Examkin

All practice questions

2232 questions

All types2,232Multiple choice1,151Multiple select509Numeric21Matching378Ordering173
Question 1601Question →

An enterprise security architect is reviewing access control operations across different corporate infrastructure components. Match each operational scenario on the left with its corresponding Authentication, Authorization, or Accounting (AAA) functional role on the right.

Click a left item, then click its matching right item

Items

A RADIUS server validates an employee's EAP-TLS digital certificate to verify identity before granting entry to the corporate network.
A firewall engine checks security group rules to grant or block an authenticated user's access to the production database subnet.
A TACACS+ server records the exact CLI commands executed by a network administrator during a switch maintenance window.
A gateway logging engine tracks session duration, bandwidth utilization, and IP addresses for remote access VPN connections.

Matches

Show answer & explanation

Answer

EAP-TLS certificate validation matches Authentication; checking firewall rules for subnet access matches Authorization; logging specific switch CLI commands matches Accounting (Action Auditing); tracking VPN bandwidth and session duration matches Accounting (Resource Tracking).
Authentication verifies identity through credentials such as digital certificates. Authorization enforces policies that determine what actions an authenticated entity can perform. Accounting logs both explicit administrative actions for auditability and general session metrics for resource tracking.

Step-by-Step Solution

1
Identify scenarios that verify identity credentials.
Scenario 1 proves identity via certificate verification, which corresponds to Authentication.
Authentication is strictly concerned with establishing and verifying identity.
2
Identify scenarios that enforce access permissions or policies.
Scenario 2 checks rule sets to allow or deny network transport paths, which corresponds to Authorization.
Authorization evaluates permissions after identity has been established.
3
Differentiate between action auditing and resource tracking within Accounting scenarios.
Scenario 3 logs specific executed commands (Action Auditing), while Scenario 4 captures metrics like bandwidth and connection time (Resource Tracking).
Accounting encompasses both non-repudiable activity auditing and quantitative resource consumption logging.

Key Concept

Authentication, Authorization, and Accounting (AAA) functional pillars
Question 1602Question →

An enterprise security team needs to deploy an urgent software patch to core payment gateways to remediate an actively exploited remote code execution vulnerability. To balance immediate threat mitigation with enterprise governance and risk management requirements, which of the following actions should the team take FIRST according to formal change management principles?

Show answer & explanation

Answer: Submit an emergency change request to the Emergency Change Advisory Board for expedited authorization with a documented backout procedure.

Answer

The team should submit an emergency change request to the Emergency Change Advisory Board (eCAB) for expedited authorization with a documented backout procedure.
Emergency Change Management procedures exist to handle urgent situations like zero-day vulnerability mitigation. Submitting an emergency change request to an Emergency Change Advisory Board allows for expedited evaluation of security impact and risk, while ensuring a backout plan is established to protect operational continuity.

Step-by-Step Solution

1
Evaluate the context of the change
Identified as a critical vulnerability requiring rapid mitigation without skipping governance
Emergency patches address active threats that cannot wait for standard change review cycles.
2
Select the correct change control path
Choose the Emergency Change Advisory Board (eCAB) process
The emergency change workflow provides expedited review and risk assessment designed specifically for urgent security fixes.
3
Ensure essential safety mechanisms are included
Attach a rollback/backout plan and conduct basic risk verification
Even under emergency conditions, a rollback plan prevents extended downtime if the patch causes unexpected failure.

Key Concept

Emergency Change Control and Security Impact Assessment
Question 1603Question →

A healthcare SaaS vendor maintains an electronic prescribing API valued at $800,000\$800,000. A security assessment identifies an unmitigated software vulnerability with an Exposure Factor (EFEF) of 0.350.35 and an Annual Rate of Occurrence (AROARO) of 0.500.50. To address this risk, the organization evaluates an inline security control with an annual recurring operating expense of $30,000\$30,000. Implementing this control will reduce the EFEF to 0.050.05 and the AROARO to 0.100.10. What is the net annual financial benefit of implementing this security control?

Show answer & explanation

Answer: $106,000\$106,000

Answer

The net annual financial benefit of implementing the security control is $106,000\$106,000.
The value of $106,000\$106,000 represents the true net annual financial benefit. Baseline ALEALE is $140,000\$140,000 (800,000×0.35×0.50800,000 \times 0.35 \times 0.50) and mitigated ALEALE is $4,000\$4,000 (800,000×0.05×0.10800,000 \times 0.05 \times 0.10), yielding a gross loss reduction of $136,000\$136,000. Subtracting the $30,000\$30,000 annual safeguard cost yields a net benefit of $106,000\$106,000.

