Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1521Question →

An enterprise security administrator is resolving TLS handshake failures for internal client applications connecting to a critical web server in an isolated, air-gapped network segment. Clients are configured to require strict certificate revocation checks before trusting server certificates. Because client endpoints lack direct internet access or connection to internal revocation endpoints, standard Certificate Revocation List (CRL) downloads and direct Online Certificate Status Protocol (OCSP) queries fail, causing clients to terminate mTLS negotiations. Which of the following solutions should the administrator implement on the web server to resolve the revocation verification failure while maintaining real-time revocation assurance?

Show answer & explanation

Answer: Enable OCSP stapling (TLS Certificate Status Request extension) on the web server so it periodically fetches and appends a time-stamped, CA-signed revocation status response directly to the client during the TLS handshake.

Answer

Enable OCSP stapling on the web server so that a cached, CA-signed revocation status response is delivered to clients directly within the TLS handshake.
OCSP stapling (defined in RFC 6066 as the TLS Certificate Status Request extension) enables the web server to query the CA OCSP responder periodically and cache the time-stamped, cryptographically signed response. When clients initiate a TLS connection, the server includes this stapled response in the TLS handshake. This allows isolated clients to verify that the server certificate has not been revoked without requiring direct network access to external OCSP responders or downloading large CRL files.

Step-by-Step Solution

1
Analyze the constraint preventing client-side revocation validation.
Identified that client endpoints reside in an isolated network segment without direct connectivity to CRL distribution points or OCSP responders, causing revocation lookups to fail.
When strict revocation checking is enabled, inability to query revocation status forces compliant clients to reject the server certificate.
2
Evaluate revocation mechanisms that satisfy isolated network client requirements.
Selected OCSP stapling, which offloads the query responsibility to the web server.
The web server queries the CA's OCSP responder on a set interval, receives a signed and time-stamped status assertion, and staples this response into the server's TLS Certificate Status Request extension.
3
Verify client trust and bandwidth efficiency.
Clients validate the stapled OCSP response using the CA's trusted public key already present in their local trust store without originating external connections.
This eliminates bandwidth overhead and resolves connectivity limitations in restricted client environments while retaining real-time revocation integrity.

Key Concept

OCSP Stapling and Certificate Revocation Management
Estimated Time:2m 0s
Question 1522Question →

An enterprise configures a remote-access VPN portal integrated with a centralized AAA infrastructure. When an engineer connects, the following sequential process occurs:

1. The gateway verifies the engineer's username, password, and multi-factor authentication token against the directory service.
2. The gateway evaluates the engineer's group memberships and applies a dynamic Network Access Control List (NACL) to restrict access strictly to database subnet resources.
3. The gateway logs the engineer's active session duration, assigned IP address, and bandwidth consumption to an auditing server.

Which core pillar of the AAA security framework is directly performed during step 2?

Show answer & explanation

Answer: Authorization

Answer

Authorization is the AAA pillar demonstrated when enforcing resource access restrictions and applying dynamic control lists based on user privileges.
Evaluating group memberships and applying network access control lists (NACLs) to limit accessible network subnets directly enforces permissions, which is the exact definition and responsibility of the Authorization pillar in AAA.

Step-by-Step Solution

1
Analyze step 1 of the scenario
Step 1 confirms and validates identity credentials (Authentication).
Authentication is the process of verifying who a user claims to be.
2
Analyze step 2 of the scenario
Step 2 evaluates permissions and applies ACL restrictions based on user group membership (Authorization).
Authorization dictates what actions or resources an authenticated user is permitted to access.
3
Analyze step 3 of the scenario
Step 3 tracks session usage and duration metrics (Accounting).
Accounting records user activities, consumption, and event timestamps for auditing.

Key Concept

Authentication, Authorization, and Accounting (AAA) Security Framework
Estimated Time:1m 15s
Question 1523Question →

An organization discovers that several employees received fraudulent text messages on their personal mobile devices claiming an urgent security update is required for their corporate email access, directing them to a credential-harvesting site. At the same time, an unauthorized individual attempted to enter the facility by closely following an authorized worker through a secure entrance. Which of the following social engineering vectors are demonstrated in these scenarios? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Smishing; Tailgating

Answer

Smishing and Tailgating are the social engineering vectors demonstrated.
Smishing represents phishing delivered via SMS text messages on mobile devices to steal credentials. Tailgating is a physical social engineering tactic where an unauthorized actor follows an authorized person through a secured barrier without authentication.

Step-by-Step Solution

1
Analyze the mobile communication component
Identify that malicious text messaging (SMS) directing users to a fake site is smishing.
Smishing specifically leverages mobile text messaging channels to deliver phishing lures.
2
Analyze the physical access breach component
Identify that following an authorized employee through a secure doorway without credentials is physical tailgating.
Tailgating relies on social courtesy or distraction to gain unauthenticated entry into restricted physical spaces.

Key Concept

Social Engineering Attack Vectors (Smishing and Tailgating)
Question 1524Question →

A security analyst is configuring asymmetric cryptography for an enterprise web application to enable secure public key exchange and digital signatures. Which of the following cryptographic algorithms meet these specific functional requirements? (Select TWO).

Select all that apply

Show answer & explanation

Answer: RSA (Rivest-Shamir-Adleman); ECC (Elliptic Curve Cryptography)

Answer

The correct asymmetric cryptographic algorithms are RSA (Rivest-Shamir-Adleman) and ECC (Elliptic Curve Cryptography).
RSA (Rivest-Shamir-Adleman) and ECC (Elliptic Curve Cryptography) are both asymmetric key algorithms. They utilize mathematically linked public-private key pairs to perform key establishment and generate digital signatures for non-repudiation.

Step-by-Step Solution

1
Identify the cryptographic category required by the scenario.
The requirements demand asymmetric encryption mechanisms capable of key exchange and digital signatures.
Asymmetric cryptography utilizes public/private key pairs to enable key negotiation and non-repudiation.
2
Evaluate the algorithm options against asymmetric capability.
RSA and ECC use public/private key pairs designed for key exchange and signatures.
RSA relies on prime factorization complexity while ECC relies on algebraic curves, both fulfilling asymmetric functions.
3
Eliminate symmetric algorithms, hashing functions, and non-cryptographic security controls.
AES (symmetric bulk cipher), SHA-256 (integrity hash), and WAF (network defense control) are incorrect.
Symmetric ciphers use a shared key and cannot independently produce digital signatures, while hash functions only produce message digests.

Key Concept

Asymmetric vs. Symmetric Cryptographic Algorithm Classification
Question 1525Question →

During an active incident response, a security analyst identifies multiple compromised internal workstations attempting to establish connections to a known malicious command-and-control (C2) domain. To immediately disrupt these communications enterprise-wide and capture telemetry from infected hosts without deploying host agents or creating custom firewall drop rules for every host, the analyst configures internal name servers to resolve queries for the C2 domain to an isolated monitoring IP address. Which deception or disruption technology is being utilized in this scenario?

Show answer & explanation

Answer: DNS sinkholing

Answer

DNS sinkholing is the correct technology being utilized to redirect malicious domain resolution requests to a security-monitored IP address.
DNS sinkholing works by configuring a DNS server to return false or redirected IP addresses (sinkhole IP addresses) for specific malicious domain names. When infected hosts attempt to resolve the C2 server domain, the DNS server redirects the connection attempt to an internal security monitoring host. This immediately disrupts malware communication while allowing the security team to identify every infected machine querying that domain.

Step-by-Step Solution

1
Analyze the operational objective in the scenario.
The goal is to disrupt malware command-and-control traffic and log infected hosts by manipulating domain name resolution across internal name servers.
Identifying the primary operational mechanism reveals whether the control relies on deception lures, decoy assets, or network resolution redirection.
2
Evaluate deception and disruption technology definitions.
DNS sinkholing specifically intercepts domain queries destined for known malicious hosts and returns a controlled IP address (such as a loopback address or monitoring sinkhole).
This technique provides rapid disruption of C2 channels while capturing traffic logs from all infected internal devices querying the domain.
3
Distinguish DNS sinkholing from decoy host and file controls.
Unlike honeypots, honeynets, or honeyfiles—which rely on decoy resources to entice threat actors—DNS sinkholing operates at the infrastructure level to intercept and divert malicious traffic.
Confirming the exact functional layer ensures accurate control selection.

Key Concept

DNS Sinkholing as a Disruption and Detection Technology
Question 1526Question →

An IT administrator needs to request and implement an X.509 server certificate from a public Certificate Authority (CA) to secure a corporate web portal. Arrange the steps of the initial PKI certificate enrollment process in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: 1) Generate the key pair, 2) Create the CSR, 3) Submit the CSR to the CA, 4) CA signs and issues the certificate, 5) Install the certificate on the web server.
In standard Public Key Infrastructure (PKI) workflows, certificate issuance follows a strict logical sequence. First, the requesting server generates an asymmetric key pair (private and public keys). Next, the administrator generates a Certificate Signing Request (CSR) which embeds the public key and organization identity details. The CSR is then submitted to the Certificate Authority (CA), which verifies the requester's identity. Once verified, the CA signs the certificate using its own private key and issues it. Finally, the administrator installs the signed certificate on the web server to service secure TLS connections.

Step-by-Step Solution

1
Generate asymmetric key pair locally
A public key and private key are generated on the destination server.
A public key is required to populate the Certificate Signing Request (CSR).
2
Build the Certificate Signing Request (CSR)
A CSR file containing the public key and entity identity (Subject/SAN) is compiled.
The CSR acts as the formal application sent to a CA for certificate issuance.
3
Submit CSR to the target CA
The CA receives the CSR and begins domain validation procedures.
The CA must verify identity and domain control before binding its trust signature.
4
CA certificate signing and issuance
The CA signs the applicant's public key with its own private key and returns the X.509 certificate.
The cryptographic signature of the CA establishes trust for clients trusting that CA root.
5
Deploy certificate on server
The server is bound to the new certificate and intermediate CA certificates.
Installation enables the web server to present a trusted certificate during TLS handshakes.

Key Concept

PKI Certificate Request and Enrollment Workflow
Question 1527Question →

A security engineer inspects network security telemetry following a simulated penetration test. The red team successfully executed a known web application exploit payload over an HTTPS connection to an internal web server. Although the Network Intrusion Prevention System (NIPS) was deployed inline and possessed the latest vendor signature for the exploit, it neither generated an alert nor dropped the malicious connection. NetFlow records confirm the attack traffic passed directly through the NIPS interface. Which of the following best explains why the monitoring and alerting controls failed to detect this attack?

Show answer & explanation

Answer: The NIPS lacked SSL/TLS decryption capabilities, preventing signature inspection of the encrypted packet payload.

Answer

The NIPS lacked SSL/TLS decryption capabilities, preventing signature inspection of the encrypted packet payload.
Network Intrusion Prevention Systems (NIPS) perform deep packet inspection by comparing packet payloads against known attack signatures. When web traffic is encrypted using HTTPS (SSL/TLS), the payload content is obfuscated as ciphertext. Unless the NIPS is configured with SSL/TLS decryption (TLS offloading/inspection), the signature engine cannot read the underlying HTTP payload to match known exploit patterns, allowing the malicious traffic to pass unhindered despite the NIPS being inline and updated.

Step-by-Step Solution

1
Analyze the scenario parameters and network architecture
The traffic was sent over HTTPS (encrypted via SSL/TLS), passed inline through a updated NIPS sensor, but went undetected.
Understanding the delivery protocol (HTTPS) is critical to identifying why deep packet inspection failed.
2
Evaluate sensor inspection mechanics against encrypted protocols
Network Intrusion Prevention Systems rely on matching packet payloads against known signatures. Without SSL/TLS decryption (TLS inspection), packet payloads are encrypted, rendering signatures ineffective.
Encrypted traffic obscures Layer 7 payload content from network monitoring tools unless SSL/TLS decryption is enabled on the sensor.
3
Differentiate correct root cause from distractor misconfigurations
The inability to inspect encrypted ciphertext is the direct cause of signature evaluation failure in this network monitoring context.
Eliminates distractors that confuse sensor deployment types (inline vs. passive TAP), deception technologies (honeypots), or control layer misclassifications.

Key Concept

Network Security Monitoring & TLS/SSL Decryption Requirements for NIDS/NIPS
Estimated Time:2m 0s
Question 1528Question →

A fintech enterprise is redesigning its transactional API gateway and core internal services to align with Zero Trust Architecture (ZTA) principles. Under the legacy model, any service deployed within the internal management network zone was implicitly trusted to execute database queries. Which of the following access enforcement strategies best reflects the core Zero Trust principle of explicit verification for internal service communication?

Show answer & explanation

Answer: Requiring every service transaction to be explicitly authenticated, authorized, and encrypted using context-aware inspection regardless of network location

Answer

Requiring every service transaction to be explicitly authenticated, authorized, and encrypted using context-aware inspection regardless of network location
Zero Trust Architecture operates on the core principle of 'never trust, always verify.' In a ZTA model, network location provides no inherent trust. Every access request—even those originating within internal subnets—must be explicitly authenticated, authorized against context-aware policy, and encrypted end-to-end.

Step-by-Step Solution

1
Identify the core tenet of Zero Trust Architecture (ZTA) regarding network trust boundaries.
ZTA operates under the assumption that network location does not imply trust, eliminating implicit trust for internal segments.
Traditional perimeter security relies on location-based trust, whereas ZTA requires continuous validation regardless of origin.
2
Evaluate the requirement for explicit verification across internal service transactions.
Every access request must be explicitly authenticated, authorized within context, and encrypted end-to-end.
Explicit verification ensures least privilege and continuous evaluation for all data flows.

Key Concept

Explicit verification and removal of implicit network perimeter trust in Zero Trust Architecture
Estimated Time:1m 30s
Question 1529Question →

A security analyst receives a high-severity alert from an Endpoint Detection and Response (EDR) agent indicating that a malicious WMI event subscription has been registered on a critical enterprise server and is attempting to execute unauthorized PowerShell scripts. Place the containment and incident response steps in the correct sequential order from initial response to final remediation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with validating telemetry alerts, followed by network isolation of the host, process termination, live response artifact collection, and finally persistence cleanup and host restoration.
In standard incident response protocols using EDR technology, the first step is validating telemetry alerts. Once confirmed, immediate network isolation protects the rest of the enterprise from lateral movement. Next, running malicious processes are killed to stop active damage, followed by collecting volatile live response artifacts for root cause analysis. Finally, persistent threat artifacts (such as WMI bindings) are deleted and the clean endpoint is restored.

Step-by-Step Solution

1
Validate the EDR alert and process tree.
Confirmed malicious WMI event execution.
Prevents taking intrusive containment actions on benign system behavior.
2
Isolate the endpoint network interface via EDR capabilities.
Lateral movement vectors are severed while preserving administrative EDR control channels.
Contains potential containment blast radius to the single endpoint.
3
Terminate active malicious processes.
Malicious code stops executing in host memory.
Halts ongoing damage or data collection on the localized system.
4
Collect live response forensic telemetry.
Volatile memory and script logs are saved for root-cause analysis.
Ensures critical forensic evidence is preserved before system modifications occur.
5
Remediate WMI persistence mechanisms and lift host isolation.
System returned to trusted baseline state and reconnected to network.
Completes the lifecycle of endpoint containment and remediation.

Key Concept

EDR Incident Containment and Investigation Workflow
Question 1530Question →

A network administrator at a logistics enterprise configures TACACS+ for centralized management of core routers. Network engineers can successfully authenticate to the router command-line interface using their domain credentials. However, when the engineers attempt to run restricted configuration commands, the router returns a permission error. The administrator verifies that credential validation against Active Directory is functioning properly. Which of the following describes the root cause of this operational issue?

Show answer & explanation

Answer: The TACACS+ server validated user identity during the authentication phase, but command-level authorization policies were not configured.

Answer

The correct answer states that the TACACS+ server validated user identity during the authentication phase, but command-level authorization policies were not configured.
The correct answer correctly identifies that TACACS+ separates authentication from authorization. While identity validation against Active Directory succeeded, specific command-level authorization policies were omitted, preventing the router from approving restricted commands.

Step-by-Step Solution

1
Analyze the reported operational symptom and AAA architecture
Engineers successfully log in (authentication works), but cannot run specific commands (authorization fails).
TACACS+ decouples authentication, authorization, and accounting into discrete protocol interactions.
2
Identify the failing AAA component
Because login succeeds, the identity verification phase (Authentication) is complete, meaning the breakdown is in command authorization rules.
Command authorization determines which specific commands an authenticated user or role is permitted to execute.
3
Determine the root cause
Command-level authorization policies or privilege attribute sets were missing or misconfigured on the TACACS+ server.
Without explicit authorization rules, the network device defaults to denying privileged command execution.

Key Concept

Separation of Authentication and Authorization in TACACS+ Operations
Estimated Time:1m 30s
Question 1531Question →

A security technician is configuring a web application server that hosts multiple distinct domain names on a single IP address. During initial testing, users receive a certificate domain name mismatch warning when attempting to navigate to the secondary domain. Which of the following X.509 certificate fields or extensions must be configured in the Certificate Signing Request (CSR) to resolve this warning?

Show answer & explanation

Answer: Subject Alternative Name (SAN)

Answer

The Subject Alternative Name (SAN) extension must be configured in the Certificate Signing Request (CSR).
Subject Alternative Name (SAN) is an X.509 certificate extension that allows a single certificate to secure multiple hostnames, domain names, or IP addresses. Specifying all intended hostnames in the SAN extension during CSR generation ensures client browsers successfully match the requested domain to the certificate identity.

Step-by-Step Solution

1
Identify the cause of the TLS certificate mismatch warning
The client browser rejects the connection because the domain requested by the client does not match the subject name on the presented X.509 certificate.
Browsers validate server identity by ensuring the requested URL matches a listed domain identity within the server's certificate attributes.
2
Determine the appropriate certificate field for securing multiple domain names
The Subject Alternative Name (SAN) extension allows an administrator to list additional hostnames, FQDNs, or IP addresses under a single certificate.
Populating the SAN field during CSR creation instructs the Certificate Authority (CA) to issue a multi-domain certificate valid for all specified domains.

Key Concept

Subject Alternative Name (SAN) extension in Public Key Infrastructure
Question 1532Question →

During a network infrastructure assessment, a security analyst reviews the operational workflow of a centralized 802.1X RADIUS deployment. When an employee connects a corporate laptop to an enterprise switch port, the RADIUS server first verifies the user's domain password against Active Directory. Immediately following identity verification, the RADIUS server returns specific network access attributes that instruct the switch to dynamically place the user's connection onto VLAN 30 (Finance). Which pillar of the AAA framework is directly performed by dynamically placing the user into VLAN 30?

Show answer & explanation

Answer: Authorization

Answer

Authorization
Authorization is the process of granting specific permissions, privileges, and network access limits to an authenticated entity. In this scenario, placing the connection into VLAN 30 enforces role-based access privileges, making it a direct application of authorization.

Step-by-Step Solution

1
Identify the distinct phases of the AAA framework described in the scenario
The initial step (verifying domain credentials against Active Directory) establishes identity, which is Authentication. The subsequent step (assigning VLAN 30 attributes) defines what resources the validated user is permitted to access.
AAA separates identity verification from permission assignment and tracking.
2
Map the dynamic VLAN 30 assignment to the corresponding AAA pillar
Restricting network access rights based on user role attributes corresponds to Authorization.
Authorization defines access privileges, network segmentation restrictions, and resource boundaries.

Key Concept

Authentication, Authorization, and Accounting (AAA) Framework
Question 1533Question →

A Security Operations Center (SOC) analyst identifies active data exfiltration from a user workstation caused by an unauthorized memory-resident process. The analyst must immediately stop the data egress and restrict lateral network communication while retaining remote console administrative access to collect RAM telemetry and run live response forensic commands. Which of the following capabilities should the analyst execute?

Show answer & explanation

Answer: EDR agent host network isolation

Answer

EDR agent host network isolation isolates the compromised endpoint from all internal and external network communication while preserving the live telemetry management channel for SOC investigation.
The correct answer leverages the EDR agent's native network isolation feature. This places a software boundary around the endpoint host operating system, dropping all incoming and outgoing network traffic except for the encrypted control channel used by security analysts for remote triage and live response.

Step-by-Step Solution

1
Analyze containment requirements
The target system requires immediate network exfiltration blockage without losing volatile forensic data or analyst management connectivity.
Shutting down the host loses RAM evidence, while network-level blocks may not stop internal lateral movement.
2
Evaluate EDR network isolation capability
EDR agents utilize software-defined filtering at the endpoint kernel layer to block all application layer traffic except the agent-to-console management protocol.
This guarantees containment of malicious outbound/east-west traffic while enabling live response activities.

Key Concept

EDR Host Isolation and Live Response Containment
Question 1534Question →

A manufacturing enterprise is updating its network security model for factory floor industrial IoT sensors that transmit operational metrics to an enterprise analytics platform. Under the legacy network model, any device connected to the internal factory subnet was implicitly trusted. Which of the following technical implementations best aligns this environment with Zero Trust Architecture (ZTA) principles?

Show answer & explanation

Answer: Require explicit, continuous authentication and dynamic authorization for every data payload, regardless of whether the traffic originates inside the factory subnet.

Answer

Requiring explicit, continuous authentication and dynamic authorization for every data payload regardless of network origin.
The correct answer aligns directly with Zero Trust Architecture (ZTA) principles by eliminating implicit trust derived from network location. Zero Trust requires that every device, user, and data transaction be explicitly authenticated and authorized using real-time context and continuous validation, even if the request originates from an internal factory subnet.

Step-by-Step Solution

1
Analyze the legacy architecture described in the scenario
The legacy model relies on implicit trust granted to devices residing on the internal factory subnet.
Traditional perimeter-based security assumes devices behind the internal firewall are trustworthy.
2
Apply Zero Trust Architecture tenets (such as NIST SP 800-207)
Zero Trust dictates 'never trust, always verify' regardless of physical or logical network position.
All communication must be explicitly authenticated, authorized, and continuously validated on a per-request basis.
3
Identify the option that enforces per-request continuous validation without network location bias
Enforcing continuous authentication and dynamic authorization for all payloads fulfills ZTA requirements.
This removes implicit perimeter trust and applies granular access controls to every transaction.

Key Concept

Zero Trust Architecture enforces explicit, continuous verification of identity and authorization for every access request, regardless of network location.
Question 1535Question →

An enterprise mobile application authenticates users via a cloud-hosted Identity Provider (IdP) using the OAuth 2.0 Authorization Code Flow with Proof Key for Code Exchange (PKCE). Place the operational steps of this authentication sequence in the correct order, from initial client initialization to final token delivery.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Client generates the secret code_verifier and computes the code_challenge, 2) Client redirects user to IdP authorization endpoint with the code_challenge, 3) IdP authenticates user and issues an authorization code bound to the code_challenge, 4) Client sends authorization code and plaintext code_verifier to IdP token endpoint, 5) IdP verifies code_verifier against code_challenge and issues access tokens.
Proof Key for Code Exchange (PKCE) mitigates authorization code interception attacks on public clients. The client first creates a secret code_verifier and calculates the code_challenge. Next, it sends the user to the IdP authorization endpoint carrying the code_challenge. After successful user authentication, the IdP returns an authorization code. The client then exchanges this authorization code by sending the plaintext code_verifier directly to the token endpoint. Finally, the IdP verifies that SHA-256 hashing of the code_verifier matches the code_challenge stored during authorization before issuing access and ID tokens.

Step-by-Step Solution

1
Generate local cryptographic parameters
The client establishes the secret code_verifier and derives the public code_challenge using SHA-256.
PKCE protects public clients against authorization code interception by establishing a secret known only to the legitimate client instance before initiating communication.
2
Initiate authorization request
The client redirects the browser/user-agent to the IdP authorization URI containing the code_challenge.
The IdP needs the code_challenge to associate it with the authorization request session prior to user authentication.
3
Authenticate user and issue authorization code
The IdP validates user credentials and issues a short-lived authorization code.
The authorization code represents temporary authorization granted by the resource owner to the client.
4
Exchange authorization code for tokens
The client makes a POST request to the token endpoint supplying the authorization code and the plaintext code_verifier.
Presenting the unhashed code_verifier proves that the party requesting tokens is the exact same application instance that generated the initial request.
5
Validate verifier and deliver tokens
The IdP hashes the received code_verifier, compares it to the original code_challenge, and returns security tokens.
Token issuance is granted only when SHA-256(code_verifier) strictly equals the code_challenge recorded in Step 3.

Key Concept

OAuth 2.0 Authorization Code Flow with PKCE (Proof Key for Code Exchange)
Estimated Time:1m 30s
Question 1536Question →

During a routine automated compliance scan, a security operations team discovers a critical zero-day vulnerability in a core software dependency running on legacy Linux application hosts. Vendor testing reveals that applying the official patch breaks custom enterprise middleware dependencies, causing service instability during canary testing. Which of the following actions represents the MOST appropriate immediate strategy to maintain security posture without compromising service availability?

Show answer & explanation

Answer: Apply virtual patching rules at the intrusion prevention system (IPS) or web application firewall (WAF) layer while testing a updated middleware revision in a staging environment.

Answer

Implement virtual patching at the perimeter (IPS/WAF) as a temporary compensating control while validating middleware stability in staging.
Virtual patching utilizes network-level or application-layer security controls (such as IPS signatures or WAF rules) to detect and block exploitation attempts targeting a specific vulnerability before the underlying system software is patched. This serves as an ideal temporary compensating control when vendor patches introduce breaking changes to custom middleware, allowing the organization to mitigate risk immediately while engineers resolve software dependencies in a isolated staging environment.

Step-by-Step Solution

1
Analyze the patch deployment constraint
Identified that applying the vendor patch directly causes production instability due to middleware incompatibility.
Direct patch deployment is blocked by availability risks, requiring a temporary mitigation strategy.
2
Identify suitable compensating controls
Selected virtual patching via WAF/IPS signatures to filter malicious payloads targeting the zero-day vulnerability.
Virtual patching mitigates the vulnerability exposure vector immediately without altering host software states.
3
Execute long-term remediation workflow
Develop and validate a compatible middleware update in a staging environment prior to final production patch rollout.
Ensures patch management lifecycle integrity through proper testing, staging, and change advisory approval.

Key Concept

Virtual Patching and Compensating Controls in Patch Management
Estimated Time:2m 0s
Question 1537Question →

A security analyst is investigating a SIEM alert containing the URI parameter: `/inventory.php?item=10' UNION SELECT null, table_name FROM information_schema.tables--`. Moments later, network security monitoring sensors record outbound traffic originating from the targeted web server to an IP address within an isolated deception subnet (honeypot). Which of the following statements accurately identifies the attack technique observed and the operational purpose of the triggered deception control?

Show answer & explanation

Answer: The URI payload represents a SQL injection attempt, and the honeypot alert acts as a detective control indicating potential lateral movement or scanning by the attacker.

Answer

The attack vector is SQL injection, and traffic touching a honeypot serves as a detective control to spot unauthorized network activity.
The URI payload uses SQL syntax ('UNION SELECT') to query database metadata, which is characteristic of SQL injection. Honeypots are deception mechanisms deployed to capture unauthorized interactions, serving as detective controls when suspicious hosts attempt internal probing.

Step-by-Step Solution

1
Analyze the URI string pattern in the SIEM alert log.
Identify 'UNION SELECT null, table_name FROM information_schema.tables--', which is characteristic of database query manipulation (SQL injection).
Distinguishing application layer payloads is essential for accurate incident triage.
2
Evaluate the role of the network monitoring sensor alert triggered in the deception subnet.
Recognize that honeypots have no legitimate business traffic and function as detective controls for early threat detection.
Honeypots do not act as inline blocking mechanisms; any traffic routed to them indicates suspicious or compromised behavior.
3
Synthesize findings to select the accurate diagnosis.
Confirm that the incident involves SQL injection followed by internal reconnaissance/lateral movement detected by a honeypot.
Combines attack payload classification with correct security control operational classification.

Key Concept

Network Security Monitoring and Deception Analysis
Estimated Time:2m 0s
Question 1538Question →

A sales manager receives a phone call from an individual claiming to be an internal IT technician conducting an audit of remote working software. The caller convinces the manager to reveal their account security answers by presenting a fabricated scenario of mandatory system compliance. Which of the following social engineering techniques did the caller perform?

Show answer & explanation

Answer: Pretexting

Answer

The caller performed pretexting by fabricating a believable scenario to manipulate the user into revealing sensitive account security answers.
Pretexting occurs when an attacker invents a scenario (the pretext) to trick a target into releasing confidential data or performing restricted actions. Impersonating an internal technician carrying out an audit is a classic form of pretexting.

Step-by-Step Solution

1
Analyze the scenario details
The attacker established a false identity (IT technician) and constructed a believable story (audit of remote working software) to build trust.
Identifying the primary mechanism of psychological manipulation clarifies the attack type.
2
Evaluate the social engineering definitions
Creating an elaborate fake backstory or pretext to manipulate a target into providing confidential information matches the definition of pretexting.
Matching attacker tactics to standardized taxonomy isolates the correct term.

Key Concept

Pretexting in Social Engineering
Question 1539Question →

An enterprise security engineer is deploying S/MIME dual-key certificates (separate key pairs for digital signing and data encryption) across an organization using an internal PKI with key recovery capabilities. To comply with security governance, private encryption keys must be escrowed before certificate issuance, while signing keys must never be escrowed. Place the administrative operational steps in the correct chronological sequence from initial key pair creation to final client integration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with generating the dual key pairs on the endpoint, followed by archiving the private encryption key into key escrow, creating and transmitting the CSR to the Intermediate CA, the CA signing and publishing the X.509 S/MIME certificate, and finally importing the signed certificate into the user's email client store.
The proper sequence follows the cryptographic lifecycle: generating dual key pairs first provides the necessary key material. Next, the private encryption key must be safely backed up into key escrow before certification to ensure data recovery compliance while maintaining non-repudiation for the private signing key. After escrow verification, the client generates a CSR with public key material and sends it to the Issuing CA. The CA validates the identity, signs the X.509 certificate, and publishes it to the directory repository. Finally, the endpoint installs the signed certificate into the local email client store to enable cryptographic email functions.

Step-by-Step Solution

1
Initiate asymmetric key pair generation on the local workstation for S/MIME dual-key deployment.
Two distinct key pairs (signing key pair and encryption key pair) are generated.
Cryptographic material must exist before any submission, escrow, or signing actions can proceed.
2
Transmit the private encryption key to the enterprise Key Escrow database over an encrypted session, leaving the signing key strictly local.
The private encryption key is archived for enterprise data recovery compliance, while non-repudiation of digital signatures is preserved.
Enterprise PKI policy mandates that private key escrow occurs prior to CA certification so unbacked-up keys are never issued active certificates.
3
Formulate a Certificate Signing Request (CSR) including the public keys and subject distinguished name, then submit it to the Issuing CA.
The CA receives a structured CSR payload containing the identity details and public key material.
The CSR acts as the formal request for the CA to validate identity and certify public key ownership.
4
The Intermediate CA authenticates the request, signs the X.509 S/MIME certificate with its private key, and publishes the certificate to LDAP.
An authenticated, signed X.509 S/MIME certificate is created and published for enterprise access.
The CA is responsible for establishing trust by signing the public key and making the certificate accessible to other email users.
5
Download and install the issued X.509 certificate into the endpoint's personal certificate store.
The email client binds the signed certificate to the local private keys, completing S/MIME initialization.
The endpoint requires the signed certificate to complete TLS/MIME handshake routines and execute cryptographic operations.

Key Concept

S/MIME Dual-Key Lifecycle and Key Escrow Workflow
Estimated Time:3m 0s
Question 1540Question →

A security engineer is designing a secure communication protocol between distributed edge gateways and a cloud broker. The design mandates that if an attacker compromises the private key of a gateway in the future, the attacker must not be able to decrypt past session traffic that was previously captured and stored. Which of the following cryptographic mechanisms should the engineer enforce to satisfy this specific requirement?

Show answer & explanation

Answer: Ephemeral Diffie-Hellman key exchange to establish Perfect Forward Secrecy

Answer

Ephemeral Diffie-Hellman key exchange to establish Perfect Forward Secrecy
Ephemeral Diffie-Hellman (such as DHE or ECDHE) creates unique, temporary key pairs for every communication session. Because these ephemeral keys are discarded after the session terminates and are never saved to disk or transmitted directly, a future compromise of the server or gateway's long-term private key cannot be used to recalculate or decrypt historical session keys. This property is known as Perfect Forward Secrecy.

Step-by-Step Solution

1
Analyze the core requirement
Identified requirement: Future compromise of a long-term private key must not compromise previously recorded session traffic.
This is the exact definition of Perfect Forward Secrecy (PFS).
2
Evaluate cryptographic primitives for PFS support
Ephemeral key exchanges (such as DHE or ECDHE) derive dynamic session keys for each individual session that are independent of long-term identity keys.
Static asymmetric key transport (e.g., standard RSA key exchange) allows any historical session to be decrypted if the static private key is compromised.
3
Select the mechanism that satisfies PFS
Ephemeral Diffie-Hellman key exchange guarantees that compromise of long-term secrets does not expose past session keys.
Temporary keys generated during the handshake are deleted immediately after the session ends.

Key Concept

Perfect Forward Secrecy (PFS) via Ephemeral Key Exchange
PreviousPage 77 / 112Next
All practice questions — CompTIA Security+ | Examkin