All practice questions

378 questions

Question 121Question

Match each observed network or wireless attack indicator on the left with its corresponding attack classification on the right.

Click a left item, then click its matching right item

Items

A rogue access point broadcasting the exact SSID of a corporate network to trick users into connecting
Excessive radio frequency signal noise causing high packet loss and sudden loss of wireless connectivity across a floor
A flood of spoofed 802.11 management frames instructing wireless client devices to disconnect from the network
Unsolicited Layer 2 responses associating the default gateway's IP address with an unauthorized MAC address

Matches

Show answer & explanation

Answer

Rogue access point mimicking SSID matches Evil Twin; RF signal noise causing connectivity loss matches RF Jamming; Spoofed 802.11 management frames match Deauthentication Attack; Unsolicited Layer 2 responses matching gateway IP to unauthorized MAC matches ARP Poisoning.
Each indicator matches its respective attack mechanism directly: broadcasting a duplicate enterprise SSID represents an Evil Twin; physical RF spectrum noise represents RF Jamming; sending disassociation management packets represents a Deauthentication attack; and distributing forged IP-to-MAC mappings represents ARP Poisoning.

Step-by-Step Solution

1
Analyze each network or wireless attack indicator in the left column.
Identify key characteristics: SSID spoofing, physical radio interference, 802.11 disassociation/deauthentication frames, and unsolicited MAC-to-IP cache updates.
Matching indicators requires recognizing the fundamental technical mechanism associated with each threat.
2
Pair each indicator with its respective threat classification.
Correlate rogue SSID broadcasting to Evil Twin, RF noise to RF Jamming, disconnect frames to Deauthentication, and ARP cache corruption to ARP Poisoning.
Each security threat leaves distinct Layer 1, Layer 2, or Layer 3 artifacts.

Key Concept

Network and Wireless Attack Indicators
Question 122Question

A security analyst is reviewing the security architecture for a hybrid cloud deployment containing both virtual machines and containerized applications. Match each security mechanism on the left with its primary isolation property on the right.

Click a left item, then click its matching right item

Items

Kernel Namespaces
Control Groups (cgroups)
Type 1 Hypervisor
Microsegmentation

Matches

Show answer & explanation

Answer

Kernel Namespaces match process-level visibility segregation within a shared OS kernel. Control Groups (cgroups) match restricting hardware resource consumption. Type 1 Hypervisor matches abstracting physical hardware for strong VM isolation. Microsegmentation matches enforcing granular network traffic control and boundaries.
Kernel namespaces isolate what processes can see (PIDs, network adapters, filesystems). Control groups (cgroups) control how much host hardware resources a container can use. Type 1 hypervisors run directly on hardware to deliver rigid virtual machine isolation. Microsegmentation creates micro-perimeters around workloads to control east-west network traffic.

Step-by-Step Solution

1
Analyze container OS kernel isolation constructs.
Linux kernel namespaces isolate process visibility (e.g., PID space, mount points), while control groups (cgroups) govern resource usage constraints like CPU and memory limits.
Distinguishing between resource visibility isolation and resource consumption limiting is fundamental to container host hardening.
2
Evaluate hypervisor virtual machine abstraction capabilities.
A Type 1 bare-metal hypervisor mediates guest operating system interactions directly on hardware, creating strong isolation boundaries that prevent inter-VM compromises.
Virtual machines run discrete guest kernels, providing stronger containment than shared-kernel container architectures.
3
Identify network security mechanisms for virtualized environments.
Microsegmentation implements policy-driven network access controls around individual microservices or VMs to restrict east-west lateral traffic.
Network-level isolation complements host-level container and hypervisor execution boundaries.

Key Concept

Virtualization and Container Isolation Mechanisms
Question 123Question

Match each observed security incident technical indicator on the left with its corresponding malware classification on the right.

Click a left item, then click its matching right item

Items

A scheduled task executing an obfuscated script creates an unauthorized persistent administrator account.
Direct Kernel Object Manipulation (DKOM) modifies active operating system data structures to conceal running processes.
Automated network sweeps over TCP port 445 exploit SMB vulnerabilities to self-replicate payload code to adjacent hosts.
A dormant script executes a malicious routine only when a target enterprise database table exceeds 100,000 records.

Matches

Show answer & explanation

Answer

The scheduled task creating persistent access matches Trojan; kernel memory manipulation to hide processes matches Rootkit; automated port 445 network propagation matches Worm; and environmental trigger execution matches Logic Bomb.
Each indicator aligns with a distinct technical behavior: kernel cloaking via DKOM signifies a Rootkit; autonomous network scanning and SMB exploitation signifies a Worm; pre-configured conditional triggering signifies a Logic Bomb; and hidden persistence via routine operating system utilities signifies a Trojan.

Step-by-Step Solution

1
Analyze item 1 regarding scheduled task obfuscated scripts creating unauthorized accounts.
Identified as a Trojan.
Trojans masquerade as or leverage legitimate functionality to secretly introduce unauthorized capabilities.
2
Analyze item 2 regarding Direct Kernel Object Manipulation (DKOM).
Identified as a Rootkit.
Rootkits operate at kernel privilege levels to alter system structures and mask processes.
3
Analyze item 3 regarding port 445 scanning and self-replication.
Identified as a Worm.
Worms propagate autonomously across network vulnerabilities without requiring user action.
4
Analyze item 4 regarding execution dependent on database record thresholds.
Identified as a Logic Bomb.
Logic bombs trigger malicious execution based on specific operational or logical events.

Key Concept

Distinguishing technical indicators of compromise across fundamental malware classifications.
Question 124Question

An enterprise security architect is refining the workload protection matrix for a multi-tenant cloud environment hosting both legacy virtualized infrastructure and microservice containers. Match each virtualization or containerization security control on the left to its corresponding isolation property or policy enforcement mechanism on the right.

Click a left item, then click its matching right item

Items

Control Groups (cgroups)
Linux Namespaces
Type-1 Hypervisor Isolation
CNI Microsegmentation

Matches

Show answer & explanation

Answer

Control Groups (cgroups) matches with enforcing resource utilization quotas; Linux Namespaces matches with providing segregated operational views of system resources; Type-1 Hypervisor Isolation matches with providing dedicated hardware-enforced abstraction directly on physical host processors; CNI Microsegmentation matches with implementing granular packet filtering rules at the virtual network layer.
Each security control aligns directly with its primary system level: cgroups manage hardware resource quotas (CPU/RAM/IO), namespaces isolate kernel object visibility (PID/NET/MNT), Type-1 hypervisors manage bare-metal hardware abstraction for full VM execution isolation, and CNI microsegmentation manages granular software-defined network traffic controls across pods.

Step-by-Step Solution

1
Analyze resource governing mechanisms for OS-level virtualization.
Control Groups (cgroups) strictly manage resource boundaries such as CPU limits, memory quotas, and block I/O rates to stop noisy-neighbor resource exhaustion.
cgroups provide hardware resource allocation control rather than structural visibility isolation.
2
Evaluate process and environment isolation primitives in container engines.
Linux Namespaces provide discrete visibility domains (PID, NET, IPC, MNT, UTS, USER) preventing one container from inspecting or interacting with system objects of another.
Namespaces abstract what a process can see rather than limiting how much CPU or RAM it consumes.
3
Examine hypervisor architectural models and hardware separation boundaries.
Type-1 (bare-metal) hypervisors run directly on underlying physical hardware host chips to enforce VM memory and CPU execution isolation without depending on a general-purpose host OS.
This establishes hardware ring isolation distinct from container kernel-sharing.
4
Determine modern network isolation methods within container orchestration systems.
CNI Microsegmentation utilizes eBPF or iptables at the virtual interface layer to enforce Zero Trust security rules on East-West traffic between container endpoints.
Microsegmentation protects pod-to-pod network pathways rather than host compute resources.

Key Concept

Virtualization and Containerization Security Mechanisms
Question 125Question

Match each storage security mechanism or state to its corresponding enterprise data protection objective.

Click a left item, then click its matching right item

Items

Data Masking
Data in Transit Protection
Cryptographic Erasure
SAN Isolation

Matches

Show answer & explanation

Answer

Data Masking pairs with replacing sensitive dataset values with realistic structural proxies for development environments; Data in Transit Protection pairs with securing data traversing network links between host servers and storage arrays using TLS or IPSec; Cryptographic Erasure pairs with sanitizing retired media by destroying encryption keys; SAN Isolation pairs with restricting logical storage volume access using Fibre Channel zoning and LUN masking.
The correct matches align each security mechanism with its explicit implementation objective: Data Masking replaces sensitive values for test environments; Data in Transit Protection encrypts network pathways between hosts and arrays using protocols like TLS/IPSec; Cryptographic Erasure sanitizes media by destroying encryption keys; SAN Isolation isolates storage volumes to authorized host systems using LUN masking and Fibre Channel zoning.

Step-by-Step Solution

1
Analyze each storage security concept listed on the left.
Identified four key concepts: Data Masking (obfuscation), Data in Transit Protection (network transport security), Cryptographic Erasure (media sanitization), and SAN Isolation (storage network access control).
Understanding the core functional domain of each storage security control is required to pair it correctly.
2
Correlate each control with its technical implementation objective listed on the right.
Data Masking correlates to proxy values for testing; Data in Transit to TLS/IPSec network encryption; Cryptographic Erasure to key destruction; SAN Isolation to Fibre Channel zoning and LUN masking.
These associations accurately reflect standard enterprise storage security architecture practices.

Key Concept

Data Protection and Storage Security Architecture Controls
Question 126Question

An enterprise systems administrator is performing a security posture review of host operating systems, network services, and infrastructure hardware. Match each host, network, or architecture vulnerability to its corresponding primary risk or operational impact.

Click a left item, then click its matching right item

Items

Resource Exhaustion via Memory Leak
Unsupported or End-of-Life (EOL) Host System
Unnecessary Open Ports and Unused Services
Out-of-Band Management Controller Misconfiguration

Matches

Show answer & explanation

Answer

Resource Exhaustion via Memory Leak matches with RAM continuously allocated without release causing instability; Unsupported/EOL Host System matches with security patches no longer provided by the vendor; Unnecessary Open Ports matches with active listening daemons running without requirement broadening attack surface; Out-of-Band Controller Misconfiguration matches with default credentials and unencrypted protocols enabled on hardware interfaces.
Each vulnerability directly pairs with its core operational impact: memory leaks exhaust host system memory; end-of-life status deprives systems of vendor updates; unnecessary listening ports expand the host attack surface; and out-of-band management misconfigurations expose hardware interfaces through weak access controls.

Step-by-Step Solution

1
Analyze host resource management failure indicators.
Identify that progressive, unreleased RAM usage leading to application crash defines a memory leak resource exhaustion condition.
Software that fails to clean up allocated memory consumes finite system memory pools over time.
2
Evaluate lifecycle security risks for legacy host operating systems.
Determine that end-of-life systems lack vendor patch support, leaving exposed flaws unmitigated.
When software reaches end-of-life status, vendor engineering teams cease issuing security advisories and security updates.
3
Examine host attack surface management concepts.
Recognize that running unnecessary services leaves open ports active, expanding host exposure.
Disabling unused services and closing unneeded ports is a fundamental host-hardening practice to minimize entry vectors.
4
Assess hardware infrastructure management vulnerabilities.
Associate out-of-band management controllers with default credential and unencrypted access weaknesses.
Baseboard management controllers operate independently of host operating systems and require strict access controls.

Key Concept

Host, Network, and Architecture Vulnerabilities
Estimated Time:1m 30s
Question 127Question

To enforce defense-in-depth across a multi-tenant cloud infrastructure hosting both virtual machines and container workloads, a platform security engineer must align security mechanisms with their specific operational boundaries. Match each virtualization or containerization technology on the left with its primary isolation boundary or resource control capability on the right.

Click a left item, then click its matching right item

Items

Linux Namespaces
Control Groups (cgroups)
Type-1 Bare-Metal Hypervisor
Kernel-level Security Modules (e.g., AppArmor / SELinux)

Matches

Show answer & explanation

Answer

Linux Namespaces matches with partitioning system resources; Control Groups (cgroups) matches with limiting hardware consumption; Type-1 Bare-Metal Hypervisor matches with enforcing hardware-assisted ring isolation between guest OS instances; and Kernel-level Security Modules matches with restricting process privileges via Mandatory Access Control profiles.
Each technology provides a specific layer of defense-in-depth: Linux Namespaces partition system resource visibility (PIDs, network interfaces, mount points); Control Groups (cgroups) govern hardware resource consumption limits (CPU, memory, I/O rates); Type-1 Bare-Metal Hypervisors manage guest virtual machines via hardware-assisted execution boundaries; and Kernel-level Security Modules enforce Mandatory Access Control policies to restrict process capabilities and syscall access on the shared host kernel.

Step-by-Step Solution

1
Analyze Linux Namespaces functionality
Namespaces control process visibility of system abstractions such as process IDs, network interfaces, and file system mounts.
Namespaces determine what an isolated containerized process can see.
2
Analyze Control Groups (cgroups) functionality
cgroups enforce resource allocations and ceilings for CPU usage, memory allocation, and I/O rates.
cgroups determine what host resources an isolated process can consume.
3
Analyze Type-1 Bare-Metal Hypervisor isolation
Bare-metal hypervisors run directly on hardware and enforce strict hardware-level memory and CPU Ring-0 isolation between guest kernels.
Hypervisors provide hardware-assisted virtualization boundaries between fully independent operating systems.
4
Analyze Kernel-level Security Modules (AppArmor/SELinux)
Security modules restrict syscall privileges and file path operations using Mandatory Access Control rules.
MAC profiles restrict container capabilities at runtime, preventing container escapes from accessing sensitive host system resources.

Key Concept

Containerization vs. Virtualization Isolation Architecture
Estimated Time:2m 0s
Question 128Question

Match each observed technical indicator from packet captures and system logs to its corresponding network or wireless attack classification.

Click a left item, then click its matching right item

Items

Frame captures reveal 802.1Q tagged traffic originating from an access port containing nested outer VLAN ID 10 and inner VLAN ID 20 headers.
Network logs show an unauthorized device responding to client broadcast DHCPDISCOVER messages with DHCP Option 3 pointing to a rogue gateway address.
Packet inspection reveals unsolicited OBEX protocol transactions establishing an unauthenticated wireless connection to extract contact lists from a mobile device.
Audit logs indicate an anomalous propagation delay during ISO 14443 challenge-response authentication while exchanging credentials between a physical badge and an access control reader.

Matches

Show answer & explanation

Answer

VLAN double tagging frames correspond to VLAN Hopping; unauthorized gateway options in DHCP responses correspond to a Rogue DHCP Server Attack; unauthorized OBEX data extraction over Bluetooth corresponds to Bluesnarfing; anomalous ISO 14443 timing delays correspond to an RFID/NFC Relay Attack.
Each indicator uniquely aligns with its attack mechanism: nested 802.1Q headers represent Double Tagging VLAN Hopping; rogue default gateway assignments via DHCP Option 3 represent Rogue DHCP deployment; unauthorized data exfiltration via Bluetooth OBEX represents Bluesnarfing; and timing anomalies in ISO 14443 smart card authentication indicate an RFID/NFC Relay Attack.

Step-by-Step Solution

1
Analyze frame encapsulation logs for 802.1Q tags.
Multiple nested 802.1Q VLAN headers sent from an access port demonstrate an exploitation of switch native VLAN tag stripping, which is characteristic of double tagging VLAN hopping.
Switches strip the outer native VLAN tag and forward the frame with the inner tag to another targeted VLAN without validating access rules.
2
Examine DHCP protocol interaction logs.
Unauthorized answers offering network configuration parameters (Option 3 for Default Gateway) point to a Rogue DHCP Server.
Attackers place rogue DHCP servers on a segment to redirect default gateway traffic to an attacker-controlled address for man-in-the-middle operations.
3
Evaluate wireless short-range data exchange protocol logs.
Unsolicited access using OBEX Push profile to download internal device memory (contacts) characterizes Bluesnarfing.
Bluesnarfing targets Bluetooth vulnerabilities to steal confidential information, unlike Bluejacking which only transmits unwanted messages.
4
Inspect physical security proximity credential timing logs.
Propagation delays during ISO 14443 contactless smart card challenge-responses signal an intermediary proxying the signal, defining a Relay Attack.
Relay attacks transmit contactless RFID/NFC RF signals over secondary channels, introducing measurable latency into proximity validation protocols.

Key Concept

Network and Wireless Attack Indicators
Estimated Time:2m 0s
Question 129Question

Match each storage security and data protection mechanism to its primary enterprise operational control function.

Click a left item, then click its matching right item

Items

LUN Masking
Hardware Security Module (HSM)
Endpoint Data Loss Prevention (DLP)
Tokenization

Matches

Show answer & explanation

Answer

LUN Masking matches restricting storage volume access by host HBA ports; Hardware Security Module matches dedicated hardware key management; Endpoint Data Loss Prevention matches monitoring and blocking unauthorized file transfers to local external storage; Tokenization matches replacing sensitive data fields with non-sensitive surrogate values.
Each security solution fulfills a distinct storage architecture requirement: LUN Masking isolates SAN volumes per host HBA, HSMs secure root cryptographic keys within dedicated hardware, Endpoint DLP enforces egress data policies on client endpoints, and Tokenization replaces sensitive data elements with non-cryptographic tokens.

Step-by-Step Solution

1
Analyze SAN block storage isolation mechanisms.
Identify LUN Masking as the storage architecture technique used to restrict volume visibility to authorized host HBAs.
Storage Area Networks require logical partitioning so servers only see assigned storage blocks.
2
Evaluate key protection architectures.
Map dedicated physical hardware appliances for root keys to Hardware Security Modules (HSMs).
HSMs offer hardened cryptographic boundaries separate from general application software.
3
Differentiate endpoint data protection controls from backend data obfuscation.
Assign file exfiltration blocking on host nodes to Endpoint DLP, and database field surrogate substitution to Tokenization.
DLP inspects user data transport actions, while tokenization alters data storage representations.

Key Concept

Enterprise Data Protection and Storage Architecture Controls
Question 130Question

A security technician is setting up a Security Information and Event Management (SIEM) log processing pipeline. Match each SIEM log management phase to its corresponding core function.

Click a left item, then click its matching right item

Items

Parsing
Normalization
Correlation
Aggregation

Matches

Show answer & explanation

Answer

Parsing matches extracting key data fields; Normalization matches mapping attributes into a single standardized schema; Correlation matches linking related log events across sources; Aggregation matches combining repetitive identical event records.
Each SIEM log processing stage performs a distinct function: Parsing extracts structured data fields from raw logs; Normalization maps extracted data to a standardized schema; Correlation connects multiple event streams using logic rules to detect security incidents; and Aggregation deduplicates log volume.

Step-by-Step Solution

1
Identify the data extraction phase
Parsing separates unstructured log lines into discrete elements like IP addresses and event IDs.
SIEM parsers read raw log strings and extract structured fields.
2
Identify the standardization phase
Normalization translates varying field names from different vendors into a unified schema.
Consistent naming conventions enable effective cross-platform querying.
3
Identify the event analysis and rule evaluation phase
Correlation connects separate events over time to detect multi-stage attacks.
Correlation engines combine data streams from multiple sensors to trigger security alerts.
4
Identify the deduplication and volume reduction phase
Aggregation consolidates identical entries into a single summary record.
Grouping duplicate logs saves bandwidth and storage while reducing noise.

Key Concept

SIEM Log Processing Pipeline
Question 131Question

A security architect is updating an enterprise data protection framework to address regulatory compliance and storage security requirements across cloud and on-premises infrastructure. Match each data protection technology to the enterprise operational requirement it primarily fulfills.

Click a left item, then click its matching right item

Items

Hardware Security Module (HSM)
Format-Preserving Tokenization
SAN LUN Masking
DLP Document Fingerprinting

Matches

Show answer & explanation

Answer

Hardware Security Module (HSM) matches dedicated cryptographic key protection in tamper-resistant hardware; Format-Preserving Tokenization matches substituting sensitive values with formatted surrogates; SAN LUN Masking matches isolating storage volumes by Host Bus Adapter (HBA) WWNs; and DLP Document Fingerprinting matches identifying sensitive unstructured file exfiltration using content hashes.
Each pair correctly matches a key storage and data protection architecture technology to its operational role. HSM provides physical and logical protection for master keys; format-preserving tokenization protects sensitive payloads while avoiding application breaking changes; SAN LUN masking enforces volume access boundaries; and DLP document fingerprinting protects unstructured IP exfiltration.

Step-by-Step Solution

1
Analyze key management requirements
Identify that dedicated, tamper-resistant cryptographic hardware isolation maps to a Hardware Security Module (HSM).
HSMs provide specialized cryptographic protection for root and master keys.
2
Evaluate data masking and schema preservation needs
Identify that substituting sensitive fields with surrogate values while maintaining string structure maps to Format-Preserving Tokenization.
Tokenization replaces sensitive values while format-preserving techniques maintain field length and validation syntax.
3
Examine SAN access control mechanisms
Identify that restricting LUN visibility using World Wide Names (WWNs) at the storage target maps to SAN LUN Masking.
LUN masking prevents unauthorized servers on the SAN fabric from seeing or mounting storage volumes allocated to other hosts.
4
Examine egress monitoring technologies
Identify that matching unstructured document content against stored cryptographic signatures maps to DLP Document Fingerprinting.
Fingerprinting enables Data Loss Prevention solutions to track proprietary file forms and exact text patterns during transfer.

Key Concept

Enterprise storage security controls must align specific architectural mechanisms—such as hardware key protection, storage volume isolation, data tokenization, and DLP content inspection—with distinct threat models and operational constraints.
Question 132Question

Match each virtualization and containerization security mechanism on the left with its primary operational function on the right.

Click a left item, then click its matching right item

Items

Type 1 Hypervisor
Linux Namespaces
Control Groups (cgroups)
Container Microsegmentation

Matches

Show answer & explanation

Answer

Type 1 Hypervisor pairs with bare-metal hardware virtual machine management; Linux Namespaces pairs with process visibility isolation; Control Groups (cgroups) pairs with resource allocation restrictions; Container Microsegmentation pairs with granular container network traffic policy enforcement.
Each security mechanism is accurately matched to its design purpose: Type 1 Hypervisors manage bare-metal VM isolation, Linux Namespaces restrict container visibility, Control Groups enforce resource limits, and Microsegmentation secures container-to-container network communication.

Step-by-Step Solution

1
Differentiate between hypervisor virtualization and container OS-level isolation.
Identify Type 1 Hypervisor as bare-metal hardware abstraction for VMs.
Bare-metal hypervisors manage virtual machines directly on hardware without relying on a general-purpose host OS.
2
Distinguish between Linux kernel features used for container isolation.
Associate Linux Namespaces with resource visibility and Control Groups (cgroups) with resource limitations.
Namespaces control what a container can see (PIDs, mounts, networking), while cgroups control how much compute capacity a container can consume.
3
Identify network-layer isolation specific to microservice environments.
Link Container Microsegmentation to fine-grained network access controls.
Microsegmentation prevents unauthorized lateral movement by isolating network flows between specific workloads.

Key Concept

Virtualization and Container Isolation Controls
Question 133Question

An enterprise security architect is establishing operational boundaries across a multi-cloud enterprise ecosystem. Match each cloud security implementation task on the left with the corresponding cloud service model on the right.

Click a left item, then click its matching right item

Items

Configuring execution timeouts, API gateway triggers, and event-driven permissions for stateless microservices without managing any OS or web server.
Applying security updates to guest operating systems, configuring virtual network firewalls, and managing persistent block storage volumes.
Enforcing enterprise data loss prevention (DLP) rules and tenant access control via API integrations for a vendor-hosted productivity suite.
Managing application source code security, database table permissions, and runtime framework configurations while the underlying OS is patched by the cloud vendor.

Matches

Show answer & explanation

Answer

Task 1 matches Function as a Service (FaaS) / Serverless; Task 2 matches Infrastructure as a Service (IaaS); Task 3 matches Software as a Service (SaaS); Task 4 matches Platform as a Service (PaaS).
Each cloud service model defines a specific division of responsibilities under the Shared Responsibility Model: IaaS delegates OS, virtual network, and storage controls to the customer; PaaS delegates application runtime and database configuration to the customer while automating OS management; SaaS limits customer responsibility to data access and identity management; FaaS abstracts all infrastructure and server runtimes, focusing strictly on stateless event execution.

Step-by-Step Solution

1
Analyze Task 1 regarding stateless execution microservices without OS or web server management.
Identified as Function as a Service (FaaS) / Serverless, where infrastructure and OS management are fully abstracted.
Serverless architectures require developers only to upload code functions and define event triggers.
2
Analyze Task 2 regarding guest OS updates, virtual firewalls, and persistent storage management.
Identified as Infrastructure as a Service (IaaS).
Under IaaS shared responsibility, the cloud provider manages physical hardware and hypervisors, whereas the customer manages guest OS, network controls, and storage encryption.
3
Analyze Task 3 regarding tenant access control and DLP integration for vendor-hosted productivity suites.
Identified as Software as a Service (SaaS).
SaaS applications are completely hosted by the cloud provider, leaving the customer only in control of data access, user identities, and data loss prevention configurations.
4
Analyze Task 4 regarding application source code, database table permissions, and runtime framework configurations with provider OS patching.
Identified as Platform as a Service (PaaS).
PaaS abstracts operating system administration while giving the customer control over application deployment, runtime configurations, and backend database schemas.

Key Concept

Cloud Shared Responsibility Model across Service Models (IaaS, PaaS, SaaS, FaaS)
Question 134Question

Match each hardware security mechanism to its primary security function.

Click a left item, then click its matching right item

Items

Trusted Platform Module (TPM)
Hardware Security Module (HSM)
eFuse
UEFI Secure Boot

Matches

Show answer & explanation

Answer

The hardware security mechanisms match their functions as follows: Trusted Platform Module (TPM) pairs with storing host keys and measuring endpoint boot integrity; Hardware Security Module (HSM) pairs with enterprise high-throughput cryptographic processing; eFuse pairs with permanently altering physical chip states for anti-rollback protection; and UEFI Secure Boot pairs with verifying cryptographic signatures on bootloaders before execution.
Each security mechanism directly aligns with its hardware role: Trusted Platform Module (TPM) serves host endpoints by storing keys and holding hardware boot measurements; Hardware Security Module (HSM) offloads server-side cryptographic workloads; eFuse physically enforces immutable hardware states such as rollback protection; and UEFI Secure Boot verifies cryptographically signed startup binaries.

Step-by-Step Solution

1
Analyze endpoint-level cryptographic hardware controls.
Trusted Platform Module (TPM) is identified as the local microcontroller on host motherboards for key storage and measurements.
TPMs are standard endpoint chips used to protect full disk encryption keys and verify device posture.
2
Analyze enterprise-level high-performance hardware crypto appliances.
Hardware Security Module (HSM) is identified as the high-throughput server appliance.
HSMs handle centralized enterprise key management and offload heavy cryptographic operations.
3
Analyze physical hardware lock mechanisms in microchips.
eFuse is identified as the technology that permanently alters internal circuits.
Once an eFuse is blown, the physical change is irreversible, prohibiting firmware downgrades or unauthorized debug interface access.
4
Analyze firmware startup signature verification mechanisms.
UEFI Secure Boot is identified as the process checking boot code signatures.
Secure Boot prevents rootkits by verifying digital signatures against known trust anchors before code executes.

Key Concept

Hardware-based root of trust components and embedded system security controls
Estimated Time:1m 0s
Question 135Question

An enterprise cloud security architect is establishing baseline control requirements for host operating systems, hypervisors, and container runtime environments across a hybrid infrastructure. Match each security mechanism to its corresponding isolation property or security enforcement role.

Click a left item, then click its matching right item

Items

Linux Namespaces
Linux Control Groups (cgroups)
Type-1 Bare-Metal Hypervisor
Secure Computing Mode (seccomp)

Matches

Show answer & explanation

Answer

Linux Namespaces match isolated process views of system resources; Linux Control Groups (cgroups) match limiting hardware resource consumption; Type-1 Bare-Metal Hypervisor matches executing directly on host hardware for virtual machine separation; Secure Computing Mode (seccomp) matches filtering host kernel system calls.
Each mechanism aligns directly with its underlying operating system or hypervisor security control role: Namespaces restrict system visibility, cgroups control resource limits, Type-1 hypervisors provide bare-metal hardware separation, and seccomp limits system call access to the host kernel.

Step-by-Step Solution

1
Analyze container kernel isolation controls.
Identify that Linux Namespaces control resource visibility (what a process can see), whereas cgroups control resource allocation (how much a process can consume).
Differentiating process boundaries from resource constraint enforcement is essential in container runtime security.
2
Analyze kernel interface reduction mechanisms.
Identify seccomp as the Linux security capability that restricts privileged kernel syscall execution.
Syscall filtering mitigates container escape vulnerabilities that target host kernel flaws.
3
Analyze hypervisor virtualization mechanisms.
Identify Type-1 hypervisors as bare-metal software layers enforcing hardware abstraction for guest VMs.
Hardware-assisted hypervisors create a distinct security boundary separate from container OS-level virtualization.

Key Concept

Virtualization vs. Containerization Isolation Primitives
Question 136Question

A enterprise network security architect is reviewing the organization's network segmentation model across physical, virtual, and industrial environments. Match each network segmentation approach to the business and architectural requirement it best addresses.

Click a left item, then click its matching right item

Items

Air Gap
Microsegmentation
Screened Subnet (DMZ)
Jump Box (Bastion Host)

Matches

Show answer & explanation

Answer

Air Gap matches physical isolation of OT systems; Microsegmentation matches granular software-defined East-West traffic control between workloads; Screened Subnet matches hosting public-facing services separated from private networks; Jump Box matches providing a single audited administrative transit point into sensitive zones.
Air gapping ensures physical isolation for critical OT systems. Microsegmentation enforces policy-based isolation for East-West cloud workload traffic. A screened subnet isolates internet-accessible assets from internal networks, and a jump box securely bridges administrative access into high-security zones.

Step-by-Step Solution

1
Analyze the operational requirements for high-security OT environments requiring total network disconnect.
Identify Air Gap as the physical isolation technique suited for SCADA/ICS safety systems.
Air gapping completely eliminates network vectors by removing physical connection paths.
2
Analyze requirements for preventing lateral movement within modern data center workload tiers.
Identify Microsegmentation as the appropriate control for granular East-West traffic restriction.
Microsegmentation uses software-defined policies to isolate individual container workloads regardless of physical topology.
3
Analyze requirements for exposing public services securely.
Identify Screened Subnet (DMZ) as the perimeter boundary control.
Screened subnets buffer public traffic between internal and external firewalls.
4
Analyze administrative security access requirements for sensitive zones.
Identify Jump Box (Bastion Host) as the controlled management transit server.
Jump boxes enforce centralized authentication, access controls, and logging for administrative sessions.

Key Concept

Secure Network Segmentation Archetypes and Traffic Control Controls
Question 137Question

An enterprise airport operations authority is redesigning its security architecture across operational technology (OT), cloud management, tenant infrastructure, and administrative networks. Match each network isolation and control mechanism on the left to its corresponding architectural requirement on the right.

Click a left item, then click its matching right item

Items

Unidirectional Data Diode
Microsegmentation with Host-based Enforcement
Hardened Jump Server with MFA and Session Auditing
Physical Air Gap with Media Sanitization Kiosk

Matches

Show answer & explanation

Answer

Unidirectional Data Diode pairs with outbound-only SCADA telemetry; Microsegmentation pairs with stopping East-West lateral movement between cloud microservices; Hardened Jump Server pairs with audited vendor administrative access; Physical Air Gap pairs with isolating critical runway control hardware via offline media ingestion.
Each isolation mechanism aligns with specific threat model requirements: data diodes physically enforce one-way telemetry streaming; microsegmentation controls internal lateral movement across cloud workloads; jump servers control and audit remote management access; air gaps eliminate all network-based attack vectors against critical physical control systems.

Step-by-Step Solution

1
Evaluate hardware-enforced single-direction communication constraints.
Identify that streaming telemetry outbound while physically blocking inbound traffic requires a Unidirectional Data Diode.
Data diodes utilize physical optical transmitters and receivers that prevent electromagnetic or logical return channels.
2
Evaluate lateral communication controls for cloud workloads.
Match Microsegmentation to the requirement of limiting East-West traffic between individual containerized instances.
Traditional perimeter firewalls cannot inspect or restrict peer-to-peer traffic inside the same virtual layer 2 network segment without software-defined microsegmentation.
3
Evaluate privileged remote management architectures.
Match Hardened Jump Server with MFA and Session Auditing to third-party vendor administrative access requirements.
Jump boxes isolate external administrative sessions from internal infrastructure while recording session activity for compliance and forensics.
4
Evaluate total isolation controls for high-consequence OT infrastructure.
Match Physical Air Gap with Media Sanitization Kiosk to the safety-critical automated runway control systems.
Complete physical separation removes external connectivity attack vectors, using controlled offline kiosks as the sole ingestion path for maintenance files.

Key Concept

Network Segmentation and Isolation Architecture Controls
Estimated Time:2m 0s
Question 138Question

Match each Identity and Access Management (IAM) protocol to its primary architectural use case.

Click a left item, then click its matching right item

Items

SAML 2.0
OAuth 2.0
OpenID Connect (OIDC)
RADIUS

Matches

Show answer & explanation

Answer

SAML 2.0 matches XML-based web SSO federation; OAuth 2.0 matches token-based authorization for API access; OpenID Connect matches the authentication identity layer built on OAuth 2.0; RADIUS matches centralized AAA network access control.
Each IAM protocol satisfies a specific architectural domain: SAML 2.0 facilitates XML web federation across organizations; OAuth 2.0 grants granular authorization tokens to APIs; OpenID Connect adds an authentication identity layer over OAuth 2.0 using JWTs; RADIUS delivers network-level AAA for VPNs and wireless infrastructure.

Step-by-Step Solution

1
Identify the primary architectural function (Authentication vs. Authorization vs. Network AAA) for each protocol.
Categorize SAML 2.0 and OIDC as web identity/SSO authentication, OAuth 2.0 as API authorization, and RADIUS as network AAA.
IAM architecture requires matching protocols to their specific layer in the security stack.
2
Differentiate web federation standards based on message format and structure.
Associate SAML 2.0 with XML assertions and OIDC with JSON Web Tokens (JWT) extending OAuth 2.0.
SAML 2.0 is enterprise XML-focused, while OIDC modernizes web authentication over RESTful/JSON endpoints.
3
Pair RADIUS with network-level authentication mechanisms.
Connect RADIUS to 802.1X port security and VPN access control.
RADIUS is designed for infrastructure device network access control, unlike web application protocols.

Key Concept

IAM Protocol Architectural Selection
Estimated Time:45s
Question 139Question

A system administrator is auditing isolation and runtime protection controls across a enterprise infrastructure hosting both virtual machines and containerized microservices. Match each security control on the left with the specific operational threat or attack vector it directly mitigates on the right.

Click a left item, then click its matching right item

Items

Hypervisor patch management and memory isolation baselines
Linux Control Groups (cgroups) quota enforcement
Read-only root file system configuration for container runtimes
Static image scanning integrated into the CI/CD deployment pipeline

Matches

Show answer & explanation

Answer

Hypervisor patch management matches VM escape exploitation; Control Groups (cgroups) enforcement matches resource exhaustion denial-of-service; Read-only root file system configuration matches malicious file persistence; Static image scanning matches deployment of unpatched software vulnerabilities.
Each security mechanism directly addresses a distinct layer of virtualization or container architecture: hypervisor patching protects hardware abstraction boundaries; cgroups manage shared kernel resource allocation; read-only root file systems enforce immutability at runtime; and static scanning secures software components in the build pipeline.

Step-by-Step Solution

1
Analyze virtual machine isolation mechanisms.
Identify that hypervisor patching specifically targets vulnerabilities allowing guest-to-host privilege escalation and VM escape.
Hypervisors manage hardware virtualization boundaries; failure to patch allows guest workloads to break out of hardware abstraction.
2
Differentiate container resource boundary controls from namespace isolation.
Map Linux Control Groups (cgroups) directly to resource consumption limits.
cgroups set boundaries on system resources like CPU, memory, and disk I/O, preventing neighbor starvation.
3
Evaluate container file system runtime security.
Connect read-only root file systems to preventing unauthorized file modifications and persistence.
Immutable runtime container storage prevents attackers from dropping binaries or modifying system binaries during runtime compromise.
4
Examine pre-deployment supply chain security controls.
Associate CI/CD static image scanning with identifying known vulnerabilities in container images.
Automated scanning checks container layers against vulnerability databases before code is deployed.

Key Concept

Virtualization vs Containerization Security Boundaries
Question 140Question

Match each storage security technology to its primary operational function.

Click a left item, then click its matching right item

Items

Tokenization
Self-Encrypting Drive (SED)
Hardware Security Module (HSM)
Data Loss Prevention (DLP)

Matches

Show answer & explanation

Answer

Tokenization maps to replacing sensitive data fields with non-sensitive surrogate tokens; Self-Encrypting Drive (SED) maps to providing automatic, hardware-level block encryption directly on physical storage media; Hardware Security Module (HSM) maps to safeguarding and managing cryptographic keys inside dedicated physical security hardware; Data Loss Prevention (DLP) maps to monitoring and blocking unauthorized transmission or exfiltration of sensitive information.
Tokenization obfuscates data using surrogate tokens; SED provides automated physical drive encryption; HSM secures cryptographic keys; DLP inspects data to prevent unauthorized transfers.

Step-by-Step Solution

1
Analyze each security technology listed on the left.
Identified Tokenization, SED, HSM, and DLP as primary storage and data protection mechanisms.
Each technology satisfies a specific, distinct function within enterprise storage architecture.
2
Match each technology to its unique functional capability.
Tokenization replaces data with surrogate tokens; SED encrypts disk blocks directly; HSM protects cryptographic keys; DLP prevents exfiltration.
Matching capabilities directly tests core knowledge of data protection and storage security mechanisms.

Key Concept

Storage and Data Protection Controls
PreviousPage 7 / 19Next
All practice questions — CompTIA Security+ | Examkin