Step-by-Step Solution

1
Calculate initial Single Loss Expectancy (SLEinitialSLE_{initial}) and Annual Loss Expectancy (ALEinitialALE_{initial})
SLEinitial=$800,000×0.35=$280,000SLE_{initial} = \$800,000 \times 0.35 = \$280,000; ALEinitial=$280,000×0.50=$140,000ALE_{initial} = \$280,000 \times 0.50 = \$140,000
Quantitative risk analysis requires establishing baseline annual expected loss prior to mitigation.
2
Calculate mitigated Single Loss Expectancy (SLEmitigatedSLE_{mitigated}) and Annual Loss Expectancy (ALEmitigatedALE_{mitigated})
SLEmitigated=$800,000×0.05=$40,000SLE_{mitigated} = \$800,000 \times 0.05 = \$40,000; ALEmitigated=$40,000×0.10=$4,000ALE_{mitigated} = \$40,000 \times 0.10 = \$4,000
Determine the residual risk exposure following control implementation.
3
Calculate gross Annual Loss Reduction
Gross Risk Reduction=ALEinitial−ALEmitigated=$140,000−$4,000=$136,000\text{Gross Risk Reduction} = ALE_{initial} - ALE_{mitigated} = \$140,000 - \$4,000 = \$136,000
Identify total annual financial loss avoided due to the reduced exposure factor and frequency.
4
Calculate Net Annual Benefit
Net Benefit=Gross Risk Reduction−Annual Control Cost=$136,000−$30,000=$106,000\text{Net Benefit} = \text{Gross Risk Reduction} - \text{Annual Control Cost} = \$136,000 - \$30,000 = \$106,000
Subtract recurring operational expense of the safeguard to determine net return on security investment.

Key Concept

Quantitative Risk Analysis (ALE and Safeguard Cost-Benefit Calculation)
Estimated Time:2m 0s
Question 1604Question →

An enterprise security architect is establishing a two-tier internal Public Key Infrastructure (PKI) hierarchy. The Root CA will remain air-gapped to maintain security, while a new Intermediate CA will issue operational certificates to web servers. Place the administrative steps for provisioning and activating the Intermediate CA into the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct administrative order is to first generate the private key and CSR locally on the Intermediate CA, transport the CSR out-of-band to the air-gapped Root CA, sign the request with the Root CA's private key, and finally import the signed intermediate certificate into the Intermediate CA while publishing the Root CA public certificate to the enterprise trust store.
In a standard two-tier PKI hierarchy with an air-gapped Root CA, the Intermediate CA first generates its own private key and CSR locally. The request is transported out-of-band to the Root CA, which signs the request using its private key. Finally, the signed certificate is installed on the Intermediate CA, and the Root CA's public certificate is deployed to endpoints' trusted root store to establish a valid trust chain.

Step-by-Step Solution

1
Generate private key pair and CSR locally on the Intermediate CA server
Creates the asymmetric key pair and formats the public key with subject identity into a CSR.
Private keys must be generated on the host system to prevent key compromise during transit.
2
Transport the CSR to the Root CA via offline media
Delivers the signing request to the isolated issuing system.
Air-gapped Root CAs lack network connectivity to defend against remote network attacks.
3
Sign the Intermediate CSR using the Root CA's private key
Generates a digitally signed Intermediate CA certificate containing path length basic constraints.
The Root CA acts as the trust anchor that validates and authorizes the Intermediate CA.
4
Install the signed certificate on the Intermediate CA and publish the Root CA certificate to client trust stores
Enables the Intermediate CA to sign leaf certificates and ensures endpoints can validate the full certificate path back to the Root CA.
Clients must possess the Root CA's public certificate in their trusted root store to build a trusted certificate path.

Key Concept

Two-tier PKI deployment and Intermediate CA certificate signing workflow
Question 1605Question →

During an ongoing security investigation into an automated build system, a security analyst discovers that an attacker compromised a CI/CD service account's API token and created unauthorized secondary deployment keys to maintain persistent access. The incident response team is currently executing the Containment phase of the NIST incident response lifecycle. Which of the following technical actions should the team perform immediately as part of containment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Revoke the compromised API token and immediately invalidate all secondary deployment keys created by the attacker.; Apply temporary network access control rules to restrict API gateway endpoints strictly to trusted internal management subnets.

