Examkin

General Security Concepts

268 questions

All types268Multiple choice139Multiple select58Matching57Ordering14
Question 181Question →

An enterprise security engineer is auditing a network management infrastructure after migrating remote administrator access to a centralized access control server. Network switches correctly validate administrator credentials against Active Directory and log the total session connection time and byte counts. However, security audits reveal that individual privilege-escalation commands (such as entering configuration modes) executed during active switch sessions are neither restricted based on administrator roles nor recorded in detailed command audit logs. Which of the following best explains why session-level authentication and accounting succeed while command-level authorization and accounting fail?

Show answer & explanation

Answer: The deployment relies on RADIUS, which combines authentication and authorization into single transactions and lacks native support for granular per-command authorization and accounting.

Answer

The deployment relies on RADIUS, which combines authentication and authorization into single transactions and lacks native support for granular per-command authorization and accounting.
The correct answer identifies that RADIUS combines authentication and authorization into a single transaction during initial connection setup. Because RADIUS is designed primarily for network level access (such as 802.1X, VPNs, and wireless connections), it lacks native support for real-time, per-command authorization and individual command accounting logs. TACACS+ would be required to restrict and audit specific command execution on network infrastructure devices.

Step-by-Step Solution

1
Analyze the scenario symptoms
Initial session authentication succeeds, session duration/volume accounting succeeds, but command-level authorization and individual command logging fail.
Different AAA protocols handle session management and command-level granularity differently.
2
Compare RADIUS and TACACS+ AAA capabilities
RADIUS (UDP 1812/1813) combines authentication and authorization into a single step and is designed primarily for network access control (IP assignment, VLAN tag, session accounting). TACACS+ (TCP 49) separates AAA into discrete processes and allows granular authorization of individual commands as well as auditing of each command entered.
Understanding protocol differences reveals why RADIUS cannot enforce or audit per-command administrative actions.
3
Select the root cause matching the protocol limitation
The organization is using RADIUS for switch administration, which supports initial session authentication and basic session accounting, but cannot enforce command-level authorization.
Migrating switch management requiring command authorization from RADIUS to TACACS+ is necessary to achieve command-level auditing and restriction.

Key Concept

AAA Protocol Capabilities (RADIUS vs. TACACS+)
Estimated Time:2m 0s
Question 182Question →

A financial organization is implementing a centralized enterprise API gateway to handle high-value B2B fund transfers with external corporate partners. The security team must ensure that once a corporate partner transmits a payment request, they cannot plausibly claim the request was forged or sent by an unauthorized party. Which of the following technical controls directly support non-repudiation for these payment requests? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Requiring senders to digitally sign payment payloads using their organization's private cryptographic key; Validating sender digital certificates against a mutually trusted Public Key Infrastructure (PKI) Certificate Authority

Answer

Non-repudiation for payment transactions is directly supported by requiring senders to digitally sign payment payloads using their asymmetric private key and by validating sender certificates against a trusted Public Key Infrastructure (PKI) Certificate Authority.
Non-repudiation ensures that a sender cannot dispute the authenticity of a message or transaction they originated. This security goal requires combining proof of origin with proof of integrity. Digitally signing payloads with an asymmetric private key guarantees that only the key owner could have signed the request. Validating the sender's identity certificate via a trusted Public Key Infrastructure (PKI) binds that key to a verified identity, completing the non-repudiation chain.

Step-by-Step Solution

1
Identify the core security requirement specified in the scenario.
The requirement calls for preventing a sending organization from denying having originated or authorized a payment request, which defines non-repudiation.
Non-repudiation combines authentication of origin with data integrity to ensure actions cannot be denied.
2
Evaluate mechanisms that provide attribution of identity to a specific sender.
Asymmetric digital signatures created with the sender's private key uniquely identify the sender. PKI certificate validation confirms that the sender's public key maps to a verified organization.
Asymmetric cryptography and PKI trust chains satisfy non-repudiation by linking cryptographically signed content to an verified identity.
3
Distinguish non-repudiation controls from integrity verification and symmetric encryption.
Hashing only proves integrity (data was not altered), not identity. Symmetric encryption uses a shared key known to both receiver and sender, preventing unambiguous proof of who created the message.
Integrity checks and symmetric encryption lack unique origin proof.

Key Concept

Non-Repudiation and Asymmetric Cryptography
Question 183Question →

An organization installs a new physical access control system at the entrance of its data center. When an employee presents a smart card and enters a personal identification number (PIN), the system checks these credentials against the central directory to verify who the employee is before unlocking the door. Which component of the Authentication, Authorization, and Accounting (AAA) framework is being directly performed during credential verification?

Show answer & explanation

Answer: Authentication

Answer

Authentication is the pillar of AAA responsible for verifying a user's or system's claimed identity using credentials like a smart card and PIN.
Verifying user credentials (such as a smart card and PIN) against a directory server confirms the user's identity, which is the exact function of authentication in the AAA security model.

Step-by-Step Solution

1
Identify the primary action taking place in the scenario.
The system receives a smart card and PIN to confirm that the person attempting entry is indeed who they claim to be.
Verifying claimed identity using authentication factors (something you have + something you know) is the core definition of identity verification.
2
Map the identity verification process to the correct AAA framework pillar.
Confirming identity corresponds directly to Authentication.
Authentication answers the question 'Who are you?', while Authorization answers 'What are you allowed to do?' and Accounting answers 'What did you do?'.

Key Concept

Authentication in the AAA Framework
Question 184Question →

An enterprise web portal requires remote employees to enter a username and a dynamic one-time password (OTP) generated by an authenticator application to prove who they are before entering the network. Which pillar of the AAA framework is directly performed during this credential verification step?

Show answer & explanation

Answer: Authentication

Answer

Authentication is the AAA pillar responsible for validating a user's claimed identity via credentials such as a username and dynamic OTP.
Authentication is the process of verifying a user's claimed identity using one or more factors, such as passwords, OTPs, or biometrics.

Step-by-Step Solution

1
Identify the primary security action described in the scenario
The user presents a username and dynamic OTP code to prove their identity to the system.
Submitting credentials to validate who a user claims to be is the core objective of identity verification.
2
Map the action to the corresponding pillar of the AAA model
Proving identity with credentials maps directly to Authentication.
Authentication focuses on identity verification, distinct from granting privileges (Authorization) or logging session details (Accounting).

Key Concept

Authentication in the AAA framework establishes and validates the identity of a user or process using credentials before access is granted.
Question 185Question →

An organization is transitioning from a traditional boundary firewall model to a Zero Trust Architecture (ZTA). An administrator is configuring access rules for internal workstations connected directly to the corporate office local area network. Which of the following statements best reflects a fundamental Zero Trust principle that should guide this configuration?

Show answer & explanation

Answer: Every access request must be explicitly authenticated and authorized regardless of whether it originates from inside or outside the network perimeter.

Answer

Every access request must be explicitly authenticated and authorized regardless of whether it originates from inside or outside the network perimeter.
The defining core principle of Zero Trust Architecture is 'never trust, always verify'. This requires every user, device, and request to be explicitly authenticated and authorized using contextual data regardless of network location.

Step-by-Step Solution

1
Identify the core tenet of Zero Trust Architecture (ZTA).
ZTA relies on the philosophy of 'never trust, always verify'.
Traditional perimeter defenses treat internal network traffic as inherently trustworthy, whereas Zero Trust eliminates implicit trust.
2
Evaluate the requirement for explicit verification.
All incoming connections, whether from internal corporate LANs or external networks, require continuous identity, context, and posture validation.
This prevents lateral movement in the event of an internal network breach.

Key Concept

Explicit Verification in Zero Trust Architecture
Question 186Question →

A security administrator is categorizing system events and operational functions into the core pillars of the Authentication, Authorization, and Accounting (AAA) framework. Match each operational scenario on the left to the corresponding AAA pillar on the right.

Click a left item, then click its matching right item

Items

An employee presents a smart card and enters a secret PIN to prove their claimed identity to a system.
An access control system checks security group policies to determine if a user can modify a restricted cloud folder.
A network gateway records session login timestamps, active connection duration, and total bandwidth consumed.

Matches

Show answer & explanation

Answer

Presenting a smart card and PIN matches Authentication; evaluating cloud folder permissions matches Authorization; recording session timestamps and bandwidth consumption matches Accounting.
Authentication verifies identity via credentials (smart card and PIN). Authorization determines resource access boundaries and user permissions (cloud folder modification checks). Accounting tracks, measures, and audits user sessions and resource usage (timestamps, session length, and bandwidth consumption).

Step-by-Step Solution

1
Analyze the first scenario regarding smart card and PIN submission.
Classify this action as identity verification.
Authentication is responsible for verifying the claimed identity of a user or system using provided credentials.
2
Analyze the second scenario regarding security group policy checks for folder modification.
Classify this action as privilege enforcement.
Authorization determines what specific actions, privileges, or resources an authenticated user is permitted to access.
3
Analyze the third scenario regarding logging login timestamps, session length, and data volume.
Classify this action as auditing and metrics tracking.
Accounting measures resource utilization and logs session activities for accountability and auditing purposes.

Key Concept

Authentication, Authorization, and Accounting (AAA)
Question 187Question →

Match each core Zero Trust Architecture (ZTA) principle to its corresponding operational description.

Click a left item, then click its matching right item

Items

Explicit Validation
Continuous Verification
Assume Breach

Matches

Show answer & explanation

Answer

Explicit Validation pairs with always authenticating and authorizing based on all available data points before granting entry. Continuous Verification pairs with constantly evaluating session security posture throughout an active connection. Assume Breach pairs with operating under the premise that internal networks contain hostile actors and using microsegmentation to minimize blast radius.
Each Zero Trust principle aligns directly with its operational intent: Explicit Validation mandates verifying all available data points prior to access; Continuous Verification monitors active sessions dynamically over time; and Assume Breach designs controls under the premise that internal networks are inherently untrusted.

Step-by-Step Solution

1
Identify the core objective of Explicit Validation.
Recognize that explicit validation demands validating identity, context, and permissions on every request prior to granting access.
Explicit validation eliminates implicit trust based on network location or past authorization.
2
Identify the core objective of Continuous Verification.
Recognize that trust must be dynamic and continuously re-assessed throughout the lifecycle of an active session.
Initial authentication is insufficient if device state or user context changes after access is established.
3
Identify the core objective of Assume Breach.
Recognize that defense strategy must assume adversaries already possess internal access, requiring microsegmentation and end-to-end encryption.
Assuming breach minimizes lateral movement and reduces the potential blast radius of security incidents.

Key Concept

Zero Trust Architecture Principles
Question 188Question →

A security architect is reviewing an organization's microservice API gateway architecture. The gateway successfully validates JSON Web Tokens (JWTs) issued by a central Identity Provider to confirm user identity upon initial request. However, once validated, the gateway forwards all traffic to backend microservices using a shared system service account with unrestricted permissions, and backend service logs only record the gateway's IP address. Which of the following correctly identifies the AAA pillars that are currently deficient in the backend microservice architecture and the necessary control implementation?

Show answer & explanation

Answer: Authorization and Accounting are deficient; backend microservices must evaluate individual user claims/roles for access permissions and log specific user session identifiers for each request.

Answer

Authorization and Accounting are deficient; backend microservices must evaluate individual user claims/roles for access permissions and log specific user session identifiers for each request.
The correct option correctly identifies that while Authentication is successfully performed by validating JWTs at the gateway, Authorization is missing because microservices execute requests under a shared unrestricted account without checking user permissions. Furthermore, Accounting is missing because logging only the gateway IP address prevents attributing specific actions to individual user accounts.

Step-by-Step Solution

1
Analyze the existing controls described in the scenario against the AAA framework.
Authentication (identity verification) is handled properly at the API gateway via JWT signature validation.
The system accurately identifies who the user is using token validation.
2
Evaluate the permissions granted to requests arriving at backend microservices.
Requests execute with an unrestricted shared service account regardless of user roles, indicating an Authorization failure.
Authorization dictates what an authenticated user is permitted to do; granting blanket administrative access fails the principle of least privilege.
3
Evaluate audit trails and logging mechanisms.
Logs only record the API gateway IP address, indicating an Accounting failure.
Accounting requires tracking individual user actions and resource usage for auditability and non-repudiation.

Key Concept

Authentication, Authorization, and Accounting (AAA) separation in distributed architectures
Estimated Time:2m 0s
Question 189Question →

A hospital network requires attending physicians to electronically sign controlled substance prescriptions. The security engineering team mandates the use of asymmetric key digital signatures on hardware security tokens rather than hash-based message authentication codes (HMACs) utilizing a shared key between the hospital system and the pharmacy portal. Which of the following primary security concepts explains why asymmetric digital signatures are required for this deployment?

Show answer & explanation

Answer: Non-repudiation, because the private key is uniquely held by the individual physician, preventing them from denying that they issued the prescription.

Answer

Non-repudiation, because the private key is uniquely held by the individual physician, preventing them from denying that they issued the prescription.
Asymmetric digital signatures provide non-repudiation because the signing key (private key) is uniquely held by a single individual. Unlike symmetric HMAC mechanisms where multiple endpoints share the same key and either could generate a valid message authentication code, asymmetric signatures cryptographically bind the action to one specific key holder.

Step-by-Step Solution

1
Analyze the difference between symmetric HMAC and asymmetric digital signatures regarding key ownership.
HMAC relies on a secret key shared between parties, whereas asymmetric signing utilizes a private key known only to the signer.
When a shared secret is used, either party possessing the key could generate the authentication tag, preventing single-party proof of origin.
2
Identify the specific security principle that prevents an originator from disowning an action.
Non-repudiation ensures that an individual cannot deny the authenticity of their signature or transaction.
Because the private key resides exclusively on the physician's hardware token, a valid signature serves as undeniable proof of authorship.

Key Concept

Non-repudiation via Asymmetric Digital Signatures
Estimated Time:1m 30s
Question 190Question →

Match each enterprise identity and access management scenario on the left with the corresponding core AAA phase or concept on the right.

Click a left item, then click its matching right item

Items

An employee enters a User Principal Name (UPN) at a web portal login prompt prior to presenting any credentials.
An identity provider validates a user's FIDO2 WebAuthn asymmetric key signature and hardware token PIN during session initialization.
A security policy engine checks a user's SAML 2.0 role attributes and dynamic network risk score against an Access Control List (ACL) to grant microsegment access.
A central network service logs TACACS+ session start/stop timestamps, executed CLI commands, and total bytes transferred by an administrator.

Matches

Show answer & explanation

Answer

Entering a User Principal Name maps to Identification. Validating FIDO2 signatures and PINs maps to Authentication. Evaluating SAML role attributes against ACLs maps to Authorization. Logging session timestamps and executed commands via TACACS+ maps to Accounting.
Each scenario represents a distinct stage in identity and access management: Identification is claiming an identity (entering a UPN); Authentication is proving that identity (validating FIDO2 keys and PINs); Authorization is determining allowable actions (checking SAML attributes against ACLs); and Accounting is recording session data and actions for audit logs (logging TACACS+ execution details).

Step-by-Step Solution

1
Analyze the first scenario (entering UPN at a prompt).
The subject is claiming who they are without providing proof yet.
Claiming an identity before credential verification is the Identification phase.
2
Analyze the second scenario (validating FIDO2 key signatures and PINs).
The system is verifying the truth of the claimed identity using cryptographic keys and factors.
Proving identity using verification factors is the Authentication phase.
3
Analyze the third scenario (evaluating SAML roles and risk scores against ACLs).
The system is determining what permissions and privileges the authenticated user has.
Enforcing access policies and granting resource rights is the Authorization phase.
4
Analyze the fourth scenario (logging TACACS+ timestamps, commands, and bandwidth).
The system is tracking user activity and resource utilization for historical auditing.
Recording actions, resource usage, and session metrics is the Accounting phase.

Key Concept

Authentication, Authorization, and Accounting (AAA) Framework
Question 191Question →

A security engineering team is establishing baseline controls for a cloud-native software delivery pipeline. Match each security implementation on the left with the primary security objective (CIA Triad pillar or Non-Repudiation) it provides on the right.

Click a left item, then click its matching right item

Items

Digitally signing container images using an asymmetric private key prior to registry deployment.
Encrypting database backups at rest using AES-256 encryption.
Deploying auto-scaling groups across multi-region redundant load balancers.
Generating SHA-256 cryptographic hashes for software release packages.

Matches

Show answer & explanation

Answer

Digitally signing container images maps to Non-Repudiation; encrypting database backups at rest maps to Confidentiality; deploying multi-region auto-scaling load balancers maps to Availability; and generating SHA-256 hashes maps to Integrity.
Each security control aligns directly with a core security objective: Asymmetric digital signatures ensure Non-Repudiation because the signature uniquely proves origin identity. Encryption protects Confidentiality by preventing unauthorized disclosure. Redundant auto-scaling architectures maintain Availability by ensuring system resilience and uptime. Cryptographic hashing enforces Integrity by verifying that files have not suffered unauthorized tampering.

Step-by-Step Solution

1
Analyze container image signing
Asymmetric digital signatures tie an action to a specific private key owner.
This guarantees origin authenticity and prevents the publisher from denying authorship (Non-Repudiation).
2
Analyze database backup encryption
AES-256 encryption obscures sensitive static data.
Restricting unauthorized viewing of data enforces secrecy (Confidentiality).
3
Analyze multi-region auto-scaling
Redundant infrastructure withstands regional failures and sudden load increases.
Ensuring continuous system uptime and responsiveness supports service accessibility (Availability).
4
Analyze SHA-256 package hashing
A cryptographic hash produces a unique digest that changes if data is modified.
Verifying that files remain unaltered during transmission ensures data accuracy (Integrity).

Key Concept

Mapping technical controls to the CIA Triad (Confidentiality, Integrity, Availability) and Non-Repudiation principles.
Question 192Question →

A system administrator is reviewing log retention policies and system auditing controls to ensure compliance with AAA principles. Which of the following tasks specifically perform the Accounting function of AAA? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Tracking session duration and data bandwidth consumed by remote VPN users; Logging specific command-line entries executed by administrators during an active session

Answer

Tracking session duration and data bandwidth consumed by remote VPN users, and logging specific command-line entries executed by administrators during an active session.
Accounting measures resource consumption and creates audit logs of actions performed during a session, such as bandwidth utilization, connection length, and commands executed.

Step-by-Step Solution

1
Define the primary responsibility of the Accounting pillar in AAA.
Accounting provides logging, metric tracking, auditing, and non-repudiation for user and system activity.
AAA separates establishing identity (Authentication), determining permissions (Authorization), and recording activity (Accounting).
2
Evaluate each provided security activity against the Accounting function.
Tracking usage metrics and creating command audit logs record actual user activity. Credential verification is Authentication, and setting folder permissions is Authorization.
Only actions that collect metrics or record event logs fall under Accounting.

Key Concept

Accounting (Auditing, Logging, and Resource Tracking)
Question 193Question →

A financial services firm is implementing Zero Trust Architecture (ZTA) principles to govern remote employee access to cloud-hosted databases and web services. A security engineer is establishing authorization policies at the gateway level. To align with the core Zero Trust tenets of continuous verification and explicit validation, which of the following mechanisms should the engineer enforce?

Show answer & explanation

Answer: Evaluating identity, device compliance posture, and contextual risk dynamically for every single access request regardless of user location or prior authentication

Answer

Evaluating identity, device compliance posture, and contextual risk dynamically for every single access request regardless of user location or prior authentication
The correct answer aligns directly with Zero Trust Architecture (NIST SP 800-207) core principles. Under Zero Trust, no user, device, or network segment is implicitly trusted. Every individual request must be explicitly validated using identity, real-time device health posture, and context before granting access.

Step-by-Step Solution

1
Identify the core requirement of Zero Trust Architecture (ZTA)
ZTA relies on the fundamental tenet: 'Never trust, always verify.'
Perimeter boundaries are no longer sufficient; all requests must be verified explicitly.
2
Analyze how continuous verification applies to access control enforcement
Access must be granted on a per-session, per-request basis by evaluating identity, device posture, location, and risk context.
Prior login status or network location cannot grant persistent implicitly trusted access.
3
Evaluate the choices against Zero Trust principles
The mechanism that continuously re-evaluates risk, identity, and device health per request correctly implements ZTA explicit validation.
This prevents lateral movement and addresses session hijack risks.

Key Concept

Continuous verification and explicit validation in Zero Trust Architecture
Question 194Question →

An enterprise organization is updating security policies for employees accessing corporate SaaS applications. To align with Zero Trust Architecture principles, the security engineering team configures the identity provider to re-evaluate user identity, device health posture, and geolocation context for every single access request, rather than granting trusted access for the duration of the session after initial login. Which core Zero Trust Architecture principle is directly implemented by this configuration?

Show answer & explanation

Answer: Explicit verification

Answer

Explicit verification is the core Zero Trust Architecture principle implemented, as it requires authenticating and authorizing every access attempt based on real-time contextual data points.
Explicit verification requires continuously authenticating and authorizing every access request based on all available data points (such as identity, device health, location, and service posture) rather than relying on persistent session trust.

Step-by-Step Solution

1
Analyze the operational scenario requirements
The system forces continuous validation of identity, device health, and environmental context for each individual request instead of trusting an initial login session.
Identifying the system behavior isolates which architectural philosophy is being practiced.
2
Map the implementation behavior to Zero Trust tenets
Evaluating risk dynamically on every request aligns directly with the 'Verify explicitly' principle of Zero Trust.
Zero Trust operates under the premise that no session or network segment should be granted implicit or persistent trust.

Key Concept

Explicit Verification in Zero Trust Architecture
Question 195Question →

A pharmaceutical research organization operates a platform where external laboratories submit clinical trial data files. To meet regulatory requirements, the security team must implement a mechanism ensuring that a submitting laboratory cannot later deny having submitted a specific file. Which of the following mechanisms best provides this non-repudiation capability?

Show answer & explanation

Answer: Asymmetric digital signatures generated using the submitting laboratory's private key

Answer

Asymmetric digital signatures generated using the submitting laboratory's private key
Asymmetric digital signatures provide non-repudiation because they pair a unique private key (known only to the sender) with a public key. Signing a hash of the file with the private key cryptographically binds the sender's identity to the file payload.

Step-by-Step Solution

1
Identify the core security requirement
The scenario specifically requires non-repudiation, which prevents an entity from denying the authenticity of their signature or transaction.
Regulatory compliance mandates proof of sender origin and file submission.
2
Evaluate cryptographic properties required for non-repudiation
Non-repudiation requires asymmetric cryptography where the signing key is private and unique to the sender.
Symmetric keys or plain hashes cannot uniquely bind a specific entity to a message because symmetric keys are shared and hashes carry no identity metadata.
3
Select the mechanism that guarantees origin authenticity and integrity
Asymmetric digital signatures combine cryptographic hashing with private key signing.
Only the holder of the private key could create the signature, and anyone with the corresponding public key can verify it.

Key Concept

Non-Repudiation vs. Integrity and Symmetric Authentication
Question 196Question →

An enterprise security team is implementing NIST SP 800-207 Zero Trust Architecture (ZTA) principles across their hybrid cloud infrastructure. Match each core Zero Trust operational requirement to its corresponding technical implementation.

Click a left item, then click its matching right item

Items

Continuous Explicit Verification
Microsegmentation Enforcement
Assume Breach Posture
Control and Data Plane Decoupling

Matches

Show answer & explanation

Answer

Continuous Explicit Verification matches with dynamically re-evaluating risk signals throughout active sessions; Microsegmentation Enforcement matches with isolating workloads to restrict lateral movement; Assume Breach Posture matches with encrypting internal traffic and treating internal subnets as untrusted; Control and Data Plane Decoupling matches with separating centralized policy decision logic from gatekeeper enforcement mechanisms.
Each Zero Trust principle directly aligns with specific architectural behaviors: Continuous Explicit Verification constantly reassesses session trust based on real-time context; Microsegmentation limits east-west lateral movement between workloads; Assuming Breach eliminates internal network trust and mandates universal encryption; and Decoupling Control/Data Planes separates policy decision logic from policy enforcement nodes.

Step-by-Step Solution

1
Analyze the operational objective of Continuous Explicit Verification.
Identified that authentication/authorization must occur continually based on live signals rather than once at perimeter entry.
Zero Trust eliminates implicit session trust after initial authentication.
2
Analyze Microsegmentation Enforcement.
Mapped to workload-level isolation and limiting lateral movement.
Microsegmentation divides networks into tiny isolated zones around critical assets.
3
Analyze Assume Breach Posture.
Mapped to internal traffic distrust and universal encryption.
Assuming breach forces organizations to secure internal communications as if the network is compromised.
4
Analyze Control and Data Plane Decoupling.
Mapped to separating Policy Engine/Administrator functions from Policy Enforcement Points.
NIST SP 800-207 specifies logical separation between governance logic and traffic enforcement.

Key Concept

Zero Trust Architecture Core Tenets & NIST SP 800-207 Logical Architecture
Question 197Question →

An enterprise security team deploys a centralized RADIUS server for remote VPN access. During a post-deployment audit, a security analyst reviews the access workflow: users validate their identity via multi-factor authentication, the RADIUS server returns Vendor-Specific Attributes (VSAs) specifying restricted network segments to the VPN gateway, and the gateway transmits session durations to a central SIEM. The analyst discovers that while identity validation succeeds, the RADIUS policy engine fails to evaluate user group memberships properly and instead attaches default attributes granting unrestricted network access across all enterprise subnets. Which pillar of the AAA framework is failing to function as intended?

Show answer & explanation

Answer: Authorization

Answer

Authorization is failing because the RADIUS server fails to enforce role-based access control attributes and group policies after identity verification.
Authorization is the AAA pillar responsible for determining access rights, privilege levels, and resource restrictions based on verified identity and group policy. Because the server successfully verified user identities but failed to apply proper group filtering attributes (VSAs), the control failure occurs within authorization.

Step-by-Step Solution

1
Evaluate the identity proofing phase of the scenario.
Authentication performed successfully because users verified their identity using multi-factor authentication.
Authentication is strictly responsible for verifying that an entity is who they claim to be.
2
Evaluate the auditing and monitoring phase of the scenario.
Accounting performed successfully because session duration metrics were captured and forwarded to the central SIEM.
Accounting tracks consumption metrics and session events for audit visibility.
3
Identify which AAA component controls post-login rights and network segment access.
Authorization failed because the RADIUS policy engine defaulted to granting unrestricted subnet access instead of applying role-specific Vendor-Specific Attributes (VSAs).
Authorization dictates what privileges, permissions, and network access boundaries an authenticated user receives.

Key Concept

Authentication, Authorization, and Accounting (AAA)
Question 198Question →

A security administrator needs to ensure that sensitive company data stored on enterprise laptops remains confidential if a laptop is lost or stolen, and must also verify that system configuration files have not been modified. Which of the following cryptographic techniques should the administrator implement to fulfill these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Symmetric bulk encryption (such as AES-256) for data-at-rest protection; Cryptographic hashing algorithms (such as SHA-256) for integrity checking

Answer

Symmetric bulk encryption (such as AES-256) to protect data confidentiality at rest, and cryptographic hashing algorithms (such as SHA-256) to verify configuration file integrity.
Symmetric bulk encryption (such as AES-256) is designed to efficiently protect data at rest on storage media against unauthorized access. Cryptographic hashing algorithms (such as SHA-256) produce unique digests used to verify data integrity by confirming files have not been modified.

Step-by-Step Solution

1
Identify the cryptographic control required for data confidentiality at rest on stolen hardware.
Symmetric bulk encryption (e.g., AES-256) provides fast and effective encryption for local drives.
Symmetric ciphers use a single secret key for fast encryption and decryption of large volumes of data.
2
Identify the cryptographic control required for verifying configuration file integrity.
Cryptographic hashing algorithms (e.g., SHA-256) generate fixed-size hash values to detect tampering.
Any modification to a configuration file changes its resulting hash digest, indicating a failure of integrity.

Key Concept

Data-at-Rest Encryption and Hashing for Integrity
Estimated Time:1m 0s
Question 199Question →

A network security gateway generates logs that record the start time, end time, and total volume of data transmitted during a user's remote connection session. Which pillar of the Authentication, Authorization, and Accounting (AAA) framework is directly provided by recording these metrics?

Show answer & explanation

Answer: Accounting

Answer

Accounting
Logging connection start times, end times, and data transmission quantities is the core function of Accounting within the AAA framework, as it captures usage data for auditing and metrics.

Step-by-Step Solution

1
Analyze the action described in the scenario.
The system records start times, end times, and data transmission volumes for user sessions.
Determining the purpose of recording these metrics helps identify the corresponding security concept.
2
Evaluate the pillars of the AAA framework.
Tracking resource consumption, session duration, and maintaining audit logs is defined as Accounting.
Authentication proves identity, Authorization determines permissions, and Accounting logs and audits user activity.

Key Concept

Accounting in the AAA Framework
Question 200Question →

An enterprise legal technology organization is upgrading its electronic contract processing platform. The platform must implement controls to guarantee non-repudiation so that signers cannot plausibly deny their participation in executing an agreement. Which of the following technical mechanisms directly satisfy the requirement for non-repudiation? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Digitally signing document hashes using asymmetric private keys bound to individual signers; Validating identity using Public Key Infrastructure (PKI) digital certificates issued by a trusted Certificate Authority

Answer

The mechanisms that directly support non-repudiation are digitally signing document hashes using asymmetric private keys bound to individual signers and validating identity using PKI digital certificates issued by a trusted Certificate Authority.
Non-repudiation provides assurance that the sender of data cannot deny sending it. This is achieved through asymmetric digital signatures, where only the individual possessing the unique private key can generate the signature, and PKI digital certificates, which officially bind that public/private key pair to an authenticated individual identity.

Step-by-Step Solution

1
Analyze the core requirement
The requirement is non-repudiation, which ensures that an origin or author of data cannot deny having authored or sent the data.
Non-repudiation requires proof of identity linked to a unique cryptographic operation that only one entity could perform.
2
Evaluate cryptographic mechanisms
Asymmetric digital signatures combined with PKI certificates establish proof of origin linked to a specific verified identity.
Private keys are kept secret by the owner, and PKI certificates bind that identity to the matching public key.
3
Differentiate symmetric authentication and authorization controls
Symmetric HMAC keys and RBAC authorization policies do not provide non-repudiation.
Shared secret symmetric keys allow any key holder to create the hash digest, and authorization models govern access rights rather than cryptographic proof of origin.

Key Concept

Non-repudiation requires asymmetric cryptography and digital signatures anchored by PKI certificates, distinguishing it from integrity (hashing) and authorization controls.
PreviousPage 10 / 14Next
General Security Concepts Practice Questions — CompTIA Security+ — Page 10 | Examkin