Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1341Question →

A security analyst is conducting a routine audit of Identity and Access Management (IAM) operational logs following an employee offboarding procedure. The log analysis reveals that an offboarded engineer's primary user account was disabled in Active Directory immediately upon termination. However, three days later, successful interactive logins were recorded on several internal servers using a secondary administrative account assigned to the same individual. Which of the following identity management operational failures is the MOST likely root cause of this security gap?

Show answer & explanation

Answer: Incomplete account lifecycle deprovisioning across secondary and privileged identities.

Answer

Incomplete account lifecycle deprovisioning across secondary and privileged identities.
Comprehensive identity lifecycle management requires all accounts associated with an individual—including primary, secondary, and privileged administrative accounts—to be promptly identified and deprovisioned during employee offboarding. Leaving secondary accounts active creates orphaned accounts that present critical security vulnerabilities.

Step-by-Step Solution

1
Analyze the incident details from the IAM operational log audit.
Identified that while the primary user account was disabled during offboarding, a secondary administrative account assigned to the same user remained active.
Offboarding procedures must track and revoke all identities linked to an individual.
2
Evaluate the cause of the unauthorized post-offboarding logins.
The logins succeeded because valid credentials for the secondary account were still active in the environment.
Orphaned accounts resulting from partial deprovisioning remain fully functional for authentication.
3
Determine the operational failure responsible for the security gap.
The root cause is incomplete identity lifecycle management during account deprovisioning.
Effective IAM operations require comprehensive account inventory and complete deprovisioning workflows across all user identities.

Key Concept

Identity Lifecycle Management and Account Deprovisioning Operations
Question 1342Question →

Match each enterprise identity and access management (IAM) architectural component on the left to its primary functional responsibility on the right.

Click a left item, then click its matching right item

Items

SAML Assertion Consumer Service (ACS)
OAuth 2.0 Authorization Server
SCIM Provisioning Service
Kerberos Key Distribution Center (KDC)

Matches

Show answer & explanation

Answer

SAML Assertion Consumer Service (ACS) matches receiving and validating signed XML assertions from an external IdP; OAuth 2.0 Authorization Server matches authenticating resource owners and issuing scoped access tokens; SCIM Provisioning Service matches automating identity account creation and de-provisioning via RESTful APIs; Kerberos Key Distribution Center (KDC) matches granting Ticket Granting Tickets and service tickets for internal domain authentication.
Each IAM component performs a specific architectural role in identity lifecycle management, federated web single sign-on, API authorization delegation, or local domain ticket authentication.

Step-by-Step Solution

1
Identify SAML Assertion Consumer Service (ACS) function
Matches XML assertion processing at the Service Provider endpoint during federated SSO.
SAML reliance on XML signatures and HTTP posts to the ACS endpoint is characteristic of web-based SP-initiated or IdP-initiated federation.
2
Identify OAuth 2.0 Authorization Server function
Matches issuing scoped tokens for API authorization access.
OAuth 2.0 delegates authority through token issuance without sharing credentials with the client application.
3
Identify SCIM Provisioning Service function
Matches automated lifecycle management across external application identity stores.
SCIM defines schema models and HTTP operations for syncing user identity lifecycles.
4
Identify Kerberos Key Distribution Center (KDC) function
Matches issuing Ticket Granting Tickets (TGT) within a local Active Directory domain.
Kerberos relies on a trusted KDC to grant ticket-based mutual authentication on internal networks.

Key Concept

Enterprise IAM Architecture Components and Protocols
Question 1343Question →

An enterprise security team is configuring a Just-In-Time (JIT) Privileged Access Management (PAM) workflow with short-lived ephemeral credentials for database administrators. Place the operational lifecycle steps in the correct chronological order from the initial access request through session termination.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The operational sequence begins with administrator authentication and request submission, followed by automated policy validation and ephemeral credential generation, session initiation through the PAM proxy gateway, real-time command monitoring and session recording during operation, and concludes with automated credential revocation and session termination upon time window expiry.
The correct operational lifecycle follows the principle of least privilege and Just-In-Time access controls. It starts with the administrator requesting access with justification. Next, authorization policies are checked and ephemeral credentials with short TTLs are issued. The administrator then logs into the target through a PAM proxy gateway, which maintains active session monitoring and command logging throughout the connection. Finally, once the access time window lapses, the PAM system automatically revokes credentials and terminates open connections.

Step-by-Step Solution

1
Identify the request phase
The administrator submits an access request with ticket justification via the PAM portal.
JIT workflows require explicit administrative intent and justification prior to provisioning privileges.
2
Determine the provisioning phase
The PAM controller evaluates the rule baseline and generates an ephemeral, short-lived credential.
Credentials must be dynamically created with strict Time-to-Live (TTL) attributes before access can be granted.
3
Identify the session entry phase
The administrator establishes a database session routed through the PAM proxy gateway using the ephemeral credential.
Routing connections through a proxy ensures direct database access is blocked and session telemetry is captured.
4
Determine the operational monitoring phase
The proxy gateway performs active session recording and real-time command monitoring.
Active monitoring must happen concurrently with session execution to maintain auditability and prevent unauthorized command execution.
5
Identify the teardown phase
The PAM system automatically invalidates the short-lived credential and terminates active proxy sessions upon window expiration.
Automated revocation enforces zero lingering privileges and minimizes standing access risks.

Key Concept

Just-In-Time (JIT) Privileged Access Management (PAM) Lifecycle
Question 1344Question →

A digital forensics examiner is performing evidence collection on a powered-on enterprise server following a suspected breach. To ensure maximum preservation of transient evidence, the examiner must adhere strictly to the forensic Order of Volatility. Sequence the following evidence sources from most volatile (highest priority for acquisition) to least volatile (lowest priority for acquisition).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct acquisition sequence from most volatile to least volatile is: Processor cache and CPU registers, followed by Physical system RAM and running process tables, followed by Swap files and pagefile space on local disk storage, and ending with Offline archival backup tapes.
Standard digital forensics practices (RFC 3227) require collecting evidence in order of volatility to prevent losing perishable data. CPU registers and cache change at instruction-level speeds and are most volatile. Physical RAM loses contents upon reboot or power-off. Swap and pagefiles reside on disk but hold temporary, frequently modified memory blocks. Offline archival tapes are static physical media stored offsite, making them the least volatile.

Step-by-Step Solution

1
Identify the data source with the shortest lifetime that changes during hardware execution.
Processor cache and CPU registers are placed first.
Registers and CPU caches alter state with every clock cycle and cannot be preserved once execution progresses or power changes.
2
Identify volatile system memory retained only while power is maintained.
Physical system RAM and running process tables are placed second.
System memory holds dynamic network connections, process structures, and unencrypted keys that disappear if the machine powers down.
3
Identify temporary disk-backed virtual memory structures.
Swap files and pagefile space on local disk storage are placed third.
Pagefiles reside on non-volatile physical disks, but their data blocks are temporary and actively overwritten by operating system memory management.
4
Identify long-term static offline storage media.
Offline archival backup tapes are placed last.
Archival media is offline, unpowered, and structurally static, making it the most durable and least volatile evidence source.

Key Concept

Order of Volatility in Digital Forensics
Question 1345Question →

A security operations team discovers that critical production servers frequently experience configuration drift due to uncoordinated hotfixes applied by system administrators during emergency outage incidents. Although automated configuration auditing tools successfully flag these non-compliant system states during nightly scans, security engineers cannot readily distinguish between unauthorized vulnerabilities and approved emergency hotfixes. Which of the following solutions should the security team implement to effectively manage configuration drift while maintaining audit compliance for emergency changes?

Show answer & explanation

Answer: Integrate automated configuration management systems with the service management database to dynamically reconcile live endpoint baseline scans against authorized emergency change requests.

Answer

Integrate automated configuration management systems with the service management database to dynamically reconcile live endpoint baseline scans against authorized emergency change requests.
Integrating automated configuration monitoring tools with the service management database (CMDB) bridges the gap between technical drift detection and administrative change management. When an emergency hotfix alters a server baseline, the configuration management tool checks the CMDB for a corresponding approved emergency change ticket. If a valid ticket exists, the baseline variation is recognized as authorized drift; if no ticket exists, it is treated as unauthorized configuration drift requiring remediation.

Step-by-Step Solution

1
Analyze the operational problem
Identify that the core issue is an inability to correlate live configuration drift with legitimate emergency change documentation.
Security operations need continuous automated verification without breaking emergency change management workflows.
2
Evaluate patch and configuration management governance
Determine that linking configuration assessment tools with formal IT service management (ITSM/CMDB) tracking enables real-time verification of baseline exceptions.
Automated reconciliation ensures unauthorized drift is highlighted for remediation while authorized emergency hotfixes are automatically reconciled against open change tickets.
3
Differentiate governance roles and control functions
Reject responses that misclassify control categories (detective vs. preventive), misapply network mitigations to system states, or break role separation.
Maintaining proper security control classification and role boundaries is critical for enterprise security posture.

