent lateral movement while keeping the EDR agent connected for forensic analysis.

Key Concept

Endpoint Detection and Response (EDR) Behavioral Monitoring and Host Isolation
Estimated Time:2m 0s
Question 1204Question →

Match each enterprise identity and access management (IAM) protocol to its corresponding architectural use case and operational characteristic.

Click a left item, then click its matching right item

Items

OAuth 2.0
OpenID Connect (OIDC)
RADIUS
TACACS+

Matches

Show answer & explanation

Answer

OAuth 2.0 matches delegated API authorization; OpenID Connect matches user authentication extensions on OAuth 2.0; RADIUS matches UDP-based combined network AAA; TACACS+ matches fully encrypted TCP-based administrator device access.
Each protocol is paired according to its native architectural function: OAuth 2.0 provides delegated authorization, OIDC adds user authentication via ID tokens, RADIUS provides combined UDP-based network AAA, and TACACS+ provides fully encrypted, decoupled TCP device management AAA.

Step-by-Step Solution

1
Differentiate between authorization frameworks and identity layers for web applications.
Identify OAuth 2.0 as the core delegated authorization framework and OIDC as the identity authentication layer.
OAuth 2.0 issues access tokens for APIs, while OIDC adds ID tokens for user identity.
2
Analyze network access protocols vs device administration AAA protocols.
Identify RADIUS for UDP network access AAA and TACACS+ for TCP administrator AAA.
RADIUS combines auth/authz over UDP, whereas TACACS+ separates auth/authz and encrypts full payloads over TCP.

Key Concept

Identity and Access Management Architecture Protocols
Question 1205Question →

A Security Operations Center (SOC) analyst is reviewing an alert generated by a cloud SIEM correlation rule. The rule flagged sequential API events originating from an external IP address in an enterprise AWS CloudTrail log dump:

[
{
"eventTime": "2026-07-27T10:15:02Z",
"eventName": "ConsoleLogin",
"errorMessage": "Failed authentication",
"userIdentity": {"type": "IAMUser", "userName": "svc_deploy"},
"sourceIPAddress": "198.51.100.77"
},
{
"eventTime": "2026-07-27T10:15:18Z",
"eventName": "ConsoleLogin",
"responseElements": {"ConsoleLogin": "Success"},
"userIdentity": {"type": "IAMUser", "userName": "svc_deploy"},
"sourceIPAddress": "198.51.100.77"
},
{
"eventTime": "2026-07-27T10:16:05Z",
"eventName": "AttachUserPolicy",
"errorCode": "AccessDenied",
"errorMessage": "User is not authorized to perform: iam:AttachUserPolicy",
"userIdentity": {"type": "IAMUser", "userName": "svc_deploy"},
"sourceIPAddress": "198.51.100.77"
}
]

Based on the log snippet above, which of the following statements accurately describe the security findings from this log analysis? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The user account successfully established identity authentication following an initial failed login attempt.; The authenticated user encountered an authorization control failure when attempting to modify IAM permissions.

Answer

The correct findings are that the user account successfully established identity authentication following an initial failed login attempt, and that the authenticated user encountered an authorization control failure when attempting to modify IAM permissions.
The log analysis reveals two distinct events: first, identity verification (authentication) succeeded on the second attempt after an initial failure; second, the user attempted an administrative action (attaching an IAM policy) that was blocked by access control policies, resulting in an authorization failure ('AccessDenied').

Step-by-Step Solution

1
Analyze the sequential ConsoleLogin events in the log snippet.
The first log entry shows 'Failed authentication' at 10:15:02Z, while the second log entry at 10:15:18Z shows 'Success'.
This establishes that credential identity verification (authentication) was completed on the second attempt.
2
Analyze the subsequent AttachUserPolicy event at 10:16:05Z.
The API call returned errorCode 'AccessDenied' and errorMessage 'User is not authorized to perform: iam:AttachUserPolicy'.
This confirms that while the user was authenticated, their role/account lacked authorization rights to attach IAM policies.

