Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1421Question →

A Chief Information Security Officer (CISO) is conducting a quantitative risk assessment for a legacy customer database server with an estimated Asset Value (AVAV) of $600,000\$600,000. Threat metrics indicate an Annual Rate of Occurrence (AROARO) of 0.250.25 for unauthorized data extraction attacks. Without additional security controls, the Exposure Factor (EFEF) for a successful compromise is 0.400.40.

To mitigate this risk, the organization evaluates deploying an Endpoint Detection and Response (EDR) solution combined with network microsegmentation. This countermeasure costs $12,000\$12,000 annually to license and manage, and it reduces the Exposure Factor (EFEF) to 0.050.05 while leaving the AROARO unchanged.

What is the net annual cost benefit of implementing this countermeasure?

Show answer & explanation

Answer: $40,500\$40,500

Answer

The net annual cost benefit of implementing the safeguard is $40,500\$40,500.
To calculate net annual cost benefit, compare the baseline annualized risk (ALEpreALE_{pre}) with post-mitigation annualized risk (ALEpostALE_{post}) and control operational expenditure:

1. SLEpre=$600,000×0.40=$240,000SLE_{pre} = \$600,000 \times 0.40 = \$240,000
2. ALEpre=$240,000×0.25=$60,000ALE_{pre} = \$240,000 \times 0.25 = \$60,000
3. SLEpost=$600,000×0.05=$30,000SLE_{post} = \$600,000 \times 0.05 = \$30,000
4. ALEpost=$30,000×0.25=$7,500ALE_{post} = \$30,000 \times 0.25 = \$7,500
5. Net Benefit = ALEpre−ALEpost−Safeguard Cost=$60,000−$7,500−$12,000=$40,500ALE_{pre} - ALE_{post} - \text{Safeguard Cost} = \$60,000 - \$7,500 - \$12,000 = \$40,500.

Thus, implementing the countermeasure yields a net annual financial benefit of $40,500\$40,500.

Step-by-Step Solution

1
Calculate the pre-control Single Loss Expectancy (SLEpreSLE_{pre}) and Annual Loss Expectancy (ALEpreALE_{pre}).
SLEpre=$600,000×0.40=$240,000SLE_{pre} = \$600,000 \times 0.40 = \$240,000; ALEpre=$240,000×0.25=$60,000ALE_{pre} = \$240,000 \times 0.25 = \$60,000.
Determines the baseline expected financial loss per year before implementing controls.
2
Calculate the post-control Single Loss Expectancy (SLEpostSLE_{post}) and Annual Loss Expectancy (ALEpostALE_{post}).
SLEpost=$600,000×0.05=$30,000SLE_{post} = \$600,000 \times 0.05 = \$30,000; ALEpost=$30,000×0.25=$7,500ALE_{post} = \$30,000 \times 0.25 = \$7,500.
Determines the remaining annualized financial risk after applying the countermeasure.
3
Determine the gross risk reduction (ALE savings).
Gross ALE Savings = ALEpre−ALEpost=$60,000−$7,500=$52,500ALE_{pre} - ALE_{post} = \$60,000 - \$7,500 = \$52,500.
Calculates the total financial loss avoided annually by reducing the exposure factor.
4
Subtract the annual cost of the safeguard from the gross ALE savings.
Net Benefit = $52,500−$12,000=$40,500\$52,500 - \$12,000 = \$40,500.
Evaluates the net economic value added by the security control.

Key Concept

Quantitative Risk Assessment and Cost-Benefit Analysis (ALE=AV×EF×AROALE = AV \times EF \times ARO)
Question 1422Question →

An enterprise risk manager is evaluating the updated organizational risk register following a infrastructure modernizing initiative. During this initiative, the cybersecurity team decommissioned several legacy database servers that contained unpatchable vulnerabilities, purchased a comprehensive cyber insurance policy to cover data breach notifications and regulatory fines, and migrated customer analytics workloads to a public Cloud Service Provider (CSP) under an Infrastructure as a Service (IaaS) arrangement. Based on this risk management scenario, which of the following statements correctly evaluate the risk response strategies and governance responsibilities? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Decommissioning the legacy database servers to eliminate exposure to unpatchable software vulnerabilities represents a risk avoidance response.; Procuring a cyber risk insurance policy to handle potential financial liabilities and notification expenses represents a risk transfer response.

Answer

The correct evaluations are that decommissioning legacy systems with unpatchable flaws constitutes risk avoidance, and purchasing cyber insurance to shift breach costs to an insurer constitutes risk transfer.
Decommissioning legacy servers eliminates the attack vector entirely, which is the textbook definition of risk avoidance. Purchasing cyber risk insurance shifts the financial burden of incident response and legal costs to an insurer, which is the definition of risk transfer.

