All practice questions

2232 questions

All types2,232 Multiple choice1,151 Multiple select509 Numeric21 Matching378 Ordering173

A security engineer at a financial institution is establishing a patch and configuration management framework for dual-homed payment processing nodes. The environment requires continuous compliance enforcement against baseline images, strict change validation before production deployment, and protection against unauthorized system modifications. Which of the following strategies should the security engineer implement to maintain secure configuration baselines and control patch deployment risks? (Select TWO.)

Select all that apply

Utilize automated infrastructure-as-code configuration management tools to continuously audit system state and automatically remediate configuration drift back to approved baselines.

Staging patch updates in an isolated test environment and verifying cryptographic signature hashes prior to deploying updates into production.

Deploying network perimeter firewall filtering rules as a permanent substitute for applying critical operating system security patches.

Reclassifying host-based automated audit logging controls as preventive physical security mechanisms to satisfy compliance reporting mandates.

Show answer & explanation

Answer: Utilize automated infrastructure-as-code configuration management tools to continuously audit system state and automatically remediate configuration drift back to approved baselines.; Staging patch updates in an isolated test environment and verifying cryptographic signature hashes prior to deploying updates into production.

Answer

The security engineer should utilize automated infrastructure-as-code tools to continuously audit and remediate configuration drift, and stage patch updates in an isolated environment while verifying cryptographic signature hashes before production deployment.

Automated infrastructure-as-code tools continuously validate system settings against established security baselines and automatically remediate configuration drift. Additionally, staging patches in an isolated environment combined with verifying cryptographic signatures prevents unstable or malicious update packages from compromising production systems.

Step-by-Step Solution

Analyze configuration maintenance requirements

Identified the need for continuous drift detection and enforcement using automated configuration baselines.

Manual baseline auditing is ineffective in dynamic environments, making automated remediation via configuration management essential for eliminating drift.

Evaluate patch deployment risk mitigation controls

Selected pre-deployment staging and cryptographic hash verification.

Testing patches in staging prevents unexpected service outages, and verifying signature hashes guarantees patch integrity against tampering.

Assess distractor validity

Rejected using firewalls as permanent patch replacements and misclassifying control categories.

Firewalls do not remediate system code flaws, and mislabeling control types invalidates risk governance modeling.

Key Concept

Continuous baseline configuration enforcement and staged patch verification

Question 1382Question →

A security engineer at an e-commerce organization is investigating an alert indicating anomalous privileged activity on a production database cluster. The authentication and operational log snippet shows:

Parameter	Log Entry Details
Timestamp	2026-07-27T14:22:10Z
Account	admin_jsmith
Source IP	198.51.100.45 (External WAN)
Authentication	RADIUS with MFA (Success)
Executed Action	GRANT ALL PRIVILEGES ON customer_db TO temp_user;
Matched Policy	Default_Admin_Role

The organization's security policy mandates that all privileged administrative sessions on critical systems must be brokered exclusively through a Privileged Access Management (PAM) jump host with short-lived session checkout. Which of the following is the MOST effective operational control modification to prevent direct administrative command execution outside the PAM solution?

Reconfigure network access control lists and authorization policies to restrict administrative session initiation strictly to designated PAM jump host IP addresses.

Implement step-up multi-factor authentication to prompt the administrator for a secondary token prior to executing database privilege elevation statements.

Relocate the database cluster inside the internal corporate network perimeter and permit administrative commands originating from internal subnets.

Configure the Security Information and Event Management (SIEM) system to generate high-priority incident tickets for external administrative logins.

Show answer & explanation

Answer: Reconfigure network access control lists and authorization policies to restrict administrative session initiation strictly to designated PAM jump host IP addresses.

Answer

Reconfigure network access control lists and authorization policies to restrict administrative session initiation strictly to designated PAM jump host IP addresses.

Enforcing network access control lists (ACLs) and restricting authorization rules so that administrative access is accepted only from designated PAM jump host IP addresses provides a preventive control. This ensures all privileged sessions are brokered, recorded, and managed according to enterprise IAM operational policy.

Step-by-Step Solution

Analyze the log entries and identify the security policy violation.

The log shows a direct RADIUS-authenticated session executing privileged database commands from an external WAN IP address, bypassing the required PAM jump host.

Privileged access management policies require all administrative sessions to be brokered, audited, and isolated through a dedicated PAM proxy or jump server.

Evaluate the required security control type to eliminate direct access bypass.

Enforcing network-level Access Control Lists (ACLs) and authorization policies at the database listener layer ensures that only connections originating from the PAM jump host IP address are accepted for administrative accounts.

Preventive network and authorization controls stop unauthorized direct connections before session establishment occurs.

Key Concept

Privileged Access Management (PAM) Session Brokering & Enforcement

Question 1383Question →

A cybersecurity analyst is preparing to transport a seized, powered-off desktop computer from a remote branch office to the central digital forensics laboratory. Which of the following procedures must be performed to maintain the chain of custody and preserve physical evidence integrity during transit? (Select TWO.)

Select all that apply

Record the equipment serial numbers, transfer timestamps, and signatures of both the transferring and receiving custodians on a formal tracking form.

