Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1281Question →

A security engineer is designing a vulnerability assessment strategy for a newly deployed microservices application hosted on short-lived container instances behind a web application firewall (WAF). Recent uncredentialed network-based vulnerability scans reported zero high-severity findings; however, a manual audit revealed several unpatched software dependencies and OS configuration flaws within the running container base images. Which of the following scanning approaches should the engineer implement to accurately detect these internal vulnerabilities without incurring high network overhead or triggering false negatives due to WAF filtering?

Show answer & explanation

Answer: Integrate container registry image scanning into the CI/CD deployment pipeline and deploy agent-based scanners within the base container templates.

Answer

Integrating container registry image scanning into the CI/CD deployment pipeline and utilizing host/agent-based scanning within container base images accurately identifies internal software vulnerabilities without network overhead or WAF interference.
Integrating static image scanning into the CI/CD pipeline and deploying agent-based scanners directly inspects the container's internal file system, installed packages, and configuration files. This local assessment approach bypasses network firewalls, eliminates network latency, and reliably uncovers missing patches and misconfigurations regardless of container ephemeral lifespans.

Step-by-Step Solution

1
Analyze the technical environment and current failure state
Uncredentialed network scanning failed to identify internal flaws due to container short lifespans, network isolation, and WAF inspection.
Network-based vulnerability scanners inspect exposed open network ports and services but cannot evaluate local package manifests or file permissions behind protective inline firewalls.
2
Evaluate candidate scanning methodologies against operational constraints
Agent-based scanning and pipeline container image analysis operate locally on the target operating system image and build artifacts.
Host-based agents and static image scanners access internal package managers (e.g., dpkg, rpm) directly, generating zero network scan traffic and avoiding WAF blockage.
3
Select the optimal vulnerability scanning architecture
CI/CD registry scanning paired with agent-based evaluation provides complete visibility into containerized microservice vulnerabilities.
This strategy satisfies all requirements by detecting local vulnerabilities prior to and during deployment without network degradation.

Key Concept

Credentialed and Agent-Based vs. Network-Based Vulnerability Scanning in Container Environments
Question 1282Question →

During a security telemetry audit of a cloud-hosted perimeter network, a security analyst evaluates a high-priority incident generated by a Network Intrusion Detection System (NIDS). The event correlates an inbound HTTP POST request payload with subsequent anomaly alerts from outbound network flow logs.

Web Application Log Snippet:
http
POST /api/v1/login HTTP/1.1
Host: portal.example.com
Content-Type: application/x-www-form-urlencoded
Payload: user=admin' OR '1'='1'--&pass=unknown

NIDS & VPC Flow Telemetry Alert:
`[ALERT] Outbound session initiated from internal application node 10.0.4.15:443 to external IP 198.51.100.42:53421 following authentication bypass payload.`

The analyst categorizes the attack as a Cross-Site Scripting (XSS) attempt aimed at endpoint browsers and recommends deploying client-side script execution restrictions. Which of the following analytical errors did the analyst commit, and what is the correct network security monitoring response?

Show answer & explanation

Answer: The analyst misdiagnosed a SQL injection (SQLi) attack targeting database queries as Cross-Site Scripting (XSS); the network security monitoring rules should be updated with Web Application Firewall (WAF) deep packet inspection signatures to detect database payload manipulation.

Answer

The analyst misdiagnosed a SQL injection attack targeting database queries as Cross-Site Scripting, and the correct monitoring action is deploying Web Application Firewall (WAF) deep packet inspection signatures.
The payload `user=admin' OR '1'='1'--` is a classic SQL injection vector that forces a database query to evaluate to true, bypassing authentication controls. The analyst incorrectly identified this as Cross-Site Scripting (XSS). Effective network security monitoring for web applications requires Layer 7 application inspection (such as a WAF or NIDS application ruleset) capable of examining HTTP POST bodies and triggering correlated alerts when suspicious payloads produce anomalous outbound traffic.

Step-by-Step Solution

1
Analyze the web application log payload.
The payload `user=admin' OR '1'='1'--` uses SQL syntax to manipulate backend database logic and bypass authentication.
SQL Injection inserts SQL commands into data inputs, whereas XSS injects executable scripts (e.g., JavaScript) rendered by a user's web browser.
2
Evaluate the analyst's diagnostic conclusion.
The analyst committed a misdiagnosis error by classifying SQL injection as Cross-Site Scripting.
Remediating client-side script execution will not defend against backend database query manipulation.
3
Determine the appropriate network security monitoring control.
Implement Layer 7 inspection via Web Application Firewall (WAF) or NIDS signatures tuned for SQL syntax patterns.
Network security monitoring must operate at the application layer (Layer 7) to parse HTTP POST bodies and correlate them with outbound anomaly alerts.

