All practice questions

2232 questions

All types2,232 Multiple choice1,151 Multiple select509 Numeric21 Matching378 Ordering173

A financial technology SaaS provider headquartered in Canada expands its operations to process real-time payment transactions and consumer credit metrics for financial institutions operating in both the European Union and the United States. During a legal compliance audit, the enterprise risk management team evaluates the organization's regulatory obligations regarding stored cardholder data, non-public personal information (NPI), and financial telemetry. Which of the following requirements MUST the organization implement to achieve compliance with PCI DSS and GDPR mandates? (Select TWO.)

Select all that apply

Encrypt stored primary account numbers (PAN) and maintain a logically segregated cardholder data environment (CDE).

Designate a statutory Data Protection Officer (DPO) and establish lawful cross-border data transfer mechanisms for EU personal data.

Deploy an inline network intrusion prevention system (IPS) to satisfy mandatory technical controls under Sarbanes-Oxley Act (SOX) Section 404.

Relocate all physical data storage infrastructure to United States soil to satisfy Gramm-Leach-Bliley Act (GLBA) data residency directives.

Show answer & explanation

Answer: Encrypt stored primary account numbers (PAN) and maintain a logically segregated cardholder data environment (CDE).; Designate a statutory Data Protection Officer (DPO) and establish lawful cross-border data transfer mechanisms for EU personal data.

Answer

The organization must encrypt stored primary account numbers (PAN) within a segregated cardholder data environment under PCI DSS, and designate a statutory Data Protection Officer (DPO) alongside lawful cross-border transfer mechanisms under GDPR.

Encrypting primary account numbers within a segregated cardholder data environment satisfies PCI DSS core security requirements. Appointing a Data Protection Officer and establishing lawful transfer mechanisms fulfills GDPR Articles 37 and 44 for processing EU personal data.

Step-by-Step Solution

Analyze PCI DSS compliance obligations for processing cardholder payment data.

PCI DSS mandates the protection of stored cardholder data (PAN) through robust encryption algorithms and logical isolation of the Cardholder Data Environment (CDE).

Cardholder data security is a foundational requirement of PCI DSS for all payment-processing entities.

Analyze GDPR compliance obligations for handling personal telemetry of European Union residents.

GDPR mandates formal data governance oversight, including designating a Data Protection Officer (DPO) for large-scale data handling and adopting lawful cross-border data transfer safeguards.

GDPR applies extra-territorially to any global organization processing personal data of individuals within the EU.

Evaluate incorrect options regarding SOX Section 404 and GLBA mandates.

SOX Section 404 addresses internal accounting controls over financial disclosures rather than technical IPS appliance deployment, while GLBA dictates information security program safeguards rather than geographic server localization.

Regulatory compliance requires accurate mapping of statutory mandates to their specific scope and baseline requirements.

Key Concept

Regulatory Compliance Scope and Framework Control Requirements

Question 1662Question →

An organization is updating its third-party risk management policies and vendor contract templates. Match each agreement or documentation type to its primary purpose in vendor oversight.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Service Level Agreement (SLA) matches with quantifiable performance targets and uptime guarantees; Interconnection Security Agreement (ISA) matches with technical and security requirements for connecting separate networks; Non-Disclosure Agreement (NDA) matches with legally binding protection of sensitive data and trade secrets; Memorandum of Understanding (MOU) matches with documenting mutual intent and shared responsibilities prior to formal contracting.

Each agreement serves a distinct governance function in third-party risk management: SLAs define measurable performance and uptime metrics; ISAs define technical controls for connecting networks; NDAs protect confidential information; and MOUs establish mutual goals and high-level intentions before formal technical or business contracting.

Step-by-Step Solution

Identify operational performance and uptime metric requirements.

Map Service Level Agreement (SLA) to quantifiable performance targets and uptime guarantees.

SLAs focus primarily on operational metrics, availability guarantees, and penalties for non-performance.

Identify technical data transmission and network connection rules.

Map Interconnection Security Agreement (ISA) to technical security controls for linking separate networks.

ISAs govern the technical security posture, protocols, and interface controls required when two external networks interconnect.

Identify legal protections for proprietary and confidential information.

Map Non-Disclosure Agreement (NDA) to binding protections for sensitive business information and trade secrets.

NDAs restrict vendor disclosure of sensitive data shared during engagement.

Identify non-binding high-level partner framework documents.

Map Memorandum of Understanding (MOU) to mutual intent and shared responsibilities prior to formal contracting.

MOUs express general mutual alignment and understanding of roles before definitive contracts or technical connections are finalized.

Key Concept

Third-Party Agreement and Documentation Types in Risk Management

Question 1663Question →

A security analyst is investigating a breach where an adversary captured encrypted TLS traffic traversing an enterprise network. Months later, the adversary obtained the web server's private key and successfully decrypted all historical session data. Which of the following cryptographic mechanisms should be implemented to ensure that a future compromise of the server's private key does not expose previously recorded encrypted session communications?

