Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1401Question →

An enterprise Security Operations Center (SOC) detects unauthorized execution of encryption software across several internal host systems. Place the following incident response playbook actions in the correct chronological order according to NIST SP 800-61 guidelines, starting from initial detection.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of incident response lifecycle steps is: 1) Validate initial alert and scope, 2) Isolate affected network subnet, 3) Terminate processes and purge artifacts, 4) Restore hosts from clean backups, and 5) Hold a post-incident review meeting.
According to standard NIST SP 800-61 guidelines, incident response follows a strict linear sequence: Detection and Analysis (scoping the incident), Containment (isolating affected network segments), Eradication (purging malicious binaries and persistence hooks), Recovery (restoring systems from clean backups), and Post-Incident Activity (documenting lessons learned).

Step-by-Step Solution

1
Analyze telemetry and validate the incident.
Confirm indicators of compromise and scope of affected host systems.
Accurate scope identification ensures containment measures target all affected systems without prematurely interrupting unaffected services.
2
Implement network containment controls.
Prevent active encryption threats from spreading laterally.
Stopping lateral movement and C2 communication limits potential operational damage.
3
Execute eradication actions.
Eliminate malware binaries, malicious persistence hooks, and unauthorized access.
Systems cannot be restored safely until threat actor access mechanisms and malware are completely removed.
4
Perform system recovery.
Rebuild or restore endpoints from verified, uncompromised backups.
Restoring validated clean states ensures business continuity without reintroducing hidden compromise.
5
Conduct post-incident review.
Document lessons learned and update Incident Response playbooks.
Analyzing response performance identifies procedural gaps and prevents recurrence of similar incidents.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Phases
Question 1402Question →

A security administrator needs to ensure that all newly deployed enterprise servers strictly adhere to a standardized, hardened set of initial operational settings prior to production release. Which of the following should the administrator implement to establish these standardized settings?

Show answer & explanation

Answer: A security configuration baseline profile

Answer

The administrator should implement a security configuration baseline profile, which establishes standardized, pre-approved hardening settings for newly deployed systems.
A configuration baseline profile defines a mandatory minimum standard for operating systems and applications, ensuring consistent hardening across all deployed assets.

Step-by-Step Solution

1
Identify the goal in the scenario
The requirement is to define standard, hardened security settings across all newly deployed systems.
The system lifecycle requires consistent initial configurations to prevent security weaknesses before systems enter production.
2
Evaluate potential configuration management tools
A security configuration baseline defines the standard minimum security setup (e.g., CIS benchmarks, DISA STIGs) for systems.
Baselines ensure uniformity, simplify drift monitoring, and minimize misconfigurations.

Key Concept

Security Baselines and Configuration Management
Question 1403Question →

A network security analyst is reviewing real-time alert logs from a Network Intrusion Detection System (NIDS). The analyst spots an alert flagging an HTTP GET request containing the following parameter string: GET /products.php?id=1%20UNION%20SELECT%20username,%20password%20FROM%20users--. Which of the following attack types has been detected by this monitoring alert?

Show answer & explanation

Answer: SQL injection

Answer

SQL injection
The network monitoring alert log contains standard database query keywords (`UNION SELECT`), which indicates an attempt to extract data directly from a backend database engine via SQL injection.

Step-by-Step Solution

1
Analyze the payload string reported in the NIDS alert log.
Identified database query keywords `UNION SELECT username, password FROM users--` within the HTTP GET request.
Network monitoring alerts provide packet or URI details that indicate the nature of the payload.
2
Match the payload features to known web application exploit vectors.
Recognized SQL query syntax designed to append unauthorized queries to existing database commands.
SQL syntax injected via input parameters characterizes a SQL injection attempt.

Key Concept

Identifying attack signatures in network intrusion detection logs
Estimated Time:45s
Question 1404Question →

A Security Operations Center (SOC) team is configuring an automated Security Orchestration, Automation, and Response (SOAR) playbook to handle suspicious email attachments reported by end users. Place the following playbook execution steps in the correct operational sequence from initial alert ingestion to final incident closure.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Parse the email artifact to extract IOCs, 2) Query threat intelligence feeds via APIs for reputation data, 3) Evaluate conditional branching logic against policy thresholds, 4) Execute automated response actions (email quarantine and host isolation), and 5) Update the ticketing system and notify the SOC team.
Automated incident response playbooks follow a structured lifecycle: Ingestion/Parsing → Enrichment → Decision Evaluation → Remediation → Documentation. The playbook must first parse the reported email to identify specific indicators of compromise. It then enriches those indicators using threat intelligence APIs. Next, it evaluates conditional logic to confirm threat thresholds. Once confirmed, automated containment (such as mailbox quarantine and endpoint isolation) takes place. Finally, the playbook logs all actions in the ticketing system and notifies analysts.