Key Concept

Log Analysis and SIEM Correlation across AAA Boundaries
Estimated Time:1m 30s
Question 1206Question →

During a security event, an Endpoint Detection and Response (EDR) agent deployed on a critical file server detects suspicious rapid file modification patterns consistent with ransomware activity. Arrange the following EDR incident containment and response steps in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct response sequence begins with ingesting and triaging the initial EDR alert, followed immediately by initiating agent-based network isolation to prevent lateral movement. Next, volatile memory is captured and active malicious processes are killed. Following host containment, malicious files are quarantined and modified files are remediated. Finally, a complete system integrity scan is completed before restoring network connectivity.
The standard EDR containment workflow prioritizes rapid threat isolation to prevent lateral movement, followed by volatile evidence preservation, malicious process termination, file quarantine/remediation, and finally health verification prior to restoring network access.

Step-by-Step Solution

1
Identify and validate threat telemetry
Alert triage confirms active ransomware behavior on the endpoint.
Detection and triage must precede any intervention to verify the scope of the alert.
2
Enforce host isolation via EDR agent
The host is logically isolated from the network while preserving EDR agent management channels.
Immediate containment stops command-and-control (C2) communication and prevents lateral movement across the enterprise.
3
Dump volatile memory and terminate malicious processes
RAM artifacts are saved for forensic examination and execution of the attack payload is halted.
Capturing memory prior to process termination ensures critical volatile evidence is preserved.
4
Quarantine binaries and execute rollback remediation
Malicious code is removed and modified system files are restored from clean snapshots.
Eradication eliminates host artifacts and restores compromised assets to a known good state.
5
Validate endpoint health and un-isolate host
System cleanliness is verified and full network access is safely re-established.
Reconnection to the network should only occur after verified remediation.

Key Concept

Endpoint Detection and Response (EDR) Incident Containment Workflow
Question 1207Question →

A Security Operations Center (SOC) analyst receives a high-severity alert from a Wireless Intrusion Prevention System (WIPS) indicating that an unauthorized rogue access point has been connected to an internal network switch port. Which of the following sequence of steps represents the correct order for responding to this incident according to standard incident response playbooks?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of incident response actions is: 1) Validate the alert by analyzing switch port logs and netflow data; 2) Logically isolate the affected switch port via network management tools; 3) Physically remove the unauthorized access point and update NAC policies; 4) Restore standard switch port settings and verify network telemetry; 5) Conduct a post-incident review to document lessons learned.
Standard incident response frameworks (such as NIST SP 800-61) define a strict sequential process: Detection and Analysis (validating the WIPS alert via switch logs), Containment (logically isolating the switch port), Eradication (physically removing the rogue AP and updating NAC rules), Recovery (restoring switch port operation safely and monitoring telemetry), and Post-Incident Activity (conducting a lessons learned review).

Step-by-Step Solution

1
Perform Detection and Analysis
Confirmed rogue access point location and operational impact.
Before initiating containment or remediation, responders must analyze and validate the alert to verify an actual incident is taking place.
2
Implement Containment
Rogue access point network communication is disabled.
Isolating the switch port stops potential data exfiltration and unauthorized network access while preserving evidence.
3
Execute Eradication
Rogue hardware is physically removed and NAC controls are updated.
Eradication removes the root cause of the incident from the network architecture.
4
Perform Recovery
Switch port is securely re-enabled and monitored for clean operational status.
Recovery ensures affected infrastructure is returned to safe production operations with active monitoring.
5
Conduct Post-Incident Activity
Incident report created and physical security playbooks updated.
Lessons learned feed back into the incident response lifecycle to harden enterprise defenses against future incidents.

Key Concept

Incident Response Lifecycle Phases (NIST SP 800-61)
Estimated Time:1m 30s
Question 1208Question →

During a security review of a custom web reporting service, a security analyst identifies two distinct software vulnerabilities: dynamic user input in the template string parameter is evaluated directly by the rendering engine allowing remote code execution, and un-sanitized file path inputs allow accessing arbitrary system files outside the web root. Which of the following remediation strategies should the development team implement to mitigate these specific vulnerabilities? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Implement strict input validation and path canonicalization to restrict file access strictly within intended directories.; Disable dynamic evaluation within the template renderer and restrict rendering to pre-approved static templates.

