All practice questions
509 questions
A cybersecurity team is deploying deception and disruption technologies within a cloud-native software development environment to detect early-stage credential access and lateral movement. Which of the following components and operational practices should the security team implement to achieve high-fidelity alerting without interfering with legitimate production workflows? (Select TWO.)
Select all that apply
An enterprise security architect is redesigning identity infrastructure to align with Zero Trust principles for a hybrid workforce. The organization must support real-time token revocation and risk evaluation for SaaS resources when user posture changes, as well as eliminate persistent administrator credentials on legacy infrastructure by enforcing ephemeral privilege allocation. Which TWO of the following identity and access management architecture components or protocols must be implemented to fulfill these requirements?
Select all that apply
A network security administrator is evaluating access control mechanisms following an audit of an enterprise infrastructure. The current deployment utilizes RADIUS for network access control and TACACS+ for network device management. During the audit, management observed that while remote administrative login attempts are logged, the security team cannot verify which specific commands were executed by individual engineers on edge routers during maintenance sessions. Additionally, permission checks fail to evaluate individual command authorizations dynamically. Which TWO of the following architectural distinctions or protocol changes should the administrator implement to resolve these issues? (Select TWO.)
Select all that apply
An enterprise Security Operations Center (SOC) detects anomalous, high-volume outbound UDP port 53 traffic originating from an automated internal build server. Log inspection reveals structured base64-encoded strings appended to DNS queries sent to an external, unclassified domain, indicating active DNS tunneling and data exfiltration. Which TWO of the following actions should the incident response team perform FIRST to contain the threat while preserving evidence? (Select TWO.)
Select all that apply
A security operations team is configuring an automated vulnerability management workflow for a hybrid cloud environment containing both ephemeral container workloads and legacy database servers. Which of the following scanning strategies should the team implement to minimize network overhead while ensuring accurate detection of OS-level vulnerabilities? (Select TWO.)
Select all that apply
To enforce strict endpoint security across a hybrid workforce, a security team is designing a host health validation strategy to enforce configuration baselines and patch management standards. Which of the following technical controls directly ensure that endpoints maintain verified baseline configurations and patch levels? (Select TWO.)
Select all that apply
An organization is evaluating risk treatment options for an aging internal document repository that contains non-sensitive archived data. Due to budget constraints, the Chief Information Security Officer (CISO) decides not to implement costly security upgrades. Instead, the organization purchases a cyber insurance policy covering potential breach liabilities for the system and signs an official memorandum documenting approval of the operational risks associated with continuing system operation without further technical modifications. Which of the following risk response strategies are being directly implemented in this scenario? (Select TWO.)
Select all that apply
An e-commerce organization is evaluating a third-party cloud analytics vendor that will handle non-financial telemetry and user interaction data. Prior to onboarding, the organization's compliance lead asks for a SOC 2 Type II attestation report. Which of the following statements correctly describe the scope and characteristics of a SOC 2 Type II report? (Select TWO.)
Select all that apply
A network administrator is establishing PKI certificate management processes and automated revocation checks for a cluster of internal web applications. To ensure optimal security during certificate issuance and minimize handshake latency during revocation checking, which of the following implementation steps should the administrator select? (Select TWO).
Select all that apply
A university based in the United States operates an online portal for international exchange programs, collecting personal identification details and financial records from European Union residents. Following a confirmed security incident involving unauthorized access to the application database, the compliance officer is determining legal breach notification duties. Which of the following obligations MUST the institution fulfill to satisfy regulatory compliance mandates? (Select TWO.)
Select all that apply
An information security officer at a biotechnology research institute is restructuring the organization's governance framework to align with updated compliance requirements. The officer must distinguish mandatory governance mandates from non-binding operational advice across the enterprise. Which of the following document types represent mandatory governance requirements that employees and systems must strictly follow? (Select TWO.)
Select all that apply
An enterprise financial institution plans to automate the ingestion of machine-readable threat indicators specifically sourced from peer sector organizations while standardizing automated indicator transport into its Security Orchestration, Automation, and Response (SOAR) platform. Which of the following solutions should the cybersecurity team implement to achieve these specific objectives? (Select TWO.)
Select all that apply
An enterprise security architect is designing compensating controls for legacy operational technology (OT) controllers on an industrial network. The controllers run an end-of-life operating system that cannot be patched or upgraded due to critical vendor warranty constraints. Which TWO of the following technical mitigation techniques should the security architect implement to prevent privilege escalation and lateral movement without impacting system stability? (Select TWO.)
Select all that apply
During a post-incident investigation, a security analyst discovers that an attacker executed a multi-channel campaign against an organization. First, remote administrators received text messages during a off-hours maintenance window directing them to a fake portal to re-authenticate their multi-factor credentials due to an urgent server outage. Second, the attacker telephoned the helpdesk, impersonated the Chief Information Security Officer, and pressured an technician into bypassing standard identity verification to reset a high-privilege account password immediately. Which of the following social engineering attack vectors and influence principles were demonstrated in this incident? (Select TWO)
Select all that apply
A threat intelligence team at a global maritime logistics provider is investigating an intrusion into their vessel tracking and scheduling infrastructure. The investigation reveals that an Advanced Persistent Threat (APT) group maintained continuous, undetected access for nine months after obtaining valid third-party vendor API credentials. Forensic analysis indicates the threat actor deployed proprietary, custom-built malware operating exclusively in volatile memory to conduct long-term intelligence gathering. Which TWO of the following attributes and attack vectors typically characterize this specific category of threat actor in contrast to casual hacktivists or script kiddies?
Select all that apply
A financial technology firm processes sensitive payment transactions using a serverless architecture (Function-as-a-Service) and utilizes a third-party Software-as-a-Service (SaaS) platform for customer records management. Which of the following security tasks remain the sole responsibility of the enterprise customer across these cloud deployment models? (Select TWO.)
Select all that apply
During a comprehensive security audit of an enterprise microservices web platform, an analyst examines two service implementations. Service 1 is an avatar generator that receives a user-supplied web URL via an HTTP POST request, fetches the image resource directly from that URL using a server-side HTTP client, and stores it in internal object storage without restricting target IP addresses or domains. Service 2 is a catalog search service that accepts input strings from search queries and directly concatenates them into dynamic SQL strings executed against the backend database.
Which of the following vulnerability classifications are present in these microservices, and which recommended controls effectively mitigate them? (Select THREE.)
Select all that apply
An organization hosts its web application using a Platform as a Service (PaaS) model from a public cloud service provider. Under the cloud shared responsibility model, which TWO of the following tasks remain the responsibility of the customer?
Select all that apply
A security technician is analyzing a compromised workstation log after an administrative staff member manually ran an executable disguised as a printer driver update. Forensic analysis reveals that upon execution, the payload established persistence via Windows Task Scheduler to maintain access across reboots and initiated command-and-control traffic. The telemetry confirms the file did not perform automated network vulnerability scans or attempt self-replication to other network hosts. Which of the following malware characteristics and operational indicators are demonstrated in this scenario? (Select TWO.)
Select all that apply
During an incident response investigation on a compromised domain controller, a security team suspects the persistent presence of a rootkit alongside other malicious artifacts. Which of the following technical indicators of compromise (IoCs) specifically confirm the presence of a rootkit on the host? (Select TWO.)
Select all that apply