Examkin

General Security Concepts

268 questions

All types268Multiple choice139Multiple select58Matching57Ordering14
Question 21Question →

An enterprise health system is updating its clinical application platform to align with Zero Trust Architecture (ZTA) principles. During an architectural review, an engineer proposes that once a medical professional completes multi-factor authentication (MFA) at the central identity provider (IdP) and receives a session token, all subsequent API requests sent to internal microservices during their 8-hour shift should be implicitly trusted without re-assessing device posture or access policies. Which core Zero Trust Architecture principle does this proposed design fail to uphold?

Show answer & explanation

Answer: Continuous verification, because access requests must be evaluated dynamically on a per-request basis using contextual signal inputs rather than relying on initial authentication success.

Answer

Continuous verification, because access requests must be evaluated dynamically on a per-request basis using contextual signal inputs rather than relying on initial authentication success.
The correct option accurately identifies continuous verification as the missing principle. Zero Trust dictates that no implicit trust is granted based on network location or initial authentication. Every transaction must be continuously authorized using real-time contextual attributes (e.g., identity, device security posture, anomalous behavior patterns).

Step-by-Step Solution

1
Analyze the proposed design in the scenario.
The proposed architecture grants an 8-hour implicit trust window following an initial MFA authentication at the Identity Provider.
Identifying the flaw requires evaluating where implicit trust is being improperly introduced.
2
Evaluate the proposal against Zero Trust tenets.
Zero Trust Architecture assumes that networks are hostile and mandates continuous authentication and authorization for every access request.
Relying on a static 8-hour token without re-checking contextual signals (such as device health or location changes) violates continuous verification.
3
Select the principle that addresses this specific architectural deficiency.
Continuous verification explicitly addresses the requirement to continuously evaluate risk and context rather than trusting prior authentication states.
This directly restores Zero Trust compliance by eliminating temporal implicit trust.

Key Concept

Zero Trust Continuous Verification
Estimated Time:2m 0s
Question 22Question →

Match each core security goal on the left with its primary operational objective on the right.

Click a left item, then click its matching right item

Items

Confidentiality
Integrity
Availability
Non-Repudiation

Matches

Show answer & explanation

Answer

Confidentiality matches with preventing unauthorized disclosure; Integrity matches with ensuring data remains accurate and unaltered; Availability matches with ensuring systems and services are accessible when needed; Non-Repudiation matches with providing verified proof of message authorship so the sender cannot deny sending it.
Each concept aligns directly with its fundamental security definition: Confidentiality prevents unauthorized viewing of sensitive information; Integrity safeguards data against unauthorized modification; Availability ensures system resources are ready for use when needed; Non-Repudiation uses proof of identity and origin so an actor cannot deny an event or message.

Step-by-Step Solution

1
Identify the primary definition of Confidentiality
Confidentiality protects data against unauthorized disclosure or viewing, matching the corresponding objective describing prevention of unauthorized disclosure.
Keeping data secret from unauthorized entities is the fundamental pillar of confidentiality.
2
Identify the primary definition of Integrity
Integrity guarantees data trustworthiness and accuracy, matching the objective regarding preventing unauthorized modification or alteration.
Maintaining unaltered data state ensures system and message integrity.
3
Identify the primary definition of Availability
Availability ensures uptime and accessibility of systems and data for authorized users upon demand.
Operational continuity and service access form the core requirement of availability.
4
Identify the primary definition of Non-Repudiation
Non-repudiation provides indisputable proof of origin, matching the requirement that a sender cannot deny submitting or authoring a message.
Cryptographic mechanisms like digital signatures tie the action directly to a private key holder.

Key Concept

Core concepts of the CIA Triad and Non-Repudiation
Question 23Question →

A healthcare analytics platform receives automated diagnostic telemetry from remote clinics. To comply with regulatory standards, the platform must verify that incoming data is unaltered during transit and ensure that sending clinics cannot deny originating a record. An engineer proposes applying a keyed-Hash Message Authentication Code (HMAC) using a symmetric key shared exclusively between each clinic and the platform. Which of the following security goals is compromised under this implementation when presenting log evidence to an independent third-party auditor?

Show answer & explanation

Answer: Non-repudiation, because symmetric key shared possession allows either the sender or the recipient to generate valid authentication tags.

