Examkin

All practice questions

173 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 141Question →

A security operations team is establishing a standardized patch management workflow to ensure system security while minimizing operational disruption across the enterprise. Place the steps of the enterprise patch management lifecycle in the correct procedural sequence from initial identification to post-implementation audit.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct procedural sequence for the patch management lifecycle is: (1) Analyze vulnerability intelligence feeds and prioritize missing vendor updates based on asset criticality; (2) Apply and evaluate the updates within a non-production staging environment to verify system stability and application compatibility; (3) Submit a formal change request to the Change Advisory Board (CAB) including deployment risk assessments and rollback plans; (4) Execute a phased rollout of the updates across production systems during authorized maintenance windows; and (5) Perform automated security baseline auditing and vulnerability scanning to confirm successful remediation and drift prevention.
The standard patch management lifecycle follows a structured progression: vulnerability identification and prioritization must occur first, followed by pre-deployment testing in staging to ensure stability. Once validated, formal approval from the Change Advisory Board (CAB) is sought with a documented rollback plan. Production deployment is then executed in a phased manner during scheduled maintenance windows, ending with post-patch auditing and baseline verification to confirm vulnerability remediation.

Step-by-Step Solution

1
Identify and prioritize patch requirements
Assets requiring updates are cataloged according to vulnerability severity and business impact.
Security operations must first assess incoming threats and asset inventory to prioritize remediation efforts effectively.
2
Conduct staging and compatibility testing
Updates are tested in an environment duplicating production configuration without risking live operations.
Pre-deployment testing identifies application dependencies, performance impacts, or instabilities caused by the patch.
3
Obtain Change Advisory Board approval
Change request is reviewed, scheduled, and authorized with explicit rollback procedures established.
Enterprise governance requires documented change authorization to minimize unannounced maintenance outages.
4
Deploy to production systems
Patches are distributed to live environments using staged, canary, or phased maintenance windows.
Phased execution limits blast radius and ensures controlled delivery across operational infrastructure.
5
Validate posture and configuration baselines
Vulnerability scans confirm patch application and ensure configuration baselines have not drifted.
Verification confirms patch success and prevents posture regression or configuration drift.

Key Concept

Enterprise Patch Management Lifecycle
Question 142Question →

A Security Operations Center (SOC) receives an automated alert generated by a Network Intrusion Prevention System (NIPS) detecting an remote code execution (RCE) payload targeted at an internal API server. In what chronological sequence should a security analyst perform the initial response actions from alert ingestion through recovery?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Initial NIPS detection and alert generation, 2) SIEM log correlation and alert verification, 3) Host isolation for network containment, 4) Deep PCAP and forensic artifact investigation, and 5) Vulnerability patching and system restoration.
In standard network security operations, alert handling follows a structured sequence: Detection (NIPS alert), Identification/Correlation (SIEM log verification), Containment (host isolation), Forensics/Analysis (PCAP and artifact review), and Eradication/Recovery (patching and system restoration).

Step-by-Step Solution

1
Identify the alert trigger
The NIPS flags suspicious inbound API traffic and generates a security event.
Security monitoring systems must first capture anomalies and alert security personnel.
2
Triage and correlate logs
SIEM correlation confirms a true positive event targeting an active API endpoint.
Analysts must validate alerts against contextual log data to rule out false positives.
3
Execute containment
The target API server is segmented/isolated from the corporate network.
Preventing lateral movement takes operational precedence over deep technical investigation.
4
Perform forensic investigation
PCAP analysis and host memory extraction reveal scope and indicators of compromise.
Forensic data capture determines whether payload execution was successful and what data was accessed.
5
Eradicate and restore
The application flaw is remediated and the host is restored safely to service.
Remediation prevents re-infection upon bringing systems back online.

Key Concept

Network Alert Triage and Incident Response Lifecycle
Question 143Question →

A Security Operations Center (SOC) analyst receives a high-priority alert from a Network Intrusion Detection System (NIDS) indicating suspicious outbound traffic from an internal enterprise workstation. Place the following analyst triage and incident response steps in the correct sequence, from initial alert evaluation to containment.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with inspecting the NIDS alert metadata in the SIEM, followed by querying NetFlow and PCAP telemetry records, cross-referencing destination indicators against threat intelligence feeds, and concluding with confirming the true positive alert and isolating the affected host.
Effective network security alert triage proceeds systematically from alert identification and SIEM evaluation, to telemetry deep-dive (NetFlow/PCAP analysis), threat intelligence enrichment, and finally root-cause confirmation leading to host containment.