Step-by-Step Solution

1
Analyze the action of decommissioning legacy servers with unpatchable vulnerabilities.
Discontinuing the vulnerable system removes the source of risk entirely, which aligns with Risk Avoidance.
Risk avoidance occurs when an organization alters its plans or operations to eliminate a hazard or risk exposure completely.
2
Analyze the action of purchasing a cyber insurance policy.
Shifting financial burdens and breach response costs to an insurance underwriter aligns with Risk Transfer.
Risk transfer shifts the financial or operational impact of a risk to a third party in exchange for a fee or premium.
3
Evaluate the statement regarding cloud migration and regulatory accountability under IaaS.
The statement is false because data governance and compliance remain the customer's responsibility under the shared responsibility model.
Cloud Service Providers manage underlying infrastructure security, but data ownership, privacy, and compliance always remain with the customer enterprise.
4
Evaluate the statement regarding residual risk elimination.
The statement is false because security controls reduce risk, but residual risk can never be reduced to zero.
Residual risk is the remaining risk existing after controls and safeguards are implemented.

Key Concept

Risk Response Strategies and Cloud Shared Responsibility Model
Question 1423Question →

An enterprise security governance team is reviewing its information security documentation hierarchy to resolve audit findings regarding governance ambiguity. Match each governance document type on the left with its corresponding organizational characteristic and legal/enforcement property on the right.

Click a left item, then click its matching right item

Items

Security Policy
Security Standard
Security Baseline
Security Guideline

Matches

Show answer & explanation

Answer

Security Policy matches executive-approved strategic directives; Security Standard matches mandatory technical rules and metric parameters; Security Baseline matches minimum compulsory hardening settings for specific systems; Security Guideline matches non-mandatory recommended operational advice.
Each governance document type fulfills a distinct role in the governance framework hierarchy: Security Policy sets mandatory strategic intent; Security Standard defines compulsory technical specifications; Security Baseline sets mandatory minimum build states for platforms; and Security Guideline offers non-binding advice.

Step-by-Step Solution

1
Analyze the overarching scope and authority of governance documents.
Identify high-level directives originating from senior leadership as Security Policies.
Policies establish top-down management intent and risk tolerance across the enterprise.
2
Differentiate mandatory technical specifications from high-level management intent.
Map compulsory technical rules, algorithms, or operational controls to Security Standards.
Standards operationalize policies by enforcing uniform technical requirements across systems.
3
Identify minimum platform-specific hardening requirements.
Assign minimum required security state parameters to Security Baselines.
Baselines serve as the mandatory foundation for platform configuration consistency and security auditing.
4
Evaluate discretionary documentation.
Match optional recommendations and practical advice to Security Guidelines.
Guidelines assist operational teams without imposing strict legal or regulatory compliance penalties.

Key Concept

Security Governance Documentation Hierarchy (Policy, Standard, Baseline, Guideline)
Estimated Time:2m 0s
Question 1424Question →

A Security Operations Center (SOC) analyst is inspecting SIEM alerts originating from an internal web server hosting an enterprise customer portal. The SIEM correlated the following sequential Sysmon process creation events:

text
EventID: 1 (Process Create)
UtcTime: 2026-07-27 11:04:12.102
Image: C:\Windows\System32\inetsrv\w3wp.exe
CommandLine: w3wp.exe -ap "CustomerPortalPool"
User: NT AUTHORITY\NETWORK SERVICE

EventID: 1 (Process Create)
UtcTime: 2026-07-27 11:04:15.884
ParentImage: C:\Windows\System32\inetsrv\w3wp.exe
Image: C:\Windows\System32\cmd.exe
CommandLine: cmd.exe /c powershell.exe -nop -w hidden -EncodedCommand aW52b2tlLXdlYnJlcXVlc3Q...
User: NT AUTHORITY\NETWORK SERVICE

Based on the log evidence provided, which of the following best describes the security incident taking place?

Show answer & explanation

Answer: A web application vulnerability was exploited to achieve remote code execution by spawning a command interpreter from the IIS worker process.

Answer

The incident represents web application exploitation resulting in server-side remote code execution, as demonstrated by the IIS web server process spawning a shell interpreter.
The correct analysis recognizes that `w3wp.exe` is the Internet Information Services (IIS) worker process responsible for serving web request code. When `w3wp.exe` acts as the parent process launching `cmd.exe` or `powershell.exe`, it signifies that an attacker exploited a web application flaw (such as command injection) to execute arbitrary commands on the host server.

Step-by-Step Solution

1
Analyze the parent-child process relationship in the Sysmon log entries.
The parent process is `w3wp.exe` (IIS Worker Process) and the child process is `cmd.exe` launching `powershell.exe`.
Web servers (`w3wp.exe`) should handle HTTP traffic and should not routinely launch interactive command prompt shells or PowerShell scripts.
2
Evaluate the command-line parameters and executed payload attributes.
The command includes `-nop -w hidden -EncodedCommand`, which are common evasive flags used to conceal malicious script execution.
Attackers frequently use Base64 encoding and hidden windows to bypass basic command-line monitoring.
3
Synthesize the log findings to classify the attack vector.
Spawning a system shell from a web daemon process confirms server-side Remote Code Execution (RCE) via web application vulnerability exploitation.
Exploits such as command injection or insecure deserialization force the web service account to execute arbitrary shell commands.

