Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1361Question →

An enterprise security organization is restructuring its internal governance documentation to align with ISO/IEC 27001 and NIST SP 800-53 standards. Match each formal security governance document type to the specific operational characteristic and enforcement authority that defines its role in the security program.

Click a left item, then click its matching right item

Items

Security Policy
Security Standard
Security Baseline
Security Guideline

Matches

Show answer & explanation

Answer

Security Policy matches the high-level executive directive. Security Standard matches the mandatory technical specification. Security Baseline matches the minimum compulsory security configuration threshold. Security Guideline matches the discretionary operational advice.
Security Policies set high-level strategic direction from executive leadership; Security Standards define mandatory uniform technical controls; Security Baselines establish minimum system hardening configurations prior to deployment; and Security Guidelines provide advisory non-mandatory best practices.

Step-by-Step Solution

1
Evaluate the governance authority and enforceability spectrum
Categorize documents into executive management directives (Policies), mandatory technical requirements (Standards), minimum system build thresholds (Baselines), and advisory best practices (Guidelines).
Document types are differentiated primarily by their enforcement level and scope of applicability within the security hierarchy.
2
Differentiate mandatory technical requirements from configuration build benchmarks
Standards mandate specific technologies or processes enterprise-wide, whereas Baselines define the precise minimum operational configuration state for a specific asset class before deployment.
Confusing enterprise-wide technical rules with platform-specific system hardening benchmarks is a common operational error.
3
Distinguish compulsory controls from discretionary material
Guidelines are non-mandatory suggestions intended to assist staff, whereas policies, standards, and baselines carry explicit compliance requirements.
Audit enforcement applies strictly to mandatory governance elements.

Key Concept

Security Governance Document Hierarchy and Enforcement Mechanisms
Question 1362Question →

A Security Operations Center (SOC) analyst receives an automated alert from a network intrusion detection system (NIDS) flagging potential command-and-control (C2) beaconing activity from an internal workstation. Place the following incident triage and response steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with validating the NIDS alert using raw packet captures and flow logs, followed by isolating the compromised workstation, deploying custom firewall block rules for the C2 IP, and concluding with incident documentation and updating network monitoring baselines.
The standard network security monitoring triage flow requires validating the security alert with raw telemetry first to confirm true positive status. Once validated, containment actions such as host isolation are performed immediately to block active command-and-control communication. Following containment, preventive controls like firewall block rules are updated across the network perimeter. Finally, the analyst completes post-incident procedures by documenting findings and updating monitoring baselines.

Step-by-Step Solution

1
Validate the NIDS alert using raw network telemetry
Confirmed true positive C2 beaconing activity
Triage validation prevents taking intrusive containment measures on false alarms.
2
Isolate the host machine from the network
C2 communication severed and host network access contained
Immediate containment limits damage and prevents adversary lateral movement.
3
Apply firewall block rules based on extracted indicators
Perimeter network defenses updated with threat indicators
Prevents other internal hosts from communicating with the same external threat infrastructure.
4
Perform post-incident documentation and update detection rules
Network security monitoring baselines and detection logic refined
Ensures lessons learned are incorporated to prevent similar incidents and improve future response speed.

Key Concept

Incident triage and containment workflow for network security alerts
Question 1363Question →

During security monitoring of an enterprise cloud environment, an automated alert flags an unauthorized microservice container actively establishing encrypted outbound connections to an external command-and-control (C2) server. Security analysts verify that the container is compromised and holds active database connection tokens. According to standard incident response frameworks, which of the following actions should the security team perform FIRST?

Show answer & explanation

Answer: Apply network isolation rules to contain the compromised container and prevent lateral movement or data exfiltration.

Answer

Apply network isolation rules to contain the compromised container and prevent lateral movement or data exfiltration.
The correct action is to apply network isolation rules to contain the compromised container. Under standard incident response frameworks (NIST SP 800-61 / ISO 27035), once an incident is verified during detection and analysis, the immediate next step is containment to restrict attacker access, halt active exfiltration, and prevent lateral movement within the network.

Step-by-Step Solution

1
Identify the current phase of the Incident Response lifecycle.
The incident has been detected and verified, moving the response process into the Containment, Eradication, and Recovery phase.
Once an active breach is confirmed, immediate focus must shift to limiting the scope and impact of the incident.
2
Determine the mandatory initial action within the Containment phase.
Apply containment measures (such as network microsegmentation or isolation security group rules) to cut off C2 communication and stop lateral movement.
Containment prevents further data loss or damage while keeping the compromised artifact available for volatile memory capture or analysis.
3
Evaluate remaining actions against the IR lifecycle order.
Actions such as terminating workloads (eradication), redeploying clean builds (recovery), or running post-mortems (lessons learned) occur sequentially after containment.
Executing out-of-order steps exposes the organization to continued risk or destroys critical forensic evidence.

Key Concept

Incident Response Lifecycle Phase Order (Containment First)
Question 1364Question →

An enterprise system administrator identifies suspicious administrative tool execution on a human resources endpoint. EDR telemetry reports that an unauthorized process is actively attempting lateral movement across internal subnets using compromised domain credentials. Which of the following actions should the security engineer take FIRST using the EDR platform to stop the attack while maintaining investigation capabilities?

Show answer & explanation

Answer: Initiate host isolation on the affected endpoint through the EDR agent console

Answer

Initiate host isolation on the affected endpoint through the EDR agent console.
Executing network host isolation directly through the EDR console immediately disconnects the compromised endpoint from all internal network resources, neutralizing lateral movement while maintaining EDR agent connectivity for SOC analysis and forensic triage.

Step-by-Step Solution

1
Analyze the EDR behavioral alert
Identified active lateral movement attempts originating from the endpoint
Immediate containment is required to prevent compromise of adjacent systems on the internal network.
2
Select the appropriate EDR response action
Apply network host isolation via the EDR platform agent
Host isolation disables internal endpoint networking while maintaining the management control channel for security analysis.

Key Concept

Endpoint Containment and Host Isolation
Question 1365Question →

A security analyst is conducting live evidence acquisition on a compromised application server following a suspected data exfiltration attempt. The analyst needs to preserve network statistics, system RAM, swap space, and non-volatile storage while minimizing data alteration. According to the standard order of volatility, which of the following evidence types should the analyst acquire FIRST?

Show answer & explanation

Answer: Routing table and active network connections

Answer

Routing table and active network connections must be acquired first because they are the most volatile form of evidence listed.
In digital forensics, the order of volatility governs evidence collection sequence to prevent data loss. According to RFC 3227, highly dynamic system states—such as CPU registers, routing tables, ARP caches, kernel statistics, and active network connections—must be captured before secondary storage like swap space or local hard drives.

Step-by-Step Solution

1
Identify the volatility level of each evidence source listed in the scenario.
Network state (routing tables, open connections) is extremely fleeting, followed by physical RAM, swap space/temp files, non-volatile disk images, and remote archival logs.
The Order of Volatility principles dictate acquiring evidence starting from the most ephemeral (fastest changing) to the most persistent.
2
Compare the candidate options against the established order of volatility (RFC 3227).
Active network connections and routing tables rank higher in volatility than swap files, physical disk partitions, or remote log repositories.
Network states can disappear instantly if a network interface drops or a socket connection closes.

Key Concept

Order of Volatility in Digital Forensics
Question 1366Question →

A security engineer analyzing packet telemetry from an inline Network Intrusion Prevention System (NIPS) notices a high-priority alert triggered by inbound traffic directed at a public-facing web server. The alert details contain the following HTTP payload snippet:

`GET /catalog.php?item_id=105%27%20UNION%20SELECT%20null,username,password_hash%20FROM%20user_credentials--%20HTTP/1.1`
`Host: portal.example.com`

The engineer must select a targeted mitigation control that specifically blocks this attack payload while preserving uninterrupted HTTP/HTTPS access for legitimate users. Which of the following actions should the engineer take?

Show answer & explanation

Answer: Deploy a Web Application Firewall (WAF) rule to inspect layer 7 payload parameters and block requests containing SQL syntax tokens.

Answer

Deploying a Web Application Firewall (WAF) rule to inspect layer 7 parameters and block requests containing SQL syntax tokens effectively mitigates the SQL injection payload while keeping standard web services available.
The log snippet reveals a URL-encoded SQL injection string (`UNION SELECT ... FROM user_credentials`). Because SQL injection is an application-layer (Layer 7) vulnerability, a Web Application Firewall (WAF) is the appropriate control. A WAF inspects HTTP/HTTPS payload contents and parameter values to block malicious database query structures while allowing benign web traffic through.

Step-by-Step Solution

1
Analyze the NIPS log payload
Identified the URL-encoded payload `%27%20UNION%20SELECT%20null,username,password_hash%20FROM%20user_credentials--` as a classic SQL Injection (SQLi) attempt aimed at extracting database records.
Accurate alert classification is necessary to choose an effective mitigation strategy.
2
Evaluate control layer requirements
SQL injection attacks occur at Layer 7 (Application layer) inside standard HTTP request parameters.
Traditional network firewalls Operating at Layer 3/4 cannot inspect application payloads and would block all legitimate traffic if port-level blocks were applied.
3
Select the precise security control
A Web Application Firewall (WAF) operates at Layer 7 to inspect parameter values against signature patterns (such as `UNION SELECT`) and block malicious attempts without disrupting valid traffic.
WAF rules provide target-specific inline protection against web application attacks.

Key Concept

Layer 7 Network Security Monitoring and WAF Mitigation
Question 1367Question →

An organization discovers that an old standalone web server running a critical legacy service contains severe unpatchable vulnerabilities. To eliminate the threat of an external remote compromise entirely, the security team decides to shut down and permanently decommission the server without replacing its function. Which risk response strategy has the organization applied?

Show answer & explanation

Answer: Risk avoidance

Answer

Risk avoidance is the strategy applied when an organization completely eliminates exposure to a risk by discontinuing the associated activity or removing the risky asset entirely.
Risk avoidance entails altering plans or operational behavior to entirely remove the risk exposure. In this scenario, permanently shutting down and decommissioning the vulnerable legacy system prevents any possibility of that system being compromised.

Step-by-Step Solution

1
Analyze the action taken in the scenario
The organization permanently decommissions and shuts down the vulnerable server entirely.
Identifying the operational action determines whether risk is reduced, shared, tolerated, or completely eliminated.
2
Evaluate the risk outcome
The risk of remote exploitation for this asset becomes zero because the asset no longer exists on the network.
Total elimination of risk by refraining from or ceasing the risky activity corresponds precisely to risk avoidance.

Key Concept

Risk Response Strategies: Avoidance vs. Mitigation vs. Transfer vs. Acceptance
Question 1368Question →

A Security Operations Center (SOC) team is deploying an automated Security Orchestration, Automation, and Response (SOAR) playbook to address high-risk suspicious email reports. To prevent accidental disruption to critical business communications while ensuring rapid response, the automated response workflow must follow strict SOC governance standards spanning ingest, threat intelligence enrichment, analyst review, containment, and post-incident cleanup. In what sequence should the SOAR playbook execute these operational steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order begins with alert payload ingestion and IOC parsing, followed by automated threat intelligence enrichment, triggering a Human-in-the-Loop (HITL) approval gate, executing automated host isolation and token revocation upon authorization, and concluding with perimeter blocklist updates and case closure.
In SOAR playbook architecture, incident response follows a structured sequence: initial data ingestion and IOC extraction, automated threat intelligence lookup, decision governance via Human-in-the-Loop (HITL) verification for high-impact remediations, automated execution of containment scripts, and final documentation with blocklist propagation.

Step-by-Step Solution

1
Parse input payload
Extracted URLs, domain names, and email headers ready for automated processing.
Automation workflows require structured data inputs before external API integrations can be invoked.
2
Enrich indicators using threat intelligence tools
Aggregated threat scores and reputation analysis metrics.
Enrichment provides the necessary contextual data to evaluate severity before decision-making.
3
Execute Human-in-the-Loop (HITL) authorization step
Analyst confirmation or rejection of the proposed mitigation actions.
High-impact containment actions require human oversight to prevent operational downtime on critical enterprise accounts.
4
Enforce endpoint containment and credential revocation
Host network isolation and invalidated active authentication tokens.
Approved remediation tasks stop active session abuse and lateral movement across the network.
5
Finalize incident documentation and feed defensive perimeter controls
Updated SIEM entries, synchronized firewall blocklists, and resolved SOAR tickets.
Final documentation ensures audit compliance and prevents repeat attacks across the enterprise edge.

Key Concept

SOAR Playbook Execution Lifecycle and Governance
Question 1369Question →

A Security Operations Center (SOC) analyst receives an automated high-severity SIEM alert indicating suspicious outbound traffic from an internal database server containing sensitive customer records to an unknown external IP address over port 443. The analyst must follow network security monitoring and initial incident response procedures. In what chronological sequence should the analyst execute the following triage and containment actions?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of actions begins with analyzing NetFlow records and SIEM log correlations, followed by inspecting NIDS alerts and full packet captures (PCAP), then applying network isolation controls to the database host, and finally updating perimeter firewall rules to block the external destination IP address.
The triage process follows a logical sequence from high-level flow verification to payload inspection, host isolation, and perimeter defense. Flow telemetry (NetFlow/SIEM) is evaluated first to confirm the alert boundaries. NIDS alerts and PCAP files are then examined to identify IoCs and malicious payloads. Next, host containment stops active data exfiltration while preserving volatile evidence. Finally, blocking the external malicious IP at the perimeter safeguards the broader enterprise architecture.

Step-by-Step Solution

1
Analyze NetFlow records and SIEM log correlations
Establishes baseline traffic metrics and verifies anomalous session characteristics.
Initial triage requires confirming session duration, flow volume, and endpoints before launching detailed analysis.
2
Inspect NIDS alerts and full packet captures (PCAP)
Extracts protocol payload details, certificate info, and threat signatures.
Detailed packet inspection provides context on the attack payload and identifies actionable indicators of compromise.
3
Apply network isolation controls to the affected database host
Halts ongoing exfiltration from the compromised system while preserving forensic artifacts in memory.
Host containment must occur immediately once a compromise is confirmed to prevent further unauthorized data access.
4
Update perimeter firewall rules to block the external destination IP address
Prevents potential lateral exfiltration attempts from other enterprise hosts to the malicious destination.
System-wide perimeter blocking ensures enterprise defense after containing the immediate host threat.

Key Concept

Incident Response and Triage Workflow in Network Security Monitoring
Question 1370Question →

A security architect is designing an authentication and authorization framework for a newly developed microservices-based web application. The architectural design requires a lightweight, stateless mechanism to securely transport identity claims and delegated authorization scopes between independent API endpoints without maintaining server-side session state or performing repeated directory database lookups for each call. Which of the following IAM standards should the architect implement?

Show answer & explanation

Answer: OpenID Connect (OIDC) combined with OAuth 2.0 using JSON Web Tokens (JWT)

Answer

The architect should implement OpenID Connect (OIDC) combined with OAuth 2.0 using JSON Web Tokens (JWT).
OpenID Connect (OIDC) built on top of OAuth 2.0 issues JSON Web Tokens (JWT) containing cryptographically signed claims and scopes. Microservices can independently verify these lightweight tokens using public key cryptography, eliminating the need to maintain server session state or query a central database for every API request.

Step-by-Step Solution

1
Analyze the microservices requirement for stateless identity and authorization propagation.
Identified the need for self-contained, digitally signed tokens that carry claims without requiring server-side session lookup databases.
Microservice architectures scale best when services do not maintain centralized session state.
2
Evaluate candidate protocols against REST/API performance and statelessness criteria.
OAuth 2.0 provides delegated authorization, OIDC adds an identity layer, and JWT provides lightweight JSON payload structures ideal for HTTP headers.
JSON Web Tokens can be validated independently by microservices using public key cryptography without calling back to the identity provider.

Key Concept

Stateless API Authentication and Authorization via OIDC/OAuth 2.0 JWTs
Estimated Time:1m 30s
Question 1371Question →

A security operations team is deploying a enterprise cloud application integrated with an internal Identity Provider (IdP) using SAML 2.0. Arrange the operational steps of a Service Provider-initiated (SP-initiated) Single Sign-On (SSO) authentication sequence in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence for SP-initiated SAML 2.0 SSO is: 1) Initial resource request to the SP, 2) Redirection with SAML AuthnRequest to the IdP, 3) User authentication at the IdP, 4) Redirection with signed SAML Assertion back to SP's ACS, and 5) Signature validation and session creation by the SP.
In SAML 2.0 SP-initiated Single Sign-On, the sequence begins with an unauthenticated request to the Service Provider. The SP redirects the user's browser with a SAML AuthnRequest to the Identity Provider. Next, the user authenticates directly at the IdP. Upon successful authentication, the IdP redirects the user back to the SP's Assertion Consumer Service (ACS) endpoint with a signed SAML Assertion containing identity attributes. Finally, the SP verifies the assertion signature and establishes the user session.

Step-by-Step Solution

1
Identify the entry point of the SP-initiated authentication workflow.
The user initiates contact by requesting access directly at the Service Provider application.
In SP-initiated SSO, the flow starts at the resource provider, unlike IdP-initiated SSO where the user visits the IdP portal first.
2
Determine how the Service Provider directs the user to the authentication authority.
The SP issues an HTTP redirect containing a SAML AuthnRequest targeted at the IdP SSO URL.
The SP cannot authenticate the user locally, so it delegates identity verification by redirecting the client browser.
3
Trace the primary authentication event at the Identity Provider.
The user supplies primary credentials and completes mandatory MFA challenges at the IdP portal.
Authentication occurs strictly between the user browser and the IdP, ensuring credentials are never exposed to the SP.
4
Trace the return path of identity claims to the Service Provider.
The IdP redirects the browser to the SP's Assertion Consumer Service (ACS) with a signed SAML Response assertion.
The SAML assertion serves as cryptographically verifiable proof that the user successfully authenticated at the IdP.
5
Finalize session establishment and access authorization.
The SP validates the digital signature using the IdP's public key certificate and logs the user into the local application context.
Verifying the signature ensures the assertion came from a trusted IdP and was not altered during transit by a man-in-the-middle.

Key Concept

SAML 2.0 SP-Initiated Authentication Flow
Question 1372Question →

A cloud-native enterprise operates a core microservices infrastructure valued at 4,000,0004,000,000. Threat intelligence data indicates that a catastrophic ransomware compromise occurs once every 55 years (ARO=0.20\text{ARO} = 0.20), resulting in a 40%40\% operational loss per incident (EF=0.40\text{EF} = 0.40). The Chief Information Security Officer (CISO) is evaluating an automated endpoint detection and response (EDR) platform costing 60,00060,000 annually. If deployed, the EDR solution will mitigate the incident impact, reducing the Exposure Factor to 5%5\% (EF=0.05\text{EF} = 0.05) while the occurrence rate remains unchanged. Based on quantitative risk assessment principles, what is the net annual financial benefit of implementing the proposed EDR platform?

Show answer & explanation

Answer: $220,000

Answer

The net annual financial benefit of implementing the EDR platform is 220,000220,000.
The correct answer demonstrates proper quantitative risk analysis by computing baseline ALE (320,000320,000), residual ALE (40,00040,000), total loss avoided (280,000280,000), and subtracting the control's annual maintenance cost (60,00060,000) to confirm a net benefit of 220,000220,000.

Step-by-Step Solution

1
Calculate the current Single Loss Expectancy (SLE) and Annual Loss Expectancy (ALE) prior to control implementation.
SLEinitial=AV×EFinitial=$4,000,000×0.40=$1,600,000\text{SLE}_{\text{initial}} = \text{AV} \times \text{EF}_{\text{initial}} = \$4,000,000 \times 0.40 = \$1,600,000. ALEinitial=SLEinitial×ARO=$1,600,000×0.20=$320,000\text{ALE}_{\text{initial}} = \text{SLE}_{\text{initial}} \times \text{ARO} = \$1,600,000 \times 0.20 = \$320,000.
Establishing baseline annual risk cost requires determining expected annual loss prior to mitigation.
2
Calculate the modified SLE and ALE following EDR safeguard deployment.
SLEmitigated=$4,000,000×0.05=$200,000\text{SLE}_{\text{mitigated}} = \$4,000,000 \times 0.05 = \$200,000. ALEmitigated=$200,000×0.20=$40,000\text{ALE}_{\text{mitigated}} = \$200,000 \times 0.20 = \$40,000.
Quantifying residual risk requires evaluating modified exposure factors under control protection.
3
Calculate the total annual loss reduction (ALE avoided).
ALEavoided=ALEinitial−ALEmitigated=$320,000−$40,000=$280,000\text{ALE}_{\text{avoided}} = \text{ALE}_{\text{initial}} - \text{ALE}_{\text{mitigated}} = \$320,000 - \$40,000 = \$280,000.
Determining gross risk reduction isolates the financial risk transferred or avoided by the security control.
4
Subtract the annual cost of the safeguard control to determine net annual benefit.
Net Benefit=ALEavoided−Annual Control Cost=$280,000−$60,000=$220,000\text{Net Benefit} = \text{ALE}_{\text{avoided}} - \text{Annual Control Cost} = \$280,000 - \$60,000 = \$220,000.
A safeguard is cost-effective only when loss reduction exceeds annual operational and licensing expenses.

Key Concept

Quantitative Risk Assessment and Safeguard Cost-Benefit Analysis (ALE = AV * EF * ARO)
Estimated Time:2m 30s
Question 1373Question →

A Security Operations Center (SOC) analyst receives a high-severity alert from an enterprise Endpoint Detection and Response (EDR) platform. Telemetry indicates an unprivileged user account initiated a obfuscated command execution that attempted process injection into `lsass.exe` and established an encrypted outbound connection to an untrusted external IP address. Which TWO of the following actions represent capabilities native to an EDR solution that the analyst should execute to contain the threat and facilitate analysis?

Select all that apply

Show answer & explanation

Answer: Apply host network isolation through the EDR agent software to sever attacker communication while maintaining management console connectivity.; Issue a remote live response command via the EDR console to dump volatile RAM contents and terminate the malicious parent process tree.

Answer

The analyst should isolate the host via the EDR agent console and execute a remote live response action to dump volatile memory and kill the malicious process tree.
Host network isolation directly through the EDR console stops malicious communication while preserving management control, and remote live response tools enable analysts to capture volatile memory and terminate running processes on the target host.

Step-by-Step Solution

1
Identify EDR containment capabilities.
Host isolation via the EDR agent restricts host network traffic to only the EDR management channel, neutralizing network activity without disabling endpoint telemetry.
Prevents lateral movement and remote C2 without taking the host offline completely from the security team.
2
Identify EDR live response and forensic capabilities.
EDR consoles permit remote execution of administrative scripts to dump memory for forensic capture and kill process trees executing injected code.
Allows immediate threat eradication and forensic collection directly on the endpoint.

Key Concept

EDR Host Containment and Live Response Features
Estimated Time:1m 30s
Question 1374Question →

A security technician is deploying monitoring sensors across an enterprise network. Which of the following statements correctly describe the features and operational behavior of a passive Network Intrusion Detection System (NIDS)? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: It analyzes mirrored network traffic from a switch port without introducing latency to live network packets.; It generates security alerts upon detecting signature matches but does not actively stop or alter packets in transit.

Answer

The correct options state that a passive Network Intrusion Detection System (NIDS) analyzes mirrored network traffic without introducing latency to live packets and generates security alerts without actively stopping or altering traffic in transit.
A passive Network Intrusion Detection System (NIDS) operates out-of-band by analyzing duplicated network traffic (such as traffic provided by SPAN ports or network TAPs). Because it processes copies of packets out-of-band, it does not add latency to production traffic flows and acts as a detective control by generating alerts when malicious signatures are matched, without interrupting packet transit.

Step-by-Step Solution

1
Identify the operational placement of a passive Network Intrusion Detection System (NIDS).
A passive NIDS is deployed out-of-band, receiving duplicated traffic from TAP or SPAN/mirror ports.
Out-of-band deployment ensures that monitoring activities do not add latency to active network communications.
2
Determine the control function and capabilities of a passive monitoring solution.
Passive NIDS devices act as detective controls by analyzing traffic against known signature sets and alerting administrators.
Since the NIDS receives copied packets out-of-band, it lacks inline capability to modify or drop malicious network traffic directly.

Key Concept

Passive Out-of-Band Network Intrusion Detection
Question 1375Question →

A security technician is documenting the standard patch deployment workflow for enterprise operating systems. Place the following stages of the patch management lifecycle in the correct order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the patch management lifecycle is: 1. Identify and assess newly released vendor patches -> 2. Test the patch in a staging environment -> 3. Submit the patch deployment plan to the Change Advisory Board (CAB) -> 4. Deploy the patch to production systems -> 5. Perform post-installation auditing.
The standard patch management process follows a structured lifecycle: identification of updates, non-production testing, change management authorization, controlled production deployment, and post-deployment validation auditing.

Step-by-Step Solution

1
Identify available patches
Discovers vendor updates requiring evaluation.
Security operations must monitor vendor advisories and assess patch severity before taking operational action.
2
Perform staging and testing
Confirms patch compatibility without affecting live systems.
Testing ensures updates do not cause system crashes or application conflicts.
3
Request change authorization
Obtains formal CAB review and approval.
Change management governance mandates documentation and risk review prior to production modification.
4
Execute production deployment
Installs patches on production assets.
Deployment must occur during scheduled maintenance windows to minimize business impact.
5
Conduct post-patch verification and auditing
Confirms compliance and closure of vulnerability.
Auditing verifies that installation succeeded and configuration baselines remain secure.

Key Concept

Standard Patch Management Lifecycle Workflow
Question 1376Question →

A security analyst reviews a network security monitoring alert generated by a Network Intrusion Detection System (NIDS). The alert log highlights the following HTTP GET parameter string:

`GET /login.php?username=admin'%20OR%20'1'='1'-- HTTP/1.1`

Which of the following best identifies the type of malicious activity captured in this alert?

Show answer & explanation

Answer: SQL injection attempt designed to bypass database authentication logic

Answer

SQL injection attempt designed to bypass database authentication logic
The URL-decoded string `admin' OR '1'='1'--` is a classic SQL injection payload. Attackers inject single quotes, boolean tautologies (like `'1'='1'`), and SQL comment flags (`--`) to force the backend database query to return true, bypassing authentication controls.

Step-by-Step Solution

1
Analyze the HTTP GET request parameter string in the NIDS alert log.
Identified the payload string: username=admin'%20OR%20'1'='1'--
URL-decoded payload represents admin' OR '1'='1'--, which manipulates SQL query logic.
2
Evaluate the attack vector and security monitoring classification.
Matches SQL injection (SQLi) syntax targeting the application backend database.
SQLi uses single quotes, boolean OR statements, and comment characters to alter backend database behavior.

Key Concept

Identifying SQL Injection Indicators in Network Security Alerts
Question 1377Question →

During an on-site physical security review of a remote branch office, a security analyst discovers an unauthorized rogue wireless access point plugged into an active wall jack. The rogue device is actively broadcasting a duplicate corporate SSID to intercept wireless client credentials. Following standard incident response playbooks, which of the following immediate containment actions should the incident response team perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Disable the specific network switch port where the rogue access point is physically attached.; Apply a quarantine access control list (ACL) to isolate traffic from the affected network segment.; Re-image the enterprise core switch operating system to remove potential malicious persistence.; Clear the switch MAC address table and volatile system logs to reset network state.

Answer

The correct containment actions are disabling the connected switch port and applying a quarantine ACL to isolate traffic from the affected segment.
Disabling the physical switch port immediately blocks the rogue access point from transmitting data across the wired enterprise network. Concurrently, applying a quarantine access control list (ACL) isolates traffic on the affected segment, preventing unauthorized lateral movement. Both steps fulfill containment objectives by isolating the threat without destroying evidence.

Step-by-Step Solution

1
Identify the primary operational objective of the containment phase in incident response.
The containment phase focuses on limiting the scope and impact of an incident without destroying forensic evidence.
Containment prevents threat expansion while allowing responders time to collect volatile evidence and plan eradication.
2
Evaluate actions that immediately restrict rogue access point network traffic.
Disabling the switch port cuts off network connectivity at the access layer, and applying a quarantine ACL prevents lateral movement on the segment.
Both measures effectively isolate the threat without altering evidence on the rogue hardware or erasing infrastructure logs.
3
Differentiate containment phase actions from premature eradication or destructive evidentiary steps.
Re-imaging switch firmware belongs in the eradication phase, while clearing volatile system logs violates evidence preservation principles.
Proper lifecycle execution ensures evidence integrity and prevents operational disruption prior to full investigation.

Key Concept

Incident Response Containment Phase for Physical Security Incidents
Estimated Time:1m 30s
Question 1378Question →

An organization relies on an Operational Technology (OT) supervisory control and data acquisition (SCADA) system valued at $2,500,000\$2,500,000. Historical threat assessments indicate that an unmitigated industrial ransomware attack has an Exposure Factor (EF) of 60%60\% (0.600.60) and an Annualized Rate of Occurrence (ARO) of 0.200.20 (11 event every 55 years).

To mitigate this risk, the security team proposes deploying an immutable network air-gap and anomaly monitoring safeguard with an annual operating cost of $65,000\$65,000. With this safeguard active, the EF is reduced to 10%10\% (0.100.10) and the ARO is reduced to 0.050.05 (11 event every 2020 years).

What is the net annual cost savings (in USD) achieved by implementing this safeguard?

Show answer & explanation

Answer: 222500

Answer

The net annual cost savings realized by implementing the safeguard is $222,500 USD.
Quantitative risk management evaluates security controls by comparing the annual loss expectancy (ALE) reduction against the control's total annual cost. Pre-mitigation ALE is calculated as AV×EF1×ARO1=$2,500,000×0.60×0.20=$300,000\text{AV} \times \text{EF}_{1} \times \text{ARO}_{1} = \$2,500,000 \times 0.60 \times 0.20 = \$300,000. Post-mitigation ALE is AV×EF2×ARO2=$2,500,000×0.10×0.05=$12,500\text{AV} \times \text{EF}_{2} \times \text{ARO}_{2} = \$2,500,000 \times 0.10 \times 0.05 = \$12,500. The risk reduction benefit is $300,000−$12,500=$287,500\$300,000 - \$12,500 = \$287,500. Subtracting the annual safeguard maintenance fee of $65,000\$65,000 yields a net annual value of $222,500\$222,500.

Step-by-Step Solution

1
Calculate pre-mitigation ALE
Initial ALE = $300,000
Determines the baseline expected financial loss per year before control implementation using ALE = AV * EF * ARO.
2
Calculate post-mitigation ALE
Mitigated ALE = $12,500
Calculates the residual annual expected loss after applying the reduced EF (10%) and reduced ARO (0.05).
3
Calculate gross risk reduction benefit
Gross ALE reduction = $287,500
Subtracts post-mitigation ALE from pre-mitigation ALE to measure total annual loss prevented.
4
Calculate net financial benefit of safeguard
Net annual savings = $222,500
Subtracts the recurring annual cost of the safeguard ($65,000) from the gross ALE reduction.

Key Concept

Quantitative Risk Analysis (ALE calculation and Safeguard Cost-Benefit Evaluation)
Question 1379Question →

Security telemetry on a corporate workstation detects a suspicious living-off-the-land binary attempting to dump process memory and establish outbound command-and-control communication. Which feature of an Endpoint Detection and Response (EDR) agent should be executed FIRST to prevent potential lateral movement while preserving remote investigation capabilities?

Show answer & explanation

Answer: Apply host network isolation via the EDR agent console

Answer

Apply host network isolation via the EDR agent console
Host network isolation restricts all network traffic on the endpoint except for encrypted communication between the EDR agent and the management console. This effectively stops lateral movement and outbound command-and-control channels without interrupting live response triage capabilities.

Step-by-Step Solution

1
Analyze the security alert requirements.
The goal is to stop lateral movement and command-and-control traffic immediately while maintaining remote administrative access for triage.
Threat containment must prioritize stopping attack propagation without losing live analysis capabilities.
2
Evaluate EDR endpoint isolation capabilities.
EDR host isolation drops non-essential inbound and outbound traffic at the endpoint agent level while keeping the EDR control plane active.
This provides containment while preserving volatile memory and analyst access.

Key Concept

EDR Host Isolation and Incident Containment
Question 1380Question →

An enterprise security manager is reviewing the risk register for an unpatchable legacy portal hosting sensitive customer records. To address the vulnerability, the organization decides to decommission the portal entirely and transition users to an enterprise platform. Additionally, to mitigate residual financial risk during the data migration phase, the organization purchases a cybersecurity liability policy. Which of the following risk response strategies are being directly implemented in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Risk Avoidance, by completely taking the vulnerable legacy portal out of service; Risk Transference, by purchasing a cybersecurity liability insurance policy

Answer

The correct responses are Risk Avoidance (by decommissioning the legacy portal) and Risk Transference (by purchasing cybersecurity liability insurance).
Decommissioning the unpatchable system removes the exposure completely, satisfying Risk Avoidance. Securing an insurance policy transfers the monetary risk of residual data breach losses to an insurance vendor, satisfying Risk Transference.

Step-by-Step Solution

1
Analyze the action of decommissioning the unpatchable legacy portal.
Completely removing the system eliminates the activity and asset exposure driving the risk, matching Risk Avoidance.
Risk avoidance entails eliminating the exposure or shutting down the risk-bearing process entirely.
2
Analyze the action of purchasing a cybersecurity liability policy.
Purchasing insurance shifts the financial burden of potential breach losses to an insurer, matching Risk Transference.
Risk transference delegates financial responsibility or liability to a third party.

Key Concept

Risk Response Strategies (Avoidance vs. Transference)
PreviousPage 69 / 112Next