Step-by-Step Solution

1
Parse and Extract Indicators
Raw file hashes, domain names, and IP addresses are extracted from the raw email header and payload.
SOAR automation cannot query threat intelligence tools or execute targeted actions without specific extracted artifacts.
2
Perform Threat Intelligence Enrichment
Reputation scores and threat categories are added to the incident context via API integrations.
Contextual intelligence provides the factual basis needed for automated decision-making.
3
Evaluate Playbook Decision Rules
The workflow determines whether risk criteria match automated containment conditions or require human analyst intervention.
Policy rules prevent accidental execution of intrusive containment actions on benign or unverified alerts.
4
Run Automated Mitigation Actions
The malicious email is purged/quarantined across all mailboxes, and impacted endpoints are logically isolated.
Neutralizing active threats prevents lateral movement and protects the enterprise footprint.
5
Document Findings and Notify Analysts
The incident ticket is updated with execution logs and alerted to security analysts for review.
Proper documentation ensures compliance, tracking, and seamless handoff to human analysts if further investigation is needed.

Key Concept

SOAR Playbook Workflow Sequencing
Estimated Time:1m 30s
Question 1405Question →

During a security evaluation of a segmented payment processing environment, an analyst runs an automated vulnerability assessment against a cluster of Linux servers holding cardholder data. The final report lists open network ports and service banners, but fails to identify installed software patch levels or local kernel flaws. Further inspection reveals that administrative SSH credentials were properly entered into the scanner configuration, but network access control lists blocked SSH protocol traffic while permitting HTTPS traffic between the scanner and targets. Which of the following best accounts for the missing host-level vulnerability data in the final report?

Show answer & explanation

Answer: The scanner fell back to an uncredentialed network assessment because it could not establish an SSH management session to query local package management databases.

Answer

The missing host-level vulnerability data occurred because the scanner fell back to an uncredentialed network assessment after network access control lists blocked its SSH authentication session.
Credentialed vulnerability scans require an active administrative session (such as SSH for Linux or WMI/WinRM for Windows) to inspect internal system configurations, patch levels, and installed packages. When network access control lists block the required protocol port, the scanner cannot authenticate and silently falls back to an uncredentialed network scan. Consequently, it can only report externally visible information like open ports and service banners, omitting internal host-level vulnerabilities.

Step-by-Step Solution

1
Analyze the scanner configuration and network path parameters in the scenario.
Administrative SSH credentials were configured on the scanner, but network ACLs blocked SSH traffic while allowing HTTPS traffic.
Establishing a credentialed scan requires successful end-to-end network connectivity on the administrative protocol (SSH port 22).
2
Evaluate how vulnerability scanners handle authentication session failure.
When authentication protocol traffic is blocked by a network firewall or ACL, the scanner cannot authenticate locally and degrades to an uncredentialed network probe.
Uncredentialed network scans rely only on banner grabbing and exposed network services, missing local OS patch states, file permissions, and kernel vulnerabilities.
3
Select the option that accurately describes this scanner fallback behavior.
The option explaining that the scanner defaulted to an uncredentialed network assessment due to failed SSH connectivity is correct.
It directly links the network ACL restriction on SSH to the absence of host-level patch and package vulnerability findings.

Key Concept

Credentialed vs. Uncredentialed Vulnerability Scanning
Question 1406Question →

A healthcare organization is conducting a quantitative risk assessment for its primary electronic health record (EHR) database cluster, valued at 6,000,0006,000,000. Threat intelligence data indicates that a major ransomware breach has an Annual Rate of Occurrence (ARO) of 0.200.20 with an Exposure Factor (EF) of 0.350.35. To mitigate this risk, the organization evaluates an automated air-gapped immutable backup vault with an annual operating cost of 110,000110,000. This safeguard will reduce the system's Exposure Factor to 0.050.05 while keeping the ARO unchanged. Based on a quantitative risk analysis, what is the net annual financial benefit of implementing this safeguard?

