All practice questions

A medical clinic operating within the United States is updating its electronic health record system to store and transmit patient diagnostic reports and treatment histories. Which of the following regulatory frameworks specifically mandates safeguards to protect the privacy and security of this protected health information (PHI)?

A logistics enterprise operates a cloud-hosted fleet dispatch platform valued at an Asset Value ($AV$) of $\$750,000$. A quantitative risk assessment reveals that a zero-day exploit could result in an Exposure Factor ($EF$) of $40\%$. Threat data establishes an Annual Rate of Occurrence ($ARO$) of $0.25$. Implementing a managed threat prevention control costs $\$20,000$ annually and is expected to reduce the $EF$ to $10\%$. What is the net annual financial benefit of implementing this security control?

A Security Operations Center (SOC) analyst receives a high-severity alert from a Network Intrusion Detection System (NIDS) monitoring outbound traffic from an internal corporate network segment. The log entry details are shown below:

`[2026-07-27 14:15:02] ALERT: ICMP_LARGE_PAYLOAD_ECHO | Src: 192.168.10.45 | Dst: 203.0.113.88 | Length: 1450 bytes | Rate: 1200 pkts/min | Payload_Header: 504b0304 (PK..)`

Based on this network security monitoring alert, which of the following conclusions and immediate response steps are most appropriate? (Select TWO.)

An enterprise is establishing a dedicated network link with a third-party logistics partner to facilitate real-time inventory database synchronization. Which of the following documents should the security team require to specifically define the technical security controls, communication protocols, and data encryption standards for this direct system-to-system connection?

Following an enterprise acquisition, a security architecture team must unify server hardening requirements across newly merged cloud and legacy data center environments. The team needs to publish a mandatory document specifying exact, minimum technical configuration thresholds—such as disabled network daemons, specific kernel audit flags, and minimum cryptographic cipher suites—that every server image must meet prior to production provisioning. Which of the following document types best fulfills this operational requirement?

An industrial control system (ICS) security engineering team requires an automated, standardized mechanism to continuously ingest machine-readable tactical indicators of compromise (IoCs) directly into their Security Orchestration, Automation, and Response (SOAR) platform from external sector peers. Which of the following intelligence standards and transport protocol combinations best satisfies this operational requirement?

A security architect is designing a multi-tenant enterprise environment hosted on shared physical hardware. The corporate compliance policy requires strict hardware-enforced memory separation and workload isolation between high-risk third-party microservices and sensitive internal data systems to prevent kernel-level privilege escalation attacks. Which of the following deployment architectures BEST satisfies this security requirement?

A security analyst reviews web application logs and observes client-side script payloads, such as `<script>document.cookie</script>`, submitted through an unvalidated search input and subsequently executed within victim browser sessions. Which of the following application vulnerabilities is present?

An enterprise security architect is aligning network isolation mechanisms with specific high-assurance business requirements across diverse deployment environments. Match each network segmentation approach on the left with its defining architectural implementation requirement on the right.

A security engineer is hardening an internal enterprise environment following an incident where an adversary established initial access on an administrative endpoint, extracted LSASS memory credentials, and executed lateral movement using unencrypted Server Message Block (SMB) sessions across internal network segments. Which TWO of the following enterprise host hardening strategies would most effectively mitigate these lateral movement techniques?

An administrator is designing a multi-tiered secure network path to allow external management traffic to reach a critical database server. Arrange the network segments in the correct order that incoming administration traffic must traverse, starting from the least secure network segment to the most secure network segment.

A security administrator is evaluating deployment options for an enterprise application hosted on a shared physical server. The organization requires full hardware abstraction and distinct operating system kernels for each workload to ensure complete isolation between tenants. Which of the following virtualization or containerization technologies best meets this requirement?

During an incident response investigation on an enterprise network operating an IPv4 infrastructure, security analysts observe unauthorized traffic redirection affecting internal hosts. Network packet captures reveal an influx of unsolicited ICMPv6 Type 134 messages broadcast across the local subnet containing a Router Preference flag set to 'High' and pointing DNS recursive server options to an untrusted external link-local address. Which network attack indicator is demonstrated in this scenario?

A biomedical research facility hosts legacy laboratory automation equipment running unpatchable operating systems. The facility must export real-time telemetry data from these legacy systems to an internal analytics data lake while simultaneously granting temporary remote access to an off-site maintenance vendor. Which of the following network architecture designs best isolates the legacy equipment while enabling these required operational functions?

A bio-pharmaceutical consortium deploys a joint machine learning analytics platform hosted within a Community Cloud environment shared exclusively among vetted research institutions. Under the cloud shared responsibility model, which of the following operational tasks is strictly the sole responsibility of each participating research organization?

A security operations team at a healthcare research organization is analyzing a long-term intrusion targeting proprietary patient genetic databases. The adversary demonstrated advanced capabilities by leveraging custom zero-day exploits, operating stealthily across multiple months without deploying ransomware or causing service disruptions. Which of the following attributes and motivations are most characteristic of this specific threat actor profile? (Select TWO.)

During a security assessment of a C-based binary processing service, an engineer analyzes the following code snippet responsible for dynamic memory allocation:

`unsigned int total_size = header_size + payload_size;`
`char *buffer = (char *)malloc(total_size);`
`memcpy(buffer, header_data, header_size);`
`memcpy(buffer + header_size, payload_data, payload_size);`

During testing, an input with $header\_size = 0xFFFFFFFF$ ($4,294,967,295$) and $payload\_size = 0x00000010$ ($16$) causes the `total_size` variable to wrap around to $0x0000000F$ ($15$ bytes). As a result, `malloc` allocates a $15$-byte buffer on the heap, but subsequent `memcpy` operations attempt to copy over $4$ gigabytes of data into that buffer.

Which of the following vulnerability types is demonstrated by this flaw, and which control best prevents its exploitation?

A bio-pharmaceutical research laboratory is deploying an automated, event-driven genomic data processing pipeline using a serverless Function-as-a-Service (FaaS) model hosted on a public cloud platform. In this architecture, cloud functions are automatically invoked whenever new dataset files are uploaded to cloud storage buckets. Under the cloud shared responsibility model, which TWO of the following security tasks are the explicit responsibility of the customer organization?

A security engineer inspects an internal build host and discovers that an unencrypted container management daemon is listening on TCP port 2375 across all network interfaces, as shown in the following output:

# netstat -tuln | grep 2375
tcp 0 0 0.0.0.0:2375 0.0.0.0:* LISTEN

This configuration allows any node on the internal network segment to send remote commands to spawn root-privileged container processes and access the underlying host filesystem. Which of the following represents the primary host and architecture vulnerability in this scenario?

A security engineer is performing a threat modeling analysis on a hybrid hypervisor host node that simultaneously runs both tenant Virtual Machines (VMs) managed by a Type 1 hypervisor and application containers running directly on the host operating system kernel. A zero-day privilege escalation vulnerability is discovered in the core host operating system kernel's memory management subsystem. Which of the following statements accurately evaluates the primary security risk distinction between the container workloads and the virtual machine workloads under this threat condition?