Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1221Question →

A Security Operations Center (SOC) analyst is reviewing an automated response playbook triggered by an Endpoint Detection and Response (EDR) agent following a suspected credential dumping attack against a high-value server. In what chronological sequence should the EDR agent and SOC workflow execute these actions to contain the threat and preserve forensic evidence?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence is: 1) Detect anomalous API memory read requests targeting LSASS, 2) Enforce host-level software network isolation, 3) Capture a volatile memory dump and terminate the offending process tree, and 4) Query tenant-wide EDR telemetry to identify other impacted endpoints.
The sequence follows the core EDR lifecycle: Detection must precede response; host-level network isolation must be established immediately after detection to block lateral spread; volatile memory collection and process termination follow isolation to safely remediate the host; and tenant-wide telemetry correlation occurs last to assess broader enterprise compromise.

Step-by-Step Solution

1
Identify initial threat activity.
The EDR behavioral monitor alerts on unauthorized memory access to sensitive system processes.
Detection provides the trigger for automated playbook execution.
2
Isolate the compromised system.
Host-based firewall rules block all inbound/outbound communication except EDR management connections.
Containment limits adversary lateral movement while keeping SOC visibility intact.
3
Acquire evidence and eradicate host execution.
Physical memory artifacts are saved to disk, followed by process tree termination.
Preserving volatile RAM prior to or simultaneously with process termination ensures critical memory-resident indicators are retained.
4
Perform enterprise scope analysis.
Telemetry indicators from the alert are cross-referenced across all enterprise endpoints.
Broader threat hunting ensures full scope eradication across the enterprise domain.

Key Concept

EDR Automated Containment and Incident Response Workflow Sequence
Question 1222Question →

A security analyst conducts both a credentialed host vulnerability assessment and a non-credentialed network scan against a critical Linux database server. The non-credentialed network scan reports zero critical vulnerabilities, whereas the credentialed scan identifies multiple unpatched kernel vulnerabilities and weak local file permissions. Additionally, internal host firewalls on the server are configured to drop ICMP and block unauthenticated port probing from outside the local management subnet. Which of the following best explains the discrepancy between the two scan results?

Show answer & explanation

Answer: The host firewall filtered the non-credentialed scanner's network probes, and non-credentialed scans lack the local OS permissions required to audit internal patch levels and configuration files.

Answer

The host firewall filtered the non-credentialed scanner's network probes, and non-credentialed scans lack the local OS permissions required to audit internal patch levels and configuration files.
The option explaining that the host firewall filtered network probes while non-credentialed scans lack local OS permissions is correct. Credentialed scans log into the operating system using valid account privileges to audit internal configurations, installed packages, kernel versions, and local user rights. Non-credentialed scans view the target solely from the network perspective; if network traffic is blocked by firewalls or ACLs, or if vulnerabilities are internal to the OS configuration, non-credentialed scans will produce false negatives.

Step-by-Step Solution

1
Analyze the operational difference between credentialed and non-credentialed vulnerability scans.
Credentialed scans authenticate to the host OS using administrative credentials to inspect local files, registries, and patch status. Non-credentialed scans only examine network-exposed ports, banners, and services.
Understanding scan context determines what visibility each scanner type possesses.
2
Evaluate the impact of the target server's host firewall configuration.
The host firewall drops unauthenticated probes, causing the non-credentialed network scanner to see closed/filtered ports and miss running services.
Network filtering prevents non-credentialed scanners from reaching listening services or gathering banner information.
3
Synthesize why the credentialed scan successfully uncovered unpatched kernel flaws and weak permissions.
Because the credentialed scan authenticated locally, it bypassed network firewall restrictions and directly queried local system state (kernel version, patch history, and file system permissions).
Local system access provides complete visibility regardless of perimeter network controls.

Key Concept

Credentialed vs. Non-Credentialed Vulnerability Scanning
Estimated Time:2m 0s
Question 1223Question →

An IAM administrator at an enterprise health system is conducting emergency offboarding for a compromised account. The administrator disables the user's account in the on-premises Active Directory. However, an hour later, security operations detects ongoing unauthorized administrative API calls performed in the cloud SaaS platform using that identity. Upon reviewing the SCIM bridge synchronization logs, the analyst observes the following log entries:

[2026-07-27 14:02:11] WARN scim_sync_engine: PATCH /Users/usr_88291 HTTP/1.1 429 Too Many Requests - Rate limit exceeded. Account deprecation push failed.
[2026-07-27 14:02:11] INFO scim_sync_engine: Exponential backoff retry scheduled for 14,400 seconds.
[2026-07-27 14:15:00] AUDIT saas_api_gateway: Token authentication successful for usr_88291 via Bearer JWT. Active session valid.