Key Concept

Log Analysis and Network Intrusion Detection Signature Tuning for Web Application Attacks
Question 1283Question →

A security technician receives an automated network intrusion detection system (NIDS) alert indicating potential unauthorized data exfiltration from an internal database server to an unknown external IP address. Place the following initial incident response steps in the correct chronological order, starting from initial alert verification to post-incident tuning.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with validating the NIDS alert using raw packet captures, followed by assessing the scope across network endpoints, isolating the compromised server to halt exfiltration, and concluding with signature updates and documentation.
The standard incident triage lifecycle starts with validating the telemetry alert to confirm malicious activity. Next, scoping is conducted to identify all impacted systems. Once scope is established, network containment (isolating the server) stops active data movement. Finally, post-incident activities such as signature updates and documentation ensure long-term mitigation.

Step-by-Step Solution

1
Validate the alert telemetry.
Confirmed whether the NIDS alert is a true positive threat or a false alarm.
Initial triage requires validating event data before taking action to avoid unnecessary operational downtime.
2
Assess incident scope.
Identified all internal hosts participating in suspicious outbound connections.
Scoping ensures that containment efforts address all impacted endpoints rather than just the initial server.
3
Perform network containment.
Isolated the server from the network to block active exfiltration.
Immediate containment stops data loss while preserving the system for forensics.
4
Execute post-incident tuning and documentation.
Updated monitoring rules and logged lessons learned.
Refining NIDS rules strengthens future monitoring and prevents similar attack techniques.

Key Concept

Network Incident Response and Alert Triage Sequencing
Question 1284Question →

A network security administrator is deploying 802.1X EAP-TLS network access control across enterprise switches to enforce mutual authentication and dynamic VLAN authorization. Place the operational stages of the EAP-TLS authentication and authorization sequence in the correct chronological order from session initiation to final access enforcement.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with identity encapsulation via RADIUS Access-Request, followed by EAP-TLS mutual certificate validation, directory policy authorization evaluation, RADIUS Access-Accept with VSAs return, and final port enforcement by the switch.
In 802.1X network access control, the sequence strictly follows: (1) Identity initiation where EAPoL responses are encapsulated into RADIUS Access-Request messages; (2) EAP-TLS mutual authentication via X.509 certificates; (3) Directory lookup to determine identity privileges; (4) RADIUS Access-Accept transmission containing dynamic authorization parameters (VSAs); and (5) Local port authorization and VLAN/ACL enforcement by the switch.

Step-by-Step Solution

1
Identify the initial protocol exchange between Supplicant, Authenticator, and AAA Server.
The supplicant responds to EAP-Request/Identity with an EAP-Response/Identity, which the switch encapsulates into a RADIUS Access-Request packet.
802.1X uses EAP encapsulation over LAN (EAPoL) between endpoint and switch, converted to RADIUS between switch and AAA server.
2
Determine the authentication mechanism step.
EAP-TLS mutual authentication completes via X.509 certificate validation over a TLS handshake.
EAP-TLS requires both server certificate validation by the client and client certificate validation by the AAA server before granting access.
3
Determine the authorization lookup phase.
The AAA server evaluates identity group memberships and directory policies.
Authentication (verifying who the user/device is) must succeed before authorization policy (determining allowed access level) can be evaluated.
4
Identify the return authorization payload.
The AAA server issues a RADIUS Access-Accept containing VSAs (e.g., RFC 2868 VLAN attributes).
The AAA server communicates policy enforcement parameters back to the network access device using RADIUS attributes.
5
Identify final enforcement at the network layer.
The switch transitions the port state to authorized and applies dynamic VLAN/ACL rules.
The authenticator network switch is responsible for enforcing physical/logical port controls based on the AAA server's directive.

Key Concept

802.1X EAP-TLS AAA Operation and Dynamic Enforcement
Question 1285Question →

A Security Operations Center (SOC) configures an automated Security Orchestration, Automation, and Response (SOAR) playbook to address high-severity data exfiltration alerts originating from enterprise database servers. Place the operational playbook steps in the correct execution sequence from initial trigger to incident documentation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct execution order is: 1) Ingest and parse sensor telemetry, 2) Query CMDB/IAM for asset criticality enrichment, 3) Perform threat intelligence and sandbox validation, 4) Execute conditional EDR host isolation, and 5) Generate the ITSM incident ticket with team escalation.
A SOAR incident response playbook follows a structured lifecycle: Alert Ingestion & Parsing -> Context Enrichment (CMDB/IAM) -> Threat Intelligence Validation -> Conditional Containment (EDR Isolation) -> Ticket Generation & Notification. This sequence minimizes false-positive impact and ensures containment occurs prior to manual analyst handoff.

Step-by-Step Solution

1
Ingest and parse the raw alert telemetry.
Extracted indicators of compromise (IPs, domains, process handles) ready for downstream API calls.
Automation workflows cannot run query functions without extracted parameters from the initial alert trigger.
2
Enrich the event with asset and identity context.
Established server business impact score and assigned owner.
Knowing asset criticality is required before evaluating automated isolation risk logic.
3
Query threat intelligence and submit binaries for sandbox analysis.
Confirmed malicious reputation score for outbound connection targets.
Validation ensures containment triggers only on verified threat indicators rather than false positives.
4
Perform conditional safety check and execute isolation.
Affected database host isolated from network segment via EDR API.
Rapid containment prevents data loss while abiding by predefined high-availability safety checks.
5
Document and escalate in ITSM.
Ticket populated with enriched telemetry logs and on-call analyst notified.
Saves analyst time by delivering fully triaged context and containment status for manual investigation.

Key Concept

SOAR Playbook Execution Sequencing
Question 1286Question →

A security analyst is documenting the hardware-based multi-factor authentication (MFA) process using WebAuthn/FIDO2 for corporate cloud applications. Place the operational steps of a successful WebAuthn authentication sequence in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order begins with the Relying Party generating a unique cryptographic challenge upon user login initiation, sending that challenge to the client browser, performing local user verification on the hardware key to sign the challenge, forwarding the signed assertion payload back to the Relying Party server, and finally verifying the signature using the stored public key to issue an authenticated session.
The WebAuthn authentication flow follows a strict challenge-response protocol sequence: First, the Relying Party (RP) generates a cryptographic challenge upon login attempt. Second, the RP sends this challenge and session parameters to the client browser. Third, the user authenticates locally on the hardware key (via PIN or biometric), which allows the private key to sign the challenge. Fourth, the signed assertion is sent back to the client browser and submitted to the RP server. Finally, the RP server verifies the signature using the stored public key to validate identity.

Step-by-Step Solution

1
Identify the initial trigger and challenge generation.
The Relying Party server generates a random cryptographic challenge when authentication is requested.
WebAuthn authentication is challenge-response based to protect against replay attacks.
2
Trace the challenge delivery to the client.
The server transmits the challenge and RP identity parameters to the browser WebAuthn API.
The client browser acts as the intermediary between the server and the hardware authenticator.
3
Determine the hardware key user verification step.
The user completes biometric or PIN verification on the physical security key, allowing it to sign the challenge with the private key.
Local user interaction is mandatory for FIDO2 token activation.
4
Trace the transmission of the signed response.
The signed assertion is returned to the browser and forwarded to the Relying Party server.
The authenticator does not communicate directly with the server; responses pass through the web browser client.
5
Confirm final server verification and authorization.
The server verifies the cryptographic signature with the user's public key.
Server validation completes the challenge-response cycle and confirms authentic user identity.

Key Concept

FIDO2 / WebAuthn Challenge-Response Authentication Sequence
Question 1287Question →

A security operations analyst at a fintech enterprise is investigating an unauthorized privilege escalation event on critical network infrastructure. During the investigation, the analyst correlates RADIUS and TACACS+ AAA logs during the administrative session:

2026-07-27T14:10:02Z RADIUS_SERVER AUTH_ACCEPT User=jdoe IP=198.51.100.45 Group=Engineers VSA_Privilege_Level=1
2026-07-27T14:10:15Z TACACS_SERVER TAC_PLUS_AUTHOR_REQ User=jdoe Service=shell cmd=enable
2026-07-27T14:10:16Z TACACS_SERVER TAC_PLUS_AUTHOR_RESP User=jdoe Status=PASS Priv_Level=15 Rule=Default_Fallback_Admin

Based on the log output, which of the following represents the primary operational root cause of the unauthorized privilege escalation?

Show answer & explanation

Answer: An authorization rule misconfiguration that evaluated a default fallback policy granting full administrative privileges despite low VSA assignments.