Perfect forward secrecy utilizing ephemeral key exchange mechanisms

Static RSA asymmetric key transport for encrypting session symmetric keys

HMAC-SHA256 message authentication codes appended to each network packet

Generating a Certificate Signing Request with a 4096-bit RSA public key length

Show answer & explanation

Answer: Perfect forward secrecy utilizing ephemeral key exchange mechanisms

Answer

Perfect forward secrecy utilizing ephemeral key exchange mechanisms

Perfect forward secrecy (PFS) ensures that compromise of a long-term private key does not compromise past session keys. By generating disposable ephemeral key pairs for each session (such as with ECDHE), past session keys cannot be computed retroactively even if an attacker acquires the server's long-term private key.

Step-by-Step Solution

Analyze the vulnerability described in the security incident.

Recorded historical TLS sessions were decrypted after an attacker obtained the server's long-term static private key.

The static key exchange mechanism allowed the server's long-term private key to decrypt stored session keys.

Identify the required cryptographic security property.

The architecture requires a mechanism where compromise of long-term keying material does not compromise past session keys.

This specific security goal is defined as Perfect Forward Secrecy (PFS).

Select the implementation mechanism that provides Perfect Forward Secrecy.

Ephemeral key exchange algorithms (such as ECDHE or DHE) generate temporary, disposable key pairs per session.

Because ephemeral keys are discarded immediately after session key derivation, compromise of the long-term server key cannot decrypt recorded past traffic.

Key Concept

Perfect Forward Secrecy and Ephemeral Key Exchange

Question 1664Question →

A network security engineer is auditing the AAA implementation for an enterprise 802.1X wireless network backed by a central RADIUS server. Which of the following statements correctly describe how authentication, authorization, or accounting functions operate in this deployment? (Select TWO.)

Select all that apply

The RADIUS server performs authentication by validating user-provided credentials against a centralized directory service.

Accounting functions capture session start/stop timestamps and data transfer volumes to provide historical audit logs.

The client wireless supplicant determines authorization by locally assigning its own network permissions prior to connection.

Passing the initial credential authentication stage automatically authorizes unrestricted access to all internal enterprise subnets.

Show answer & explanation

Answer: The RADIUS server performs authentication by validating user-provided credentials against a centralized directory service.; Accounting functions capture session start/stop timestamps and data transfer volumes to provide historical audit logs.

Answer

The RADIUS server performs authentication by validating user-provided credentials against a centralized directory service, and accounting functions capture session start/stop timestamps and data transfer volumes to provide historical audit logs.

Authentication is correctly described by the statement where RADIUS validates credentials against a central directory to verify identity. Accounting is correctly described by the statement where session duration and network consumption metrics are logged for compliance and auditing purposes.

Step-by-Step Solution

Differentiate between the three distinct pillars of AAA in network security.

Authentication proves identity, Authorization determines allowed rights and access controls, and Accounting logs user activity.

Establishing accurate function definitions allows proper evaluation of the scenario statements.

Evaluate identity verification mechanisms.

The statement describing the RADIUS server checking user credentials against a directory service represents identity verification (Authentication).

Credential validation against an authoritative directory service is the fundamental mechanism of authentication.

Evaluate session tracking mechanisms.

The statement describing logging session timestamps and data bandwidth usage represents resource tracking (Accounting).

Capturing session metrics and activity logs provides auditability and non-repudiation.

Key Concept

Authentication, Authorization, and Accounting (AAA)

Question 1665Question →

A publicly traded company in the United States must establish internal security controls to ensure the accuracy, transparency, and integrity of its corporate financial reports and auditing processes. Which of the following regulatory frameworks specifically mandates these financial data governance and reporting control requirements?

Sarbanes-Oxley Act (SOX)

Health Insurance Portability and Accountability Act (HIPAA)

Payment Card Industry Data Security Standard (PCI-DSS)

General Data Protection Regulation (GDPR)

Show answer & explanation

Answer: Sarbanes-Oxley Act (SOX)

Answer

The Sarbanes-Oxley Act (SOX) is the legal framework that specifically mandates internal controls over financial auditing and corporate disclosures.

The Sarbanes-Oxley Act (SOX) mandates that publicly traded organizations implement IT security controls, audit trails, and strict data protection mechanisms to guarantee the integrity, transparency, and accuracy of corporate financial reporting.

Step-by-Step Solution

Identify the primary requirement in the scenario

The scenario focuses on internal security controls for financial accounting integrity and corporate auditing disclosures.

Regulatory compliance mandates depend directly on the classification of data and organizational operational type.

Map the requirement to the governing legal framework

The Sarbanes-Oxley Act (SOX) explicitly governs financial accounting integrity and audit trails for publicly traded US corporations.