Place the hard drive in a tamper-evident anti-static bag and seal it prior to secure physical transport.

Power on the system at the remote office to calculate and log the baseline cryptographic hash of the primary storage partition before packing.

Apply full-disk encryption to the primary drive prior to shipping to protect sensitive data confidentiality during transit.

Show answer & explanation

Answer: Record the equipment serial numbers, transfer timestamps, and signatures of both the transferring and receiving custodians on a formal tracking form.; Place the hard drive in a tamper-evident anti-static bag and seal it prior to secure physical transport.

Answer

Maintaining chain of custody and physical evidence integrity during transportation requires documenting all transfer details with custodian signatures on a formal tracking log and securing evidence inside sealed, tamper-evident anti-static packaging.

Chain of custody requires continuous tracking of evidence possession via detailed logs containing timestamps, serial numbers, and signatures. Physical evidence must also be packaged in sealed, tamper-evident, anti-static containers to guard against physical damage and tampering.

Step-by-Step Solution

Identify chain of custody tracking requirements

Every physical transfer of digital evidence must record the date, time, unique identifiers (such as serial numbers), purpose of transfer, and signatures of both releasing and receiving custodians.

This establishes accountability and legally proves who had possession of the evidence at all times.

Identify physical evidence preservation standards

Physical components such as hard drives must be stored in tamper-evident anti-static bags to prevent electrostatic discharge damage and provide clear indicators of unauthorized access.

Ensuring physical protection prevents evidence contamination or damage during transit.

Evaluate prohibited modifications to original media

Actions that modify the drive contents (such as applying encryption) or boot the operating system directly (altering system logs/timestamps) corrupt original evidence.

Forensic evidence acquisition requires static bit-stream imaging using write-blocking technology in controlled lab settings, not live unblocked execution at a remote site.

Key Concept

Preserving chain of custody documentation and physical evidence integrity during transport

Question 1384Question →

A system administrator updates a cluster of web servers with an emergency software patch. Immediately after the update, users report that web applications hosted on those servers are failing to load. Which of the following actions should the administrator take FIRST to restore system functionality?

Execute the documented rollback plan to revert the servers to their known good baseline configuration.

Deploy network firewall rules to block incoming web traffic to the affected servers.

Reclassify the web server security policy from a preventive control to a detective control.

Run an automated vulnerability scan against the web servers to detect open network ports.

Show answer & explanation

Answer: Execute the documented rollback plan to revert the servers to their known good baseline configuration.

Answer

Execute the documented rollback plan to revert the servers to their known good baseline configuration.

When a patch causes unexpected service outage or instability in production, the immediate action within configuration management is to execute a tested rollback plan to restore services to the last known good baseline.

Step-by-Step Solution

Identify the immediate operational impact following the patch deployment.

The newly applied patch caused application instability and service disruption.

When a patch causes system failure, immediate operational recovery is required.

Initiate the emergency rollback procedures associated with the patch deployment plan.

The servers revert to the previously verified baseline state.

Rollback plans ensure rapid recovery to a stable configuration minimalizing downtime.

Key Concept

Rollback Planning and Configuration Baselines

Question 1385Question →

An organization is onboarding a third-party cloud service provider to support its customer support operations. To ensure accountability, the security team must document measurable performance targets, such as minimum uptime requirements and incident response timeframes. Which of the following agreements should be established with the provider to define these operational metrics?

Service Level Agreement (SLA)

Non-Disclosure Agreement (NDA)

Memorandum of Understanding (MOU)

Interconnection Security Agreement (ISA)

Show answer & explanation

Answer: Service Level Agreement (SLA)

Answer

Service Level Agreement (SLA)

A Service Level Agreement (SLA) is specifically designed to set measurable operational targets, including uptime guarantees, availability expectations, and incident response windows for vendor services.

Step-by-Step Solution

Identify the core operational requirement from the scenario

The requirement is to formalize measurable targets for service availability, system uptime, and incident response windows.

Third-party risk management relies on distinct agreements depending on whether the requirement involves confidentiality, joint operational intent, technical connectivity, or performance guarantees.

Select the appropriate third-party agreement type

A Service Level Agreement (SLA) directly establishes concrete metrics such as 99.9% uptime, maximum allowable latency, and response time thresholds.

SLAs provide objective criteria for evaluating vendor performance and enforcing contractual remedies if targets are missed.

Key Concept

Third-Party Risk Agreements - Service Level Agreement (SLA)

Question 1386Question →

An organization purchases a comprehensive cybersecurity insurance policy to cover financial losses that may result from potential data breaches. Which of the following risk response strategies is the organization implementing?

Risk transfer

Risk avoidance

Risk mitigation

Risk acceptance

Show answer & explanation

Answer: Risk transfer

Answer

Risk transfer is the strategy of shifting potential risk and financial liability to a third party, such as through cybersecurity insurance.

Risk transfer is executed when an organization shares or shifts the responsibility for risk management and financial burden to an external third party. Obtaining a cyber insurance policy is a textbook example of transferring financial liability.

Step-by-Step Solution

Identify the primary action taken by the organization in the scenario.

