All practice questions

509 questions

Question 1Question

A cybersecurity team is deploying deception and disruption technologies within a cloud-native software development environment to detect early-stage credential access and lateral movement. Which of the following components and operational practices should the security team implement to achieve high-fidelity alerting without interfering with legitimate production workflows? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Embed non-functional synthetic API keys (honeytokens) into code repositories that generate alerts upon any authorization attempt.; Deploy low-interaction decoy container endpoints on isolated microsegments to simulate high-value internal management services.

Answer

The correct practices are embedding non-functional synthetic API keys (honeytokens) into code repositories to alert on any access attempt, and deploying low-interaction decoy container endpoints on isolated network segments to detect probing without risking production infrastructure.
Deception strategies rely on deploying assets that serve no legitimate business purpose. The option stating that non-functional synthetic API keys (honeytokens) should be placed in code repositories is correct because any interaction with these keys immediately signals unauthorized discovery or credential harvesting. The option recommending low-interaction decoy container endpoints on isolated microsegments is also correct because it provides a lightweight decoy target to capture lateral movement probes without exposing production systems.

Step-by-Step Solution

1
Analyze the goal of deception technologies in a cloud environment.
Identified that deception mechanisms (like honeytokens and decoys) aim to lure adversaries into interacting with non-production assets to produce high-confidence alerts.
Deception assets have no legitimate operational traffic, making any interaction suspicious.
2
Evaluate the proposed deception components against production safety and intent.
Selected honeytokens in code repositories and low-interaction decoy containers as proper deception tools.
Honeytokens detect credential misuse, and low-interaction containers catch scanning and discovery efforts safely.
3
Differentiate deception tools from standard inline prevention and filtering controls.
Disqualified inline traffic filtering and DNS dropping controls.
Honeypots do not act as inline filtering devices, and DNS filtering is a preventive control rather than a deception technology.

Key Concept

Deception and Disruption Technologies Deployment
Estimated Time:1m 30s
Question 2Question

An enterprise security architect is redesigning identity infrastructure to align with Zero Trust principles for a hybrid workforce. The organization must support real-time token revocation and risk evaluation for SaaS resources when user posture changes, as well as eliminate persistent administrator credentials on legacy infrastructure by enforcing ephemeral privilege allocation. Which TWO of the following identity and access management architecture components or protocols must be implemented to fulfill these requirements?

Select all that apply

Show answer & explanation

Answer: Identity Provider (IdP) integration supporting the Continuous Access Evaluation Protocol (CAEP) and Shared Signals Framework; Privileged Access Management (PAM) vault utilizing Just-In-Time (JIT) provisioning and short-lived ephemeral credentials

Answer

The correct architecture requires integrating an Identity Provider supporting the Continuous Access Evaluation Protocol (CAEP) alongside a Privileged Access Management (PAM) framework utilizing Just-In-Time (JIT) provisioning with ephemeral credentials.
Zero Trust IAM architecture requires continuous risk evaluation and minimization of standing privileges. Implementing CAEP (Continuous Access Evaluation Protocol) allows IdPs and SaaS platforms to exchange real-time security events to revoke access tokens immediately upon risk detection. Implementing a PAM vault with JIT temporary credentials removes standing administrator accounts by dynamically assigning short-lived privileges only when required.

Step-by-Step Solution

1
Analyze requirement 1: Dynamic session revocation and real-time posture risk evaluation across SaaS apps.
Identify that standard OAuth2/OIDC refresh token lifecycles are periodic; Continuous Access Evaluation Protocol (CAEP) / Shared Signals Framework enables real-time event-driven session revocation across identity providers and relying parties.
Enforces continuous verification rather than trusting static long-lived tokens.
2
Analyze requirement 2: Elimination of persistent privileged accounts on internal server infrastructure.
Identify Privileged Access Management (PAM) with Just-In-Time (JIT) credentialing as the standard architectural control for dynamic temporary elevation without standing administrative permissions.
Minimizes the blast radius of credential harvesting by ensuring privileged credentials expire immediately after administrative tasks.

Key Concept

Zero Trust IAM Architecture, CAEP, and Privileged Access Management (PAM)
Question 3Question

A network security administrator is evaluating access control mechanisms following an audit of an enterprise infrastructure. The current deployment utilizes RADIUS for network access control and TACACS+ for network device management. During the audit, management observed that while remote administrative login attempts are logged, the security team cannot verify which specific commands were executed by individual engineers on edge routers during maintenance sessions. Additionally, permission checks fail to evaluate individual command authorizations dynamically. Which TWO of the following architectural distinctions or protocol changes should the administrator implement to resolve these issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Migrate administrative router sessions to TACACS+, which decouples authentication, authorization, and accounting to support granular per-command authorization and accounting.; Implement TACACS+ command authorization profiles to evaluate each CLI command requested by an administrator against central policy before execution.