Key Concept

Identifying Remote Code Execution (RCE) and anomalous process lineage in web server and SIEM logs
Question 1425Question →

A logistics organization is performing a quantitative risk assessment for its automated warehouse management system, which has an Asset Value (AVAV) of $1,500,000\$1,500,000. Without additional security controls, a critical cyber attack is estimated to occur once every 2 years (ARO=0.50ARO = 0.50) with an Exposure Factor (EFEF) of 0.300.30. The cybersecurity team plans to deploy an endpoint detection and response (EDR) platform alongside network microsegmentation controls, which is expected to reduce the EFEF to 0.050.05 and the AROARO to 0.100.10. The total annual cost for subscription licensing and maintenance of these controls is $45,000\$45,000.

What is the net annual financial value (net benefit in USD) of implementing these security controls?

Show answer & explanation

Answer: 172500

Answer

The net annual financial value of implementing the controls is $172,500 USD.
The net financial value (cost-benefit) of a security control is determined by evaluating the monetary risk reduction achieved minus the annual cost to maintain the control: (ALEprior−ALEpost)−Safeguard Cost(ALE_{\text{prior}} - ALE_{\text{post}}) - \text{Safeguard Cost}. Baseline ALEALE is calculated as AV×EF×ARO=$1,500,000×0.30×0.50=$225,000AV \times EF \times ARO = \$1,500,000 \times 0.30 \times 0.50 = \$225,000. Residual ALEALE after control implementation is AV×EFpost×AROpost=$1,500,000×0.05×0.10=$7,500AV \times EF_{\text{post}} \times ARO_{\text{post}} = \$1,500,000 \times 0.05 \times 0.10 = \$7,500. The gross risk reduction is $225,000−$7,500=$217,500\$225,000 - \$7,500 = \$217,500. Subtracting the annual safeguard maintenance and subscription cost of $45,000\$45,000 yields a net annual financial benefit of $172,500\$172,500.

Step-by-Step Solution

1
Calculate initial Single Loss Expectancy (SLE) and Annualized Loss Expectancy (ALE) without controls.
SLEprior=$1,500,000×0.30=$450,000SLE_{\text{prior}} = \$1,500,000 \times 0.30 = \$450,000; ALEprior=$450,000×0.50=$225,000ALE_{\text{prior}} = \$450,000 \times 0.50 = \$225,000.
Establishes the organization's initial baseline risk exposure in monetary terms.
2
Calculate post-control Single Loss Expectancy (SLE) and Annualized Loss Expectancy (ALE).
SLEpost=$1,500,000×0.05=$75,000SLE_{\text{post}} = \$1,500,000 \times 0.05 = \$75,000; ALEpost=$75,000×0.10=$7,500ALE_{\text{post}} = \$75,000 \times 0.10 = \$7,500.
Determines the expected residual financial risk following mitigation.
3
Deduct residual ALE and annual safeguard expenses from the baseline ALE to determine net financial benefit.
Net Safeguard Value =($225,000−$7,500)−$45,000=$172,500= (\$225,000 - \$7,500) - \$45,000 = \$172,500.
Evaluates whether the safeguard is cost-effective and quantifies the net savings provided.

Key Concept

Quantitative Risk Analysis and Net Safeguard Cost-Benefit Calculation
Question 1426Question →

Following a phishing simulation report, a security analyst reviews telemetry to identify systems where an unauthorized script executed via a native administrative tool without creating new executable files on disk. Traditional signature-based antivirus on the endpoints flagged no alerts. Which of the following Endpoint Detection and Response (EDR) capabilities allows the analyst to identify this activity?

Show answer & explanation

Answer: Process lineage tracking and behavioral telemetry collection

Answer

Process lineage tracking and behavioral telemetry collection
Process lineage tracking and behavioral telemetry collection allow EDR solutions to monitor process creation events, command-line arguments, and parent-child execution hierarchies. This enables analysts to spot suspicious activity, such as legitimate system binaries executing unusual commands, even when no malware binary is written to the disk.

Step-by-Step Solution

1
Analyze the incident context and attack vector.
Identified a fileless attack where native system binaries execute malicious scripts without saving new files to disk.
Traditional antivirus fails to detect this activity because no known malicious file signature is created on the filesystem.
2
Evaluate the required security capability to detect fileless activity.
Determined that monitoring runtime execution logic, parent-child process chains, and system behavior is necessary.
Fileless threats rely on legitimate binaries, requiring context-aware behavioral inspection rather than static file hash matching.
3
Select the EDR feature that provides this monitoring capability.
Process lineage tracking and behavioral telemetry collection.
EDR records the relationships between parent and child processes (such as a word processor launching a command shell), capturing anomalous behavior across endpoints.

Key Concept

Endpoint Detection and Response (EDR) behavioral telemetry and process lineage
Estimated Time:1m 30s
Question 1427Question →

A system administrator is preparing to roll out a critical operating system patch across enterprise workstations. Which of the following tasks should be completed prior to deploying the patch into the broad production environment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Test the patch in an isolated staging environment to verify system stability and application compatibility.; Establish a rollback plan and back up system configurations to ensure rapid recovery if the update fails.

Answer

Testing the patch in an isolated staging environment to verify system stability and establishing a rollback plan with backups prior to deployment.
Prior to deploying software updates across production environments, best practices require validating patch stability in a non-production staging environment and creating backups with a documented rollback plan to recover quickly if issues arise.

Step-by-Step Solution

1
Identify pre-deployment requirements in the patch management lifecycle.
Recognize that changes must be tested in a controlled staging environment before production release.
Testing mitigates the risk of unforeseen software incompatibilities or system crashes.
2
Determine risk mitigation procedures for patch deployment failures.
Establish backups and a clear rollback plan.
System snapshots and backups enable quick restoration if a patch introduces severe operational disruptions.

Key Concept

Pre-deployment Patch Staging and Rollback Planning
Question 1428Question →

Following an automated alert indicating potential fileless malware activity on an operational database server, a security analyst must collect volatile digital evidence prior to server isolation. Adhering strictly to the standard order of volatility, which of the following data sources should the analyst acquire FIRST?

Show answer & explanation

Answer: CPU registers and cache contents

Answer

CPU registers and cache contents should be acquired first because they represent the most volatile data layer on a system.
The correct answer identifies CPU registers and cache contents as the most volatile components. According to the forensic order of volatility, evidence collection must begin with the shortest-lived data sources to prevent evidence destruction.

Step-by-Step Solution

1
Identify the data sources present in the scenario and rank them by volatility lifetime.
CPU registers/cache have lifetimes measured in nanoseconds; RAM in microseconds; swap/temp files in minutes/hours; disk drives persist until explicitly deleted.
Forensic evidence preservation must capture data at risk of immediate loss before capturing more stable data.
2
Apply the standard Order of Volatility guidelines (RFC 3227).
The sequence is: CPU registers/cache -> RAM/routing tables/process tables -> Swap/temp files -> Disk storage -> Remote logs/network traffic -> Archival media.
Following established forensic standards ensures evidence admissibility and integrity.
3
Select the highest priority item from the choices provided.
CPU registers and cache contents are at the top of the volatility hierarchy.
Acquiring CPU registers and cache first prevents critical CPU-bound execution artifacts from being overwritten during subsequent memory dumps.

Key Concept

Order of Volatility in Digital Forensics
Estimated Time:1m 15s
Question 1429Question →

A logistics company evaluates the risk of server downtime at a remote warehouse facility. The database server cluster has an Asset Value (AVAV) of $80,000\$80,000. An assessment indicates that a severe localized network outage would result in an Exposure Factor (EFEF) of 0.250.25 (25%25\%). The Annual Rate of Occurrence (AROARO) for this type of outage is estimated to be 0.50.5 (occurring once every two years). What is the Annualized Loss Expectancy (ALEALE) in USD for this threat?

Show answer & explanation

Answer: 10000

Answer

The Annualized Loss Expectancy (ALEALE) for the database server cluster is 10,00010,000 USD.
The Annualized Loss Expectancy (ALEALE) is determined using standard quantitative risk assessment metrics: first, calculate Single Loss Expectancy as SLE=AV×EF=$80,000×0.25=$20,000SLE = AV \times EF = \$80,000 \times 0.25 = \$20,000. Second, calculate ALE=SLE×ARO=$20,000×0.5=$10,000ALE = SLE \times ARO = \$20,000 \times 0.5 = \$10,000.

Step-by-Step Solution

1
Calculate the Single Loss Expectancy (SLE)
SLE=$20,000SLE = \$20,000
Single Loss Expectancy represents the monetary loss expected each time an asset is compromised, calculated by multiplying the Asset Value (AVAV) by the Exposure Factor (EFEF).
2
Calculate the Annualized Loss Expectancy (ALE)
ALE=$10,000ALE = \$10,000
Annualized Loss Expectancy represents the expected financial loss per year, calculated by multiplying the Single Loss Expectancy (SLESLE) by the Annual Rate of Occurrence (AROARO).

Key Concept

Quantitative Risk Assessment (ALE Calculation)
Question 1430Question →

An enterprise systems administrator is troubleshooting a Kerberos authentication issue in an Active Directory environment. Place the steps of the Kerberos ticket exchange process in the correct order from initial user login to final resource access.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with the client sending an AS-REQ with pre-authentication data to the KDC, followed by the KDC returning an AS-REP with the Ticket Granting Ticket (TGT). Next, the client submits a TGS-REQ containing the TGT and target SPN to the TGS, which responds with a TGS-REP containing the Service Ticket. Finally, the client presents the Service Ticket to the target application server.
Kerberos follows a strict authentication flow: First, the client initiates authentication with the Authentication Server via AS-REQ and receives a TGT via AS-REP. Next, the client uses the TGT to request a service-specific ticket from the TGS via TGS-REQ and receives the Service Ticket via TGS-REP. Finally, the client presents the Service Ticket directly to the target application server for resource access.

Step-by-Step Solution

1
Initiate Authentication (AS-REQ)
Client contacts the KDC's Authentication Server with encrypted timestamp data.
Initial proof of identity is required before any tickets can be issued.
2
Obtain TGT (AS-REP)
Client receives the Ticket Granting Ticket and session key.
The TGT proves authentication status for subsequent service requests.
3
Request Service Ticket (TGS-REQ)
Client sends the TGT and target SPN to the TGS.
The client requests permissions for a specific service using its existing TGT.
4
Receive Service Ticket (TGS-REP)
Client receives a ticket encrypted with the service account's secret key.
The TGS validates the client's authority and grants a ticket tailored to the destination service.
5
Authenticate to Application Server (AP-REQ)
Client presents the Service Ticket to the target application server.
The application server verifies the ticket and authorizes access without contacting the KDC directly.

Key Concept

Kerberos Authentication Exchange Process
Question 1431Question →

An organization is updating its security governance hierarchy to resolve operational ambiguities discovered during a regulatory audit. Match each governance document type on the left with its corresponding organizational scope and enforceability characteristic on the right.

Click a left item, then click its matching right item

Items

Security Policy
Security Standard
Security Guideline
Standard Operating Procedure

Matches

Show answer & explanation

Answer

Security Policy matches the high-level strategic mandate; Security Standard matches mandatory technical specs and configuration baselines; Security Guideline matches discretionary recommendations and operational advice; Standard Operating Procedure matches step-by-step sequential technical instructions.
Security governance relies on a defined hierarchy where Security Policies provide mandatory high-level strategic direction; Security Standards set compulsory technical configurations; Security Guidelines communicate non-mandatory suggestions; and Standard Operating Procedures provide explicit step-by-step execution tasks.

Step-by-Step Solution

1
Analyze the strategic role and authority level of high-level directives.
Identify that overall strategic directives set by executive leadership correspond to a Security Policy.
Policies sit at the top of the governance hierarchy and establish mandatory security goals across the entire entity.
2
Distinguish between mandatory technical requirements and discretionary recommendations.
Map compulsory technical parameters to Security Standards and non-enforceable recommendations to Security Guidelines.
Standards mandate explicit technical thresholds, whereas guidelines provide flexible, non-binding best practice advice.
3
Examine operational documentation formats.
Assign detailed step-by-step tactical workflows to Standard Operating Procedures.
Procedures define exact sequential operational mechanics required to execute tasks defined by policies and standards.

Key Concept

Information Security Governance Document Hierarchy
Question 1432Question →

An enterprise security team manages a geographically distributed fleet of edge servers running containerized microservices. Following an emergency zero-day patch deployment, several edge nodes experience configuration drift, causing unauthorized modifications to local system baselines and security settings. Which TWO of the following technical controls should the security team implement to remediate this configuration drift and prevent future baseline deviations?

Select all that apply

Show answer & explanation

Answer: Redeploy validated Infrastructure as Code (IaC) templates through the automated deployment pipeline to restore systems to a compliant state.; Deploy continuous automated configuration auditing agents to monitor systems against established benchmarks and detect unauthorized changes.

Answer

The security team should redeploy validated Infrastructure as Code (IaC) templates through the automated pipeline and deploy continuous automated configuration auditing agents.
Redeploying validated Infrastructure as Code (IaC) templates through an automated pipeline guarantees that edge nodes return to a tested, immutable baseline without manual intervention. Combining this with continuous automated configuration auditing agents ensures ongoing compliance monitoring and instant detection of unauthorized modifications.

Step-by-Step Solution

1
Analyze the cause of system configuration drift after emergency patching.
Identified that out-of-band updates bypassed automated build pipelines, resulting in inconsistent baseline enforcement across edge nodes.
Understanding why drift occurred is necessary to select effective automated remediation strategies.
2
Restore standard system baselines using pipeline automation.
Nodes are returned to a verified, compliant state by executing validated IaC templates.
Automated deployment eliminates manual errors and enforces declarative, immutable configuration baselines.
3
Establish real-time visibility into system state deviations.
Automated compliance agents continuously evaluate system state against hardened baseline profiles.
Continuous auditing ensures rapid detection and notification when unauthorized local modifications or drift occur.

Key Concept

Configuration Baseline Enforcement and Drift Management
Question 1433Question →

Following an executive directive mandating strict software supply chain security, an enterprise security architect publishes a technical document for application development teams. The document establishes mandatory technical criteria, including requiring all container images to be cryptographically signed and prohibiting deployment if any unresolved critical vulnerabilities are detected. While the document does not outline tool-specific step-by-step workflow actions, adherence to these quantitative rules is strictly compulsory across all engineering teams. Which of the following security governance document types is represented by this technical specification?

Show answer & explanation

Answer: Standard

Answer

Standard
A security standard specifies mandatory technical, operational, or behavioral rules that support high-level enterprise policies. Because the document introduces mandatory technical criteria (container signature verification and zero critical vulnerability thresholds) that must be strictly followed without defining step-by-step tactical instructions, it functions as a security standard.

Step-by-Step Solution

1
Analyze the core characteristics and enforceability of the document described in the scenario.
The specification sets mandatory, specific technical requirements (container signing and vulnerability criteria) that engineering teams must strictly follow.
Governance documents in an enterprise hierarchy are classified based on their level of technical specificity, enforceability, and operational purpose.
2
Evaluate how the document compares to distinct governance levels.
It translates high-level policy objectives into compulsory technical rules without prescribing step-by-step execution tasks (procedures) or platform-specific hardening images (baselines).
Standards define the compulsory quantitative or technical boundaries necessary to achieve compliance with high-level policies.
3
Identify the correct governance element.
The document represents a security standard.
A standard enforces mandatory technical criteria across an enterprise while leaving individual procedural steps to team-level implementation.

Key Concept

Security Governance Hierarchy (Policies, Standards, Baselines, Guidelines, Procedures)
Question 1434Question →

A security operations analyst is investigating an automated alert from a enterprise Identity Provider (IdP). An administrator attempted to access a critical production Kubernetes management console, generating the following log excerpt:

text
[TIMESTAMP: 2026-07-27T14:20:11Z] EVENT: Auth_Request | User: admin_ops | Source_IP: 10.240.12.88 | Protocol: SAML_2.0 | Auth_Result: SUCCESS (MFA Verified)
[TIMESTAMP: 2026-07-27T14:20:15Z] EVENT: Resource_Access | User: admin_ops | Target: Prod_K8s_Console | Action: EVAL_POLICY | Result: DENIED | Reason: Missing_Privileged_Role_Claim
[TIMESTAMP: 2026-07-27T14:20:18Z] EVENT: Privileged_Elevate | User: admin_ops | Request_ID: 99412 | Action: ASSUME_ROLE | Result: FAILED | Reason: No_Active_PAM_Approval_Ticket

Which of the following security operational concepts best explains why access was blocked after successful identity verification?

Show answer & explanation

Answer: The user successfully completed authentication, but the request was denied during authorization due to missing entitlement claims and unapproved PAM elevation requirements.

Answer

The user successfully completed authentication, but the request was denied during authorization due to missing entitlement claims and unapproved PAM elevation requirements.
The correct option identifies the fundamental separation between authentication and authorization in identity operations. The logs confirm that the user successfully authenticated using SAML 2.0 and MFA. However, when attempting to access the Kubernetes management console, the authorization check failed because the session lacked the required role claim and had no active, approved PAM elevation ticket.

Step-by-Step Solution

1
Analyze the log timestamp 14:20:11Z
The identity provider confirmed successful SAML 2.0 authentication and verified Multi-Factor Authentication (MFA).
This establishes identity (Authentication phase).
2
Analyze the log timestamps 14:20:15Z and 14:20:18Z
Policy evaluation failed due to a missing role claim and an absent Privileged Access Management (PAM) ticket.
This evaluates rights and privileges (Authorization phase).
3
Synthesize security controls
Distinguish that identity proofing (authentication) succeeded, but privilege enforcement (authorization) correctly blocked unauthorized access.
AAA security models separate identity verification from access privilege granting.

Key Concept

Authentication vs. Authorization in IAM Operations
Question 1435Question →

A security engineering team is refining the vulnerability assessment strategy for a hybrid cloud environment. The team wants to obtain detailed patch and configuration status from cloud virtual machines while minimizing network bandwidth overhead and avoiding the transmission of privileged domain credentials across the network. Which TWO of the following configurations or approaches should the team implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy host-based vulnerability scanner agents directly onto the virtual machines to conduct local authenticated assessments.; Leverage cloud API integration to perform offline disk snapshot and image vulnerability assessments.

Answer

The security team should deploy host-based scanner agents onto the virtual machines and leverage cloud API integration for offline disk snapshot assessments.
Deploying host-based vulnerability scanner agents directly on targets allows local execution without transmitting privileged credentials over the network or incurring heavy network scan traffic. Additionally, leveraging cloud API integration for offline disk snapshot scanning allows out-of-band analysis of host filesystems without impacting running workloads or needing network probes.

Step-by-Step Solution

1
Analyze requirements for zero network credential transmission and minimal network bandwidth overhead.
Identify that traditional remote network scans with elevated credentials expose network traffic and introduce significant overhead.
Host-based agents execute assessments locally, eliminating the need to transmit administrative credentials over the wire and drastically reducing network bandwidth consumption.
2
Evaluate cloud-native vulnerability assessment capabilities.
Determine that out-of-band snapshot scanning using cloud management APIs provides comprehensive visibility into OS vulnerabilities.
API-driven snapshot inspection assesses virtual machine disks without interacting with active production network interfaces or running live network probes.

Key Concept

Credentialed vulnerability assessment methods using host agents and cloud API integration
Question 1436Question →

An enterprise organization is enhancing its vendor onboarding process for commercial off-the-shelf (COTS) software applications. To evaluate software supply chain risks and ensure the integrity of vendor-supplied code before deployment, which TWO of the following controls or artifacts should the security team require from software vendors? (Select TWO)

Select all that apply

Show answer & explanation

Answer: A comprehensive Software Bill of Materials (SBOM) listing all third-party components and dependencies; Cryptographic digital signatures and code-signing attestations for all software deliverables

Answer

The correct requirements are providing a Software Bill of Materials (SBOM) detailing third-party components and enforcing cryptographic code signing with digital signatures to verify software integrity and origin.
Requiring a Software Bill of Materials (SBOM) ensures complete transparency into third-party code libraries and upstream dependencies, allowing organizations to track known vulnerabilities (CVEs). Requiring code signing and cryptographic digital signatures validates the software's authenticity and guarantees that the application code has not been altered or tampered with by unauthorized third parties.

Step-by-Step Solution

1
Analyze the scenario objective.
The goal is to evaluate third-party software supply chain risk and ensure binary integrity before deployment.
Supply chain oversight requires verification of upstream software dependencies and proof that code has not been tampered with.
2
Evaluate artifacts and controls that provide software supply chain assurance.
A Software Bill of Materials (SBOM) provides complete transparency into nested dependencies, and code signing cryptographically verifies code origin and uncompromised integrity.
These two items directly mitigate supply chain vulnerabilities and tampering risks.
3
Differentiate improper or misclassified administrative and technical controls.
Confusing NDAs with SLAs, or requiring physical logs/internal developer WAFs, fails to validate the security and authenticity of distributed software packages.
General administrative agreements and unrelated operational controls do not satisfy supply chain software verification requirements.

Key Concept

Software Supply Chain Oversight and Integrity Verification
Question 1437Question →

A network security analyst receives a high-severity Network Intrusion Detection System (NIDS) alert signaling anomalous outbound data transfers from a internal web server to an unknown external IP address. Which of the following sequences represents the correct chronological order of network security monitoring and incident triage steps the analyst should follow from initial alert validation through enterprise protection?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for network security monitoring and triage is: 1) Correlate the NIDS alert with web server access logs and SIEM event streams to confirm a true positive condition; 2) Capture live network flow telemetry and analyze packet payloads to determine the scope of exfiltrated data; 3) Apply targeted network access control rules to isolate the compromised web server from external endpoints; 4) Extract network Indicators of Compromise (IoCs) and deploy updated NIPS signatures across the enterprise perimeter.
The standard network security monitoring triage workflow starts with alert validation against correlated SIEM and web logs to confirm a true positive. Following validation, packet payload and NetFlow telemetry are analyzed to establish the breach extent and extract threat characteristics. Once the attack profile is understood, network isolation controls are applied to block live exfiltration. Finally, derived network Indicators of Compromise (IoCs) are deployed to NIPS rules to prevent secondary attacks enterprise-wide.

Step-by-Step Solution

1
Verify Alert Authenticity
Confirmed true positive alert identifying the source web server and destination IP.
Initial network monitoring triage requires cross-referencing raw NIDS alerts with host logs and SIEM data to rule out false positives.
2
Analyze Telemetry & Packet Data
Determined exfiltrated data volume, protocols, and malicious payload characteristics.
Inspecting packet payloads and flow records provides detailed context regarding breach impact and specific Indicators of Compromise (IoCs).
3
Enforce Network Isolation
Active exfiltration path blocked without powering off host, preserving volatile RAM and active connection state.
Network containment halts ongoing unauthorized transmission once the nature of the threat is understood.
4
Update Defensive Signatures
Enterprise NIPS and firewall devices configured with new block rules and signatures.
Feeding extracted IoCs back into network intrusion prevention systems mitigates risk across the rest of the enterprise.

Key Concept

Network Security Incident Monitoring and Alert Triage Workflow
Question 1438Question →

Match each third-party risk management artifact or supply chain control on the left with its corresponding oversight function on the right.

Click a left item, then click its matching right item

Items

Right-to-Audit Clause
SOC 2 Type II Report
Hardware Supply Chain Assessment
Vendor Offboarding Protocol

Matches

Show answer & explanation

Answer

Right-to-Audit Clause matches with Contractual provision granting direct inspection authority; SOC 2 Type II Report matches with Independent third-party evaluation of operational control effectiveness over time; Hardware Supply Chain Assessment matches with Evaluation process focused on detecting counterfeit components and physical tampering; Vendor Offboarding Protocol matches with Governance process ensuring access revocation and data destruction upon relationship termination.
Each vendor oversight control aligns directly with its operational scope: legal audit clauses enable direct inspection, SOC 2 Type II reports demonstrate sustained control effectiveness, hardware assessments defend against component tampering, and offboarding protocols eliminate residual access when contracts end.

Step-by-Step Solution

1
Analyze contractual verification mechanisms
Identified that the Right-to-Audit Clause explicitly grants authority to inspect vendor operations.
Contractual terms determine legal permissions for active security verification.
2
Differentiate third-party attestation types
Associated the SOC 2 Type II Report with historical, independent verification of control effectiveness over time.
SOC 2 Type II specifically measures operational performance over an extended evaluation window.
3
Evaluate hardware and physical supply chain risks
Linked Hardware Supply Chain Assessment to component integrity, counterfeit detection, and anti-tampering verification.
Physical supply chain oversight ensures hardware devices have not been altered prior to deployment.
4
Review the vendor lifecycle termination requirements
Matched Vendor Offboarding Protocol with access revocation, asset recovery, and secure data sanitization.
Offboarding manages end-of-life supplier risk by revoking rights and retrieving sensitive materials.

Key Concept

Third-Party Risk Management and Supply Chain Oversight
Estimated Time:1m 30s
Question 1439Question →

A healthcare provider contracts a third-party software vendor to maintain its remote patient monitoring platform. During a compliance audit, the security team discovers that the vendor transferred customer data backups to an unvetted sub-processor to reduce hosting expenses. The existing contract includes non-disclosure obligations, minimum uptime guarantees, and annual on-site audit privileges, but lacks restrictions regarding sub-tier service providers. Which of the following contractual provisions should the security team mandate in future procurement agreements to directly restrict unauthorized downstream vendor engagements?

Show answer & explanation

Answer: A mandatory sub-processor authorization and notification clause requiring prior written approval

Answer

A mandatory sub-processor authorization and notification clause requiring prior written approval
Including a sub-processor notification and mandatory authorization clause ensures that vendors cannot legally transfer sensitive data or infrastructure operations to fourth parties without the primary organization's explicit review and consent. This directly addresses supply chain visibility and downstream risk exposure.

Step-by-Step Solution

1
Analyze the scenario vulnerability
Identified that the risk stems from fourth-party (sub-tier) outsourcing without organization knowledge or security vetting.
The primary vendor subcontracted backup services to an unauthorized entity due to missing contractual boundaries around sub-tier processing.
2
Evaluate existing contract limitations
The current terms (confidentiality, uptime SLA, standard auditing) fail to govern supply chain sub-contracting practices.
Auditing privileges and confidentiality enforce baseline security for the primary vendor, but do not automatically restrict the vendor's choice of subcontractors.
3
Select the appropriate governance control
Enforce sub-processor notification and authorization requirements in vendor contracts.
Requiring prior written approval and advance notification gives the organization the legal right to veto high-risk fourth-party sub-processors before data is shared.

Key Concept

Fourth-Party Risk Management and Sub-Processor Governance
Estimated Time:2m 0s
Question 1440Question →

An enterprise organization is outsourcing its customer data analytics platform to a cloud service provider that will process sensitive financial records. To establish continuous risk oversight and maintain regulatory compliance throughout the contractual relationship, which of the following mechanisms should the organization require? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Annual delivery of an independent SOC 2 Type II audit report assessing security controls over time; Inclusion of a mandatory security incident notification window within the contractual Service Level Agreement (SLA)

Answer

The organization should require annual independent SOC 2 Type II audit reports to verify operational control effectiveness over time, and mandate a formal security incident notification timeline within the Service Level Agreement (SLA).
Requiring annual independent SOC 2 Type II reports provides verifiable assurance that the cloud provider's security controls operate effectively over an extended period. Additionally, specifying a mandatory security incident notification timeframe within the SLA guarantees that the enterprise is alerted quickly during a security incident to fulfill legal and operational obligations.

Step-by-Step Solution

1
Identify third-party risk verification mechanisms for ongoing operational security oversight.
Recognize that a SOC 2 Type II report provides independent attestation of control effectiveness operating across an extended period.
Point-in-time assessments (like SOC 2 Type I or simple questionnaires) do not verify whether controls operated consistently over time.
2
Determine the necessary contractual controls to ensure prompt breach visibility and regulatory compliance.
Select a mandatory incident notification window specified in the Service Level Agreement (SLA).
Timely notification is required by data privacy regulations and enables the organization to initiate incident containment and notification protocols.
3
Evaluate and eliminate unsuitable governance and technical options.
Reject MOUs for hypervisor software enforcement, ISAs for physical tape disposal, and honeypots for inline build pipeline blocking due to control function misclassifications.
MOUs are non-binding, ISAs govern network connections, and honeypots serve threat detection rather than inline software blocking.

Key Concept

Third-party risk management relies on independent audit attestations (SOC 2 Type II) for ongoing control assurance and binding contractual terms (SLAs) for incident notification boundaries.
PreviousPage 72 / 112Next
All practice questions — CompTIA Security+ | Examkin