Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 141Question →

An enterprise Security Operations Center (SOC) identifies anomalous database queries originating from an authenticated SSL/TLS VPN remote user session outside of normal business hours. Place the following incident response actions in the correct chronological order from first step to last step according to the standard NIST Incident Response Lifecycle.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence according to the NIST Incident Response Lifecycle is: 1. Analyze logs and correlate alerts (Detection and Analysis), 2. Terminate VPN sessions and isolate database servers (Containment), 3. Revoke compromised credentials and remove persistence mechanisms (Eradication), 4. Restore systems from clean backups and enforce MFA reset (Recovery), and 5. Conduct a post-incident review meeting to update playbooks (Post-Incident Activity).
Standard incident response frameworks (such as NIST SP 800-61 Rev. 2) define a sequential lifecycle: Detection & Analysis, Containment, Eradication, Recovery, and Post-Incident Activity. Security teams must first validate indicators to establish scope (Detection & Analysis), immediately restrict attacker access and isolate affected assets (Containment), eliminate threat artifacts and vulnerabilities (Eradication), restore systems to production under secure conditions (Recovery), and finally document lessons learned to improve playbooks (Post-Incident Activity).

Step-by-Step Solution

1
Identify Detection and Analysis activities
Analyzing VPN logs and SIEM data verifies the unauthorized access and determines the scope of compromise.
Responders must validate that a security incident has occurred and understand its footprint prior to executing operational containment.
2
Identify Containment activities
Terminating active connections and isolating hosts halts active malicious actions and prevents network spread.
Containment limits operational damage while security personnel plan and execute permanent threat eradication.
3
Identify Eradication activities
Revoking compromised tokens, removing backdoor mechanisms, and applying security patches eliminates the adversary's presence.
Eradication removes the root cause so affected hosts can be re-introduced to production safely.
4
Identify Recovery activities
Restoring database systems from known-good backups and re-enabling access brings business operations back online.
Recovery validates system integrity and resumes normal business capabilities under enhanced monitoring.
5
Identify Post-Incident Activity
Conducting a debrief session and updating playbooks documents response efficacy and lessons learned.
Post-incident review improves operational readiness and updates incident response playbooks for future events.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Phases
Estimated Time:1m 30s
Question 142Question →

A security engineer is configuring a Service Provider-initiated SAML 2.0 Single Sign-On (SSO) integration between an enterprise SaaS application (Service Provider) and an external cloud Identity Provider (IdP) with mandatory MFA. In what order should the steps occur to complete a secure authentication and access flow?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with the user requesting access at the Service Provider, followed by the SP generating a SAML AuthnRequest and redirecting the browser to the Identity Provider. Next, the IdP authenticates the user credentials and MFA challenge. After authentication succeeds, the IdP sends a signed SAML response to the SP Assertion Consumer Service endpoint. Finally, the SP validates the signature and token claims before creating the local session.
In a Service Provider (SP)-initiated SAML 2.0 Single Sign-On sequence, the workflow must start at the resource endpoint (SP), redirect to the identity repository (IdP) for credential and MFA verification, return a signed SAML assertion token to the Assertion Consumer Service (ACS) endpoint, and end with cryptographic validation and local session establishment by the SP.

Step-by-Step Solution

1
Identify the initiation point for Service Provider (SP)-initiated SSO
The unauthenticated client request to the application triggers the creation of a SAML AuthnRequest payload.
In SP-initiated flows, access attempts at the target application must precede redirection.
2
Trace the HTTP redirect sequence
The user's browser transfers the AuthnRequest parameter to the IdP endpoint.
The browser acts as the user-agent bridge carrying authentication requests between decoupled domains.
3
Perform centralized identity verification and policy enforcement
The IdP processes primary credentials and enforces secondary MFA challenges.
Authentication and policy evaluation take place entirely on the trusted Identity Provider.
4
Return the signed security token via browser redirect/POST
The IdP constructs a SAML assertion signed with its private key and sends it to the SP Assertion Consumer Service (ACS).
The ACS endpoint is designed to receive and parse federated identity assertions.
5
Validate cryptographic trust and grant local application authorization
The SP checks the IdP's public certificate signature, expiration timestamps, and recipient claims before granting access.
Verification prevents SAML response spoofing and token replay attacks.

Key Concept

SAML 2.0 SP-Initiated SSO Authentication Flow
Question 143Question →

An enterprise web application experienced an unrecoverable infrastructure failure at its primary facility. The incident response team must execute the disaster recovery plan to activate the secondary warm site and minimize service disruption. In what chronological order should the administrator execute the following steps to complete the failover securely while preserving data integrity?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with declaring the disaster, followed by applying pending transaction logs to reach RPO consistency, promoting the standby database replica to read-write mode, running synthetic validation health checks, and finally updating external DNS records to route user traffic.
The proper disaster recovery sequence balances data protection with operational availability. First, formal disaster declaration initiates the procedure. Second, pending database logs are applied to guarantee data integrity up to the defined RPO. Third, the database replica is promoted to read-write primary status. Fourth, health and security validation checks verify system integrity. Fifth, external DNS records are redirected to route live client traffic to the secondary facility.

Step-by-Step Solution

1
Initiate administrative failover authorization
Disaster declaration triggers authorized BCP workflows.
Technical failover tasks should not begin without official management invocation of the plan.
2
Reconcile database logs to satisfy RPO
Outstanding transaction logs are fully committed to the standby instance.
Ensures no data loss occurs prior to promoting the database instance.
3
Promote database instance role
Standby database becomes the active primary read-write database.
Application services require write access to backend storage to fulfill user requests.
4
Perform synthetic operational verification
Application dependencies and health indicators are validated.
Prevents routing users to a partially failed or corrupted secondary environment.
5
Cut over global user routing
DNS records point external users to the new active endpoint.
Directing user traffic is the final cutover mechanism after backend readiness is confirmed.

Key Concept

Disaster Recovery Failover Sequence and RPO/RTO Alignment
Estimated Time:1m 30s
Question 144Question →

During an ongoing incident investigation, a Security Operations Center (SOC) team detects that an automated Continuous Integration/Continuous Deployment (CI/CD) build server has been compromised. An attacker modified build scripts to exfiltrate enterprise API credentials to an external host while continuing to compile production software images. Which TWO of the following containment actions should the incident response team perform immediately to mitigate the incident while preserving evidence?

Select all that apply

Show answer & explanation

Answer: Isolate the compromised build server network interface via virtual firewall rules while capturing its volatile RAM.; Revoke and rotate the exposed API tokens and service account credentials associated with the build pipeline.

Answer

The containment strategy requires isolating the compromised build server network interface while capturing volatile memory, alongside revoking and rotating all exposed API tokens and service account credentials.
Effective containment of a compromised automation pipeline requires stopping both host communication and credential abuse. Isolating the build server at the network level combined with memory capture preserves volatile forensic evidence while halting exfiltration. Concurrently, revoking and rotating exposed API tokens prevents the adversary from leveraging stolen credentials against peripheral enterprise resources.

Step-by-Step Solution

1
Identify immediate containment goals
Determine that stopping active exfiltration and preventing unauthorized API access takes priority during containment.
Containment limits the scope and damage of an incident without prematurely destroying forensic artifacts.
2
Preserve state while stopping network exfiltration
Isolate the virtual host at the network layer and acquire a memory dump.
Acquiring memory prior to shut down ensures critical volatile evidence (such as injected process memory) is preserved.
3
Invalidate exfiltrated identity assets
Revoke and re-issue all affected tokens and secrets.
Exfiltrated credentials allow threat actors to bypass perimeter boundaries regardless of host containment.

Key Concept

Incident Response Containment Strategies and Evidence Preservation
Question 145Question →

An organization is establishing hardware security specifications for edge computing appliances deployed in remote, physically untrusted locations. The security architect must ensure cryptographic keys stored on hardware cannot be extracted via physical chip probing, and device identities cannot be duplicated onto unauthorized hardware. Which of the following hardware security controls should be implemented to meet these specific requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Physically Unclonable Functions (PUF) to generate unique cryptographic keys derived from semiconductor manufacturing variations; Cryptographic co-processor with active physical tamper detection integrated to trigger key zeroization upon enclosure breach

Answer

Implementing Physically Unclonable Functions (PUF) to derive unique key material from silicon manufacturing variations, and deploying active tamper-detection mechanisms integrated with cryptoprocessors to zeroize keys upon physical breach.
Physically Unclonable Functions (PUF) utilize unique manufacturing variations in semiconductor silicon to generate distinct cryptographic key material that cannot be cloned across devices. Active tamper detection mechanisms paired with cryptoprocessors provide physical protection by detecting enclosure compromises and immediately zeroizing sensitive keys to prevent extraction via physical probing.

Step-by-Step Solution

1
Identify the threat vectors described in the scenario.
The primary threat vectors are physical chip probing (key extraction) and hardware cloning (device duplication) in unmonitored locations.
Security controls must specifically target physical and silicon-level protection mechanisms rather than software-based controls.
2
Evaluate hardware mechanism for anti-cloning and unique identity.
Physically Unclonable Functions (PUF) leverage unique sub-micron physical variations in silicon to construct un-clonable key material.
Because no two chips have identical micro-structural variations, PUF prevents hardware cloning and physical key extraction.
3
Evaluate hardware mechanism for physical intrusion protection.
Active tamper detection circuits connected to secure cryptoprocessors perform automated key zeroization when physical breach occurs.
Zeroization ensures sensitive cryptographic material is completely wiped before an adversary can probe memory chips.

Key Concept

Hardware-Based Key Protection and Anti-Tamper Mechanisms
Question 146Question →

A security technician needs to conduct a vulnerability scan on an internal application server to accurately identify missing software patches and internal misconfigurations without disrupting active services. Which of the following scanning approaches best satisfies these requirements?

Show answer & explanation

Answer: Credentialed, non-intrusive scan

Answer

Credentialed, non-intrusive scan
A credentialed, non-intrusive scan uses valid system credentials to authenticate directly to the target operating system. It inspects installed software registries, missing patches, and local security configurations with high accuracy while avoiding aggressive exploit traffic that could disrupt server availability.

Step-by-Step Solution

1
Determine authentication requirement
Local system access is needed to accurately verify installed software versions and patch levels.
Unauthenticated network scans only see open network ports and service banners, resulting in potential false positives.
2
Determine scan impact requirement
A non-intrusive scan method must be selected.
Intrusive scanning sends exploit payloads or intensive tests that could crash live application services.

Key Concept

Credentialed vs. Non-Credentialed Vulnerability Scanning
Estimated Time:1m 0s
Question 147Question →

During a network security monitoring review of a cloud environment, a security analyst examines the following NIDS alert log associated with an internal application gateway:

Timestamp: 2026-07-27T14:22:01Z
Src_IP: 192.168.10.45:49152 -> Dst_IP: 10.0.4.12:80
Signature: HTTP_Req_Pattern_Match
Payload Snippet: POST /search.php HTTP/1.1\r
Host: store.internal\r
User-Agent: Mozilla/5.0\r
Content-Type: application/x-www-form-urlencoded\r
Content-Length: 68\r
\r
item=1+UNION+SELECT+null,username,password_hash+FROM+users--

Following this initial request, outbound firewall logs capture sustained 15-minute periodic TCP connections from 10.0.4.12 to an external IP address over port 443. Based on the log evidence, which of the following represents the most accurate diagnosis of the activity and the appropriate immediate analyst action?

Show answer & explanation

Answer: The alert indicates a successful SQL injection exploit leading to potential data exfiltration; the analyst should immediately isolate the web server (10.0.4.12) to contain potential command and control activity.

Answer

The alert indicates a successful SQL injection exploit leading to potential data exfiltration; the analyst should immediately isolate the web server (10.0.4.12) to contain potential command and control activity.
Analyzing the payload snippet reveals a classic SQL injection pattern (`UNION SELECT null,username,password_hash FROM users--`) attempting to extract user credentials from a backend database. Correlating this NIDS alert with the subsequent sustained outbound TCP port 443 sessions from the target web server indicates potential post-exploitation activity or data exfiltration. Isolating the target web server halts egress communications while enabling forensic analysis.

Step-by-Step Solution

1
Analyze NIDS HTTP payload syntax
Identified 'UNION SELECT null,username,password_hash FROM users--' as a SQL injection (SQLi) attack targeting backend database credentials.
Determines the specific attack vector targeting the database application logic.
2
Correlate NIDS payload with outbound NetFlow/Firewall logs
Observed subsequent persistent outbound traffic over TCP port 443 from the target server (10.0.4.12) to an external IP.
Establishes post-exploitation behavior indicative of data exfiltration or Command and Control (C2) beaconing.
3
Determine containment response action
Selected network isolation of server 10.0.4.12.
Prevents ongoing outbound data exfiltration while preserving memory and system state for digital forensics.

Key Concept

SQL Injection Alert Diagnosis and Containment Correlation
Question 148Question →

An IAM administrator at an online payment processor is reviewing identity operational logs after an audit revealed that a terminated contractor retained administrative access to production API gateways 48 hours after offboarding:

Timestamp (UTC)Event IDIdentity / SubjectSystem ComponentDetails / Status
2026-07-25 09:00:00EVT-801[email protected]IdP DirectoryUser account status set to Disabled
2026-07-25 09:00:05EVT-802[email protected]SCIM EngineProvisioning push failed: Integration token expired
2026-07-25 09:05:00EVT-803[email protected]API GatewayRefresh token exchange succeeded (New access token issued)
2026-07-27 08:30:00EVT-804[email protected]API GatewayAdministrative configuration change executed

Based on the log analysis, which of the following identifies the primary technical cause of the persistent access and the most effective operational fix?

Show answer & explanation

Answer: The automated deprovisioning sync failed due to an expired SCIM integration token, and long-lived OAuth refresh tokens were not explicitly revoked upon account disablement; implementing Continuous Access Evaluation (CAE) or automated token revocation hooks is required.

Answer

The persistent access was caused by an expired SCIM provisioning token preventing downstream account deprovisioning combined with active OAuth refresh tokens that were not invalidated; the operational fix requires implementing Continuous Access Evaluation (CAE) or automated token revocation hooks.
The logs clearly show that while the account was disabled in the directory (EVT-801), the SCIM engine failed to propagate this disablement due to an expired integration token (EVT-802). As a result, the API Gateway honored the user's existing OAuth refresh token (EVT-803), granting continued access. Remediating this requires repairing SCIM token authentication and enforcing Continuous Access Evaluation (CAE) or automated revocation webhooks to instantly invalidate active tokens when an account status changes.

Step-by-Step Solution

1
Analyze the log entries sequentially to trace the deprovisioning workflow failure.
Event EVT-801 shows account disablement in the primary Identity Provider at 09:00:00 UTC, but EVT-802 indicates that SCIM provisioning push failed due to an expired integration token five seconds later.
SCIM depends on valid API credentials/tokens to propagate identity lifecycle updates to relying applications.
2
Examine downstream authentication and authorization behavior following the failed SCIM push.
At 09:05:00 UTC (EVT-803), the API Gateway processed a valid OAuth refresh token request because it was never notified of the user's disabled status, issuing a new active access token.
OAuth refresh tokens remain valid until explicitly revoked or expired; disabling an account in the primary IdP does not automatically invalidate active downstream tokens without active revocation mechanisms.
3
Determine the required IAM operational remediation.
Fixing the SCIM integration credential maintenance and deploying Continuous Access Evaluation (CAE) / automated token revocation ensures real-time session invalidation across all relying parties.
CAE enables identity providers and reliance endpoints to communicate security events dynamically, stopping active sessions immediately upon account risk state changes.

Key Concept

Identity Provisioning, Lifecycle Synchronization, and Token Revocation Operations
Question 149Question →

An enterprise security team needs to publish a document that specifies the mandatory minimum technical security settings required for all newly deployed cloud virtual machines. Which type of security governance document should the team create to define these mandatory minimum configurations?

Show answer & explanation

Answer: Security baseline

Answer

A security baseline document defines the minimum mandatory technical configurations required for systems.
A security baseline provides a mandatory set of minimum security settings and configuration controls that all systems of a given type must meet to ensure consistent hardening.

Step-by-Step Solution

1
Analyze the scenario requirements
The requirement specifies mandatory minimum technical security configurations for virtual machines.
Identifying whether requirements are mandatory technical settings, high-level directives, or optional advice determines the document classification.
2
Evaluate document types against governance definitions
A security baseline explicitly establishes the mandatory minimum build and security controls for operating systems or hardware.
Baselines ensure consistent hardening across deployments.

Key Concept

Security Baselines and Policy Hierarchy
Question 150Question →

An enterprise logistics provider is conducting a quantitative risk assessment for a mission-critical database cluster valued at 2,000,000.ThreatmetricsindicatethataransomwareinfectionresultsinanExposureFactor(EF)of252,000,000. Threat metrics indicate that a ransomware infection results in an Exposure Factor (EF) of 25%, with an unmitigated Annual Rate of Occurrence (ARO) of 0.5. The security team plans to implement an endpoint detection and response (EDR) solution costing 30,000 annually, which is expected to lower the ARO to 0.1 without altering the EF. What is the net annual financial benefit (safeguard value) of implementing this security control?

Show answer & explanation

Answer: $170,000

Answer

The net annual financial benefit of implementing the safeguard is $170,000.
The net annual benefit (safeguard value) measures total financial savings generated by a security control after subtracting its operational expense. First, the Single Loss Expectancy (SLE) is computed as $2,000,000×0.25=$500,000\$2,000,000 \times 0.25 = \$500,000. Next, the baseline Annual Loss Expectancy (ALEinitialALE_{initial}) is $500,000×0.5=$250,000\$500,000 \times 0.5 = \$250,000. After applying the safeguard, the post-control Annual Loss Expectancy (ALEmitigatedALE_{mitigated}) becomes $500,000×0.1=$50,000\$500,000 \times 0.1 = \$50,000. Subtracting mitigated ALE from initial ALE yields a gross loss reduction of $200,000\$200,000. Finally, subtracting the $30,000\$30,000 annual safeguard cost results in a net annual financial benefit of $170,000\$170,000.

Step-by-Step Solution

1
Calculate Single Loss Expectancy (SLE)
SLE=Asset Value(AV)×Exposure Factor(EF)=$2,000,000×0.25=$500,000SLE = Asset\ Value (AV) \times Exposure\ Factor (EF) = \$2,000,000 \times 0.25 = \$500,000
SLE represents the financial loss incurred each time a single risk event occurs.
2
Calculate Initial Annual Loss Expectancy (ALE_initial)
ALEinitial=SLE×AROinitial=$500,000×0.5=$250,000ALE_{initial} = SLE \times ARO_{initial} = \$500,000 \times 0.5 = \$250,000
Initial ALE establishes the baseline annual monetary loss expected from the threat prior to safeguard implementation.
3
Calculate Mitigated Annual Loss Expectancy (ALE_mitigated)
ALEmitigated=SLE×AROmitigated=$500,000×0.1=$50,000ALE_{mitigated} = SLE \times ARO_{mitigated} = \$500,000 \times 0.1 = \$50,000
Mitigated ALE determines the residual annual expected loss after the safeguard reduces event occurrence frequency.
4
Calculate Net Safeguard Value (Annual Cost-Benefit)
Safeguard Value=(ALEinitial−ALEmitigated)−Annual Safeguard Cost=($250,000−$50,000)−$30,000=$170,000Safeguard\ Value = (ALE_{initial} - ALE_{mitigated}) - Annual\ Safeguard\ Cost = (\$250,000 - \$50,000) - \$30,000 = \$170,000
Net annual financial benefit accounts for both the loss exposure reduction and the ongoing cost of maintaining the control.

Key Concept

Quantitative Risk Analysis & Safeguard Cost-Benefit Value
Estimated Time:2m 0s
Question 151Question →

A security operations team must implement appropriate vulnerability assessment methodologies across four distinct IT and operational environments. Which vulnerability scanning approach best matches each enterprise operational requirement?

Click a left item, then click its matching right item

Items

Non-intrusive Credentialed Scan
Passive Vulnerability Monitoring
Intrusive Exploitation Scan
Authenticated Dynamic Application Scan

Matches

Show answer & explanation

Answer

The correct pairing matches: Non-intrusive Credentialed Scan with auditing production database OS updates safely; Passive Vulnerability Monitoring with assessing sensitive OT/ICS networks without sending packets; Intrusive Exploitation Scan with confirming shell access from a remote code execution vulnerability in staging; and Authenticated Dynamic Application Scan with analyzing web vulnerabilities behind a login prompt.
Vulnerability scanner methodologies must align with system risk tolerance and application architecture. Passive monitoring avoids packet transmission for delicate operational technology. Non-intrusive credentialed scans safely query local package managers via host credentials. Intrusive scans perform real exploitation checks to confirm true positives in test environments. Authenticated dynamic scans execute web request payloads behind application login mechanisms.

Step-by-Step Solution

1
Evaluate the requirements and constraints for legacy OT/ICS networks.
Determine that packet injection can crash legacy SCADA controllers, making packetless monitoring necessary.
Passive vulnerability monitoring collects asset and vulnerability intelligence solely by sniffing network traffic.
2
Determine the safest method to verify patch compliance on production hosts during operational hours.
Select non-intrusive credentialed scanning.
Host credentials allow direct inspection of local package manifests without generating heavy or disruptive network attack traffic.
3
Identify the technique required to confirm functional exploitability of a critical flaw.
Select intrusive exploitation scanning.
Intrusive scans validate exploitability by actively executing exploit scripts against target vulnerabilities.
4
Match the web application testing requirement for authenticated areas.
Select authenticated dynamic application scanning.
DAST crawlers require session tokens to traverse and analyze access controls, session state, and input fields behind login interfaces.

Key Concept

Vulnerability Scanning Methodologies and Environmental Constraints
Estimated Time:2m 0s
Question 152Question →

Following an enterprise-wide cloud transformation, an organization's Chief Information Security Officer (CISO) establishes a multi-tiered governance structure to enforce security controls across diverse engineering teams. The framework includes high-level security objectives, mandatory technical requirements for microservices, discretionary coding recommendations, and platform-specific step-by-step configuration steps. During an internal compliance review, a software development team is flagged for utilizing AES-128 encryption across microservices instead of the mandatory enterprise cipher specification. The team lead asserts that technical rules specified outside the overarching executive policy document are non-binding recommendations. Which governance document type did the CISO issue to enforce mandatory technical requirements across the enterprise, and what is its role within the governance hierarchy?

Show answer & explanation

Answer: Standard; it establishes mandatory technical specifications and rules that operationalize high-level security policies.

Answer

The standard is the governance document type issued to enforce compulsory technical specifications operationalizing high-level security policies.
In security governance hierarchies, a Standard establishes mandatory technical requirements, rules, or configurations (such as compulsory cryptographic algorithms) that operationalize executive Security Policies across an enterprise.

Step-by-Step Solution

1
Analyze the CISO's governance hierarchy and the nature of the requirement.
The requirement (specific AES cipher usage) is a mandatory technical specification designed to enforce consistent controls across engineering teams.
Governance documents are differentiated by their level of abstraction, authority level, and mandatory vs. discretionary nature.
2
Evaluate the distinct roles of governance document types in an enterprise framework.
High-level goals belong in policies, step-by-step workflows belong in procedures, suggestions belong in guidelines, and uniform mandatory technical rules belong in standards.
Standards bridge high-level policy intent with actionable, mandatory technical requirements across systems.
3
Identify the correct governance classification for the CISO's cipher requirement.
The document defining compulsory cipher usage across microservices is a Standard.
Engineers must comply with standards because they carry mandatory authority beneath the overarching policy.

Key Concept

Security Policy Hierarchy (Policies vs Standards vs Baselines vs Guidelines vs Procedures)
Estimated Time:2m 0s
Question 153Question →

During a routine security review of cloud identity operations, a security analyst discovers that an automated data synchronization process uses a legacy service account configured with a long-lived static API key. The key was inadvertently committed to an internal repository, allowing an unauthorized external entity to request access tokens and enumerate cloud resources. Which of the following operational controls should the security team implement to remediate this vulnerability and secure the service identity lifecycle? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Migrate the automated service identity to use workload identity federation with short-lived, ephemeral tokens instead of hardcoded credentials.; Configure risk-based conditional access policies to evaluate request context and block token issuance from unexpected locations or anomalous sources.

Answer

The security team should migrate the service account to workload identity federation with short-lived tokens and implement contextual conditional access policies.
Migrating to workload identity federation eliminates static long-lived credentials by issuing short-lived tokens based on trusted identity relationships. Combining this with risk-based conditional access ensures token requests from untrusted origins or anomalous locations are blocked automatically.

Step-by-Step Solution

1
Identify the primary operational vulnerability.
The vulnerability stems from using long-lived static credentials (API keys) that can be leaked and abused externally.
Static credentials present a continuous risk of exposure and lack dynamic identity verification.
2
Select credential lifecycle remediation controls.
Replace long-lived keys with workload identity federation to issue short-lived, ephemeral access tokens.
Ephemeral tokens drastically reduce the window of opportunity for compromise.
3
Select adaptive access controls for identity operations.
Apply conditional access policies to inspect request context and block suspicious token requests.
Risk-based conditional access enforces Zero Trust principles for service account token requests.

Key Concept

Workload Identity Federation and Conditional Access Control in IAM Operations
Question 154Question →

A security engineer is configuring a newly deployed Security Information and Event Management (SIEM) system to ingest and analyze multi-source telemetry across the enterprise network. Arrange the core stages of the SIEM log processing pipeline in the correct sequential order from initial intake to operational notice.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of stages in the SIEM log processing pipeline is: Log Collection, Parsing, Normalization, Correlation, and Alerting.
The SIEM log processing pipeline must ingest raw logs before evaluating them. Log Collection receives raw telemetry from source hosts. Next, Parsing extracts discrete fields from unformatted text strings. Once parsed, Normalization maps those fields into a uniform taxonomy so events from different vendors can be understood under a single schema. Correlation then evaluates these normalized events across time windows and sources against threat rules. Finally, Alerting notifies security analysts when rule conditions are satisfied.

Step-by-Step Solution

1
Identify the initial intake phase of event data
Log Collection gathers raw telemetry from endpoints, network devices, and security controls.
Before any processing can begin, raw logs must be collected from their original sources.
2
Structure the unformatted log text into defined fields
Parsing breaks down raw strings into structured data elements like IP addresses, timestamps, and action codes.
SIEM systems cannot efficiently search or evaluate unstructured text without extracting key attributes.
3
Standardize variable field naming across disparate vendor formats
Normalization converts heterogeneous fields (e.g., 'src_ip' vs 'source_address') into a single common schema.
Correlation rules require uniform field names to effectively compare events from different vendors.
4
Evaluate uniform log data against security logic and threat indicators
Correlation cross-examines normalized events to identify suspicious patterns and multi-host activity.
Rule matching must operate on standardized, parsed telemetry to produce reliable threat detection.
5
Notify analysts or triggering automated incident response mechanisms
Alerting dispatches high-priority tickets or push notices for identified threats.
Alerting occurs only after correlation engines determine that specific event thresholds or rules have been triggered.

Key Concept

SIEM Log Processing Pipeline
Question 155Question →

An enterprise security architect is designing an updated Identity and Access Management (IAM) architecture to support dynamic, fine-grained authorization across microservices while automating user account lifecycles across cloud services. Which of the following components or standards should be incorporated into the architecture to fulfill these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: A Policy Decision Point (PDP) utilizing Attribute-Based Access Control (ABAC) to evaluate real-time contextual access requests; System for Cross-domain Identity Management (SCIM) protocol to automate account provisioning and lifecycle synchronization

Answer

The architecture requires combining a Policy Decision Point (PDP) enforcing Attribute-Based Access Control (ABAC) for dynamic access decisions with the System for Cross-domain Identity Management (SCIM) standard for automated identity provisioning.
Attribute-Based Access Control (ABAC) managed by a central Policy Decision Point (PDP) provides fine-grained context-aware authorization decisions across distributed microservices. Simultaneously, the System for Cross-domain Identity Management (SCIM) standard automates user identity creation, modification, and revocation across connected identity domains.

Step-by-Step Solution

1
Address the requirement for dynamic, fine-grained authorization
Implement an ABAC-based Policy Decision Point (PDP).
ABAC evaluates dynamic variables (such as risk score, user position, time, and requested data sensitivity) to make granular, real-time access decisions.
2
Address the requirement for automated account lifecycle management across systems
Implement the System for Cross-domain Identity Management (SCIM) standard.
SCIM provides standardized REST/JSON APIs that allow Identity Providers to push user onboarding, profile updates, and offboarding changes across target SaaS applications automatically.

Key Concept

IAM Architecture Integration: Fine-grained Authorization (PDP/ABAC) and Automated Provisioning (SCIM)
Question 156Question →

A security analyst is auditing access logs following an unauthorized privilege escalation incident on a network perimeter gateway. The organization utilizes a centralized RADIUS server integrated with Directory Services for network access control. The authentication and authorization logs display the following consecutive events:

[TIMESTAMP: 2026-07-27T14:22:01Z] RADIUS-Auth: User 'j_doe' successfully authenticated via MS-CHAPv2.
[TIMESTAMP: 2026-07-27T14:22:02Z] RADIUS-Authz: Vendor-Specific Attribute (VSA) 'Cisco-AVPair = shell:priv-lvl=15' rejected due to policy schema syntax mismatch.
[TIMESTAMP: 2026-07-27T14:22:03Z] Gateway-Daemon: Fallback default authorization rule applied; assigned administrative profile (privilege level 15) to session 'j_doe'.

Which of the following operational vulnerabilities is the primary root cause of the unauthorized privilege escalation?

Show answer & explanation

Answer: A failure in authorization attribute processing triggered an insecure default fallback configuration on the gateway.

Answer

A failure in authorization attribute processing triggered an insecure default fallback configuration on the gateway.
The log output shows successful authentication followed by a failure in authorization attribute syntax (Vendor-Specific Attribute). The gateway daemon's flawed logic defaulted to granting full privilege level 15 when the authorization attribute was rejected. The root cause is therefore improper authorization processing leading to an insecure fail-open default configuration.

Step-by-Step Solution

1
Analyze RADIUS authentication log entry
User 'j_doe' successfully passed authentication using MS-CHAPv2, confirming identity validation occurred correctly.
Differentiates authentication (identity proof) from authorization (permission granting).
2
Analyze RADIUS authorization VSA log entry
The Vendor-Specific Attribute intended to specify privilege level 15 failed due to a syntax error.
Identifies where the permission specification mechanism broke down.
3
Analyze Gateway Daemon fallback log entry
Upon rejection of the authorization attribute, the gateway applied a default local rule granting full privilege level 15 access.
Pinpoints the root cause as fail-open default configuration upon authorization processing failure.

Key Concept

RADIUS Vendor-Specific Attributes (VSAs) and Fail-Secure vs. Fail-Open Authorization Handling
Question 157Question →

A digital forensics analyst has completed the imaging of a seized storage volume from an enterprise database server involved in a security incident. The analyst is preparing to transfer the physical evidence to an external forensic laboratory for detailed examination. Which of the following actions must the analyst take to maintain a valid chain of custody during this transfer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Record cryptographic SHA-256 hashes of the acquired evidence alongside timestamped logs before initiating evidence transfer; Document sign-off signatures of both transferor and recipient detailing the exact date, time, and purpose on the chain of custody log

Answer

The analyst must record cryptographic hashes of the evidence before transfer and document dual sign-off signatures detailing the date, time, and purpose on the chain of custody log.
Maintaining a valid chain of custody requires documenting every transfer of evidence with detailed logs—including date, time, transferor, recipient, and purpose—as well as verifying evidence integrity via cryptographic hashing before and after transfer.

Step-by-Step Solution

1
Calculate and record pre-transfer cryptographic hash values
Establishes an integrity baseline for comparing evidence post-transport
Verification of hash integrity proves the digital evidence was not tampered with during transfer.
2
Complete the chain of custody log documentation during handoff
Tracks official custody, transferor/transferee identities, timestamps, and transfer purpose
Provides legal non-repudiation and accountability for who handled the evidence at all times.

Key Concept

Digital Forensics Chain of Custody and Evidence Integrity
Estimated Time:1m 30s
Question 158Question →

A Security Operations Center (SOC) analyst receives a high-priority alert indicating that an enterprise Voice over IP (VoIP) management server has established unauthorized outbound secure shell (SSH) sessions to an unknown external IP address and is attempting horizontal scanning across internal server subnets. The analyst inspects network logs and confirms that an active remote code execution exploit took place through the server's web administration panel. According to standard incident response playbooks, which of the following actions should the analyst perform FIRST?

Show answer & explanation

Answer: Isolate the compromised VoIP server from the network segment while preserving host volatile memory for forensic investigation.

Answer

Isolate the compromised VoIP server from the network segment while preserving host volatile memory for forensic investigation.
In accordance with standard NIST SP 800-61 incident response frameworks, once an active system compromise is confirmed, the immediate priority is containment. Isolating the compromised VoIP server from the network halts unauthorized lateral movement and outbound command-and-control communications. Preserving volatile RAM ensures vital forensic evidence remains available for analysis.

Step-by-Step Solution

1
Identify the current incident response phase based on the scenario state.
The compromise has just been verified, placing the response at the Containment phase.
Before any remediation or recovery can take place, active threats must be contained to prevent further damage or lateral movement.
2
Select the action that properly executes containment while preserving forensic evidence.
Network isolation stops external command-and-control traffic and internal scanning while keeping RAM intact.
Preserving volatile memory (RAM) is crucial before power-down or network disconnect, supporting chain of custody and forensic triage.

Key Concept

Incident Response Lifecycle - Containment Phase
Question 159Question →

A tier 2 incident responder analyzing endpoint telemetry observes an active fileless attack on an enterprise financial server, where an injected process is issuing unauthorized API calls to extract credentials and establish an outbound encrypted beacon. To effectively contain the active compromise and preserve critical evidence for incident triage without losing agent telemetry, which of the following response actions should the responder perform using EDR agent capabilities? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply host-level network isolation via the agent while maintaining the agent-to-console management connection; Capture a live volatile memory (RAM) dump of the endpoint directly through agent execution capabilities prior to terminating the suspicious process tree

Answer

The incident responder should apply host-level network isolation via the EDR agent while maintaining console connectivity, and capture a live volatile memory (RAM) dump of the host before terminating the suspicious process tree.
Combining host-level agent isolation with pre-remediation volatile memory acquisition enables incident responders to contain active network activity instantly while preserving volatile evidence necessary for root cause analysis.

Step-by-Step Solution

1
Isolate the compromised host at the endpoint layer via EDR console network containment features.
Network communication to external adversary infrastructure and adjacent internal network hosts is severed, stopping lateral movement while preserving SOC remote agent control.
Immediate containment at the host level prevents adversary expansion without blinding the security team.
2
Trigger volatile memory acquisition using EDR forensic capabilities prior to process kill execution.
In-memory code, injected DLLs, and volatile runtime evidence are preserved on disk or uploaded securely for forensic analysis.
Fileless memory threats disappear as soon as the host reboots or the process tree is killed.

Key Concept

EDR Host Isolation and Volatile Telemetry Preservation
Question 160Question →

A systems administrator is configuring a secure remote management channel for server administration over an untrusted network. The security policy mandates perfect forward secrecy so that compromising the server's long-term private key in the future will not allow an attacker to decrypt previously recorded session traffic. Which cryptographic key exchange mechanism should the administrator implement to satisfy this requirement?

Show answer & explanation

Answer: Ephemeral Diffie-Hellman key exchange

Answer

Ephemeral Diffie-Hellman key exchange should be selected because ephemeral keys provide perfect forward secrecy for encrypted sessions.
Ephemeral Diffie-Hellman key exchange satisfies perfect forward secrecy requirements because a unique, temporary key pair is generated for each communication session. Once the session ends, the temporary keys are discarded. An attacker who compromises the server's long-term private key at a later date cannot derive previous session keys or decrypt captured historical traffic.

Step-by-Step Solution

1
Identify the primary requirement specified in the scenario
The requirement is perfect forward secrecy (PFS) for remote management sessions over an untrusted network.
The system must protect historical session logs from decryption even if long-term server private keys are compromised.
2
Evaluate key exchange mechanisms against the requirement
Ephemeral key exchanges (such as ECDHE or DHE) generate temporary, disposable keys per session rather than deriving session keys from long-term asymmetric keys.
Because temporary session keys are not stored and cannot be derived from long-term keys, forward secrecy is maintained.
3
Select the option that implements ephemeral key exchange
Ephemeral Diffie-Hellman key exchange correctly satisfies the security requirement.
It ensures that compromising long-term keys does not compromise past communication sessions.

Key Concept

Perfect Forward Secrecy via Ephemeral Diffie-Hellman
PreviousPage 8 / 112Next
All practice questions — CompTIA Security+ | Examkin