The organization purchased a cybersecurity insurance policy to handle financial loss.

Determining the core action establishes how risk is being handled.

Map the action to formal risk response options.

Purchasing insurance moves the financial impact to a third-party insurer.

Sharing or moving financial liability to another entity is defined as risk transfer.

Key Concept

Risk Response Strategies (Risk Transfer)

Question 1387Question →

A security analyst is triaging log files collected by a SIEM system across web applications, authentication servers, and system logs. Match each log snippet on the left to the corresponding security event or attack vector on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The HTTP snippet containing 'UNION SELECT' matches SQL Injection; the repeated SSH failed authentication log matches SSH Brute-Force; Windows Event ID 4624 with Logon Type 10 matches RDP Interactive Session; and the HTTP request with '../../' sequences matches Directory/Path Traversal.

Each log entry displays distinct forensic indicators: 'UNION SELECT' points directly to SQL injection; repeated SSH authentication failures indicate brute-force attempts; Windows Event 4624 with Logon Type 10 marks remote interactive RDP logons; and dot-dot-slash patterns indicate path traversal attempts.

Step-by-Step Solution

Analyze Web Application Logs

Identified SQL query keywords ('UNION SELECT') in the query string of the first log entry and directory navigation dot-dots ('../../') in the fourth entry.

Web logs reveal application-level attacks targeting backend databases or sensitive file paths.

Analyze Linux Authentication Logs

Identified high-frequency failed password entries for SSH targeting administrative users from an external IP.

Syslog authentication events with high frequency from single sources characterize automated password guessing.

Analyze Windows Event Logs

Correlated Event ID 4624 (Successful Logon) with Logon Type 10.

Logon Type 10 is reserved for RemoteInteractive connections such as RDP, distinguishing it from local (Type 2) or network share (Type 3) logons.

Key Concept

Log Telemetry Analysis and Threat Identification

Question 1388Question →

A Security Operations Center (SOC) is designing an automated Security Orchestration, Automation, and Response (SOAR) workflow to handle high-severity alerts triggered when an Amazon S3 storage bucket hosting confidential customer data is modified to allow public read access. The playbook must rapidly mitigate public data exposure while ensuring operational continuity for legitimate internal microservices that depend on the bucket. Which TWO of the following design choices should be incorporated into the automated response playbook to achieve effective containment without causing catastrophic service disruption?

Select all that apply

Configure an automated playbook action to invoke cloud API webhooks that immediately apply an explicit 'Block Public Access' policy to the bucket while leaving authenticated IAM roles intact.

Program the playbook to automatically delete the bucket and its objects immediately upon alert ingestion to guarantee zero unauthorized external data egress.

Include an automated enrichment step that queries cloud audit logs for recent policy change events and appends access metadata to the incident ticket prior to triggering analyst notifications.

Deploy an inline endpoint intrusion prevention system (IPS) agent directly onto the cloud object storage service to dynamically filter incoming public HTTP requests.

Show answer & explanation

Answer: Configure an automated playbook action to invoke cloud API webhooks that immediately apply an explicit 'Block Public Access' policy to the bucket while leaving authenticated IAM roles intact.; Include an automated enrichment step that queries cloud audit logs for recent policy change events and appends access metadata to the incident ticket prior to triggering analyst notifications.

Answer

The correct playbook design choices are to invoke cloud API webhooks that apply an explicit public access block to the S3 bucket while preserving authenticated IAM access, and to include automated enrichment that queries cloud audit logs for policy change events to context-enrich the incident ticket.

The correct options properly balance rapid automated containment with operational safety and forensic enrichment. Utilizing API webhooks to apply a public access block neutralizes the misconfiguration immediately without invalidating internal IAM roles required by microservices. Simultaneously, automating the retrieval of audit log metadata provides essential context to responders without delaying containment.

Step-by-Step Solution

Evaluate containment mechanisms for object storage exposure.

Identified that applying an explicit public block via API webhooks surgically eliminates internet exposure without disrupting internal IAM-authenticated services.

Containment actions in SOAR playbooks must isolate the threat vector without breaking production dependencies.

Assess the role of context enrichment in automated incident workflows.

Determined that gathering recent API audit log trails automatically enriches the ticket with attacker/user context for effective analyst triage.

SOAR platforms excel at aggregating threat intelligence and log metadata before escalating to human responders.

Analyze distractor containment and control options for operational risk and technical feasibility.

Rejected bucket deletion due to severe operational damage and rejected host IPS agent installation due to the architectural reality of cloud object storage services.

Automated playbooks must avoid destructive actions on production data assets and must respect cloud platform control boundaries.

Key Concept

SOAR Playbook Containment Logic and Context Enrichment

Question 1389Question →

An enterprise security analyst is performing a quantitative risk assessment for a high-availability identity authentication cluster with an asset value ( $AV$ ) of $\$1,200,000$ . Threat intelligence data indicates an identity spoofing threat with an annual rate of occurrence ( $ARO$ ) of $0.50$ and an exposure factor ( $EF$ ) of $0.30$ . The organization plans to implement an inline Hardware Security Module (HSM) safeguard costing $\$25,000$ per year, which will reduce the $EF$ to $0.05$ while keeping the $ARO$ constant at $0.50$ . Additionally, to address potential physical facility damage to the datacenter, the organization purchases a third-party commercial insurance policy. Which of the following statements accurately evaluate the risk metrics and risk response strategies in this scenario? (Select TWO.)