Answer

Non-repudiation is compromised because symmetric key shared possession allows either the sender or the recipient to generate valid authentication tags.
Non-repudiation mandates that a sender cannot deny creating or transmitting a message. Because an HMAC relies on a shared symmetric secret key possessed by both parties, either the sender or the receiver can calculate a valid hash digest. Consequently, an independent third-party auditor cannot determine which party generated the payload, making symmetric HMAC insufficient for non-repudiation. Digital signatures using asymmetric private keys are required for non-repudiation.

Step-by-Step Solution

1
Identify the required security objectives in the scenario.
The system requires both data integrity (ensuring records are unaltered) and non-repudiation (proof of origin that cannot be disowned before a third-party auditor).
Regulatory compliance mandates verifying message integrity as well as unambiguous attribution of data sources.
2
Analyze the properties of the proposed cryptographic control (HMAC).
HMAC utilizes symmetric shared secret keys known to both the transmitting clinic and the central platform.
Symmetric cryptography allows all keyholders to encrypt, decrypt, or sign data using the identical key.
3
Determine which security pillar fails under third-party audit conditions.
Because the receiving platform also holds the symmetric key, it could synthesize valid HMAC tags itself. An auditor cannot verify whether the clinic or the platform generated the record, thereby violating non-repudiation.
Non-repudiation demands asymmetric digital signatures where only the originator holds the private key.

Key Concept

Distinction between symmetric HMAC (integrity and symmetric authentication) and asymmetric digital signatures (non-repudiation)
Question 24Question →

An enterprise e-commerce organization requires external suppliers to digitally approve updated procurement contracts. During an audit, a supplier claims that an internal administrator forged an approval entry and that the supplier never authorized the agreement. Which security objective and technical implementation best prevents the supplier from successfully denying their action?

Show answer & explanation

Answer: Non-repudiation implemented via asymmetric digital signatures using the supplier's private key

Answer

Non-repudiation implemented via asymmetric digital signatures using the supplier's private key
Non-repudiation ensures that a sender or signatory cannot deny the authenticity of their signature or submission. In asymmetric cryptography, a digital signature is generated using the signer's private key, which is kept secret by the owner. Because no other entity possesses that private key, a valid signature provides undeniable cryptographic proof of authorization and origin.

Step-by-Step Solution

1
Identify the core security requirement from the scenario
The organization needs to prevent an entity from falsely denying that they performed a specific action (approving a contract).
Preventing denial of origin or authorization is the defining requirement of non-repudiation.
2
Evaluate technical controls that satisfy non-repudiation
Asymmetric cryptography provides non-repudiation because only the private key owner could have generated the signature.
Since the private key is held exclusively by the supplier, a valid digital signature proves the document was signed by them.
3
Distinguish non-repudiation from integrity, confidentiality, and authentication mechanisms
Hashes verify integrity alone, symmetric keys are shared so they lack origin proof, and login logs do not cryptographically sign document contents.
Only digital signatures combine integrity verification with undeniable proof of origin.

Key Concept

Non-repudiation and Asymmetric Digital Signatures
Question 25Question →

An organization is updating its network access controls to align with Zero Trust Architecture (ZTA) principles. Which of the following fundamental principles should the security team implement as part of this design? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Explicitly verify every access request using all available contextual data points including identity, location, and device state.; Assume breach and continuously validate trust for all network sessions regardless of connection origin.

Answer

Explicitly verify every access request using all available contextual data points, and assume breach by continuously validating trust for all network sessions regardless of connection origin.
Zero Trust Architecture requires explicit verification of every access request using contextual parameters (identity, health state, location) and operates under an 'assume breach' mindset to enforce continuous validation across all sessions.

Step-by-Step Solution

1
Identify core Zero Trust Architecture principles.
Zero Trust is built on explicit validation, least privilege access, and assuming breach.
These core tenets establish that no user, device, or network segment is inherently trusted.
2
Evaluate the choices against Zero Trust principles.
Validating every request with identity/contextual data and treating internal traffic as potentially compromised align directly with Zero Trust requirements.
These practices remove implicit trust mechanisms found in legacy perimeter-focused security models.

Key Concept

Zero Trust Architecture Core Principles
Question 26Question →

During an emergency response to a critical zero-day remote code execution vulnerability on an enterprise edge gateway, an administrator bypassed standard Change Advisory Board (CAB) review and applied an emergency patch directly to production systems. Within minutes of application, critical external API endpoints began returning persistent HTTP 500 errors, causing high-priority business service outages. To handle this ongoing operational disruption while adhering to formal change management frameworks, which of the following actions should the security operations team take FIRST?