Answer

To remediate the identified directory traversal and server-side template injection (SSTI) vulnerabilities, the development team must implement path canonicalization with strict input validation for file access, and disable dynamic evaluation while restricting rendering to pre-approved static templates.
Path canonicalization resolves relative directory references (such as dot-dot-slash sequences) into absolute file paths and checks them against permitted folder boundaries to prevent file traversal. Removing dynamic code execution features from the template engine and restricting rendering to static templates prevents server-side template injection (SSTI) attacks.

Step-by-Step Solution

1
Analyze the file retrieval vulnerability to identify proper software mitigation controls.
Recognize that allowing arbitrary file path references enables directory traversal outside the web root.
Path canonicalization converts path inputs to standard absolute forms and verifies them against an explicit whitelist of allowed directories.
2
Analyze the template rendering flaw to eliminate arbitrary code execution opportunities.
Determine that evaluating user-controlled input inside the template engine leads to Server-Side Template Injection (SSTI).
Disabling dynamic string evaluation and strictly using pre-defined static templates isolates template parsing from untrusted input execution.

Key Concept

Application input validation, path canonicalization, and safe template rendering practices.
Question 1209Question →

An organization is establishing a secure onboarding process for system administrators to enforce least privilege and privileged access management (PAM). In what order should the administrative security operations team perform the following operational tasks during user onboarding?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with identity verification via HR records, followed by provisioning a standard baseline account in the Identity Provider, then integrating the user into the Privileged Access Management solution, and concluding with enforcing Multi-Factor Authentication and conducting a final permission audit.
The correct sequence starts with identity verification against authoritative HR records to validate authorization. Next, a basic non-privileged account is created in the central Identity Provider to enforce least privilege. The account is subsequently registered in the Privileged Access Management (PAM) vault to manage temporary elevation securely. Finally, Multi-Factor Authentication (MFA) registration is completed and initial permissions are audited to finalize secure onboarding.

Step-by-Step Solution

1
Identity Validation
HR authorization baseline confirmed.
Prevents unauthorized account creation by confirming employment and role requirements before generating directory objects.
2
Baseline Provisioning
Standard non-privileged account created.
Establishes a core user identity following least privilege principles prior to assigning elevated rights.
3
PAM System Integration
Identity linked to vault for just-in-time privilege checkouts.
Ensures administrative activities are subject to credential vaulting, session recording, and automated access revocation.
4
MFA Activation & Audit
Strong authentication registered and RBAC baseline verified.
Ensures multifactor security controls are operational and access limits are verified before granting access to systems.

Key Concept

Identity Lifecycle Management and PAM Onboarding Operations
Question 1210Question →

An enterprise infrastructure security team is performing a post-incident audit across a hybrid multi-cloud environment. Log correlation reveals that a former cloud administrator whose Active Directory account was disabled during an automated offboarding process was still able to access confidential production storage buckets two days later:

[2026-07-25 09:00:00] AD_EVENT: User 'dev_admin_04' status updated to DISABLED via HR workflow.
[2026-07-25 09:01:15] SCIM_EVENT: Provisioning sync sent DELETE request for user GUID 'usr-99482' to Cloud IdP -> HTTP 200 OK.
[2026-07-27 14:10:22] API_GATEWAY: OAuth Token Refresh Request for Client ID 'App-Storage-v2' using Refresh Token 'rt_88dfa2...'.
[2026-07-27 14:10:23] CLOUD_IDP: Token Endpoint issued new Access Token 'at_44c12...' without re-evaluating directory account state.
[2026-07-27 14:11:05] STORAGE_SERVICE: GET /buckets/prod-finance-db -> HTTP 200 OK (Authenticated via 'at_44c12...').

Which of the following operational root causes BEST explains why the offboarded administrator retained API access despite successful SCIM deprovisioning, and what remediation should be implemented?

Show answer & explanation

Answer: The Identity Provider token endpoint issued a new access token because it validated the refresh token without checking real-time directory account status; revoking active refresh tokens upon offboarding and enabling Continuous Access Evaluation (CAE) is required.