Show answer & explanation

Answer: 250,000250,000

Answer

The net annual financial benefit of implementing the safeguard is 250,000250,000.
The correct answer is 250,000250,000. Calculating quantitative risk requires establishing Baseline ALE (6,000,000×0.35×0.20=6,000,000 \times 0.35 \times 0.20 = 420,000 )andPost−MitigationALE() and Post-Mitigation ALE ( 6,000,000 \times 0.05 \times 0.20 = 60,00060,000). The difference between baseline and post-mitigation ALE is 360,000360,000 in gross savings. Subtracting the annual safeguard cost of 110,000110,000 yields a net annual financial benefit of 250,000250,000.

Step-by-Step Solution

1
Calculate the baseline Single Loss Expectancy (SLE) and Annual Loss Expectancy (ALE) prior to safeguard implementation.
Baseline SLE=$6,000,000×0.35=$2,100,000\text{SLE} = \$6,000,000 \times 0.35 = \$2,100,000. Baseline ALE=$2,100,000×0.20=$420,000\text{ALE} = \$2,100,000 \times 0.20 = \$420,000.
Establishing the initial unmitigated risk exposure establishes the benchmark loss expected per year.
2
Calculate the post-mitigation Single Loss Expectancy (SLE) and Annual Loss Expectancy (ALE).
Post-mitigation SLE=$6,000,000×0.05=$300,000\text{SLE} = \$6,000,000 \times 0.05 = \$300,000. Post-mitigation ALE=$300,000×0.20=$60,000\text{ALE} = \$300,000 \times 0.20 = \$60,000.
Determining the residual loss expected after deploying the safeguard.
3
Calculate the annual gross risk reduction (gross ALE savings).
Gross ALE Savings =Baseline ALE−Post-mitigation ALE=$420,000−$60,000=$360,000= \text{Baseline ALE} - \text{Post-mitigation ALE} = \$420,000 - \$60,000 = \$360,000.
Isolating the gross financial risk avoided due to control implementation.
4
Subtract the annualized cost of the safeguard from the gross ALE savings to determine net benefit.
Net Benefit =$360,000−$110,000=$250,000= \$360,000 - \$110,000 = \$250,000.
Evaluating safeguard cost-justification by comparing gross loss avoidance against recurring operational cost.

Key Concept

Quantitative Risk Assessment and Safeguard Cost-Benefit Analysis (ALE = SLE * ARO = AV * EF * ARO)
Estimated Time:3m 0s
Question 1407Question →

A security analyst is reviewing correlated events in a SIEM console generated from cloud audit logs:

text
[2026-07-27T10:14:22Z] AWS CloudTrail: eventName=ConsoleLogin, userIdentity=arn:aws:iam::123456789012:user/jdoe, sourceIPAddress=198.51.100.45, responseElements={ConsoleLogin=Success}, additionalEventData={MFAUsed=No}
[2026-07-27T10:14:25Z] AWS CloudTrail: eventName=CreateAccessKey, userIdentity=arn:aws:iam::123456789012:user/jdoe, sourceIPAddress=198.51.100.45, responseElements={accessKey={accessKeyId=AKIAIOSFODNN7EXAMPLE}}
[2026-07-27T10:15:01Z] AWS CloudTrail: eventName=DescribeInstances, userIdentity=arn:aws:iam::123456789012:user/jdoe, sourceIPAddress=203.0.113.88, userAgent=aws-cli/2.11.0

Based on the log sequence provided, which of the following conclusions and immediate mitigation steps are correct? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The compromised identity logged into the console without multi-factor authentication before creating a persistent programmatic access key.; The incident response process should immediately revoke active IAM user sessions and deactivate access key AKIAIOSFODNN7EXAMPLE.

Answer

The correct conclusions and actions are that the user identity was authenticated without MFA prior to creating a programmatic access key, and that responders must deactivate access key AKIAIOSFODNN7EXAMPLE and revoke active user sessions.
The CloudTrail log sequence demonstrates that account `jdoe` logged into the management console without MFA (`MFAUsed=No`) and immediately created a long-term API access key (`AKIAIOSFODNN7EXAMPLE`). Shortly thereafter, that generated access key was utilized from a different IP address (`203.0.113.88`) to perform infrastructure enumeration (`DescribeInstances`). Effective incident containment requires deactivating the compromised access key and invalidating all active user sessions.