Which of the following operational remediation actions should the analyst take FIRST to immediately terminate the unauthorized active cloud session?

Show answer & explanation

Answer: Revoke active OAuth 2.0/JWT access and refresh session tokens directly within the cloud SaaS administrative portal.

Answer

Revoke active OAuth 2.0/JWT access and refresh session tokens directly within the cloud SaaS administrative portal.
Directly revoking the active OAuth 2.0/JWT session and refresh tokens within the cloud SaaS administrative portal is the most direct and immediate operational control to kill the compromised session. Because the SCIM provisioning bridge failed due to HTTP 429 rate limiting, relying on automated account disabling will take up to four hours (the scheduled backoff period). Explicit session revocation invalidates the bearer token at the cloud gateway immediately.

Step-by-Step Solution

1
Analyze the log entries to identify the root cause of ongoing unauthorized access.
The SCIM synchronization bridge failed to push the disabled account status to the cloud provider due to HTTP 429 rate limiting, leaving the account active in the cloud while an active JWT bearer token remained valid.
Stateless authentication tokens (JWTs) remain valid until expiration or explicit token revocation at the API gateway/identity provider.
2
Evaluate containment actions for immediate session termination.
Directly revoking session tokens inside the SaaS portal terminates active sessions immediately without waiting for automated provisioning sync retries.
Token revocation is the primary operational response for terminating active session hijackings or compromised identity tokens.

Key Concept

Identity Lifecycle Operations and Active Session Revocation
Estimated Time:2m 0s
Question 1224Question →

During a routine audit of enterprise endpoint logs, a threat hunter discovers an unauthorized, memory-resident process running on an HR file server that is actively sending encrypted outbound beacons to a suspicious external IP address. Initial investigation confirms an active Command and Control (C2) connection. According to standard incident response frameworks, which of the following actions should the security team take FIRST?

Show answer & explanation

Answer: Disconnect the infected HR file server from the network segment to prevent lateral movement while maintaining system power to preserve volatile RAM.

Answer

The security team should first disconnect the infected file server from the network segment to contain the threat while keeping power connected to preserve volatile memory.
According to the NIST Incident Response lifecycle (Preparation, Detection & Analysis, Containment, Eradication & Recovery, Post-Incident Activity), the immediate priority upon confirming an active compromise is containment. Network isolation prevents the attacker from exfiltrating data or moving laterally, while keeping the machine powered preserves volatile memory (RAM) necessary for memory forensics.

Step-by-Step Solution

1
Identify the current incident response phase
The incident is transitioning from detection and analysis to the containment phase due to active C2 traffic.
Once an active compromise is confirmed, immediate containment is required to halt communication and lateral movement.
2
Determine the appropriate immediate containment action
Network isolation stops outbound C2 beacons and prevents lateral propagation while leaving the system powered on preserves volatile memory (RAM) for analysis.
Standard NIST SP 800-61 incident response guidelines require containment before eradication and recovery steps can proceed safely.

Key Concept

Incident Response Lifecycle Phases and Containment Strategies
Question 1225Question →

An EDR console triggers a high-severity behavioral alert on an enterprise application server after detecting an obfuscated PowerShell execution that attempts process injection into a legitimate system process and initiates an outbound connection to an unknown external IP address. Which of the following initial containment and investigation actions should the security analyst perform directly using EDR console capabilities? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply host-level network isolation to the endpoint while maintaining management channel connectivity.; Kill the malicious process tree and capture a volatile memory dump for forensic analysis.

Answer

The analyst should isolate the host endpoint from the network while preserving EDR management communications and terminate the suspicious process tree while capturing volatile memory for investigation.
Isolating the endpoint network traffic while retaining agent communication stops malicious lateral movement without severing SOC management, and terminating process trees alongside volatile memory acquisition halts code execution while preserving volatile evidence.

Step-by-Step Solution

1
Initiate network isolation on the affected endpoint
Prevents lateral movement and command-and-control communication while leaving the EDR management channel active.
Containment is the immediate priority during an active process injection incident.
2
Terminate malicious processes and collect volatile memory telemetry
Stops malicious payload execution and captures RAM data required for memory analysis.
Preserves forensic evidence before process termination or host modification.