Answer

The primary operational root cause is an authorization rule misconfiguration on the TACACS+ server that evaluated a default fallback policy granting privilege level 15 despite the user possessing lower vendor-specific attributes (VSAs).
The correct answer correctly identifies that authentication succeeded at standard privilege levels (Privilege Level 1 via RADIUS VSA), but the TACACS+ server's authorization evaluation hit a misconfigured fallback policy ('Default_Fallback_Admin') that assigned maximum privileges (Privilege Level 15). This highlights a critical operational vulnerability in AAA policy mapping.

Step-by-Step Solution

1
Analyze the RADIUS authentication entry in the log output.
User 'jdoe' authenticates successfully from IP 198.51.100.45 with Vendor-Specific Attribute (VSA) assigning Privilege Level 1.
Initial identity verification (authentication) completes properly with restricted user permissions.
2
Analyze the subsequent TACACS+ authorization request and response logs.
The user requests shell command authorization ('enable'). The TACACS+ server matches 'Rule=Default_Fallback_Admin' and issues Priv_Level=15.
This shows a distinct authorization mismatch where a permissive fallback rule overrode explicit lower privileges.
3
Determine the operational security deficiency.
Distinguish authentication success from administrative authorization misconfiguration.
The system failed to properly map authorization roles to the authenticated VSA constraints, resulting in unauthorized privilege escalation.

Key Concept

AAA Operational Authorization and TACACS+/RADIUS Integration
Estimated Time:2m 0s
Question 1288Question →

A Security Operations Center (SOC) team wants to create a workflow that automatically extracts file hashes from suspicious email alerts and queries external threat intelligence platforms. Which key component of a Security Orchestration, Automation, and Response (SOAR) platform enables integration and communication between these disparate security tools?

Show answer & explanation

Answer: API connectors and integration plugins

Answer

API connectors and integration plugins enable SOAR platforms to communicate with external security tools and threat intelligence services.
API connectors and integration plugins provide the technical interfaces necessary for a SOAR solution to send requests and pull data from external platforms, such as threat intelligence feeds, SIEMs, and endpoint management software.

Step-by-Step Solution

1
Identify the primary requirement in the scenario.
The requirement is enabling interoperability and automated communication between distinct security platforms.
SOAR platforms aggregate data and trigger actions across different tools in the security stack.
2
Evaluate the technical mechanism used by SOAR to connect disparate tools.
SOAR uses API connectors and integration modules to send and receive data from external systems.
APIs provide standard protocols for automated data exchange between platforms without human intervention.

Key Concept

SOAR Integration and API Orchestration
Question 1289Question →

An organization is evaluating the annual financial exposure of a cloud storage infrastructure valued at $800,000. A recent risk assessment reveals that ransomware attacks pose a threat to this system with an estimated Exposure Factor (EF) of 0.25 (25%). Threat intelligence indicates that the Annualized Rate of Occurrence (ARO) for this type of attack vector is 0.50 (once every two years). Based on quantitative risk analysis methodology, what is the calculated Annualized Loss Expectancy (ALE) in US dollars?

Show answer & explanation

Answer: 100000

Answer

The Annualized Loss Expectancy (ALE) for the cloud storage infrastructure is $100,000.
The correct calculation follows quantitative risk management standards where Single Loss Expectancy (SLE) = Asset Value (800,000)×ExposureFactor(0.25)=800,000) × Exposure Factor (0.25) = 200,000. Then, Annualized Loss Expectancy (ALE) = SLE (200,000)×AnnualizedRateofOccurrence(0.50)=200,000) × Annualized Rate of Occurrence (0.50) = 100,000.

Step-by-Step Solution

1
Determine Single Loss Expectancy (SLE)
$200,000
SLE represents the financial impact of a single risk event, calculated by multiplying the total asset value ($800,000) by the exposure factor (0.25).
2
Calculate Annualized Loss Expectancy (ALE)
$100,000
ALE measures expected annual financial loss by multiplying the single loss impact ($200,000) by the annual frequency of occurrence (0.50).

Key Concept

Quantitative Risk Analysis (ALE calculation)
Question 1290Question →

During a system inspection, a security auditor reviews the following excerpt from an internal DNS server transaction log:

27-Jul-2026 14:02:11.104 queries: info: client @0x7f8a10 192.168.10.45#51204 (a3V4b2ExOTI4M2E4MTI3.exfil.badsite.com): query: a3V4b2ExOTI4M2E4MTI3.exfil.badsite.com IN TXT + (192.168.10.1)
27-Jul-2026 14:02:11.215 queries: info: client @0x7f8a10 192.168.10.45#51205 (bTl4YTE5MjgzYTgxMjg.exfil.badsite.com): query: bTl4YTE5MjgzYTgxMjg.exfil.badsite.com IN TXT + (192.168.10.1)
27-Jul-2026 14:02:11.330 queries: info: client @0x7f8a10 192.168.10.45#51206 (Yzg5YTE5MjgzYTgxMjk.exfil.badsite.com): query: Yzg5YTE5MjgzYTgxMjk.exfil.badsite.com IN TXT + (192.168.10.1)

Based on the observed log pattern, which of the following activities is taking place?

Show answer & explanation

Answer: DNS tunneling utilized for covert data exfiltration

Answer

DNS tunneling utilized for covert data exfiltration
The correct answer identifies DNS tunneling for data exfiltration. The log snippet shows rapidly repeating DNS queries for TXT records containing long, high-entropy, base64-encoded subdomains appended to an external domain. Because standard firewalls allow outbound DNS traffic on UDP port 53, threat actors use DNS queries to encode and exfiltrate sensitive data in small chunks.

Step-by-Step Solution

1
Examine the log query type and payload structure
Identified repeated DNS queries requesting TXT records with long, randomized, base64-encoded strings as subdomains (e.g., a3V4b2ExOTI4M2E4MTI3).
DNS TXT records allow arbitrary text data transport, which attackers abuse to encode and package sensitive payload information.
2
Analyze request frequency and destination host pattern
Observed multiple rapid queries originating from a single internal IP (192.168.10.45) querying unique subdomains under a common root (exfil.badsite.com).
High-frequency queries with unique encoded prefixes directed to an external authoritative name server indicate automated data chunking over DNS protocol.
3
Correlate telemetry indicators with threat behavior
Concluded that the telemetry matches DNS tunneling/exfiltration techniques.
Encoding payload chunks inside DNS hostname lookups bypasses standard perimeter firewalls that permit outbound port 53 traffic.

Key Concept

DNS Log Analysis and DNS Tunneling Detection
Estimated Time:1m 30s
Question 1291Question →

An incident response team is investigating a confirmed security incident on a Linux application server hosting an internal logistics portal. Monitoring alerts indicate an unauthorized remote access session is currently active, and the compromised host has begun scanning adjacent internal subnets for lateral movement. According to standard incident response frameworks, which TWO of the following immediate actions should the analyst take during the containment phase?

Select all that apply

Show answer & explanation

Answer: Isolate the compromised server's network segment by updating network security group rules to restrict lateral movement while keeping the system powered on.; Capture a volatile memory snapshot of the system to preserve running processes and active network connection states before taking the host offline.

Answer

The analyst should isolate the server's network segment using security group rules while keeping the machine powered on, and capture a volatile memory snapshot before taking the host offline.
The correct response combines network isolation to halt lateral movement with volatile memory acquisition to preserve ephemeral evidence. Isolating the system via network security groups stops the adversary from reaching adjacent subnets, while taking a memory capture ensures active process memory, network connections, and memory-resident malware artifacts are preserved before host shutdown or remediation.

Step-by-Step Solution

1
Identify the primary objective during the containment phase of incident response.
Containment aims to prevent the spread of the incident (lateral movement) and limit damage without destroying volatile evidence.
Stopping active scanning to adjacent subnets is urgent to safeguard internal enterprise resources.
2
Evaluate containment actions regarding host state and evidence preservation.
Applying network-level isolation via security groups stops lateral network traffic, while capturing RAM preserves volatile evidence prior to any disruptive actions.
Maintaining power while restricting network communications allows memory forensic acquisition without alerting the threat actor or losing RAM contents.
3
Differentiate containment phase actions from eradication, recovery, or misconfigured controls.
Re-imaging systems belongs to the eradication/recovery phase, and altering preventive controls to detective logging reduces defensive capability.
Incident response playbooks mandate executing phases in sequence to ensure root cause determination and full containment before system restoration.

Key Concept

Incident Response Containment Phase and Volatile Evidence Preservation
Question 1292Question →

A security team creates an automated Security Orchestration, Automation, and Response (SOAR) playbook to handle alerts generated when a suspicious email attachment is reported. Place the following automated playbook steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order of the SOAR playbook steps is: 1) Ingest alert payload from email security gateway via webhook, 2) Query external threat intelligence service to analyze file hash, 3) Send API command to EDR agents to quarantine malicious file, and 4) Update ITSM ticket with findings and resolve case.
Standard SOAR playbooks follow a structured sequence: initial ingestion of alert data triggers the playbook, threat intelligence enrichment evaluates indicators of compromise, automated containment tools neutralize confirmed threats, and ticketing integrations record final documentation.

Step-by-Step Solution

1
Ingest the alert trigger
The SOAR engine receives event data from the email security gateway.
Playbooks require initial alert data ingestion before any actions or analysis can be performed.
2
Perform threat enrichment
File hashes are evaluated against external threat intelligence sources.
Enrichment provides the verification needed to determine if response actions are required.
3
Execute automated response
The EDR platform isolates and quarantines the file across endpoints.
Mitigation steps are executed automatically based on the confirmed threat intelligence verdict.
4
Document and close case
The ITSM ticketing platform receives full incident details and case resolution status.
Final audit logging and ticket updates occur after all operational containment tasks are complete.

Key Concept

SOAR Playbook Lifecycle (Ingest -> Enrich -> Contain -> Document)
Question 1293Question →

A Security Operations Center (SOC) analyst receives a high-priority alert indicating potential encrypted command-and-control (C2) beaconing originating from a domain controller. In what order should the analyst perform the following network security monitoring and triage steps to properly validate, investigate, and contain the incident?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with validating the NIDS alert against NetFlow and DNS records, followed by identifying the specific process via endpoint telemetry, isolating the host to prevent lateral movement, and finally enforcing perimeter blocking and DNS sinkholing.
The incident handling lifecycle requires starting with verification (correlating NIDS, NetFlow, and DNS logs), followed by context gathering (EDR process mapping), local containment (host network isolation to halt lateral spread while keeping power on), and global containment (perimeter firewall blocks and DNS sinkholing).

Step-by-Step Solution

1
Correlate network telemetry (NIDS, NetFlow, DNS).
Validates the alert authenticity and confirms persistent beaconing behavior.
Security monitoring protocols mandate verifying alerts against baseline NetFlow and DNS logs to eliminate false positives before taking invasive actions.
2
Inspect host endpoint logs (EDR process correlation).
Identifies the malicious process ID and executable tied to the network connection.
Network alerts identify IP/port pairings, but pinpointing the malicious actor on the system requires matching sockets to host processes.
3
Execute targeted host containment (network isolation).
Prevents lateral movement while keeping the system powered for forensic memory capture.
Isolating the compromised domain controller prevents adversaries from moving laterally to other critical assets.
4
Implement enterprise perimeter indicators of compromise (IoC) block rules.
Shields all other enterprise hosts from communicating with the external C2 infrastructure.
Broad perimeter blocking and DNS sinkholing ensure enterprise-wide containment after host-level containment is established.

Key Concept

Incident Response Lifecycle for Network Security Monitoring
Estimated Time:3m 0s
Question 1294Question →

An enterprise integrates a Security Orchestration, Automation, and Response (SOAR) platform to process phishing reports. The automated playbook extracts embedded URLs, checks them against threat intelligence feeds, and upon finding a positive match, executes an automated script that revokes the compromised user's directory account and isolates their host machine. During a routine business operation, a false-positive threat feed match triggers the playbook, causing the domain administrator account to be automatically disabled and isolating a primary domain controller. Which of the following modifications to the SOAR playbook logic best mitigates the risk of operational disruption while preserving automated triage efficiency?

Show answer & explanation

Answer: Insert a conditional decision node requiring Human-in-the-Loop (HITL) approval prior to executing high-impact containment actions on identified critical infrastructure or privileged accounts.

Answer

Inserting a conditional decision node requiring Human-in-the-Loop approval prior to executing high-impact containment actions on identified critical infrastructure or privileged accounts.
The correct option addresses the root cause of automated operational failure by introducing a Human-in-the-Loop (HITL) approval step for critical systems and privileged accounts. SOAR playbooks should automate low-risk investigation and triage tasks automatically, but high-impact containment actions against critical infrastructure (like domain controllers) must incorporate analyst authorization to prevent business disruption caused by false positives.

Step-by-Step Solution

1
Analyze the incident root cause
Unrestricted automated containment scripts disabled a critical asset (domain controller / admin account) based on a false-positive trigger.
Fully automated containment without asset-level safeguards creates significant operational exposure for enterprise infrastructure.
2
Evaluate SOAR orchestration governance controls
High-impact containment tasks (such as account revocation or server isolation) on tier-0 assets require approval gates.
Human-in-the-Loop (HITL) steps allow automated enrichment and triage to proceed rapidly while maintaining human oversight for critical disruption risks.
3
Select the optimal playbook design modification
Implement conditional branching that checks asset criticality tags and requires analyst sign-off before executing disruptive containment against core systems.
This preserves the speed of automated investigation while protecting organizational resilience.

Key Concept

SOAR Playbook Governance and Human-in-the-Loop (HITL) Safeguards
Question 1295Question →

An enterprise is implementing a federated web single sign-on (SSO) solution allowing corporate users to access external cloud applications seamlessly. The architectural requirement mandates using an open standard that relies on XML-based security assertions to transmit authentication state and user attributes from the Identity Provider (IdP) to the Service Provider (SP). Which of the following protocols should the security architect select to meet these requirements?

Show answer & explanation

Answer: SAML (Security Assertion Markup Language)

Answer

SAML (Security Assertion Markup Language) is the correct architectural choice for XML-based federated web SSO between an Identity Provider and a Service Provider.
Security Assertion Markup Language (SAML) is an open XML-based standard created specifically for federated Single Sign-On (SSO). It allows an Identity Provider (IdP) to package authentication state, user attributes, and entitlement assertions into XML tokens sent to a Service Provider (SP), perfectly satisfying all stated requirements.

Step-by-Step Solution

1
Identify key architectural requirements from the scenario.
The requirements demand a web-based federated SSO architecture using XML-based security assertions between an Identity Provider (IdP) and a Service Provider (SP).
Accurately pinpointing protocol capability criteria is required before selecting IAM security controls.
2
Evaluate standard identity protocols against the XML assertion constraint.
Security Assertion Markup Language (SAML) specifically utilizes XML formatted security assertions to communicate user identity and authentication status across domain boundaries.
OAuth 2.0 and OIDC use JSON tokens, RADIUS uses UDP attribute-value pairs, and Kerberos uses ticket grants within symmetric domain trusts.

Key Concept

Federated Identity and Access Architecture
Question 1296Question →

A security analyst is preparing to create a bit-stream disk image from a physical hard drive seized during an insider threat investigation. Before connecting the target drive to the forensic workstation for image capture, which of the following controls should the analyst implement FIRST to protect the integrity of the original evidence?

Show answer & explanation

Answer: Connect a physical hardware write-blocker between the seized drive and the acquisition workstation

Answer

The analyst should connect a physical hardware write-blocker between the seized drive and the acquisition workstation.
Connecting a physical hardware write-blocker ensures that all write requests issued by the workstation's operating system are intercepted and dropped before reaching the evidence drive. This guarantees that the original evidence remains completely unaltered during bit-stream image acquisition.

Step-by-Step Solution

1
Identify the primary threat to physical evidence integrity during forensic image acquisition.
Standard operating systems automatically mount drives and write metadata (such as volume flags or access timestamps) when a drive is attached.
Preventing any write commands from reaching the original source media is required to preserve evidence admissibility.
2
Select the appropriate forensic control designed to intercept host write signals.
A hardware write-blocker blocks write commands at the controller layer while allowing read commands necessary for imaging.
Hardware write-blockers guarantee read-only access regardless of host OS behavior.
3
Begin bit-stream forensic imaging and hash generation after write-blocking is confirmed.
A true bit-by-bit copy is produced with matching source and target cryptographic hashes.
Establishes a verifiable chain of custody and maintains evidence integrity.

Key Concept

Use of Hardware Write-Blockers for Forensic Acquisition Integrity
Question 1297Question →

Match each vulnerability scanning approach to its corresponding operational characteristic or primary benefit.

Click a left item, then click its matching right item

Items

Credentialed Scan
Non-Credentialed Scan
Passive Scan
Agent-Based Scan

Matches

Show answer & explanation

Answer

Credentialed Scan pairs with internal software inventory and patch details; Non-Credentialed Scan pairs with simulating an external attacker's perspective; Passive Scan pairs with silently monitoring network traffic without probes; Agent-Based Scan pairs with assessing off-network endpoints continuously.
Vulnerability assessment modalities differ fundamentally by access rights, deployment model, and network footprint: credentialed scans perform local patch audits, non-credentialed scans map external surface vulnerabilities, passive scans monitor packet headers without sending probes, and agent-based scans gather host posture locally on mobile devices.

Step-by-Step Solution

1
Analyze host authentication privileges vs network probing.
Identify that authenticating to a host provides deep local configuration data (Credentialed), whereas unauthenticated network discovery shows external exposure (Non-Credentialed).
Privilege level dictates visibility into internal system patches versus network perimeter posture.
2
Analyze network traffic impact and agent deployment mechanics.
Determine that packet sniffer-style assessment creates zero active traffic (Passive), while locally installed software reports posture regardless of network location (Agent-Based).
Scanning architecture determines traffic overhead and visibility into remote or fragile assets.