Step-by-Step Solution

1
Analyze the ConsoleLogin log telemetry
Identified that user `jdoe` authenticated successfully from IP `198.51.100.45` with `MFAUsed=No`.
Single-factor console login represents a primary vulnerability indicator in administrative audit trails.
2
Correlate chronologically subsequent API calls
Observed key generation (`CreateAccessKey` ID `AKIAIOSFODNN7EXAMPLE`) 3 seconds post-login, followed by AWS CLI recon (`DescribeInstances`) from a secondary IP (`203.0.113.88`).
Sequencing shows post-compromise persistence creation and immediate secondary IP access using programmatic credentials.
3
Determine containment requirements
Containment requires invalidating generated credentials (`AKIAIOSFODNN7EXAMPLE`) and terminating active session tokens.
Invalidating the key stops external CLI access, and revoking sessions prevents ongoing console persistence.

Key Concept

Cloud Audit Log Analysis and SIEM Event Correlation
Question 1408Question →

An organization is establishing a direct, dedicated network connection between its data center and a business partner's network to exchange sensitive data continuously. Which of the following agreements specifically documents the technical security requirements, encryption controls, and interface parameters for this direct connection?

Show answer & explanation

Answer: Interconnection Security Agreement (ISA)

Answer

Interconnection Security Agreement (ISA)
An Interconnection Security Agreement (ISA) is specifically designed to document the technical and security parameters for a direct connection between two dedicated systems or networks, ensuring both organizations maintain agreed-upon security controls.

Step-by-Step Solution

1
Identify the core requirement in the scenario
The scenario requires establishing specific technical and security requirements for a direct network link between two organizations.
Different third-party agreements serve distinct operational, legal, and technical functions.
2
Evaluate agreement types against the technical requirements
An Interconnection Security Agreement (ISA) specifically governs direct network and system linkages, documenting security controls, encryption, and technical interface boundaries.
Other agreements focus on confidentiality (NDA), performance metrics (SLA), or high-level cooperative intent (MOU).

Key Concept

Third-Party Interconnection Security Agreements
Question 1409Question →

An enterprise security architect is designing an Identity and Access Management (IAM) architecture for a hybrid enterprise environment. To align with modern Zero Trust principles, the system must evaluate real-time context—such as user risk score, device compliance state, and access location—before granting access to sensitive cloud databases, rather than trusting users based on network location. Which architectural component in this framework is directly responsible for evaluating these dynamic context attributes against enterprise security policies to render an access decision?

Show answer & explanation

Answer: Policy Decision Point (PDP)

Answer

Policy Decision Point (PDP)
In Zero Trust identity architectures, the Policy Decision Point (PDP) examines subject attributes, requested resources, and real-time environmental context against security policies to produce authorization decisions.

Step-by-Step Solution

1
Identify the core requirement in the scenario.
The requirement specifies evaluating dynamic context (device posture, user risk score, location) against security policies to make authorization decisions.
Distinguishing policy evaluation logic from policy enforcement and credential storage isolates the responsible component.
2
Map the requirement to standard Zero Trust IAM architectural roles.
The component that executes policy rules to yield a grant/deny outcome is the Policy Decision Point (PDP).
In Zero Trust architecture, the PDP acts as the centralized engine responsible for rendering access decisions before passing them to enforcement mechanisms.

Key Concept

Zero Trust IAM Architecture and Policy Decision Points (PDP)
Question 1410Question →

Match each security governance document type to its corresponding operational characteristic within an enterprise governance framework.

Click a left item, then click its matching right item

Items

Security Policy
Security Standard
Security Guideline
Security Baseline

Matches

Show answer & explanation

Answer

Security Policy matches the high-level directive statement; Security Standard matches the mandatory compliance requirement; Security Guideline matches the discretionary advice; Security Baseline matches the minimum configuration threshold.
In security governance, documents follow a formal hierarchy: Policies provide top-down executive leadership direction; Standards define mandatory procedural and technical requirements; Guidelines offer non-binding best practice advice; and Baselines establish minimum security build configurations for IT assets.