Answer

The administrator must migrate administrative sessions to TACACS+ to separate AAA services for per-command logging and implement TACACS+ command authorization profiles to dynamically check individual CLI commands before execution.
TACACS+ is designed specifically for device administration because it separates authentication, authorization, and accounting into independent functions. This separation enables network devices to send authorization queries to the server for every individual command an administrator attempts to execute and generate distinct accounting records for each executed command. The selections recommending TACACS+ session migration and command authorization profile enforcement directly fulfill these security objectives.

Step-by-Step Solution

1
Analyze the technical deficit described in the scenario
Identified missing granular command-level authorization and command execution accounting during administrative SSH/console sessions.
The scenario requires tracking specific executed CLI commands and controlling permission checks per command.
2
Evaluate protocol capabilities between RADIUS and TACACS+
RADIUS combines authentication and authorization and provides session-level accounting. TACACS+ separates AAA functions into distinct processes and encrypts all packet payloads.
Separating AAA allows TACACS+ to perform authorization checks for each individual command entered on a network device.
3
Select the appropriate controls to fulfill both requirements
Using TACACS+ for administrative sessions provides the required granular command accounting, while configuring command authorization profiles enforces per-command privilege checks.
These controls directly resolve the inability to track CLI command history and enforce fine-grained authorization.

Key Concept

AAA Protocol Differences (RADIUS vs. TACACS+ Granularity)
Question 4Question

An enterprise Security Operations Center (SOC) detects anomalous, high-volume outbound UDP port 53 traffic originating from an automated internal build server. Log inspection reveals structured base64-encoded strings appended to DNS queries sent to an external, unclassified domain, indicating active DNS tunneling and data exfiltration. Which TWO of the following actions should the incident response team perform FIRST to contain the threat while preserving evidence? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply network-level isolation controls or move the build server interface to a quarantine VLAN.; Capture a volatile memory image of the host before executing destructive remediation tasks.

Answer

The incident response team should apply network-level isolation controls (or move the interface to a quarantine VLAN) and capture a volatile memory image (RAM) of the host before performing destructive remediation.
In accordance with standard incident response frameworks (NIST SP 800-61 / ISO 27035), containment must isolate the compromised asset from the network while preserving volatile digital evidence. Isolating the build server via firewall/VLAN adjustments blocks C2 and exfiltration channels immediately. Capturing physical RAM satisfies the order of volatility, ensuring volatile evidence is captured prior to system changes.

Step-by-Step Solution

1
Isolate the host at the network layer.
Stops ongoing data exfiltration via DNS tunneling while preserving system execution state.
Containment limits the blast radius without modifying system artifacts or losing volatile memory.
2
Preserve volatile evidence according to the order of volatility.
Captures running processes, memory-resident tools, and active network connections stored in RAM.
Volatile memory is lost if the machine is powered off, rebooted, or modified during eradication.

Key Concept

Incident Response Containment and Forensic Order of Volatility
Estimated Time:1m 30s
Question 5Question

A security operations team is configuring an automated vulnerability management workflow for a hybrid cloud environment containing both ephemeral container workloads and legacy database servers. Which of the following scanning strategies should the team implement to minimize network overhead while ensuring accurate detection of OS-level vulnerabilities? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy lightweight host-based agents on persistent database servers to perform authenticated internal system checks.; Integrate vulnerability scanners directly into the CI/CD pipeline to analyze container images prior to deployment.

Answer

The team should deploy host-based agents on persistent database servers and integrate container image scanning into the CI/CD deployment pipeline.
Deploying host-based agents on persistent servers provides detailed credentialed assessment results without generating heavy network traffic. Similarly, integrating container scanning into the CI/CD pipeline ensures container images are assessed for vulnerabilities before being spawned, addressing the ephemeral nature of container workloads efficiently.

Step-by-Step Solution

1
Analyze persistent workload requirements
Identify that host-based agents provide continuous, credentialed assessment of OS and library patch states on persistent database servers with minimal network impact.
Host agents execute locally, eliminating network bandwidth consumption and port-scanning overhead on core databases.
2
Analyze container workload requirements
Identify that scanning static container images within the CI/CD pipeline identifies vulnerabilities prior to runtime deployment.
Ephemeral containers spin up and shut down rapidly, making active network scans ineffective and resource-intensive.

Key Concept

Selecting appropriate vulnerability scanning methodologies (agent-based vs. network-based vs. static pipeline image scanning) based on infrastructure environment constraints.
Question 6Question

To enforce strict endpoint security across a hybrid workforce, a security team is designing a host health validation strategy to enforce configuration baselines and patch management standards. Which of the following technical controls directly ensure that endpoints maintain verified baseline configurations and patch levels? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploying configuration management agents to continuously audit workstation settings against established security baselines and automatically remediate configuration drift; Implementing Network Access Control (NAC) posture assessment to check endpoint operating system patch levels against mandatory patch compliance SLAs before granting network access

Answer

Deploying automated configuration management agents to remediate baseline drift and implementing Network Access Control (NAC) posture assessments to verify patch compliance.
Maintaining secure host states requires verifying both software patch levels and baseline configurations. Automated configuration management agents detect and correct unauthorized setting changes (configuration drift), while posture assessment mechanisms (such as NAC) evaluate patch levels against defined SLAs to ensure non-compliant systems are isolated or updated prior to granting network access.

Step-by-Step Solution

1
Identify mechanisms that enforce configuration baselines and remediate configuration drift on endpoints.
Automated configuration management agents continuously monitor system settings and restore non-compliant settings back to authorized baselines.
Baseline enforcement requires local or agent-based auditing and automated remediation.
2
Identify mechanisms that validate endpoint patch compliance during network admission.
Network Access Control (NAC) posture assessments check host patch status against organization SLAs prior to network authorization.
NAC posture checks prevent unpatched or vulnerable systems from joining the corporate network.

Key Concept

Continuous configuration baseline auditing, drift remediation, and endpoint patch compliance validation.
Question 7Question

An organization is evaluating risk treatment options for an aging internal document repository that contains non-sensitive archived data. Due to budget constraints, the Chief Information Security Officer (CISO) decides not to implement costly security upgrades. Instead, the organization purchases a cyber insurance policy covering potential breach liabilities for the system and signs an official memorandum documenting approval of the operational risks associated with continuing system operation without further technical modifications. Which of the following risk response strategies are being directly implemented in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Risk Transference; Risk Acceptance

Answer

The organization is implementing Risk Transference by purchasing a cyber insurance policy and Risk Acceptance by formally approving and documenting the decision to operate the system with its existing residual risk.
Purchasing a cyber insurance policy transfers financial liability to an insurance provider (Risk Transference), while explicitly choosing to operate the system as-is with senior management sign-off constitutes absorbing the risk (Risk Acceptance).

Step-by-Step Solution

1
Analyze the action of purchasing a cyber insurance policy.
Identified as shifting financial exposure to a third-party guarantor.
Risk transference delegates financial consequences of an adverse event to an outside entity.
2
Analyze the action of signing an official memorandum accepting operational risk without modifications.
Identified as formal acknowledgment and retention of residual risk.
Risk acceptance occurs when management acknowledges the potential loss and chooses to operate without additional risk reduction controls.

Key Concept

Distinguishing fundamental risk response strategies (Acceptance, Transference, Mitigation, Avoidance) in corporate risk management.
Question 8Question

An e-commerce organization is evaluating a third-party cloud analytics vendor that will handle non-financial telemetry and user interaction data. Prior to onboarding, the organization's compliance lead asks for a SOC 2 Type II attestation report. Which of the following statements correctly describe the scope and characteristics of a SOC 2 Type II report? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: It evaluates the operational effectiveness of the service organization's security controls over a specified period of time.; It evaluates controls categorized under the Trust Services Criteria, such as security, availability, and confidentiality.

Answer

A SOC 2 Type II report measures the operational effectiveness of controls over a defined period (such as 6–12 months) and measures security controls against the Trust Services Criteria.
The correct options accurately describe a SOC 2 Type II attestation. Unlike a Type I report which evaluates control design at a single point in time, a Type II report tests the operational effectiveness of implemented controls across a extended period (such as 6 to 12 months). Additionally, SOC 2 reports specifically evaluate service organizations against the Trust Services Criteria (security, availability, processing integrity, confidentiality, and privacy).

Step-by-Step Solution

1
Identify the primary framework and focus of SOC 2 reports
SOC 2 focuses on operational security, availability, processing integrity, confidentiality, and privacy using the Trust Services Criteria.
SOC 2 is designed for technical/operational security evaluations rather than financial reporting audits.
2
Distinguish between Type I and Type II report scopes
Type I tests control design at a single point in time, whereas Type II tests operational effectiveness over a historical timeframe.
Type II reports require auditor testing across a specified observation period (e.g., 6 to 12 months).
3
Eliminate incorrect SOC report classifications
Exclude financial reporting controls (SOC 1) and public summary reports (SOC 3).
SOC 1 handles financial controls (ICFR) and SOC 3 is an executive summary intended for general public release.

Key Concept

SOC 2 Type II Attestation Reports and Trust Services Criteria
Estimated Time:1m 30s
Question 9Question

A network administrator is establishing PKI certificate management processes and automated revocation checks for a cluster of internal web applications. To ensure optimal security during certificate issuance and minimize handshake latency during revocation checking, which of the following implementation steps should the administrator select? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Generate the private key locally on the target web server when creating the Certificate Signing Request (CSR) before submitting it to the Certificate Authority.; Configure OCSP stapling on the web servers so that cached, digitally signed CA revocation responses are delivered directly to client browsers during the TLS handshake.

Answer

The correct implementation steps are local private key generation during CSR creation and configuring OCSP stapling on web servers.
Generating the private key locally when creating a CSR ensures the private key is never exposed across the network. Enabling OCSP stapling allows the web server to append signed revocation proof directly during the TLS handshake, reducing latency and avoiding client connection delays.

Step-by-Step Solution

1
Analyze certificate request lifecycle security requirements
Confirm that private keys must be generated locally on the requestor endpoint so that the key is never transferred across the network.
Maintaining private key isolation on the endpoint prevents exposure and maintains the integrity of asymmetric key pairs.
2
Evaluate revocation checking optimization methods
Identify OCSP stapling as the mechanism where web servers periodically fetch and staple timestamped, signed OCSP responses to TLS handshakes.
OCSP stapling avoids third-party OCSP responder queries by clients, eliminating external lookup latency and bandwidth overhead.

Key Concept

PKI Certificate Request Flow and OCSP Stapling Revocation Verification
Question 10Question

A university based in the United States operates an online portal for international exchange programs, collecting personal identification details and financial records from European Union residents. Following a confirmed security incident involving unauthorized access to the application database, the compliance officer is determining legal breach notification duties. Which of the following obligations MUST the institution fulfill to satisfy regulatory compliance mandates? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Notify the relevant supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach if it poses a risk to individuals.; Communicate the personal data breach to affected data subjects without undue delay when the incident is likely to result in a high risk to their rights and freedoms.

Answer

The organization must notify the competent supervisory authority within 72 hours of awareness if a risk exists, and communicate the breach to affected individuals without undue delay if a high risk to rights and freedoms is present.
Under international privacy frameworks like GDPR, organizations processing personal data of EU residents must fulfill dual notification obligations upon experiencing a qualifying breach. Data controllers must notify the supervisory authority within 72 hours if a risk to individuals exists, and directly inform affected data subjects without undue delay if the incident poses a high risk to their rights and freedoms.

Step-by-Step Solution

1
Identify the territorial and material scope of applicable regulations based on data subject residency.
The university processes personal data of EU residents, bringing breach notifications under GDPR jurisdiction.
GDPR applies extra-territorially to non-EU entities offering services to or monitoring data subjects in the EU.
2
Determine the legal timeframes and thresholds for supervisory authority notification.
Supervisory notification is required within 72 hours of awareness if the breach poses a risk to individuals.
Article 33 of GDPR establishes the 72-hour reporting rule for data controllers.
3
Determine the conditions required for notifying impacted data subjects.
Individual notification is required without undue delay when a high risk to rights and freedoms is present.
Article 34 of GDPR establishes communication duties directly to individuals when breach severity passes the high-risk threshold.

Key Concept

GDPR Breach Notification Rules and Timelines
Estimated Time:1m 30s
Question 11Question

An information security officer at a biotechnology research institute is restructuring the organization's governance framework to align with updated compliance requirements. The officer must distinguish mandatory governance mandates from non-binding operational advice across the enterprise. Which of the following document types represent mandatory governance requirements that employees and systems must strictly follow? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enterprise Security Policy outlining executive direction, scope, and high-level security directives.; Technical Security Standard specifying mandatory baseline configurations and specific technology rules.

Answer

The mandatory governance requirements are the Enterprise Security Policy and the Technical Security Standard.
Both policies and standards represent mandatory governance elements. An enterprise security policy provides top-down executive directives establishing mandatory compliance rules for the organization, while technical security standards set mandatory specific technical thresholds, hardware/software baselines, and configuration requirements.

Step-by-Step Solution

1
Analyze the security governance document hierarchy.
Governance documentation is categorized into mandatory directives (policies, standards, procedures) and non-binding advice (guidelines).
Understanding document authority determines compliance enforcement obligations.
2
Evaluate the role of an Enterprise Security Policy.
Policies are executive-level, overarching directives that mandate compliance across all organizational units.
It sets the mandatory foundational rules and goals.
3
Evaluate the role of a Technical Security Standard.
Standards mandate explicit technical configurations, protocols, and baselines that must be implemented without exception.
It translates high-level policy mandates into mandatory, measurable technical requirements.

Key Concept

Security Governance Hierarchy (Policy vs. Standard vs. Guideline)
Question 12Question

An enterprise financial institution plans to automate the ingestion of machine-readable threat indicators specifically sourced from peer sector organizations while standardizing automated indicator transport into its Security Orchestration, Automation, and Response (SOAR) platform. Which of the following solutions should the cybersecurity team implement to achieve these specific objectives? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Financial Services Information Sharing and Analysis Center (FS-ISAC) subscription; Trusted Automated eXchange of Intelligence Information (TAXII) feed integration

Answer

The cybersecurity team should implement a Financial Services Information Sharing and Analysis Center (FS-ISAC) subscription and a Trusted Automated eXchange of Intelligence Information (TAXII) feed integration.
To fulfill the requirements, the organization needs both a sector-specific community threat source and an automated protocol for machine-readable ingestion. Subscribing to an Information Sharing and Analysis Center (specifically FS-ISAC for financial entities) supplies specialized threat data from peer institutions. Integrating a TAXII feed provides the standardized, machine-to-machine RESTful transport protocol needed to automatically ingest structured threat data directly into security orchestration platforms.

Step-by-Step Solution

1
Identify the requirement for sector-specific peer intelligence sharing.
Determined that joining an ISAC (such as FS-ISAC) provides vetted threat intelligence specifically tailored to and shared by peer institutions within the financial sector.
ISACs facilitate targeted industry information sharing regarding sector-relevant attack vectors and active campaigns.
2
Identify the protocol mechanism required for machine-readable, automated threat indicator transport.
Selected TAXII as the automated transport mechanism to push and pull threat data directly into the SOAR platform.
TAXII is specifically built to automate the secure exchange of structured threat intelligence data feeds across networks.
3
Evaluate alternative options for alignment with automation and sector specificity.
Disqualified NVD feeds (vulnerability focus, not threat indicators), strategic briefings (high-level executive human reports, not machine-readable), and manual OSINT RSS scrapers (unstructured human-readable blog data).
These alternatives fail to meet the dual criteria of sector-specific peer intelligence sharing and automated machine-readable transport.

Key Concept

Threat Intelligence Sharing Architectures (ISACs and TAXII)
Question 13Question

An enterprise security architect is designing compensating controls for legacy operational technology (OT) controllers on an industrial network. The controllers run an end-of-life operating system that cannot be patched or upgraded due to critical vendor warranty constraints. Which TWO of the following technical mitigation techniques should the security architect implement to prevent privilege escalation and lateral movement without impacting system stability? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Implement application allowlisting policies on the host controllers to restrict execution strictly to pre-approved operational binaries and scripts.; Isolate the host controllers within microsegmented network zones using firewalls to limit communications strictly to essential industrial protocols.

Answer

The correct mitigations are implementing application allowlisting on host controllers and isolating the controllers within microsegmented network zones using firewalls.
Application allowlisting and microsegmentation provide robust compensating controls for legacy environments where patching is impossible. Application allowlisting prevents malicious code from running locally to escalate privileges, while microsegmentation restricts lateral movement by limiting network communications strictly to required operational protocols.

Step-by-Step Solution

1
Analyze host constraints and vulnerability risks
Patching is not viable due to legacy OS limitations and vendor warranties, requiring host-based compensating controls that block unauthorized binary execution.
Host security must prevent exploit execution without altering legacy application software.
2
Select execution control mitigation
Application allowlisting ensures only explicitly approved binaries and scripts are permitted to execute.
Allowlisting prevents privilege escalation tools and dropped payloads from running even if vulnerability vectors exist.
3
Select network containment mitigation
Microsegmentation enforces network layer isolation around host controllers.
Restricting communications strictly to necessary industrial control protocols stops lateral movement across network segments.

Key Concept

Enterprise Hardening and Compensating Security Controls for Legacy Systems
Question 14Question

During a post-incident investigation, a security analyst discovers that an attacker executed a multi-channel campaign against an organization. First, remote administrators received text messages during a off-hours maintenance window directing them to a fake portal to re-authenticate their multi-factor credentials due to an urgent server outage. Second, the attacker telephoned the helpdesk, impersonated the Chief Information Security Officer, and pressured an technician into bypassing standard identity verification to reset a high-privilege account password immediately. Which of the following social engineering attack vectors and influence principles were demonstrated in this incident? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Smishing leveraging urgency to capture administrative credentials; Vishing leveraging authority to bypass helpdesk verification procedures

Answer

The attack involved smishing leveraging urgency to capture administrative credentials, and vishing leveraging authority to bypass helpdesk verification procedures.
The scenario describes two distinct communication channels: text messaging (SMS) to lure administrators into revealing credentials under time pressure (smishing combined with urgency), and voice phone calls impersonating executive leadership to force policy bypasses (vishing combined with authority).

Step-by-Step Solution

1
Analyze the vector used in the SMS message targeting remote administrators.
Identified SMS-based messaging (smishing) exploiting time sensitivity during off-hours maintenance (urgency).
Phishing via SMS text messaging is classified specifically as smishing.
2
Analyze the vector used in the telephone call to the helpdesk.
Identified voice-based communication (vishing) using executive impersonation (authority).
Phishing over voice telephony is classified specifically as vishing, and posing as CISO leverages senior management hierarchy.

Key Concept

Identification of social engineering attack vectors (Smishing, Vishing) and psychological principles of influence (Urgency, Authority).
Estimated Time:2m 0s
Question 15Question

A threat intelligence team at a global maritime logistics provider is investigating an intrusion into their vessel tracking and scheduling infrastructure. The investigation reveals that an Advanced Persistent Threat (APT) group maintained continuous, undetected access for nine months after obtaining valid third-party vendor API credentials. Forensic analysis indicates the threat actor deployed proprietary, custom-built malware operating exclusively in volatile memory to conduct long-term intelligence gathering. Which TWO of the following attributes and attack vectors typically characterize this specific category of threat actor in contrast to casual hacktivists or script kiddies?

Select all that apply

Show answer & explanation

Answer: High technical sophistication manifested through custom, fileless memory malware engineered to bypass endpoint defenses; Substantial financial and operational resources enabling long-term persistence and stealthy cyber espionage

Answer

The threat actor described is characterized by high technical sophistication utilizing custom in-memory malware and substantial financial and operational resources enabling long-term persistence.
The correct selections accurately identify nation-state APT attributes: high technical sophistication demonstrated by custom fileless in-memory malware and extensive resource funding supporting prolonged, stealthy cyber espionage.

Step-by-Step Solution

1
Analyze the incident scenario indicators
Identified long-term presence (nine months), proprietary memory-only malware, and third-party vendor credential abuse, indicating a nation-state Advanced Persistent Threat (APT).
Threat actor categorization relies on observing intent, capability, sophistication, funding, and attack vectors.
2
Evaluate capability and sophistication characteristics
Developing custom fileless payloads requires high technical sophistication, distinguishing APTs from lower-skilled actors.
Script kiddies and low-tier actors rely on known, off-the-shelf exploit scripts rather than custom memory malware.
3
Evaluate resource levels and motivation attributes
Sustaining a multi-month stealthy cyber espionage campaign requires extensive resource backing and long-term strategic intent.
Hacktivists typically seek short-term public disruption for awareness, whereas nation-states fund stealthy, persistent surveillance.

Key Concept

Threat Actor Attributes and Attack Vectors
Question 16Question

A financial technology firm processes sensitive payment transactions using a serverless architecture (Function-as-a-Service) and utilizes a third-party Software-as-a-Service (SaaS) platform for customer records management. Which of the following security tasks remain the sole responsibility of the enterprise customer across these cloud deployment models? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Developing secure application source code and defining IAM role permissions for the serverless functions.; Classifying organizational data and administering user access rights within the SaaS platform.

Answer

The enterprise customer is strictly responsible for developing secure serverless application code, managing IAM role policies, classifying organizational data, and controlling user access within the SaaS application.
Under the cloud shared responsibility model, higher abstraction models (such as FaaS and SaaS) transfer physical infrastructure, operating system maintenance, and host application management to the cloud provider. However, regardless of the deployment model, the customer always retains ultimate responsibility for data classification, identity and access management (IAM), and custom code development.

Step-by-Step Solution

1
Evaluate customer responsibilities in Function-as-a-Service (FaaS)
In FaaS, the cloud provider abstracts away servers, operating systems, and runtime provisioning. The customer is solely responsible for code security, data handling, and access permissions (IAM).
Understanding the boundary of abstraction in serverless compute models.
2
Evaluate customer responsibilities in Software-as-a-Service (SaaS)
In SaaS, the provider manages the application code, infrastructure, and hardware availability. The customer remains responsible for data governance, classification, user management, and authorization.
Identifying shared responsibility limits in application-level cloud services.
3
Select tasks common to customer ownership
Writing secure code and configuring IAM for serverless functions, alongside classifying data and managing user access in SaaS, fall entirely on the customer.
Matching shared responsibility allocation across abstract cloud service models.

Key Concept

Cloud Shared Responsibility Model across FaaS and SaaS
Estimated Time:1m 30s
Question 17Question

During a comprehensive security audit of an enterprise microservices web platform, an analyst examines two service implementations. Service 1 is an avatar generator that receives a user-supplied web URL via an HTTP POST request, fetches the image resource directly from that URL using a server-side HTTP client, and stores it in internal object storage without restricting target IP addresses or domains. Service 2 is a catalog search service that accepts input strings from search queries and directly concatenates them into dynamic SQL strings executed against the backend database.

Which of the following vulnerability classifications are present in these microservices, and which recommended controls effectively mitigate them? (Select THREE.)

Select all that apply

Show answer & explanation

Answer: Server-Side Request Forgery (SSRF) is present in Service 1 because the application fetches remote resources based on user-supplied URLs without restricting outbound requests or validating target IP destinations.; SQL Injection (SQLi) is present in Service 2 because user input is directly concatenated into database query strings instead of using prepared statements or parameterized queries.; Implementing strict egress network filtering, URL domain allowlists, and blocking access to loopback and internal private IP ranges remediates the SSRF vulnerability in Service 1.

Answer

The application suffers from Server-Side Request Forgery (SSRF) in the avatar microservice and SQL Injection (SQLi) in the catalog search microservice. Effective mitigations include implementing egress network filtering, URL allowlisting, and restricting internal IP access for the avatar service, as well as replacing dynamic string concatenation with parameterized queries for the catalog search service.
The correct options accurately identify the two software vulnerabilities present in the scenario and specify an effective mitigation strategy for the SSRF flaw. Service 1 exhibits Server-Side Request Forgery (SSRF) because it fetches remote content based on client-provided URLs without constraining destination addresses or prohibiting requests to loopback/private IPs. Service 2 exhibits SQL Injection (SQLi) because input is dynamically concatenated into database queries. Remediating SSRF requires strict egress network filtering, URL allowlisting, and blocking access to internal management interfaces.

Step-by-Step Solution

1
Analyze Service 1 behavior (fetching external URL server-side).
Identified Server-Side Request Forgery (SSRF). The server trusts user input to make backend HTTP requests without validating if the destination IP is internal or forbidden.
When a server receives a URL from a client and retrieves the resource without restricting target address space, it creates an SSRF vulnerability.
2
Analyze Service 2 behavior (dynamic string concatenation into SQL statements).
Identified SQL Injection (SQLi). Untrusted input directly alters database command syntax.
Direct concatenation of user-supplied data into database queries allows attackers to break out of data context into query code context.
3
Evaluate appropriate technical mitigation controls for identified vulnerabilities.
Confirmed that egress network controls, URL allowlisting, and disabling access to private IP blocks mitigate SSRF, while parameterization mitigates SQLi.
Defensive controls must directly address the architectural root cause (preventing unauthorized server requests for SSRF, and isolating data from query execution logic for SQLi).

Key Concept

Software vulnerability identification and remediation (SSRF and SQL Injection)
Question 18Question

An organization hosts its web application using a Platform as a Service (PaaS) model from a public cloud service provider. Under the cloud shared responsibility model, which TWO of the following tasks remain the responsibility of the customer?

Select all that apply

Show answer & explanation

Answer: Configuring application-level identity access controls and authorization settings; Securing custom application source code and managing database data classification

Answer

The customer is responsible for configuring application-level access controls and securing custom application code along with data classification.
Under Platform as a Service (PaaS), the cloud service provider abstracts and manages the underlying hardware, hypervisor, and operating system. The customer remains strictly responsible for securing their custom application source code, data classification, user identities, and application-level access controls.

Step-by-Step Solution

1
Identify the cloud service model referenced in the scenario
The model is Platform as a Service (PaaS).
Different cloud models (IaaS, PaaS, SaaS) divide responsibilities differently between the provider and customer.
2
Determine the division of responsibilities for PaaS
The Cloud Service Provider (CSP) manages physical infrastructure, hardware, network virtualization, and the operating system/runtime environment. The customer manages application logic, code, user access permissions, and data security.
PaaS abstracts the underlying operating system and hardware layer away from the customer.
3
Evaluate the choices based on customer responsibilities
Application authorization configuration and application code/data classification are customer duties. OS patching and hypervisor perimeter defense are CSP duties.
Customer responsibility stops above the runtime/OS layer in PaaS deployments.

Key Concept

Cloud Shared Responsibility Model (PaaS)
Question 19Question

A security technician is analyzing a compromised workstation log after an administrative staff member manually ran an executable disguised as a printer driver update. Forensic analysis reveals that upon execution, the payload established persistence via Windows Task Scheduler to maintain access across reboots and initiated command-and-control traffic. The telemetry confirms the file did not perform automated network vulnerability scans or attempt self-replication to other network hosts. Which of the following malware characteristics and operational indicators are demonstrated in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Trojan classification based on masquerading as authorized software to induce user execution; Host-based persistence created via OS task scheduling mechanisms

Answer

The scenario demonstrates Trojan classification based on masquerading as authorized software to induce user execution, as well as host-based persistence created via OS task scheduling mechanisms.
The scenario highlights two key operational indicators: first, the executable disguised itself as a legitimate driver update to induce a user to launch it, which defines Trojan malware. Second, endpoint forensic logs show scheduled task creation, which is a key indicator of compromise establishing host persistence.

Step-by-Step Solution

1
Analyze the initial execution vector described in the host telemetry.
The payload relied on disguising itself as a legitimate printer driver update requiring manual user execution, matching Trojan delivery.
Trojans hide inside seemingly legitimate software to trick users into executing malicious code.
2
Examine the endpoint persistence behavior.
The malware configured Windows Task Scheduler to maintain execution rights across reboots.
Scheduled task creation is a standard indicator of compromise used to establish persistent execution.
3
Evaluate negative telemetry indicators (lack of self-replication and scanning).
The file is confirmed not to be a worm because it lacks autonomous self-propagation capabilities.
Differentiating worms from Trojans requires identifying self-replication functionality.

Key Concept

Malware Types and Indicators of Compromise
Question 20Question

During an incident response investigation on a compromised domain controller, a security team suspects the persistent presence of a rootkit alongside other malicious artifacts. Which of the following technical indicators of compromise (IoCs) specifically confirm the presence of a rootkit on the host? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Hooked system call table pointers diverting kernel API requests to mask running malicious process IDs; Direct Kernel Object Manipulation (DKOM) modifying active data structures to conceal open network sockets

Answer

The correct indicators confirming the presence of a rootkit are hooked system call table pointers diverting kernel API requests and Direct Kernel Object Manipulation (DKOM) modifying active data structures to conceal open network sockets.
Rootkits operate at deep operating system levels (often within kernel space) to maintain persistent, invisible control over a host. Intercepting API calls via system call table hooking and modifying kernel memory through Direct Kernel Object Manipulation (DKOM) allow the rootkit to bypass administrative detection tools and mask running processes and active sockets.

Step-by-Step Solution

1
Analyze the core operational mechanism of rootkit malware
Identify that rootkits aim to conceal malicious activity by operating at the kernel or system driver level
Rootkits modify lower-level operating system structures to stealthily hide processes, files, network connections, and privileges from administrative discovery tools.
2
Evaluate the technical telemetry presented in each indicator
System call hooking and Direct Kernel Object Manipulation (DKOM) directly match kernel-level evasion techniques utilized by rootkits
By intercepting system calls and modifying kernel memory structures directly, rootkits prevent native tools from displaying malicious artifacts.
3
Differentiate rootkit telemetry from worm propagation and perimeter defenses
Automated network SMB sweeps represent worm behavior, while firewall configurations are security controls rather than compromise indicators
Rootkits are defined by stealth and kernel manipulation rather than network self-replication mechanisms or defensive policy settings.

Key Concept

Kernel-Level Evasion and Rootkit Indicators of Compromise
Page 1 / 26Next
All practice questions — CompTIA Security+ | Examkin