Answer

The correct containment actions are revoking the compromised API token along with any secondary keys generated by the attacker, and applying temporary network access control rules to restrict API gateway endpoints strictly to trusted internal subnets.
During the Containment phase of an incident response process, the priority is to isolate affected systems and revoke compromised access vectors to prevent further damage. Revoking the compromised API token and secondary keys directly terminates the attacker's administrative access. Restricting API gateway ingress via network access control rules prevents unauthorized external connections. Both actions isolate the impact while preserving system state for ongoing forensic analysis.

Step-by-Step Solution

1
Identify the active incident response phase and objective.
The scenario specifies the team is in the Containment phase of the NIST Incident Response Framework, focusing on limiting incident damage and scope.
Containment measures prevent further unauthorized access while allowing forensic analysis to continue safely.
2
Evaluate identity and credential containment options.
Disabling compromised API credentials and removing secondary persistence keys immediately revokes the attacker's authorization to access API resources.
Credential revocation stops ongoing malicious API operations without wiping forensic state.
3
Evaluate network and infrastructure isolation containment options.
Applying restrictive network rules at the API gateway blocks external access vectors utilized by the threat actor.
Network isolation isolates access vectors to prevent additional remote unauthorized API calls.

Key Concept

Incident Response Lifecycle - Containment Phase Actions
Question 1606Question →

A security administrator must deploy a critical security patch across enterprise production application servers following standard change control and patch management practices. Place the following operational lifecycle steps in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with non-production sandbox testing, followed by submitting a formal change request to the Change Advisory Board, deploying to a pilot/staging fleet, executing the full production deployment during a scheduled maintenance window, and finally auditing compliance to update the configuration baseline.
Structured patch and configuration management follows a strict procedural lifecycle: non-production sandbox testing, formal Change Advisory Board authorization, staged pilot deployment, enterprise production rollout, and final post-installation verification auditing.

Step-by-Step Solution

1
Conduct initial functional and security testing in an isolated sandbox environment.
Identifies software conflicts or system crashes without impacting live operations.
Patches must never be applied to production or submitted for formal change approval without preliminary compatibility validation.
2
Submit a change request to the Change Advisory Board (CAB).
Obtains formal management approval, documents risks, and establishes backout plans.
Enterprise change management governance requires documented authorization before deploying changes to live operational systems.
3
Roll out the patch to a pilot or staging group.
Verifies patch stability under real-world conditions on a small subset of systems.
Staging deployments mitigate enterprise-wide outage risks by detecting unexpected edge-case issues early.
4
Perform full production deployment during an approved maintenance window.
Applies the patch across all target enterprise assets.
Deployment timing must align with authorized maintenance windows to minimize disruption to business operations.
5
Conduct automated compliance auditing and update configuration baselines.
Confirms successful patch application and establishes a new hardened system baseline.
Post-patch verification ensures no systems were missed and updates security records to prevent false drift alerts.

Key Concept

Standard Patch Management Lifecycle and Change Governance
Question 1607Question →

An IT infrastructure team plans to implement a centralized Privileged Access Management (PAM) solution to manage administrative access across corporate servers. To comply with formal change management policies and minimize operational and security risks, in which sequence should the team perform the following change control steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with documenting the change request and rollback plan, followed by obtaining CAB approval, testing in a staging environment, and finally deploying to production during an approved maintenance window.
A standard change management lifecycle follows a strict sequence: initial creation and risk/rollback documentation, formal evaluation and authorization by the Change Advisory Board (CAB), non-production staging validation to test functionality and rollback procedures, and finally, scheduled production implementation with post-change verification.

Step-by-Step Solution

1
Document change details, risk assessment, impact analysis, and rollback plan.
A completed formal change request is established.
Risk and operational dependencies must be fully understood and documented prior to evaluation.
2
Submit the documentation to the Change Advisory Board (CAB) for authorization.
Formal CAB approval is granted.
Governance policy requires authorized sign-off before changes can be tested or scheduled.
3
Execute the change within a dedicated staging environment.
Successful functional testing and validation of the rollback procedure in staging.
Testing mitigates the risk of unexpected outages and validates the backout plan safely.
4
Deploy to the production environment during an approved maintenance window.
The PAM system is successfully deployed in production with post-change verification.
Executing during authorized maintenance minimizes user impact and fulfills change control requirements.