Step-by-Step Solution

1
Identify mandatory versus non-mandatory governance documents.
Guidelines are non-mandatory (discretionary), while policies, standards, and baselines are mandatory.
Governance frameworks explicitly distinguish between mandatory directives and discretionary recommendations.
2
Differentiate high-level strategic directives from implementation-level controls.
Policies reflect executive management intent, whereas standards and baselines detail specific rules and minimum system settings.
Document hierarchy ranges from high-level management objectives down to technical implementation parameters.
3
Map each term to its specific operational definition.
Pair Policy with high-level directive, Standard with mandatory course of action, Guideline with discretionary advice, and Baseline with minimum security configuration.
Each document type fulfills a distinct level of governance within the organizational hierarchy.

Key Concept

Security Governance Document Hierarchy and Enforceability
Question 1411Question →

An analyst is configuring an automated Security Orchestration, Automation, and Response (SOAR) playbook to respond to API token abuse detected by a SIEM. The playbook must automatically mitigate active malicious access while minimizing operational disruption to critical cloud workloads. Which of the following automated actions should be incorporated into the playbook containment workflow? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Revoke the affected API access token via API calls to the Identity and Access Management (IAM) provider.; Quarantine active user sessions associated with the compromised credential to force re-authentication.

Answer

The correct automated containment actions are revoking the compromised API access token via IAM integration and quarantining active user sessions associated with the credential to force re-authentication.
Automated SOAR playbooks should execute targeted actions that eliminate unauthorized access without causing broad outages. Revoking the specific compromised API access token directly removes the attacker's entry mechanism. Simultaneously, invalidating active sessions associated with the user account forces re-authentication, preventing further exploitation while limiting operational impact to unaffected systems.

Step-by-Step Solution

1
Identify targeted containment controls for API token compromise.
Disabling the specific revoked token stops unauthorized API requests directly at the identity layer.
Targeted token revocation neutralizes the active threat vector immediately without impacting other infrastructure.
2
Enforce session invalidation.
Terminating active sessions linked to the identity prevents persistent session exploitation.
Forcing re-authentication validates user identity while cutting off stolen session tokens.
3
Evaluate potential side effects of over-broad automated actions.
Shutting down core API gateways creates self-inflicted downtime, while escalating roles increases security risks.
SOAR playbooks must balance automated response speed with service availability and least privilege principles.

Key Concept

SOAR Automated Containment and Playbook Safety Controls
Question 1412Question →

A healthcare organization is conducting a quantitative risk assessment on an unencrypted portable diagnostic platform. The total asset value (AVAV), including sensitive data asset valuation and regulatory non-compliance exposure, is estimated at $600,000\$600,000. Security metrics indicate that a single breach incident would impact 30%30\% of the asset's total value (EF=0.30EF = 0.30). Historical threat intelligence indicates that this specific type of breach occurs once every 44 years (ARO=0.25ARO = 0.25).

What is the Annual Loss Expectancy (ALEALE) in dollars associated with this security risk?

Show answer & explanation

Answer: 45000

Answer

The Annual Loss Expectancy (ALE) for the portable diagnostic platform is $45,000.
Quantitative risk analysis calculates financial risk using the formulas SLE=AV×EFSLE = AV \times EF and ALE=SLE×AROALE = SLE \times ARO. Given an asset value (AVAV) of $600,000\$600,000 and an exposure factor (EFEF) of 0.300.30, the Single Loss Expectancy (SLESLE) is $180,000\$180,000. With an event frequency of once every 4 years (ARO=0.25ARO = 0.25), the resulting Annual Loss Expectancy (ALEALE) is $180,000×0.25=$45,000\$180,000 \times 0.25 = \$45,000.

Step-by-Step Solution

1
Calculate the Single Loss Expectancy (SLE)
$180,000
Multiply the total Asset Value ($600,000) by the Exposure Factor (0.30).
2
Determine the Annualized Rate of Occurrence (ARO)
0.25
An incident expected once every 4 years has an annual frequency of 1/4 = 0.25.
3
Calculate the Annual Loss Expectancy (ALE)
$45,000
Multiply the SLE ($180,000) by the ARO (0.25).

Key Concept

Quantitative Risk Assessment (ALE Calculation)
Question 1413Question →

A incident response analyst is performing evidence collection on a live enterprise server following an intrusion alert. According to the Order of Volatility standard, in what sequence should the analyst acquire the evidence sources, ordered from most volatile to least volatile?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from most volatile to least volatile is: CPU registers and L1/L2 cache memory, followed by System RAM and active ARP routing tables, then Local solid-state persistent disk storage, and lastly Off-site archival backup tapes.
Forensic evidence acquisition follows RFC 3227 Order of Volatility: CPU registers and cache (most volatile) -> System RAM and network cache -> Local persistent disk storage -> Off-site archival backup tapes (least volatile).