Answer

The Identity Provider token endpoint issued a new access token because it validated the refresh token without checking real-time directory account status; revoking active refresh tokens upon offboarding and enabling Continuous Access Evaluation (CAE) is required.
The log analysis demonstrates that while SCIM successfully deprovisioned the user object in the Cloud Identity Provider, the user's previously issued long-lived OAuth refresh token remained active. When the API Gateway presented this refresh token, the token endpoint generated a new access token without performing a real-time check against the user's directory account status. To prevent unauthorized post-offboarding access, IAM operations must explicitly revoke active refresh tokens and user sessions upon termination, as well as deploy Continuous Access Evaluation (CAE) to enforce real-time access policy decisions.

Step-by-Step Solution

1
Analyze the account deprovisioning log entries.
Active Directory disabled the user account and SCIM issued an automated DELETE call to the Cloud IdP, which returned HTTP 200 OK.
Confirms that account deprovisioning succeeded at both the primary directory level and the federated identity provider level.
2
Examine the OAuth token refresh event occurring two days post-offboarding.
The API Gateway presented a long-lived refresh token (`rt_88dfa2...`), and the Cloud IdP issued a new short-lived access token (`at_44c12...`) without re-evaluating whether the underlying directory user account was active.
Identifies that standard OAuth 2.0 token endpoints evaluate refresh token validity independently of live directory status unless active session revocation or real-time continuous evaluation is configured.
3
Determine the operational root cause and required security remediation.
The root cause is unrevoked refresh tokens combined with passive token validation. The required control remediation is revoking all active refresh tokens and user session state during offboarding, alongside implementing Continuous Access Evaluation (CAE).
Ensures that identity state changes are immediately propagated and enforced across token endpoints and API resource gateways in real time.

Key Concept

OAuth 2.0 Refresh Token Lifecycle, Session Revocation, and Continuous Access Evaluation (CAE)
Estimated Time:2m 0s
Question 1211Question →

An enterprise logistics organization is re-architecting its cloud-native platform to comply with NIST SP 800-207 Zero Trust Architecture (ZTA) principles. Which of the following architectural practices must be implemented to establish core Zero Trust controls across the environment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enforce explicit authentication and authorization for every access request, utilizing dynamic context such as identity, device state, and location regardless of network position.; Implement microsegmentation and end-to-end session encryption between workload components to minimize the blast radius of potential compromises.

Answer

The core architectural practices required are explicitly verifying every access request using dynamic risk context, and implementing microsegmentation with end-to-end encryption between workload components to contain lateral movement.
Zero Trust Architecture requires explicit verification of every access request using dynamic contextual signals (identity, device posture, location) regardless of network origin, combined with granular microsegmentation and encryption between internal services to assume breach and limit lateral movement.

Step-by-Step Solution

1
Identify fundamental Zero Trust Architecture (ZTA) tenets
ZTA relies on assuming breach, explicitly verifying all connections, enforcing least privilege, and continuously monitoring access context.
Implicit network trust based on physical location or static perimeters must be removed.
2
Map tenets to enterprise workload controls
Verifying each request dynamically (explicit verification) and segmenting internal workload flows (microsegmentation) directly enact these tenets.
These controls restrict access to authorized subjects and limit lateral movement if a workload is compromised.

Key Concept

Zero Trust Architecture Principles
Estimated Time:1m 30s
Question 1212Question →

A security analyst is acquiring digital evidence from a running enterprise application server immediately after detecting an active intrusion. Place the evidence sources in sequence according to the standard order of volatility, starting with the MOST volatile evidence first and ending with the LEAST volatile evidence.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of volatility from most volatile to least volatile is: CPU cache and processor registers, followed by System RAM and ARP cache, Temporary swap space and pagefiles, Local solid-state drive (SSD) storage, and finally Offsite optical and magnetic backup tapes.
Digital forensics standards dictate capturing evidence in order of decreasing volatility to prevent data loss. CPU registers and cache memory vanish almost instantaneously, followed by system RAM and dynamic network tables, virtual memory swap files on disk, non-volatile local drives, and lastly offsite backup media.

Step-by-Step Solution

1
Identify CPU hardware state as the highest priority.
CPU cache and processor registers are placed first.
Registers and processor cache are the most short-lived data structures in a computer system.
2
Prioritize main system RAM and active network cache.
System RAM and ARP cache are placed second.
Volatile memory contains running process code, cryptographic keys, and active network states that disappear on shutdown.
3
Order secondary virtual storage and local drives.
Temporary swap space and pagefiles are placed third, followed by local SSD storage fourth.
Swap files update dynamically during system runtime, while primary local disk storage retains persistent files.
4
Place long-term offline archives last.
Offsite optical and magnetic backup tapes are placed fifth.
Offline backup media is immutable and least susceptible to immediate modification or loss.

Key Concept

Order of Volatility
Estimated Time:1m 30s
Question 1213Question →

An enterprise security team is implementing a Zero Trust Identity and Access Management (IAM) architecture. The team needs to ensure that access to cloud resources is dynamically granted or restricted based on real-time signals, such as user risk level, device health state, and geographic location, rather than relying solely on static group memberships or initial password verification. Which of the following IAM architectural mechanisms should the team implement to satisfy this requirement?

Show answer & explanation

Answer: Context-aware access policies

Answer

Context-aware access policies
Context-aware access policies evaluate real-time signals—such as user IP location, device security posture, and behavioral risk scores—to dynamically enforce granular access controls in alignment with Zero Trust architecture principles.

Step-by-Step Solution

1
Analyze the architecture requirements in the scenario.
Identified the need for real-time, dynamic access decisions using contextual signals like device health, location, and risk scores.
Zero Trust IAM architecture mandates continuous evaluation rather than one-time static authentication.
2
Evaluate candidate IAM access control mechanisms against dynamic requirements.
Context-aware access policies evaluate incoming telemetry continuously against policy parameters.
Static models like RBAC or MAC cannot dynamically adapt access rights based on real-time situational signals.

Key Concept

Context-Aware Conditional Access in IAM Architecture
Question 1214Question →

A security analyst is investigating a alert generated by a SIEM correlation engine. The console displays the following sequential log entries collected from an enterprise web server and host database:

2026-07-27 11:05:12 | Host: WEB-01 | Apache: 192.168.1.105 - - "POST /login.php HTTP/1.1" 200 4512 "username=admin' OR '1'='1"
2026-07-27 11:05:13 | Host: WEB-01 | Auth: Successful authentication for user 'admin' from 192.168.1.105
2026-07-27 11:05:18 | Host: DB-01 | MySQL: Query executed: SELECT * FROM users WHERE username='admin' OR '1'='1'

Based on these correlated log entries, which of the following best describes the attack vector being executed and its immediate impact?

Show answer & explanation

Answer: SQL injection (SQLi) resulting in an authentication bypass by manipulating the backend database query logic.

Answer

SQL injection (SQLi) resulting in an authentication bypass by manipulating the backend database query logic.
The HTTP POST request contains the classic SQL injection payload 'OR '1'='1, which forces the database conditional check to evaluate as true. As a result, the backend application authenticates the request as the 'admin' user without verifying credentials, leading to an authentication bypass.

Step-by-Step Solution

1
Analyze the web server request payload in the Apache HTTP log.
The input string "username=admin' OR '1'='1" contains SQL syntax markers intended to alter database query logic.
Web logs reveal initial attack vectors and payload delivery.
2
Correlate web server authentication events with host database query logs.
The database executed `SELECT * FROM users WHERE username='admin' OR '1'='1'`, which evaluates to true for all rows, returning a valid admin record.
Evaluating downstream database behavior confirms if an input payload successfully altered application backend processing.
3
Determine the impact of the successful payload execution.
The web application granted a successful authentication session for 'admin' without requiring a valid password.
Connecting payload execution to log authentication outcomes identifies the threat type as SQL injection leading to authentication bypass.

Key Concept

SQL Injection (SQLi) Log Analysis
Question 1215Question →

A system administrator is auditing user permissions following a departmental transfer. An employee moved from the Accounting department to Human Resources but still retains write access to the Accounting file share. Which of the following identity and access management operations should be executed to resolve this issue?

Show answer & explanation

Answer: Conduct an access privilege review to adjust permissions in accordance with least privilege

Answer

Conducting an access privilege review to adjust permissions in accordance with the principle of least privilege.
An access privilege review allows security administrators to audit user entitlements following organizational changes, revoking obsolete rights so that access aligns with the principle of least privilege.

Step-by-Step Solution

1
Identify the administrative gap
The employee maintains rights to resources no longer required for their updated job role.
Job transfers often lead to privilege creep if rights from previous roles are not explicitly revoked.
2
Select the appropriate IAM lifecycle process
Perform an access recertification/review.
Periodic or event-driven access reviews evaluate authorization boundaries to remove unneeded entitlements.

Key Concept

Account Lifecycle Operations & Privilege Recertification
Question 1216Question →

An enterprise security architect is transitioning legacy perimeter security controls to align with Zero Trust Architecture (ZTA) design tenets. Match each Zero Trust architectural concept on the left to its corresponding operational function on the right.

Click a left item, then click its matching right item

Items

Implicit Trust Zone Removal
Continuous Adaptive Risk Evaluation
Microsegmentation
Control Plane and Data Plane Separation

Matches

Show answer & explanation

Answer

Implicit Trust Zone Removal corresponds to eliminating default trust based on network location. Continuous Adaptive Risk Evaluation corresponds to dynamically re-evaluating session state and context throughout an active connection. Microsegmentation corresponds to dividing network environments into small isolated zones to restrict lateral movement. Control Plane and Data Plane Separation corresponds to decoupling policy decision logic from application traffic paths.
Each Zero Trust term matches its core architectural operational responsibility: removing implicit trust strips location-based assumptions; continuous adaptive evaluation continuously monitors session context; microsegmentation restricts internal lateral movement; and control/data plane separation decouples policy management from data transit paths.

Step-by-Step Solution

1
Analyze the core premise of Zero Trust regarding network location and implicit trust.
Identify that removing implicit trust eliminates reliance on physical or IP-based network location.
Legacy networks trust internal IP segments; Zero Trust demands zero inherent trust regardless of location.
2
Evaluate session lifetime management principles in Zero Trust.
Map Continuous Adaptive Risk Evaluation to ongoing context and behavioral re-validation.
Authentication and authorization must not be static single-point-in-time checks.
3
Analyze containment strategies within Zero Trust Architecture.
Map Microsegmentation to creating granular isolated zones around workloads to prevent lateral movement.
Breach containment relies on restricting traffic between workload segments.
4
Examine architectural component separation.
Map Control Plane and Data Plane Separation to isolating policy evaluation logic from data traffic transmission.
Policy engines and administrators process control requests independently of raw data forwarding paths.

Key Concept

Zero Trust Architecture Principles
Question 1217Question →

During an enterprise security audit, an incident response team identifies four distinct technical indicators across wireless and wired network segments. Match each observed technical anomaly on the left to its corresponding attack classification on the right.

Click a left item, then click its matching right item

Items

A continuous stream of 802.11 management frames containing reason code 7 sent to client MAC addresses, causing immediate wireless disconnection.
Unsolicited ARP replies broadcasted across a subnet associating the default gateway IP address with an unauthorized host MAC address.
Spurious IPv6 Neighbor Advertisement frames claiming ownership of an existing router link-local address without prior Neighbor Solicitation.
An unauthorized access point broadcasting a corporate SSID with an elevated transmit power (+20 dBm+20\text{ dBm}) to force client reassociation.

Matches

Show answer & explanation

Answer

The technical anomalies match their respective attack categories based on protocol-specific indicators: 802.11 management deauth frames match Deauthentication Attack; unsolicited ARP responses match ARP Poisoning; unauthorized IPv6 Neighbor Advertisements match NDP Spoofing; and rogue APs broadcasting legitimate SSIDs match Evil Twin Attack.
Each technical log indicator aligns directly with its underlying protocol behavior: 802.11 management deauthentication frames force client disconnects (Deauthentication Attack); gratuitous ARP replies corrupt local ARP caches (ARP Poisoning); unsolicited ICMPv6 Neighbor Advertisements corrupt IPv6 neighbor caches (NDP Spoofing); and rogue APs broadcasting identical SSIDs with higher RF signal levels manipulate wireless roaming decisions (Evil Twin Attack).

Step-by-Step Solution

1
Analyze the 802.11 management frame anomaly with reason code 7.
Reason code 7 explicitly denotes explicit wireless disassociation/deauthentication requesting disconnect, matching Deauthentication Attack.
Deauthentication frames are unauthenticated in legacy 802.11 standards and used to force disconnects.
2
Examine the unsolicited ARP response packet capture.
Mapping the gateway IP to an unknown host MAC address manipulates the switch IPv4 neighbor cache, confirming ARP Poisoning.
ARP lacks authentication mechanisms, allowing malicious hosts to spoof mapping responses.
3
Evaluate the IPv6 Neighbor Advertisement anomaly.
NDP Neighbor Advertisements perform address resolution in IPv6 analogous to ARP in IPv4, making unsolicited NA broadcasts indicative of NDP Spoofing.
Without SEND (Secure Neighbor Discovery), NDP messages can be spoofed to divert IPv6 traffic.
4
Identify the rogue AP broadcasting the legitimate corporate SSID.
Mimicking a valid wireless network name with higher power output to trick station roaming algorithms matches the Evil Twin classification.
Wireless clients typically prefer APs with stronger RSSI operating under known SSIDs.

Key Concept

Network and Wireless Attack Indicators
Question 1218Question →

An enterprise identity administrator is enforcing phishing-resistant multi-factor authentication (MFA) for privileged accounts. What is the correct sequence of events for registering a FIDO2 WebAuthn hardware security key with the Identity Provider (IdP)? Place the steps in chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct registration sequence begins with the IdP issuing a cryptographic challenge nonce to the client browser. Next, the user touches the hardware key to generate an origin-bound asymmetric key pair on the device. Then, the security key signs the challenge and returns the signature, public key, and attestation data to the IdP. Finally, the IdP validates the attestation statement and registers the public key to the user's IAM account profile.
The correct sequence follows the standard FIDO2/WebAuthn registration ceremony. First, the Identity Provider initiates the process by issuing a cryptographic challenge nonce to the browser. Second, upon user presence confirmation, the hardware token generates an origin-bound asymmetric key pair. Third, the token signs the challenge with the private key and returns the public key and attestation payload. Fourth, the Identity Provider verifies the attestation and signature before persisting the public key in the user's IAM profile.

Step-by-Step Solution

1
Identify the initial server-side trigger.
The Identity Provider generates a cryptographic challenge nonce to prevent replay attacks during WebAuthn registration.
Challenge creation must occur first so that the hardware key has fresh data to sign.
2
Determine the local hardware token response.
The user completes physical presence verification (e.g., touch sensor), prompting the security key to generate an origin-bound public/private key pair.
The key pair is created on-device in response to the browser receiving the registration challenge.
3
Trace the transmission of cryptographic proof.
The security key signs the challenge nonce using the private key and returns the signature, new public key, and attestation object to the IdP.
The IdP requires the signature and public key to verify authentic token hardware before enrollment.
4
Finalize identity binding at the Identity Provider.
The IdP authenticates the attestation metadata, verifies the signature against the issued challenge, and binds the public key to the user's IAM profile.
Saving the verified public key in the IAM user store is the final step required for future authentication.

Key Concept

FIDO2/WebAuthn Enrollment Ceremony and Cryptographic Credential Binding
Question 1219Question →

A network security team receives a high-severity alert indicating anomalous telemetry from a critical database bridge host. An analyst inspects the correlated Network Flow (NetFlow) logs and DNS query events shown below:

Timestamp: 2026-07-27T14:02:11Z | SrcIP: 10.200.4.15:51204 -> DstIP: 198.51.100.77:443 | Proto: TCP | Bytes: 142 | State: ESTABLISHED
Timestamp: 2026-07-27T14:07:11Z | SrcIP: 10.200.4.15:51210 -> DstIP: 198.51.100.77:443 | Proto: TCP | Bytes: 142 | State: ESTABLISHED
Timestamp: 2026-07-27T14:12:10Z | SrcIP: 10.200.4.15:51216 -> DstIP: 198.51.100.77:443 | Proto: TCP | Bytes: 142 | State: ESTABLISHED
DNS Lookup Query: z9x4k1.ec2-updates-sync.net -> Resolved: 198.51.100.77 (TTL: 30s)

The analyst notes that low-volume outbound encrypted connections occur at fixed 300-second intervals following short-TTL DNS queries for algorithmically generated subdomains. Which of the following mitigation actions should the security analyst perform FIRST to contain the threat while minimizing operational disruption to legitimate encrypted web services?