Step-by-Step Solution

1
Review initial SIEM alert details
Identified source workstation, destination IP, and specific NIDS signature.
Initial alert validation establishes baseline context before performing deeper queries.
2
Analyze supporting network telemetry (NetFlow/PCAP)
Detailed flow volume, session frequency, and packet characteristics gathered.
Telemetry logs confirm whether network traffic matched actual transmission patterns or was a false alarm.
3
Perform threat intelligence lookup
Destination IP confirmed to be associated with known botnet infrastructure.
Enriching local traffic data with global threat intelligence verifies malicious indicator severity.
4
Execute host containment
Workstation isolated from the network segment.
Immediate containment halts potential data exfiltration and lateral movement across the enterprise.

Key Concept

Network Security Monitoring Triage Workflow
Question 144Question →

A security operations team is responding to a newly disclosed critical remote code execution vulnerability impacting enterprise database servers. To ensure operational stability while mitigating risk, what is the correct chronological sequence of steps the team should perform during this emergency patch deployment workflow?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with evaluating and testing the patch in a non-production staging environment, followed by submitting an emergency change request with a rollback plan to the Change Advisory Board (CAB). Once authorized, the patch is deployed to production database hosts during an approved window, and finally, credentialed scanning and baseline auditing are performed to confirm success.
The correct operational sequence follows structured patch and change management governance. Testing in a non-production environment occurs first to verify stability. Next, emergency CAB approval ensures stakeholder authorization and rollback readiness. The patch is then deployed to production, and post-deployment credentialed scanning verifies successful remediation without baseline drift.

Step-by-Step Solution

1
Stage and test the emergency patch in a non-production environment.
Identified potential application incompatibility and confirmed system stability before touching live systems.
Applying untested patches directly to production risks outage or service failure.
2
Obtain CAB approval with documented rollback procedures.
Emergency change request is authorized by stakeholders with an agreed contingency plan.
Change management policy mandates authorized approval and risk governance even during emergency windows.
3
Deploy the patch to production hosts during the maintenance window.
Vulnerability mitigation is applied across production target machines.
Execution must occur after validation and authorization within controlled timeframes.
4
Validate deployment via credentialed scanning and configuration baseline checks.
Confirmed successful vulnerability remediation and verified configuration compliance without drift.
Operational verification ensures the flaw is eliminated and no system settings were unintentionally altered.

Key Concept

Standard Emergency Patch Management Lifecycle and Governance Workflow
Estimated Time:1m 30s
Question 145Question →

A security operations team is preparing to remediate a newly disclosed critical vulnerability affecting enterprise application servers. In what order should the team execute the patch management lifecycle steps from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with testing the patch in a non-production staging environment, followed by submitting a formal change request to the Change Advisory Board, deploying the patch to production during the approved maintenance window, and concluding with post-deployment auditing and verification scanning.
Effective patch and configuration management follows a structured lifecycle: evaluating and testing patches in non-production environments first, securing formal approval from the Change Advisory Board, deploying updates during authorized windows, and performing post-implementation auditing to verify that vulnerability remediation was successful and configuration baselines remain intact.

Step-by-Step Solution

1
Test the patch in staging
Patch compatibility and roll-back steps are confirmed without risking production downtime.
Non-production testing validates stability and provides required evidence for formal change approval.
2
Obtain Change Advisory Board (CAB) approval
Formal authorization and scheduled maintenance windows are established.
Change governance prevents uncoordinated production updates and mitigates enterprise risk.
3
Deploy to production systems
The patch is applied across production application servers.
Execution must align strictly with approved maintenance schedules.
4
Audit and verify baseline compliance
Vulnerability scanning confirms patch installation and baseline integrity.
Post-deployment validation proves successful remediation and ensures system baselines remain secure.

Key Concept

Patch Management Lifecycle and Change Control Governance
Question 146Question →

A Security Operations Center (SOC) analyst receives a high-severity intrusion detection alert indicating an unusual volume of outbound DNS queries containing randomized long subdomains. Arrange the following security operations steps in the correct chronological sequence from initial alert triage to network-wide remediation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with analyzing packet captures and NSM logs to inspect the DNS payloads (Step 1), followed by correlating endpoint logs to confirm a true positive (Step 2), isolating the affected system to halt exfiltration (Step 3), and finally implementing DNS sinkhole and firewall blocks across the enterprise (Step 4).
The correct workflow follows standard network security operations methodology: initial traffic analysis (inspecting packet captures to determine payload indicators), true positive validation (correlating host process activity), targeted host containment (isolating the endpoint to stop data exfiltration), and broader organizational mitigation (updating firewall blocks and DNS sinkholes).

Step-by-Step Solution

1
Analyze network security monitoring logs and PCAP files.
Identified anomalous DNS TXT payload structures and target domain names.
Triage begins at the network level to understand the scope and signature of the alert.
2
Correlate network data with endpoint activity logs.
Confirmed an unauthorized executable generating DNS queries on a specific host.
Validation prevents taking destructive containment measures based on false positives.
3
Isolate the compromised system from the network segment.
Active DNS tunneling exfiltration session terminated.
Host containment prevents further exfiltration while preserving forensic evidence.
4
Apply perimeter firewall blocks and update DNS sinkhole configurations.
Blocked command-and-control and exfiltration domains organization-wide.
Mitigation controls ensure no other host on the network can communicate with the attacker infrastructure.

Key Concept

Network Security Monitoring Alert Triage and Incident Containment Lifecycle
Question 147Question →

An enterprise security policy requires software developers to digitally sign compiled binaries using a dedicated Hardware Security Module (HSM) USB token. Which of the following represents the correct sequential order of steps required to obtain and prepare the code signing certificate on the hardware token, from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with generating the asymmetric key pair on the HSM token, followed by generating the Certificate Signing Request (CSR), submitting the CSR to the Certificate Authority (CA) for signing, and finally importing the signed certificate onto the HSM token to bind it with the stored private key.
The standard PKI enrollment workflow follows a logical sequence. First, the asymmetric key pair must be generated directly on the target device (HSM) so the private key remains secure. Second, a CSR is built using the generated public key and subject metadata. Third, the CSR is submitted to the CA for verification and digital signature issuance. Finally, the resulting signed certificate is installed back onto the HSM to bind with the private key.

Step-by-Step Solution

1
Generate the asymmetric key pair inside the secure boundary of the HSM USB token.
A public key is exposed for request generation, while the private key is retained in non-exportable hardware storage.
For high-assurance security like code signing, private key generation must occur locally on the cryptoprocessor to prevent key exposure.
2
Construct a Certificate Signing Request (CSR) incorporating the public key and organizational subject attributes.
A standardized PKCS#10 CSR file is created.
The Certificate Authority requires a formal CSR containing the public key and identity data to construct the certificate.
3
Submit the CSR to the internal or commercial Certificate Authority (CA).
The CA validates the identity, signs the public key using its private key, and issues an X.509 certificate.
The CA serves as the trusted third party that validates the identity and digitally signs the certificate.
4
Import the issued X.509 certificate back into the HSM token container.
The certificate is bound to the matching private key stored on the hardware token.
Binding the signed public certificate with the private key on the HSM completes the PKI enrollment lifecycle and enables signing tools to operate.

Key Concept

Public Key Infrastructure (PKI) Certificate Signing Request (CSR) and Hardware-Based Key Lifecycle
Question 148Question →

A systems administrator needs to request and deploy a new SSL/TLS certificate for an enterprise web application using an internal Certificate Authority (CA). Arrange the steps of the certificate enrollment and deployment process in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence for certificate enrollment and deployment is: 1) Generate the public/private key pair locally on the web server, 2) Create the Certificate Signing Request (CSR), 3) Submit the CSR to the internal Certificate Authority, 4) The Certificate Authority signs the request and issues the X.509 certificate, and 5) Install the certificate and intermediate chain on the web server and bind it to port 443.
The PKI enrollment lifecycle follows a logical progression starting with local key generation to ensure private key protection. The public key is then packaged into a CSR containing subject parameters and sent to a CA. The CA validates the identity, signs the request using its private key, and returns an X.509 certificate. Finally, the certificate and intermediate trust chain are installed and bound to the server's web service.

Step-by-Step Solution

1
Generate asymmetric keys locally on the endpoint host
The private key stays securely on the server while the public key is made available for certification.
Generating keys locally prevents private key exposure during transmission across network channels.
2
Build the Certificate Signing Request (CSR)
A CSR file is generated containing the public key and server identification details.
The CSR serves as the standardized input needed by a CA to construct a signed public key certificate.
3
Transmit the CSR to the Certificate Authority
The CA receives the CSR and verifies domain control and identity credentials.
The CA requires formal submission of the request before performing verification checks.
4
CA signs and issues the X.509 certificate
A signed X.509 digital certificate is created using the CA's private key.
Digital signing creates a trusted relationship between the server's public key and the CA's root of trust.
5
Import certificate and bind to web service
The web server presents the valid certificate during TLS client negotiation.
Binding the certificate to port 443 completes deployment, allowing browsers to establish trust.

Key Concept

PKI Certificate Request, Issuance, and Deployment Lifecycle
Question 149Question →

A security analyst receives a high-severity alert from an inline Network Intrusion Prevention System (NIPS) indicating potential encrypted command-and-control (C2) beaconing originating from an internal endpoint to an untrusted external IP address. In what sequence should the analyst execute the network security monitoring and initial containment workflow?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct response workflow begins with alert correlation in the SIEM, followed by isolating the endpoint, querying NetFlow and packet captures to quantify damage, implementing perimeter blocks, and finally conducting host forensic remediation.
The workflow follows standard incident response procedures: validation (verifying SIEM/NIPS alert), containment (host network isolation), investigation/scoping (NetFlow/PCAP analysis), enterprise protection (perimeter block/sinkholing), and eradication/remediation (host forensics).

Step-by-Step Solution

1
Validate the NIPS alert against SIEM log aggregations.
Confirms the alert is a true positive C2 beaconing attempt.
Prevents unnecessary containment procedures caused by false-positive alerts.
2
Isolate the compromised internal endpoint from the network.
Halts active C2 communication and blocks lateral movement within the network.
Immediate containment is required once a true positive C2 connection is confirmed.
3
Inspect historic NetFlow records and PCAP data.
Establishes a timeline of network activity and measures exfiltration metrics.
Deep monitoring telemetry analysis reveals the extent of compromised data.
4
Deploy perimeter block rules and DNS sinkholes for the malicious external indicators.
Protects the broader organization from connecting to the C2 infrastructure.
Defends remaining assets while investigation continues.
5
Execute detailed host-based forensic analysis and malware remediation.
Removes the root cause process and restores the system to a clean state.
Ensures complete eradication of the threat before returning the asset to service.

Key Concept

Incident Response Triage and Containment Workflow in Network Security Monitoring
Question 150Question →

An enterprise security administrator is formalizing an operational workflow to handle human risk incidents, progressing from initial end-user detection of a spear-phishing attempt to enterprise-wide awareness training improvements. Place the following procedural steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct procedural order is: 1) End user reports suspicious email; 2) SOC triages and performs technical containment; 3) Security awareness team analyzes human risk trends; 4) Targeted micro-learning modules are deployed; 5) Program metrics are escalated to governance committees for policy updates.
The procedural sequence follows a logical lifecycle starting with end-user identification and reporting, followed by technical SOC incident triage and containment. Once the threat is remediated, the human risk program analyzes targeted vulnerabilities, deploys micro-learning tailored to those vectors, and finally aggregates reporting metrics for executive governance and security awareness policy escalation.

Step-by-Step Solution

1
Identify user detection and initial reporting
The employee notices anomaly indicators and uses official reporting mechanisms.
Human risk mitigation begins with employee awareness and rapid reporting actions.
2
Perform incident response containment
The SOC verifies the attack vector and purges malicious messages enterprise-wide.
Immediate technical response prevents wider enterprise compromise.
3
Evaluate human risk metrics and training gaps
The security awareness team identifies vulnerable departments and attack technique exposure.
Analyzing incident data enables tailored awareness program adjustments rather than generic messaging.
4
Deliver targeted education and micro-simulations
Affected personnel undergo targeted remediation and simulated phishing exercises.
Specific behavioral remediation addresses demonstrated vulnerability.
5
Escalate program metrics to executive governance
Awareness training key performance indicators (KPIs) drive policy updates.
Security program oversight requires reporting effectiveness trends to leadership to justify policy adjustments.

Key Concept

Incident-driven Human Risk Management Lifecycle
Question 151Question →

A Security Operations Center (SOC) analyst receives a high-priority alert from a Network Intrusion Detection System (NIDS) indicating anomalous outbound TCP traffic on port 443 with a mismatched Server Name Indication (SNI) header. In what order should the analyst execute the following triage and response steps to effectively investigate and mitigate the network threat?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with examining the initial NIDS alert metadata, querying NetFlow data to measure session impact, correlating network events with host endpoint logs, and ending with executing containment and network block rules.
The analyst must follow standard network security monitoring procedure: start by reviewing NIDS metadata for baseline context, examine NetFlow records for session metrics, cross-reference endpoint logs to determine the initiating process, and finally enforce containment once malicious activity is confirmed.

Step-by-Step Solution

1
Analyze NIDS alert metadata
Identified source internal host IP and remote destination IP address
Initial triage requires verifying basic alert properties before conducting deeper analysis.
2
Evaluate NetFlow telemetry
Quantified session duration and total byte counts sent over the network
Flow statistics help assess potential impact and determine if large data transfers occurred.
3
Correlate with host endpoint logs
Identified the specific process and user account creating the socket connection
Linking network alerts to endpoint activity isolates the root cause software or script.
4
Execute containment and mitigation controls
Blocked outbound connection attempt and isolated compromised system
Active containment is performed after identifying and verifying the threat vector to prevent further damage.

Key Concept

Network Security Monitoring Triage Workflow
Estimated Time:1m 30s
Question 152Question →

An enterprise security administrator is formalizing a human risk management initiative to reduce departmental vulnerability to targeted social engineering attacks. In what order should the administrator execute the stages of this security awareness lifecycle from start to finish?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with conducting a baseline human risk assessment, followed by developing tailored role-based training modules, delivering the targeted training to key personnel, executing unannounced simulations to measure behavioral changes, and concluding with reporting risk reduction metrics to leadership to refine governance policy.
The correct sequence follows the standard security program lifecycle: first assess baseline risks to identify vulnerable roles, second develop tailored role-based learning content, third deliver training to targeted personnel, fourth evaluate behavioral change using unannounced simulations, and fifth present outcome metrics to leadership to update overall program governance.

Step-by-Step Solution

1
Conduct a baseline risk assessment across departments.
Identifies specific threat vectors and vulnerable job roles.
Security awareness programs must be data-driven and targeted toward actual risk profiles.
2
Develop role-based microlearning modules.
Creates targeted educational content tailored to specific job responsibilities.
Tailored training addresses unique attack surfaces more effectively than generic, one-size-fits-all awareness modules.
3
Roll out training and monitor completion metrics.
Ensures targeted personnel acquire necessary threat identification skills.
Formal training must precede practical evaluation so employees know how to recognize and report threats.
4
Launch unannounced simulated attack scenarios.
Gathers empirical data on click-through rates and threat reporting performance.
Simulations test whether educational concepts successfully translate into practical behavioral defense in real-world scenarios.
5
Aggregate metrics for executive reporting and policy refinement.
Demonstrates program effectiveness and informs ongoing security governance updates.
Continuous security program management requires leadership visibility and continuous policy alignment based on measured metrics.

Key Concept

Role-Based Security Awareness Program Lifecycle
Question 153Question →

Place the following steps of a phishing reporting and human risk management workflow in the correct chronological order, from initial end-user detection to awareness program refinement.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct workflow begins with user detection and reporting, followed by automated quarantine triage, technical analyst verification and gateway filter updating, recording user reporting telemetry, and deploying targeted role-based microlearning.
The correct sequence reflects the operational lifecycle of human threat reporting: initial user reporting, automated quarantine triage, SOC verification and technical containment, human risk telemetry logging, and adaptive role-based microlearning deployment.

Step-by-Step Solution

1
Identify the initial reporting trigger.
The process starts when an employee recognizes suspicious email indicators and reports the email via the reporting plugin.
Human risk workflows originate with active employee identification and reporting of social engineering attempts.
2
Determine the immediate technical triage action.
Automated security systems quarantine the message and alert security operations.
Immediate technical isolation prevents secondary execution while escalating to analysts.
3
Identify the threat containment phase.
Security analysts validate the threat and update secure email gateway blocklists with new indicators.
Verification is required to ensure accurate threat classification before modifying technical perimeter defenses.
4
Determine the human risk metric logging step.
The reporting event is updated in the human risk management telemetry dashboard.
Tracking real-world reporting behaviors measures the actual effectiveness of awareness programs beyond passive compliance.
5
Identify the adaptive educational output.
Role-specific microlearning modules are dispatched to exposed user groups.
Closing the feedback loop ensures training evolves to address specific vulnerabilities revealed during live attacks.

Key Concept

Phishing Incident Reporting and Human Risk Telemetry Workflow
Question 154Question →

An enterprise security team needs to remediate a critical zero-day vulnerability in a high-throughput API gateway fleet supporting real-time financial transactions. To ensure system stability and regulatory compliance, the team must execute a structured patch and configuration management workflow. In what sequence should the security team perform the following operational steps from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps is: 1) Validate patch installation and vulnerability remediation efficacy in an isolated sandbox lab environment, 2) Deploy the patch to a production-mirror staging environment to perform automated regression testing and baseline drift checks, 3) Submit the staging test metrics, security assessment results, and back-out rollback strategy to the Change Advisory Board for formal deployment authorization, 4) Execute a phased canary deployment across a limited percentage of production API gateway nodes while monitoring performance indicators, and 5) Update and digitally sign the authoritative version-controlled configuration baseline repository to reflect the patched system state.
A complete patch and configuration management lifecycle follows a strict progression designed to mitigate operational risk and maintain compliance. First, patches must be validated in an isolated sandbox to confirm vulnerability remediation. Second, the patch must undergo integration and regression testing in a staging environment to detect performance or configuration issues under realistic load. Third, test artifacts and rollback strategies are submitted to the Change Advisory Board for governance review and formal deployment approval. Fourth, a canary deployment is conducted in production to minimize blast radius while verifying telemetry. Finally, once the deployment is verified successful across all nodes, the golden configuration baseline is updated and signed to establish the new authoritative benchmark.

Step-by-Step Solution

1
Isolated Validation
Patch efficacy and basic functionality are confirmed without exposing enterprise systems to risk.
Initial testing must occur in a contained environment to verify that the vendor fix actually mitigates the vulnerability.
2
Staging and Integration Testing
Interoperability with surrounding API services and absence of baseline configuration drift are verified.
Testing in a production-identical staging environment catches unexpected dependency breakages prior to operational change review.
3
Change Governance Review
Formal authorization is granted by the Change Advisory Board based on risk assessment and rollback readiness.
Enterprise security frameworks require Change Advisory Board review and signed-off back-out procedures before live system modification.
4
Controlled Production Rollout
The patch is deployed incrementally with minimal blast radius should unexpected runtime failures occur.
Phased canary deployments allow continuous telemetry monitoring so engineers can instantly trigger a rollback if anomaly thresholds are breached.
5
Baseline Artifact Update
The version-controlled infrastructure baseline is updated and signed to define the new compliance target.
Configuration management tools rely on updated authoritative baselines to prevent false-positive drift alerts and enable consistent automated provisioning.

Key Concept

Enterprise Patch and Configuration Management Lifecycle
Question 155Question →

A security engineer is documenting the automated failover process for an active-passive cluster of perimeter firewalls. When the primary node experiences an unrecoverable hardware failure, specific high-availability failover events must occur. Place the following operational steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order is: 1) The standby firewall node detects consecutive missed heartbeat signals from the primary firewall node, 2) The standby firewall node transitions its internal cluster state from passive to active, 3) The newly active node broadcasts Gratuitous ARP (GARP) requests across the local network segment, and 4) The newly active node begins receiving, inspecting, and forwarding stateful network traffic.
In high-availability active-passive clustering, failover begins when the passive node notices consecutive missing heartbeats from the primary. The passive node promotes itself to active status, then broadcasts Gratuitous ARP (GARP) packets to update surrounding switch MAC address tables with its interface details for the virtual IP, and finally starts processing network traffic.

Step-by-Step Solution

1
Identify the initial failover trigger in an active-passive cluster.
The failure detection phase is triggered when heartbeat health checks fail.
The passive node cannot take action until it detects that the primary node is unreachable.
2
Determine the operational state transition of the surviving node.
The passive node promotes itself to the active state.
Role promotion is required before the standby hardware can assume cluster ownership.
3
Identify how network traffic is redirected to the new hardware instance.
The newly active node issues Gratuitous ARP (GARP) broadcasts.
GARP updates neighbor switch forwarding tables so traffic addressed to the virtual IP maps to the new node's physical MAC address.
4
Determine when stateful security enforcement resumes.
Active session processing and packet filtering resume on the new active node.
Traffic flow can only resume after surrounding network infrastructure switches learn the updated Layer 2 destination path.

Key Concept

Active-Passive Cluster Failover Sequence
Question 156Question →

A Security Operations Center (SOC) analyst receives a high-severity Network Intrusion Prevention System (NIPS) alert indicating potential unauthorized data exfiltration from a core database host to an external IP address. Place the incident response steps in the correct operational sequence, starting from initial alert validation through threat intelligence integration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with validating the alert using NetFlow and NIPS payload data, followed by SIEM log correlation for host context, executing network isolation to halt exfiltration, conducting PCAP forensic analysis to extract IOCs, and updating enterprise monitoring signatures and blocklists.
In standard network security incident operations, analysts must first validate the NIPS alert with NetFlow data to confirm true positive status. Next, SIEM correlation provides necessary endpoint and host context. Once verified, network containment (VLAN isolation) must be implemented immediately to halt data loss. After containment, PCAP analysis extracts specific C2 indicators, which are finally ingested into NIDS/NIPS signatures and perimeter blocklists to protect the broader network.

Step-by-Step Solution

1
Analyze NIPS alert payload and NetFlow traffic statistics.
Validation of the network anomaly as a true positive event.
Alert validation prevents misallocating response resources to false positives.
2
Query SIEM for host authentication and endpoint telemetry.
Identification of compromised accounts or malicious processes on the source host.
Establishes host-level context and potential root cause following traffic verification.
3
Enforce dynamic VLAN isolation on the network infrastructure.
Immediate containment of data exfiltration and restriction of lateral movement.
Containment takes immediate priority over detailed forensics once a threat is confirmed.
4
Analyze full packet capture (PCAP) files collected during the event window.
Extraction of actionable C2 domains, IP addresses, and payload hashes.
Forensic investigation can be performed safely after the active threat pathway is severed.
5
Incorporate newly discovered IOCs into NIDS/NIPS detection rules and blocklists.
Enhanced detection coverage against the adversary's infrastructure across the organization.
Ensures long-term resilience and real-time alerting for similar threat vectors.

Key Concept

Network Incident Response Lifecycle & Monitoring Workflow
Question 157Question →

An enterprise security platform detects an exposed cloud service API key in a public code repository. Arrange the steps of an automated Security Orchestration, Automation, and Response (SOAR) playbook into the correct operational sequence from initial alert detection to incident ticket resolution.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence for the SOAR playbook is: (1) Ingest and parse the alert payload received via webhook from the secret detection scanner, (2) Query cloud IAM and SIEM logs to enrich the alert with identity context, key permissions, and active usage logs, (3) Execute automated API calls to revoke the leaked API key and terminate associated active session tokens, (4) Query cloud audit logs to extract all API actions initiated by the key prior to revocation and attach them to the case file, and (5) Generate a high-priority ticket in the ITSM platform and notify the Security Operations Center team with summary metrics.
A standard automated SOAR playbook follows a precise operational lifecycle: (1) Incident ingestion & parsing, (2) Contextual enrichment via integrations, (3) Rapid automated containment, (4) Forensic artifact collection, and (5) Incident documentation & analyst notification.

Step-by-Step Solution

1
Ingest and parse incoming webhook trigger.
The SOAR tool validates the alert payload content and starts playbook execution.
Automation requires a parsed payload to extract key parameters like API key ID and repository source.
2
Perform contextual enrichment using API integrations.
Identity, permission scope, and recent activity logs are gathered.
SOAR playbooks perform enrichment prior to taking action to evaluate impact and avoid disabling critical production systems blindly.
3
Perform automated containment via API integration.
Compromised credentials are neutralized immediately.
Fast automated mitigation reduces attacker dwell time and prevents lateral movement or data exfiltration.
4
Collect and attach forensic audit logs.
Historical event logs associated with the key are attached to the incident record.
Preserving audit trails immediately after containment ensures evidence integrity for secondary investigation.
5
Create an ITSM ticket and dispatch notifications.
An incident ticket is logged and human analysts are briefed on the automated actions taken.
Concluding with administrative logging and analyst notification completes the workflow and satisfies compliance tracking.

Key Concept

SOAR Incident Response Workflow Sequence
Question 158Question →

An organization is refining its human risk management and incident feedback lifecycle following a targeted social engineering campaign. Which of the following represents the correct chronological order of the operational and programmatic steps, from initial end-user discovery through security awareness curriculum escalation?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence is: 1) End-user detects and reports the suspicious email via reporting tool; 2) SOC triages the submission to confirm an active campaign; 3) Incident Response executes technical containment; 4) Human Risk Management evaluates metrics to identify vulnerable user cohorts; 5) Security Awareness lead updates training curriculum and launches targeted simulations.
The sequence reflects the standard operational and administrative lifecycle for human risk mitigation. The workflow starts when an end-user identifies and reports a suspicious message. Next, the SOC triages the report to confirm a malicious campaign. Once confirmed, the Incident Response team performs technical containment (e.g., revoking compromised sessions and blocklisting malicious domains). After technical risks are mitigated, Human Risk Management analyzes metrics such as reporting latency to identify vulnerable employee groups. Finally, Security Awareness updates training materials and deploys targeted simulations mirroring the attack vector to prevent future susceptibility.

Step-by-Step Solution

1
Identify the initial reporting trigger
The user observes suspicious indicators and submits the email.
Human risk management relies on end-user detection as the initial sensor in social engineering detection.
2
Perform SOC threat triage
Security analysts analyze indicators of compromise (IOCs) and confirm a live attack.
Verification distinguishes benign false positives from actionable security incidents.
3
Enforce technical containment
Active sessions are terminated and domains are blocklisted.
Immediate containment stops threat spread and limits blast radius before administrative policy review.
4
Analyze human risk metrics
Reporting rates, reporting speed, and failure rates are quantified across roles.
Evaluating behavioral data highlights specific operational roles that require focused remediation.
5
Update training and simulation programs
Curriculum modules are modified and real-world simulations are deployed.
Closing the feedback loop ensures long-term awareness programs adapt to emerging threat tactics.

Key Concept

Integration of end-user incident reporting, human risk metrics, and iterative security awareness program updates.
Question 159Question →

An enterprise is formalizing its end-to-end human risk management and incident feedback workflow following a social engineering attempt. Place the following procedural steps in the correct chronological order from initial end-user detection to long-term security awareness program optimization.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence is: 1) End-user detection and submission via reporting tool -> 2) Automated security triage and payload verification -> 3) Enterprise mailbox purging and technical containment -> 4) Development of targeted micro-learning based on attack tactics -> 5) Recalibration of human risk scores and future simulation parameters.
The correct sequence begins with user detection and reporting. Next, automated technical triage validates the malicious payload, followed by immediate enterprise containment (purging the emails). Once the active threat is contained, post-incident data is fed into the awareness program to create targeted micro-learning, and finally, organizational risk profiles and simulation parameters are recalibrated.

Step-by-Step Solution

1
Identify the initial trigger event in the human risk lifecycle.
User reporting of suspicious email via automated add-in.
Human risk mitigation begins with employee awareness and immediate reporting behavior.
2
Determine the immediate technical validation step.
Automated triage and header/payload inspection.
SOC tools must confirm the threat level before taking active containment steps.
3
Identify the active containment and mitigation phase.
Purging malicious emails enterprise-wide.
Preventing exposure to other users is essential to limit organizational risk.
4
Determine the feedback mechanism for security training.
Creating role-based micro-learning modules based on the attack vector.
Training content must adapt dynamically to observed real-world threats.
5
Identify the macro-level program evaluation step.
Updating risk scores and recalibrating future simulation baselines.
Human risk metrics and simulation campaigns must reflect updated risk baselines.

Key Concept

Incident-Driven Human Risk Management and Security Training Lifecycle
Question 160Question →

An organization is updating its human risk management policy following a simulated phishing exercise that revealed widespread vulnerability among high-privilege users. To establish an effective, iterative Security Awareness and Human Risk Management cycle, in what sequential order should the security team implement the following stages?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with identifying high-risk groups and baseline risk metrics, followed by developing targeted role-based training content, executing contextual interventions and simulations, and concluding with continuous feedback analysis and policy adjustments.
An effective human risk management program follows a continuous administrative lifecycle: baseline assessment and target identification must come first, followed by role-based curriculum development, practical training delivery with simulations, and final feedback analysis to drive continuous policy refinement.

Step-by-Step Solution

1
Assess Baseline Risk & Target Groups
Establishes quantifiable human risk metrics and isolates vulnerable roles requiring specialized awareness.
Security awareness programs must begin with data-driven risk assessment rather than generic, unmeasured deployment.
2
Curate Role-Based Curriculum
Produces tailored micro-learning content directly targeting identified threat vectors.
Training materials must be customized to job functions and high-risk behaviors to maximize retention and impact.
3
Deliver Interventions & Conduct Practical Testing
Deploys targeted training modules and conducts controlled phishing simulations.
Employees must receive practical, contextual education and immediately test their ability to detect attacks.
4
Measure Performance & Adjust Program Framework
Calculates residual risk metrics, Mean Time to Detect/Report (MTTD/MTTR), and updates awareness policy governance.
Human risk management relies on a continuous feedback loop to ensure awareness policies evolve alongside emerging threats.

Key Concept

Human Risk Management Lifecycle and Security Awareness Program Design
PreviousPage 8 / 9Next
All practice questions — CompTIA Security+ | Examkin