Key Concept

Standard Change Control Workflow Lifecycle
Question 1608Question →

During operational threat hunting, a security analyst detects an internal workstation communicating with an unrecognized external IP address using DNS over HTTPS (DoH). Detailed inspection of the query logs reveals that sensitive file paths and directory metadata are being systematically encoded into subdomains and sent outside the enterprise network. According to standard incident response lifecycle guidelines (NIST SP 800-61), which of the following actions should the incident response team execute FIRST upon confirming this activity?

Show answer & explanation

Answer: Isolate the workstation from the network and block the external destination IP address.

Answer

Isolate the workstation from the network and block the external destination IP address.
According to the NIST Incident Response Framework, once an incident involves active data exfiltration, the team must prioritize Containment. Isolating the impacted workstation and restricting destination communication prevents further loss of confidential data while maintaining the system state for forensic investigation.

Step-by-Step Solution

1
Determine current incident lifecycle stage
The incident has been verified during the Identification phase as an active data exfiltration breach.
NIST SP 800-61 dictates that following identification, responders must prioritize Containment to prevent further data loss.
2
Select the appropriate Containment action
Disconnecting the host severs external C2/exfiltration channels while preserving volatile memory state for digital forensics.
Host isolation stops the active exfiltration vector without prematurely altering system artifacts needed for root-cause analysis.

Key Concept

Containment Phase Actions in Incident Response Playbooks
Question 1609Question →

An enterprise executive committee issues a high-level mandate requiring all internal data transmissions containing sensitive customer information to be strongly encrypted. To implement this directive across the organization, the IT security team publishes a mandatory technical document establishing the exact approved cipher suites, minimum key lengths, and required protocol versions that all systems must comply with. Which of the following governance document types is represented by this mandatory technical document?

Show answer & explanation

Answer: Security Standard

Answer

The technical specification document is a Security Standard because it contains compulsory technical requirements and configurations that operationalize high-level policy mandates.
A Security Standard specifies compulsory, measurable technical criteria—such as explicit encryption algorithms, minimum key sizes, and approved protocols—that must be implemented to fulfill a broader policy objective.

Step-by-Step Solution

1
Analyze the enforceability and specificity described in the scenario stem.
The document is mandatory and contains exact technical requirements (cipher suites, key lengths, protocol versions).
Governance documents are differentiated by their level of technical detail and whether compliance is mandatory or optional.
2
Compare the document characteristics against the governance document hierarchy.
High-level rules are policies; specific mandatory settings are standards; step-by-step tasks are procedures; optional suggestions are guidelines.
Standards bridges high-level policy intent with mandatory, measurable technical controls.

Key Concept

Information Security Governance Hierarchy (Policies, Standards, Baselines, Guidelines, Procedures)
Estimated Time:1m 15s
Question 1610Question →

An organization specifies that its primary customer database must be fully restored and operational within four hours following an unexpected system outage to prevent severe financial impact. Which of the following business continuity metrics does this duration represent?

Show answer & explanation

Answer: Recovery Time Objective (RTO)

Answer

Recovery Time Objective (RTO)
Recovery Time Objective (RTO) is the maximum acceptable duration of time that a system or process can be down after a disaster or disruption before intolerable operational or financial impact occurs. The four-hour restoration window explicitly defines RTO.

Step-by-Step Solution

1
Identify the key requirement in the scenario
The requirement specifies a maximum allowable timeframe (four hours) for restoring system functionality following an outage.
Determining whether the metric targets downtime duration or data loss duration isolates the correct BIA metric.
2
Map the requirement to the corresponding Business Impact Analysis (BIA) metric
The metric defining maximum acceptable system recovery time is the Recovery Time Objective (RTO).
RTO focuses on service restoration and operational uptime thresholds.

Key Concept

Recovery Time Objective (RTO) vs. Recovery Point Objective (RPO)
Question 1611Question →

A security operations team is configuring an internal vulnerability assessment for a critical database cluster. During initial test runs, network-based scans produced incomplete results because inline Network Intrusion Prevention System (NIPS) appliances dropped scanning probes after flagging them as port scanning attacks. Which of the following approaches should the team implement to ensure comprehensive vulnerability visibility without triggering network traffic blocking? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy credentialed host-based vulnerability agents directly on the target cluster nodes.; Configure NIPS bypass rules for the dedicated vulnerability scanner IP address and apply scan throttling.