Show answer & explanation

Answer: Execute the pre-approved emergency rollback plan to restore the last known stable configuration while recording the security impact.

Answer

Execute the pre-approved emergency rollback plan to restore the last known stable configuration while recording the security impact.
The primary objective of change management during a failed emergency deployment is to rapidly minimize business disruption while maintaining security integrity. Executing a documented, pre-approved rollback plan restores the system to a known good baseline state and ensures the security impact is recorded for subsequent review by the Change Advisory Board (CAB).

Step-by-Step Solution

1
Analyze the operational impact of the emergency change
Identified that an unvetted emergency change caused active service degradation across production APIs
Emergency changes carry inherent risk of unexpected operational side effects if not thoroughly tested
2
Select the appropriate change control response procedure
Identified the emergency rollback plan as the immediate prioritized action
Standard change management governance dictates using documented, pre-tested rollback plans to restore baseline operations immediately when a deployment destabilizes production environments
3
Initiate post-implementation security analysis
Captured audit logs and documented security impacts for subsequent CAB review
Even emergency changes and rollbacks require thorough documentation and security impact assessments to refine future change workflows

Key Concept

Emergency Change Control and Rollback Execution
Question 27Question →

A security operations team is implementing an active defense strategy across a enterprise network to detect lateral movement and credential theft. Match each deception technology implementation on the left with its corresponding active defense classification on the right.

Click a left item, then click its matching right item

Items

Injecting fake database connection strings into endpoint memory to alert security teams when dumped by malware
Deploying an interconnected subnet of intentionally vulnerable virtual machines simulating a corporate Active Directory infrastructure
Placing an attractive financial audit spreadsheet on a shared network drive embedded with an invisible phone-home beacon
Adding false DNS records and browser history entries to endpoint hosts to steer network scanners toward a monitoring gateway

Matches

Show answer & explanation

Answer

Matching pairs: Endpoint memory strings -> Honeytoken; Interconnected virtual subnet -> Honeynet; Financial audit spreadsheet -> Honeyfile; False DNS records and browser entries -> Breadcrumb.
Each deception technology fulfills a distinct operational role in active defense strategy. Honeytokens are data-level artifacts such as fake keys or connection strings. Honeynets provide comprehensive, multi-system network decoys to observe attacker behavior. Honeyfiles rely on fake documents containing tracking mechanisms. Breadcrumbs consist of host artifacts configured on active production systems to guide threat actors into deceptive environments.

Step-by-Step Solution

1
Analyze each deception deployment scenario by evaluating its deployment layer (data, host, document, network).
Identified specific active defense controls based on structural characteristics.
Deception technologies are classified by whether they represent network segments, decoy files, isolated data elements, or directional lures.
2
Differentiate between host-level directional lures and standalone digital tokens.
Paired endpoint memory injection with honeytoken and false DNS/browser history entries with breadcrumb.
Honeytokens are passive digital data traps, whereas breadcrumbs are directional artifacts specifically placed on legitimate host endpoints to lure attackers away from real assets.
3
Differentiate between decoy files and multi-system infrastructure decoys.
Paired the beaconed spreadsheet with honeyfile and the simulated AD subnet with honeynet.
A honeyfile is a single deceptive data container, whereas a honeynet comprises multiple decoy systems operating together.

Key Concept

Deception and Disruption Technologies
Question 28Question →

Match each active deception technology component on the left with its corresponding operational implementation function on the right.

Click a left item, then click its matching right item

Items

Honeytoken
Honeynet
Honeyfile
Breadcrumb

Matches

Show answer & explanation

Answer

Honeytoken pairs with simulated credential or API key; Honeynet pairs with high-interaction network segment of decoy systems; Honeyfile pairs with enticing decoy document on an audited file share; Breadcrumb pairs with client-side artifact planted to direct attackers toward decoy infrastructure.
Each deception technology matches its specific deployment role: Honeytokens represent fake credentials or data elements; Honeynets constitute multi-host decoy network environments; Honeyfiles are audited decoy documents; and Breadcrumbs serve as endpoint lure artifacts that steer threat actors toward decoy assets.