Step-by-Step Solution

1
Assess the volatility of processor-level data structures.
CPU registers and caches change at nanosecond speeds and clear immediately upon CPU halt.
Processor memory represents the highest volatility tier in digital forensics.
2
Assess the volatility of main memory and active state information.
System RAM and ARP/routing caches hold volatile dynamic runtime data.
This data remains intact only while power is continuously supplied to the host.
3
Assess the volatility of local secondary storage media.
Local SSD and magnetic drives hold non-volatile data files.
Disk contents persist on physical media even after host power is removed.
4
Assess the volatility of offline long-term archives.
Archival backup tapes contain static snapshot data.
Offline backup media changes least frequently and retains data indefinitely.

Key Concept

Order of Volatility (RFC 3227)
Question 1414Question →

An IT manager wants to issue recommendations and practical advice to help remote employees secure their home Wi-Fi networks. The document provides optional best practices rather than mandatory operational requirements. Which type of security governance document should the IT manager publish?

Show answer & explanation

Answer: Security guideline

Answer

Security guideline
Security guidelines provide non-mandatory best practices and recommendations that help users achieve security goals without imposing strict compulsory rules.

Step-by-Step Solution

1
Analyze the nature of the documentation requirement in the scenario.
The scenario describes optional advice and best-practice recommendations rather than mandatory operational constraints.
Governance documents are categorized based on whether their contents are mandatory or discretionary.
2
Match the requirement to the appropriate security governance document type.
Guidelines are non-mandatory, discretionary documents providing guidance and recommended practices.
Policies, standards, and baselines all enforce mandatory compliance, whereas guidelines provide non-binding recommendations.

Key Concept

Distinguishing between mandatory governance documents (Policies, Standards, Baselines) and discretionary governance documents (Guidelines).
Estimated Time:45s
Question 1415Question →

A security analyst is implementing an out-of-band security patch for a critical database cluster following the discovery of an actively exploited zero-day vulnerability. Arrange the following steps of the emergency patch management process in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for emergency patch deployment is: 1) Validate patch authenticity and execute sandbox testing in staging, 2) Submit an Emergency Change Request with a rollback plan, 3) Deploy the patch to the production database cluster, 4) Perform post-implementation vulnerability scanning and health checks, and 5) Update the CMDB and system security baseline image.
The standard emergency patch management lifecycle follows a strict sequence to balance urgent vulnerability mitigation with operational risk management. First, validating and testing the patch in an isolated sandbox ensures it does not destabilize the software ecosystem. Second, submitting an Emergency Change Request (ECR) with a rollback strategy maintains change control governance. Third, the patch is deployed to production systems once approved. Fourth, post-implementation vulnerability scans and service health checks confirm the flaw is resolved without side effects. Finally, updating the CMDB records and baseline images preserves configuration integrity and prevents drift during future node provisioning.

Step-by-Step Solution

1
Perform initial pre-deployment testing and signature verification in a non-production environment.
The patch is verified as genuine and free from breaking application dependencies.
Applying unverified patches directly to production risks outage or malware injection.
2
Obtain formal emergency authorization via Emergency Change Advisory Board (ECAB).
Authorized emergency change ticket with mandatory fallback/rollback procedures established.
Change control governance prevents unauthorized alterations and ensures back-out plans exist.
3
Execute the patch deployment across production nodes.
Production servers receive and install the patch binaries.
Implementation executes the authorized changes on live production systems.
4
Conduct post-deployment validation scans and monitoring.
Confirmation that the target flaw is remediated and no regression issues exist.
Integrity checks confirm successful threat mitigation before closing the incident ticket.
5
Reconcile configuration management records and baseline artifacts.
CMDB and golden image templates reflect the new version compliance standard.
Updating baselines prevents future automated provisioning from reverting systems to an unpatched state.

Key Concept

Emergency Patch and Configuration Management Lifecycle
Question 1416Question →

An enterprise cloud security engineering team is updating its operational documentation following a compliance review. Executive leadership has already established an overarching Information Security Policy mandating baseline security hygiene and risk minimization across all enterprise workloads. To operationalize this directive for system deployments, the team needs to publish a document detailing the mandatory minimum security configuration parameters—such as specific SSH cipher suites, disabled unneeded services, and firewall rule defaults—that every Linux virtual machine must satisfy before launch. Which of the following governance document types should the team publish to establish these minimum configuration requirements?