Select all that apply

The pre-control Annual Loss Expectancy (

ALE

) for the identity spoofing threat is

\$180,000

, and the post-control

ALE

after implementing the HSM cluster is

\$30,000

Purchasing the commercial insurance policy for datacenter facility risks represents a risk transfer strategy.

The Single Loss Expectancy (

SLE

) of the identity spoofing threat prior to HSM deployment is

\$600,000

Purchasing the commercial insurance policy represents a risk avoidance strategy that eliminates the underlying physical facility threat vector.

Show answer & explanation

Answer: The pre-control Annual Loss Expectancy ( $ALE$ ) for the identity spoofing threat is $\$180,000$ , and the post-control $ALE$ after implementing the HSM cluster is $\$30,000$ .; Purchasing the commercial insurance policy for datacenter facility risks represents a risk transfer strategy.

Answer

The pre-control

ALE

\$180,000

and post-control

ALE

\$30,000

, while purchasing the commercial insurance policy represents a risk transfer strategy.

Calculating pre-control

ALE

yields

1,200,000 \times 0.30 \times 0.50 = \$180,000

, and post-control

ALE

yields

1,200,000 \times 0.05 \times 0.50 = \$30,000

. Furthermore, purchasing commercial insurance explicitly transfers financial liabilities of datacenter losses to an insurance provider, satisfying the definition of risk transfer.

Step-by-Step Solution

Calculate pre-control Single Loss Expectancy (

SLE

) and Annual Loss Expectancy (

ALE

SLE_{pre} = AV \times EF_{pre} = \$1,200,000 \times 0.30 = \$360,000

ALE_{pre} = SLE_{pre} \times ARO = \$360,000 \times 0.50 = \$180,000

Establishing baseline financial loss potential before safeguard deployment.

Calculate post-control Single Loss Expectancy (

SLE

) and Annual Loss Expectancy (

ALE

SLE_{post} = AV \times EF_{post} = \$1,200,000 \times 0.05 = \$60,000

ALE_{post} = SLE_{post} \times ARO = \$60,000 \times 0.50 = \$30,000

Evaluating residual loss exposure after applying the HSM control.

Classify the risk response strategy associated with purchasing commercial insurance.

Purchasing commercial insurance shifts financial exposure to a third party, which defines Risk Transfer.

Distinguishing between risk response options (Acceptance, Avoidance, Mitigation, Transfer).

Key Concept

Quantitative Risk Assessment Metrics (SLE, ARO, ALE) and Risk Response Classification

Question 1390Question →

An enterprise organization is deploying a native mobile application that connects to cloud-hosted REST APIs. The mobile client runs in an untrusted environment where embedded client secrets cannot be kept confidential. Which of the following identity and access management architecture components should the security architect implement to securely authorize the mobile application while mitigating authorization code interception attacks?

OAuth 2.0 Authorization Code Grant with Proof Key for Code Exchange (PKCE)

OAuth 2.0 Implicit Grant with hardcoded API keys for client identification

Static API key authentication combined with internal IP address whitelisting

HTTP Basic Authentication wrapped inside a Role-Based Access Control (RBAC) policy

Show answer & explanation

Answer: OAuth 2.0 Authorization Code Grant with Proof Key for Code Exchange (PKCE)

Answer

OAuth 2.0 Authorization Code Grant with Proof Key for Code Exchange (PKCE)

OAuth 2.0 Authorization Code Grant with PKCE is specifically designed to secure public clients (such as mobile apps and single-page apps) that cannot safely maintain a confidential client secret. By creating a unique code verifier and transformed code challenge for each request, the authorization server verifies that the entity redeeming the code is the exact client instance that requested it.

Step-by-Step Solution

Analyze client constraints

The target application is a public native mobile client, meaning embedded client secrets cannot be securely stored.

Public clients can be decompiled or inspected by attackers to extract static credentials.

Evaluate risk profile for authorization code flow

Standard Authorization Code Grant requires a client secret, making public clients vulnerable to code interception attacks if secrets are omitted or exposed.

Malicious applications on the mobile device can register custom URI schemes and intercept the authorization code returned by the authorization server.

Select appropriate IAM protocol extension

Proof Key for Code Exchange (PKCE) replaces static secrets with a dynamically generated secret key pair (code_verifier and code_challenge) per request.

This guarantees that only the application instance that initiated the request can exchange the intercepted authorization code for an access token.

Key Concept

Public Client Token Exchange and PKCE Architecture

Estimated Time:1m 30s

Question 1391Question →

Match each third-party risk management agreement type on the left with its correct operational description on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Service Level Agreement matches performance metrics and uptime guarantees; Non-Disclosure Agreement matches legal confidentiality obligations; Memorandum of Understanding matches mutual intent for collaboration; Interconnection Security Agreement matches technical security requirements for network connections.

