Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1481Question →

An enterprise security architect is reviewing identity and access management (IAM) controls across network access servers, policy engines, and central logging services. Match each security mechanism on the left with the specific AAA function or protocol capability on the right that best describes its primary operational purpose.

Click a left item, then click its matching right item

Items

EAP-TLS protocol negotiation during an 802.1X network access request using X.509 digital certificates
XACML policy decision point (PDP) evaluating user attributes, environmental context, and object sensitivity
TACACS+ daemon capturing individual privilege shell commands executed by network engineers
RADIUS start, interim-update, and stop messages logging connection duration and byte counts

Matches

Show answer & explanation

Answer

EAP-TLS pairs with Mutual Authentication; XACML PDP pairs with Attribute-Based Authorization; TACACS+ command logging pairs with Administrative Command Accounting; RADIUS start/stop metrics pair with Resource Usage Accounting.
Matching each security control to its primary operational capability correctly distinguishes between authentication methods, authorization policy models, and distinct accounting mechanism granularity.

Step-by-Step Solution

1
Analyze EAP-TLS network negotiation
Identified as requiring X.509 certificates on both client and server sides
Because both endpoints validate each other's credentials, EAP-TLS provides mutual authentication.
2
Analyze XACML PDP policy evaluations
Identified as evaluating dynamic rules based on subject, resource, action, and environment attributes
XACML is the enterprise standard for implementing Attribute-Based Access Control (ABAC) authorization.
3
Analyze TACACS+ command logging capabilities
Identified as tracking specific CLI commands executed during administrator sessions
TACACS+ provides granular administrative command accounting, distinct from general connection logging.
4
Analyze RADIUS session message exchanges
Identified as tracking session stats such as uptime, connect time, and bandwidth consumption
RADIUS accounting focuses primarily on resource usage metrics and overall session auditing.

Key Concept

Core Pillars and Implementations of AAA (Authentication, Authorization, and Accounting)
Estimated Time:2m 0s
Question 1482Question →

A network security administrator is auditing the Centralized Access Management setup for core network switches using RADIUS and TACACS+ protocols. The audit aims to verify proper alignment with the Authentication, Authorization, and Accounting (AAA) framework. Which of the following statements correctly describe AAA operational characteristics in this deployment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: TACACS+ decouples authentication and authorization, enabling granular, per-command authorization checks after identity is established.; Accounting mechanisms capture command execution logs and session timestamps to establish non-repudiation and forensic traceability.

Answer

TACACS+ decouples authentication and authorization, enabling granular, per-command authorization checks after identity is established; and Accounting mechanisms capture command execution logs and session timestamps to establish non-repudiation and forensic traceability.
The statements emphasizing TACACS+ decoupled AAA architecture for per-command authorization and accounting's role in recording audit logs for non-repudiation are correct. TACACS+ separates authentication from authorization, allowing granular command authorization per user session. Accounting tracks user activities and resource usage after access is granted.

Step-by-Step Solution

1
Analyze the AAA phase definitions and protocol implementations for RADIUS and TACACS+.
Identify that authentication verifies identity, authorization enforces permissions (like TACACS+ per-command authorization), and accounting records activity.
AAA requires clear functional separation between proving identity, granting permissions, and logging events.
2
Evaluate protocol-specific architecture regarding AAA coupling and packet encryption.
Confirm that TACACS+ separates AAA services and encrypts the entire body, unlike RADIUS which combines authentication and authorization while only encrypting passwords.
Protocol design dictates how granular access controls and payload protections are applied.

Key Concept

Authentication, Authorization, and Accounting (AAA) Protocol Architecture
Question 1483Question →

A logistics corporation requires remote dispatchers to complete multi-factor authentication (MFA) when initiating their daily workspace session. Once initial login is established, users maintain persistent access to centralized fleet databases for ten hours without additional context evaluations, even if their host endpoint connects to untrusted networks or exhibits degraded compliance status mid-session. Which of the following actions best aligns this environment with core Zero Trust Architecture principles?

Show answer & explanation

Answer: Implementing dynamic access policies that continuously evaluate user identity, device posture, and risk factors throughout the session

Answer

Implementing dynamic access policies that continuously evaluate user identity, device posture, and risk factors throughout the session
The correct response addresses the vulnerability by enforcing continuous verification, a foundational pillar of Zero Trust Architecture (ZTA). Rather than trusting an active session indefinitely after a single login check, ZTA continuously monitors contextual attributes—such as endpoint posture, IP changes, and user behavioral risk—to enforce real-time access decisions.

Step-by-Step Solution

1
Analyze the vulnerability described in the scenario
Identified that authentication occurs only once at session initiation, allowing unverified access for 10 hours despite potential risk posture changes.
Static, one-time authentication creates a window of implicit trust during the active session.
2
Evaluate candidate solutions against Zero Trust Architecture principles
Zero Trust requires continuous verification and explicit validation regardless of network location or initial authentication success.
Access decisions must be constantly re-evaluated based on real-time context (device health, location shifts, behavioral anomalies).
3
Select the option that eliminates implicit session trust
Dynamic policy evaluation throughout the session duration fulfills the continuous verification tenant.
It ensures access rights adjust automatically if device compliance or user risk changes.

Key Concept

Continuous Verification and Explicit Validation in Zero Trust Architecture
Question 1484Question →

A cloud engineering team is refactoring a legacy microservices application to adhere to Zero Trust Architecture principles. During initial login, an edge gateway authenticates the incoming client request using mutual TLS (mTLS) and issues a signed JSON Web Token (JWT). However, backend microservices are configured to trust any request carrying a valid JWT signature without evaluating real-time user context, device compliance, or risk metrics for individual downstream API transactions. Which Zero Trust Architecture operational vulnerability is most directly presented by this configuration?

Show answer & explanation

Answer: Failing to enforce continuous verification by allowing initial session authentication to grant implicit trust for subsequent API transactions.

Answer

Failing to enforce continuous verification by allowing initial session authentication to grant implicit trust for subsequent API transactions.
Zero Trust Architecture requires explicit, continuous verification of every request based on all available data points (such as user identity, device posture, location, and risk state). Validating a token signature once upon entry without re-assessing context during subsequent microservice interactions creates a window of implicit session trust that contradicts Zero Trust tenets.

Step-by-Step Solution

1
Analyze the technical scenario context
The architecture authenticates clients upfront via mTLS and issues a token, but downstream microservices blindly trust the token signature without re-evaluating risk, context, or posture.
Identifying what checks are present versus what checks are missing exposes the architectural gap.
2
Map the technical gap to core Zero Trust tenets
Zero Trust mandates explicit validation and continuous verification on every resource request regardless of prior session authentication state.
Static acceptance of initial authentication violates the 'never trust, always verify' requirement for ongoing session evaluation.
3
Select the option that precisely targets continuous verification failure
The option identifying reliance on initial session authentication over continuous contextual re-evaluation directly matches the flaw.
Accepting static tokens without real-time risk evaluation allows hijacked sessions or compromised endpoints to execute actions without continuous checks.

Key Concept

Continuous Verification and Explicit Validation in Zero Trust Architecture
Question 1485Question →

A system administrator places a fake spreadsheet named confidential_salaries.xlsx containing fictitious employee records onto a corporate file share. The administrator configures security software to trigger an immediate alert whenever this file is opened or accessed. Which of the following deception technologies has the administrator implemented?

Show answer & explanation

Answer: Honeyfile

Answer

Honeyfile
The correct answer is a honeyfile. A honeyfile is an intentionally placed decoy file containing synthetic or bait information. Because legitimate business processes do not require accessing this dummy file, any open or read activity immediately alerts security analysts to suspicious or unauthorized internal reconnaissance.

Step-by-Step Solution

1
Analyze the scenario details
The administrator deployed a single dummy file with alerting configured to detect unauthorized file access.
Deception controls utilize decoy assets within an environment to lure unauthorized actors and provide early warning of an intrusion.
2
Identify the deception technology category
A fake file used as a decoy to catch unauthorized users accessing sensitive storage locations is defined as a honeyfile.
Honeyfiles specifically monitor file shares and data repositories for unauthorized reads or copies.

Key Concept

Honeyfile Deception Control
Question 1486Question →

A security architect is designing an enterprise Zero Trust Architecture (ZTA) baseline aligned with NIST SP 800-207. During a dynamic context evaluation event, distinct logical control plane and data plane components handle distinct duties. Match each Zero Trust logical component on the left with its precise operational role during access decision making and execution on the right.

Click a left item, then click its matching right item

Items

Policy Engine (PE)
Policy Administrator (PA)
Policy Enforcement Point (PEP)
Continuous Diagnostics and Mitigation (CDM) System

Matches

Show answer & explanation

Answer

Policy Engine pairs with evaluating policies and telemetry to make access decisions. Policy Administrator pairs with issuing control plane commands to establish or terminate sessions. Policy Enforcement Point pairs with inline data plane inspection and traffic gating. CDM System pairs with providing host health and vulnerability posture data.
In NIST SP 800-207 Zero Trust Architecture, logical responsibilities are strictly demarcated across control plane and data plane boundaries. The Policy Engine (PE) acts as the decision-making body evaluating authorization rules and contextual signals. The Policy Administrator (PA) acts as the control plane gateway issuing session control commands (establishing or severing connections). The Policy Enforcement Point (PEP) sits in the data plane to directly gate, inspect, or drop traffic to enterprise resources. Continuous Diagnostics and Mitigation (CDM) systems provide ongoing host state metrics as inputs into the Policy Engine.

Step-by-Step Solution

1
Differentiate between control plane decision logic and execution components in Zero Trust Architecture (NIST SP 800-207).
Identified the Policy Engine (PE) as the brain that applies security policy algorithms to reach a decision, and the Policy Administrator (PA) as the control component that communicates that decision.
The Policy Engine evaluates context, while the Policy Administrator translates the decision into command signals (such as issuing short-lived credentials or token revocations).
2
Separate data plane execution from control plane governance.
Identified the Policy Enforcement Point (PEP) as the single data-plane component in direct path of resource traffic.
The PEP gates, inspects, enables, or severs actual network connections to resources based on PA instructions.
3
Map threat intelligence and posture telemetry data sources.
Mapped the Continuous Diagnostics and Mitigation (CDM) System as an external signal feeder to the Policy Engine.
ZTA relies on dynamic context, requiring posture indicators like OS patch levels and threat detection states from CDM systems to continually calculate trust scores.

Key Concept

NIST SP 800-207 Zero Trust Architecture Logical Components (Control Plane vs. Data Plane)
Question 1487Question →

A security analyst places decoy configuration files containing dummy server hostnames and fake database connection parameters onto several developer endpoints. The intention is that an unauthorized intruder performing local credential harvesting will follow these planted traces toward a monitored decoy system. Which of the following deception and disruption technologies is primarily being utilized on the developer endpoints?

Show answer & explanation

Answer: Breadcrumb

Answer

Breadcrumbs are host-based deception artifacts (such as fake database strings, saved connections, or registry keys) placed on real endpoints to entice adversaries into exposing their presence by targeting monitored decoys.
Breadcrumbs consist of intentionally placed decoy information—such as fake registry entries, stored connection paths, mapped drives, or configuration files—on real production devices. They serve as lure trails to trick adversaries performing internal reconnaissance into revealing themselves by contacting decoy systems.

Step-by-Step Solution

1
Analyze the action performed on the endpoints
Fake configuration files and server parameters were planted on legitimate workstations.
Identifying the nature of the placed artifact helps differentiate between decoy targets and decoy pointers.
2
Determine the operational purpose of the artifact
The artifacts act as fake trails to guide attackers from production hosts toward decoy infrastructure.
Artifacts designed to lead adversaries to deception targets fit the definition of breadcrumbs.
3
Match the defense mechanism to standard deception technology definitions
Breadcrumbs serve as the trail/pointer mechanisms on production systems.
This distinguishes breadcrumb artifacts from honeypots (the decoy targets themselves) or honeynets (entire decoy networks).

Key Concept

Deception Technologies - Breadcrumbs vs. Decoy Systems
Question 1488Question →

Match each deception technology component on the left with its corresponding functional definition on the right.

Click a left item, then click its matching right item

Items

Honeynet
Honeyfile
Low-interaction Honeypot
Honeytoken

Matches

Show answer & explanation

Answer

Honeynet pairs with the network segment of multiple decoy systems. Honeyfile pairs with the deceptive file positioned on storage shares. Low-interaction Honeypot pairs with the decoy service emulating basic protocols. Honeytoken pairs with fake data used to detect exfiltration.
Each deception technology is paired accurately based on its scope and implementation layer: Honeynet matches multi-system network decoys; Honeyfile matches decoy documents on storage systems; Low-interaction Honeypot matches basic protocol emulation services; and Honeytoken matches fake data records used for tracing exfiltration.

Step-by-Step Solution

1
Identify full network decoy implementations.
Honeynet corresponds to an entire simulated network infrastructure.
Honeynets represent multi-system decoy environments rather than isolated files or single services.
2
Identify file-based deception assets.
Honeyfile corresponds to fake documents or files on storage devices.
Honeyfiles are dedicated file objects monitored specifically for unauthorized opening or editing.
3
Identify limited-emulation decoys.
Low-interaction Honeypot corresponds to basic service emulation.
Low-interaction honeypots simulate only necessary network responses without exposing a full operating system.
4
Identify data-centric deception tokens.
Honeytoken corresponds to synthetic data records or fake credentials.
Honeytokens are isolated pieces of data planted in systems or databases to detect unauthorized handling.

Key Concept

Deception and Disruption Technologies
Question 1489Question →

An organization installs closed-circuit television (CCTV) cameras around the perimeter of its facility to continuously monitor activity and review video footage following potential security incidents. Which security control functional type does this installation primarily represent?

Show answer & explanation

Answer: Detective

Answer

Detective
Detective security controls operate to identify, record, and signal security events or unauthorized actions. CCTV recording provides security personnel with the ability to detect incidents as they occur or review evidence during post-incident investigations.

Step-by-Step Solution

1
Evaluate the primary purpose of the security mechanism described in the scenario.
The continuous recording of camera footage is used to observe activity and identify security breaches after they occur.
Controls designed to record, alert, or inspect events to identify policy violations or breaches fall into the detective functional type.

Key Concept

Security Control Functional Types
Question 1490Question →

A security engineer is integrating an identity provider (IdP) with an internal web application using OpenID Connect (OIDC) and OAuth 2.0. During testing, users successfully authenticate at the IdP prompt and receive a valid ID token verifying their credentials. However, when the web application presents the accompanying access token to a backend microservice to update sensitive records, the backend service returns an HTTP 403 Forbidden status code because the token is missing the required write permission scope. Which core pillar of the AAA framework is directly failing in this scenario, and why?

Show answer & explanation

Answer: Authorization, because while user identity was verified during authentication, the access token lacks the required permissions scope to perform the requested operation.

Answer

Authorization failed because user identity was successfully authenticated, but the issued access token lacked the required permission scopes to perform the requested operation.
The correct response highlights that Authorization is the specific AAA component failing. Authentication was successfully completed when the identity provider verified the user's credentials and issued the ID token. However, when requesting the backend resource, the access token lacked the required scope attributes to permit write operations, resulting in an authorization failure (HTTP 403 Forbidden).

Step-by-Step Solution

1
Analyze the scenario metrics and log responses
User credentials were validated and an ID token was issued (Authentication succeeded). The backend returned HTTP 403 Forbidden due to missing scope attributes.
Differentiating between identity validation and permission assignment is essential for identifying the specific AAA stage.
2
Map the error behavior to the AAA framework
HTTP 403 Forbidden corresponds to permission enforcement failure (Authorization), whereas HTTP 401 Unauthorized corresponds to identity proof failure (Authentication).
Authorization enforces access rights based on policies, roles, or scopes after identity is established.
3
Evaluate the correct operational function of AAA pillars
The failure occurs at the authorization layer due to missing privilege scopes on the access token presented to the backend resource.
Proper AAA implementation isolates authentication (identity verification) from authorization (permission evaluation).

Key Concept

Distinction between Authentication (proving identity) and Authorization (granting permissions) within OAuth 2.0 / OIDC and AAA frameworks
Estimated Time:2m 0s
Question 1491Question →

A security administrator is evaluating existing security measures across an enterprise environment to ensure appropriate control categorization. Which of the following represent technical security controls? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Firewall rules restricting unauthorized inbound port traffic; Database disk encryption applied to sensitive files at rest

Answer

The technical security controls are firewall rules restricting unauthorized inbound port traffic and database disk encryption applied to sensitive files at rest.
Technical controls rely on software, hardware, or firmware mechanisms to automatically safeguard systems and data. Firewall rules enforce access control at the network level using software logic, and disk encryption uses cryptographic algorithms to protect data at rest.

Step-by-Step Solution

1
Identify the core definition of technical controls
Technical controls (also known as logical controls) are implemented through computer hardware, software, or firmware mechanisms.
Control categorization relies on distinguishing technology-driven mechanisms from policies, operational procedures, and physical barriers.
2
Evaluate each control option against the definition
Firewall rules and data encryption execute via system hardware/software logic, while security policies are managerial oversight documents and door locks are physical security mechanisms.
Distinguishing between technical, managerial, operational, and physical categories ensures accurate control assessment.

Key Concept

Technical security controls use software, hardware, or firmware technology to protect system resources and data integrity.
Question 1492Question →

A software enterprise recently migrated its legacy inventory management application to a hybrid cloud environment. To protect application access, the security team configured a Web Application Firewall at the network edge and mandated multi-factor authentication during user login. However, once an employee successfully authenticates at the start of their shift, backend microservices honor all subsequent data requests based on the request originating from an internal IP subnet, without re-evaluating risk telemetry, user behavior, or device compliance. Which core principle of Zero Trust Architecture is directly violated by this security design?

Show answer & explanation

Answer: Continuous verification and explicit validation, because session context and authorization must be evaluated dynamically per request rather than assuming persistent trust after initial authentication.

Answer

Continuous verification and explicit validation, because session context and authorization must be evaluated dynamically per request rather than assuming persistent trust after initial authentication.
The correct answer accurately identifies that Zero Trust Architecture eliminates implicit trust based on physical or logical network location. Under Zero Trust guidelines (such as NIST SP 800-207), access decisions must be explicitly validated and continuously re-evaluated on a per-request basis using contextual signals (e.g., device health, resource sensitivity, threat intelligence), rather than relying on a single initial MFA event at the network border.

Step-by-Step Solution

1
Analyze the operational scenario provided in the stem.
Identified that authentication occurs only once at login, after which access is granted implicitly based on internal network IP subnets.
Understanding the current security posture reveals where implicit trust assumptions are introduced.
2
Evaluate the identified flaw against Zero Trust tenets.
Zero Trust mandates 'Never Trust, Always Verify', requiring continuous assessment of identity, device health, and context for every transaction.
Static trust based on network location or initial login violates explicit validation and continuous verification principles.
3
Select the option that correctly identifies the violated Zero Trust principle.
The requirement for dynamic, per-request context re-evaluation directly highlights continuous verification as the missing principle.
Per-request authorization prevents lateral movement and unauthorized access from compromised internal endpoints.

Key Concept

Continuous Verification and Explicit Validation in Zero Trust Architecture
Question 1493Question →

An enterprise risk management team is auditing the security controls of an automated insurance claims processing platform. Match each system security implementation on the left to the corresponding security objective (CIA Triad pillar or Non-Repudiation) it primarily satisfies on the right.

Click a left item, then click its matching right item

Items

Encrypting database tables containing policyholder Personally Identifiable Information (PII) using AES-256 to block unauthorized viewing.
Validating claim file attachments against SHA-256 cryptographic checksums to detect any unauthorized modification or corruption during transmission.
Deploying load-balanced multi-region web servers with automated failover to maintain operational access during surge periods.
Requiring claims adjusters to digitally sign payout approvals using asymmetric key pairs stored on personal hardware tokens to prevent denial of authorization.

Matches

Show answer & explanation

Answer

Encrypting PII matches Confidentiality; SHA-256 checksum validation matches Integrity; Multi-region load balancing matches Availability; Digital signatures on payout approvals match Non-repudiation.
Each technical safeguard maps directly to one of the four foundational security objectives: encrypting PII ensures Confidentiality; checking SHA-256 hashes ensures Integrity; load balancing ensures Availability; and digital signatures using hardware-backed asymmetric keys ensure Non-repudiation.

Step-by-Step Solution

1
Analyze the control restricting unauthorized viewing of sensitive PII data
AES-256 database encryption protects privacy by hiding content from unauthorized entities, which maps to Confidentiality.
Confidentiality ensures information is accessible only to authorized users.
2
Analyze the control detecting unauthorized modifications to uploaded files
SHA-256 hash checks verify that data remains unaltered during transit, which maps to Integrity.
Integrity guarantees the accuracy and completeness of data by detecting unauthorized changes.
3
Analyze the control providing system uptime and access during high demand
Multi-region load balancing and redundancy maintain service uptime, which maps to Availability.
Availability ensures systems and data are operational and accessible whenever required.
4
Analyze the control preventing a user from denying a specific transaction or approval
Digital signatures using asymmetric cryptography combine authentication with proof of action, which maps to Non-repudiation.
Non-repudiation prevents an individual from denying the authenticity or origin of a signed document or transaction.

Key Concept

CIA Triad and Non-Repudiation Core Security Objectives
Question 1494Question →

A enterprise security architect is updating the Transport Layer Security (TLS) configuration for an API gateway that services millions of mobile endpoints. The architecture requires establishing unique, temporary symmetric session keys across untrusted connections while minimizing computational overhead on mobile processor microchips. Additionally, the solution must enforce Perfect Forward Secrecy (PFS) so that a future compromise of the API gateway's long-term private key will not allow an attacker to decrypt previously captured session traffic. Which cryptographic key exchange algorithm combination should the architect configure on the gateway?

Show answer & explanation

Answer: Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)

Answer

Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) uses temporary (ephemeral) key pairs for every handshake session, ensuring that compromising long-term keys does not reveal past communications (Perfect Forward Secrecy). Additionally, using elliptic curve mathematics reduces bit-length overhead, preserving CPU and battery resources on mobile clients.

Step-by-Step Solution

1
Analyze the core requirements
Identified low-overhead key exchange on mobile devices, temporary session key agreement, and Perfect Forward Secrecy (PFS).
PFS requires key exchange protocols that derive unique, temporary key pairs per session rather than using static private keys.
2
Evaluate key exchange mechanisms for forward secrecy
Ephemeral Diffie-Hellman (EDH/DHE) variants generate temporary keys discarded after session termination.
Because ephemeral keys are never stored long-term, compromising the server private key cannot decrypt past recorded sessions.
3
Select algorithm optimized for mobile resource constraints
Elliptic Curve cryptography (ECC) delivers equivalent security to standard RSA/DH with significantly smaller key sizes and less computational overhead.
Combining ECC with Ephemeral Diffie-Hellman yields ECDHE, meeting both the mobile efficiency requirement and PFS enforcement.

Key Concept

Perfect Forward Secrecy via Ephemeral Elliptic Curve Key Exchange
Estimated Time:2m 0s
Question 1495Question →

Following a major security incident involving a compromised legacy jump box, an enterprise security team implements two immediate measures: (1) deploying custom Web Application Firewall (WAF) rate-limiting rules to shield the legacy application while developers rebuild the primary authentication microservice, and (2) establishing an enterprise-wide policy requiring formal executive sign-off for any future jump box configuration modifications. Which of the following correctly classifies Measure 1 and Measure 2 by their control category and functional type?

Show answer & explanation

Answer: Measure 1 is a Technical / Compensating control; Measure 2 is a Managerial / Directive control.

Answer

Measure 1 is classified as a Technical / Compensating control, and Measure 2 is classified as a Managerial / Directive control.
Deploying WAF rate-limiting rules relies on technical software enforcement to provide an alternative guardrail while primary authentication mechanisms are constructed, making it a Technical / Compensating control. Enforcing executive sign-off through formal policy sets organizational rules and oversight, making it a Managerial / Directive control.

Step-by-Step Solution

1
Analyze Measure 1 (Deploying temporary WAF rate-limiting rules while rebuilding authentication).
Control Category = Technical; Functional Type = Compensating.
WAF rules are automated software mechanisms (Technical). Because they temporarily mitigate risk while the primary authentication control is missing or being rebuilt, they function as a Compensating control.
2
Analyze Measure 2 (Establishing enterprise policy requiring executive sign-off for configuration changes).
Control Category = Managerial; Functional Type = Directive.
Governance policies and administrative oversight rules are defined by management (Managerial). Controls that specify or mandate required organizational behavior operate as Directive controls.

Key Concept

Dual-Axis Security Control Classification (Categories vs. Functional Types)
Question 1496Question →

A Security Operations Center (SOC) analyst receives an automated SIEM alert indicating high-priority authentication anomalies on a critical domain server. The analyst extracts the following log entries from the SIEM console:

text
2026-07-27T14:02:11Z Hostname: SEC-DC01 EventID: 4625 Status: 0xC000006D User: admin_jdoe SrcIP: 192.168.10.45
2026-07-27T14:02:13Z Hostname: SEC-DC01 EventID: 4625 Status: 0xC000006D User: admin_jdoe SrcIP: 192.168.10.45
2026-07-27T14:02:15Z Hostname: SEC-DC01 EventID: 4625 Status: 0xC000006D User: admin_jdoe SrcIP: 192.168.10.45
2026-07-27T14:02:18Z Hostname: SEC-DC01 EventID: 4624 LogonType: 10 User: admin_jdoe SrcIP: 192.168.10.45
2026-07-27T14:02:19Z Hostname: SEC-DC01 EventID: 4672 User: admin_jdoe Privileges: SeDebugPrivilege

Based on these correlated log entries, which of the following security events has occurred?

Show answer & explanation

Answer: A successful password guessing attempt resulting in an interactive Remote Desktop session with administrative privileges assigned.

Answer

The log sequence represents a successful password guessing attempt resulting in an interactive Remote Desktop session with administrative privileges assigned.
The correct answer accurately interprets the chronological sequence of Windows Security Event IDs: multiple Event 4625 logs represent failed authentication attempts (brute force), immediately followed by Event 4624 with LogonType 10 indicating a successful Remote Desktop (RDP) session, and Event 4672 confirming administrative privilege elevation.

Step-by-Step Solution

1
Analyze initial failed authentication logs.
Multiple Windows Event ID 4625 entries occur in rapid succession from IP 192.168.10.45 for user admin_jdoe, indicating repeated failed logon attempts (credential guessing/brute force).
Event ID 4625 explicitly logs failed logon attempts in Windows Event Logs.
2
Analyze the subsequent successful logon entry.
Event ID 4624 indicates a successful logon. LogonType 10 specifies Remote Desktop (RDP) interactive network access from the same source IP.
LogonType 10 differentiates Remote Desktop logins from local interactive (LogonType 2) or network share (LogonType 3) logons.
3
Correlate privilege assignment.
Event ID 4672 immediately follows, logging special privileges assigned to the new user session (such as SeDebugPrivilege).
Event ID 4672 confirms the session has superuser or administrative control over the system.

Key Concept

Windows Security Event Correlation in SIEM (Event IDs 4625, 4624, and 4672)
Estimated Time:1m 30s
Question 1497Question →

A cloud security team is designing a telemetry ingestion pipeline for high-speed streaming data collected from millions of remote edge devices. The architecture requires that each transmitted payload maintain confidentiality while enabling recipient servers to verify message authenticity and integrity in a single, computationally efficient pass. Which cryptographic algorithm mode or mechanism best satisfies these operational constraints?

Show answer & explanation

Answer: Galois/Counter Mode (GCM)

Answer

Galois/Counter Mode (GCM) is the correct cryptographic mechanism as it provides authenticated encryption with high performance and parallel processing capability.
Galois/Counter Mode (GCM) combines counter-mode symmetric encryption with Galois field authentication to deliver Authenticated Encryption with Associated Data (AEAD). It provides confidentiality, integrity, and origin authenticity in a highly efficient, parallelizable structure ideal for fast streaming telemetry.

Step-by-Step Solution

1
Analyze the scenario requirements
Identified the need for confidentiality (encryption), integrity/authenticity verification, high throughput, and low processing overhead for streaming telemetry data.
High-volume IoT ingestion requires a mechanism that combines encryption and authentication efficiently without requiring multiple heavy passes over data blocks.
2
Evaluate cryptographic mechanisms against security objectives
Authenticated Encryption with Associated Data (AEAD) modes like GCM perform symmetric block cipher encryption (CTR mode) while computing an authentication tag (Galois field multiplication) in parallel.
AEAD eliminates the need to run separate encryption and hashing routines, saving CPU cycles on edge endpoints and ingestion servers.
3
Rule out unsuitable alternatives
Asymmetric encryption (RSA) is too slow for bulk streaming; ECB mode lacks pattern protection and integrity checks; standalone SHA-256 lacks confidentiality.
Selecting symmetric AEAD modes is the standard enterprise practice for authenticated stream encryption.

Key Concept

Authenticated Encryption with Associated Data (AEAD) and Cipher Modes
Estimated Time:1m 30s
Question 1498Question →

An enterprise security team is designing a cryptographically secure real-time transaction processing engine for a distributed financial network. The system requires ephemeral key agreement for inter-microservice TLS communications to protect past sessions if long-term credentials are compromised, alongside high-speed data encryption with built-in authenticity verification for sensitive ledger entries stored in volatile memory. Which of the following cryptographic implementation choices should the security team select to satisfy these requirements? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Implement Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) key exchange for microservice transport sessions to provide Perfect Forward Secrecy.; Utilize Advanced Encryption Standard in Galois/Counter Mode (AES-GCM) for in-memory ledger entry protection.

Answer

The correct implementation choices are using Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) for transport session key exchange and Advanced Encryption Standard in Galois/Counter Mode (AES-GCM) for in-memory ledger protection.
Implementing Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) provides Perfect Forward Secrecy (PFS) by generating temporary keys for each TLS session, ensuring past communications remain secure even if long-term private keys are compromised later. Additionally, Advanced Encryption Standard in Galois/Counter Mode (AES-GCM) is an authenticated symmetric encryption cipher mode (AEAD) optimized for high-throughput data protection, delivering both confidentiality and integrity verification.

Step-by-Step Solution

1
Analyze transport session privacy and key durability requirements
Identify that Perfect Forward Secrecy (PFS) via ephemeral key agreement (ECDHE) is required so future key compromises do not decrypt past traffic.
Static key exchange mechanisms reuse keys across sessions, whereas ephemeral Diffie-Hellman creates temporary keys per session.
2
Evaluate data protection requirements for high-throughput volatile memory storage
Select AES-GCM as an authenticated symmetric cipher providing high-speed confidentiality and built-in integrity tags.
Symmetric AEAD modes handle bulk data efficiently with cryptographic authenticity verification, unlike asymmetric algorithms which are too slow.
3
Differentiate cryptographic integrity vs non-repudiation and control scope
Reject standalone hashing for non-repudiation, asymmetric ciphers for bulk storage, and network firewalls for cipher suite remediation.
Non-repudiation requires private-key digital signatures, bulk storage demands symmetric encryption, and cipher suite weaknesses require protocol-level cryptographic configuration.

Key Concept

Cryptographic Algorithms, Cipher Modes, and Ephemeral Key Exchange
Question 1499Question →

An IT operations team is preparing to upgrade the operating system of an enterprise web server host cluster. According to standard change management procedures, which of the following activities MUST be completed prior to implementing the change in the production environment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Testing the operating system upgrade in a non-production staging environment to assess security and operational impacts; Creating a documented backout and rollback plan to restore the previous functional state if the upgrade fails

Answer

The essential pre-implementation change management activities are testing the upgrade in a non-production staging environment and creating a documented backout plan to restore functionality if issues arise.
Formal change management procedures require pre-implementation testing in a non-production environment to evaluate security impacts and potential conflicts. Additionally, establishing a documented backout plan is mandatory to ensure that the environment can be safely restored if errors or vulnerabilities manifest during execution.

Step-by-Step Solution

1
Identify risk reduction procedures required before production deployment.
Staging environment testing verifies software stability and security impact prior to touching live infrastructure.
Testing mitigates operational risk by exposing flaws early.
2
Identify contingency controls required for formal change authorization.
Developing a detailed rollback plan guarantees that services can be recovered if the change breaks production functionality.
Rollback planning ensures business continuity and resilience.

Key Concept

Change Management and Security Impacts
Estimated Time:45s
Question 1500Question →

Following an enterprise risk assessment, an organization implements several new security measures: (1) automated Endpoint Detection and Response (EDR) agents configured to isolate compromised hosts and terminate malicious processes, (2) formal updates to the enterprise security governance document requiring multi-factor authentication (MFA) across all administrative accounts, (3) decoy honeypot servers deployed in an isolated subnet to attract and monitor threat actors, and (4) mandatory annual security awareness training for all software developers. Which of the following statements correctly classify the category and functional type of these security controls according to CompTIA Security+ standards? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Automated EDR host isolation and process termination represents a Technical control operating as a Corrective control type.; Formal updates to governance documentation mandating MFA enforcement represent a Managerial control operating as a Directive control type.

Answer

The correct statements are that automated EDR host isolation represents a Technical control operating as a Corrective control type, and formal updates to governance documentation mandating MFA represent a Managerial control operating as a Directive control type.
Automated EDR scripts that isolate hosts and kill malicious processes utilize system technology (Technical category) to contain active threats and restore normal operations (Corrective type). Additionally, official updates to security policy documentation by leadership fall under governance (Managerial category) and dictate mandatory compliance requirements (Directive type).

Step-by-Step Solution

1
Analyze Control 1 (Automated EDR host isolation and process termination)
Categorized under Technical controls because it is executed via software agents and operating system APIs. Functionally classified as Corrective because host isolation actively mitigates an ongoing security event and contains damage.
Technical controls use technology/hardware/software; Corrective controls lessen the impact of an incident after or during occurrence.
2
Analyze Control 2 (Formal governance document updates requiring MFA)
Categorized under Managerial (Administrative) controls because it involves policy documentation and oversight framework design. Functionally classified as Directive because it specifies mandatory security practices and organizational expectations.
Managerial controls deal with security governance, policies, and risk oversight; Directive controls prescribe mandated behaviors.
3
Evaluate Distractor 1 (Honeypot servers as Preventive controls)
Incorrect. Honeypots capture intelligence and detect intrusion; they do not filter or prevent production traffic attacks inline.
Honeypots are Detective/Deception tools, not inline Preventive enforcement points like firewalls or IPS.
4
Evaluate Distractor 2 (Security awareness training as Physical controls)
Incorrect. Security awareness training governs human behavior and day-to-day user tasks, making it an Operational control.
Physical controls protect tangible assets and facilities (e.g., locks, fences, guards). Training is an Operational control.

Key Concept

Dual-axis classification of security controls by Category (Technical, Managerial, Operational, Physical) and Functional Type (Preventive, Detective, Corrective, Deterrent, Compensating, Directive).
PreviousPage 75 / 112Next
All practice questions — CompTIA Security+ | Examkin