Show answer & explanation

Answer: Security baseline

Answer

Security baseline
A security baseline specifies the mandatory minimum technical hardening settings required for a particular operating system, application, or network device. Because the engineering team is publishing exact OS parameters (such as SSH ciphers and disabled services) that all Linux virtual machines must meet before deployment, the document represents a technical security baseline.

Step-by-Step Solution

1
Analyze the scope and intent of the required security document described in the scenario.
The requirement specifies mandatory, technical, system-level minimum security parameters (e.g., SSH cipher suites, disabled services) for newly provisioned Linux virtual machines.
Governance documents are categorized by their level of abstraction, authority, and enforceability.
2
Evaluate the document types within the security governance hierarchy.
High-level policies govern organizational directives; standards establish mandatory rules; guidelines offer optional recommendations; baselines set minimum technical configuration standards for specific systems.
Identifying the specific level of technical detail distinguishes baselines from higher-level policy directives.
3
Select the governance document type that matches mandatory minimum OS configuration settings.
A security baseline is the correct designation for platform-specific minimum hardening requirements.
Baselines serve as the functional reference configuration for hardening operating systems before production use.

Key Concept

Security Governance Hierarchy (Policy vs. Standard vs. Baseline vs. Guideline)
Question 1417Question →

An enterprise organization is conducting a third-party risk assessment of a key managed service provider (MSP). The security evaluation reveals that the MSP routes sensitive telemetry data over a dedicated, persistent network connection to a secondary facility operated by a fourth-party subcontractor. The enterprise security manager requires the technical security controls, data encryption rules, and interface boundaries for this specific direct network connection to be formally documented and enforced. Which of the following agreements should be established between the MSP and the fourth-party provider to meet this requirement?

Show answer & explanation

Answer: Interconnection Security Agreement (ISA)

Answer

Interconnection Security Agreement (ISA)
An Interconnection Security Agreement (ISA) is specifically intended to regulate technical security requirements, data encryption protocols, user access boundaries, and operational procedures for direct electronic connections between separate networks or organizations.

Step-by-Step Solution

1
Analyze the scenario requirement
Identified the need for a legal and technical document that defines parameters for a direct, persistent network link between distinct organizations.
The enterprise requires explicit documentation of technical security controls, encryption, and interface boundaries across a vendor-to-subcontractor network link.
2
Evaluate agreement types against third-party risk management principles
An Interconnection Security Agreement (ISA) specifically addresses system-to-system connections, technical requirements, security baselines, and data transmission controls.
Other vendor contracts focus on business terms (BPA), uptime/performance metrics (SLA), or confidentiality obligations (NDA) rather than technical network interconnect security.
3
Select the correct third-party risk document
The Interconnection Security Agreement (ISA) is the proper choice for governing persistent network interconnections.
It fulfills security governance requirements for fourth-party supply chain connection oversight.

Key Concept

Third-Party Interconnection Security Governance
Estimated Time:1m 30s
Question 1418Question →

An organization is preparing to onboard a new software-as-a-service (SaaS) vendor to process sensitive financial records. Which of the following activities are essential steps in performing third-party risk management and supply chain oversight during vendor assessment? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Reviewing the vendor's SOC 2 Type II report to evaluate operational security controls over an extended period; Requesting and analyzing the vendor's Software Bill of Materials (SBOM) to verify third-party library dependencies

Answer

Reviewing the vendor's SOC 2 Type II report and analyzing the vendor's Software Bill of Materials (SBOM) are key elements of third-party risk management and supply chain oversight.
Reviewing independent audit attestations like SOC 2 Type II reports verifies that the vendor maintains effective security controls over time. Evaluating a Software Bill of Materials (SBOM) provides critical visibility into open-source components and software supply chain vulnerabilities.

Step-by-Step Solution

1
Identify effective third-party governance mechanisms
Independent audit attestations (SOC 2 Type II) confirm that operational security controls work continuously over time.
Third-party risk management relies on independent verification of security posture.
2
Identify software supply chain integrity controls
Obtaining an SBOM allows the organization to track nested dependencies and mitigate supply chain vulnerabilities.
Supply chain oversight requires visibility into embedded third-party libraries and packages.

Key Concept

Third-Party Risk Management and Supply Chain Oversight
Question 1419Question →

During routine operational monitoring of a Linux web application server hosting a customer portal, a security analyst identifies an unauthorized web shell script placed in the web root. Log entries confirm an external attacker is currently executing remote commands through the web shell to perform local privilege escalation. According to standard incident response procedures, which of the following actions should the security analyst take FIRST?

Show answer & explanation

Answer: Isolate the web application server from the network to prevent further unauthorized command execution and lateral movement.

Answer

Isolate the web application server from the network to prevent further unauthorized command execution and lateral movement.
In standard incident response frameworks (such as NIST SP 800-61), once an active incident is detected and analyzed, the immediate next step is Containment. Isolating the server from the network stops the attacker from continuing active remote command execution and prevents lateral movement into adjacent subnets.

Step-by-Step Solution

1
Analyze the scenario state within the Incident Response lifecycle framework.
The incident has been detected and analyzed; an active web shell is executing commands in real time.
Determining the current phase of the incident establishes the required sequence of technical actions.
2
Identify the immediate operational priority for an active compromise.
Containment must be executed immediately to restrict attacker access, stop ongoing command execution, and prevent lateral movement.
According to NIST SP 800-61 guidelines, containment limits incident damage before moving to root-cause removal.
3
Select the action that aligns with the containment phase.
Isolating the server from the network halts active attacker sessions while preserving system state for analysis and subsequent remediation.
Network isolation prevents external command and control traffic while keeping volatile evidence intact.

Key Concept

Incident Response Lifecycle Phase Ordering (Containment prior to Eradication and Recovery)
Estimated Time:1m 30s
Question 1420Question →

An organization is evaluating a security safeguard for a facility control system valued at 150,000.Threatmodelingindicatesamajorsecuritycompromiseoccursonceevery5years(150,000. Threat modeling indicates a major security compromise occurs once every 5 years ( ARO = 0.20 ),resultinginanExposureFactor(), resulting in an Exposure Factor ( EF )of40) of 40%. The organization plans to deploy an inline monitoring gateway with an annual operating cost of 7,000, which will reduce the post-control Exposure Factor to 5% while keeping the ARO unchanged. What is the net annual financial savings realized by implementing this security control?

Show answer & explanation

Answer: $3,500

Answer

The net annual financial savings realized by implementing the control is $3,500.
The correct answer is obtained by conducting a quantitative risk cost-benefit analysis. Baseline pre-control annual loss expectation is AV×EF×ARO=$150,000×0.40×0.20=$12,000AV \times EF \times ARO = \$150,000 \times 0.40 \times 0.20 = \$12,000. With the security safeguard deployed, post-control ALE becomes $150,000×0.05×0.20=$1,500\$150,000 \times 0.05 \times 0.20 = \$1,500. The reduction in annual expected risk loss is $12,000−$1,500=$10,500\$12,000 - \$1,500 = \$10,500. Subtracting the annual safeguard maintenance cost of $7,000\$7,000 yields a net annual financial savings of $3,500\$3,500.

Step-by-Step Solution

1
Calculate pre-control Single Loss Expectancy (SLE) and Annual Loss Expectancy (ALE)
Pre-control SLE = 150,000∗0.40=150,000 * 0.40 = 60,000. Pre-control ALE = 60,000∗0.20=60,000 * 0.20 = 12,000.
Determining baseline expected annual loss prior to safeguard installation is required for cost-benefit evaluation.
2
Calculate post-control Single Loss Expectancy (SLE) and Annual Loss Expectancy (ALE)
Post-control SLE = 150,000∗0.05=150,000 * 0.05 = 7,500. Post-control ALE = 7,500∗0.20=7,500 * 0.20 = 1,500.
Quantifying residual risk after control implementation identifies the remaining expected annual loss.
3
Determine gross ALE reduction and subtract annual safeguard cost for net savings
Gross ALE Reduction = 12,000−12,000 - 1,500 = 10,500.NetAnnualSavings=10,500. Net Annual Savings = 10,500 - 7,000=7,000 = 3,500.
Net savings measures the true financial benefit of implementing the safeguard after offsetting its operational cost.

Key Concept

Quantitative Risk Assessment and Safeguard Cost-Benefit Analysis
PreviousPage 71 / 112Next
All practice questions — CompTIA Security+ | Examkin