Each agreement serves a distinct governance or operational role: Service Level Agreements (SLAs) enforce performance and availability guarantees; Non-Disclosure Agreements (NDAs) enforce confidentiality of sensitive shared data; Memorandums of Understanding (MOUs) document informal or general cooperative goals between organizations; and Interconnection Security Agreements (ISAs) govern the technical security requirements for inter-organizational system connections.

Step-by-Step Solution

Identify the purpose of each legal and operational agreement used in third-party risk management.

Categorize each agreement by its focus: performance metrics (SLA), privacy/confidentiality (NDA), general collaboration (MOU), or technical connectivity (ISA).

Different third-party agreements address different aspects of governance, legal protection, operational performance, and technical integration.

Match each agreement term to its corresponding definition based on security governance standards.

Pairing SLA with uptime/performance metrics, NDA with confidentiality, MOU with mutual intent/collaboration, and ISA with technical network interconnection parameters.

Accurate pairing ensures correct understanding of third-party contract oversight and compliance.

Key Concept

Third-Party Agreements and Governance Frameworks

Question 1392Question →

A risk analyst is conducting a quantitative risk assessment for a database server hosting core enterprise operational data. The Asset Value ( $AV$ ) of the server is established at $\$500,000$ . Threat intelligence data indicates that a major ransomware incident targeting this database occurs approximately once every 5 years. Financial modeling determines that the Annual Loss Expectancy ( $ALE$ ) for this threat scenario is $\$25,000$ . Based on these quantitative metrics, what is the Exposure Factor ( $EF$ ) associated with a single ransomware incident?

25%

20%

80%

Show answer & explanation

Answer: 25%

Answer

The Exposure Factor (EF) associated with a single ransomware incident is 25%.

The Exposure Factor (

EF

) measures the percentage of an asset destroyed or damaged during a single threat occurrence. Given

ALE = \$25,000

and

ARO = 0.20

(once every 5 years), the Single Loss Expectancy (

SLE

) is

\$25,000 / 0.20 = \$125,000

. Dividing

SLE

by the total Asset Value (

AV = \$500,000

) gives

EF = \$125,000 / \$500,000 = 0.25

, or 25%.

Step-by-Step Solution

Calculate the Annual Rate of Occurrence (ARO)

ARO = \frac{1}{\text{5 years}} = 0.20

The event occurs once every 5 years, giving an annual frequency of 0.20.

Calculate the Single Loss Expectancy (SLE) from ALE and ARO

SLE = \frac{ALE}{ARO} = \frac{\$25,000}{0.20} = \$125,000

Since

ALE = SLE \times ARO

, dividing

ALE

ARO

yields the expected monetary loss per single incident.

Calculate the Exposure Factor (EF)

EF = \frac{SLE}{AV} = \frac{\$125,000}{\$500,000} = 0.25 \text{ or } 25\%

The Exposure Factor represents the percentage of asset value lost during a single realization of a risk (

SLE = AV \times EF

Key Concept

Quantitative Risk Assessment Metrics (ALE, SLE, ARO, EF)

Question 1393Question →

Match each enterprise identity and access management (IAM) protocol or standard on the left with its primary architectural function on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

OAuth 2.0 matches API authorization delegation; OpenID Connect matches the OAuth 2.0 identity/authentication layer; SAML 2.0 matches XML-based federated Web SSO; SCIM matches automated identity provisioning.

Each protocol serves a distinct architectural purpose in modern enterprise IAM systems: OAuth 2.0 handles delegated API access control, OIDC provides modern OAuth-based user authentication, SAML 2.0 delivers traditional XML-based federated web SSO, and SCIM automates identity lifecycle management and provisioning across cloud and on-premises directories.

Step-by-Step Solution

Differentiate authentication vs. authorization frameworks.

Identify OAuth 2.0 as strictly authorization/delegation, and OIDC as the identity authentication extension.

OAuth 2.0 alone provides access tokens for API authorization, whereas OIDC adds ID tokens for user authentication.

Identify web federation formats.

Match SAML 2.0 to XML-based security assertions.

SAML 2.0 is the legacy enterprise XML standard for cross-domain SSO federations between IdPs and SPs.

Identify identity lifecycle management standards.

Match SCIM to automated cross-domain user provisioning.

SCIM uses standardized REST endpoints and JSON payloads to sync user account states across systems.

Key Concept

Enterprise IAM Architectural Protocols & Standards

Question 1394Question →

During an ongoing internal incident investigation, a security analyst suspects that a logged-in workstation is currently running an active malicious process in memory that is exfiltrating sensitive database records to an external server. The system is powered on and connected to the local network. To ensure maximum evidentiary value and legal admissibility for potential prosecution, which of the following actions should the analyst take FIRST?

Capture the system's volatile memory (RAM) using an approved live acquisition tool before powering off or disconnecting the device.

Immediately disconnect the power cable to freeze the current disk state and prevent further remote data exfiltration.

Perform a full bit-stream disk clone of the primary storage drive before capturing any system memory artifacts.

Export the system's security event logs to a remote network share to establish non-repudiation of user authentication.

Show answer & explanation

Answer: Capture the system's volatile memory (RAM) using an approved live acquisition tool before powering off or disconnecting the device.

Answer

Capturing the system's volatile memory (RAM) using an approved live acquisition tool before taking any action that modifies the system state.

According to standard digital forensics guidelines and RFC 3227 (Order of Volatility), evidence must be gathered starting from the most volatile items to the least volatile items. Active system memory (RAM) containing execution stacks, network connections, and unencrypted keys is highly perishable and must be preserved prior to powering down or performing disk-level imaging.

Step-by-Step Solution

Evaluate the current operational state of the compromised host system.

The target computer is powered on with active processes running in system memory.

Understanding host state determines which artifacts are most volatile and at risk of immediate loss.

Apply the Order of Volatility principles to sequence evidence acquisition.

System memory (RAM) and active cache/registers take priority over non-volatile hard disk storage and remote logs.

Volatile data disappears when the device loses power or shuts down, whereas disk data persists across reboots.

Execute live memory capture using an authorized forensic acquisition tool.

A cryptographically hashed RAM dump file is preserved for forensic analysis.

This captures the running malicious process, injected code, and active network connections without destroying evidence.

Key Concept

Order of Volatility in Digital Forensics

Question 1395Question →

A Chief Information Security Officer (CISO) is structuring an organization's governance framework. The CISO needs to clearly differentiate between binding organizational rules and discretionary advice. Which of the following governance document types establish MANDATORY requirements that personnel or technical systems must follow? (Select TWO).

Select all that apply

Security Policies

Security Standards

Security Guidelines

Security Control Categories

Show answer & explanation

Answer: Security Policies; Security Standards

Answer

Security Policies and Security Standards establish mandatory compliance requirements within an enterprise governance hierarchy.

In security governance, Security Policies serve as mandatory high-level statements of management intent that direct user conduct and organizational security expectations. Security Standards set specific, mandatory requirements (such as technical requirements or operational constraints) that systems and users must adhere to without exception.

Step-by-Step Solution

Identify the compliance obligation of each document type in the governance hierarchy.

Policies and Standards are mandatory directives, whereas Guidelines are discretionary.

Governance frameworks separate mandatory directives (Policies, Standards, Baselines, Procedures) from optional recommendations (Guidelines).

Select all option choices that represent binding, mandatory governance documents.

Security Policies and Security Standards are selected.

Security Policies set management intent and mandatory rules across the enterprise, while Security Standards enforce mandatory specific technology choices and baseline requirements.

Key Concept

Distinction between mandatory compliance documents (Policies, Standards) and discretionary governance materials (Guidelines).

Question 1396Question →

A Security Operations Center (SOC) analyst is investigating SIEM alert correlation logs for an internal endpoint with IP address 10.0.4.112. The log collector correlates recursive DNS resolver logs with outbound NetFlow records as shown below:

2026-07-27T11:02:14Z DNS_RESOLV src=10.0.4.112 qtype=TXT qname=a9f1b.data-sync-update.com rcode=NOERROR rdata="ZXhoYWlsZV9jMg=="
2026-07-27T11:03:14Z DNS_RESOLV src=10.0.4.112 qtype=TXT qname=c3k8p.data-sync-update.com rcode=NOERROR rdata="dHJhbnNtaXRfZGF0YQ=="
2026-07-27T11:04:14Z DNS_RESOLV src=10.0.4.112 qtype=TXT qname=e7m2q.data-sync-update.com rcode=NOERROR rdata="Y29tbWFuZF9hY2s=
2026-07-27T11:04:15Z NETFLOW_OUT src=10.0.4.112:49812 dst=203.0.113.88:443 bytes=148200 proto=TCP flags=ACK,PSH

Which of the following findings accurately interpret these network security monitoring logs and represent effective mitigation steps? (Select TWO.)

Select all that apply

The pattern of periodic DNS TXT queries with encoded subdomain prefixes indicates DNS tunneling used for command-and-control (C2) communication or data staging.

Configuring DNS sinkholing or Response Policy Zone (RPZ) rules on the local recursive resolver provides immediate containment by blocking resolution of the malicious domain.

The log telemetry demonstrates a client-side Cross-Site Scripting (XSS) attack vector attempting to manipulate local database records via HTTP GET parameters.

Deploying a stateful host-based firewall rule to block all inbound UDP port 53 traffic to endpoint 10.0.4.112 is the primary control to prevent outgoing DNS queries.

Show answer & explanation

Answer: The pattern of periodic DNS TXT queries with encoded subdomain prefixes indicates DNS tunneling used for command-and-control (C2) communication or data staging.; Configuring DNS sinkholing or Response Policy Zone (RPZ) rules on the local recursive resolver provides immediate containment by blocking resolution of the malicious domain.

Answer

The telemetry indicates DNS tunneling for command-and-control (C2) beaconing, which is best contained by implementing DNS sinkholing or Response Policy Zone (RPZ) rules.

