All practice questions

378 questions

Question 141Question

A security operations analyst is evaluating several network monitoring alerts and packet captures from an enterprise environment. Match each observed technical indicator on the left with its corresponding attack classification on the right.

Click a left item, then click its matching right item

Items

High volume of 802.11 management frames containing frame subtype 0x000C causing widespread client drops
Unsolicited ICMPv6 Type 134 packets broadcast across a segment overriding client default gateways
Ethernet frames containing dual 802.1Q headers transmitted over a native trunk port to reach an isolated segment
Unsolicited vCard contact details pushed to employee mobile devices via short-range RF connections

Matches

Show answer & explanation

Answer

The technical indicators match their corresponding attack classifications as follows: 802.11 subtype 0x000C frames map to Disassociation Attack; ICMPv6 Type 134 packets map to Rogue IPv6 Router Advertisement; dual 802.1Q headers map to Double Tagging VLAN Hopping; and unsolicited Bluetooth vCards map to Bluejacking.
Each indicator corresponds to a distinct network or wireless attack mechanism: 802.11 disassociation frames (0x000C) break active Wi-Fi sessions; ICMPv6 Type 134 packets distribute rogue default gateway details; dual 802.1Q VLAN headers enable switch trunk hopping; and unsolicited Bluetooth vCards represent Bluejacking.

Step-by-Step Solution

1
Analyze the 802.11 wireless frame indicator
Identify frame subtype 0x000C as an 802.11 disassociation frame.
Spoofed disassociation frames force wireless clients to disconnect from their legitimate access point.
2
Analyze the IPv6 ICMP message type
Identify ICMPv6 Type 134 as a Router Advertisement message.
Unauthorized RA packets alter IPv6 neighbor discovery and divert traffic through a rogue gateway.
3
Analyze the Layer 2 frame header structure
Identify dual 802.1Q VLAN encapsulation tags as double tagging.
Switches processing native VLAN traffic strip the outer header, allowing the inner VLAN tag to bypass switch port isolation.
4
Analyze the mobile short-range wireless activity
Identify unsolicited Bluetooth vCard transfers as Bluejacking.
Bluejacking uses OBEX protocol to send uninvited messages to Bluetooth targets without exfiltrating data.

Key Concept

Distinguishing technical indicators of Layer 2 switch attacks, wireless denial-of-service, and network auto-configuration spoofing.
Question 142Question

An enterprise security architect is categorizing control plane and data plane functional duties during a Zero Trust Architecture (ZTA) migration. Match each Zero Trust architecture component on the left with its specific operational responsibility on the right.

Click a left item, then click its matching right item

Items

Policy Engine (PE)
Policy Administrator (PA)
Policy Enforcement Point (PEP)
Threat Intelligence System

Matches

Show answer & explanation

Answer

The Policy Engine renders access authorization decisions; the Policy Administrator commands control plane session establishment or teardown; the Policy Enforcement Point gates data plane traffic; and the Threat Intelligence System supplies contextual threat data to dynamic trust scoring processes.
In Zero Trust Architecture (NIST SP 800-207), the control plane is split into evaluation logic (Policy Engine) and control execution (Policy Administrator), which together make up the Policy Decision Point (PDP). The Policy Enforcement Point (PEP) resides in the data plane to directly gate resource access. External contextual providers, such as Threat Intelligence Systems, supply real-time attack data to inform dynamic trust decisions.

Step-by-Step Solution

1
Differentiate between Policy Decision Point (PDP) components and Policy Enforcement Point (PEP) locations.
Identified the Policy Engine and Policy Administrator as core PDP components in the control plane, while the PEP functions strictly within the data plane boundary.
ZTA relies on a clear operational separation between control plane decision logic and data plane traffic enforcement.
2
Distinguish between the decision logic (PE) and the execution logic (PA) within the PDP.
Matched the Policy Engine to policy calculation and access decision rendering, and the Policy Administrator to signaling the PEP to open or close session channels.
The PE evaluates contextual inputs against trust algorithms, whereas the PA communicates decision outcomes to enforcement gates.
3
Map supporting data sources to their external telemetry role.
Associated the Threat Intelligence System with providing real-time external threat feeds and dynamic risk context.
Continuous authorization relies on contextual data sources outside standard static identity attributes.

Key Concept

Zero Trust Control Plane vs. Data Plane Component Functions (NIST SP 800-207)
Question 143Question

Match each enterprise data protection architectural control to its corresponding storage security function.

Click a left item, then click its matching right item

Items

Tokenization with Format-Preserving Encryption
Hardware Security Module (HSM) with KMIP
LUN Masking and Fabric Zoning
Cryptographic Erase on Self-Encrypting Drives (SED)

Matches

Show answer & explanation

Answer

Tokenization with Format-Preserving Encryption matches replacing sensitive values with surrogate tokens while preserving database column schemas. Hardware Security Module (HSM) with KMIP matches providing centralized, tamper-resistant key generation and management. LUN Masking and Fabric Zoning matches restricting SAN access so only authorized HBAs can attach to specific storage targets. Cryptographic Erase on SEDs matches rapidly rendering physical drives unreadable during decommissioning by destroying internal encryption keys.
Each storage security mechanism operates at a distinct operational layer of data storage architecture: application/database field protection (tokenization with FPE), root key lifecycle governance (HSM with KMIP), SAN fabric path isolation (LUN masking and zoning), and media sanitization at end-of-life (cryptographic erase).

Step-by-Step Solution

1
Analyze field-level data protection and schema preservation needs.
Identify Tokenization with Format-Preserving Encryption as the technique that substitutes sensitive values while keeping existing field formatting intact.
Tokenization replaces raw sensitive entries with surrogate values, avoiding database application syntax errors without storing actual plaintext.
2
Evaluate key protection architectures and interoperability protocols.
Connect HSM with KMIP to centralized hardware key generation, storage, and cross-platform key management communication.
HSMs provide physical and logical tamper protection for keys, and KMIP standardizes key management operations across multi-vendor storage environments.
3
Examine SAN network segmentation and storage access restriction controls.
Match LUN Masking and Fabric Zoning to Host Bus Adapter (HBA) initiator-to-target access enforcement.
Zoning isolates FC switch network communication, and LUN masking ensures storage controllers restrict volume visibility to intended host HBAs.
4
Assess storage drive retirement and media sanitization mechanisms.
Link Cryptographic Erase on SEDs to the immediate destruction of the internal Data Encryption Key (DEK).
Destroying the underlying DEK makes all encrypted blocks on self-encrypting drives permanently unrecoverable in seconds.

Key Concept

Data Protection and Storage Security Architecture Controls
Question 144Question

A security analyst is defining operational procedures for a Security Information and Event Management (SIEM) deployment. Match each SIEM log management concept on the left with its correct operational description on the right.

Click a left item, then click its matching right item

Items

Log Aggregation
Log Normalization
Event Correlation
Log Retention

Matches

Show answer & explanation

Answer

Log Aggregation matches centralizing raw log data from disparate hosts; Log Normalization matches transforming heterogeneous log entries into a standardized schema; Event Correlation matches analyzing relationship patterns between distinct log events; and Log Retention matches storing historical log data for specified timelines to satisfy regulatory requirements.
Each concept aligns with its precise SIEM function: Aggregation collects raw logs into a central location, Normalization standardizes field syntax across vendor logs, Correlation analyzes relationships across events to flag attacks, and Retention maintains historical log archives for compliance.

Step-by-Step Solution

1
Identify the mechanism for collecting raw logs centrally.
Centralizing raw log data from disparate systems corresponds to Log Aggregation.
Aggregation brings scattered log sources together into a central SIEM collector.
2
Identify the process for unifying varied log formats.
Transforming heterogeneous logs into a standardized schema corresponds to Log Normalization.
Normalization ensures that different log syntax structures share identical field names (e.g., standardizing 'src_ip', 'SourceAddress', and 'src' to a single common field).
3
Identify the analytical process for connecting multi-system events.
Analyzing relationships across distinct log entries corresponds to Event Correlation.
Correlation engine rules detect threat scenarios spanning multiple log sources across time windows.
4
Identify the policy governing historic data storage.
Storing historical logs to satisfy regulatory requirements corresponds to Log Retention.
Retention schedules dictate how long logs remain accessible in hot, warm, or cold storage.

Key Concept

SIEM Core Log Management Operations
Estimated Time:1m 30s
Question 145Question

An enterprise security architect is refining the organization's data protection and storage security architecture. Match each enterprise storage security objective on the left with the primary storage control or mechanism on the right that best satisfies the requirement.

Click a left item, then click its matching right item

Items

Preventing unauthorized access to SAN block volumes by restricting visibility to specific Host Bus Adapter (HBA) World Wide Names (WWNs) at the storage controller layer.
Offloading cryptographic key generation, lifecycle management, and secure key storage to dedicated hardware compliant with FIPS 140-3 Level 3 requirements.
Ensuring hardware-level full disk encryption that transparently encrypts data at rest directly on disk controllers without OS overhead.
Replacing sensitive account numbers with surrogate values of identical length and character type before writing to database storage.

Matches

Show answer & explanation

Answer

The correct pairings are: 1) Preventing unauthorized SAN volume access pairs with LUN Masking and Zoning. 2) Offloading key generation and lifecycle management to tamper-resistant hardware pairs with Hardware Security Module (HSM). 3) Hardware-level disk block encryption without OS reliance pairs with Self-Encrypting Drives (SED). 4) Replacing account numbers with format-matched surrogate tokens pairs with Format-Preserving Tokenization.
Each requirement directly aligns with a foundational storage security architectural control: LUN Masking/Zoning isolates SAN storage access; HSMs secure key management infrastructure; SEDs deliver hardware-based encryption at rest; and Format-Preserving Tokenization protects structured sensitive data while maintaining system schema constraints.

Step-by-Step Solution

1
Analyze SAN block volume visibility control requirements
Identify LUN Masking and SAN Fabric Zoning as the mechanisms configured at the storage network layer to restrict volume presentation based on HBA WWN addresses.
LUN masking operates at the storage controller/target level to hide logical units from unauthorized initiator host HBAs.
2
Analyze tamper-resistant key lifecycle management requirements
Identify Hardware Security Module (HSM) as the hardware appliance designed for centralized, FIPS-certified key storage and cryptographic operations.
HSMs isolate root keys and cryptographic processing within physical tamper-evident physical boundaries.
3
Analyze controller-level transparent storage encryption at rest
Identify Self-Encrypting Drives (SED) as self-contained storage media equipped with onboard ASIC encryption controllers.
SEDs implement full disk encryption transparently at hardware speeds without processor overhead from the host operating system.
4
Analyze schema-preserving surrogate data replacement requirements
Identify Format-Preserving Tokenization as the database/application control that maps original sensitive data to tokens of identical structure.
Tokenization removes real sensitive values from the storage backend while maintaining length and field data type formatting.

Key Concept

Storage Architecture Security Controls & Encryption Mechanisms
Question 146Question

A cloud security architect is establishing isolation and resource protection mechanisms for a hybrid deployment containing both virtualized workloads and containerized microservices. Match each security mechanism to its primary isolation function.

Click a left item, then click its matching right item

Items

Linux Namespaces
Linux Control Groups (cgroups)
Secure Computing Mode (seccomp)
Type-1 Hypervisor

Matches

Show answer & explanation

Answer

Linux Namespaces match with restricting a process's view of system resources; Linux Control Groups (cgroups) match with enforcing resource allocation limits (CPU, memory, I/O); Secure Computing Mode (seccomp) matches with filtering and restricting kernel system calls; Type-1 Hypervisor matches with providing hardware-level abstraction running directly on bare-metal host hardware.
Each technology provides a distinct security and isolation boundary layer within enterprise virtualization and containerization architectures: Namespaces isolate visibility into host resources, Control Groups enforce resource consumption limits, Seccomp restricts syscall surface area exposed to the shared kernel, and Type-1 hypervisors provide hardware-assisted bare-metal guest isolation.

Step-by-Step Solution

1
Analyze container kernel isolation and view boundary mechanisms.
Identify that Linux Namespaces restrict process visibility into PIDs, network stacks, and filesystems, while seccomp restricts the system calls executable against the kernel.
Namespaces govern visibility boundaries whereas seccomp governs host syscall attack surface.
2
Analyze container resource governance mechanisms.
Identify that Linux Control Groups (cgroups) regulate compute, memory, and I/O consumption.
cgroups prevent individual microservices from consuming excessive host capacity.
3
Analyze virtualization layer boundaries.
Identify that Type-1 hypervisors execute on physical hardware to partition virtual machines.
Bare-metal hypervisors enforce hardware-level virtual machine boundary isolation.

Key Concept

Virtualization and Containerization Security Mechanisms
Estimated Time:1m 30s
Question 147Question

Match each advanced hardware security mechanism or embedded architecture component to its primary operational security function.

Click a left item, then click its matching right item

Items

Hardware Root of Trust (RoT) / eFuse
Physical Unclonable Function (PUF)
Bus Encryption Engine
Hardware Security Module (HSM)

Matches

Show answer & explanation

Answer

Hardware Root of Trust / eFuse pairs with the unalterable hardware baseline for boot signature validation; Physical Unclonable Function (PUF) pairs with deriving cryptographic keys from semiconductor manufacturing variations; Bus Encryption Engine pairs with encrypting data traversing physical PCB traces; Hardware Security Module (HSM) pairs with offloading and managing enterprise cryptographic keys within tamper-evident hardware enclosures.
The correct pairings directly correspond to each technology's foundational architectural design: Hardware Root of Trust (eFuse) provides an unchangeable anchor for boot chain verification; Physical Unclonable Function (PUF) derives keys from physical silicon variances; Bus Encryption Engine protects data in transit over physical board traces; and Hardware Security Module (HSM) manages high-volume enterprise cryptographic keys in dedicated tamper-resistant enclosures.

Step-by-Step Solution

1
Analyze the role of immutable hardware primitives in secure system startup.
Link Hardware Root of Trust (RoT) and eFuses to the permanent, write-once validation mechanism for initial boot signatures.
Software integrity must be rooted in unmodifiable hardware primitives to prevent low-level firmware tampering.
2
Evaluate key generation mechanisms that avoid static key storage on embedded chips.
Associate Physical Unclonable Functions (PUFs) with generating keys directly from silicon physical variations upon device power-up.
Static flash storage of cryptographic keys exposes system secrets to physical reverse engineering, whereas PUFs dynamically reconstruct keys.
3
Identify protection controls designed for physical system interconnects and memory buses.
Connect Bus Encryption Engines to real-time encryption of physical trace data paths between CPU and RAM.
Physical attacks like memory bus sniffing or logic analyzer probing target plaintext data passing across hardware interconnects.
4
Differentiate endpoint hardware security primitives from centralized infrastructure appliances.
Match Hardware Security Modules (HSMs) to centralized enterprise key lifecycle protection and dedicated cryptographic processing.
HSMs function as enterprise-grade hardware appliances engineered specifically for robust key lifecycle management and high-volume operations.

Key Concept

Hardware primitives, embedded system hardening, and cryptographic boundary protection
Question 148Question

Match each threat intelligence source type to its primary operational use case or intelligence characteristic in an enterprise security framework.

Click a left item, then click its matching right item

Items

Open-Source Intelligence (OSINT)
Information Sharing and Analysis Center (ISAC)
Dark Web Threat Intelligence
Commercial/Proprietary Threat Feed

Matches

Show answer & explanation

Answer

Open-Source Intelligence (OSINT) matches publicly accessible research repositories; ISAC matches sector-specific peer sharing networks; Dark Web Intelligence matches monitoring of hidden services for credential exposures; Commercial feeds match vendor-managed paid tactical indicator streams.
Each threat intelligence source type is accurately mapped to its primary delivery model and operational scope: OSINT uses public data, ISACs facilitate sector-specific peer collaboration, Dark Web intelligence monitors illicit underground communities, and Commercial feeds provide paid, automated tactical data streams.

Step-by-Step Solution

1
Analyze Open-Source Intelligence (OSINT)
Identified as freely available public data, matching open telemetry and code repositories.
OSINT encompasses all publicly available sources requiring no proprietary access.
2
Analyze Information Sharing and Analysis Centers (ISACs)
Identified as sector-specific peer sharing organizations.
ISACs focus on industry-wide collaborative threat intelligence.
3
Analyze Dark Web Threat Intelligence
Identified as intelligence gathered from hidden services and illicit market sites.
Dark web monitoring targets underground forums and leaked data.
4
Analyze Commercial/Proprietary Feeds
Identified as vendor-supplied, paid feeds with high confidence for automated ingestion.
Commercial feeds provide actionable, structured indicators backed by service contracts.

Key Concept

Classification and Operational Applications of Threat Intelligence Sources
Question 149Question

A security administrator is documenting high-availability and business continuity metrics for an organization's core infrastructure. Match each availability metric on the left with its corresponding description on the right.

Click a left item, then click its matching right item

Items

Recovery Time Objective (RTO)
Recovery Point Objective (RPO)
Mean Time Between Failures (MTBF)
Mean Time to Repair (MTTR)

Matches

Show answer & explanation

Answer

Recovery Time Objective (RTO) matches the maximum targeted duration to restore a system; Recovery Point Objective (RPO) matches the maximum acceptable amount of data loss measured in time; Mean Time Between Failures (MTBF) matches the average expected operational time between breakdowns; Mean Time to Repair (MTTR) matches the average duration required to troubleshoot and repair a failed component.
Recovery Time Objective (RTO) represents the target time to bring systems back online. Recovery Point Objective (RPO) defines maximum tolerated data loss measured in time. Mean Time Between Failures (MTBF) measures system component reliability and expected operational runtime between crashes. Mean Time to Repair (MTTR) quantifies the average duration needed to repair and restore a failed item.

Step-by-Step Solution

1
Identify metrics measuring service recovery speed and acceptable data loss.
RTO focuses on duration until service availability is restored, while RPO focuses on acceptable data loss window.
Differentiating time-to-restore (RTO) from data loss tolerance (RPO) is essential for disaster recovery planning.
2
Identify metrics measuring hardware/system reliability and repair time.
MTBF measures expected operational uptime between failures, while MTTR measures the duration required to fix a failure.
Understanding hardware reliability metrics helps establish realistic availability baselines and SLA expectations.

Key Concept

Business Impact and High Availability Metrics
Estimated Time:1m 0s
Question 150Question

An enterprise security architecture team is evaluating cloud deployment and service models for a multi-cloud initiative. Match each operational requirement on the left with the most appropriate cloud architecture or service model on the right.

Click a left item, then click its matching right item

Items

Deploying a highly customized legacy database requiring direct control over hypervisor settings, hardware isolation, and dedicated host resources.
Developing customer-facing web services where the cloud provider maintains the underlying runtime, operating system patching, and web server framework.
Executing transient, event-driven payment processing code that scales automatically without maintaining active server instances.
Sharing a specialized regional threat intelligence pool co-hosted and governed by several partner financial institutions under common regulatory compliance standards.

Matches

Show answer & explanation

Answer

1. Custom legacy database requiring physical host isolation -> Private Cloud (IaaS); 2. Web services with provider-managed runtime and OS patching -> Platform as a Service (PaaS); 3. Transient event-driven code execution -> Serverless (FaaS); 4. Co-hosted platform shared by partner financial institutions -> Community Cloud.
Matching each requirement accurately aligns business demands with cloud service abstraction boundaries. Private Cloud (IaaS) provides dedicated hardware control; PaaS offloads OS/runtime maintenance while hosting persistent apps; Serverless (FaaS) executes code transiently without server management; and Community Cloud serves multi-organizational groups sharing specific compliance and functional goals.

Step-by-Step Solution

1
Analyze the hardware and control requirements for the database scenario.
Identified direct hardware control, hypervisor management, and physical isolation as characteristics of Private Cloud (IaaS).
IaaS provides maximum architectural control to the organization, while private deployment guarantees dedicated isolation.
2
Evaluate the management boundary for web services with managed runtime and OS patching.
Identified abstraction of OS and runtime environment as characteristics of PaaS.
Under PaaS, the provider handles infrastructure maintenance and middleware, leaving application code to the consumer.
3
Examine the operational mechanics of transient event-triggered microservices.
Matched zero-server management and event execution to Serverless (FaaS).
FaaS abstracts server instances completely, executing logic on demand in response to events.
4
Determine the cloud deployment model for joint industry collaboration under common compliance standards.
Matched shared infrastructure between partner institutions to Community Cloud.
Community clouds are designed for multi-tenant access restricted to organizations bound by shared mission goals or compliance standards.

Key Concept

Cloud Deployment Models and Shared Responsibility Boundaries
Question 151Question

A senior security architect is auditing an enterprise data center infrastructure to eliminate single points of failure (SPOFs) and ensure compliance with strict uptime service level agreements (SLAs). Match each hardware or operational redundancy mechanism to its corresponding technical implementation objective.

Click a left item, then click its matching right item

Items

Multipathing (MPIO)
Dual Power Supplies with Independent PDU Feeds
NIC Teaming (802.3ad LACP)
Asynchronous Multi-Site Storage Replication

Matches

Show answer & explanation

Answer

Multipathing (MPIO) matches maintaining redundant block-level I/O paths between host HBAs and SAN storage; Dual Power Supplies with Independent PDU Feeds matches mitigating electrical breaker trips and rack-level PDU disruptions; NIC Teaming (802.3ad LACP) matches aggregating physical Ethernet interfaces for Layer 2 failover; Asynchronous Multi-Site Storage Replication matches regional disaster protection over WAN links with non-zero RPO.
Each architectural control fulfills a distinct redundancy layer (storage I/O, electrical infrastructure, network interface aggregation, or disaster recovery site replication) without overlapping scope.

Step-by-Step Solution

1
Analyze storage path redundancy requirements.
Multipathing (MPIO) provides host-to-SAN fault tolerance across redundant controllers and Fibre Channel/iSCSI paths.
MPIO operates at the block storage driver layer rather than standard network link aggregation.
2
Evaluate electrical fault tolerance controls.
Dual power supplies plugged into separate PDUs isolate electrical component failures.
Decoupling electrical circuits guarantees continuous host operation if a circuit or PDU encounters a fault.
3
Examine network link-layer resilience mechanisms.
NIC Teaming (802.3ad LACP) binds interface cards for switch port failover and link load distribution.
LACP aggregates physical Ethernet links to eliminate single cable or port failures.
4
Determine geographic site replication parameters.
Asynchronous replication allows multi-site protection across long distances without application latency degradation.
Because network latency over WAN prohibits zero-RPO synchronous commits, asynchronous transfer allows local writes to complete immediately.

Key Concept

Infrastructure Resilience and Redundancy Controls
Question 152Question

An enterprise security architecture assessment identified several technical flaws across the organization's cryptographic implementations and control configurations. Match each cryptographic or security control weakness on the left to its corresponding security impact on the right.

Click a left item, then click its matching right item

Items

Static RSA key exchange without ephemeral key parameters
Hardcoded symmetric encryption keys embedded in client application binaries
Disabled Certificate Revocation List (CRL) and OCSP validation on client endpoints
Cipher Block Chaining (CBC) mode initialized with predictable Initialization Vectors

Matches

Show answer & explanation

Answer

Static RSA key exchange matches retroactive decryption of past session traffic due to lack of Perfect Forward Secrecy; hardcoded symmetric keys match binary reverse engineering leading to global key exposure; disabled revocation checking matches acceptance of revoked certificates during man-in-the-middle attacks; predictable CBC IVs match susceptibility to block pattern analysis and chosen-ciphertext attacks.
Each identified weakness maps directly to its technical vulnerability: static RSA key exchange lacks forward secrecy resulting in retroactive traffic decryption; hardcoded client secrets permit reverse engineering and key extraction; bypassing CRL/OCSP validation forces endpoints to trust revoked certificates during interception attacks; and predictable IVs in CBC mode break cipher non-determinism, exposing sessions to chosen-ciphertext analysis.

Step-by-Step Solution

1
Analyze the impact of static RSA key exchange.
Determined that without ephemeral key negotiation (such as DHE or ECDHE), session keys depend directly on the server's private key, failing to provide Perfect Forward Secrecy (PFS).
This structural flaw enables adversaries who capture and archive encrypted session traffic to decrypt all past communications if the private key is later compromised.
2
Evaluate the security risk of hardcoded secret keys in client binaries.
Recognized that software binaries distributed to end-user devices can be decompiled.
Hardcoded keys can be extracted via static binary analysis, compromising confidentiality across every instance of the software.
3
Examine the consequence of disabling certificate revocation checks.
Identified that client software bypasses CRL and OCSP verification steps during TLS handshakes.
Without revocation verification, clients trust compromised certificates that have been explicitly revoked by the issuing Certificate Authority.
4
Assess the cryptographic vulnerability of predictable IVs in Cipher Block Chaining mode.
Understood that CBC mode requires unpredictable, random IVs to ensure ciphertext randomized outputs.
Predictable IVs allow adversaries to craft matching plaintext guesses and observe cipher outputs, leading to information disclosure via chosen-ciphertext side-channel attacks.

Key Concept

Cryptographic and Security Control Weaknesses
Question 153Question

Match each observed wireless or network attack technical indicator to its corresponding security threat classification.

Click a left item, then click its matching right item

Items

Packet capture logs displaying continuous transmission of IEEE 802.11 management frames with subtype 0x000C sent to client MAC addresses with spoofed access point source addresses.
Spectrum analyzer logs recording high-power broadband carrier noise across the 2.4 GHz ISM band causing a complete collapse in the signal-to-noise ratio (SNR).
System logs showing unsolicited Bluetooth L2CAP and Service Discovery Protocol (SDP) requests pushing unwanted text contact notes to nearby discoverable mobile devices.
Packet captures recording unauthorized ICMPv6 Type 134 messages broadcast from a unauthorized endpoint to dynamically reconfigure neighbor default routing paths.

Matches

Show answer & explanation

Answer

The observed technical indicators match as follows: 802.11 management frames (subtype 0x000C) match Deauthentication Attack; broadband high-power noise matches RF Jamming Attack; unsolicited Bluetooth text messages match Bluejacking Attack; unauthorized ICMPv6 Type 134 broadcasts match Rogue IPv6 Router Advertisement Attack.
Each indicator directly corresponds to its characteristic protocol behavior: 802.11 subtype 0x000C identifies wireless deauthentication; RF spectrum noise indicates physical radio frequency jamming; unsolicited Bluetooth message delivery represents Bluejacking; and unauthorized ICMPv6 Type 134 frames represent a rogue IPv6 Router Advertisement attack.

Step-by-Step Solution

1
Analyze frame subtypes and protocol headers in wireless packet captures.
IEEE 802.11 subtype 0x000C specifically designates Deauthentication management frames designed to drop wireless client connections.
Identifying specific frame types isolates wireless denial-of-service vectors.
2
Evaluate RF spectrum metrics and signal noise metrics.
Continuous high-power noise overwhelming the signal-to-noise ratio indicates intentional intentional physical layer interference (RF Jamming).
Jamming impacts physical layer propagation rather than logical protocol exchanges.
3
Examine short-range wireless protocol traffic and payload types.
Unsolicited messaging via Bluetooth SDP/L2CAP characterizes Bluejacking (distinguished from Bluesnarfing, which steals data).
Bluejacking focuses on sending messages rather than exfiltrating stored data.
4
Inspect ICMPv6 packet types and network layer routing announcements.
ICMPv6 Type 134 corresponds to Router Advertisements (RA). Unauthorized RA messages alter host IPv6 gateway configurations.
IPv6 Stateless Address Autoconfiguration (SLAAC) relies on ICMPv6 Type 134, making rogue RAs a prominent network layer threat indicator.

Key Concept

Technical Indicators of Network and Wireless Attacks
Estimated Time:1m 30s
Question 154Question

A security architect is establishing physical and firmware-level hardening controls for an industrial IoT edge gateway deployed in physically accessible utility substations. Which option correctly matches each embedded hardware security control to its primary operational security role?

Click a left item, then click its matching right item

Items

Microcontroller Memory Protection Unit (MPU)
Immutable Mask ROM Bootloader
Tamper-Resistant Secure Element (SE)
Inline Bus Encryption Engine

Matches

Show answer & explanation

Answer

Microcontroller Memory Protection Unit (MPU) matches restricting task memory and peripheral access by privilege level; Immutable Mask ROM Bootloader matches serving as the unalterable Hardware Root of Trust for initial boot validation; Tamper-Resistant Secure Element (SE) matches providing hardened cryptographic storage resistant to physical/side-channel extraction; Inline Bus Encryption Engine matches protecting external memory interconnects against physical bus probing.
Each component is mapped to its core architectural security scope: the MPU isolates software privilege levels and memory space; the Immutable Mask ROM forms the immutable Root of Trust for booting; the Secure Element safeguards cryptographic keys against physical tamper; and the Inline Bus Encryption Engine secures physical hardware interconnects against logic analyzer capture.

Step-by-Step Solution

1
Analyze the hardware protection layer enforced at the microcontroller CPU execution level.
Identify that the Memory Protection Unit (MPU) isolates memory regions and peripherals based on task privilege levels.
MPUs define access permissions for specific memory segments to prevent non-privileged tasks from modifying core hardware configuration.
2
Identify the foundation of the boot signature verification chain.
Map the Immutable Mask ROM Bootloader to the initial Hardware Root of Trust.
Because mask ROM cannot be altered post-fabrication, it guarantees that the initial boot execution vector cannot be corrupted or bypassed.
3
Evaluate key storage mechanisms resilient against physical attack vectors.
Associate the Tamper-Resistant Secure Element (SE) with side-channel resistant cryptographic key operations.
Secure Elements incorporate active shields and power-glitch protection specifically to counter physical hardware extraction techniques.
4
Evaluate memory interconnect defenses for off-chip communication paths.
Match the Inline Bus Encryption Engine to protecting external memory buses against physical probing.
Unencrypted buses between system-on-chip controllers and external memory are vulnerable to logic analyzers; inline bus encryption encrypts data over these physical traces.

Key Concept

Hardware-based security mechanisms provide distinct operational guarantees across processing privilege isolation, boot sequence verification, key protection against physical attacks, and memory bus confidentiality.
Question 155Question

Match each storage security technology to its primary operational application within an enterprise architecture.

Click a left item, then click its matching right item

Items

Self-Encrypting Drive (SED)
Data Loss Prevention (DLP)
Hardware Security Module (HSM)
Tokenization

Matches

Show answer & explanation

Answer

The correct pairings match Self-Encrypting Drive (SED) to hardware-level disk encryption; Data Loss Prevention (DLP) to data monitoring and exfiltration prevention; Hardware Security Module (HSM) to key generation and secure key storage; and Tokenization to replacing sensitive data fields with non-sensitive placeholder values.
Each technology is correctly paired with its core operational capability. Self-Encrypting Drives deliver controller-based disk encryption, Data Loss Prevention mitigates unauthorized data exfiltration, Hardware Security Modules protect cryptographic keys and perform high-assurance crypto operations, and Tokenization substitutes sensitive data fields with non-sensitive tokens using a secure vault.

Step-by-Step Solution

1
Evaluate Self-Encrypting Drive (SED)
Identified as disk controller hardware-level bulk encryption.
SED operates transparently on disk controller hardware without requiring host CPU cycles.
2
Evaluate Data Loss Prevention (DLP)
Identified as a content monitoring and exfiltration enforcement system.
DLP inspects structured and unstructured data to detect and prevent unauthorized policy violations.
3
Evaluate Hardware Security Module (HSM)
Identified as a dedicated tamper-resistant cryptographic appliance.
HSMs store master keys and perform cryptoprocessing inside a secure physical boundary.
4
Evaluate Tokenization
Identified as a data substitution method using non-sensitive placeholders.
Tokenization maps sensitive database values to surrogate tokens via a database vault rather than mathematical encryption algorithms.

Key Concept

Data Protection and Storage Security Architecture Controls
Question 156Question

Match each security log entry snippet extracted from enterprise monitoring systems to the corresponding attack vector or security incident type it accurately represents.

Click a left item, then click its matching right item

Items

GET /products.php?id=12%20AND%201=CONVERT(int,(SELECT%20@@version)) HTTP/1.1 500 Internal Server Error
Jan 14 10:15:02 firewall kernel: DROP IN=eth0 OUT= SRC=192.168.1.50 DST=10.0.0.50 PROTO=TCP SPT=44500 DPT=21 FLAGS=SYN
Jan 14 10:15:02 firewall kernel: DROP IN=eth0 OUT= SRC=192.168.1.50 DST=10.0.0.50 PROTO=TCP SPT=44501 DPT=22 FLAGS=SYN
Jan 14 10:15:02 firewall kernel: DROP IN=eth0 OUT= SRC=192.168.1.50 DST=10.0.0.50 PROTO=TCP SPT=44502 DPT=23 FLAGS=SYN
EventID 4769: Service Name: MSSQLSvc/db01.corp:1433, Ticket Options: 0x40810000, Ticket Encryption Type: 0x17 (RC4-HMAC-MD5)
POST /avatar_upload.php HTTP/1.1 200 OK
Content-Type: multipart/form-data; boundary=----
Content-Disposition: form-data; name="file"; filename="shell.php.png"

<?php system($_GET['cmd']); ?>

Matches

Show answer & explanation

Answer

1. GET request with database CONVERT function syntax maps to Error-Based SQL Injection (SQLi).
2. Firewall drop logs showing rapid sequential destination port connection attempts map to Reconnaissance / Horizontal Port Scanning.
3. Windows Event ID 4769 requesting TGS tickets with RC4 encryption for SPNs maps to Kerberoasting Credential Theft.
4. Multipart POST request containing PHP command execution syntax inside image uploads maps to Unrestricted File Upload / Web Shell Deployment.
Each security log snippet exhibits unique protocol and event attributes: SQL execution syntax in HTTP GET parameters indicates Error-Based SQL Injection; sequential port probes in firewall logs indicate Horizontal Port Scanning; Windows Event ID 4769 with legacy RC4 encryption indicates Kerberoasting; and PHP command injection inside multipart uploads indicates Web Shell Deployment.

Step-by-Step Solution

1
Analyze the web request URL parameter containing SQL type conversion functions (`CONVERT`).
Identified as Error-Based SQL Injection.
Forcing database conversion errors forces backend SQL engines to output internal state data into application error pages.
2
Examine firewall drop events originating from a single source host probing sequential port numbers in sub-second intervals.
Identified as Horizontal Port Scanning.
Sequential attempts on standard service ports (FTP/21, SSH/22, Telnet/23) indicate active network reconnaissance.
3
Evaluate Active Directory Event ID 4769 requesting Kerberos service tickets for Service Principal Names (SPNs) using RC4-HMAC encryption.
Identified as Kerberoasting.
Requesting TGS tickets with legacy RC4 encryption enables threat actors to extract ticket hashes and crack service passwords offline.
4
Inspect the file upload POST payload containing raw PHP system call instructions within a disguised file extension.
Identified as Web Shell Deployment via Unrestricted File Upload.
Bypassing extension controls to write executable server scripts permits persistent remote administrative control.

Key Concept

SIEM Log Analysis and Threat Signature Pattern Matching
Question 157Question

A security architect is designing an enterprise deployment strategy incorporating both virtual machines and application containers. Match each architectural isolation mechanism on the left with its corresponding security function or boundary property on the right.

Click a left item, then click its matching right item

Items

Control Groups (cgroups)
Linux Namespaces
Type 1 Hypervisor
Secure Computing Mode (seccomp)

Matches

Show answer & explanation

Answer

Control Groups (cgroups) matches with hardware resource limiting; Linux Namespaces matches with resource visibility partitioning; Type 1 Hypervisor matches with direct bare-metal hardware abstraction; Secure Computing Mode (seccomp) matches with syscall filtering.
Control Groups (cgroups) enforce resource allocation limits; Linux Namespaces enforce logical visibility boundaries; Type 1 Hypervisors provide bare-metal hardware abstraction; and Secure Computing Mode (seccomp) restricts kernel system call access.

Step-by-Step Solution

1
Analyze container resource governance mechanisms.
Control Groups (cgroups) regulate compute, memory, and storage bandwidth limits per container process group.
cgroups prevent resource exhaustion and noisy neighbor issues.
2
Analyze container visibility isolation controls.
Linux Namespaces segment global system resources (process trees, network devices, filesystem mount points) into isolated process environments.
Namespaces ensure one container cannot see or interact directly with another container's processes or file mounts.
3
Evaluate hypervisor virtualization architectures.
A Type 1 hypervisor operates directly on raw host hardware, enforcing strong VM boundary separation at the virtual CPU and memory abstraction level.
Type 1 hypervisors eliminate host OS vulnerability exposure present in Type 2 virtualization.
4
Identify kernel surface attack reduction controls.
Seccomp restricts the system call interface exposed by the host kernel to running container processes.
Filtering unused or dangerous syscalls reduces container escape vulnerabilities.

Key Concept

Virtualization and Containerization Isolation Mechanisms
Question 158Question

An enterprise network security architect is updating the organization's network architecture to enhance isolation and access control. Match each network design or segmentation technique on the left with its corresponding enterprise implementation requirement on the right.

Click a left item, then click its matching right item

Items

Air Gap
Microsegmentation
Jump Box
Screened Subnet

Matches

Show answer & explanation

Answer

Air Gap pairs with physical separation from all networks; Microsegmentation pairs with software-defined lateral policy enforcement; Jump Box pairs with a secure, audited administrative access gateway; Screened Subnet pairs with isolating public-facing services between security boundaries.
The concepts correctly align with their standard technical definitions: Air Gaps mandate complete physical isolation; Microsegmentation restricts East-West lateral traffic at the workload level via software policies; Jump Boxes act as secure intermediate administrative access points; and Screened Subnets isolate public-facing assets between perimeter firewalls.

Step-by-Step Solution

1
Identify absolute isolation without network medium connectivity.
Air Gap corresponds to complete physical network disconnection.
Air-gapping ensures no data can cross network media electronically.
2
Determine granular lateral traffic controls in virtualized environments.
Microsegmentation corresponds to controlling East-West traffic between individual workloads.
Microsegmentation operates at fine granularity using software-defined security policies.
3
Locate administrative transit control requirements.
Jump Box corresponds to the intermediate secure gateway for administration.
Jump hosts centralize management authentication and session auditing.
4
Evaluate perimeter placement for externally exposed services.
Screened Subnet corresponds to placing public-facing services between security boundaries.
Screened subnets shield private internal resources from untrusted internet ingress.

Key Concept

Secure Network Segmentation Archetypes
Question 159Question

A security operations team is standardizing its threat intelligence collection and distribution architecture. Match each threat intelligence technology or source type on the left with its correct technical definition or exchange role on the right.

Click a left item, then click its matching right item

Items

TAXII (Trusted Automated eXchange of Intelligence Information)
STIX (Structured Threat Information Expression)
ISAC (Information Sharing and Analysis Center)
Commercial / Proprietary Threat Feed

Matches

Show answer & explanation

Answer

TAXII matches the HTTPS application-layer transport protocol. STIX matches the standardized language format for threat indicators. ISAC matches the sector-specific sharing organization. Commercial/Proprietary Feed matches the paid subscription service for curated threat data.
Each threat intelligence source or protocol performs a distinct operational role: TAXII is the transport protocol over HTTPS; STIX is the structured JSON/XML data representation language; ISAC is the sector-specific collaborative trust network; and Commercial/Proprietary feeds are subscription-based, vendor-curated intelligence services.

Step-by-Step Solution

1
Differentiate transport protocols from data formatting languages in threat intelligence automation.
Identified TAXII as the protocol for transmitting data and STIX as the language format describing threat data.
TAXII specifies how threat intelligence is communicated, whereas STIX specifies what is contained inside the payload.
2
Differentiate peer-to-peer industry sharing entities from vendor-supplied intelligence services.
Mapped ISAC to sector-specific peer sharing and Commercial Feeds to paid vendor subscriptions.
ISACs rely on member-driven information exchange within specific critical infrastructure sectors, while commercial feeds sell specialized proprietary intelligence collected by vendors.

Key Concept

Threat Intelligence Standards, Protocols, and Source Classifications
Question 160Question

A cybersecurity architect for a critical infrastructure energy provider is aligning enterprise security controls with foundational Zero Trust Architecture (ZTA) principles to protect operational technology (OT) and cloud control systems. Match each Zero Trust principle on the left with its corresponding operational security implementation on the right.

Click a left item, then click its matching right item

Items

Assume Breach
Explicit Verification
Microsegmentation
Least Privilege Access

Matches

Show answer & explanation

Answer

Assume Breach pairs with enforcing mTLS encryption and inspecting all internal and external network traffic as untrusted; Explicit Verification pairs with evaluating multi-factor identity, device health, and risk signals for every request; Microsegmentation pairs with establishing isolated perimeters around individual workloads to restrict lateral movement; Least Privilege Access pairs with granting just-in-time permissions limited strictly to minimum required operations.
Each Zero Trust principle correctly aligns with its core architectural intent: Assume Breach treats internal traffic as inherently untrusted; Explicit Verification dynamically checks identity and context for every request; Microsegmentation contains threat proliferation by isolating individual workloads; and Least Privilege Access limits temporal and operational privileges to the bare minimum.

Step-by-Step Solution

1
Analyze the principle of 'Assume Breach' within Zero Trust Architecture.
Identify that assuming breach means treating internal network zones as untrusted, necessitating pervasive encryption (mTLS) and telemetry monitoring across all internal flows.
Legacy perimeter security relies on trusted internal zones, whereas Zero Trust presumes internal network segments may already harbor compromised nodes.
2
Analyze the principle of 'Explicit Verification'.
Identify that explicit verification requires continuous, multi-attribute policy evaluation (identity, device posture, location, threat context) prior to authorizing access.
Explicit verification replaces single-point-in-time authentication with dynamic, context-aware validation for every transaction.
3
Analyze the architectural concept of 'Microsegmentation'.
Identify that microsegmentation isolates workload boundaries to restrict lateral movement across network segments.
Placing fine-grained ingress and egress policy enforcement points around workloads prevents compromise propagation.
4
Analyze the principle of 'Least Privilege Access'.
Identify that least privilege access limits permissions via just-in-time elevation and tight operational scoping.
Minimizing active permissions limits potential damage if credentials or accounts are intercepted.

Key Concept

Core Zero Trust Architecture Principles and Controls
Estimated Time:2m 0s
PreviousPage 8 / 19Next
All practice questions — CompTIA Security+ | Examkin