Key Concept

Configuration Drift and Automated Baseline Reconciliation
Question 1346Question →

A chief information security officer (CISO) is evaluating a proposed security safeguard for an enterprise web application valued at $1,200,000\$1,200,000. Threat intelligence and audit history indicate an Annual Rate of Occurrence (AROARO) of 0.50.5 for major security breach attempts, with a current Exposure Factor (EFEF) of 40%40\%. The proposed security control requires an annual subscription and maintenance cost of $45,000\$45,000 and is projected to reduce the Exposure Factor (EFEF) to 10%10\%, while the AROARO remains unchanged. What is the net annual financial benefit of implementing this safeguard?

Show answer & explanation

Answer: $135,000\$135,000

Answer

The net annual financial benefit of implementing the safeguard is $135,000\$135,000.
To calculate net annual financial benefit, compare initial Annual Loss Expectancy (ALEpriorALE_{prior}) against post-control Annual Loss Expectancy (ALEpostALE_{post}) plus annual control cost. Initial ALE=$1,200,000×0.40×0.5=$240,000ALE = \$1,200,000 \times 0.40 \times 0.5 = \$240,000. Post-control ALE=$1,200,000×0.10×0.5=$60,000ALE = \$1,200,000 \times 0.10 \times 0.5 = \$60,000. Gross risk reduction is $240,000−$60,000=$180,000\$240,000 - \$60,000 = \$180,000. Subtracting the $45,000\$45,000 annual safeguard cost leaves a net annual benefit of $135,000\$135,000.

Step-by-Step Solution

1
Calculate the baseline Single Loss Expectancy (SLEpriorSLE_{prior}) and Annual Loss Expectancy (ALEpriorALE_{prior})
SLEprior=$1,200,000×0.40=$480,000SLE_{prior} = \$1,200,000 \times 0.40 = \$480,000; ALEprior=$480,000×0.5=$240,000ALE_{prior} = \$480,000 \times 0.5 = \$240,000
Establishing the initial unmitigated annual financial risk before implementing security controls.
2
Calculate the post-mitigation Single Loss Expectancy (SLEpostSLE_{post}) and Annual Loss Expectancy (ALEpostALE_{post})
SLEpost=$1,200,000×0.10=$120,000SLE_{post} = \$1,200,000 \times 0.10 = \$120,000; ALEpost=$120,000×0.5=$60,000ALE_{post} = \$120,000 \times 0.5 = \$60,000
Determining the residual annual loss expected after the safeguard reduces the Exposure Factor.
3
Calculate the gross annual risk reduction
Gross Loss Reduction =ALEprior−ALEpost=$240,000−$60,000=$180,000= ALE_{prior} - ALE_{post} = \$240,000 - \$60,000 = \$180,000
Determining the total annual loss prevented by the control.
4
Deduct the annual cost of the safeguard to determine net annual financial benefit
Net Benefit =$180,000−$45,000=$135,000= \$180,000 - \$45,000 = \$135,000
Determining whether the safeguard is cost-effective by weighing risk reduction against control maintenance expenses.

Key Concept

Quantitative Risk Assessment and Safeguard Cost-Benefit Analysis
Estimated Time:2m 0s
Question 1347Question →

A security engineer is refining the vulnerability assessment strategy for an enterprise data center hosting high-availability web applications and legacy backend databases. To ensure deep asset visibility while mitigating the risk of service disruption and unauthorized network impact, which of the following operational practices should the engineer implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Schedule intrusive vulnerability scanning templates exclusively during pre-approved maintenance windows.; Use credentialed access to audit local system configurations, installed software inventories, and missing patches.

Answer

The security engineer should schedule intrusive vulnerability scan templates exclusively during pre-approved maintenance windows and use credentialed access to audit local configurations, installed software, and missing patches.
Scheduling intrusive scans during maintenance windows protects production availability from unexpected system crashes, while credentialed scanning provides precise internal configuration visibility with minimal network impact and reduced false positives.

Step-by-Step Solution

1
Evaluate the operational impact of scan intensity levels on critical assets.
Recognize that intrusive scanning techniques can exhaust host resources or crash legacy services if executed during peak hours.
Intrusive scans actively probe weaknesses and must be confined to maintenance windows to safeguard service availability.
2
Determine the scanning methodology that maximizes accuracy while reducing network overhead.
Select authenticated (credentialed) scanning over unauthenticated network probing.
Credentialed scanning queries local system registries and patch databases directly, reducing false positives without saturating network bandwidth.
3
Differentiate detective scanning tools from preventive and corrective security controls.
Reject firewalls and scanners as automated patch remediation mechanisms.
Scanners are detective controls and firewalls are preventive traffic filters; application flaws require software updates or code refactoring.

Key Concept

Vulnerability Scanning Methodologies and Operational Controls
Question 1348Question →

A security engineer is configuring a SIEM collector to process raw syslog feeds from perimeter devices. Place the stages of SIEM log processing in the correct order from initial ingestion to analyst notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of SIEM log processing stages is Log Collection & Ingestion, Parsing & Field Extraction, Data Normalization, Event Correlation, and Alert Generation.
The SIEM log processing pipeline must proceed sequentially from raw data capture to actionable intelligence. First, Log Collection & Ingestion gathers raw logs from network sources. Second, Parsing & Field Extraction breaks unstructured strings into distinct field variables. Third, Data Normalization maps vendor-specific variables into a unified schema. Fourth, Event Correlation analyzes normalized fields against detection rules and threat feeds. Finally, Alert Generation dispatches notifications to analysts when correlated events breach security thresholds.

Step-by-Step Solution

1
Identify the initial entry point of telemetry into the SIEM pipeline.
Log Collection & Ingestion is placed first because raw logs must be received before any processing can occur.
Raw data must be gathered from source endpoints or network appliances first.
2
Identify how raw unstructured strings are structured.
Parsing & Field Extraction is placed second to break raw text strings into discrete data variables.
Extracting key-value pairs is necessary before data can be categorized or standardized.
3
Identify how disparate vendor fields are unified.
Data Normalization is placed third to map extracted variables to a standard schema.
Standardizing field names allows the SIEM to analyze logs from different manufacturers consistently.
4
Determine how security context is established across normalized telemetry.
Event Correlation is placed fourth to evaluate normalized data against rules and threat intelligence.
Correlation logic requires structured, normalized data to accurately detect multi-source threats.
5
Determine the operational output resulting from correlation matches.
Alert Generation is placed fifth to notify security analysts of actionable security events.
Alert dispatches occur as the end result of matched correlation criteria.

Key Concept

SIEM Log Processing Pipeline
Question 1349Question →

An enterprise incident response team is evaluating a newly deployed Security Orchestration, Automation, and Response (SOAR) playbook intended to contain compromised systems. The playbook automatically executes a script that isolates host network interfaces upon receiving high-severity endpoint alerts. Security engineers are concerned that automated execution against critical infrastructure, such as domain controllers or primary database hosts, could cause severe business disruptions in the event of a false positive. Which of the following workflow modifications best mitigates this risk while preserving automated containment capabilities for standard endpoints?

Show answer & explanation

Answer: Implement conditional branching that requires human-in-the-loop manual authorization before taking isolation actions against designated high-criticality assets.

Answer

Implement conditional branching that requires human-in-the-loop manual authorization before taking isolation actions against designated high-criticality assets.
Implementing conditional branching with human-in-the-loop (HITL) approval for critical assets allows security operations to isolate standard endpoints automatically while preventing accidental outages of critical infrastructure during false positives.

Step-by-Step Solution

1
Analyze the operational risk associated with fully automated SOAR playbooks.
Unconditional automated isolation of critical production infrastructure (such as domain controllers) presents high business continuity risk due to potential false positives.
Automated containment actions must balance response velocity with the potential business impact on essential services.
2
Identify playbook design mechanisms to protect critical assets while maintaining automation.
Introducing conditional logic based on asset tags or criticality levels allows standard hosts to be automatically contained while routing high-impact systems to an analyst.
Human-in-the-loop (HITL) approval steps provide necessary governance where downtime consequences are severe.

Key Concept

SOAR Playbook Logic and Human-in-the-Loop (HITL) Governance
Estimated Time:1m 30s
Question 1350Question →

An enterprise security policy requires that any unauthorized changes to server system configurations are automatically detected and restored to a pre-approved security state. Which of the following operational controls best meets this requirement?

Show answer & explanation

Answer: Automated configuration management baseline enforcement

Answer

Automated configuration management baseline enforcement
Automated configuration management baseline enforcement continuously compares system settings against an established baseline and automatically remediates configuration drift by restoring approved settings.

Step-by-Step Solution

1
Identify the core requirement in the scenario.
The scenario requires automatic detection and restoration of unauthorized system configuration changes (configuration drift).
Security baselines define approved operational settings, and automated tools enforce compliance against these baselines continuously.
2
Evaluate the technical capabilities of available operational controls.
Automated configuration management tools actively monitor settings and enforce baselines, reverting unauthorized drift automatically without manual intervention.
Other control options act as detective logging mechanisms or network filters rather than internal system configuration enforcement tools.

Key Concept

Configuration Drift and Automated Baseline Enforcement
Question 1351Question →

An e-commerce enterprise hosts a customer transaction database valued at $500,000. Security metrics indicate that a successful SQL injection attack has an Exposure Factor (EF) of 0.15, and threat intelligence data estimates the Annualized Rate of Occurrence (ARO) for this threat vector to be 0.40. What is the Annualized Loss Expectancy (ALE) in dollars for this database asset?

Show answer & explanation

Answer: 30000

Answer

The Annualized Loss Expectancy (ALE) for the database asset is $30,000.
The Annualized Loss Expectancy (ALE) is determined by first computing Single Loss Expectancy (SLE=AV×EF\text{SLE} = \text{AV} \times \text{EF}) and then scaling it by the occurrence rate (ALE=SLE×ARO\text{ALE} = \text{SLE} \times \text{ARO}). With an Asset Value of 500,000andanEFof0.15,theSLEis500,000 and an EF of 0.15, the SLE is 75,000. Multiplying 75,000byanAROof0.40yieldsanALEof75,000 by an ARO of 0.40 yields an ALE of 30,000.

Step-by-Step Solution

1
Calculate the Single Loss Expectancy (SLE)
SLE = $75,000
SLE measures the monetary loss expected each time a risk event occurs, calculated by multiplying the total Asset Value ($500,000) by the Exposure Factor (0.15).
2
Calculate the Annualized Loss Expectancy (ALE)
ALE = $30,000
ALE calculates the yearly financial impact of the threat by multiplying the Single Loss Expectancy ($75,000) by the Annualized Rate of Occurrence (0.40).

Key Concept

Quantitative Risk Analysis (ALE = AV * EF * ARO)
Estimated Time:1m 30s
Question 1352Question →

A security administrator is reviewing high-availability cluster resilience and failover mechanisms for mission-critical enterprise services. Match each clustering component or condition on the left with its corresponding operational definition or control mechanism on the right.

Click a left item, then click its matching right item

Items

Split-brain condition
Quorum
STONITH (Fencing)
Heartbeat link

Matches

Show answer & explanation

Answer

Split-brain condition matches the state where isolated partitions simultaneously claim active role; Quorum matches the minimum voting node requirement for authority; STONITH matches the automated node power-down/isolation mechanism; Heartbeat link matches the dedicated keep-alive telemetry path.
Each clustering concept represents a specific mechanism essential for maintaining cluster integrity and high availability: the heartbeat link continuously monitors peer health; quorum requires a majority vote before changing active status; split-brain occurs when lost communication causes dual active nodes; and STONITH forcibly isolates or powers down problematic nodes to prevent split-brain write corruption.

Step-by-Step Solution

1
Identify the primary functions of node monitoring, partition consensus, and conflict resolution in high-availability clusters.
Determined that heartbeat links monitor health, quorum establishes state consensus, split-brain describes dual-active partition conflicts, and fencing (STONITH) enforces physical node isolation.
Clustering resilience relies on distinguishing health signaling from decision consensus and active fencing controls.
2
Pair each clustering concept on the left with its matching definition on the right.
Mapped Split-brain condition to dual active assumption, Quorum to voting node threshold, STONITH to automated power down, and Heartbeat link to dedicated monitoring path.
Accurate pairing aligns cluster design terminology with concrete resilience and failover controls.

Key Concept

High-Availability Clustering Controls and Partition Fault Tolerance Mechanisms
Estimated Time:1m 30s
Question 1353Question →

A security administrator is establishing standard operating procedures for system maintenance across enterprise servers. Which of the following actions should be performed prior to deploying software patches to live production servers? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Test updates in a non-production staging environment to verify system stability and software compatibility; Submit proposed updates for formal review and authorization through the change management process

Answer

Testing updates in a non-production staging environment and submitting proposed updates through formal change management review.
A sound patch management policy requires testing software updates in a non-production staging environment to confirm system stability and software compatibility prior to live deployment. Additionally, submitting the proposed changes through a formal change management process ensures administrative oversight, scheduled maintenance windows, and verified rollback plans.

Step-by-Step Solution

1
Analyze the patch management lifecycle requirements prior to production deployment.
Identified the need for technical verification and administrative risk governance.
Pre-deployment validation reduces the risk of operational disruption.
2
Evaluate technical pre-deployment procedures.
Staging environment testing verifies functional compatibility without risking live services.
Staging reflects production conditions while isolating potential patch defects.
3
Evaluate administrative governance controls.
Formal change management authorization provides proper approval, scheduling, and rollback planning.
Change control ensures organizational awareness and structured risk management.

Key Concept

Patch Management and Change Control Lifecycle
Question 1354Question →

An organization evaluates the risk of a critical power surge affecting an off-site infrastructure facility housing archival data servers valued at 120,000.Riskassessmentsindicatethatamajorsurgewouldpermanentlydestroy40120,000. Risk assessments indicate that a major surge would permanently destroy 40% of the server hardware (Exposure Factor, EF = 0.40 ).Historicalweatherandutilityrecordssuggestthistypeofincidentoccursonceeveryfouryears(AnnualRateofOccurrence,). Historical weather and utility records suggest this type of incident occurs once every four years (Annual Rate of Occurrence, ARO = 0.25$). What is the Annual Loss Expectancy (ALE) for this server infrastructure?

Show answer & explanation

Answer: $12,000

Answer

The Annual Loss Expectancy (ALE) is $12,000.
The correct answer is 12,000.QuantitativeriskassessmentcalculatesSingleLossExpectancyas12,000. Quantitative risk assessment calculates Single Loss Expectancy as SLE = AV \times EF = 120,000×0.40=120,000 \times 0.40 = 48,000 .MultiplyingSLEbytheAnnualRateofOccurrence(. Multiplying SLE by the Annual Rate of Occurrence ( ARO = 0.25 )yields) yields ALE = 48,000×0.25=48,000 \times 0.25 = 12,000$.

Step-by-Step Solution

1
Calculate the Single Loss Expectancy (SLE)
SLE=Asset Value (AV)×Exposure Factor (EF)=SLE = \text{Asset Value (AV)} \times \text{Exposure Factor (EF)} = 120,000 \times 0.40 = 48,00048,000
SLE determines the expected monetary loss every time a risk event occurs.
2
Calculate the Annual Loss Expectancy (ALE)
ALE=SLE×Annual Rate of Occurrence (ARO)=ALE = SLE \times \text{Annual Rate of Occurrence (ARO)} = 48,000 \times 0.25 = 12,00012,000
ALE quantifies the expected annualized financial loss resulting from a specific risk.

Key Concept

Quantitative Risk Analysis (ALE Formula)
Estimated Time:1m 30s
Question 1355Question →

A security operations team is configuring an automated Security Orchestration, Automation, and Response (SOAR) workflow to handle initial triage and containment for incoming high-severity suspicious email alerts. Which of the following tasks represent safe, effective automated steps to include in the initial playbook execution prior to analyst review? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Query external threat intelligence APIs to verify the reputation scores of URLs and attachment hashes found in the message.; Issue API calls to the email gateway to quarantine the matching message across all internal employee mailboxes.

Answer

The correct response steps are to query external threat intelligence APIs for domain and hash reputation and to quarantine the email message across internal mailboxes using email gateway API integrations.
Automated SOAR playbooks perform best when executing rapid enrichment (such as querying threat intelligence feeds for malicious domain reputation) and targeted, low-risk containment (such as quarantining an email message across mailboxes via API). These steps neutralize immediate exposure while providing rich contextual data for analyst decision-making.

Step-by-Step Solution

1
Evaluate automated threat enrichment capabilities
Automated threat intelligence queries enrich indicators without impacting business operations.
Enriching alerts with external domain and file hash reputation provides context required for analyst triage.
2
Evaluate low-risk automated containment actions
Quarantining emails at the mail gateway prevents further user interaction.
Removing suspicious messages from recipient mailboxes stops potential phishing execution while preserving system availability.
3
Identify high-risk distractor logic in automated playbooks
Isolating critical infrastructure or locking out recipients causes immediate business disruption.
Executing destructive actions automatically on unverified or low-fidelity indicators creates self-inflicted denial of service.

Key Concept

SOAR Playbook Design and Low-Risk Automated Response
Question 1356Question →

Match each security governance document type on the left with its corresponding characteristic on the right.

Click a left item, then click its matching right item

Items

Security Policy
Security Standard
Security Baseline
Security Guideline

Matches

Show answer & explanation

Answer

Security Policy matches High-level management statement establishing mandatory security goals; Security Standard matches Mandatory course of action or technical requirement establishing uniform compliance rules; Security Baseline matches Mandatory minimum security configuration required for a specific system; Security Guideline matches Discretionary recommendation providing advisory guidance.
Security Governance documents are categorized by scope and enforcement level: Policies set high-level executive intent, Standards dictate specific mandatory rules, Baselines enforce minimum system build configurations, and Guidelines offer discretionary advice.

Step-by-Step Solution

1
Identify the mandatory vs. discretionary nature of each document type.
Policies, Standards, and Baselines are mandatory, while Guidelines are discretionary (optional).
Guidelines serve as recommendations, whereas policies, standards, and baselines enforce compliance.
2
Differentiate high-level strategic intent from specific technical requirements.
Policy represents high-level organizational goals, Standard defines mandatory operational/technical rules, and Baseline specifies minimum system configuration levels.
Governance documents follow a hierarchical structure from general management direction down to technical implementation details.

Key Concept

Security Policy Hierarchy and Document Classification
Question 1357Question →

Following a third-party compliance audit that highlighted inconsistent multi-cloud storage configurations, an enterprise Chief Information Security Officer (CISO) publishes a high-level organizational mandate requiring all data at rest containing non-public personal information (NPI) to be protected with strong cryptographic controls. To translate this high-level directive into mandatory, non-negotiable operational requirements for deployment pipelines across all engineering units, the security governance committee drafts a document specifying exact encryption algorithms (AES-256), mandatory key rotation schedules (every 90 days), and rigid access control lists. Which document type in the security governance hierarchy is the committee publishing to establish these mandatory technical specifications?

Show answer & explanation

Answer: Security Standard

Answer

The security governance committee is publishing a Security Standard because standards provide mandatory, detailed technical requirements and specific operational configurations designed to enforce high-level policy directives.
In security governance, high-level policies state management intent, while Security Standards establish the mandatory, specific technical rules, algorithms, and configuration parameters required to achieve compliance across an enterprise. Specifying mandatory AES-256 encryption and rigid 90-day key rotation schedules directly aligns with the definition of a Security Standard.

Step-by-Step Solution

1
Analyze the organizational governance hierarchy levels present in the scenario.
Identified the CISO's overarching mandate as a Security Policy (high-level leadership directive).
Security policies define intent, scope, and objectives but omit low-level technical parameters.
2
Evaluate the nature of the requirement being drafted by the security steering committee.
The committee is establishing mandatory, specific technical parameters (AES-256, 90-day key rotation, ACL configurations).
The required document must be compulsory rather than advisory.
3
Map the technical parameters to the appropriate governance document layer.
Determined that mandatory technical criteria and compulsory minimum configurations define a Security Standard.
Standards bridge high-level policy directives with repeatable operational implementations.

Key Concept

Distinguishing Governance Document Hierarchy (Policy vs. Standard vs. Guideline vs. Procedure)
Estimated Time:1m 30s
Question 1358Question →

An enterprise security manager issues a document detailing the specific, mandatory step-by-step technical instructions that system administrators must execute when hardening a newly deployed Linux web server. Which type of security governance document has the manager published?

Show answer & explanation

Answer: Procedure

Answer

Procedure
Procedures are mandatory governance documents that establish detailed, step-by-step operational workflows for carrying out specific security tasks, such as server hardening.

Step-by-Step Solution

1
Identify key characteristics of the document in the scenario.
The document contains mandatory, sequential, step-by-step instructions for server hardening.
Governance document types are distinguished by their authority, detail level, and operational role.
2
Map the characteristics to the security governance document hierarchy.
Mandatory step-by-step operational workflows correspond directly to a procedure.
Procedures define the exact operational steps required to implement security standards and policies.

Key Concept

Security Governance Hierarchy and Documentation Types
Estimated Time:45s
Question 1359Question →

A systems administrator deploys a lightweight host-based agent across a fleet of Linux web servers to perform continuous vulnerability assessment. During an audit, the agent flags several critical local kernel vulnerabilities requiring remediation. However, a subsequent uncredentialed network-based vulnerability scan targeting the public IP addresses of these same web servers fails to detect any of the reported kernel flaws. Which of the following best explains why the network vulnerability scan missed these kernel vulnerabilities?

Show answer & explanation

Answer: Uncredentialed network scans analyze only network-accessible listening ports and service headers, lacking host-level privileges to inspect internal operating system kernel package manifests.

Answer

Uncredentialed network scans analyze only network-accessible listening ports and service headers, lacking host-level privileges to inspect internal operating system kernel package manifests.
Uncredentialed network scanners evaluate target hosts from the perspective of an external network observer. They discover open ports, protocols, and service banners. Because operating system kernel vulnerabilities reside inside the host OS and are rarely advertised over network sockets, an uncredentialed network scan cannot audit local package registers or kernel versions. By contrast, a credentialed host agent possesses local system privileges to directly inspect the installed software inventory and kernel build details.

Step-by-Step Solution

1
Analyze the scanning mechanisms described in the scenario.
Identified two scanning approaches: a credentialed/host-agent scan (inside view) and an uncredentialed network scan (outside view).
Different scan types operate with distinct privilege levels and visibility parameters.
2
Determine the visibility constraints of an uncredentialed network scan.
Uncredentialed network scans query open network ports, banners, and remote service protocol interactions without authenticating to the underlying operating system.
Kernel patch levels are internal system state properties that are not typically exposed via external service banners unless a specific exposed service explicitly advertises its host kernel.
3
Evaluate why the host agent successfully detected the flaw while the network scan did not.
The host agent has local administrative access to inspect installed software manifests, system binaries, and running kernel builds directly, enabling detailed vulnerability detection.
Host agents provide deep visibility into local patch state regardless of open network ports or perimeter controls.

Key Concept

Credentialed vs. Uncredentialed Vulnerability Scanning Visiblity
Question 1360Question →

A Security Operations Center (SOC) analyst is reviewing alerts generated by a SIEM correlation rule designed to flag potential credential harvesting activity. Within a five-minute window, a standard domain user workstation generated multiple instances of the following Windows Security Event log entry:

Event ID: 4769
Task Category: Kerberos Service Ticket Operations
TargetUserName: [email protected]
Service Name: MSSQLSvc/db01.contoso.com:1433
Ticket Options: 0x40810000
Ticket Encryption Type: 0x17
Failure Code: 0x0
Client Address: ::ffff:192.168.10.115

Based on this log telemetry, which of the following security events is occurring?

Show answer & explanation

Answer: A Kerberoasting attack requesting a service ticket with weak RC4 encryption to crack the service account password offline.

Answer

A Kerberoasting attack requesting a service ticket with weak RC4 encryption to crack the service account password offline.
The correct answer identifies a Kerberoasting attack. Windows Event ID 4769 logs when a Kerberos service ticket (TGS) is requested. A key indicator of Kerberoasting is a standard user requesting TGS tickets for accounts with registered Service Principal Names (SPNs) specifying weak encryption types such as RC4 (0x17). The attacker can extract the encrypted ticket payload from memory or network traffic and attempt to crack the service account's password offline.

Step-by-Step Solution

1
Analyze the Event ID and Service Name in the log snippet.
Event ID 4769 records Kerberos service ticket requests (TGS-REQ/TGS-REP) processed by Active Directory Domain Controllers.
Identifying the event type establishes that the activity relates to Kerberos ticket granting rather than application-layer network traffic.
2
Examine the Ticket Encryption Type field value (0x17).
Value 0x17 corresponds to legacy RC4-HMAC encryption.
Attackers specifically request service tickets with weak RC4 encryption because RC4 hashes are significantly easier to crack offline using password dictionary attacks compared to AES encryption (0x12).
3
Synthesize the event telemetry context.
Repeated requests from a standard user workstation for Service Principal Name (SPN) tickets using RC4 encryption indicates Kerberoasting.
Kerberoasting allows non-admin domain users to request TGS tickets for any account with a configured SPN and extract the password hash for offline brute-forcing.

Key Concept

Kerberoasting Detection via SIEM Log Analysis
Estimated Time:1m 30s
PreviousPage 68 / 112Next
All practice questions — CompTIA Security+ | Examkin