SOX Section 404 specifically requires management to establish and maintain adequate internal controls over financial reporting.

Key Concept

Sarbanes-Oxley Act (SOX) Financial Compliance Mandates

Estimated Time:45s

Question 1666Question →

A security engineer is updating the cryptographic specifications for an enterprise file ingest service. The system baseline requires high-throughput data confidentiality for large batch data uploads, alongside digital non-repudiation and origin verification for administrative policy manifests submitted with each batch. Which TWO cryptographic algorithms or mechanisms should the security engineer implement to satisfy these specific operational requirements?

Select all that apply

AES-GCM (Advanced Encryption Standard in Galois/Counter Mode) for high-speed symmetric bulk data encryption

ECDSA (Elliptic Curve Digital Signature Algorithm) for signing administrative policy manifests

Direct RSA public key encryption applied to the full payload stream of each large batch data upload

Standalone SHA-256 hashing performed on administrative policy manifests prior to transmission

Generating and submitting a new Certificate Signing Request (CSR) for each individual administrative policy manifest

Show answer & explanation

Answer: AES-GCM (Advanced Encryption Standard in Galois/Counter Mode) for high-speed symmetric bulk data encryption; ECDSA (Elliptic Curve Digital Signature Algorithm) for signing administrative policy manifests

Answer

The correct cryptographic implementation consists of using symmetric authenticated encryption (AES-GCM) for rapid bulk data confidentiality and asymmetric digital signatures (ECDSA) to provide non-repudiation and origin authentication for administrative manifests.

AES-GCM is the industry standard symmetric block cipher mode for fast, authenticated encryption of high-volume data payloads. ECDSA provides strong asymmetric digital signatures with compact key sizes, fulfilling the requirement for non-repudiation and sender authenticity on administrative manifest files.

Step-by-Step Solution

Identify the high-throughput confidentiality requirement for bulk data.

Symmetric ciphers are optimized for processing large volumes of data quickly. AES-GCM provides bulk stream confidentiality along with authenticated encryption.

Asymmetric algorithms incur prohibitive performance overhead when encrypting large payloads.

Identify the non-repudiation and origin verification requirement for administrative manifests.

Asymmetric digital signatures, such as ECDSA, allow the sender to sign content using a private key, enabling receivers to verify origin and integrity using the corresponding public key.

Digital signatures guarantee non-repudiation because only the private key owner could have produced the signature.

Key Concept

Selecting Appropriate Cryptographic Algorithms for Confidentiality vs. Non-Repudiation

Question 1667Question →

An organization must conduct scheduled external vulnerability assessments of its public-facing web applications to satisfy regulatory compliance. During previous unauthenticated scans, the perimeter web application firewall (WAF) repeatedly blocked the scanner's IP address, resulting in incomplete scan reports and false positives. Which scanning strategy should the security analyst implement to obtain comprehensive assessment results without disabling perimeter defenses for external traffic?

Perform authenticated application scanning using scanner source IP addresses whitelisted specifically on the WAF

Reconfigure the inline Intrusion Prevention System to operate in passive monitoring mode to identify web application flaws

Execute an aggressive, non-credentialed port scan using randomized source ports to overwhelm perimeter firewall logging

Analyze client-side web browser logs using static code analysis tools to detect database vulnerabilities on the backend server

Show answer & explanation

Answer: Perform authenticated application scanning using scanner source IP addresses whitelisted specifically on the WAF

Answer

Perform authenticated application scanning using scanner source IP addresses whitelisted specifically on the WAF

Whitelisting the dedicated vulnerability scanner's IP address on the WAF allows security probes to reach target applications without triggering defensive blocks. Combining this with authenticated access enables comprehensive assessment of application code and system configurations while keeping WAF protections fully enabled for untrusted external traffic.

Step-by-Step Solution

Identify the primary root cause of incomplete scanner results.

The perimeter WAF actively identifies scanner probes as attack traffic and blocks the scanner's source IP address.

Unauthenticated vulnerability probes mimic real-world attack traffic, triggering automated defensive rules.

Determine the appropriate configuration to allow legitimate scanner traffic.

Whitelisting the dedicated scanner's IP address on the WAF allows scan traffic through while keeping protection active for all other internet traffic.

Targeted IP exceptions permit authorized security testing without lowering baseline enterprise security.

Select the scan type that provides maximum accuracy and reduces false positives.

Executing an authenticated scan provides deep visibility into application states and internal patch levels.

Credentialed scans bypass superficial banner checks, reducing false positives and identifying complex vulnerabilities.

Key Concept

Credentialed Vulnerability Scanning and Defensive Control Whitelisting

Estimated Time:1m 30s

Question 1668Question →

A security operations team is implementing an automated system for endpoint security baseline auditing and patch management across a hybrid enterprise environment. Which of the following operational practices should the security team deploy to maintain system stability while enforcing secure configuration baselines? (Select TWO.)

Select all that apply

Establish a pre-deployment testing environment to validate patch compatibility and configuration baselines before rollout.

Deploy network-level web application firewalls to automatically rewrite local operating system configuration files on non-compliant systems.

Implement continuous baseline drift detection to identify and remediate unauthorized system configuration changes.

Reclassify host configuration baseline auditing logs as physical security controls to meet regulatory compliance requirements.

Show answer & explanation

Answer: Establish a pre-deployment testing environment to validate patch compatibility and configuration baselines before rollout.; Implement continuous baseline drift detection to identify and remediate unauthorized system configuration changes.

Answer

The correct operational practices are establishing a pre-deployment testing environment to validate patch updates and configuration baselines prior to production deployment, and implementing continuous baseline drift detection to monitor and remediate unauthorized system modifications.

Establishing a pre-deployment staging environment ensures patches and baseline changes are tested for stability and compatibility prior to broad release. Implementing continuous configuration drift detection allows administrators to quickly detect and correct unauthorized deviations from established security baselines.

Step-by-Step Solution

Analyze operational requirements for patch and configuration management lifecycle.

Identified the need for safety verification prior to deployment and ongoing maintenance of compliance post-deployment.

Safe patch management requires testing prior to release, while configuration management requires continuous monitoring against drift.

Evaluate pre-deployment staging practice.

Staging environments allow security teams to catch system conflicts or regressions early.

Deploying untested patches directly to production risks operational outage.

Evaluate continuous drift detection practice.

Drift detection tools identify unauthorized changes away from approved security baselines.

Systems frequently drift due to manual edits or unauthorized software installations, compromising security posture.

Key Concept

Patch Staging and Configuration Drift Detection

Question 1669Question →

During a malware investigation, an incident responder discovers that several engineers in an organization had their workstations infected after visiting an authentic, third-party software development forum that they frequently use for work. The attacker had previously breached the forum and injected a malicious drive-by download script targeting visitors originating from the organization's corporate IP range. Which of the following social engineering attack vectors was executed by the threat actor?

Watering hole attack

Spear phishing

Typosquatting

Pretexting

Show answer & explanation

Answer: Watering hole attack

Answer

Watering hole attack

The correct answer is watering hole attack. In a watering hole attack, threat actors observe or predict which authentic websites a target group frequently visits, breach one of those sites, and plant malicious code to infect visitors from the target organization.

Step-by-Step Solution

Analyze the attack mechanism described in the scenario

The adversary compromised an authentic, trusted third-party website commonly frequented by the target group to deliver malware.

Identifying the delivery channel distinguishes site-based passive exploitation from direct communication attacks.

Compare the attack characteristics against social engineering vector definitions

Planting malware on a site known to be visited by specific victims matches the definition of a watering hole attack.

Watering hole tactics specifically target sites trusted by a specific organization or demographic.

Key Concept

Watering Hole Attack Vector Identification

Estimated Time:1m 0s

Question 1670Question →

During a Business Impact Analysis (BIA), an enterprise security team defines a target timeframe of two hours to fully restore a critical application and its services after an unexpected server failure. Which of the following metrics best describes this targeted restoration timeframe?

Recovery Time Objective (RTO)

Recovery Point Objective (RPO)

Mean Time Between Failures (MTBF)

Mean Time to Repair (MTTR)

Show answer & explanation

Answer: Recovery Time Objective (RTO)

Answer

Recovery Time Objective (RTO)

The term Recovery Time Objective (RTO) represents the targeted duration of time and service level within which a business process must be restored after a disruption in order to avoid unacceptable consequences associated with a break in business continuity.

Step-by-Step Solution

Identify the key operational requirement described in the scenario.

The scenario requires establishing a target maximum timeframe (two hours) for restoring application availability following an outage.

Determining whether the constraint relates to service recovery time versus data loss helps select the appropriate BIA metric.

Map the requirement to standard Business Impact Analysis (BIA) definitions.

The targeted duration to bring systems back online corresponds to the Recovery Time Objective (RTO).

RTO focuses on service restoration timing, whereas RPO focuses on acceptable data loss timing.

Key Concept

Recovery Time Objective (RTO) vs. Recovery Point Objective (RPO)

Question 1671Question →

A financial services enterprise relies on a critical SaaS provider for processing customer transactions. To strengthen its third-party risk governance, the security team needs to establish continuous oversight to detect security posture changes between annual audit cycles without violating tenant boundaries. Which of the following technical and operational controls should the security team implement? (Select TWO.)

Select all that apply

Subscribe to third-party security rating services to dynamically monitor changes in the vendor's external attack surface and threat posture.

Deploy inline intrusion prevention system (IPS) appliances directly within the provider's physical cloud data center network.

Utilize a vendor risk management (VRM) platform to automate the ingestion and tracking of updated SOC 2 Type II attestation reports.

Substitute technical oversight by executing a Memorandum of Understanding (MOU) that guarantees zero operational security vulnerabilities.

Mandate root-level administrative access to the vendor's multi-tenant virtualization hypervisors to run internal vulnerability scans.

Show answer & explanation

Answer: Subscribe to third-party security rating services to dynamically monitor changes in the vendor's external attack surface and threat posture.; Utilize a vendor risk management (VRM) platform to automate the ingestion and tracking of updated SOC 2 Type II attestation reports.

Answer

The organization should subscribe to security rating services for external monitoring and utilize a vendor risk management platform to automate tracking of updated SOC 2 Type II attestations.

Effective third-party risk management requires ongoing oversight beyond annual point-in-time assessments. Subscribing to security rating services provides continuous external attack surface intelligence without disrupting operations. Concurrently, leveraging automated vendor risk management platforms guarantees prompt collection and analysis of updated third-party audit attestations, such as SOC 2 Type II reports.

Step-by-Step Solution

Identify non-intrusive continuous monitoring techniques suitable for third-party oversight.

Selected external security rating services (SRS) which continuously evaluate public posture (patching, DNS hygiene, exposed assets) without penetrating vendor systems.

Security rating services allow ongoing risk visibility between annual formal security reviews.

Evaluate continuous artifact ingestion mechanisms.

Selected automated vendor risk management (VRM) portal tracking for SOC 2 Type II reports.

SOC 2 Type II reports audit operational effectiveness over a historical period; automated VRM ingestion ensures newly published audit reports are reviewed promptly.

Filter out ineffective, overly intrusive, or boundary-violating options.

Eliminated physical IPS deployment, hypervisor root access demands, and replacing monitoring with an MOU.

Physical deployments and hypervisor credentials violate cloud boundaries, while MOUs are non-binding administrative documents.

Key Concept

Continuous Third-Party Risk Monitoring and Vendor Oversight

Question 1672Question →

A university research facility hosts a specialized data repository with an estimated Asset Value ( $AV$ ) of $\$600,000$ . Threat analysis indicates an Exposure Factor ( $EF$ ) of $25\%$ from potential unauthorized network intrusions, with an Annual Rate of Occurrence ( $ARO$ ) of $0.40$ . The security team proposes implementing an intrusion prevention system (IPS) that would reduce the $EF$ to $5\%$ and the $ARO$ to $0.10$ . What is the expected annual financial loss reduction achieved by deploying the IPS control?

\$57,000

\$60,000

\$3,000

\$147,000

Show answer & explanation

Answer: $\$57,000$

Answer

The expected annual financial loss reduction achieved by deploying the IPS control is

\$57,000

The initial Annual Loss Expectancy (

ALE

) is calculated as

AV \times EF \times ARO = \$600,000 \times 0.25 \times 0.40 = \$60,000

. The modified

ALE

after control deployment is

\$600,000 \times 0.05 \times 0.10 = \$3,000

. The annual financial loss reduction achieved by the control is the difference between the initial

ALE

and modified

ALE

, which equals

\$60,000 - \$3,000 = \$57,000

Step-by-Step Solution

Calculate the initial Single Loss Expectancy (

SLE_{initial}

) and initial Annual Loss Expectancy (

ALE_{initial}

SLE_{initial} = AV \times EF_{initial} = \$600,000 \times 0.25 = \$150,000

. Thus,

ALE_{initial} = SLE_{initial} \times ARO_{initial} = \$150,000 \times 0.40 = \$60,000

Determines the baseline expected annual risk impact before adding controls.

Calculate the post-control Single Loss Expectancy (

SLE_{modified}

) and post-control Annual Loss Expectancy (

ALE_{modified}

SLE_{modified} = AV \times EF_{modified} = \$600,000 \times 0.05 = \$30,000

. Thus,

ALE_{modified} = SLE_{modified} \times ARO_{modified} = \$30,000 \times 0.10 = \$3,000

Determines the expected residual annual risk impact after adding the IPS.

Compute the total annual financial loss reduction.

Loss Reduction

= ALE_{initial} - ALE_{modified} = \$60,000 - \$3,000 = \$57,000

Measures the net risk mitigation value delivered by the security control.

Key Concept

Quantitative Risk Assessment (ALE Calculation & Mitigation Value)

Question 1673Question →

An organization is preparing its annual compliance roadmap and needs to explain the purpose of external third-party security audits to executive leadership. Which of the following statements correctly describe key characteristics of an external third-party security audit? (Select TWO.)

Select all that apply

It provides independent, objective assurance of security controls to external stakeholders and regulators.

It evaluates operational and technical controls against an established compliance standard or audit framework.

It acts as an automated detective control designed to intercept and block malicious network traffic in real time.

It serves as a direct technical mitigation that automatically remediates host software vulnerabilities found during testing.

