All practice questions

2232 questions

All types2,232 Multiple choice1,151 Multiple select509 Numeric21 Matching378 Ordering173

A financial institution is restructuring its cybersecurity governance framework to resolve ambiguities between executive mandates, operational requirements, and administrative duties. The Chief Information Security Officer (CISO) must clearly delineate the legal enforceability of document types and role responsibilities across the organization. Which of the following statements accurately characterize governance structures and policy hierarchy principles within an enterprise security framework? (Select TWO.)

Select all that apply

High-level security policies represent mandatory executive directives that establish organizational security objectives and define compliance expectations.

Security baselines specify mandatory minimum technical configuration standards that system administrators must enforce across specific operating environments.

Security guidelines act as mandatory operational checklists that internal auditors enforce to measure technical compliance across enterprise systems.

Technical data custodians retain ultimate business authority to establish data classification levels and accept risks associated with enterprise assets.

Security standards function as non-binding recommendations provided to software engineers to guide system configuration decisions.

Show answer & explanation

Answer: High-level security policies represent mandatory executive directives that establish organizational security objectives and define compliance expectations.; Security baselines specify mandatory minimum technical configuration standards that system administrators must enforce across specific operating environments.

Answer

Security policies are mandatory executive directives setting overarching organizational security goals, and security baselines establish mandatory minimum technical configuration requirements across systems.

High-level security policies serve as top-tier mandatory directives created by executive leadership to outline organizational goals and compliance bounds. Security baselines define mandatory minimum baseline settings and technical controls required to maintain consistent security postures across IT infrastructure.

Step-by-Step Solution

Analyze document enforceability levels in governance frameworks.

Identified high-level policies as mandatory executive directives and baselines as mandatory technical minimums.

Governance frameworks establish high-level policies to mandate security direction and baselines to enforce standardized technical controls.

Evaluate discretionary components versus mandatory rules.

Guidelines are discretionary recommendations, whereas standards and baselines are mandatory.

Mistaking guidelines or standards for non-binding recommendations misinterprets the policy hierarchy structure.

Distinguish data role responsibilities between data owners and data custodians.

Data owners authorize classification and risk acceptance; data custodians implement technical safeguarding controls.

Operational responsibilities must be segregated correctly to maintain proper data governance oversight.

Key Concept

Enterprise Policy Hierarchy and Governance Roles

Estimated Time:1m 30s

Question 1742Question →

A logistics firm plans to contract a third-party software vendor to manage its real-time route optimization platform. Prior to completing vendor onboarding, the security manager requires verifiable proof that the vendor's security controls have operated effectively throughout a sustained six-month evaluation period. Which of the following third-party documentation types best fulfills this requirement?

SOC 2 Type II report

SOC 2 Type I report

Vendor Security Assessment Questionnaire (VSAQ)

Service Level Agreement (SLA) performance log

Show answer & explanation

Answer: SOC 2 Type II report

Answer

SOC 2 Type II report

A System and Organization Controls (SOC) 2 Type II report provides independent third-party auditor verification regarding both the design and operational effectiveness of security controls over a designated testing period (typically 6 to 12 months). This directly aligns with the requirement for proof of sustained control operating performance.

Step-by-Step Solution

Identify the key third-party security assurance requirement in the scenario

The scenario calls for evidence confirming operating effectiveness of controls over a continuous six-month timeframe.

Assessing vendor risk requires distinguishing between point-in-time compliance attestations and continuous operational effectiveness.

Compare third-party assessment artifacts against the required monitoring duration

A SOC 2 Type II audit specifically involves auditor testing of security controls across an extended period (typically 6-12 months), fulfilling the requirement.

Point-in-time audits (Type I), self-assessments (VSAQ), and availability metrics (SLA logs) do not test sustained security control performance.

Key Concept

Third-Party Risk Assessment Artifacts and SOC Reporting

Question 1743Question →

A security architect is establishing cryptographic standards for an enterprise API service. The service requirements specify that past session communications must remain secure even if the server's long-term private key is compromised in the future. Additionally, incoming API requests must provide proof of origin and data integrity that cannot be denied by the sender. Which of the following cryptographic mechanisms should the architect implement to satisfy these security requirements? (Select TWO).

Select all that apply

Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) key exchange for session establishment

Asymmetric digital signatures attached to request payloads

SHA-256 cryptographic hashing alone applied to incoming payload data

Static RSA asymmetric encryption for bulk API payload encryption

Certificate Signing Request (CSR) generation for every incoming request

Show answer & explanation

Answer: Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) key exchange for session establishment; Asymmetric digital signatures attached to request payloads

Answer

The architect should implement Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) key exchange and asymmetric digital signatures attached to request payloads.

Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) key exchange provides Perfect Forward Secrecy (PFS) by generating unique key pairs for each session, preventing future key compromises from decrypting past traffic. Asymmetric digital signatures ensure data integrity and non-repudiation, guaranteeing that the request originated from the specified sender and was not altered in transit.

Step-by-Step Solution

Analyze the requirement for protecting past session communications against future private key compromise.

Identified the need for Perfect Forward Secrecy (PFS).

Perfect Forward Secrecy ensures that session keys are not derived from long-term secret keys. Ephemeral Diffie-Hellman key exchanges (such as ECDHE) generate temporary keys per session to achieve this.

Analyze the requirement for proof of origin and data integrity that cannot be denied by the sender.

Identified the need for non-repudiation and integrity verification.

Digital signatures combine hashing (for integrity) with asymmetric private key signing (for non-repudiation), ensuring the sender cannot deny creating the request.

Key Concept

Perfect Forward Secrecy and Digital Signatures

Question 1744Question →

A cloud services enterprise performs a Business Impact Analysis (BIA) for its core payment settlement microservice. The assessment establishes that data loss exceeding 15 minutes will cause catastrophic financial reconciliation errors, and overall system outage cannot exceed 4 hours before regulatory non-compliance fines occur. The engineering team deploys asynchronous database replication operating on a 5-minute sync interval and an automated failover system capable of restoring full application functionality within 30 minutes. Which statement correctly evaluates this technical recovery architecture against the established BIA metrics?

The 5-minute synchronization interval satisfies the 15-minute Recovery Point Objective (RPO), and the 30-minute failover time satisfies the Recovery Time Objective (RTO) within the 4-hour Maximum Tolerable Downtime (MTD).

The 5-minute synchronization interval defines a 5-minute Recovery Time Objective (RTO), while the 30-minute system failover duration establishes the Recovery Point Objective (RPO).

The 15-minute data loss threshold represents the system's Recovery Time Objective (RTO), whereas the 4-hour outage limit represents its Recovery Point Objective (RPO).

The automated failover system functions as a detective security control for monitoring downtime, whereas asynchronous replication operates as a deterrent control against data loss.

Show answer & explanation

Answer: The 5-minute synchronization interval satisfies the 15-minute Recovery Point Objective (RPO), and the 30-minute failover time satisfies the Recovery Time Objective (RTO) within the 4-hour Maximum Tolerable Downtime (MTD).

Answer

The option establishing that the 5-minute synchronization interval satisfies the 15-minute RPO and the 30-minute failover meets the RTO within the 4-hour MTD is correct. RPO represents acceptable data loss (15 minutes max required, 5 minutes achieved). RTO represents targeted recovery time (30 minutes achieved), which is safely beneath the MTD limit of 4 hours before severe business harm occurs.

Step-by-Step Solution

Identify the data loss parameter from the scenario.

The business allows a maximum of 15 minutes of lost transaction data.

Recovery Point Objective (RPO) dictates the maximum acceptable data loss measured in time back from the outage point.

Evaluate the technical replication mechanism against RPO.

Asynchronous database replication running every 5 minutes ensures data loss remains below the 15-minute RPO threshold.

Data loss in the worst-case failure scenario will not exceed 5 minutes of data, satisfying the 15-minute requirement.

Identify and compare the recovery time targets against maximum acceptable outage thresholds.

The 30-minute automated restoration capability (RTO) successfully falls within the 4-hour operational limit (MTD).

Recovery Time Objective (RTO) is the targeted system restoration timeframe, which must never exceed Maximum Tolerable Downtime (MTD).

Key Concept

Business Impact Analysis Metrics: RPO, RTO, and MTD Alignment

Estimated Time:2m 0s

Question 1745Question →

A security operations team is responding to a newly disclosed critical remote code execution vulnerability impacting enterprise database servers. To ensure operational stability while mitigating risk, what is the correct chronological sequence of steps the team should perform during this emergency patch deployment workflow?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with evaluating and testing the patch in a non-production staging environment, followed by submitting an emergency change request with a rollback plan to the Change Advisory Board (CAB). Once authorized, the patch is deployed to production database hosts during an approved window, and finally, credentialed scanning and baseline auditing are performed to confirm success.

The correct operational sequence follows structured patch and change management governance. Testing in a non-production environment occurs first to verify stability. Next, emergency CAB approval ensures stakeholder authorization and rollback readiness. The patch is then deployed to production, and post-deployment credentialed scanning verifies successful remediation without baseline drift.

Step-by-Step Solution

Stage and test the emergency patch in a non-production environment.

Identified potential application incompatibility and confirmed system stability before touching live systems.

Applying untested patches directly to production risks outage or service failure.

Obtain CAB approval with documented rollback procedures.

Emergency change request is authorized by stakeholders with an agreed contingency plan.

Change management policy mandates authorized approval and risk governance even during emergency windows.

Deploy the patch to production hosts during the maintenance window.