Key Concept

Endpoint Detection and Response (EDR) Host Isolation and Process Containment
Estimated Time:1m 30s
Question 1226Question →

Following an alert indicating that an unauthorized process attempted to dump LSASS memory on a corporate workstation, a security analyst needs to prevent the compromised host from communicating with internal network assets while preserving the host's active connection to the central EDR console for remote incident triage. Which of the following capabilities should the analyst execute?

Show answer & explanation

Answer: Host network isolation

Answer

Host network isolation is the appropriate EDR capability to stop lateral movement while retaining agent communication for incident triage.
Host network isolation configures the local software driver or agent to block all network traffic to and from the host, with an exception for the encrypted control channel to the EDR management platform. This effectively stops lateral movement across the enterprise while enabling security analysts to perform remote triage, memory dumps, and remediation actions.

Step-by-Step Solution

1
Identify containment objectives during an active host compromise
The host must be restricted from communicating with other internal network systems.
Preventing lateral movement limits the spread of post-exploitation activities across the enterprise.
2
Evaluate EDR features that isolate endpoints while retaining management control
Host network isolation applies software-defined filtering at the endpoint level, dropping user-space and local network traffic while keeping the EDR telemetry socket open.
Security operations teams require uninterrupted telemetry access to collect volatile data and execute response playbooks remotely.

Key Concept

Endpoint Detection and Response (EDR) Host Network Isolation
Estimated Time:1m 0s
Question 1227Question →

During an active incident investigation on an enterprise Linux application server, an incident responder detects suspicious process execution originating from a kernel module. The server remains powered on and connected to the internal network segment. To preserve evidence while minimizing the loss of transient data, which of the following actions should the analyst perform FIRST according to the order of volatility?

Show answer & explanation

Answer: Capture the system RAM using a specialized live memory acquisition tool.

Answer

The incident responder should capture the system RAM using a specialized live memory acquisition tool prior to acquiring non-volatile storage or altering system state.
Capturing system RAM using a live acquisition tool is the correct initial action because volatile memory contains temporary process states, network connections, and loaded kernel modules that are permanently erased when the machine is shut down. According to the order of volatility, memory collection must precede persistent drive imaging.

Step-by-Step Solution

1
Identify the volatility level of candidate evidence sources.
System RAM and CPU registers are categorized as highly volatile, while local disk storage and network logs are far less volatile.
The order of volatility dictates collecting the most transient data first before it is modified or permanently lost.
2
Perform live acquisition of volatile memory.
A memory dump image is saved to secure external storage.
Preserving running processes, kernel structures, and active connections requires live RAM capture before system power state alterations occur.
3
Calculate and record cryptographic hashes of the memory dump file.
Integrity baseline is established for chain of custody tracking.
Ensures that acquired forensic artifacts can be validated against subsequent modifications during legal proceedings.

Key Concept

Order of Volatility in Digital Forensics
Question 1228Question →

During a security assessment of a legacy network daemon written in C, security engineers identify that user-supplied input is copied directly into a fixed-size stack buffer using the `strcpy()` function without length checking. A junior developer proposes deploying a Web Application Firewall (WAF) to filter incoming traffic as the primary remediation. Which statement best evaluates the proposed solution and identifies the most effective remediation?

Show answer & explanation

Answer: Deploying a network-level control such as a WAF does not resolve the underlying flaw in the application code; the source code must be modified to implement bounds checking or safe string functions.

Answer

Network-level controls like a WAF do not eliminate software defects; source code modification to enforce bounds checking or safe functions is required.
The correct answer emphasizes that network-level filtering like a WAF is merely a temporary or compensating filter. Complete remediation of a buffer overflow requires securing the application code directly using memory-safe functions or explicit input length checking before copying data to fixed memory buffers.

Step-by-Step Solution

1
Analyze the identified vulnerability
The flaw is an unsafe memory operation in C (`strcpy()`) that creates a stack-based buffer overflow condition.
Understanding the root cause is necessary to select an appropriate mitigation control.
2
Evaluate the proposed mitigation strategy
A WAF operates at the perimeter or application edge and cannot fix memory handling errors inside compiled application binaries.
Perimeter filters may be bypassed and do not correct vulnerable application logic.
3
Determine the proper remediation control
The application code must be remediated directly by replacing `strcpy()` with bounded alternatives like `strncpy()` or using memory-safe safe functions.
Defective software implementation must be resolved at the application source level to ensure effective risk reduction.

Key Concept

Remediating application memory vulnerabilities requires code-level fixes (secure coding standards/bounds checking) rather than sole reliance on external network controls.
Question 1229Question →

A Security Operations Center (SOC) analyst wants to standardize and automate the incident response steps for phishing alerts. The workflow needs to automatically extract suspicious URLs, query threat intelligence sources, and isolate affected endpoints without manual intervention. Which SOAR component should the analyst configure to execute this automated sequence of actions?

Show answer & explanation

Answer: A security playbook

Answer

A security playbook is the SOAR component used to execute automated, multi-step incident response workflows.
A security playbook is a automated linear or conditional script used by SOAR platforms to orchestrate incident response processes across connected systems. It allows SOC teams to automate repeated tasks such as extracting indicators, querying threat feeds, and isolating compromised hosts.

Step-by-Step Solution

1
Identify the primary operational requirement in the scenario.
The requirement is to define and execute an automated sequence of multi-tool actions (triage, threat lookup, endpoint isolation).
Understanding the goal distinguishes detection mechanisms from automation and orchestration mechanisms.
2
Evaluate the capabilities of Security Automation and Orchestration (SOAR).
SOAR uses playbooks (or runbooks) to codify step-by-step incident response workflows into executable logic using APIs.
Playbooks provide the automated conditional logic required to coordinate tasks across distinct security tools.

Key Concept

SOAR Playbooks and Automated Response
Question 1230Question →

An analyst receives an automated intrusion detection alert indicating suspicious outbound traffic from a workstation. Place the initial network security monitoring and triage steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: First, validate the initial network alert to verify whether it represents a real event or false positive; second, examine relevant packet captures and netflow logs to determine the scope; third, isolate the affected workstation from the network; fourth, document the monitoring findings and notify the incident response team.
Effective network security monitoring follows a structured workflow: alert triage and validation must happen first, followed by telemetry inspection to scope the incident, host isolation to contain risk, and finally thorough documentation and incident escalation.

Step-by-Step Solution

1
Alert Validation
Confirmed genuine alert requiring investigation.
Before acting on an alert, security analysts must rule out false positives.
2
Telemetry & Log Analysis
Identified destination IP address and traffic volume.
Reviewing packet captures and network flows helps identify the exact nature and extent of the threat.
3
Host Containment
Workstation disconnected from local subnet.
Preventing lateral movement or exfiltration is critical once suspicious activity is confirmed and scoped.
4
Documentation & Escalation
Alert ticket updated and escalated to tier-2 incident response.
Proper documentation ensures complete chain-of-custody and smooth operational handoff.

Key Concept

Network Security Monitoring Triage & Incident Workflow
Question 1231Question →

A security operations center (SOC) detects an active compromise of an administrative account with elevated privileges across hybrid cloud infrastructure. To contain the incident and restore secure identity operations according to privileged access management (PAM) best practices, place the mitigation and lifecycle remediation steps in the correct chronological sequence.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order for containing and remediating a compromised privileged account is: First, terminate active sessions and invalidate tokens at the IdP; second, trigger an automated SCIM push to revoke downstream federated SaaS access; third, rotate vaulted credentials within the PAM solution; fourth, perform an IGA entitlement recertification audit.
In security operations, incident containment prioritizes immediate threat suppression: active session termination and token invalidation at the IdP stop ongoing adversary actions. Once centralized sessions are severed, automated SCIM provisioning pushes account disablement to downstream federated services. Next, secrets stored in the PAM vault are rotated to prevent credential reuse. Finally, IGA recertification cleanses unauthorized entitlement changes made by the threat actor.

Step-by-Step Solution

1
Perform immediate active session containment
Active adversary connections are terminated and access tokens are invalidated at the centralized Identity Provider.
Containment must occur at the root IdP level before attackers can pivot or establish additional persistence mechanisms.
2
Synchronize account disablement across federated environments
SCIM protocol updates disable state across external Service Providers (SPs).
Relying solely on central IdP disablement without SCIM or continuous access evaluation (CAE) can leave active SaaS sessions functional until refresh tokens expire.
3
Rotate administrative secrets and vault baseline credentials
All static and dynamic passwords, API keys, and certificates associated with the compromised account are refreshed in the PAM vault.
Vault rotation ensures that harvested credentials cannot be reused to re-authenticate after sessions are killed.
4
Execute post-incident Identity Governance and Administration (IGA) recertification
All granted entitlements, group memberships, and role assignments are audited and reconciled against authorization baseline policies.
IGA recertification verifies that persistence mechanisms, such as unauthorized role assignments created during the incident, are completely removed.

Key Concept

Identity Lifecycle and Incident Response Containment in IAM Operations
Question 1232Question →

A renewable energy utility operates remote maintenance workstations connected to solar farm Supervisory Control and Data Acquisition (SCADA) controllers. Under the existing access model, once a field technician completes initial multi-factor authentication (MFA) at the start of their shift, the active network connection is granted persistent trust across all internal SCADA subnets. The organization wants to refactor this workflow to align with core Zero Trust Architecture principles. Which of the following implementation strategies best satisfies this requirement?

Show answer & explanation

Answer: Continuously evaluating user risk metrics and endpoint compliance signals before granting access to each subsequent SCADA resource.

Answer

Continuously evaluating user risk metrics and endpoint compliance signals before granting access to each subsequent SCADA resource represents the correct implementation of Zero Trust principles.
Zero Trust Architecture eliminates implicit trust tied to network location or past authentication. By continuously evaluating contextual risk factors—such as user activity, endpoint security posture, and resource sensitivity—before granting access to specific assets, the system maintains strict explicit verification at all times.

Step-by-Step Solution

1
Analyze the existing architecture weakness described in the scenario.
The current model relies on persistent, implicit trust across network subnets after an initial shift authentication.
Zero Trust Architecture explicitly forbids granting implicit trust based solely on initial authentication or network location.
2
Evaluate the architectural controls against Zero Trust core tenets.
Dynamic assessment of device posture, context, and user risk scores for every individual resource request removes implicit trust and enforces explicit verification continuously.
Zero Trust requires continuous authorization evaluations rather than one-time perimeter access.

Key Concept

Continuous explicit verification and elimination of implicit trust in Zero Trust Architecture
Question 1233Question →

Match each vulnerability assessment scan type to its defining operational characteristic.

Click a left item, then click its matching right item

Items

Credentialed Scan
Non-Credentialed Scan
Passive Scan
Intrusive Scan

Matches

Show answer & explanation

Answer

Credentialed Scan pairs with using system-level privileges for internal inspection; Non-Credentialed Scan pairs with unauthenticated external probing of exposed services; Passive Scan pairs with silently monitoring traffic flow without sending probes; Intrusive Scan pairs with executing tests that risk system instability or service disruption.
Each vulnerability scan type aligns with its specific operational profile: credentialed scans access host interiors using privileges, non-credentialed scans inspect external attack surfaces without privileges, passive scans collect intelligence from network traffic without packet injection, and intrusive scans run aggressive tests that may disrupt target availability.

Step-by-Step Solution

1
Identify the authentication level of the scan types.
Credentialed scans use local privileges for deep inspection, whereas non-credentialed scans simulate unauthenticated external observers.
Differentiating authentication capabilities clarifies internal inventory auditing versus surface attack view.
2
Analyze the operational impact and network traffic generation of the remaining scan types.
Passive scans capture existing traffic without transmitting data, while intrusive scans actively interact with vulnerabilities and risk causing service outages.
Understanding network traffic generation helps separate non-interfere monitoring from high-impact active testing.

Key Concept

Vulnerability assessment scan classifications (Credentialed, Non-Credentialed, Passive, Intrusive)
Question 1234Question →

During a high-volume credential stuffing campaign targeted at an enterprise web portal, an automated Security Orchestration, Automation, and Response (SOAR) playbook is triggered upon detecting repeated failed authentication alerts. To rapidly mitigate the active attack while minimizing the risk of self-inflicted service outages on critical infrastructure, which of the following actions should be configured as the initial automated response step in the playbook?

Show answer & explanation

Answer: Dynamically apply a temporary perimeter firewall drop rule for the external source IP addresses associated with the failed login requests while querying threat intelligence feeds for enrichment.

Answer

Dynamically applying a temporary perimeter firewall drop rule for the external source IP addresses associated with the failed login requests while querying threat intelligence feeds for enrichment.
The correct response dynamically blocks the external source IP addresses carrying out the attack at the perimeter while enriching alert data via threat intelligence. This encapsulates the core purpose of Security Automation and Orchestration (SOAR)—executing rapid, low-risk containment steps automatically while preserving system availability.

Step-by-Step Solution

1
Identify the primary goal of automated SOAR incident response containment.
The objective is to stop malicious ingress traffic rapidly while preserving infrastructure availability.
Effective automation must balance rapid threat containment against operational risk to core business services.
2
Evaluate the operational scope of perimeter blocking versus internal infrastructure shutdown.
Blocking external malicious IP addresses at the perimeter mitigates attack traffic without taking down internal authentication services or revoking legitimate user access rights.
Targeting external attack vectors at the boundary avoids collateral damage to internal systems.

Key Concept

Security Automation Playbook Design and Risk-Aware Containment
Question 1235Question →

Place the typical steps of an automated Security Orchestration, Automation, and Response (SOAR) incident playbook in the correct operational sequence from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence for an automated SOAR playbook is: 1) Ingest the alert payload automatically from a SIEM or EDR integration, 2) Enrich the alert data by querying external threat intelligence feeds for IP and domain reputation, 3) Execute active containment measures, such as applying a firewall block rule or isolating the affected endpoint, and 4) Update the incident ticket in the ITSM platform with execution logs and notify the security analyst.
An automated SOAR incident response playbook follows a logical operational flow: alert ingestion occurs first upon event detection, followed immediately by automated threat intelligence enrichment. After validating indicators, the playbook executes active containment integrations (such as network blocks or host isolation), and concludes by updating the ticketing system with full execution logs.

Step-by-Step Solution

1
Trigger workflow upon alert reception
Alert data is passed into the SOAR engine.
An automated playbook requires a triggered event payload to initiate execution.
2
Perform contextual threat enrichment
Indicators of compromise are checked against threat intelligence.
Gathering context ensures containment decisions are based on verified threat reputation.
3
Invoke automated containment integrations
Network perimeter or endpoint controls block the threat.
Containment API calls execute after conditions and enrichment checks pass.
4
Complete ticketing and analyst notification
The incident tracking system records all automated actions.
Final documentation and audit trail updates occur after containment actions finish.

Key Concept

SOAR Playbook Execution Lifecycle
Question 1236Question →

A security administrator is evaluating a high-availability perimeter firewall pair deployed in an active-passive failover configuration. During a scheduled failover simulation, the secondary appliance successfully assumed the virtual IP address and began handling traffic, but all active client TCP sessions were abruptly dropped, forcing users to re-authenticate. The administrator must update the architecture so that existing connection states persist uninterrupted across failover events. Which of the following solutions should the administrator implement?

Show answer & explanation

Answer: Stateful session synchronization across the cluster members

Answer

Stateful session synchronization across the cluster members
Stateful session synchronization continuously transmits connection tracking data, NAT tables, and TCP state details across a dedicated heartbeat/sync interface between high-availability nodes. When the passive node assumes primary status, it already possesses the exact state of all active connections, enabling uninterrupted traffic flow without forcing clients to re-establish connections.

Step-by-Step Solution

1
Analyze the observed issue during the active-passive firewall failover test.
The secondary node successfully acquired network ownership (virtual IP), but dropped active client TCP connections, indicating a lack of dynamic session state sharing.
Basic high availability virtual IP mechanisms (like VRRP or CARP) manage IP address migration but do not natively copy active memory tables across hosts.
2
Evaluate the architectural control required for seamless session persistence.
Stateful session synchronization must be configured over a dedicated sync link to continuously replicate session state tables.
This allows the backup appliance to track open TCP connections and immediately service existing client traffic without requiring session re-establishment.

Key Concept

Stateful Session Failover vs. Hardware Fault Tolerance
Estimated Time:1m 15s
Question 1237Question →

An incident response team is reviewing operational logs from an enterprise Privileged Access Management (PAM) system after an emergency database restoration. The following audit log snippet was recorded during the incident:

[11:02:15] PAM_VAULT: Account 'bg_admin01' checked out by user 'j.doe'. Reason: INC-9904.
[11:02:16] PAM_VAULT: Temporary credentials issued; rotate-on-checkin timer active (4 hours).
[11:02:20] PAM_PROXY: SSH session initiated to target 'db-prod-01' by 'bg_admin01'. Live session recording enabled.
[11:45:10] PAM_VAULT: Account 'bg_admin01' manually checked back in by user 'j.doe'.

Based on identity and access management operational standards, which automated action should the PAM solution perform immediately upon account check-in?

Show answer & explanation

Answer: Rotate the credential password and terminate any active sessions associated with the checked-in account.

Answer

The PAM solution should immediately rotate the account password and invalidate any active sessions tied to the break-glass account upon check-in.
Privileged Access Management (PAM) systems use password vaulting and checked-out credential management to secure administrative access. When a user manually checks in a break-glass or shared administrative account, the PAM software immediately rotates the password in the target environment and revokes active proxy connections. This ensures the credentials used during the session cannot be reused.

Step-by-Step Solution

1
Analyze the log entries for account lifecycle events.
Identified that user 'j.doe' checked out emergency break-glass account 'bg_admin01' at 11:02:15 and checked it back in at 11:45:10.
Break-glass accounts utilize temporary credentials intended only for emergency window usage.
2
Determine the security requirements of a Privileged Access Management (PAM) vault check-in workflow.
Upon check-in, the PAM solution must ensure single-use credential integrity by invalidating the issued secret.
Automated password rotation prevents credential reuse, shoulder surfing exploits, and unauthorized persistent access.
3
Select the operational action that maintains zero-trust principle and least privilege.
The PAM system automatically rotates the password and terminates lingering proxy sessions.
This guarantees that the temporary authorization period is closed immediately upon work completion.

Key Concept

Privileged Access Management (PAM) Break-Glass Account Lifecycle & Automatic Credential Rotation
Question 1238Question →

An enterprise infrastructure team discovers that an infected internal workstation executed fileless malware that established an encrypted outbound connection to an external command-and-control server. Traditional signature-based antivirus and perimeter firewalls failed to identify or restrict the malicious activity. To contain the active compromise immediately while ensuring SOC analysts retain remote telemetry collection and administrative management access to the host, which of the following Endpoint Detection and Response (EDR) capabilities should be executed?

Show answer & explanation

Answer: Initiate host-level network isolation with console management exemptions

Answer

Initiate host-level network isolation with console management exemptions
Host-level network isolation applied by an EDR agent restricts all network traffic to and from the infected endpoint, blocking outbound C2 beacons and preventing lateral movement. Crucially, EDR agents maintain an explicit channel exemption for management traffic back to the cloud or on-premises security console, allowing analysts to perform remote remediation and forensic triage.

Step-by-Step Solution

1
Analyze the incident requirements
Identified the need to instantly halt outbound command-and-control (C2) activity and internal lateral movement from a compromised host while keeping remote forensic and management connectivity intact.
Containment must occur at the endpoint layer without blinding security operations analysts.
2
Evaluate EDR containment mechanisms versus legacy defenses
Determined that host-level network isolation enforces software-defined isolation on the endpoint network stack.
Perimeter firewalls cannot stop internal lateral movement, and signature updates cannot contain active fileless threats.
3
Verify EDR console communication persistence
Confirmed that EDR host isolation policies explicitly preserve the agent-to-console management tunnel.
Analyst access to endpoint telemetry and automated playbook execution relies on maintaining this isolated management connection.

Key Concept

Endpoint Detection and Response (EDR) Host Isolation
Estimated Time:1m 30s
Question 1239Question →

A security analyst at a global logistics firm is reviewing central SIEM authentication logs following an automated threat alert. The log snippet reveals the following sequential events:

text
[08:15:02 UTC] IdP_SSO SUCCESS User: [email protected] Src_IP: 198.51.100.45 (New York, US) Auth: SAML+FIDO2
[08:16:35 UTC] Legacy_VPN SUCCESS User: [email protected] Src_IP: 203.0.113.88 (London, UK) Auth: RADIUS/PAP
[08:18:10 UTC] PAM_Gateway ALERT User: [email protected] Direct SSH attempt to Core_DB bypassing PAM proxy

Based on these logs, which of the following measures should the security team implement to contain the threat and mitigate the underlying operational IAM vulnerability? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Investigate potential credential harvesting or session hijacking indicated by the impossible travel time anomaly between authentication events.; Deprecate legacy authentication protocols that bypass cloud Identity Provider (IdP) conditional access policies and multi-factor authentication (MFA).

Answer

The security team must investigate potential credential harvesting or session hijacking indicated by the impossible travel anomaly, and deprecate legacy authentication protocols that bypass IdP conditional access and MFA controls.
The correct measures are analyzing the impossible travel anomaly (New York to London in 93 seconds) to detect compromised credentials or session theft, and disabling legacy authentication protocols (RADIUS/PAP) that allow threat actors to circumvent conditional access and MFA controls enforced by modern IdPs.

Step-by-Step Solution

1
Analyze SIEM authentication event timestamps and source locations.
Identified successful sign-in from New York via SAML+FIDO2 at 08:15:02 UTC followed by a successful sign-in from London via RADIUS/PAP at 08:16:35 UTC.
Authenticating from two distant geographic locations within 93 seconds represents an impossible travel scenario, indicating credential theft or compromise.
2
Evaluate authentication protocol weaknesses exposed in the logs.
Discovered that legacy RADIUS/PAP protocols remain enabled on the VPN gateway.
Legacy authentication mechanisms bypass modern IdP-enforced MFA and conditional access evaluation, creating an easily exploitable attack vector.
3
Select effective operational IAM remediation strategies.
Initiate incident response for credential harvesting/hijacking and disable/block legacy authentication protocols across all enterprise gateways.
These steps address both the immediate compromise incident and the architectural gap allowing protocol fallback attacks.

Key Concept

Identity and Access Management Operations Log Correlation and Legacy Protocol Hardening
Question 1240Question →

A security operations team is refining its enterprise vulnerability management program to address scanning anomalies, deployment gaps, and risk prioritization metrics across diverse infrastructure assets. Match each vulnerability scanning scenario to its most appropriate operational response or root cause analysis.

Click a left item, then click its matching right item

Items

A scheduled credentialed scan reports zero vulnerabilities on a critical server, but raw scan logs reveal an SMB authentication failure during initial target enumeration.
A vulnerability scanner flags a critical zero-day vulnerability on an internal server, but local host isolation and air-gapped network segmentation negate the primary exploit vector.
Short-lived ephemeral container instances in a cloud environment complete their execution cycles between scheduled daily network scanning windows.
A vulnerability scanner flags an outdated software version, but local package management logs confirm the vendor backported the security patch without incrementing the main version string.

Matches

Show answer & explanation

Answer

1. The scenario involving SMB authentication failure pairs with verifying service account permissions, firewall ingress rules, and remote administrative interface access.
2. The scenario involving host isolation and air-gapped network segmentation reducing exploitability pairs with adjusting environmental and temporal CVSS metrics in the risk tracking system.
3. The scenario involving short-lived ephemeral containers missing scheduled scan windows pairs with shifting to continuous container registry scanning and CI/CD pipeline integration.
4. The scenario involving vendor backporting of security patches resulting in incorrect software version flags pairs with classifying the finding as a false positive, verifying package logs, and documenting an exception.
Each scenario represents a distinct operational operational challenge in vulnerability management: authentication troubleshooting for incomplete scans, CVSS environmental metric tailoring for isolated assets, container image registry scanning for ephemeral cloud workloads, and false positive exception handling for backported security patches.

Step-by-Step Solution

1
Analyze authentication failure logs in credentialed vulnerability scans.
Recognize that authentication failures revert credentialed scans to less comprehensive non-credentialed probes, requiring administrative credential and network access troubleshooting.
Credentialed scans require local host access via SMB/SSH to enumerate missing patches accurately.
2
Evaluate risk scoring contextual adjustments for compensating security controls.
Determine that environmental CVSS scoring factors in existing infrastructure mitigations such as air-gapping and network isolation.
CVSS Base Scores assess intrinsic vulnerability severity, whereas Environmental Scores reflect specific deployment contexts.
3
Address visibility gaps associated with dynamic microservices and cloud workloads.
Select static image scanning in registries and CI/CD pipelines over periodic network IP scanning.
Short-lived container lifecycles expire before scheduled network scanning passes occur.
4
Identify signature-based scanner inaccuracies caused by enterprise Linux patch backporting.
Confirm false positive status through local package verification and establish scanner exception rules.
Banner-grabbing scanners frequently fail to detect backported patches that leave main version strings unchanged.

Key Concept

Operational Assessment, Vulnerability Scanner Troubleshooting, and Environmental Risk Prioritization
PreviousPage 62 / 112Next
All practice questions — CompTIA Security+ | Examkin