Answer

The correct approaches are to deploy credentialed host-based vulnerability agents directly on the cluster nodes and to configure NIPS bypass rules for the scanner IP address along with scan throttling.
Deploying host-based credentialed agents allows local auditing of installed patches and configurations without generating high-volume network probes that trigger inline IPS drops. Additionally, setting up IPS allowlist rules for the designated scanner IP address while enabling scan throttling ensures network probe traffic is authorized and does not disrupt network performance.

Step-by-Step Solution

1
Identify the primary cause of scan failure.
The NIPS drops probe packets due to detecting high-volume network scanning signatures.
Inline network security appliances misidentify automated scanner traffic as malicious port scanning activity.
2
Evaluate host-based local assessment solutions.
Deploying host-based agents enables local inventory and patch audits.
Agent-based scanning inspects system state locally, eliminating heavy network probe traffic and bypassing network IPS inspection.
3
Evaluate network-based scanner adjustment techniques.
Allowlisting the scanner IP on NIPS and throttling request rates allows network probes through cleanly.
NIPS bypass rules prevent packet dropping for authorized scanner IPs, while rate throttling avoids network overload.

Key Concept

Vulnerability Scanner Configuration and Intrusion Defense Interoperability
Question 1612Question →

An organization is ending its contract with a third-party cloud service vendor that hosted proprietary customer datasets. To satisfy data privacy compliance mandates and prevent unauthorized data disclosure, the security team must verify that all organizational data, including backups and shadow copies stored on the vendor's storage infrastructure, has been permanently removed and sanitized. Which of the following artifacts should the organization require from the vendor to validate that this requirement was completed?

Show answer & explanation

Answer: Certificate of Destruction

Answer

The organization should require a Certificate of Destruction from the vendor.
A Certificate of Destruction is a formal document provided by a vendor certifying that specific data, files, or physical media have been rendered unrecoverable using approved sanitization or destruction methods. During third-party vendor offboarding, obtaining this document is essential for confirming compliance with data governance and privacy policies.

Step-by-Step Solution

1
Identify the objective of vendor offboarding and data decommissioning
The objective is to obtain verifiable proof that all proprietary customer data and residual backups have been permanently sanitized by the third party.
Offboarding procedures require formal documentation ensuring vendor compliance with data retention and destruction policies.
2
Evaluate the function of third-party governance documents and compliance artifacts
Operational contracts (SLAs), network connectivity agreements (ISAs), and risk management analyses (BIAs) govern active operations or planning, whereas a Certificate of Destruction documents completed media/data sanitization.
Verifiable attestation requires an explicit confirmation artifact generated upon completing the data purge.
3
Select the appropriate artifact that fulfills the compliance validation requirement
A Certificate of Destruction officially confirms the method, date, and scope of data destruction.
This document ensures legal accountability and compliance with data privacy regulations.

Key Concept

Third-Party Vendor Offboarding and Data Destruction Attestation
Question 1613Question →

A security administrator is evaluating the AAA implementation for a new enterprise remote access gateway. During connection establishment, the gateway verifies user credentials against an Active Directory domain controller, applies dynamic firewall rules to restrict network access based on role attributes, enforces bandwidth throttling policies according to user subscription tiers, and writes start/stop session timestamps to a central syslog server.

Which of the following operational activities performed by the gateway represent the Authorization pillar of AAA? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Applying dynamic firewall rules to restrict network access based on role attributes; Enforcing bandwidth throttling policies according to user subscription tiers

Answer

Applying dynamic firewall rules to restrict network access based on role attributes, and enforcing bandwidth throttling policies according to user subscription tiers.
Authorization dictates the specific rights, privileges, and resource access levels allowed for a validated user. Applying dynamic firewall rules based on user role attributes enforces network perimeter permissions, while enforcing bandwidth limits based on user tiers controls resource utilization rights. Both functions explicitly manage permitted access bounds.