Vulnerability mitigation is applied across production target machines.

Execution must occur after validation and authorization within controlled timeframes.

Validate deployment via credentialed scanning and configuration baseline checks.

Confirmed successful vulnerability remediation and verified configuration compliance without drift.

Operational verification ensures the flaw is eliminated and no system settings were unintentionally altered.

Key Concept

Standard Emergency Patch Management Lifecycle and Governance Workflow

Estimated Time:1m 30s

Question 1746Question →

A healthcare technology company hosts its multi-tenant application on a cloud service provider's infrastructure. To satisfy client enterprise compliance requirements, the company must provide an independent auditor's report verifying that its security controls protecting customer data were appropriately designed and operated effectively throughout the preceding 12-month period. Which of the following compliance deliverables best satisfies this requirement?

SOC 2 Type II report

SOC 2 Type I report

SOC 1 Type II report

Vulnerability assessment report

Show answer & explanation

Answer: SOC 2 Type II report

Answer

SOC 2 Type II report

A SOC 2 Type II report provides independent attestation that an organization's security controls are properly designed and operated effectively over a defined evaluation timeframe (such as 6 to 12 months). This fulfills both the scope (security/confidentiality) and operational duration requirements.

Step-by-Step Solution

Determine the subject area required for the compliance report.

The requirement calls for evaluating data protection and security controls, pointing toward a SOC 2 audit focusing on Trust Services Criteria (Security, Confidentiality) rather than financial reporting controls evaluated under SOC 1.

SOC 2 reports specifically cover security, availability, processing integrity, confidentiality, and privacy controls.

Evaluate the timeframe requirement specified in the scenario.

The client requires proof of operational effectiveness over a continuous 12-month period.

Type II reports test and verify operational effectiveness across a defined monitoring period (e.g., 6 to 12 months), whereas Type I reports only verify control design at a single point in time.

Key Concept

SOC 2 Type II Attestation Reports

Estimated Time:1m 15s

Question 1747Question →

A security analyst receives a high-severity report from an unauthenticated network-based vulnerability scan indicating that several internal Linux servers are susceptible to a critical remote code execution vulnerability in OpenSSL. However, local patch management logs confirm that all vendor-issued security updates were applied earlier that week. Which of the following is the most appropriate action for the analyst to take to verify whether the servers are genuinely vulnerable?

Perform a credentialed scan on the servers to inspect installed package versions directly.

Implement an inline network firewall rule blocking inbound port 443 traffic to mitigate potential exploitation.

Deploy a honeypot within the server subnet to inline-block incoming exploit payloads.

Modify the SIEM correlation rules to suppress high-severity alerts related to OpenSSL vulnerabilities.

Show answer & explanation

Answer: Perform a credentialed scan on the servers to inspect installed package versions directly.

Answer

Perform a credentialed scan on the servers to inspect installed package versions directly.

Unauthenticated network scans rely primarily on banner grabbing, which inspects remote service version headers. Many Linux distributions backport security fixes into existing package versions without incrementing the main software version banner, leading unauthenticated scanners to report false positives. Conducting a credentialed scan grants host-level access to query the package manager directly, accurately verifying whether the patch has been applied.

Step-by-Step Solution

Analyze the cause of discrepancy between the scan report and patch management records.

Unauthenticated network scans rely on service banner grabbing, which often produces false positives when operating system vendors backport security fixes without changing the primary software version banner.

Identifying why unauthenticated scans misidentify vulnerabilities is necessary to choose the correct verification method.

Determine the appropriate scanning methodology to accurately verify patch status.

Credentialed (authenticated) scanning enables the vulnerability scanner to log into the target operating system and audit local package databases or software registries directly.

Host-level verification provides definitive evidence of installed security patches without relying on external network banners.

Key Concept

Credentialed vs. Uncredentialed Vulnerability Scanning and False Positive Resolution

Question 1748Question →

Match each enterprise security incident scenario on the left with the corresponding social engineering attack vector or technique on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The correct pairings match: (1) USB drives left in the cafeteria to Baiting; (2) Fictional compliance auditor identity requesting access to Pretexting; (3) Intercepting supplier wire payment details to Invoice Switching; and (4) Highly targeted email aimed at the CEO to Whaling.

Each attack vector is correctly identified by evaluating its delivery channel, target profile, and deception technique: Baiting uses physical curiosity triggers; Pretexting uses a crafted false persona; Invoice Switching alters legitimate transaction details; and Whaling specifically targets high-ranking executives.

Step-by-Step Solution

Analyze the physical media scenario (cafeteria USB drives)

Identified as Baiting, which relies on offering an appealing item (curiosity hook) to entice a victim into executing malware.

Baiting relies on physical or digital promises that exploit curiosity or greed.

Analyze the identity fraud scenario (fake auditor calling HR)

Identified as Pretexting, which involves inventing a believable context or role to manipulation individuals into surrendering information.

Pretexting requires establishing a fictional background story and role prior to requesting sensitive access.

Analyze the payment detail tampering scenario (modifying vendor bank info)

Identified as Invoice Switching, where legitimate transactional data is modified to divert money.

Invoice switching explicitly targets financial workflows by modifying beneficiary banking details.

Analyze the high-level executive targeting scenario (email to CEO)

Identified as Whaling, a specialized subcategory of spear phishing directed specifically at C-suite personnel.

Phishing attempts specifically aimed at senior leadership or high-value targets are categorized as whaling.

Key Concept

Social Engineering Attack Classification

Question 1749Question →

A security administrator discovers that members of the financial operations team are being targeted by fraudulent wire transfer requests disguised as emails from executive leadership. Which of the following represents the most effective human risk management control to mitigate this threat?

Conducting role-based security training focused on out-of-band transaction verification procedures

Deploying network firewalls to filter database query traffic

Reclassifying the enterprise security policy as a deterrent physical control

Providing mandatory training on identifying voice-based vishing over mobile phones

Show answer & explanation

Answer: Conducting role-based security training focused on out-of-band transaction verification procedures

Answer

Conducting role-based security training focused on out-of-band transaction verification procedures

Role-based security awareness training provides targeted instruction tailored to specific job responsibilities. For employees handling financial transfers, training them on out-of-band verification (confirming requests through a separate, trusted channel) directly addresses human risk associated with Business Email Compromise (BEC) attacks.

Step-by-Step Solution

Analyze the threat vector described in the scenario

Identified a Business Email Compromise (BEC) attack targeting financial staff via spoofed executive emails.

Understanding the specific attack vector is essential to selecting an appropriate control.

Evaluate human risk mitigation options

Selected role-based security awareness training that addresses the specific business process (wire transfers) and emphasizes out-of-band verification.

General or mismatched training does not build the specific operational safeguards needed by high-risk job roles.

Key Concept

Role-Based Security Awareness Training

Question 1750Question →

An organization updates its enterprise defense baseline to satisfy compliance requirements. As part of this initiative, the security team deploys an inline Network Intrusion Prevention System (NIPS) to automatically drop unauthorized network traffic, and publishes an updated Acceptable Use Policy (AUP) mandating clean desk and screen lock procedures for all staff members.

Which of the following statements correctly classify these security controls according to CompTIA Security+ categories and functional types? (Select TWO.)

Select all that apply

The inline NIPS is classified as a technical category control with a preventive functional type.

The inline NIPS is classified as an operational category control with a detective functional type.

The Acceptable Use Policy is classified as a managerial category control with a directive functional type.

The Acceptable Use Policy is classified as a physical category control with a compensating functional type.

Show answer & explanation

Answer: The inline NIPS is classified as a technical category control with a preventive functional type.; The Acceptable Use Policy is classified as a managerial category control with a directive functional type.

Answer

The inline Network Intrusion Prevention System (NIPS) is a technical category control with a preventive functional type, and the Acceptable Use Policy (AUP) is a managerial category control with a directive functional type.

The inline Network Intrusion Prevention System (NIPS) relies on software and hardware mechanisms to automatically inspect and drop unauthorized traffic before it breaches the perimeter, classifying it as a technical control with a preventive functional type. The Acceptable Use Policy (AUP) is an administrative document created by leadership to mandate user behavior and compliance, classifying it as a managerial control with a directive functional type.

Step-by-Step Solution

Analyze the inline NIPS mechanism.

It relies on hardware/software technology to function (Technical category) and actively stops unauthorized packets before entering the network (Preventive type).

Technical controls execute via automated hardware/software logic, while preventive controls actively inhibit security policy violations.

Analyze the Acceptable Use Policy (AUP).

It is an administrative governance document established by leadership (Managerial category) that mandates required employee compliance and behavior (Directive type).

Managerial controls focus on policy, oversight, and governance, while directive controls instruct individuals on mandatory operational practices.

Key Concept

Classification of security mechanisms by primary category (technical, managerial, operational, physical) and functional type (preventive, detective, corrective, deterrent, compensating, directive).

Question 1751Question →

Match each regulatory framework or standard to its primary compliance mandate.

Click a left item, then click its matching right item

Show answer & explanation

Answer

PCI DSS matches cardholder data protection; HIPAA matches Protected Health Information (PHI) safeguards; GDPR matches EU personal data privacy rights; SOX matches corporate financial reporting and internal audit controls.

Each regulatory framework targets a distinct sector or data classification: PCI DSS protects cardholder data, HIPAA protects healthcare PHI, GDPR protects EU personal privacy rights, and SOX regulates public company financial accounting and audit logging.

Step-by-Step Solution

Identify the primary domain governed by PCI DSS.

PCI DSS focuses specifically on securing payment card transactions and credit/debit cardholder data.

Merchants and payment gateways must comply with PCI DSS to prevent payment fraud.

Identify the primary focus of HIPAA.

HIPAA establishes privacy and security rules for medical records and health data (PHI).

Healthcare providers must secure patient data under US federal regulations.

Identify the scope of GDPR.

GDPR governs privacy, consent, and rights regarding personal data for EU data subjects.

It applies broadly to any entity processing personal data of EU residents.

Identify the mandate of SOX.

SOX regulates financial record integrity, log retention, and internal auditing for publicly traded corporations.

It prevents accounting fraud and ensures transparency in corporate disclosures.

Key Concept

Regulatory Framework Mandates and Compliance Data Scope

Question 1752Question →

Match each Business Impact Analysis (BIA) metric or continuity planning parameter with its corresponding operational description.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Work Recovery Time (WRT) matches system validation and process restoration duration; Maximum Tolerable Downtime (MTD) matches the total upper limit of tolerable business disruption; Recovery Point Objective (RPO) matches maximum acceptable data loss timeframe; Mean Time Between Failures (MTBF) matches component operational reliability between breakdowns.

Each business continuity metric serves a distinct purpose in a BIA: Work Recovery Time (WRT) covers business validation and process resumption post-technical recovery; Maximum Tolerable Downtime (MTD) sets the overarching threshold for enterprise viability; Recovery Point Objective (RPO) dictates acceptable data loss measured back in time; and Mean Time Between Failures (MTBF) measures hardware component reliability.

Step-by-Step Solution

Analyze data loss parameters

Identify RPO as the metric measuring acceptable data loss measured backwards in time.

RPO sets backup frequency requirements based on how much transactional data the business can afford to lose.

Distinguish between infrastructure recovery and business process recovery

Identify WRT as the period focused on post-RTO verification, testing, and business workflow restoration.

Technical restoration (RTO) brings infrastructure online, but WRT is required to ensure data integrity and operational readiness.

Evaluate total outage limits

Identify MTD as the overarching limit representing the point of irreversible enterprise damage.

MTD acts as the sum envelope (

MTD \geq RTO + WRT

) beyond which business survival is compromised.

Assess hardware reliability metrics

Identify MTBF as the metric predicting hardware longevity between failure events.

MTBF evaluates system component durability to determine maintenance cycles and redundancy needs.

Key Concept

Business Impact Analysis Metrics and Recovery Parameters

Question 1753Question →

Match each security audit, assessment, or attestation deliverable with its primary operational scope and objective.

Click a left item, then click its matching right item

Show answer & explanation

Answer

SOC 1 Type II Report matches with financial reporting internal control evaluation over a period of time; ISO/IEC 27001 Certification matches with international ISMS compliance certification; Penetration Testing Assessment matches with proof-of-concept exploitation of technical vulnerabilities; PCI DSS Attestation of Compliance (AoC) matches with credit card data handling compliance validation.

Each deliverable serves a specific audit objective: SOC 1 Type II verifies internal controls related to financial reporting over a defined period; ISO/IEC 27001 certifies the enterprise ISMS against global standards; Penetration testing demonstrates active exploitability of technical vulnerabilities; PCI DSS AoC validates compliance with cardholder data protection requirements.

Step-by-Step Solution

Analyze the financial reporting aspect of SOC reports

Identify that SOC 1 specifically targets internal controls impacting financial reporting, with Type II covering a historical testing period.

SOC 1 is distinct from SOC 2 (trust services criteria) and focuses solely on financial controls.

Differentiate management system certifications from technical testing deliverables

Map ISO/IEC 27001 to formal ISMS certification and Penetration Testing to active technical vulnerability exploitation.

ISO 27001 evaluates holistic governance frameworks, whereas penetration testing evaluates dynamic technical defenses.

Identify cardholder data regulatory requirements

Link the PCI DSS Attestation of Compliance (AoC) to payment card security validation.

PCI DSS specifically governs entities processing, storing, or transmitting credit card information.

Key Concept

Distinguishing between security audit deliverables, attestations, and assessment methodologies based on scope and purpose.

Question 1754Question →

Following an application security review, a Chief Information Security Officer (CISO) discovers that engineering teams are utilizing inconsistent cryptographic configurations across microservices. To resolve this, the CISO needs to issue a mandatory document that establishes explicit, uniform technical requirements—such as requiring AES-256 for data at rest and TLS 1.3 for data in transit—without specifying step-by-step execution workflows or platform-specific OS images. Which governance document type should the CISO publish to meet these requirements?

Security standard

Security guideline

Security baseline

Security procedure

Show answer & explanation

Answer: Security standard

Answer

Security standard

A security standard is a mandatory governance document that specifies explicit, uniform technical requirements, controls, and configurations (such as designated cryptographic algorithms like AES-256 and protocol versions like TLS 1.3) that all teams must follow.

Step-by-Step Solution

Analyze the requirements set forth by the CISO in the scenario.

The document must be mandatory and specify concrete technical rules (AES-256 and TLS 1.3) across systems without providing step-by-step procedures or OS-specific configurations.

Identifying the enforcement level and scope is critical to distinguishing between governance document types.

Evaluate each document type against the governance hierarchy characteristics.

Standards set mandatory technical controls and protocols. Guidelines are advisory. Baselines define minimum platform-specific hardening states. Procedures outline step-by-step implementation tasks.

Comparing document definitions isolates the exact document matching mandatory technical rules.

Select the governance document that enforces mandatory technical criteria across applications.

A security standard accurately fits mandatory cryptographic requirement specifications.

Security standards bridge high-level policy mandates and operational execution by stipulating mandatory technical parameters.

Key Concept

Security Standards within Governance Frameworks

Estimated Time:1m 15s

Question 1755Question →

An enterprise security team discovers that several Linux application servers frequently deviate from established security baselines following system maintenance. Local administrators have been making manual configuration edits directly on production instances to resolve immediate service issues, bypassing the organization's deployment pipeline. Which of the following strategies best addresses this configuration drift while ensuring all future changes adhere to baseline security standards?

Implement an automated configuration management system using infrastructure-as-code and version control, where all approved baseline changes are deployed centrally and unauthorized local modifications are automatically overwritten.

Deploy network perimeter firewall rules to restrict administrative management access to local physical console connections during maintenance windows.

Reclassify the configuration baseline rules as detective security controls within the SIEM to log unauthorized modifications without taking corrective action.

Suspend automated patch management updates on production servers to prevent software vendor updates from overriding local system configuration settings.

Show answer & explanation

Answer: Implement an automated configuration management system using infrastructure-as-code and version control, where all approved baseline changes are deployed centrally and unauthorized local modifications are automatically overwritten.

Answer

Centralized automated configuration management utilizing Infrastructure as Code (IaC) ensures that security baselines are consistently maintained across all enterprise servers. By committing changes to version control and running automated enforcement, any manual modifications made directly on production nodes are detected and automatically overwritten to maintain baseline integrity.

Step-by-Step Solution

Identify the root cause of the security failure.

System administrators are making manual configuration changes directly on production systems, causing configuration drift from baseline standards.

Manual changes bypass change tracking and automated enforcement mechanisms.

Evaluate remediation strategies against configuration management objectives.

Automated configuration management tools paired with version control enforce consistent baselines across all servers.

Automated tools continuously monitor systems and automatically revert unapproved local alterations to maintain security hardening.

Key Concept

Configuration Drift and Automated Baseline Enforcement

Question 1756Question →

During a security monitoring shift, an analyst reviews the following alert log snippet generated by a perimeter Network Intrusion Detection System (NIDS) inspecting traffic directed at an internal web application server:

[ALERT] 2026-07-27 14:12:08 UTC - NIDS-Rule-90421
Src: 198.51.100.44:48210 -> Dst: 172.16.10.15:443
Payload snippet: POST /catalog/search HTTP/1.1
Body: item=widget' UNION SELECT username, password_hash FROM user_credentials--

Based on this alert payload and monitoring data, which of the following correctly identifies the attack type and the appropriate analyst action?

Identify the attack as SQL Injection (SQLi) aimed at extracting backend database records, and initiate containment by blocking the source IP or reviewing backend query logs.

Identify the attack as Cross-Site Scripting (XSS) designed to execute client-side scripts in user browsers, and update Content Security Policy (CSP) headers.

Classify the NIDS alert as a failure of a preventive control because the NIDS did not automatically block and drop the incoming TCP connection inline.

Mitigate the vulnerability by implementing network perimeter firewall rules that permanently block inbound traffic on port 443.

Show answer & explanation

Answer: Identify the attack as SQL Injection (SQLi) aimed at extracting backend database records, and initiate containment by blocking the source IP or reviewing backend query logs.

Answer

Identify the attack as SQL Injection (SQLi) aimed at extracting backend database records, and initiate containment by blocking the source IP or reviewing backend query logs.

The alert payload explicitly shows SQL commands ('UNION SELECT... FROM user_credentials') injected into an HTTP POST request parameter. This confirms a SQL injection attack targeting backend database confidentiality. Because a NIDS is a detective monitoring control, alerting security analysts to initiate containment (such as IP blocks or database log analysis) is the appropriate operational response.

Step-by-Step Solution

Analyze the NIDS alert payload snippet

The string 'UNION SELECT username, password_hash FROM user_credentials--' contains SQL keywords intended to append queries to backend database calls.

Recognizing database manipulation syntax isolates the vector as a server-side SQL injection attempt rather than a client-side execution attempt.

Differentiate network security monitoring control functions

Confirm that NIDS serves as a detective monitoring tool that generates alerts rather than actively dropping inline traffic like a NIPS.

Analyst triage requires understanding tool capabilities to determine manual vs automated response steps.

Select effective incident response triage actions

Block the originating external IP address and inspect database execution logs to confirm if any data exfiltration succeeded.

Targeted IP containment and targeted log correlation mitigate threat progression without shutting down necessary application ports.

Key Concept

NIDS Log Payload Analysis and Incident Identification

Estimated Time:1m 30s

Question 1757Question →

During a disaster recovery simulation for a financial institution's core transaction system, a database storage array failure occurred. Technical teams completed failover operations and declared the transaction service operational $3$ hours after the initial outage. Transaction records were restored from log backups up to $10$ minutes prior to the failure. The organization's Business Impact Analysis (BIA) established a Recovery Time Objective (RTO) of $2$ hours, a Recovery Point Objective (RPO) of $15$ minutes, and a Maximum Tolerable Downtime (MTD) of $5$ hours. Based on these operational recovery metrics, which assessment accurately describes the outcome of this exercise?

The exercise satisfied the RPO target but failed to meet the established RTO target.

The exercise satisfied the RTO target but failed to meet the established RPO target.

The exercise failed both the RPO target and the MTD target.

The exercise breached the MTD target while successfully satisfying the RTO target.

Show answer & explanation

Answer: The exercise satisfied the RPO target but failed to meet the established RTO target.

Answer

The exercise satisfied the RPO target but failed to meet the established RTO target.

The correct assessment is that the exercise satisfied the RPO target but failed to meet the established RTO target. Recovery Point Objective (RPO) dictates the maximum acceptable data loss timeframe prior to an outage; because database logs were restored to a point 10 minutes before failure, the 10-minute actual data loss fell within the 15-minute RPO threshold. Recovery Time Objective (RTO) dictates the targeted maximum duration for restoring systems; because technical failover required 3 hours, the recovery exceeded the 2-hour RTO limit. The 3-hour downtime remained within the 5-hour Maximum Tolerable Downtime (MTD) ceiling.

Step-by-Step Solution

Evaluate the Recovery Point Objective (RPO) performance

Actual data loss was

10

minutes, which is less than or equal to the allowable RPO limit of

15

minutes (

10\text{ min} \le 15\text{ min}

RPO defines the maximum acceptable timeframe of data loss measured in time prior to the disruption.

Evaluate the Recovery Time Objective (RTO) performance

Actual recovery time was

3

hours, which exceeds the allowable RTO limit of

2

hours (

3\text{ hrs} > 2\text{ hrs}

RTO defines the target duration of time within which a business process or IT infrastructure must be restored after a disruption.

Evaluate the Maximum Tolerable Downtime (MTD) performance

Actual total downtime of

3

hours was within the overall MTD limit of

5

hours (

3\text{ hrs} \le 5\text{ hrs}

MTD represents the absolute maximum duration a business function can be unavailable before irreversible damage occurs.

Synthesize the metric evaluations to form the overall assessment

RPO was satisfied (

10\text{ min} \le 15\text{ min}

), RTO was failed/breached (

3\text{ hrs} > 2\text{ hrs}

), and MTD was not breached (

3\text{ hrs} \le 5\text{ hrs}

Comparing each actual result against its defined BIA threshold reveals that RPO passed while RTO failed.

Key Concept

Business Impact Analysis (BIA) Metrics: RTO vs RPO vs MTD

Estimated Time:2m 0s

Question 1758Question →

A company is enhancing its human risk management efforts to better prepare employees against social engineering threats. Which of the following initiatives directly support an effective security awareness program? (Select TWO.)

Select all that apply

Delivering targeted micro-learning modules to employees immediately following a policy compliance oversight

Establishing simple, non-punitive escalation channels for personnel to report potential security concerns

Configuring network intrusion prevention rules to isolate workstations that access unauthorized web domains

Mandating daily password rotations for all staff to prevent credential harvesting attacks

Show answer & explanation

Answer: Delivering targeted micro-learning modules to employees immediately following a policy compliance oversight; Establishing simple, non-punitive escalation channels for personnel to report potential security concerns

Answer

The correct initiatives are delivering targeted micro-learning modules immediately following policy oversights and establishing simple, non-punitive escalation channels for reporting suspicious activities.

Delivering targeted micro-learning immediately after a user mistake provides timely education that reinforces security policy, while non-punitive reporting pathways foster an open culture that encourages prompt escalation of suspicious activity.

Step-by-Step Solution

Identify the primary objective of human risk management and security awareness programs.

Recognize that human risk management focuses on modifying user behavior, encouraging reporting, and reinforcing security habits.

Security awareness targets human behavior rather than relying solely on automated technical enforcement.

Evaluate the choices to distinguish human awareness strategies from technical controls.

Select contextual micro-learning and non-punitive reporting mechanisms while excluding technical IPS filtering and counterproductive password rules.

Timely training feedback and easy reporting empower staff as effective security sensors.

Key Concept

Security Awareness Programs and Human Risk Management

Question 1759Question →

A medical imaging clinic based in the United States plans to migrate its patient diagnostic archives to a third-party cloud storage and analytics platform. The archives contain sensitive Protected Health Information (PHI). Before transmitting any data to the cloud service provider, which mandatory legal agreement or compliance instrument must the chief information security officer (CISO) execute to satisfy Health Insurance Portability and Accountability Act (HIPAA) regulatory requirements?

A Service Level Agreement (SLA) specifying 99.99% uptime guarantees and high-availability disaster recovery metrics.

A Business Associate Agreement (BAA) contractually binding the provider to implement required HIPAA security safeguards.

A Payment Card Industry Data Security Standard (PCI DSS) Attestation of Compliance (AoC) for the cloud repository.

Standard Contractual Clauses (SCCs) authorizing cross-border personal data transfers under European privacy directives.

Show answer & explanation

Answer: A Business Associate Agreement (BAA) contractually binding the provider to implement required HIPAA security safeguards.

Answer

Executing a Business Associate Agreement (BAA) contractually binding the cloud provider to implement required HIPAA security safeguards is the mandatory compliance requirement.

Under HIPAA regulatory rules, when a covered entity (such as a medical imaging clinic) utilizes a third-party vendor to store or process Protected Health Information (PHI), the parties must enter into a formal Business Associate Agreement (BAA). The BAA legally obligates the vendor to maintain appropriate administrative, physical, and technical security controls and report any security incidents or data breaches.

Step-by-Step Solution

Identify the data classification and applicable regulatory scope in the scenario.

The scenario specifies patient diagnostic archives containing Protected Health Information (PHI) operated by a US medical imaging clinic, placing the organization under HIPAA regulation.

Regulatory compliance mandates depend directly on data type and jurisdiction.

Determine the third-party relationship and legal obligations under HIPAA.

The cloud storage vendor acts as a 'Business Associate' because it processes and stores PHI on behalf of a 'Covered Entity' (the clinic).

HIPAA rules require covered entities to obtain satisfactory assurances that business associates will appropriately safeguard PHI.

Select the correct legal instrument required prior to data disclosure.

Executing a formal Business Associate Agreement (BAA) satisfies HIPAA requirements by legally binding the vendor to administrative, physical, and technical safeguards.

Without a signed BAA in place, transmitting PHI to a third-party cloud provider constitutes an illegal disclosure under HIPAA rules.

Key Concept

HIPAA Business Associate Agreements (BAA) for Third-Party Vendors

Question 1760Question →

An organization is evaluating its third-party risk management governance framework to ensure proper compliance, software oversight, and vendor auditability. Match each third-party documentation artifact or agreement to its primary security function.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Data Processing Agreement (DPA) matches with personal data processing compliance mandates; Software Bill of Materials (SBOM) matches with the nested inventory of software dependencies; SOC 3 Report matches with the publicly distributable executive summary of security controls; Supply Chain Risk Management (SCRM) Plan matches with the strategies for mitigating hardware tampering and supplier disruptions.

Each artifact correctly aligns with its specialized third-party risk oversight role: DPAs govern data privacy, SBOMs disclose software code components, SOC 3 reports serve as public attestations of security posture, and SCRM plans manage physical supply chain and hardware risks.

Step-by-Step Solution

Analyze the legal and privacy requirements for third-party data processing.

Identify that the Data Processing Agreement (DPA) governs third-party data protection responsibilities.

DPAs are legally binding addendums required for privacy regulation compliance when personal data is processed by vendors.

Evaluate component visibility in modern software supply chains.

Map the Software Bill of Materials (SBOM) to the structural list of software dependencies and open-source packages.

An SBOM gives organizations transparency into embedded software components and potential vulnerabilities.

Differentiate between audit reports meant for confidential operational review versus public distribution.

Associate the SOC 3 Report with the general executive summary intended for public distribution.

Unlike SOC 2, SOC 3 reports omit confidential technical details so they can be freely distributed to prospective clients.

Examine risk strategies aimed at physical components, procurement lines, and vendor logistics.

Link the Supply Chain Risk Management (SCRM) Plan to hardware provenance, counter-tampering, and supplier continuity.

SCRM plans specifically address systemic risks in hardware acquisition, counterfeit parts, and logistics pathways.

Key Concept

Third-Party Risk Management and Supply Chain Oversight

PreviousPage 88 / 112Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept