Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1241Question →

A security administrator is auditing an organization's identity lifecycle procedures to ensure clear operational separation between authentication and authorization controls. Which of the following operational activities specifically perform authentication? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Verifying a user's time-based one-time password (TOTP) token during the login sequence; Validating submitted user credential hashes against an Active Directory domain controller

Answer

Verifying a user's time-based one-time password (TOTP) token during the login sequence and validating submitted user credential hashes against an Active Directory domain controller specifically perform authentication.
Authentication strictly addresses identity verification. Verifying TOTP tokens and checking submitted credentials against an Active Directory domain controller both serve to confirm that a user is who they claim to be.

Step-by-Step Solution

1
Define authentication within IAM operations.
Authentication is the process of proving a claimed identity using credentials, tokens, or biometric factors.
Establishing identity must happen before access permissions can be evaluated.
2
Evaluate each activity against the definition of authentication.
Checking TOTP tokens and validating password hashes verify identity claims. Configuring folder permissions assigns rights (authorization), and trusting internal subnets assumes implicit network trust without identity verification.
Only mechanisms that validate claimed identity qualify as authentication operations.

Key Concept

Distinguishing identity verification (authentication) from access control enforcement (authorization) and perimeter implicit trust in IAM operations.
Question 1242Question →

During network telemetry monitoring, a security technician observes an alert generated when an internal workstation attempts an unauthorized connection to a non-production server that contains simulated sensitive files and no real enterprise services. Which of the following network security monitoring concepts is actively being utilized in this scenario?

Show answer & explanation

Answer: A honeypot deployed as a deception mechanism to detect unauthorized internal access

Answer

A honeypot deployed as a deception mechanism to detect unauthorized internal access
A honeypot is a security control designed to act as a decoy to lure potential attackers or unauthorized users. Because a honeypot has no legitimate business purpose or real production traffic, any interaction or connection attempt made to it generates a high-confidence alert for security analysts.

Step-by-Step Solution

1
Analyze the network monitoring scenario
Identified a non-production decoy server designed with simulated data to attract interaction.
Security monitoring systems use intentionally vulnerable or decoy assets to alert security teams of lateral movement or unauthorized scanning.
2
Evaluate the security mechanism type
Decoy systems intended for detection and threat intelligence gathering are classified as honeypots.
Honeypots do not serve legitimate business functions, so any connection attempt to one triggers a high-fidelity alert.

Key Concept

Honeypots and Deception Technologies in Network Security Monitoring
Question 1243Question →

A security architect is evaluating hardware security controls for enterprise hardware and embedded system deployments. Match each hardware security component on the left to its corresponding security capability on the right.

Click a left item, then click its matching right item

Items

Secure Element (SE)
Baseboard Management Controller (BMC)
Memory Protection Unit (MPU)
Hardware Root of Trust (eFuse / Immutable ROM)

Matches

Show answer & explanation

Answer

The correct matches pair Secure Element (SE) with tamper-resistant credential storage; Baseboard Management Controller (BMC) with out-of-band remote management; Memory Protection Unit (MPU) with hardware memory region isolation; and Hardware Root of Trust (eFuse / Immutable ROM) with unalterable boot validation.
Each hardware component is correctly mapped to its essential function: Secure Elements handle isolated credential and key storage; Baseboard Management Controllers perform out-of-band remote administration; Memory Protection Units enforce internal memory access restrictions; and Hardware Roots of Trust anchor secure boot validation using immutable hardware.

Step-by-Step Solution

1
Evaluate the functional scope of a Secure Element (SE).
Identified as a specialized, tamper-resistant chip designed to store sensitive tokens and biometric data securely.
SE provides physical and logical isolation from the main operating system for crypto operations.
2
Evaluate the architectural role of a Baseboard Management Controller (BMC).
Identified as out-of-band motherboard hardware that enables remote administration.
BMCs function independently of the main processor and host operating system.
3
Evaluate the mechanism of a Memory Protection Unit (MPU).
Identified as micro-architectural hardware that restricts execution regions and memory access.
MPUs enforce boundary protection in embedded hardware to block buffer overflows and privilege escalation.
4
Evaluate the purpose of a Hardware Root of Trust built on eFuse or Immutable ROM.
Identified as the static cryptographic foundation for boot validation.
Write-once or read-only hardware cannot be overwritten by software malware, forming an immutable trust anchor.

Key Concept

Hardware Security Components and Embedded Controls
Question 1244Question →

A security technician needs to assess an internal enterprise server to accurately identify missing operating system patches and local software misconfigurations while minimizing network bandwidth usage. Which of the following scan methods should the technician execute?

Show answer & explanation

Answer: Credentialed vulnerability scan

Answer

Credentialed vulnerability scan
A credentialed vulnerability scan authenticates directly to the target operating system, allowing the scanner to inspect internal file versions, package managers, and registry settings directly. This yields precise patch and configuration details without requiring heavy network packet generation.

Step-by-Step Solution

1
Determine host assessment requirements
The scenario requires auditing internal system configuration details and patch levels without causing server instability.
Reading internal system registries and software patch databases requires local system authorization.
2
Select the appropriate vulnerability scanning method
Executing a credentialed scan allows the scanner to log in locally to perform a direct inventory.
Credentialed scans provide host-level precision, significantly reduce false positives, and consume less network bandwidth compared to intense unauthenticated probing.

Key Concept

Credentialed vs. Non-Credentialed Vulnerability Assessment
Question 1245Question →

A security analyst reviews packet capture metrics following reports of intermittent traffic manipulation on a corporate wireless network. The packet capture reveals unexpected network protocol behavior during client IP address assignment. Which TWO of the following indicators specifically point to a rogue DHCP server attack on the network? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Multiple DHCP OFFER packets originating from an unauthorized MAC address containing an unapproved default gateway IP; Duplicate DHCP ACK responses observed on the subnet assigning client IP configurations outside the authorized scope pool

Answer

The presence of a rogue DHCP server is confirmed by unauthorized DHCP OFFER packets containing an unapproved default gateway address and duplicate DHCP ACK responses assigning IP configurations outside the legitimate network scope.
A rogue DHCP server operates by broadcasting unauthorized DHCP OFFER and DHCP ACK packets in response to client DHCP DISCOVER requests. These unauthorized packets contain modified IP settings, such as an unapproved default gateway address or DNS server IP, enabling the attacker to perform on-path network interception.

Step-by-Step Solution

1
Analyze the observed network protocol behavior described in the scenario
Identified anomalous IP address assignment traffic during client network initialization.
DHCP attacks target the automated address allocation process on local subnets.
2
Evaluate the specific packet types and attributes characteristic of rogue DHCP servers
Rogue DHCP servers race against legitimate DHCP servers to respond to client DISCOVER messages with unauthorized DHCP OFFER and ACK packets.
By supplying invalid gateway or DNS settings, the attacker establishes an on-path position for interception.
3
Differentiate rogue DHCP indicators from unrelated wireless attacks
Disassociation frame floods represent wireless DoS/deauthentication attacks, while IV reuse represents cryptographic key cracking attempts.
Accurate incident diagnosis requires matching protocol anomalies directly to the underlying threat vector.

Key Concept

Rogue DHCP Server Attack Indicators
Question 1246Question →

A municipal water utility is re-architecting remote operational telemetry monitoring access for field maintenance engineers. The security architect must enforce Zero Trust Architecture (ZTA) principles to prevent unauthorized lateral movement across operational technology (OT) networks. Which of the following access control implementations best demonstrates the core Zero Trust tenets of explicit verification and least privilege?

Show answer & explanation

Answer: Deploying an inline Policy Enforcement Point (PEP) that evaluates user identity, endpoint health, and contextual risk for every individual database query before granting per-session access.

Answer

Deploying an inline Policy Enforcement Point (PEP) that evaluates user identity, endpoint health, and contextual risk for every individual database query before granting per-session access.
The option specifying an inline Policy Enforcement Point (PEP) directly aligns with NIST SP 800-207 Zero Trust Architecture principles. It enforces explicit verification by continuously inspecting user identity, device compliance posture, and contextual parameters for every database transaction, granting minimal per-session access without assuming network-based implicit trust.

Step-by-Step Solution

1
Analyze the core requirements of Zero Trust Architecture (ZTA).
ZTA requires eliminating implicit trust based on network location and enforcing continuous explicit verification and least privilege for every access request.
Traditional perimeter security assumes internal network traffic is trustworthy, whereas Zero Trust assumes breach and verifies continuously.
2
Evaluate the role of Policy Decision Points (PDP) and Policy Enforcement Points (PEP).
An inline PEP intercepting every transaction ensures dynamic contextual evaluation (user identity, device posture, location, risk) before granting temporal, per-session authorization.
Explicit verification must occur dynamically on a per-request basis rather than relying on a one-time perimeter check.

Key Concept

Zero Trust Architecture Principles - Explicit Verification and Continuous Authorization
Estimated Time:1m 30s
Question 1247Question →

Match each resilience and redundancy mechanism on the left with the corresponding operational requirement or architecture scenario on the right.

Click a left item, then click its matching right item

Items

Automatic Transfer Switch (ATS)
Geographic Asynchronous Replication
Multipath I/O (MPIO)
Dynamic BGP Multihoming

Matches

Show answer & explanation

Answer

The correct pairings match Automatic Transfer Switch (ATS) to single-corded utility power delivery via seamlessly transferred electrical loads; Geographic Asynchronous Replication to maintaining distant data availability with a non-zero RPO; Multipath I/O (MPIO) to storage access path aggregation over redundant HBAs; and Dynamic BGP Multihoming to enterprise boundary traffic rerouting across multiple ISP links.
Each redundancy technology directly targets a specific physical or logical component failure domain: ATS addresses single-corded power feed failure, MPIO addresses storage channel and HBA adapter failure, BGP multihoming addresses WAN ISP link failure, and Asynchronous Replication addresses regional datacenter failure without application performance degradation.

Step-by-Step Solution

1
Analyze power redundancy requirements for single-corded hardware.
An Automatic Transfer Switch (ATS) is required to feed single-corded appliances from redundant PDUs without power interruption.
ATS handles power source failover at the rack level when a PDU or utility feed loses power.
2
Evaluate long-distance database disaster recovery methods.
Geographic Asynchronous Replication allows cross-datacenter sync over WAN without local commit latency constraints.
Asynchronous replication tolerates network latency across geographic sites while accepting a minor RPO delta.
3
Assess host-to-SAN storage link redundancy.
Multipath I/O (MPIO) aggregates multiple Host Bus Adapter (HBA) paths into a redundant logical channel.
MPIO protects host storage connectivity against individual HBA, cable, or fiber channel switch failures.
4
Examine WAN perimeter network resilience.
Dynamic BGP Multihoming maintains network connectivity across independent Internet service provider links.
BGP detects link failure and updates routing tables to direct inbound and outbound traffic over functional paths.

Key Concept

High Availability and Infrastructure Redundancy Controls
Question 1248Question →

A logistics enterprise is deploying thousands of handheld mobile terminals to remote distribution staff. The devices operate in physically untrusted environments and store sensitive customer authentication data. The security engineering team mandates that each device must validate system integrity from power-on through operating system initialization using hardware-bound cryptographic measurements, while securely storing full-disk encryption keys on a dedicated cryptoprocessor integrated into the endpoint's motherboard. Which of the following hardware security controls BEST meets this requirement?

Show answer & explanation

Answer: Trusted Platform Module (TPM)

Answer

Trusted Platform Module (TPM)
The correct option is the Trusted Platform Module (TPM). A TPM is a hardware-based cryptoprocessor integrated into endpoint motherboards that securely generates and stores cryptographic keys, while providing platform integrity measurements (measured boot) to ensure firmware and system boot files have not been compromised.

Step-by-Step Solution

1
Analyze the endpoint hardware security requirements specified in the scenario.
Identified two primary requirements: motherboard-integrated hardware cryptoprocessor key storage and hardware-bound platform boot integrity measurement on individual mobile endpoints.
Security controls must match both the form factor (endpoint motherboard) and functional requirements (boot integrity and key protection).
2
Evaluate hardware security mechanisms against the requirement profile.
A Trusted Platform Module (TPM) is designed specifically for endpoint systems to store cryptographic keys isolated from the main CPU and verify boot integrity metrics via Platform Configuration Registers (PCRs).
Other options either target data center infrastructure (HSM), focus strictly on storage media encryption (SED), or lack hardware-level isolation (software key stores).

Key Concept

Trusted Platform Module (TPM) and Endpoint Hardware Security
Estimated Time:1m 30s
Question 1249Question →

A security administrator is planning a routine security evaluation of internal server infrastructure. Which of the following are distinct operational advantages of conducting a credentialed vulnerability scan rather than a non-credentialed network scan? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Identification of missing local software patches and operating system updates; Lower rate of false positives due to direct host configuration querying

Answer

Credentialed vulnerability scans provide direct inspection of missing local patches and system configurations while significantly reducing false positives through direct host querying.
Credentialed vulnerability scans log into target systems to directly audit local file versions, installed security updates, and configuration files. This internal visibility enables precise patch verification and dramatically reduces false positives compared to unauthenticated network probing.

Step-by-Step Solution

1
Analyze the operational differences between credentialed (authenticated) and non-credentialed (unauthenticated) vulnerability scans.
Credentialed scans log into target host operating systems using administrative access, allowing direct inspection of patch registries, local settings, and software inventories.
Understanding scanner access privileges highlights what host-level visibility is gained.
2
Evaluate the impact on reporting accuracy and false positive rates.
Direct host access provides definitive data on installed patch levels, reducing false positives caused by generic network banner grabbing.
Authenticated access eliminates guesswork for services hidden behind network security controls or running on non-standard ports.
3
Differentiate vulnerability scanners from active control mechanisms like firewalls or automated remediation systems.
Vulnerability scanners remain detective assessment tools and do not directly enforce network firewall filtering or alter security control classifications.
Scanners produce diagnostic data; mitigation requires separate patch management or configuration enforcement processes.

Key Concept

Credentialed vs. Non-Credentialed Vulnerability Scanning
Question 1250Question →

A security administrator is troubleshooting a critical network storage appliance in a data center. The appliance features dual internal power supply units (PSUs) to ensure hardware fault tolerance. However, during a recent scheduled power maintenance event on a single electrical circuit, the appliance unexpectedly lost power and shut down. Investigation reveals that both PSUs were plugged into the same rack Power Distribution Unit (PDU). Which of the following infrastructure modifications should the administrator implement to prevent single-circuit power outages from taking the appliance offline?

Show answer & explanation

Answer: Connect each power supply unit to separate, independent Power Distribution Units (PDUs) fed by distinct power sources.

Answer

Connect each power supply unit to separate, independent Power Distribution Units (PDUs) fed by distinct power sources.
Connecting each redundant power supply unit to a separate, independent Power Distribution Unit fed by distinct power lines eliminates single points of failure in the electrical distribution path. If one PDU or utility feed goes offline, the second PSU continues to draw power from the remaining active PDU, allowing the appliance to operate without interruption.

Step-by-Step Solution

1
Analyze the root cause of the system outage described in the scenario.
The system shut down because both redundant power supplies were plugged into the same PDU, making that PDU and its single circuit a single point of failure.
Redundant hardware components inside a chassis cannot provide high availability if they rely on a single shared upstream power source.
2
Identify the appropriate architectural modification for power redundancy.
Each power supply unit must be connected to independent PDUs backed by separate electrical circuits or Uninterruptible Power Supply (UPS) feeds.
A dual-bus power configuration ensures continuous server operation even if an entire PDU or electrical breaker trips.

Key Concept

Power Redundancy and Single Points of Failure
Estimated Time:1m 15s
Question 1251Question →

Following an influx of fileless malware alerts detected by an Endpoint Detection and Response (EDR) solution, a Security Operations Center (SOC) team is refining an automated Security Orchestration, Automation, and Response (SOAR) playbook. During initial testing, a high-severity alert triggered the playbook to automatically isolate a primary Domain Controller, causing a critical network outage. Which playbook design modification BEST balances rapid threat containment with enterprise operational resilience to prevent future accidental outages?

Show answer & explanation

Answer: Implement conditional evaluation of asset tags to mandate manual analyst approval before executing host isolation on critical infrastructure.

Answer

Implement conditional evaluation of asset tags to mandate manual analyst approval before executing host isolation on critical infrastructure.
Implementing conditional evaluation of asset tags—mandating analyst approval prior to isolating critical systems like Domain Controllers while permitting automatic containment for standard endpoints—strikes the correct balance between rapid threat mitigation and enterprise system availability.

Step-by-Step Solution

1
Analyze the incident trigger and operational impact
Identified that unvalidated, fully automated isolation of critical core assets (such as Domain Controllers) introduces high risk of self-inflicted service outages.
SOAR playbooks must balance containment velocity against the operational impact of false positives or unvalidated high-severity alerts.
2
Evaluate risk mitigation strategies within playbook logic
Determined that integrating asset tag evaluation (e.g., critical infrastructure vs. standard endpoint) enables contextual response pathways.
Standard workstation endpoints can be automatically contained immediately, whereas critical infrastructure assets can route to an analyst queue for quick manual validation.
3
Select the optimal playbook containment design
Incorporating conditional branching and human-in-the-loop approval for critical assets prevents unplanned operational downtime while retaining rapid automated response for non-critical systems.
This approach preserves enterprise availability while preserving automated containment capabilities across the rest of the environment.

Key Concept

SOAR Automated Response Playbook Design and Asset-Aware Containment Logic
Question 1252Question →

A security operations analyst at a financial institution is investigating an unauthorized change alert on a core network device. The organization relies on a central TACACS+ server integrated with an LDAP directory for network device administration. The analyst reviews the following TACACS+ audit log entries:

text
[2026-07-27 14:15:02 UTC] AUTHEN PASS: user="net_admin1" port="tty1" rem_addr="10.1.5.22"
[2026-07-27 14:15:10 UTC] AUTHOR PASS: user="net_admin1" cmd="show running-config"
[2026-07-27 14:16:05 UTC] AUTHOR FAIL: user="net_admin1" cmd="configure terminal" reason="Privilege level insufficient"
[2026-07-27 14:16:12 UTC] AUTHEN PASS: user="svc_monitor" port="tty2" rem_addr="10.1.5.50"
[2026-07-27 14:16:30 UTC] AUTHOR PASS: user="svc_monitor" cmd="configure terminal" matched_rule="rule_group_ops_override"

Further inspection confirms that `svc_monitor` is a low-privilege automated monitoring account with read-only rights in the LDAP directory. Which of the following operational misconfigurations best explains why `svc_monitor` was permitted to run the restricted command while `net_admin1` was denied?

Show answer & explanation

Answer: An explicit command authorization override rule on the TACACS+ server granted command permissions directly to the monitoring group, decoupling authorization from the LDAP role attributes.

Answer

An explicit command authorization override rule on the TACACS+ server granted command permissions directly to the monitoring group, decoupling authorization from the LDAP role attributes.
TACACS+ strictly separates authentication from authorization, evaluating authorization on a granular per-command basis. The log shows that `svc_monitor` authenticated successfully via LDAP but executed the command because a specific TACACS+ authorization rule (`rule_group_ops_override`) explicitly permitted it, overriding directory-level role expectations.

Step-by-Step Solution

1
Analyze the TACACS+ log entries for authentication and authorization events.
Both `net_admin1` and `svc_monitor` passed authentication (`AUTHEN PASS`). However, `net_admin1` failed authorization for `configure terminal`, whereas `svc_monitor` passed authorization due to `matched_rule="rule_group_ops_override"`.
Determining where the access decision diverged is essential to isolating the misconfiguration.
2
Evaluate TACACS+ operational architecture features regarding AAA separation.
TACACS+ completely separates Authentication, Authorization, and Accounting (AAA). Authorization policies are evaluated on a per-command basis using TACACS+ policy sets.
Understanding TACACS+ behavior explains how authorization can yield results independent of central authentication store roles.
3
Identify the operational root cause.
The local TACACS+ server contained a custom authorization rule (`rule_group_ops_override`) that matched `svc_monitor` and permitted command execution despite its low-privilege group status in LDAP.
Overly permissive or leftover local command authorization rules override intended centralized privilege restrictions.

Key Concept

TACACS+ AAA Decoupling and Per-Command Authorization
Estimated Time:2m 0s
Question 1253Question →

A security analyst inspecting telemetry from an Endpoint Detection and Response (EDR) system observes an unapproved administrative utility downloading an encoded payload from an external domain, followed by an immediate attempt to modify host boot configurations. Which of the following is the MOST effective immediate action the analyst should take using the EDR platform to contain the incident?

Show answer & explanation

Answer: Perform host-level network isolation via the EDR console while keeping the management channel open for live investigation.

Answer

Initiating host-level network isolation via the EDR console while retaining agent management connectivity is the most effective containment step.
Isolating the endpoint at the network layer via EDR restricts network access (stopping command-and-control communication and lateral movement) while preserving the agent connection so analysts can continue investigating and gathering memory forensics.

Step-by-Step Solution

1
Analyze the telemetry alert
Identified suspicious command execution and payload download on an active endpoint.
Determines the immediate severity and potential for lateral movement.
2
Select the containment control
Apply EDR host-level network isolation.
Host isolation cuts off network connectivity to prevent spread, while maintaining the EDR control plane for remote triage.

Key Concept

Endpoint Detection and Response (EDR) Host Isolation
Question 1254Question →

A security administrator notices during a routine audit that an employee who transferred to a new department retains active access permissions from their previous job role. Which identity and access management procedure should be executed to address this issue?

Show answer & explanation

Answer: Perform user permission recertification and role adjustment

Answer

Perform user permission recertification and role adjustment
Performing user permission recertification and role adjustment systematically reviews an account's granted entitlements, revoking stale access rights to enforce the principle of least privilege following role transfers.

Step-by-Step Solution

1
Identify the core access issue resulting from the internal department transfer.
The user retains privilege creep (unneeded legacy access rights).
Changes in job roles require aligning permissions with current duties.
2
Evaluate the appropriate IAM operational control.
Permission recertification and privilege adjustment resolves inappropriate access.
Recertification audits existing rights and removes unneeded authorizations.

Key Concept

Account Lifecycle Management and Permission Recertification
Question 1255Question →

A Security Operations Center (SOC) analyst is inspecting web server access logs ingested into a SIEM platform. An automated correlation rule generated a low-priority informational alert after detecting directory path indicators in incoming HTTP requests. The SIEM displays the following sequential log entries:

192.168.1.45 - - [27/Jul/2026:14:22:01 +0000] "GET /api/v1/download?file=../../../../etc/passwd HTTP/1.1" 200 4096
192.168.1.45 - - [27/Jul/2026:14:22:05 +0000] "GET /api/v1/download?file=..%2f..%2f..%2f..%2fetc%2fshadow HTTP/1.1" 403 280

Based on these log entries, which of the following conclusions accurately identifies the security incident status and the required SIEM management action?

Show answer & explanation

Answer: A path traversal attack successfully accessed a sensitive system file on the first request, requiring the SIEM correlation rule severity to be escalated from informational to high.

Answer

A path traversal attack successfully accessed a sensitive system file on the first request, requiring the SIEM correlation rule severity to be escalated from informational to high.
The correct response recognizes that the HTTP status code 200 combined with a 4096-byte payload on the request containing path traversal sequences (../../../../etc/passwd) indicates that the application successfully served file contents to the attacker. Because the initial SIEM alert was categorized as low-priority/informational, the analyst must escalate the rule severity to ensure immediate incident response triggers upon successful exploitation.

Step-by-Step Solution

1
Analyze the request URI parameters in both log entries
Identified path traversal patterns (../../../../ and URL-encoded ..%2f..%2f..%2f..) targeting restricted system files (/etc/passwd and /etc/shadow).
Determining the threat vector requires evaluating the input payload within the HTTP GET request string.
2
Evaluate the HTTP response status codes and byte sizes in sequence
The first request returned HTTP status 200 (OK) with 4096 bytes transferred. The second request returned HTTP status 403 (Forbidden) with 280 bytes.
HTTP 200 indicates the server fulfilled the request and returned file content, whereas HTTP 403 indicates subsequent access blocking.
3
Determine the incident impact and required SIEM management response
Successful unauthorized retrieval of /etc/passwd confirms a successful breach. The low-priority SIEM rule failed to reflect the true severity.
SIEM correlation rules must be tuned to alert with high severity when directory traversal attempts return HTTP 200 success codes.

Key Concept

Directory Traversal Log Analysis and SIEM Alert Tuning
Question 1256Question →

A security operations team is investigating an incident where an attacker maintained active access to enterprise cloud applications following the revocation of a compromised user's directory credentials. The centralized Identity Provider (IdP) successfully initiated password resets and disabled the directory account in response to a SIEM alert, yet the attacker continued performing privileged actions in single sign-on (SSO) web applications for several hours. Which of the following operational root causes directly contributed to this continuous unauthorized access and failure of immediate session termination? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The Identity Provider revoked user refresh tokens without invalidating active stateless JSON Web Tokens (JWTs) or clearing active session caches at the Relying Party applications.; The application architecture relied on standard OAuth 2.0 access token lifetimes without implementing Continuous Access Evaluation Protocol (CAEP) or real-time event-driven session revocation.

Answer

The persistent access was caused by the IdP revoking refresh tokens without invalidating active stateless JWT access tokens or session caches at the application tier, alongside the absence of Continuous Access Evaluation Protocol (CAEP) integration to communicate real-time credential revocation events to relying applications.
In modern federated IAM architectures, revoking credentials at the identity provider (IdP) stops new authentication requests and refresh token usage. However, active sessions established via stateless access tokens (such as JSON Web Tokens) remain valid at relying applications until their expiration time unless active token invalidation (or session cache clearing) is performed. Furthermore, implementing Continuous Access Evaluation Protocol (CAEP) allows identity providers to push real-time security events (e.g., credential revocation, user disablement) directly to relying parties, enabling immediate termination of active sessions across applications.

Step-by-Step Solution

1
Analyze the IAM session flow and revocation mechanics
Disabling an account or revoking refresh tokens in an IdP stops new authentication attempts and token refreshes, but does not inherently revoke currently active access tokens already issued to client applications.
Stateless access tokens (like JWTs) are verified digitally by applications without querying the IdP on every API request until the token expires.
2
Evaluate real-time event integration protocols between IdPs and Relying Parties
Without CAEP or shared signals framework (SSF), relying party applications operate in isolation from IdP status changes until existing token lifetimes lapse.
CAEP enables real-time synchronization of security events (e.g., account disablement, session revocation) between identity providers and service providers.
3
Identify misattributed infrastructure controls
Network perimeter firewalls, RADIUS servers, and TACACS+ AAA configurations govern network access and infrastructure device logins, not web SSO access token lifecycles.
Operational IAM incident response requires distinguishing identity protocol mechanics (OAuth/OIDC/SAML) from network layer AAA controls.

Key Concept

Federated Identity Session Lifecycles & Real-Time Revocation (CAEP/JWT Invalidation)
Question 1257Question →

An IT security operations team wants to streamline incident triage by automatically connecting threat intelligence feeds with security monitoring tools and executing pre-defined response actions across different platforms. Which technology should the team implement to achieve this orchestration and automation?

Show answer & explanation

Answer: Security Orchestration, Automation, and Response (SOAR)

Answer

Security Orchestration, Automation, and Response (SOAR)
Security Orchestration, Automation, and Response (SOAR) integrates disparate security systems and software, allowing organizations to execute automated playbooks that enrich alerts and streamline response actions across the enterprise.

Step-by-Step Solution

1
Analyze the operational requirement given in the scenario.
The requirement calls for integrating disparate security tools and automating threat triage using pre-defined response actions.
Combining disparate tools into unified workflows requires an orchestration layer.
2
Compare the core functions of security solutions against the requirement.
SOAR connects threat feeds and security tools to run automated response playbooks, fulfilling all requirements.
SOAR is specifically designed for cross-platform security automation and workflow orchestration.

Key Concept

Security Automation and Orchestration (SOAR)
Question 1258Question →

During an internal fraud investigation, a security analyst seizes a desktop computer and generates a forensic image of the primary storage drive. Months later, during a legal proceeding, opposing counsel moves to suppress the forensic disk image evidence. Which of the following circumstances would serve as the strongest basis for suppressing the evidence due to a breakdown in the chain of custody?

Show answer & explanation

Answer: An unrecorded gap exists in the evidence log showing a missing signature during the physical transfer of the drive between two investigators.

Answer

An unrecorded gap in the physical evidence log showing a missing signature during transfer serves as the strongest basis for suppressing evidence due to a chain of custody failure.
The chain of custody is a strict administrative and legal process requiring detailed record-keeping of every individual who collected, transported, accessed, or secured physical evidence. An unrecorded transfer or missing custodian signature creates an unverified gap in possession, making it impossible to legally guarantee that the evidence was not tampered with, swapped, or altered.

Step-by-Step Solution

1
Analyze the core objective of maintaining a chain of custody.
Chain of custody requires a complete, unbroken, chronological documentation trail of every person who possessed, transferred, or examined physical evidence.
Any unaccounted period or missing transfer sign-off compromises legal verification that evidence remained unaltered while in law enforcement or analyst custody.
2
Distinguish legal custodial requirements from technical acquisition choices.
Gaps in transfer logs directly breach procedural custody rules, whereas choices regarding software vs. hardware write-blockers, hashing algorithms, or network acquisition interfaces represent technical methodology.
Technical acquisition choices do not undermine evidence admissibility as long as verification hashes match and custodial logs are maintained.

Key Concept

Chain of Custody and Evidence Admissibility
Question 1259Question →

A security technician is configuring network security monitoring rules to detect active compromises and data exfiltration. Which of the following observations represent valid network-level threat indicators that should trigger an immediate security alert? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Outbound network flow logs showing persistent connection attempts to known malicious Command and Control (C2) IP addresses; Network Intrusion Detection System (NIDS) alerts identifying anomalous ICMP packet payloads containing encoded data transfers from an internal server

Answer

The valid indicators of network-based compromise requiring alerts are persistent outbound connections to known Command and Control (C2) IP addresses and NIDS alerts identifying anomalous ICMP packet payloads carrying encoded data.
Outbound connection attempts to known Command and Control infrastructure and protocol anomalies like data-laden ICMP payloads represent real-time network layer telemetry indicating compromised internal assets and active tunneling, making both essential network alert triggers.

Step-by-Step Solution

1
Evaluate network connection telemetry for outbound threat indicators
Persistent outbound traffic to known C2 addresses confirms active malware beaconing from internal hosts.
Compromised endpoints routinely initiate outbound sessions to external command infrastructure to receive instructions.
2
Analyze protocol payloads for covert channel activity
Anomalous ICMP packets carrying data payloads signal ICMP tunneling.
Standard ICMP traffic carries simple echo request/reply data; embedding arbitrary data payloads indicates protocol misuse for data exfiltration.

Key Concept

Network Security Monitoring and Alerting
Question 1260Question →

A Security Operations Center (SOC) team deploys an automated Security Orchestration, Automation, and Response (SOAR) playbook designed to mitigate rapid ransomware propagation. The playbook triggers automatically upon receiving high-severity Endpoint Detection and Response (EDR) telemetry, querying external threat intelligence APIs to verify file hashes before calling a Network Access Control (NAC) API to isolate the host network interface. During a red-team simulation, synthetic high-volume alert telemetry from an active primary domain controller causes the playbook to execute auto-isolation on the server, resulting in an immediate domain-wide operational outage. Which modification to the SOAR playbook logic or execution configuration best mitigates the operational risk of automated service disruption while maintaining rapid containment capabilities for verified threats?

Show answer & explanation

Answer: Implement conditional asset tagging with human-in-the-loop approval gates for tier-0 infrastructure alongside scoped containment actions such as perimeter firewall blocking instead of full interface isolation.

Answer

Implementing asset-aware conditional logic with human-in-the-loop (HITL) approval gates for critical tier-0 infrastructure and utilizing scoped containment controls best balances operational availability with incident response automation.
The correct answer addresses the root cause of the outage by introducing asset awareness and conditional execution paths into the SOAR playbook logic. For critical infrastructure (such as domain controllers or key database servers), automated full-network isolation poses a greater risk to business continuity than the threat itself. Implementing human-in-the-loop (HITL) approval gates or lower-impact microsegmentation/egress filtering preserves security operations without causing enterprise-wide outages.

Step-by-Step Solution

1
Analyze the operational vulnerability in the existing automated playbook
The SOAR playbook performs aggressive automated network interface isolation indiscriminately on any host, including critical tier-0 domain controllers.
Automated containment actions must evaluate the operational criticality of the target system to prevent self-inflicted denial-of-service events.
2
Evaluate containment actions based on risk and asset classification
Tier-0 systems require human-in-the-loop approval or non-disruptive scoped containment (e.g., blocking outbound external traffic rather than full port shutdown).
Asset awareness in playbooks ensures that high-impact automated actions are constrained when applied to critical enterprise services.
3
Differentiate effective logic fixes from misconfigured or non-functional options
Changing thresholds increases false positives, reclassifying control metadata does not change execution behavior, and imposing interactive MFA breaks system-to-system API authentication.
Only logic adjustments incorporating asset tags and approval workflow gates properly resolve the operational risk.

Key Concept

SOAR Playbook Design & Safety Controls
Estimated Time:2m 0s
PreviousPage 63 / 112Next
All practice questions — CompTIA Security+ | Examkin