Show answer & explanation

Answer: Implement Response Policy Zone (RPZ) DNS sinkholing for the malicious domain and configure egress TLS Server Name Indication (SNI) filtering on the web proxy.

Answer

Implement Response Policy Zone (RPZ) DNS sinkholing for the malicious domain and configure egress TLS Server Name Indication (SNI) filtering on the web proxy.
The observed telemetry displays classic indicators of compromised host C2 beaconing: regular timing intervals (300 seconds), uniform low byte size (142 bytes), and dynamic DNS lookups with low TTLs. Employing DNS sinkholing (RPZ) combined with proxy-level SNI filtering precisely disrupts the malicious C2 channel without taking down legitimate outbound HTTPS access on port 443.

Step-by-Step Solution

1
Analyze flow and log telemetry indicators
Identified periodic outbound HTTPS connections (every 300 seconds) with fixed 142-byte payloads to an external IP resolved via short-TTL dynamic DNS, confirming malware C2 beaconing.
Recognizing command and control beaconing behavior isolates the precise threat mechanism.
2
Evaluate candidate mitigation controls for precision and operational impact
Determined that DNS sinkholing via RPZ combined with SNI proxy filtering specifically isolates and redirects malicious communications without impacting unrelated business HTTPS traffic.
Effective security controls must mitigate targeted threats while preserving availability for legitimate services.
3
Select the optimal initial containment step
Selected domain-specific sinkholing and SNI-based egress filtering as the preferred first-line containment strategy.
This approach disrupts C2 reachability immediately with minimal risk of broad service outage.

Key Concept

Network Security Monitoring Alert Analysis and Command & Control (C2) Beacon Containment
Question 1220Question →

During security operations monitoring, an analyst receives an alert indicating anomalous API token creation and unexpected mass repository downloads originating from a compromised developer endpoint connected via VPN. The analyst confirms that an external threat actor is actively leveraging these stolen credentials to access private source code repositories. According to NIST incident response guidelines, which of the following immediate actions should the incident response team perform during the Containment phase of this incident? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Revoke active VPN sessions and invalidate all API tokens associated with the compromised developer account.; Apply restrictive host-based firewall rules to isolate the affected workstation while preserving volatile system memory for analysis.

Answer

The correct containment actions are revoking the active VPN sessions and invalidating stolen API tokens associated with the account, as well as applying host-based firewall rules to isolate the compromised endpoint while preserving volatile memory.
During the containment phase of an incident response process, the goal is to prevent the threat from spreading or causing further damage while preserving forensic evidence. Revoking compromised credentials and API tokens stops the attacker from continuing exfiltration, while network-isolating the host prevents lateral movement while preserving volatile system RAM for forensic investigation.

Step-by-Step Solution

1
Identify the primary phase of the incident response lifecycle requested in the scenario.
The scenario specifically asks for actions appropriate for the Containment phase of the NIST SP 800-61 IR framework.
Containment limits the scope and impact of an active breach before recovery steps begin.
2
Evaluate containment actions that immediately halt adversary activity without destroying digital evidence.
Revoking active credentials/tokens stops ongoing unauthorized remote access. Isolating the workstation network interface prevents lateral movement while retaining volatile RAM data.
Effective containment balances stopping threat activity with evidence preservation.
3
Distinguish containment phase actions from eradication, recovery, or post-incident activities.
Actions such as re-imaging hosts or holding lessons learned sessions belong to later IR phases.
Prematurely re-imaging hosts destroys forensic evidence before containment and investigation are complete.

Key Concept

NIST Incident Response Containment Phase Strategies
PreviousPage 61 / 112Next
All practice questions — CompTIA Security+ | Examkin