Step-by-Step Solution

1
Define the core responsibility of the Authorization pillar in AAA.
Authorization determines the specific permissions, resource access rights, and operational boundaries granted to an identity after authentication.
Differentiating between identity proofing (Authentication), access control (Authorization), and activity logging (Accounting) is required to categorize each activity.
2
Evaluate each system action in the gateway scenario against AAA definitions.
Credential verification proves identity (Authentication). Writing session timestamps records session metrics for auditing (Accounting). Dynamic firewall rules and bandwidth throttling define what network resources and performance limits the identity is allowed to use (Authorization).
Actions that control or restrict access permissions map to Authorization.
3
Identify the two actions representing Authorization.
Applying dynamic firewall rules based on role attributes and enforcing bandwidth throttling policies based on user tiers.
Both mechanisms enforce permissions and resource usage parameters for authenticated users.

Key Concept

Authentication, Authorization, and Accounting (AAA) Framework
Estimated Time:1m 15s
Question 1614Question →

A chief information security officer (CISO) is reviewing the quantitative risk assessment report for an organization's legacy data center hosting critical data storage arrays. The assessment establishes an Asset Value (AVAV) of $500,000\$500,000, an Exposure Factor (EFEF) of 0.400.40, and an Annual Rate of Occurrence (AROARO) of 0.500.50. The risk management team is evaluating several potential risk handling options. Which of the following statements accurately describe the risk metrics and response strategies in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Purchasing a targeted cyber insurance policy to offset potential financial losses from server downtime constitutes a risk transference strategy.; The unmitigated Annual Loss Expectancy (ALEALE) prior to implementing additional safeguards is $100,000\$100,000.

Answer

The correct statements are that purchasing a cyber insurance policy constitutes risk transference, and that the unmitigated Annual Loss Expectancy (ALEALE) is $100,000\$100,000.
Purchasing insurance is a textbook example of risk transference because financial risk is shifted to a third party. Furthermore, calculating the annualized financial exposure yields an ALEALE of $100,000\$100,000 (SLE=$500,000×0.40=$200,000SLE = \$500,000 \times 0.40 = \$200,000; ALE=$200,000×0.50=$100,000ALE = \$200,000 \times 0.50 = \$100,000).

Step-by-Step Solution

1
Calculate Single Loss Expectancy (SLESLE)
SLE=AV×EF=$500,000×0.40=$200,000SLE = AV \times EF = \$500,000 \times 0.40 = \$200,000
SLESLE measures the monetary loss of a single risk event.
2
Calculate Annual Loss Expectancy (ALEALE)
ALE=SLE×ARO=$200,000×0.50=$100,000ALE = SLE \times ARO = \$200,000 \times 0.50 = \$100,000
ALEALE quantifies the expected annualized financial impact of the threat.
3
Categorize risk response options based on standard definitions
Cyber insurance shifts financial burden (transference); completely ceasing the process eliminates exposure (avoidance).
Risk transference relies on third parties (e.g., insurance), whereas risk avoidance eliminates the risk source entirely.

Key Concept

Quantitative risk analysis metrics (SLESLE, ALEALE) and standard risk response strategies (transference vs. avoidance vs. mitigation).
Question 1615Question →

A security analyst investigating enterprise Network Security Monitoring (NSM) alerts receives a notification from a Network Traffic Analysis (NTA) sensor. The alert indicates an unusual volume of outbound encrypted SSH traffic on port 22 originating from an internal corporate workstation toward an unfamiliar external IP address during non-business hours. Which of the following actions should the analyst perform as initial investigation and containment steps? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Cross-reference endpoint detection logs on the workstation to identify the local process and user context associated with the outbound SSH connections.; Temporarily isolate the workstation from the internal network to prevent potential unauthorized data exfiltration.

Answer

The analyst should check endpoint detection logs to verify the initiating process and temporarily isolate the workstation from the network to prevent data exfiltration.
Verifying host endpoint logs establishes whether an unauthorized process created the SSH tunnel, while isolating the workstation from the network halts active data transfer without altering volatile system state.

Step-by-Step Solution

1
Correlate NTA network alerts with host-level EDR logs
Identifies the executable, parent process, and user credentials responsible for initiating the outbound SSH connection.
Validates whether the alert represents a legitimate administrative activity or a malicious tunnel.
2
Apply network isolation controls to the affected workstation
Disconnects the host from the internal network while keeping host processes intact for forensic acquisition.
Prevents potential exfiltration of sensitive data across the unauthorized network path.

Key Concept

Network traffic anomaly triage and initial incident containment.
Question 1616Question →

An enterprise financial service provider relies on a third-party software-as-a-service (SaaS) platform to process sensitive customer data. During a recent audit, the security team discovered that while the SaaS vendor maintains a clean SOC 2 Type II report, the vendor's software pipeline dynamically pulls unverified sub-dependencies from open-source repositories at build time, exposing the enterprise to potential downstream software supply chain compromises. Which of the following technical controls should the enterprise security team require from the vendor to continuously validate component integrity and mitigate this software supply chain risk?

Show answer & explanation

Answer: Mandate the submission of machine-readable Software Bill of Materials (SBOM) artifacts alongside cryptographically signed build attestations for each release.

Answer

Mandate the submission of machine-readable Software Bill of Materials (SBOM) artifacts alongside cryptographically signed build attestations for each release.
Requiring a machine-readable Software Bill of Materials (SBOM) and cryptographically signed build attestations directly mitigates software supply chain risk. An SBOM discloses all nested third-party libraries, allowing the enterprise to continuously analyze software components against vulnerability databases. Cryptographic attestations verify that the code built matches the audited source code without tampered dependencies.

Step-by-Step Solution

1
Analyze the identified risk scenario
The core security vulnerability stems from unvalidated, dynamic open-source sub-dependencies within the vendor's build pipeline (software supply chain risk).
Point-in-time compliance reports and network-level security controls do not grant visibility into software component composition.
2
Evaluate third-party software supply chain risk mitigation controls
An SBOM explicitly details all direct and nested components, libraries, and modules, while signed build attestations verify code provenance and prevent unauthorized pipeline modifications.
Modern third-party risk oversight requires continuous, automated tracking of software dependencies to identify zero-day vulnerabilities in third-party code.
3
Differentiate technical supply chain controls from legal and network controls
Selecting SBOM ingestion and build attestation addresses component transparency directly at the software artifact level.
ISAs address network connectivity, SOC 2 reports provide periodic audit compliance, and SLAs enforce contractual liabilities.

Key Concept

Software Supply Chain Oversight and SBOM Verification
Question 1617Question →

A systems administrator is configuring bulk storage encryption for a enterprise cloud file server holding sensitive financial records. The organization requires a cryptographic mechanism that delivers high-speed symmetric data encryption while simultaneously calculating an authentication tag to ensure confidentiality and data integrity during high-throughput disk operations. Which of the following cryptographic algorithms and modes BEST fulfills these requirements?

Show answer & explanation

Answer: AES-256 in Galois/Counter Mode (GCM)

Answer

AES-256 in Galois/Counter Mode (GCM) is the optimal choice because it is a symmetric block cipher mode offering high-speed authenticated encryption (AEAD), satisfying both confidentiality and integrity requirements for bulk storage.
AES-256 in Galois/Counter Mode (GCM) is an Authenticated Encryption with Associated Data (AEAD) cipher mode. It provides strong confidentiality via symmetric bulk encryption and simultaneous data integrity authentication via a Galois field multiplication tag, fulfilling all scenario requirements with minimal latency.

Step-by-Step Solution

1
Identify the primary operational constraint and functional requirements
The scenario requires bulk data encryption (requiring symmetric encryption for speed), confidentiality, and integrity (requiring authenticated encryption).
Bulk disk storage operations require high-throughput symmetric ciphers due to performance overhead of asymmetric ciphers.
2
Evaluate candidate cryptographic algorithms for bulk data encryption
AES (Advanced Encryption Standard) is the standard symmetric block cipher for high-speed bulk data-at-rest encryption.
Asymmetric ciphers (such as RSA) and hashing functions (such as HMAC or SHA-3) cannot fulfill high-throughput encryption requirements.
3
Select the appropriate cipher mode of operation
Galois/Counter Mode (GCM) provides Authenticated Encryption with Associated Data (AEAD), outputting both ciphertext and an authentication tag.
AEAD modes guarantee data confidentiality while verifying data integrity without requiring separate hash passes.

Key Concept

Authenticated Encryption with Associated Data (AEAD) via AES-GCM
Question 1618Question →

A security engineer is establishing a secure mutual TLS (mTLS) framework between microservices operating within air-gapped container clusters. During deployment testing, client microservices fail TLS handshakes because they cannot reach external certificate revocation lists (CRLs) or online responders to check server certificate validity. Additionally, security compliance mandates that private keys must originate exclusively within the local trusted execution environment of each microservice during certificate enrollment. Which of the following solutions should the engineer implement to resolve the revocation validation failures and satisfy the key generation compliance requirement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure server-side microservices to utilize OCSP stapling, enabling them to include a time-stamped, CA-signed revocation status assertion directly within the TLS handshake.; Ensure each client microservice generates its asymmetric key pair locally inside its local hardware security module and submits only the public key within the Certificate Signing Request (CSR) to the CA.

Answer

The security engineer should enable OCSP stapling on the server-side microservices and require each client microservice to generate its key pair locally inside its hardware security module prior to submitting a CSR.
Enabling OCSP stapling resolves the revocation checking issue in air-gapped environments because the server periodically retrieves the signed OCSP response and delivers it directly to the client during the TLS handshake, eliminating the need for client outbound access. Furthermore, generating key pairs locally within an HSM and submitting only the public key in the Certificate Signing Request (CSR) ensures the private key never leaves the client boundary.

Step-by-Step Solution

1
Analyze the certificate revocation validation failure in an isolated, air-gapped network segment.
Identify that clients cannot initiate outbound connections to check CRL or OCSP endpoints external to the cluster.
Air-gapped environments block direct internet or cross-segment egress traffic from client nodes.
2
Select a revocation mechanism that delivers status proof without client-initiated outbound traffic.
Implement OCSP stapling on server microservices.
The server periodically fetches the signed OCSP response from the CA/responder and appends ('staples') it to the TLS handshake, allowing the client to verify revocation offline.
3
Evaluate the key generation requirement for certificate enrollment.
Enforce local key generation within the microservice's local hardware security module (HSM) / secure enclave before creating the Certificate Signing Request (CSR).
Submitting a CSR with a locally generated public key guarantees the private key is never exposed or transferred across network boundaries.

Key Concept

PKI Certificate Lifecycle & Revocation Optimization (OCSP Stapling and CSR Key Management)
Estimated Time:2m 0s
Question 1619Question →

An enterprise is preparing to onboard a third-party Software-as-a-Service (SaaS) provider to process customer payment data. To comply with regulatory requirements, the security team must verify not only that the vendor has implemented required security controls, but also that these controls operated effectively over a continuous six-month period. Which of the following vendor artifacts should the security team request to validate this operational effectiveness?

Show answer & explanation

Answer: SOC 2 Type II report

Answer

The organization should request a SOC 2 Type II report to verify the operational effectiveness of vendor security controls over a continuous timeframe.
A SOC 2 Type II report provides independent assurance regarding both the design suitability and operational effectiveness of a vendor's security controls across a designated period (such as 6 to 12 months). This matches the enterprise requirement for continuous operational verification.

Step-by-Step Solution

1
Identify the core assessment requirement in the scenario.
The requirement demands proof that security controls operated effectively over an extended period (six months), rather than just being configured at a single instant.
Third-party risk management frameworks distinguish between design suitability at a point in time and continuous operational effectiveness.
2
Evaluate third-party audit reports against the specific requirement.
A SOC 2 Type II report specifically tests and reports on control performance across a historical audit window (6–12 months).
Type II audits involve independent testing over time to ensure controls remain active and effective during standard business operations.

Key Concept

SOC Report Types in Third-Party Risk Assessment
Question 1620Question →

An organization's security team is conducting a Business Impact Analysis (BIA) for a cloud-hosted customer portal. The analysis indicates that the organization can tolerate a maximum of two hours of lost data during an unpredicted outage before experiencing critical business impact. Which of the following metrics defines this maximum acceptable data loss timeframe?

Show answer & explanation

Answer: Recovery Point Objective (RPO)

Answer

Recovery Point Objective (RPO)
Recovery Point Objective (RPO) directly measures the maximum amount of data loss an organization can tolerate expressed as a time duration prior to an outage. Specifying a maximum data loss threshold of two hours establishes an RPO of two hours.

Step-by-Step Solution

1
Identify the primary constraint described in the business continuity scenario.
The scenario focuses on the maximum tolerable data loss duration (two hours).
Differentiating between time-to-restore systems and acceptable data loss is necessary to choose the correct metric.
2
Match the constraint to standard Business Impact Analysis (BIA) metrics.
The metric measuring maximum acceptable data loss in terms of time is the Recovery Point Objective (RPO).
RPO dictates backup frequency and data replication strategies.

Key Concept

Recovery Point Objective (RPO)
Estimated Time:45s
PreviousPage 81 / 112Next
All practice questions — CompTIA Security+ | Examkin