Show answer & explanation

Answer: It provides independent, objective assurance of security controls to external stakeholders and regulators.; It evaluates operational and technical controls against an established compliance standard or audit framework.

Answer

The statements correctly describing an external third-party security audit are that it provides independent, objective assurance of security controls to external stakeholders and regulators, and it evaluates operational and technical controls against an established compliance standard or audit framework.

External third-party security audits are defined by independent evaluations conducted by external assessors to provide objective verification to stakeholders and regulators. They evaluate an organization's existing controls against established standards or compliance frameworks.

Step-by-Step Solution

Identify the primary function of external security audits.

Recognize that external audits are conducted by independent auditors to provide objective assurance to outside parties such as clients and regulators.

Auditor independence is necessary to deliver unbiased verification.

Distinguish auditing activities from active security controls and vulnerability patching.

Understand that audits assess compliance against formal frameworks without acting as inline defense mechanisms or applying technical software fixes.

Audits report on security posture rather than functioning as operational security tools.

Key Concept

Key Characteristics of External Security Audits

Estimated Time:1m 0s

Question 1674Question →

An enterprise financial institution relies on a custom, proprietary fraud detection application supplied by a niche third-party software vendor. During an annual supply chain risk assessment, the security team identifies a major operational risk: if the software vendor unexpectedly faces insolvency, goes out of business, or fails to maintain the application, the institution will lose the ability to update or fix critical bugs in the software. Which of the following risk mitigation provisions should the security team implement in the vendor agreement to directly resolve this continuity risk?

A software escrow agreement requiring the vendor to deposit source code and build instructions with a neutral third party.

A service level agreement (SLA) establishing strict system uptime targets and financial remedies for unapproved downtime.

A business partner agreement (BPA) establishing shared financial liability and joint leadership oversight between both entities.

A non-disclosure agreement (NDA) containing strict confidentiality requirements and intellectual property protection terms.

Show answer & explanation

Answer: A software escrow agreement requiring the vendor to deposit source code and build instructions with a neutral third party.

Answer

A software escrow agreement requiring the vendor to deposit source code and build instructions with a neutral third party.

A software escrow agreement directly mitigates third-party vendor bankruptcy and abandonment risk. Under this arrangement, the software vendor deposits the application source code, compile instructions, and documentation with an independent third-party escrow agent. If the vendor goes out of business or fails to meet contractual maintenance obligations, the escrow agent releases the code to the customer, enabling them to maintain and operate the software independently.

Step-by-Step Solution

Analyze the specific supply chain risk described in the scenario.

The risk is operational disruption and loss of software maintenance capabilities due to potential vendor insolvency or business failure.

The organization depends on a custom proprietary application whose underlying source code is controlled exclusively by an external vendor.

Evaluate third-party contract types against the requirement to preserve source code availability.

A software escrow agreement places source code, build scripts, and documentation with a trusted neutral trustee to be released upon triggered events (e.g., bankruptcy or abandonment).

Escrow mechanisms preserve software maintenance rights for the buyer even if the original vendor goes out of business.

Differentiate software escrow from operational and confidentiality agreements.

SLAs, BPAs, and NDAs govern performance metrics, partnership terms, and secrecy respectively, but none provide source code release mechanisms upon vendor liquidation.

Standard legal agreements without escrow clauses leave the customer without legal or technical access to proprietary source code.

Key Concept

Software Escrow Agreements in Third-Party Risk Management

Question 1675Question →

A regional healthcare provider is performing a quantitative risk assessment for its web-based patient telemetry portal. The asset value ( $AV$ ) of the portal infrastructure is estimated at $\$800,000$ . A threat assessment projects that a web application breach occurs once every two years ( $ARO = 0.5$ ), with an estimated Exposure Factor ( $EF$ ) of $25\%$ per incident. To mitigate this risk, the organization evaluates a Web Application Firewall (WAF) service costing $\$30,000$ annually, which is expected to reduce the Exposure Factor to $5\%$ . Based on quantitative risk analysis principles, what is the net annual financial benefit of implementing this security safeguard?

\$50,000

\$80,000

\$130,000

\$110,000

Show answer & explanation

Answer: $\$50,000$

Answer

The net annual financial benefit of implementing the Web Application Firewall safeguard is

\$50,000

The net annual financial benefit of a safeguard is determined by calculating the difference between baseline Annual Loss Expectancy (

ALE_{baseline} = \$800,000 \times 0.25 \times 0.5 = \$100,000

) and modified Annual Loss Expectancy (

ALE_{modified} = \$800,000 \times 0.05 \times 0.5 = \$20,000

), then subtracting the annual cost of the control (

\$80,000 - \$30,000 = \$50,000

Step-by-Step Solution

Calculate baseline Single Loss Expectancy (SLE) and Annual Loss Expectancy (ALE) without the safeguard.

\text{Baseline SLE} = AV \times EF = \$800,000 \times 0.25 = \$200,000

;

\text{Baseline ALE} = \text{SLE} \times ARO = \$200,000 \times 0.5 = \$100,000

Establishing baseline annual risk cost is necessary before measuring safeguard value.

Calculate modified SLE and ALE with the safeguard in place.

\text{Modified SLE} = \$800,000 \times 0.05 = \$40,000

;

\text{Modified ALE} = \$40,000 \times 0.5 = \$20,000

Determines the projected annual risk cost after applying control mitigations.

Calculate the gross annual risk reduction and net benefit.

\text{ALE Reduction} = \$100,000 - \$20,000 = \$80,000

;

\text{Net Benefit} = \text{ALE Reduction} - \text{Safeguard Cost} = \$80,000 - \$30,000 = \$50,000

The true value of a safeguard subtracts its ongoing annual expense from the gross annual loss reduction.

Key Concept

Quantitative Risk Analysis & Net Value of Safeguards (ALE = SLE * ARO)

Question 1676Question →

A mid-sized financial technology firm is preparing for an upcoming regulatory inspection. To evaluate how effectively its security controls withstand a targeted cyberattack, executive leadership hires an independent third-party team to perform an assessment. The team is given zero prior knowledge of the company's internal infrastructure and is authorized to actively exploit discovered vulnerabilities to determine potential intrusion depth. Which of the following security evaluations is the organization conducting?

Black-box penetration test

Internal vulnerability assessment

Regulatory compliance audit

SOC 2 Type I attestation

Show answer & explanation

Answer: Black-box penetration test

Answer

The organization is conducting a black-box penetration test because the external team is granted no prior architectural knowledge and actively exploits vulnerabilities to test defensive posture.

The selection describing a black-box penetration test is correct because black-box exercises provide the assessment team with no prior information regarding target systems, forcing them to perform reconnaissance, vulnerability identification, and active exploitation in the same manner as an external adversary.

Step-by-Step Solution

Analyze the scope and information level provided to the testing team.

The team is given zero prior knowledge of internal systems, which characterizes a 'black-box' testing environment.

Black-box testing simulates an unknown external threat actor attempting to discover and breach network perimeters.

Differentiate between passive scanning and active exploitation in security testing.

The scenario highlights that testers are actively exploiting vulnerabilities to measure breach impact, confirming a penetration test rather than a vulnerability scan.

Vulnerability scans only identify potential weaknesses, whereas penetration tests validate exploitability and assess potential blast radius.

Distinguish active security testing from formal audit attestations.

Audits and attestations evaluate written policies, control designs, or operational evidence, unlike adversarial penetration exercises.

The scenario describes a simulated technical attack exercise rather than a formal policy or control framework audit.

Key Concept

Penetration Testing Methodologies vs. Vulnerability Assessments and Compliance Audits

Question 1677Question →

A system administrator configures a central Linux bastion host that allows external contractors to connect via SSH using public key cryptography. Access control policies successfully restrict contractors from accessing unapproved file directories or running root-level processes. However, during a post-incident review, security auditors discover that while login timestamps and initial connection attempts were recorded, there are no log records detailing the specific commands executed or configuration files modified by contractors during their active sessions. Which pillar of the AAA framework is deficient in this configuration?

Authentication

Accounting

Authorization

Perimeter Trust Verification

Show answer & explanation

Answer: Accounting

Answer

Accounting is the deficient pillar because it handles tracking, auditing, and logging of actions performed by authenticated users during their session.

Accounting is the pillar of AAA that maintains detailed log trails of actions, command history, file access, and resource consumption during an authenticated user's session. Since the organization failed to record command execution and configuration changes made by contractors, the accounting mechanism is deficient.

Step-by-Step Solution

Analyze the scenario requirements against the three pillars of AAA (Authentication, Authorization, Accounting).

Identified that SSH key identity verification functions correctly (Authentication) and access permissions restrict directory access (Authorization).

Separating functioning AAA controls isolates the missing functional requirement.

Evaluate the identified operational deficiency.

The system lacks detailed logging of specific commands executed and files modified during active sessions.

Session tracking and detailed command/audit logging fall directly under event recording.

Map the deficiency to the correct AAA pillar.

Accounting is responsible for audit logs, command tracking, session duration, and resource utilization monitoring.

Without audit logs detailing user actions, accounting controls are incomplete.

Key Concept

Authentication, Authorization, and Accounting (AAA) Framework

Estimated Time:1m 15s

Question 1678Question →

A security engineer is updating enterprise cryptographic standards across various operational systems. Match each cryptographic algorithm or mechanism on the left to its primary operational security capability on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Galois/Counter Mode (AES-GCM) pairs with authenticated encryption for bulk data confidentiality and integrity; Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) pairs with temporary session key negotiation for perfect forward secrecy; Password-Based Key Derivation Function 2 (PBKDF2) pairs with salting and repeated iterations for password cracking mitigation; SHA-256 HMAC pairs with secret-key hashing for origin authentication and payload integrity.

Each cryptographic primitive aligns strictly with its defined operational role: AES-GCM performs authenticated bulk encryption, ECDHE manages ephemeral key exchange for perfect forward secrecy, PBKDF2 performs key stretching to secure stored passwords, and SHA-256 HMAC provides keyed integrity and origin verification.

Step-by-Step Solution

Evaluate Galois/Counter Mode (AES-GCM)

Identified as an authenticated encryption cipher mode.

GCM mode pairs symmetric encryption with built-in authentication tag generation to achieve confidentiality and integrity simultaneously.

Evaluate Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)

Identified as an ephemeral key exchange protocol.

The ephemeral nature of ECDHE key generation ensures independent session keys, establishing perfect forward secrecy.

Evaluate Password-Based Key Derivation Function 2 (PBKDF2)

Identified as a password hashing and key stretching function.

PBKDF2 introduces salt and thousands of pseudorandom iterations to slow down dictionary and brute-force cracking attempts on stored credentials.

Evaluate SHA-256 HMAC

Identified as a keyed message authentication mechanism.

HMAC combines a shared secret key with the SHA-256 hash function to confirm message integrity and authenticate sender origin.

Key Concept

Cryptographic Primitives and Operational Capabilities

Estimated Time:1m 30s

Question 1679Question →

A newly established fintech firm is defining its formal security governance architecture to ensure consistent risk oversight across cloud services. Match each governance document type on the left with its corresponding operational characteristic on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Security Policy pairs with the high-level mandatory directive outlining security goals; Security Standard pairs with the mandatory requirement specifying technical controls and operational rules; Security Baseline pairs with the minimum mandatory operational configuration benchmark; Security Guideline pairs with the discretionary recommendation providing best practices.

The correct pairings accurately place documents in the governance hierarchy: Security Policy serves as the executive mandatory directive; Security Standard sets mandatory operational and technical rules; Security Baseline establishes the mandatory minimum configuration benchmark for target assets; and Security Guideline offers optional best-practice advice.

Step-by-Step Solution

Analyze the high-level authority tier of governance documentation.

Identify that overall organizational intent and high-level requirements form a Security Policy.

Policies establish top-down mandatory direction without defining implementation details.

Differentiate mandatory technical specs from mandatory configuration states.

Map specific required protocols and controls to Security Standards, and minimum system hardening thresholds to Security Baselines.

Standards dictate mandatory rules or tools, whereas baselines define the mandatory minimum secure state for system deployments.

Identify non-mandatory or discretionary advisory documentation.

Map recommended best practices to Security Guidelines.

Guidelines provide suggested approaches and flexibility rather than compulsory enforcement.

Key Concept

Security Governance Document Hierarchy and Enforcement Levels

Question 1680Question →

A security analyst investigates a SIEM alert triggered by a Network Traffic Analysis (NTA) sensor monitoring an internal enterprise workstation subnet. The flow log snippet displays the following sequential network events:

Based on the network security monitoring logs, which of the following actions should the analyst take first to address this threat?

Reconfigure the NTA sensor to act as an inline honeypot that actively drops all TCP port 445 traffic across the workstation subnet.

Isolate host 10.0.4.15 from the network to contain automated lateral movement reconnaissance.

Update perimeter edge firewall rules to block inbound TCP port 445 traffic from external internet addresses.

Document the alert as a detective control functioning to automatically block password brute-force attempts.

Show answer & explanation

Answer: Isolate host 10.0.4.15 from the network to contain automated lateral movement reconnaissance.

Answer

Isolate host 10.0.4.15 from the network to contain automated lateral movement reconnaissance.

The flow logs show host 10.0.4.15 initiating rapid TCP SYN connection requests on port 445 (SMB) across consecutive destination IP addresses. This pattern represents an internal IP sweep, commonly used by compromised hosts during lateral movement to discover network shares and active hosts. The immediate priority in network security operations is isolating the compromised source host to contain potential worm or ransomware spread.

Step-by-Step Solution

Analyze the log flow entries for patterns in source IP, destination IP, port, and TCP flags.

Identified host 10.0.4.15 attempting sequential TCP SYN connections to port 445 across multiple internal targets (192.168.1.50-53) within one second.

Sequential port/service probing from a single internal source indicates automated network reconnaissance/horizontal IP sweeping for vulnerable SMB services.

Determine the appropriate incident response containment action based on network monitoring findings.

Host 10.0.4.15 must be isolated immediately to prevent further lateral scanning or infection spreading across the enterprise network.

Network isolation stops compromised internal assets from discovering and exploiting neighboring systems via SMB.

Key Concept

Network Reconnaissance and Incident Containment

PreviousPage 84 / 112Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept