Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1501Question →

During a multi-cloud infrastructure compliance review, a cloud engineering team is evaluating security controls against corporate documentation. Executive leadership previously published an overarching document mandating that all workloads in production environments must encrypt data in transit. To operationalize this directive, the security engineering department issued a compulsory document specifying that all inter-service cluster communications must strictly utilize TLS 1.3 with specific approved cipher suites and mandatory mutual authentication parameters. Which of the following governance framework document types is represented by this mandatory technical specification?

Show answer & explanation

Answer: Security Standard

Answer

The mandatory technical specification document is a Security Standard.
A Security Standard defines compulsory rules, technologies, parameters, and measurable metrics needed to achieve policy objectives. Specifying TLS 1.3, exact cipher suites, and mutual authentication parameters constitutes a mandatory technical standard.

Step-by-Step Solution

1
Analyze the governance document characteristics described in the scenario.
The document specifies exact mandatory technical parameters (TLS 1.3, specific cipher suites, mutual authentication) that enforce an executive directive.
Governance documents are categorized based on their level of technical detail and whether compliance is mandatory or discretionary.
2
Differentiate between policies, standards, guidelines, and baselines.
Policies establish top-level mandates; standards define mandatory technical rules/configurations; guidelines offer optional advice; baselines establish minimum configuration snapshots for systems.
Matching technical requirements to governance hierarchy definitions ensures correct classification.
3
Select the governance document type that matches mandatory specific technical configurations.
Security Standard is the precise match.
Standards bridges high-level policy intent with actionable, mandatory technical enforcement rules across an organization.

Key Concept

Hierarchy of Security Governance Documents (Policies vs. Standards vs. Baselines vs. Guidelines)
Question 1502Question →

After detecting an active fileless malware infection executing via host memory scripts on a critical workstation, the Incident Response (IR) team initiates their initial handling playbook. Which of the following actions should the team perform immediately to contain the threat while preserving digital evidence? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Disconnect the workstation from the local network via physical cable removal or port isolation while keeping system power on.; Acquire a full forensic capture of the host system's volatile memory (RAM) prior to any system shutdown or state modification.

Answer

The incident response team should isolate the host from the network while maintaining system power, and capture a full dump of volatile system memory (RAM).
Effective incident response playbooks mandate network isolation to stop threat expansion while keeping the machine powered on, followed by acquiring volatile RAM to capture memory-resident fileless payloads according to the order of volatility.

Step-by-Step Solution

1
Evaluate containment priorities during an active fileless malware incident.
Identify that network containment is essential to stop lateral movement and Command & Control (C2) communication without powering off the host.
Maintaining system power prevents volatile memory loss.
2
Apply forensic evidence preservation principles according to the order of volatility.
Prioritize capturing volatile system RAM before performing host changes, reboots, or drive imaging.
Fileless malware resides exclusively in memory and is wiped if the system reboots.
3
Distinguish containment phase steps from eradication and recovery actions.
Reject premature re-imaging or host wiping actions.
Re-imaging occurs in the eradication phase after evidence collection and root cause analysis are finished.

Key Concept

Incident Response Containment and Order of Volatility in Evidence Preservation
Estimated Time:1m 30s
Question 1503Question →

A security operations team configures an isolated decoy server on an internal network. The server runs a complete, fully functional operating system with authentic services and interactive shells designed to capture advanced attacker tools, command-line techniques, and lateral movement tactics in real time. Which of the following deception technologies has the team implemented?

Show answer & explanation

Answer: High-interaction honeypot

Answer

High-interaction honeypot
A high-interaction honeypot presents a real, fully operational environment with authentic operating system services. This enables security teams to observe sophisticated post-exploitation behavior, capture custom tools, and analyze an attacker's manual command execution.

Step-by-Step Solution

1
Analyze the operational capabilities described in the scenario
The target system requires a complete, fully functional operating system with interactive command shell access to record advanced adversary tactics.
Deception technologies are categorized by their level of interactivity, complexity, and operational exposure.
2
Compare high-interaction and low-interaction deception implementations
High-interaction honeypots run real operating systems and full services, whereas low-interaction honeypots only emulate basic network listeners or fixed protocol responses.
Providing genuine interactive shells and complete OS functionality is the defining characteristic of a high-interaction honeypot.

Key Concept

Deception and Disruption Technologies - High-Interaction Honeypot
Question 1504Question →

An organization has expanded its remote workforce, resulting in laptops connecting to the enterprise network via VPN at unpredictable times. The security operations team observes that scheduled centralized network vulnerability scans routinely miss these endpoints because they are disconnected or powered off during scan execution windows. Which of the following scanning solutions best enables the security team to maintain continuous vulnerability visibility for these roaming endpoints?

Show answer & explanation

Answer: Deploy host-based vulnerability scanning agents to locally assess system configurations and transmit results when connectivity is established.

Answer

Deploying host-based vulnerability scanning agents to locally assess system configurations and transmit results when connectivity is established.
Deploying host-based vulnerability scanning agents directly onto endpoints allows vulnerability data to be collected locally regardless of whether the machine is connected to the corporate network. When the roaming device connects to the internet or VPN, the lightweight agent securely transmits its local scan results back to the central management console, eliminating blind spots caused by rigid network scan windows.

Step-by-Step Solution

1
Analyze the operational constraints of the remote endpoint environment.
Identified that endpoints are frequently offline or off-network during scheduled centralized network scan windows, causing missing assessment data.
Centralized network scanners require active network reachability and host uptime during the scan execution window.
2
Evaluate vulnerability assessment methodologies suited for transient/roaming hosts.
Host-based agents execute assessments locally on the endpoint OS using local resources and cache scan reports until network connectivity is restored.
Agent-based scanning decouples vulnerability assessment timing from network availability.
3
Select the optimal solution that resolves the visibility gap without impacting operational workflows.
Deploying agent-based software ensures consistent, up-to-date vulnerability tracking across roaming laptops.
Host agents provide continuous visibility regardless of endpoint location or VPN connection schedules.

Key Concept

Agent-Based vs. Network-Based Vulnerability Scanning
Estimated Time:1m 30s
Question 1505Question →

An organization aims to enhance its threat detection capabilities against internal lateral movement and credential theft within a cloud-native environment. The security team decides to deploy deception technologies to lure attackers into revealing their presence without exposing actual production assets. Which of the following techniques should the security team implement to meet these objectives? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Honeytokens embedded within deployment configuration files to trigger alerts when invoked; Low-interaction honeypots disguised as vulnerable microservice API endpoints to detect unauthorized probes

Answer

The organization should implement honeytokens embedded within configuration files and low-interaction honeypots disguised as vulnerable API endpoints.
Honeytokens embedded in configuration files and low-interaction honeypots simulating API endpoints are direct implementations of deception technology. Honeytokens alert security operations when unauthorized entities attempt to use fake tokens, while low-interaction honeypots capture reconnaissance probes safely without risking production data.

Step-by-Step Solution

1
Identify the primary objective of active deception deployment
The objective is to deploy deception resources that attract adversaries and detect unauthorized internal activities without exposing real assets.
Deception technologies work by establishing non-production lures and decoys that generate high-fidelity detection signals upon interaction.
2
Evaluate candidate deception components
Honeytokens provide immediate detection when stolen credentials are used, while low-interaction honeypots simulate API endpoints to capture initial reconnaissance.
Both methods act directly as lures to trap attackers early in the lateral movement or discovery phase.
3
Distinguish deception mechanisms from traditional security controls
Inline IPS devices and NAC policies are active preventive and network enforcement defenses, not deception lures.
Traditional defensive controls enforce policy and filter production traffic rather than intentionally offering fake target assets.

Key Concept

Deception technologies strategically deploy fake assets, credentials, or services (such as honeytokens and honeypots) to allure adversaries and detect unauthorized activity early in the attack lifecycle.
Question 1506Question →

A lead security analyst is evaluating enterprise cryptographic controls to remediate vulnerabilities identified in a recent security audit. Match each cryptographic mechanism on the left with its primary operational security objective or implementation purpose on the right.

Click a left item, then click its matching right item

Items

Ephemeral Elliptic Curve Diffie-Hellman (ECDHE)
Password-Based Key Derivation Function 2 (PBKDF2)
Galois/Counter Mode (AES-GCM)
Elliptic Curve Digital Signature Algorithm (ECDSA)

Matches

Show answer & explanation

Answer

Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) pairs with providing Perfect Forward Secrecy; PBKDF2 pairs with mitigating offline brute-force attacks on stored credentials; AES-GCM pairs with delivering authenticated encryption (AEAD) providing confidentiality and integrity; and ECDSA pairs with providing non-repudiation and origin authenticity via asymmetric signatures.
Each cryptographic primitive is mapped to its core security objective: ECDHE provides ephemeral session key exchange for Perfect Forward Secrecy; PBKDF2 implements computational key stretching to thwart offline password cracking; AES-GCM delivers authenticated symmetric encryption (AEAD) combining integrity and confidentiality; and ECDSA leverages asymmetric keys to generate digital signatures guaranteeing non-repudiation and origin verification.

Step-by-Step Solution

1
Analyze Ephemeral Elliptic Curve Diffie-Hellman (ECDHE)
ECDHE is an asymmetric key exchange protocol using ephemeral (temporary) keys per session.
Because session keys are regenerated dynamically and discarded, compromising a permanent private key does not decrypt historical session traffic, meeting the requirement for Perfect Forward Secrecy.
2
Analyze Password-Based Key Derivation Function 2 (PBKDF2)
PBKDF2 is a key stretching algorithm utilizing salt and iterative hashing.
Iterative hashing slows down candidate testing, directly counteracting high-speed GPU-based offline brute-force credential cracking.
3
Analyze Galois/Counter Mode (AES-GCM)
AES-GCM is a symmetric authenticated encryption mode (AEAD).
It combines counter mode encryption (confidentiality) with Galois field multiplication (integrity authentication tag) for fast, secure data stream protection.
4
Analyze Elliptic Curve Digital Signature Algorithm (ECDSA)
ECDSA is an asymmetric algorithm used for digital signatures.
Signing hash values using asymmetric private keys establishes verifiable proof of origin, integrity, and non-repudiation.

Key Concept

Cryptographic Concepts and Algorithms
Question 1507Question →

During an enterprise Security Operations Center (SOC) investigation, telemetry from various log sources is ingested into a SIEM platform. Match each log snippet on the left with the corresponding event description on the right.

Click a left item, then click its matching right item

Items

192.168.1.50 - - [27/Jul/2026:14:32:10 +0000] "GET /login.php?user=admin' OR '1'='1" 200 4502
EventID: 4625, Account Name: jdoe, Failure Reason: Unknown user name or bad password, Logon Type: 3
Jul 27 14:35:01 fw01 kernel: DROP IN=eth0 OUT= SRC=10.0.0.15 DST=192.168.1.10 PROTO=TCP SPT=49152 DPT=445
type=SYSCALL arch=c000003e syscall=59 success=yes exit=0 pcomm="nc" exe="/usr/bin/nc"

Matches

Show answer & explanation

Answer

The correct pairings are: HTTP GET log with SQL payload matches the web application SQL injection description; Windows Event ID 4625 matches the failed network logon event; Firewall DROP entry targeting port 445 matches the blocked SMB traffic event; Linux SYSCALL audit log execve matching nc binary matches the executed netcat process description.
Each log entry contains distinctive indicators characteristic of its log source and activity type: HTTP GET request with SQL syntax indicates SQL injection; Windows Event ID 4625 indicates a failed logon; Syslog kernel DROP output targeting port 445 indicates blocked SMB traffic; and Linux auditd syscall 59 referencing /usr/bin/nc indicates netcat process execution.

Step-by-Step Solution

1
Analyze the web server access log snippet.
Identify HTTP GET method containing SQL logic syntax (admin' OR '1'='1), confirming a web application SQL injection attempt.
Log syntax matches standard Nginx/Apache log formatting with embedded web exploit strings.
2
Analyze the Windows Event log snippet.
Identify Event ID 4625 and Logon Type 3, pointing to an unsuccessful network authentication attempt.
Event ID 4625 standardly logs logon failures in Windows Security Event logs.
3
Analyze the firewall syslog snippet.
Identify action DROP and destination port 445 (DPT=445), denoting blocked SMB protocol traffic.
Firewall syslog outputs typically format dropped network traffic with directional IP/port flags.
4
Analyze the Linux auditd snippet.
Identify syscall=59 (execve) along with exe="/usr/bin/nc", pointing to process execution of the Netcat networking tool.
Linux audit daemon logs system calls related to process creation and command execution.

Key Concept

Log Identification and SIEM Telemetry Archetypes
Question 1508Question →

An enterprise network team plans to modify existing firewall rule sets to allow communications for a new third-party business application. Which of the following represents the primary security objective of conducting a security impact assessment before approving this request?

Show answer & explanation

Answer: To identify unintended vulnerability exposures and potential security risks introduced by the proposed modification.

Answer

To identify unintended vulnerability exposures and potential security risks introduced by the proposed modification.
Conducting a security impact assessment ensures an organization evaluates how a proposed infrastructure or configuration change affects the security posture, helping identify new vulnerabilities, policy violations, or unauthorized access vectors before implementation.

Step-by-Step Solution

1
Analyze the proposed configuration change scenario.
Recognize that modifying firewall rule sets alters network traffic boundaries and access permissions.
Firewall configuration updates can inadvertently open unauthorized ports or grant excessive privileges.
2
Determine the role of a security impact assessment within change management workflows.
Identify that the primary goal is proactively identifying new risks, compliance issues, or attack surface expansions.
Evaluating security impacts prior to implementation ensures that potential risks are understood and mitigated before changes go live.

Key Concept

Security Impact Analysis in Change Control
Question 1509Question →

A systems administrator is reviewing federated identity access logs for an enterprise web portal. After a user successfully validates their username, password, and time-based one-time password (TOTP) at the central Identity Provider (IdP), the service provider parses the group membership claims in the token to restrict the user to read-only privileges on administrative dashboards. Which pillar of the AAA framework is being executed by the service provider when enforcing these access privileges based on group membership?

Show answer & explanation

Answer: Authorization

Answer

Authorization
Authorization is the AAA function responsible for evaluating rules and permissions to determine what resources or capabilities an authenticated identity may access. Restricting a user to read-only access based on group claims in a federated token is a classic application of authorization.

Step-by-Step Solution

1
Identify the primary action being evaluated in the scenario.
The service provider evaluates token claims to grant specific privileges (read-only administrative dashboard access).
Assigning and restricting permissions based on verified roles or attributes defines how privileges are governed.
2
Map the identified action to the AAA framework components.
Credential validation is Authentication; permission evaluation is Authorization; logging and audit metrics is Accounting.
Because the step enforces what the user can do after identity confirmation, it falls under Authorization.

Key Concept

Authentication, Authorization, and Accounting (AAA)
Question 1510Question →

A logistics enterprise is migrating its internal supply chain microservices from a legacy network zone model to a Zero Trust Architecture (ZTA). The engineering team must ensure that service-to-service communications are secured strictly according to Zero Trust principles. Which of the following design decisions directly align with Zero Trust Architecture principles for this deployment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Implement mutual TLS (mTLS) to cryptographically authenticate identity and encrypt transit data for every API request between microservices, regardless of logical network location.; Enforce continuous transaction-level authorization by dynamically evaluating contextual risk parameters and access token validity for each request.

Answer

Implementing mutual TLS for cryptographic identity and data protection across all requests, alongside enforcing continuous transaction-level authorization based on contextual risk evaluation, directly aligns with Zero Trust Architecture principles.
Zero Trust Architecture operates on the core tenets of 'never trust, always verify' and assuming breach. Implementing mutual TLS ensures explicit verification of service identity and cryptographic data protection for every request across all boundaries. Furthermore, continuous transaction-level authorization re-evaluates security posture and context dynamically rather than relying on static or initial authentication states.

Step-by-Step Solution

1
Evaluate the baseline Zero Trust principle regarding implicit trust and network boundaries.
Zero Trust mandates that no request is inherently trusted based on network position, requiring explicit verification and encryption for all inter-service traffic via mutual TLS (mTLS).
Microservices operating inside a container cluster or internal network must still authenticate and encrypt all data in transit.
2
Analyze how authorization decisions should be made within a Zero Trust Architecture.
Authorization must be continuous and contextual, evaluating security parameters and session tokens on every transaction rather than relying on one-time initial authentication.
Static initial authentication at the boundary does not account for mid-session risk changes or lateral movement threats within the environment.
3
Eliminate choices based on flawed assumptions regarding perimeter reliance, control types, and authentication scope.
Bypassing authentication for internal cluster traffic, trusting edge gateway authentication for downstream access, and misclassifying passive detective controls as inline preventive enforcement all violate Zero Trust principles.
Zero Trust rejects perimeter-based implicit trust and requires proper alignment of Policy Enforcement Points with dynamic policy evaluation.

Key Concept

Zero Trust Architecture Principles (Explicit Verification and Continuous Authorization)
Question 1511Question →

A security analyst is examining the following aggregated syslog entries ingested into a SIEM platform:

text
Jul 27 11:02:14 jump-srv01 sshd[14201]: Failed password for invalid user admin from 203.0.113.88 port 49152 ssh2
Jul 27 11:02:16 jump-srv01 sshd[14205]: Failed password for invalid user root from 203.0.113.88 port 49154 ssh2
Jul 27 11:02:19 jump-srv01 sshd[14210]: Accepted password for deployer from 203.0.113.88 port 49158 ssh2
Jul 27 11:02:22 jump-srv01 sudo: deployer : TTY=pts/1 ; PWD=/home/deployer ; USER=root ; COMMAND=/bin/bash

Based on the correlated log sequence above, which of the following conclusions accurately describes the security event?

Show answer & explanation

Answer: An external IP address successfully authenticated using valid credentials for an existing account after failed login attempts, followed by root privilege escalation.

Answer

An external IP address successfully authenticated using valid credentials for an existing account after failed login attempts, followed by root privilege escalation.
The log sequence demonstrates an attack timeline: initial failed authentication attempts for common administrative accounts ('admin', 'root') from IP 203.0.113.88, followed three seconds later by a successful SSH authentication for user 'deployer' from the same IP, and finally a `sudo` command execution spawning an interactive root shell (`/bin/bash`).

Step-by-Step Solution

1
Analyze initial log timestamps and event sources
Identified rapid, sequential SSH authentication failures from IP 203.0.113.88 targeting invalid usernames ('admin' and 'root').
Establishes baseline pattern of credential testing or automated brute-force activity.
2
Evaluate subsequent authentication logs
At 11:02:19, SSH accepted the password for the valid account 'deployer' from the same external IP address.
Confirms successful compromise of legitimate user account credentials.
3
Analyze post-authentication command execution telemetry
At 11:02:22, the 'deployer' user executed `sudo` to spawn `/bin/bash` as `root`.
Confirms successful local privilege escalation to root permissions immediately following remote access.

Key Concept

Sequential Log Correlation and Event Reconstruction
Question 1512Question →

A network security consultant is auditing a newly implemented TACACS+ access control solution for datacenter routers. Match each administrative operational activity to its corresponding pillar within the AAA framework.

Click a left item, then click its matching right item

Items

An engineer presents a corporate username and time-based hardware token passcode to prove their identity to the network terminal.
The central server evaluates the engineer's security group membership and restricts execution to a specific subset of privilege-level commands.
The device generates timestamped records of commands executed during the shell session and transmits them to a centralized audit server.

Matches

Show answer & explanation

Answer

Presenting credentials to establish identity matches Authentication; evaluating security groups to grant specific command execution privileges matches Authorization; generating timestamped logs of executed commands for auditing matches Accounting.
Authentication is the process of verifying a user's claimed identity using credentials such as passwords or hardware tokens. Authorization determines the specific rights, privileges, and commands permitted for that verified identity. Accounting collects telemetry, session timestamps, and command history to maintain accountability and support forensic auditing.

Step-by-Step Solution

1
Analyze the first activity involving identity proof via username and hardware token passcode.
Identify that credential validation and identity verification fall under Authentication.
Authentication is responsible for confirming the identity of a subject before granting system access.
2
Analyze the second activity involving security group evaluation and command execution restriction.
Identify that granting specific rights based on policy falls under Authorization.
Authorization determines what actions, commands, or resources an authenticated identity is permitted to access.
3
Analyze the third activity involving session logging, timestamp generation, and telemetry transmission.
Identify that tracking user actions for compliance and monitoring falls under Accounting.
Accounting measures resource consumption and maintains detailed logs of subject activity for non-repudiation and auditing.

Key Concept

Authentication, Authorization, and Accounting (AAA)
Estimated Time:1m 30s
Question 1513Question →

A security defense team is implementing active deception and disruption controls across an enterprise environment to improve threat detection and mitigation. Match each deception or disruption technology on the left with its corresponding operational security objective on the right.

Click a left item, then click its matching right item

Items

DNS Sinkhole
Honeyfile
Honeytoken
Low-Interaction Honeypot

Matches

Show answer & explanation

Answer

DNS Sinkhole matches with C2 domain lookup interception; Honeyfile matches with decoy file auditing; Honeytoken matches with fake credentials or API key detection; Low-Interaction Honeypot matches with simulated service basic protocol response.
Each technology is paired correctly based on its core implementation: DNS sinkholes redirect malicious DNS queries; honeyfiles act as audited decoy documents; honeytokens serve as fake digital credentials/keys; and low-interaction honeypots emulate basic network services to capture initial probes.

Step-by-Step Solution

1
Analyze DNS disruption techniques.
Identify that DNS Sinkholing specifically targets outbound malicious DNS queries to isolate or monitor botnet/C2 communications.
DNS sinkholes alter resolution paths to prevent compromised hosts from reaching external threat infrastructure.
2
Differentiate between decoy files, tokens, and honeypot interaction levels.
Honeyfiles correspond to file objects, honeytokens correspond to specific data/credentials, and low-interaction honeypots correspond to emulated network daemons.
Each deception technology operates at a distinct layer (filesystem, credential/data level, or protocol service level).
3
Map each item to its operational mechanism.
Establish the 4 correct pairings.
Correct alignment demonstrates understanding of active defense components within CompTIA Security+ framework.

Key Concept

Deception and Disruption Technologies
Question 1514Question →

A healthcare technology enterprise is redesigning the communication architecture for its remotely managed biomedical telemetry gateways. Under the legacy model, gateways established an IPsec VPN tunnel to an internal network segment where all internal traffic was implicitly trusted after initial authentication. To align with Zero Trust Architecture (ZTA) principles, the security architect must enforce strict policy controls over access to backend microservices. Which of the following design decisions best reflects core Zero Trust Architecture principles for this scenario?

Show answer & explanation

Answer: Require explicit validation of identity, device health posture, and contextual signals for every access request, dynamically enforcing granular least privilege permissions regardless of network location.

Answer

Require explicit validation of identity, device health posture, and contextual signals for every access request, dynamically enforcing granular least privilege permissions regardless of network location.
The correct response reflects the fundamental Zero Trust principle 'never trust, always verify'. In Zero Trust Architecture, every connection request must be explicitly validated using real-time contextual factors (user identity, device compliance, context) and governed by least privilege access rules, regardless of whether the communication originates internally or over a VPN.

Step-by-Step Solution

1
Analyze the core tenets of Zero Trust Architecture (NIST SP 800-207).
Zero Trust operates on the fundamental principle of 'never trust, always verify', assuming no implicit trust based solely on physical or network location.
Traditional perimeter security relies on implicit network zone trust, whereas ZTA mandates per-request authentication and continuous authorization.
2
Evaluate the requirement for explicit validation and least privilege enforcement.
Access decisions must continuously evaluate contextual data (identity, device posture, location, resource sensitivity) and enforce minimum required access.
Continuous contextual validation prevents lateral movement in the event of compromised credentials or devices.
3
Select the option that correctly mandates explicit verification and contextual dynamic policy enforcement across every request.
The design decision requiring explicit validation of identity, device posture, and contextual signals for every request represents full ZTA alignment.
This directly fulfills the fundamental principles of explicit verification, micro-segmentation, and least privilege in Zero Trust.

Key Concept

Zero Trust Architecture Principles
Estimated Time:1m 15s
Question 1515Question →

During a scheduled vulnerability assessment of an industrial processing facility, an active intrusive network scan caused several sensitive Programmable Logic Controllers (PLCs) on the Operational Technology (OT) network to crash. The security administrator needs to gather vulnerability data for these legacy devices without risking system instability or operational downtime. Which of the following scanning methodologies should the administrator implement?

Show answer & explanation

Answer: Perform a non-intrusive, passive vulnerability assessment by monitoring network traffic via a SPAN port.

Answer

Perform a non-intrusive, passive vulnerability assessment by monitoring network traffic via a SPAN port.
Passive non-intrusive vulnerability scanning inspects mirrored network traffic without sending active request packets to target systems. This technique is ideal for sensitive or legacy Operational Technology (OT) networks and embedded systems, as it prevents system crashes while still providing visibility into active protocols and potential software vulnerabilities.

Step-by-Step Solution

1
Identify the environment constraints.
The target environment contains fragile legacy OT/PLC devices that crash when subjected to active intrusive network probes.
Active scanning can overload limited network stacks on embedded devices.
2
Evaluate safe vulnerability scanning methodologies.
Passive scanning captures and analyzes existing traffic (e.g., via a mirrored SPAN port) to identify host types, open ports, and potential vulnerabilities without transmitting packets to the target systems.
Passive assessment eliminates the risk of disrupting sensitive industrial control processes.

Key Concept

Passive vs. Active and Intrusive Vulnerability Scanning
Question 1516Question →

A security analyst reviewing automated audit logs discovers that several cloud-hosted web servers have diverged from the organization's hardened baseline. Investigation reveals that system administrators manually modified SSL/TLS configuration files to troubleshoot a legacy integration, inadvertently re-enabling weak cipher suites that violate security policy. The central Infrastructure-as-Code (IaC) repository still contains the approved, secure configuration state. Which of the following is the BEST initial action to remediate the vulnerability and prevent future configuration drift?

Show answer & explanation

Answer: Execute the automated configuration management orchestration playbook to enforce the repository's declarative baseline state across all servers.

Answer

Execute the automated configuration management orchestration playbook to enforce the repository's declarative baseline state across all servers.
Automated configuration management tools continuously evaluate server state against a centralized Infrastructure-as-Code repository. When configuration drift occurs due to manual modification, executing the deployment playbook ensures that the approved baseline is redeployed, removing weak ciphers and preventing recurring discrepancies.

Step-by-Step Solution

1
Identify the root cause of the non-compliance incident.
The non-compliance stems from configuration drift caused by manual intervention on the web servers.
Understanding whether a flaw is software-based or configuration-based determines the correct remediation path.
2
Evaluate automated baseline enforcement mechanisms.
Automated configuration management tools pull approved templates from the IaC repository and overwrite unapproved drift.
Automated enforcement restores baseline compliance rapidly without risk of human error or missed settings.
3
Select the primary operational control that addresses both immediate remediation and long-term compliance.
Executing the configuration management playbook enforces consistency and eliminates drift across the cluster.
Direct baseline enforcement fixes the host system while establishing automated alignment with security governance.

Key Concept

Configuration Drift and Automated Baseline Enforcement
Estimated Time:1m 30s
Question 1517Question →

A security analyst is reviewing correlated firewall and internal DNS query logs for an internal workstation (10.0.4.15):

[Firewall Log]
Timestamp: 2026-07-27T14:15:02Z Src_IP: 10.0.4.15 Dst_IP: 198.51.100.44 Dst_Port: 53 Protocol: UDP Bytes_Sent: 4520 Bytes_Rcvd: 312 Action: ALLOW
Timestamp: 2026-07-27T14:15:05Z Src_IP: 10.0.4.15 Dst_IP: 198.51.100.44 Dst_Port: 53 Protocol: UDP Bytes_Sent: 4890 Bytes_Rcvd: 298 Action: ALLOW

[DNS Query Log]
Timestamp: 2026-07-27T14:15:02Z Client: 10.0.4.15 Query: 58617a7964617461.exfil.badactor-domain.com Type: TXT RCODE: NOERROR
Timestamp: 2026-07-27T14:15:05Z Client: 10.0.4.15 Query: 6261636b75703031.exfil.badactor-domain.com Type: TXT RCODE: NOERROR

Based on this log telemetry, which of the following statements regarding the threat activity and appropriate mitigation steps are correct? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The host is utilizing DNS tunneling to exfiltrate encoded payload data within subdomain query strings.; Implementing DNS sinkholing or blocking external DNS resolution to the suspicious destination host will help contain the exfiltration path.

Answer

The host is utilizing DNS tunneling to exfiltrate encoded payload data within subdomain query strings, and implementing DNS sinkholing or blocking external DNS resolution to the suspicious destination host will help contain the exfiltration path.
The combination of high-entropy hexadecimal subdomains, TXT query types, and disproportionately large outbound byte counts in firewall logs over UDP port 53 is a definitive indicator of DNS tunneling. Implementing DNS sinkholing or restricting outbound DNS traffic to trusted internal recursive resolvers successfully mitigates this data exfiltration vector.

Step-by-Step Solution

1
Analyze the DNS query logs and firewall payload metrics.
Identified high-entropy subdomains requesting TXT records with unusually high outbound byte counts relative to response byte counts over UDP port 53.
Standard DNS queries are small lookup requests; large outbound payloads containing encoded strings point to DNS covert channel/tunneling.
2
Differentiate the identified attack vector from unrelated application and identity threats.
Ruled out application vulnerabilities like XSS/SQLi and authentication control failures.
Traffic occurs at the transport and application layer specifically for DNS resolution (port 53), not web app services or AAA infrastructure.
3
Determine the optimal containment strategy.
Selected DNS sinkholing and blocking unauthorized external DNS resolution.
DNS sinkholing redirects malicious domain requests to a controlled IP, cutting off command and control and data exfiltration routes.

Key Concept

DNS Tunneling Detection and SIEM Log Correlation
Question 1518Question →

An organization deploys security personnel at the entrance of a facility to verify employee identity badges and physically block unauthorized individuals from entering. Which of the following security control categories and functional control types best classifies these security guards?

Show answer & explanation

Answer: Physical category and preventive functional type

Answer

Physical category and preventive functional type
Security guards represent a physical control category because they operate in the tangible physical domain to protect facilities. In this scenario, their primary function of checking badges to block unauthorized visitors directly prevents unauthorized entry from occurring, making them a preventive functional type.

Step-by-Step Solution

1
Determine the security control category based on implementation domain.
Security guards physically exist in the real world to secure a facility environment, making them a physical control.
Control categories distinguish between technical (logical/software), managerial (administrative/policy), operational (human procedures), and physical (tangible/environmental) controls.
2
Determine the functional control type based on the goal in the scenario.
The guards stop unauthorized individuals from entering, which directly prevents a security breach.
Functional types describe the primary security action: preventive controls stop incidents before they happen, detective controls discover incidents, and deterrent controls discourage actions.

Key Concept

Security Control Categories and Functional Types
Question 1519Question →

A cloud security administrator is updating the identity and access management framework for an enterprise application platform to align strictly with the AAA model. Which of the following implementation steps specifically address the Authorization pillar of AAA? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Applying Role-Based Access Control (RBAC) policies to assign specific resource permissions based on job function; Enforcing Attribute-Based Access Control (ABAC) rules to evaluate environmental context and resource tags before granting request access

Answer

The configurations that specifically address Authorization are applying Role-Based Access Control (RBAC) policies to assign resource permissions and enforcing Attribute-Based Access Control (ABAC) rules based on context and resource tags.
Authorization determines the permissions and access rights granted to an identity after it has been authenticated. Both Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) are access control frameworks designed specifically to define and enforce what actions users or services can perform on target resources.

Step-by-Step Solution

1
Differentiate between the three pillars of the AAA model: Authentication (verifying identity), Authorization (determining permissions and access rights), and Accounting (tracking activity and keeping logs).
Established that the question requires identifying access control mechanisms that enforce permissions.
Authorization explicitly governs what actions an authenticated identity is allowed to execute.
2
Evaluate each configuration option against the Authorization definition.
RBAC and ABAC govern permissions and access rights (Authorization). Credential and TOTP verification establishes identity (Authentication). Activity logging tracks historical user actions (Accounting).
Correctly categorizes each control mechanism to isolate the two valid Authorization mechanisms.

Key Concept

Authentication, Authorization, and Accounting (AAA)
Question 1520Question →

During a routine operational review of corporate laptops, endpoint telemetry detects a malicious script executing directly in volatile memory and initiating unauthorized outbound traffic to a known adversary infrastructure. To stop lateral movement and data exfiltration immediately while retaining live memory context for incident investigation, which of the following EDR capabilities should be executed?

Show answer & explanation

Answer: Initiating agent-based network host isolation

Answer

Initiating agent-based network host isolation is the correct capability because it disconnects the host from the internal network while keeping EDR communication open and preserving volatile memory.
Initiating agent-based network isolation enables security analysts to halt all unauthorized network communications to and from the endpoint instantly while preserving system state and volatile memory for forensic response.

Step-by-Step Solution

1
Identify the immediate incident response priority
Containment is required to halt lateral movement and data exfiltration without losing RAM evidence.
Active fileless memory threats require host containment mechanisms rather than static perimeter blocking.
2
Evaluate EDR containment actions
Agent-based network isolation cuts off non-essential network connections at the host level while maintaining administrative console connectivity.
This allows SOC responders to investigate live memory while preventing the adversary from moving laterally.

Key Concept

Endpoint Detection and Response (EDR) Host Isolation
PreviousPage 76 / 112Next
All practice questions — CompTIA Security+ | Examkin