Key Concept

Vulnerability Scanning Types and Deployment Methodologies
Question 1298Question →

A security administrator is establishing a baseline security workflow to ensure that all newly deployed workstations meet organizational security standards and remain protected against known software flaws. Which of the following operational practices should the administrator implement to maintain system integrity and compliance? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Establishing standardized configuration baselines across all workstation images prior to deployment; Implementing an automated patch management process to deploy verified vendor updates regularly

Answer

The administrator should establish standardized configuration baselines across workstation images and implement an automated patch management process.
Establishing secure configuration baselines ensures consistent secure state defaults upon deployment, while implementing automated patch management maintains system security by applying vendor updates to resolve software flaws continuous across the lifecycle.

Step-by-Step Solution

1
Identify baseline configuration needs
Creating initial configuration baselines ensures all workstations start in a secure, uniform state.
Prevents configuration drift and default misconfigurations across newly deployed systems.
2
Implement centralized automated patching
Ongoing automated patching updates operating systems and applications with the latest security fixes.
Reduces security risks associated with known unpatched vulnerabilities over time.

Key Concept

Patch and Configuration Management
Estimated Time:1m 0s
Question 1299Question →

A Security Operations Center (SOC) team is designing an automated Security Orchestration, Automation, and Response (SOAR) playbook to mitigate high-volume brute-force authentication attacks against a web portal. The security team must ensure rapid response while avoiding operational self-denial of service (DoS) against critical enterprise infrastructure or legitimate traffic. Which of the following playbook design strategies best achieves automated containment while minimizing operational risk?

Show answer & explanation

Answer: Automatically append external source IP addresses exceeding the failed login threshold to a temporary perimeter firewall blocklist while excluding trusted enterprise IP ranges.

Answer

Automatically appending external source IP addresses exceeding the failed login threshold to a temporary perimeter firewall blocklist while excluding trusted enterprise IP ranges best balances rapid response with operational safety.
The option advocating temporary firewall blocklisting of external source IPs with trusted range exclusions represents effective SOAR playbook design. SOAR automation speeds up response times during brute-force attacks, while inclusion of temporary blocks and whitelist logic ensures operational continuity and guards against self-inflicted outages.

Step-by-Step Solution

1
Analyze the threat vector and operational requirements.
Identified high-volume brute-force attacks needing automated containment that stops malicious traffic without disrupting legitimate enterprise services.
SOAR playbooks must balance automated speed with risk management to avoid unexpected outages of critical business systems.
2
Evaluate containment actions against operational safety controls.
Enforcing temporary IP blocks on malicious external sources while incorporating allowlists for internal/trusted infrastructure prevents self-inflicted denial of service.
Safeguarding critical assets and enterprise egress ranges ensures that automated playbooks do not inadvertently isolate core infrastructure.

Key Concept

SOAR Playbook Containment Logic and Risk Mitigation
Estimated Time:1m 30s
Question 1300Question →

A network security administrator is enhancing default gateway availability for a critical transaction processing subnet. The design mandates that if the active border router suffers a hardware crash, internal client endpoints must maintain outbound connectivity automatically without requiring manual IP reconfiguration or workstation restarts. Which of the following controls best achieves this fault-tolerant requirement?

Show answer & explanation

Answer: Implement a First Hop Redundancy Protocol to share a virtual IP and MAC address across the routers.

Answer

Implementing a First Hop Redundancy Protocol (FHRP) allows redundant routers to share a single virtual IP and MAC address, allowing transparent gateway failover for client endpoints.
First Hop Redundancy Protocols allow two or more physical routers to present a shared virtual IP address and virtual MAC address to local endpoints. If the active master router fails, a backup router assumes responsibility for traffic sent to the virtual IP without requiring changes to client network settings.

Step-by-Step Solution

1
Analyze the technical requirement.
The requirement calls for automatic layer 3 default gateway failover for endpoint clients without manual endpoint reconfiguration.
Host computers configured with a static default gateway IP address cannot dynamically switch to a second router IP address unless a virtual gateway abstraction is used.
2
Evaluate candidate high availability protocols.
First Hop Redundancy Protocols (such as VRRP or HSRP) group physical routers into a logical unit assigned a virtual IP address used by endpoints as their default gateway.
When the primary router fails, a standby router immediately assumes the virtual IP address and virtual MAC address, continuing traffic forwarding seamlessly.

Key Concept

First Hop Redundancy Protocols (FHRP)
PreviousPage 65 / 112Next
All practice questions — CompTIA Security+ | Examkin