Step-by-Step Solution

1
Identify the data-centric deception element intended for credential/data harvesting detection.
Associate Honeytoken with fake credentials, database entries, or API keys embedded in production repositories.
Honeytokens focus specifically on monitoring unauthorized usage of non-production data values.
2
Differentiate macro-level network decoy environments from single-host artifacts.
Associate Honeynet with the complete simulated network segment containing multiple decoy systems.
Honeynets provide multi-system telemetry to observe broad attack vectors and lateral movement techniques.
3
Distinguish between monitored document files and endpoint redirection lures.
Associate Honeyfile with decoy documents stored on file shares, and Breadcrumb with host-level artifacts that direct attackers to honeypots.
Honeyfiles monitor data access directly, whereas breadcrumbs manipulate adversary reconnaissance paths on host systems.

Key Concept

Deception and Disruption Technologies in Active Defense Architecture
Question 29Question →

A security engineer aims to detect unauthorized internal reconnaissance and credential scraping within private source code repositories without provisioning decoy server infrastructure or altering existing network routing. The engineer inserts inactive, traceable API access keys into public test environment files. Any attempt to authenticate using these fake credentials triggers an immediate high-fidelity alert containing the origin IP address and request details. Which of the following deception technologies did the security engineer deploy?

Show answer & explanation

Answer: Honeytoken

Answer

Honeytoken is the correct technology because fake API keys and credentials used to lure and detect unauthorized scrapers qualify as honeytokens.
Honeytokens are specific fake data artifacts—such as fake database entries, cloud access keys, or API tokens—placed inside systems or repositories. Because legitimate applications and personnel do not use these tokens, any usage indicates unauthorized activity or compromised systems, providing high-fidelity detection without heavy infrastructure overhead.

Step-by-Step Solution

1
Analyze the deployed resource type described in the scenario.
The resource consists of fake API access keys placed inside repository files, not dedicated host OS environments or network appliances.
Deception technologies are categorized by whether they mimic data assets (honeytokens/honeyfiles), individual servers (honeypots), or network segments (honeynets).
2
Evaluate the detection mechanism.
Alerts trigger when an adversary attempts to utilize the non-functional credential.
Honeytokens rely on the principle that legitimate users have no operational reason to access or use fake artifacts.
3
Match the implementation to the correct deception classification.
The deployment matches a honeytoken.
Embedding fake credentials, database records, or API keys into valid files directly defines honeytoken usage.

Key Concept

Honeytokens vs. Decoy Infrastructure in Active Defense
Question 30Question →

An enterprise organization is migrating a monolithic legacy application to a cloud-native microservices architecture. To maintain security governance during continuous integration and continuous deployment (CI/CD) updates, the Security Advisory Board is revising the organization's change control procedures. Which of the following technical and procedural requirements must be integrated into the change management workflow to evaluate and mitigate security impacts effectively? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Embedding automated static and dynamic security testing gates into the build pipeline to evaluate code changes before deployment approval; Establishing immutable baseline configuration repositories paired with automated drift detection to identify unauthorized system modifications

Answer

The correct requirements are embedding automated static and dynamic security testing gates into the build pipeline and establishing immutable baseline configuration repositories paired with automated drift detection.
Integrating automated security testing gates directly into deployment pipelines ensures code changes undergo rigorous vulnerability evaluation prior to deployment, while maintaining immutable configuration baselines with automated drift detection guarantees that any unauthorized operational changes are identified and remediated promptly.

Step-by-Step Solution

1
Evaluate pre-implementation change validation controls for modern CI/CD software pipelines.
Integrating automated static (SAST) and dynamic (DAST) testing into pipeline build stages enforces mandatory security impact analysis prior to production promotion.
Pre-deployment automated testing prevents vulnerable or non-compliant code from reaching live environments without proper security assessment.
2
Evaluate post-implementation integrity controls and baseline maintenance requirements.
Configuring baseline repositories with automated drift detection continuously cross-checks active infrastructure state against approved change records.
Drift detection ensures all systems remain within authorized security postures and alerts administrators to out-of-band or malicious modifications.
3
Analyze incorrect procedural and technical shortcuts against change management principles.
Emergency changes still require retrospective Change Advisory Board (CAB) validation, and perimeter firewall rules cannot replace proper application patch and change testing.
Governance frameworks mandate full documentation of emergency workflows, while control selection must address root causes rather than applying external workarounds.

Key Concept

Change Management and Security Impacts
Question 31Question →

An enterprise security architecture team is deploying a deception and disruption strategy within an operational technology (OT) network to detect unauthorized lateral movement and internal service discovery. The environment includes legacy industrial control systems, programmable logic controllers (PLCs), and human-machine interfaces (HMIs). Which of the following implementation practices should the team select to achieve high-fidelity threat detection while preventing operational disruption to production systems? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploying low-interaction honeypots on isolated subnets that emulate industrial control protocols to generate alerts upon any inbound connection attempt.; Placing decoy credentials and fake network path references into administrative host memory to serve as breadcrumbs leading attackers toward decoy systems.

Answer

The correct practices are deploying low-interaction honeypots on isolated subnets that emulate industrial control protocols and placing decoy credentials or network references in administrative host memory as breadcrumbs.
Deploying low-interaction honeypots on isolated subnets that emulate industrial protocols provides a safe, non-intrusive method for capturing unauthorized network discovery in OT environments without placing real hardware at risk. Furthermore, placing decoy credentials and fake path references in host memory acts as breadcrumbs that steer adversaries away from production assets and into monitored deception traps during lateral movement.

Step-by-Step Solution

1
Analyze the operational constraints and deception objectives in an industrial control environment.
Identified the need for non-disruptive detection mechanisms capable of capturing adversary reconnaissance and lateral movement without impacting production PLCs.
Legacy OT systems are highly sensitive to network traffic anomalies and cannot support intrusive inline controls.
2
Evaluate the low-interaction honeypot deployment strategy.
Isolated low-interaction honeypots simulating industrial protocols safely trap unauthorized connection attempts and yield high-fidelity alerts since legitimate traffic should never contact these decoy nodes.
Low-interaction honeypots reduce resource usage and eliminate operational risk to real physical equipment.
3
Evaluate host-based deception techniques using breadcrumbs.
Planting decoy credentials and fake network paths on host systems acts as breadcrumbs that direct attackers performing memory scraping or configuration enumeration toward deception traps.
Breadcrumbs manipulate adversary decision-making during post-exploitation reconnaissance.
4
Identify misconceptions regarding deception technology roles.
Rejected options that misclassify honeypots as inline filtering mechanisms or active vulnerability remediation agents.
Deception technology operates as a detective/intelligence control rather than an inline preventive firewall or active vulnerability management system.

Key Concept

Deception and Disruption Architecture in Specialized Networks
Question 32Question →

An enterprise network engineering team is preparing to deploy an automated microsegmentation policy across multi-tenant cloud virtual networks during a scheduled maintenance window. The submitted change request includes implementation timelines, interface configuration backups, and automated rollback scripts triggered by network latency thresholds. During the Change Advisory Board (CAB) security impact review, a security analyst notes that the backout plan restores default port settings but does not restore tenant isolation access control lists (ACLs) or cryptographic session states. Which of the following security risks is most likely to occur if this rollback plan is executed as written?

Show answer & explanation

Answer: The network environment could be left in an inconsistent configuration state with residual permissive access, exposing tenant workloads to unauthorized lateral movement.

Answer

Executing a backout plan that fails to restore tenant access control lists and isolation rules leaves residual permissive configurations, introducing severe lateral movement risks.
A comprehensive security impact assessment during change management requires verifying that backout and rollback plans restore all security controls—including access control lists and tenant isolation rules—to a verified baseline state. Restoring network interface hardware settings without restoring security policy dependencies leaves the network in a permissive, insecure state, exposing systems to lateral movement.

Step-by-Step Solution

1
Analyze the change management proposal and proposed backout procedure
Identified that the rollback script restores interface defaults but omits tenant ACL state restoration
Change management security impact assessments must evaluate backout scenarios as thoroughly as primary deployment steps
2
Evaluate the security impact of an incomplete rollback plan
Discovered that uncoordinated interface resets leave microsegmentation boundaries open or improperly defined
Security dependencies (such as ACL integrity and isolation boundaries) must be preserved during backout execution to maintain baseline protection
3
Determine the primary risk exposure resulting from CAB approval without remediation
Residual permissive rules create unauthorized network paths between isolated tenant workloads
Inconsistent state rollbacks compromise confidentiality and integrity by exposing assets to potential lateral movement

Key Concept

Security Impact Assessment of Rollback and Backout Plans in Change Control
Question 33Question →

An enterprise IT security team is implementing a major network security policy update to enforce microsegmentation across production database servers. Place the following change management steps in the correct chronological order from first to last to ensure proper security governance and operational continuity.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence begins with performing a security risk assessment and impact analysis, followed by validating rules and rollback procedures in staging. Next, the change request and test evidence are submitted to the Change Advisory Board (CAB) for authorization. After approval, the change is implemented in production during a maintenance window. Finally, post-implementation verification and configuration baseline updates are completed.
A standard security-focused change management workflow follows a linear progression: initial security impact assessment, staging environment validation of the change and rollback plan, CAB review and approval, production execution within an authorized window, and post-implementation review with configuration baseline updating.

Step-by-Step Solution

1
Identify potential security risks, technical dependencies, and business impacts.
Establishes baseline risk parameters and defines scope.
Security impact assessment must precede technical testing and formal review.
2
Execute technical testing and validate rollback steps in a staging environment.
Confirms the change works as designed without causing unintended outages.
Empirical testing in non-production is required to prove feasibility before seeking authorization.
3
Present the change package to the Change Advisory Board (CAB).
Obtains formal business and operational approval for deployment.
CAB approval ensures governance alignment and prevents scheduling conflicts.
4
Implement the configuration change during the scheduled maintenance window.
Applies the new security policies live in production.
Production execution must adhere to authorized timing constraints.
5
Perform post-implementation review (PIR) and update system baselines.
Confirms operational stability and updates security baseline records.
Ensures auditability and records the final post-change state.

Key Concept

Change Control Lifecycle and Security Impact Assessment
Question 34Question →

An enterprise organization updates its endpoint compliance architecture by deploying Mobile Device Management (MDM) software across all remote corporate devices. When an endpoint fails continuous compliance checks or exhibits unauthorized system modifications, the MDM agent automatically executes a remotely triggered cryptographic wipe script to isolate and sanitize the stored sensitive data. A security auditor asks the architecture team to classify this automated software action. Which of the following classifications correctly identifies both the primary category and functional type of this security control?

Show answer & explanation

Answer: Technical category and Corrective functional type

Answer

Technical category and Corrective functional type
The security control is implemented via software logic and automated scripts running on an endpoint, which places it firmly in the Technical control category. Because the script executes automatically following a compliance failure to neutralize data exposure and return the endpoint to a safe state, its functional behavior is Corrective.

Step-by-Step Solution

1
Identify the mechanism used to implement the security control
The mechanism relies on software agents, cryptographic scripts, and automated device technology.
Security measures executed via hardware, software, or firmware belong to the Technical control category.
2
Determine the functional objective of the security control during an incident
The remote wipe script executes after an endpoint fails compliance checks to mitigate risk and reverse exposure.
Controls that react to an incident or compliance failure by restoring security or limiting damage operate as Corrective controls.
3
Synthesize category and functional type classifications
Combining software-based implementation with incident remediation yields a Technical, Corrective control.
CompTIA Security+ classifies automated endpoint software scripts taking post-compromise action under Technical category and Corrective functional type.

Key Concept

Dual-axis classification of security controls (Categories: Technical, Operational, Managerial, Physical; Types: Preventive, Detective, Corrective, Deterrent, Compensating, Directive)
Question 35Question →

An organization's security team is evaluating a microservices deployment where an API gateway receives requests containing OAuth 2.0 JSON Web Tokens (JWTs) issued by a central Identity Provider. The API gateway validates the cryptographic signature of incoming tokens to verify issuer authenticity, but it immediately forwards all requests to downstream microservices without checking if the token's granted scopes permit access to the requested endpoint URI. Which pillar of the Authentication, Authorization, and Accounting (AAA) framework is improperly implemented at the API gateway layer?

Show answer & explanation

Answer: Authorization

Answer

Authorization
Authorization is responsible for enforcing privilege boundaries by verifying that an authenticated subject possesses the required permissions or scopes to access a specific resource. In this scenario, verifying the JWT signature accomplishes authentication, but failing to evaluate token scopes against the target microservice endpoint means authorization is completely omitted at the gateway.

Step-by-Step Solution

1
Analyze the active control mechanism performed by the API gateway.
The API gateway validates the cryptographic signature of the incoming JWT.
Verifying signature validity and issuer trust confirms who sent the request, satisfying the Authentication requirement of AAA.
2
Identify the missing security verification step in the request processing pipeline.
The gateway forwards requests without evaluating token scopes against the target resource URI.
Restricting what actions an authenticated user can perform on specific endpoints is the defining function of Authorization.
3
Map the vulnerability to the corresponding AAA pillar.
Authorization is the missing or improperly implemented AAA component.
Failing to check permission scopes allows users to perform unauthorized actions despite being authenticated.

Key Concept

Distinguishing Authentication (verifying identity) from Authorization (enforcing permissions) in API and token-based architectures.
Estimated Time:1m 30s
Question 36Question →

An enterprise security architect is reviewing identity and access management (IAM) controls across network access servers, policy engines, and central logging services. Match each security mechanism on the left with the specific AAA function or protocol capability on the right that best describes its primary operational purpose.

Click a left item, then click its matching right item

Items

EAP-TLS protocol negotiation during an 802.1X network access request using X.509 digital certificates
XACML policy decision point (PDP) evaluating user attributes, environmental context, and object sensitivity
TACACS+ daemon capturing individual privilege shell commands executed by network engineers
RADIUS start, interim-update, and stop messages logging connection duration and byte counts

Matches

Show answer & explanation

Answer

EAP-TLS pairs with Mutual Authentication; XACML PDP pairs with Attribute-Based Authorization; TACACS+ command logging pairs with Administrative Command Accounting; RADIUS start/stop metrics pair with Resource Usage Accounting.
Matching each security control to its primary operational capability correctly distinguishes between authentication methods, authorization policy models, and distinct accounting mechanism granularity.

Step-by-Step Solution

1
Analyze EAP-TLS network negotiation
Identified as requiring X.509 certificates on both client and server sides
Because both endpoints validate each other's credentials, EAP-TLS provides mutual authentication.
2
Analyze XACML PDP policy evaluations
Identified as evaluating dynamic rules based on subject, resource, action, and environment attributes
XACML is the enterprise standard for implementing Attribute-Based Access Control (ABAC) authorization.
3
Analyze TACACS+ command logging capabilities
Identified as tracking specific CLI commands executed during administrator sessions
TACACS+ provides granular administrative command accounting, distinct from general connection logging.
4
Analyze RADIUS session message exchanges
Identified as tracking session stats such as uptime, connect time, and bandwidth consumption
RADIUS accounting focuses primarily on resource usage metrics and overall session auditing.

Key Concept

Core Pillars and Implementations of AAA (Authentication, Authorization, and Accounting)
Estimated Time:2m 0s
Question 37Question →

A network security administrator is auditing the Centralized Access Management setup for core network switches using RADIUS and TACACS+ protocols. The audit aims to verify proper alignment with the Authentication, Authorization, and Accounting (AAA) framework. Which of the following statements correctly describe AAA operational characteristics in this deployment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: TACACS+ decouples authentication and authorization, enabling granular, per-command authorization checks after identity is established.; Accounting mechanisms capture command execution logs and session timestamps to establish non-repudiation and forensic traceability.

Answer

TACACS+ decouples authentication and authorization, enabling granular, per-command authorization checks after identity is established; and Accounting mechanisms capture command execution logs and session timestamps to establish non-repudiation and forensic traceability.
The statements emphasizing TACACS+ decoupled AAA architecture for per-command authorization and accounting's role in recording audit logs for non-repudiation are correct. TACACS+ separates authentication from authorization, allowing granular command authorization per user session. Accounting tracks user activities and resource usage after access is granted.

Step-by-Step Solution

1
Analyze the AAA phase definitions and protocol implementations for RADIUS and TACACS+.
Identify that authentication verifies identity, authorization enforces permissions (like TACACS+ per-command authorization), and accounting records activity.
AAA requires clear functional separation between proving identity, granting permissions, and logging events.
2
Evaluate protocol-specific architecture regarding AAA coupling and packet encryption.
Confirm that TACACS+ separates AAA services and encrypts the entire body, unlike RADIUS which combines authentication and authorization while only encrypting passwords.
Protocol design dictates how granular access controls and payload protections are applied.

Key Concept

Authentication, Authorization, and Accounting (AAA) Protocol Architecture
Question 38Question →

A logistics corporation requires remote dispatchers to complete multi-factor authentication (MFA) when initiating their daily workspace session. Once initial login is established, users maintain persistent access to centralized fleet databases for ten hours without additional context evaluations, even if their host endpoint connects to untrusted networks or exhibits degraded compliance status mid-session. Which of the following actions best aligns this environment with core Zero Trust Architecture principles?

Show answer & explanation

Answer: Implementing dynamic access policies that continuously evaluate user identity, device posture, and risk factors throughout the session

Answer

Implementing dynamic access policies that continuously evaluate user identity, device posture, and risk factors throughout the session
The correct response addresses the vulnerability by enforcing continuous verification, a foundational pillar of Zero Trust Architecture (ZTA). Rather than trusting an active session indefinitely after a single login check, ZTA continuously monitors contextual attributes—such as endpoint posture, IP changes, and user behavioral risk—to enforce real-time access decisions.

Step-by-Step Solution

1
Analyze the vulnerability described in the scenario
Identified that authentication occurs only once at session initiation, allowing unverified access for 10 hours despite potential risk posture changes.
Static, one-time authentication creates a window of implicit trust during the active session.
2
Evaluate candidate solutions against Zero Trust Architecture principles
Zero Trust requires continuous verification and explicit validation regardless of network location or initial authentication success.
Access decisions must be constantly re-evaluated based on real-time context (device health, location shifts, behavioral anomalies).
3
Select the option that eliminates implicit session trust
Dynamic policy evaluation throughout the session duration fulfills the continuous verification tenant.
It ensures access rights adjust automatically if device compliance or user risk changes.

Key Concept

Continuous Verification and Explicit Validation in Zero Trust Architecture
Question 39Question →

A cloud engineering team is refactoring a legacy microservices application to adhere to Zero Trust Architecture principles. During initial login, an edge gateway authenticates the incoming client request using mutual TLS (mTLS) and issues a signed JSON Web Token (JWT). However, backend microservices are configured to trust any request carrying a valid JWT signature without evaluating real-time user context, device compliance, or risk metrics for individual downstream API transactions. Which Zero Trust Architecture operational vulnerability is most directly presented by this configuration?

Show answer & explanation

Answer: Failing to enforce continuous verification by allowing initial session authentication to grant implicit trust for subsequent API transactions.

Answer

Failing to enforce continuous verification by allowing initial session authentication to grant implicit trust for subsequent API transactions.
Zero Trust Architecture requires explicit, continuous verification of every request based on all available data points (such as user identity, device posture, location, and risk state). Validating a token signature once upon entry without re-assessing context during subsequent microservice interactions creates a window of implicit session trust that contradicts Zero Trust tenets.

Step-by-Step Solution

1
Analyze the technical scenario context
The architecture authenticates clients upfront via mTLS and issues a token, but downstream microservices blindly trust the token signature without re-evaluating risk, context, or posture.
Identifying what checks are present versus what checks are missing exposes the architectural gap.
2
Map the technical gap to core Zero Trust tenets
Zero Trust mandates explicit validation and continuous verification on every resource request regardless of prior session authentication state.
Static acceptance of initial authentication violates the 'never trust, always verify' requirement for ongoing session evaluation.
3
Select the option that precisely targets continuous verification failure
The option identifying reliance on initial session authentication over continuous contextual re-evaluation directly matches the flaw.
Accepting static tokens without real-time risk evaluation allows hijacked sessions or compromised endpoints to execute actions without continuous checks.

Key Concept

Continuous Verification and Explicit Validation in Zero Trust Architecture
Question 40Question →

A system administrator places a fake spreadsheet named confidential_salaries.xlsx containing fictitious employee records onto a corporate file share. The administrator configures security software to trigger an immediate alert whenever this file is opened or accessed. Which of the following deception technologies has the administrator implemented?

Show answer & explanation

Answer: Honeyfile

Answer

Honeyfile
The correct answer is a honeyfile. A honeyfile is an intentionally placed decoy file containing synthetic or bait information. Because legitimate business processes do not require accessing this dummy file, any open or read activity immediately alerts security analysts to suspicious or unauthorized internal reconnaissance.

Step-by-Step Solution

1
Analyze the scenario details
The administrator deployed a single dummy file with alerting configured to detect unauthorized file access.
Deception controls utilize decoy assets within an environment to lure unauthorized actors and provide early warning of an intrusion.
2
Identify the deception technology category
A fake file used as a decoy to catch unauthorized users accessing sensitive storage locations is defined as a honeyfile.
Honeyfiles specifically monitor file shares and data repositories for unauthorized reads or copies.

Key Concept

Honeyfile Deception Control
PreviousPage 2 / 14Next
General Security Concepts Practice Questions — CompTIA Security+ — Page 2 | Examkin