The correct options accurately identify the threat as DNS tunneling and select the appropriate remediation. DNS tunneling encodes binary command strings into DNS subdomains and TXT record responses, providing a covert C2 channel over standard port 53 traffic. DNS sinkholing (or RPZ) is the primary containment strategy because it intercepts resolution attempts for the adversary-controlled domain at the recursive resolver level.

Step-by-Step Solution

Analyze the DNS protocol behavior and query characteristics.

Identified high-frequency, randomized subdomain queries under a single domain (data-sync-update.com) requesting TXT records containing Base64-encoded strings at strict 60-second intervals.

Covert channels like DNS tunneling encode payload data into DNS subdomains or record fields to bypass perimeter firewall inspection.

Correlate DNS telemetry with outbound flow logs.

Confirmed outbound TCP connection spikes immediately following successful DNS TXT query responses.

The C2 agent receives instructions via DNS TXT record payloads and establishes secondary egress connections based on received commands.

Evaluate appropriate network monitoring containment strategies.

Select DNS sinkholing / Response Policy Zones (RPZ) at the internal resolver layer.

Sinkholing prevents the compromised host from resolving malicious C2 domains, isolating the host from external adversary control while logging blocked connection attempts.

Key Concept

DNS Tunneling Detection and DNS Sinkholing Mitigation

Estimated Time:2m 0s

Question 1397Question →

During a comprehensive governance realignment, a Chief Risk Officer (CRO) audits an organization's information security documentation structure. The audit reveals that operational teams frequently confuse discretionary advice with mandatory technical requirements, leading to inconsistent security controls across business units. To establish rigid governance boundaries across the enterprise, the CRO restructures the document architecture. Which of the following statements accurately characterize the structural hierarchy, mandatory nature, and operational scope of these security governance documents? (Select THREE).

Select all that apply

Security Policies serve as high-level, executive-approved directives that establish organizational security intent and management commitment, whereas Standards define mandatory technical specifications required to enforce those policies.

Security Baselines establish mandatory minimum-security configurations for specific asset classes, while Guidelines offer discretionary recommendations and operational flexibility.

Security Guidelines represent mandatory operational directives issued by technical custodians that system administrators must execute without exception during system deployment.

Security Procedures serve primarily as strategic, high-level detective controls that establish overall corporate risk appetite rather than step-by-step operational workflows.

Procedures provide mandatory, step-by-step instructions that operational personnel must follow sequentially to ensure consistent task execution aligned with enterprise standards.

Show answer & explanation

Answer: Security Policies serve as high-level, executive-approved directives that establish organizational security intent and management commitment, whereas Standards define mandatory technical specifications required to enforce those policies.; Security Baselines establish mandatory minimum-security configurations for specific asset classes, while Guidelines offer discretionary recommendations and operational flexibility.; Procedures provide mandatory, step-by-step instructions that operational personnel must follow sequentially to ensure consistent task execution aligned with enterprise standards.

Answer

The correct statements are those identifying Policies as top-level executive directives supported by mandatory technical Standards, Baselines as mandatory minimum configurations distinct from discretionary Guidelines, and Procedures as mandatory step-by-step operational instructions.

In security governance, Policies provide high-level mandatory executive management directives, supported by mandatory technical Standards. Baselines enforce mandatory uniform technical settings across asset types, while Guidelines offer non-mandatory advisory best practices. Procedures supply the explicit, step-by-step instructions operational teams must follow to satisfy standards.

Step-by-Step Solution

Analyze the policy hierarchy top layer (Policies and Standards)

Policies define high-level strategic objectives approved by executive leadership, while Standards define mandatory, measurable technical or operational rules required to achieve policy compliance.

Governance frameworks establish a strict chain of authority from strategic intent down to mandatory technical controls.

Evaluate technical configuration baselines versus advisory guidelines

Baselines set the mandatory minimum hardening standards for operating systems and devices, whereas Guidelines provide non-mandatory best practices and recommendations.

Distinguishing mandatory baselines from discretionary guidelines is essential to prevent operational ambiguity.

Examine operational workflow execution documents (Procedures)

Procedures are step-by-step operational documents detailing exact sequential tasks personnel must execute to meet standards and baselines.

Procedures ensure operational repeatability and procedural compliance across technical teams.

Synthesize and validate the correct options

The options describing Policy/Standard alignment, Baseline/Guideline distinction, and mandatory sequential Procedures accurately represent the governance framework.

Incorrect choices misclassify optional guidelines as mandatory directives or misrepresent operational procedures as strategic risk appetite declarations.

Key Concept

Security Governance Documentation Hierarchy (Policy, Standard, Baseline, Guideline, Procedure)

Question 1398Question →

A security analyst is recommending controls to address vulnerabilities discovered during a recent internal security review. Which of the following security actions represent examples of Risk Mitigation? (Select TWO.)

Select all that apply

Applying security updates and software patches to eliminate known operating system vulnerabilities.

Purchasing a comprehensive cyber liability insurance policy to cover potential breach financial losses.

Installing network intrusion prevention systems (IPS) to detect and block malicious traffic targeting internal servers.

Disabling and taking offline an unsupported web application to completely eliminate its associated attack surface.

Show answer & explanation

Answer: Applying security updates and software patches to eliminate known operating system vulnerabilities.; Installing network intrusion prevention systems (IPS) to detect and block malicious traffic targeting internal servers.

Answer

Risk Mitigation involves taking specific actions or deploying controls to reduce the probability or impact of a threat. Applying software patches and installing an Intrusion Prevention System (IPS) are both mitigation techniques.

Risk mitigation involves implementing controls and safeguards to lower the likelihood or impact of a security event while continuing the operational activity. Applying software patches closes known security holes, reducing vulnerability likelihood. Deploying an Intrusion Prevention System (IPS) actively blocks malicious activity, reducing risk impact and probability.

Step-by-Step Solution

Define Risk Mitigation

Identify that mitigation focuses on reducing risk likelihood or impact via controls and safeguards.

Risk mitigation aims to lessen the overall risk score without necessarily eliminating the underlying activity or transferring responsibility.

Evaluate option actions against risk response definitions

Patching systems reduces vulnerability exposure (Mitigation). Deploying an IPS blocks network attacks (Mitigation). Buying insurance shifts financial liability (Transfer). Decommissioning systems removes the risk source completely (Avoidance).

Categorizing each action clarifies which responses alter risk exposure directly through control implementation.

Key Concept

Risk Response Strategies (Mitigation vs. Transfer vs. Avoidance)

Estimated Time:45s

Question 1399Question →

A Security Operations Center (SOC) analyst is reviewing the following syslog sequence captured from a Linux bastion server:

Jul 27 14:15:02 sec-srv01 sshd[18420]: Failed password for invalid user admin from 198.51.100.45 port 42102 ssh2
Jul 27 14:15:05 sec-srv01 sshd[18422]: Failed password for invalid user admin from 198.51.100.45 port 42108 ssh2
Jul 27 14:15:09 sec-srv01 sshd[18425]: Failed password for valid user devops from 198.51.100.45 port 42115 ssh2
Jul 27 14:15:14 sec-srv01 sshd[18429]: Accepted publickey for devops from 198.51.100.45 port 42122 ssh2 RSA SHA256:7b+x...

Based on these log entries, which of the following events has occurred?

An external IP performed user enumeration and password attempts before successfully authenticating to a valid account using an SSH key pair.

The devops account successfully authenticated via public key and was automatically granted elevated administrative authorization on the local operating system.

The server blocked a SQL injection authentication bypass attack targeted against the local user database.

The log sequence represents a continuous network drop by the perimeter firewall due to invalid port assignments.

Show answer & explanation

Answer: An external IP performed user enumeration and password attempts before successfully authenticating to a valid account using an SSH key pair.

Answer

An external IP performed user enumeration and password attempts before successfully authenticating to a valid account using an SSH key pair.

The log sequence demonstrates an initial set of failed password authentication attempts from IP address 198.51.100.45 targeting invalid accounts ('admin') and a valid account ('devops'). The final entry shows a successful logon for the user 'devops' using an SSH RSA public key from the same source IP.

Step-by-Step Solution

Analyze the log entries sequentially by timestamp and event message.

Entries show repeated failed password attempts from IP 198.51.100.45 for both non-existent ('admin') and existing ('devops') accounts.

Tracking account names and failure statuses identifies initial password guessing or account scanning behavior.

Evaluate the final log entry in the sequence.

The final entry records 'Accepted publickey for devops' from the same IP address.

This confirms successful identity verification using SSH key authentication following the failed password attempts.

Key Concept

SSH Authentication Telemetry and Log Analysis

Question 1400Question →

An enterprise Endpoint Detection and Response (EDR) agent detects an unauthorized process attempting to read sensitive memory structures from the Local Security Authority Subsystem Service (LSASS) on a finance system host. In what sequence should the automated EDR response workflow process this security event from initial containment to post-incident analysis?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with detecting anomalous process behavior, followed by isolating the host via the EDR agent, terminating malicious processes and quarantining artifacts, and concludes with gathering forensic telemetry for fleet-wide IoC threat hunting.

The workflow follows standard EDR incident response methodology: first detect the malicious behavioral attempt on the endpoint, isolate the host to restrict lateral movement, kill malicious processes and quarantine binary components, and finally gather forensic telemetry to hunt for Indicators of Compromise (IoCs) enterprise-wide.

Step-by-Step Solution

Behavioral Alert Triggering

The EDR agent flags the LSASS memory access attempt as a high-severity alert.

Detection forms the entry point for automated incident playbooks.

Host Containment & Isolation

Network traffic to and from the host is restricted except for the security agent control server.

Isolating the endpoint prevents the attacker from utilizing dumped credentials laterally while investigation proceeds.

Active Mitigation & Artifact Quarantine

The rogue process handle is killed and file modifications are moved to secure quarantine.

Terminating process handles halts local code execution after network propagation risk is mitigated.

Forensic Telemetry & Fleet Hunting

Memory state telemetry is collected and IOC hashes are searched across all endpoints.

Broad threat hunting ensures the adversary has not established duplicate persistence on adjacent hosts.

Key Concept

Endpoint Detection and Response (EDR) Automated Containment and Remediation Workflow

PreviousPage 70 / 112Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept