CompTIA Security+ — All Questions

An attacker sends an email that appears to come from the company CEO, urgently asking the finance team to wire funds to a new vendor. What type of social engineering attack is this?

• a.Business email compromise✓
• b.Watering hole attack
• c.Tailgating
• d.Vishing

Business email compromise (BEC) impersonates a trusted executive or partner to trick employees into transferring money or sensitive data. It relies on authority and urgency rather than malware. Because it uses legitimate-looking email, it often bypasses technical filters and targets human judgment.

Which malware type encrypts a victim's files and demands payment for the decryption key?

• a.Ransomware✓
• b.Adware
• c.Keylogger
• d.Rootkit

Ransomware encrypts data and extorts the victim for a decryption key, often with a payment deadline. Modern variants also exfiltrate data first to enable double extortion. Reliable offline backups are the most effective recovery control.

A user reports that their credentials worked on a fake login page that looked identical to the corporate portal. Which attack most likely occurred?

• a.Buffer overflow
• b.SQL injection
• c.Privilege escalation
• d.Phishing✓

Phishing lures users to fraudulent pages that harvest credentials by mimicking legitimate sites. The cloned portal is the classic delivery mechanism. User training and multifactor authentication reduce the impact of harvested passwords.

Which term describes a previously unknown software vulnerability for which no patch yet exists?

• a.Zero-day✓
• b.Legacy flaw
• c.Race condition
• d.Misconfiguration

A zero-day is a vulnerability unknown to the vendor and defenders, giving zero days to prepare a fix. Attackers exploiting it face no available patch. Compensating controls like segmentation and behavior-based detection help mitigate the risk.

An attacker overwhelms a web server with traffic from thousands of compromised devices, making it unavailable. What is this called?

• a.Distributed denial-of-service✓
• b.On-path replay
• c.DNS poisoning
• d.Man-in-the-middle

A distributed denial-of-service (DDoS) attack floods a target from many compromised hosts, often a botnet, exhausting bandwidth or resources. The goal is to disrupt availability rather than steal data. Rate limiting, scrubbing services, and CDNs help absorb the load.

Which type of threat actor is typically well-funded, highly skilled, and motivated by espionage on behalf of a government?

• a.Hacktivist
• b.Script kiddie
• c.Insider by accident
• d.Nation-state actor✓

Nation-state actors, often labeled advanced persistent threats, have significant resources, patience, and sophisticated tooling. Their goals include espionage, sabotage, and strategic advantage. They frequently use zero-days and long-dwell stealthy campaigns.

A disgruntled employee copies confidential designs to a USB drive before resigning. This is an example of what threat?

• a.Shadow IT
• b.Watering hole
• c.Insider threat✓
• d.Supply chain attack

An insider threat comes from someone with authorized access who misuses it, whether maliciously or negligently. The employee here abuses legitimate access to steal data. Data loss prevention, least privilege, and monitoring help detect such activity.

Which attack injects malicious database commands through unvalidated user input fields?

• a.Directory traversal
• b.SQL injection✓
• c.Session hijacking
• d.Cross-site scripting

SQL injection inserts crafted database statements through input that the application fails to sanitize. It can expose, modify, or delete data. Parameterized queries and input validation are the primary defenses.

An attacker leaves infected USB drives in a company parking lot hoping employees will plug them in. This technique is known as:

• a.Whaling
• b.Baiting✓
• c.Shoulder surfing
• d.Pretexting

Baiting entices victims with something appealing, such as a found USB drive, to trigger a compromise. Curiosity leads the victim to introduce the malware themselves. Endpoint controls that block unknown removable media reduce this risk.

Which malware disguises itself as legitimate software but performs malicious actions once installed?

• a.Logic bomb
• b.Botnet
• c.Worm
• d.Trojan✓

A Trojan masquerades as a benign or useful program to trick users into running it. Unlike a worm, it does not self-replicate; it relies on deception. Once executed it may open backdoors, steal data, or download further payloads.

A malicious program spreads across a network automatically without any user interaction. What is it?

• a.Spyware
• b.Trojan
• c.Worm✓
• d.Rootkit

A worm self-replicates and propagates across networks by exploiting vulnerabilities, requiring no user action. This makes outbreaks spread rapidly. Timely patching and network segmentation slow worm propagation.

An attacker calls an employee pretending to be IT support to trick them into revealing a password. This voice-based social engineering is called:

• a.Phishing
• b.Spooling
• c.Smishing
• d.Vishing✓

Vishing uses voice calls to manipulate victims into disclosing information or performing actions. The attacker builds a plausible pretext, often posing as a trusted party. Verification callbacks and never sharing passwords by phone are effective countermeasures.

Which attack compromises a website frequently visited by a target group to infect their systems?

• a.Rainbow table
• b.Typosquatting
• c.Pass-the-hash
• d.Watering hole✓

A watering hole attack infects a site the intended victims commonly use, so visiting it delivers malware. It targets a community indirectly through a trusted resource. Keeping browsers patched and using endpoint protection reduces exposure.

Which term describes a hidden vulnerability in a third-party component that compromises everyone who uses it?

• a.Configuration drift
• b.Insider risk
• c.Physical risk
• d.Supply chain risk✓

Supply chain risk arises when a trusted vendor, library, or hardware component is compromised, affecting downstream customers. A single tainted update can reach many organizations. Vendor assessments and software bill of materials help manage this risk.

Malware that records every keystroke a user types to capture passwords is a:

• a.Keylogger✓
• b.Rootkit
• c.Backdoor
• d.Ransomware

A keylogger captures keyboard input to steal credentials, messages, and other sensitive typed data. It can be software or hardware based. Multifactor authentication limits the damage from stolen static passwords.

An attacker registers a domain like 'goggle.com' hoping users mistype the real address. This is:

• a.DNS spoofing
• b.Typosquatting✓
• c.Pharming
• d.Session fixation

Typosquatting registers look-alike domains based on common misspellings to catch mistyped traffic. Victims may land on malicious or fraudulent pages. Users should verify URLs and organizations can defensively register close variants.

Which type of malware hides deep in the operating system to conceal its presence and maintain privileged access?

• a.Worm
• b.Adware
• c.Trojan
• d.Rootkit✓

A rootkit embeds itself at a low level, often the kernel, to hide processes and files while retaining elevated control. Its stealth makes detection and removal difficult. Secure boot and integrity monitoring help defend against rootkits.

A phishing attack that specifically targets a high-value executive is known as:

• a.Spear tailoring
• b.Vishing
• c.Whaling✓
• d.Smishing

Whaling is a form of spear phishing aimed at senior executives or high-profile targets. The lures are carefully crafted for that individual and their authority. Executive awareness training and verification procedures reduce success.

Which attack intercepts and possibly alters communication between two parties who believe they are talking directly?

• a.On-path (man-in-the-middle)✓
• b.Cross-site request forgery
• c.Brute force
• d.Denial-of-service

An on-path attack, historically called man-in-the-middle, positions the attacker between two endpoints to eavesdrop or tamper with traffic. Unencrypted channels are especially vulnerable. Strong encryption and certificate validation mitigate it.

A malicious script stored on a vulnerable web page runs in other users' browsers when they view it. This is:

• a.Stored cross-site scripting✓
• b.Clickjacking
• c.SQL injection
• d.CSRF

Stored cross-site scripting (XSS) persists malicious script on the server so it executes in every visitor's browser. It can steal session tokens or perform actions as the victim. Output encoding and input validation prevent XSS.

Which term describes exploiting a time gap between checking a resource and using it?

• a.Replay attack
• b.Race condition✓
• c.Buffer overflow
• d.Injection

A race condition, or time-of-check to time-of-use flaw, exploits the interval between validating and using a resource. An attacker changes state in that window to bypass controls. Proper locking and atomic operations prevent it.

An attacker follows an employee through a secured door without badging in. This physical attack is called:

• a.Piggyback encryption
• b.Tailgating✓
• c.Shoulder surfing
• d.Dumpster diving

Tailgating is entering a restricted area by closely following an authorized person through a controlled door. It exploits politeness and weak physical enforcement. Mantraps, turnstiles, and awareness reduce tailgating.

Which attack precomputes hashes to reverse password hashes quickly?

• a.Rainbow table attack✓
• b.Dictionary attack
• c.Credential stuffing
• d.Password spraying

A rainbow table uses precomputed hash chains to reverse unsalted password hashes efficiently. Adding a unique random salt to each password defeats this approach. Modern slow hashing functions further increase cracking cost.

An attacker tries a few very common passwords across many user accounts to avoid lockouts. This is:

• a.Brute force
• b.Pass-the-hash
• c.Rainbow table
• d.Password spraying✓

Password spraying tests a small set of common passwords across many accounts, staying under lockout thresholds. It exploits weak, reused passwords at scale. Strong password policies, MFA, and anomaly detection counter it.

Which security model assumes no user or device is trusted by default, even inside the network perimeter?

• a.Zero trust✓
• b.Perimeter security
• c.Implicit trust
• d.Defense in depth

Zero trust removes automatic trust based on network location and continuously verifies every request. Access is granted per session based on identity, device posture, and context. It reduces lateral movement after a breach.

Layering multiple independent security controls so that one failure does not cause a breach is called:

• a.Air gapping
• b.Single sign-on
• c.Defense in depth✓
• d.Least privilege

Defense in depth stacks overlapping controls across people, process, and technology so no single failure is catastrophic. If one layer is bypassed, others still protect the asset. It reflects the assumption that any one control can fail.

Dividing a network into isolated zones to limit the spread of an attack is known as:

• a.Tunneling
• b.Segmentation✓
• c.Load balancing
• d.Port forwarding

Network segmentation separates systems into zones so a compromise in one cannot freely reach others. It limits lateral movement and contains breaches. VLANs, firewalls, and microsegmentation implement this principle.

Which network area sits between the internet and the internal network to host public-facing services?

• a.Screened subnet (DMZ)✓
• b.VPN concentrator
• c.Air gap
• d.Intranet

A screened subnet, historically called a DMZ, isolates public-facing servers from the internal network. If a public host is compromised, the internal network remains protected by an additional boundary. Firewalls control traffic on both sides.

Which cloud model gives the customer the most control over the operating system and applications while the provider manages the physical hardware?

• a.Software as a Service
• b.Platform as a Service
• c.Function as a Service
• d.Infrastructure as a Service✓

Infrastructure as a Service (IaaS) provides virtualized compute, storage, and networking while the customer manages the OS and applications. This maximizes customer control and responsibility. SaaS, by contrast, hands nearly everything to the provider.

In cloud computing, which concept defines who is responsible for securing which layers of the stack?

• a.Multitenancy
• b.Serverless
• c.Elasticity
• d.Shared responsibility model✓

The shared responsibility model divides security duties between the cloud provider and the customer. The provider secures the underlying infrastructure while the customer secures data, identities, and configurations. Misunderstanding the split is a common source of cloud breaches.

Which technology allows multiple isolated operating systems to run on a single physical host?

• a.Containerization
• b.Clustering
• c.Virtualization✓
• d.Load balancing

Virtualization uses a hypervisor to run multiple guest operating systems on one physical machine, each isolated in a virtual machine. It improves resource use and isolation. Hardening the hypervisor is critical because it is a high-value target.

Which approach packages an application with its dependencies to run consistently across environments while sharing the host OS kernel?

• a.Bare-metal deployment
• b.Full virtualization
• c.Containerization✓
• d.Air gapping

Containerization bundles an application and its dependencies into a lightweight, portable unit that shares the host kernel. Containers start quickly and use fewer resources than full VMs. Isolation is weaker than VMs, so kernel and image security matter.

Which principle grants users only the minimum access needed to perform their job?

• a.Least privilege✓
• b.Implicit deny
• c.Separation of duties
• d.Defense in depth

Least privilege limits each user or process to only the permissions required for its role. This shrinks the attack surface and limits damage from compromised accounts. Regular access reviews keep privileges aligned with need.

A firewall rule set ends with a rule that blocks anything not explicitly permitted. This is called:

• a.Explicit allow
• b.Implicit deny✓
• c.Stateful inspection
• d.Failover

Implicit deny blocks all traffic that no earlier rule explicitly allows. It ensures only intended traffic passes and unknowns are rejected by default. This deny-by-default posture is a core secure design principle.

Which design ensures a system has no single point of failure by duplicating critical components?

• a.Segmentation
• b.Redundancy✓
• c.Least functionality
• d.Tokenization

Redundancy duplicates critical components, such as power supplies or servers, so failure of one does not cause an outage. It supports high availability and resilience. Combined with failover, it keeps services running through faults.

Which term describes an isolated environment where suspicious code can be executed and analyzed safely?

• a.Sandbox✓
• b.Honeypot
• c.Bastion host
• d.Air gap

A sandbox is a contained, isolated environment for running untrusted code without risking the host or network. It is used to analyze malware behavior or test software safely. Escapes from the sandbox are a key security concern.

Which decoy system is deployed to attract attackers and study their techniques?

• a.Proxy server
• b.Load balancer
• c.Honeypot✓
• d.Jump server

A honeypot is a deliberately vulnerable-looking decoy that lures attackers away from real assets and gathers intelligence on their methods. Any interaction with it is suspicious by design. Honeynets extend the concept to entire fake networks.

Which hardened intermediary host is used to securely administer devices in a sensitive network segment?

• a.Web proxy
• b.Honeypot
• c.Jump server (bastion host)✓
• d.DNS resolver

A jump server, or bastion host, is a tightly controlled system that administrators connect through to reach protected segments. It centralizes and monitors administrative access. Hardening and logging on this host are essential because it is a gateway to sensitive systems.

Which control physically separates a highly sensitive network from all other networks and the internet?

• a.Air gap✓
• b.Screened subnet
• c.NAT
• d.VPN

An air gap isolates a system or network so it has no physical or logical connection to untrusted networks. It is used for critical systems like industrial controls. Data transfer requires manual, controlled processes, which reduces remote attack surface.

Which concept keeps availability high by automatically shifting workloads to a standby system when the primary fails?

• a.Segmentation
• b.Failover✓
• c.Load balancing
• d.Snapshotting

Failover automatically transfers operations to a redundant standby when the active component fails, minimizing downtime. It is a cornerstone of high-availability design. Regular testing ensures the standby will actually take over when needed.

Embedded systems in industrial equipment that monitor and control physical processes are collectively known as:

• a.IoT hubs
• b.ICS/SCADA✓
• c.Edge routers
• d.Thin clients

Industrial control systems (ICS), including SCADA, manage physical processes in utilities and manufacturing. They often run legacy software and prioritize availability over patching. Segmentation and strict access control are key because downtime and safety are critical.

Which design principle removes unnecessary services, ports, and software to reduce a system's attack surface?

• a.Least functionality✓
• b.Elasticity
• c.Multitenancy
• d.Redundancy

Least functionality configures a system to run only the services and features required for its purpose. Disabling unneeded components shrinks the attack surface. It complements least privilege by hardening the system itself, not just user access.

Which type of encryption uses the same key to encrypt and decrypt data?

• a.Asymmetric
• b.Hashing
• c.Symmetric✓
• d.Steganographic

Symmetric encryption uses a single shared secret key for both encryption and decryption, such as AES. It is fast and suited to bulk data. The main challenge is securely distributing the shared key.

Which cryptographic method uses a public and private key pair?

• a.Asymmetric encryption✓
• b.Salting
• c.Hashing
• d.Symmetric encryption

Asymmetric encryption uses a mathematically linked key pair: a public key to encrypt and a private key to decrypt, or the reverse for signatures. It solves the key distribution problem of symmetric systems. RSA and elliptic curve are common examples.

Which one-way function produces a fixed-length value that cannot be reversed to the original input?

• a.Steganography
• b.Symmetric cipher
• c.Hashing✓
• d.Tokenization

Hashing transforms input into a fixed-length digest that cannot be feasibly reversed. It verifies integrity because any change to the input changes the hash. SHA-256 is a widely used secure hashing algorithm.

Adding a unique random value to each password before hashing to defeat precomputed attacks is called:

• a.Salting✓
• b.Peppering
• c.Stretching
• d.Encoding

Salting prepends or appends a unique random value to each password before hashing. This ensures identical passwords produce different hashes and defeats rainbow tables. Each salt must be unique and stored alongside the hash.

Which entity in a PKI issues and signs digital certificates?

• a.Key escrow agent
• b.Certificate authority✓
• c.Registration authority
• d.Certificate holder

A certificate authority (CA) issues, signs, and vouches for digital certificates, binding a public key to an identity. Trust in the CA underpins the entire PKI. A compromised CA can undermine trust for all certificates it issued.

Which mechanism lets a client quickly check whether a single certificate has been revoked?

• a.Certificate pinning
• b.Key stretching
• c.Online Certificate Status Protocol✓
• d.Certificate signing request

The Online Certificate Status Protocol (OCSP) queries a responder in real time to check a certificate's revocation status. It is faster and more current than downloading a full certificate revocation list. OCSP stapling improves performance and privacy.

What does a digital signature primarily provide?

• a.Integrity and non-repudiation✓
• b.Availability
• c.Faster encryption
• d.Confidentiality only

A digital signature proves the message came from the holder of the private key and was not altered, giving integrity, authentication, and non-repudiation. It does not by itself keep the content secret. It is created by encrypting a hash with the signer's private key.

Which authentication factor category does a fingerprint belong to?

• a.Something you are✓
• b.Something you know
• c.Something you have
• d.Somewhere you are

A fingerprint is a biometric, which is the 'something you are' factor based on physical characteristics. Combining it with a different factor, such as a password, creates multifactor authentication. Biometrics resist sharing but raise privacy and revocation concerns.

Requiring a password plus a one-time code from a phone app is an example of:

• a.Role-based access
• b.Federation
• c.Multifactor authentication✓
• d.Single sign-on

Multifactor authentication combines two or more independent factor categories, here something you know and something you have. This greatly reduces the risk from a stolen password alone. An attacker would need to defeat both factors.

Which access control model grants permissions based on a user's assigned job function?

• a.Rule-based access control
• b.Mandatory access control
• c.Discretionary access control
• d.Role-based access control✓

Role-based access control (RBAC) assigns permissions to roles, and users inherit access by being placed in a role. It simplifies administration and enforces consistency. Changing a role updates access for everyone assigned to it.

Which model uses security labels and clearances, common in government, where the system enforces access centrally?

• a.Discretionary access control
• b.Attribute-based access control
• c.Mandatory access control✓
• d.Role-based access control

Mandatory access control (MAC) enforces access based on classification labels and clearances set by a central authority. Users cannot change permissions on resources they own. It is used where strict, non-discretionary control is required.

Which secure protocol replaces Telnet for encrypted remote command-line access?

• a.HTTP
• b.SNMPv1
• c.FTP
• d.SSH✓

Secure Shell (SSH) provides encrypted remote administration, replacing the plaintext Telnet protocol. It protects credentials and session data in transit. SSH also underpins secure file transfer and tunneling.

Which protocol secures web traffic by encrypting HTTP with TLS?

• a.SMTP
• b.LDAP
• c.SFTP
• d.HTTPS✓

HTTPS layers HTTP over TLS to encrypt web traffic, protecting confidentiality and integrity between browser and server. It also authenticates the server through its certificate. Modern sites should use TLS 1.2 or 1.3 with strong ciphers.

Which protocol provides secure file transfer by running over an SSH connection?

• a.TFTP
• b.FTPS
• c.SFTP✓
• d.HTTP

SFTP transfers files over an SSH channel, encrypting both credentials and data. It differs from FTPS, which is FTP secured with TLS. SFTP uses a single connection, simplifying firewall configuration.

Which technology creates an encrypted tunnel for remote users to access a private network over the internet?

• a.DMZ
• b.NAT
• c.VPN✓
• d.Proxy

A virtual private network (VPN) establishes an encrypted tunnel over an untrusted network, protecting traffic between the remote user and the corporate network. It preserves confidentiality and integrity in transit. IPsec and TLS are common VPN foundations.

Which single sign-on standard is widely used to exchange authentication data between identity providers and web applications?

• a.TACACS+
• b.SAML✓
• c.RADIUS
• d.Kerberos

Security Assertion Markup Language (SAML) exchanges authentication and authorization assertions between an identity provider and service providers, enabling web single sign-on. The identity provider vouches for the user so each application does not manage passwords. It is common in enterprise federation.

Replacing sensitive data such as a credit card number with a non-sensitive substitute value is called:

• a.Tokenization✓
• b.Hashing
• c.Salting
• d.Compression

Tokenization swaps sensitive data for a meaningless token, keeping the real value in a secure vault. The token has no exploitable value if stolen. It is widely used to reduce the scope of payment card data handling.

A dedicated hardware device that securely generates and stores cryptographic keys is a:

• a.Proximity token
• b.TPM
• c.Smart card
• d.Hardware security module✓

A hardware security module (HSM) is a tamper-resistant device that generates, stores, and manages cryptographic keys and performs crypto operations. It keeps keys isolated from general-purpose systems. HSMs are common in PKI and high-assurance environments.

Which chip on a motherboard stores keys and supports features like full-disk encryption and secure boot?

• a.Smart card
• b.CPU cache
• c.HSM
• d.Trusted Platform Module✓

The Trusted Platform Module (TPM) is a chip integrated into a device that securely stores keys and measurements for boot integrity and disk encryption. It binds encryption to specific hardware. It underpins features like BitLocker and secure boot.

Which property ensures a sender cannot later deny having sent a signed message?

• a.Availability
• b.Non-repudiation✓
• c.Anonymity
• d.Confidentiality

Non-repudiation prevents a party from convincingly denying an action, such as sending a digitally signed message. It relies on the private key being unique to the signer. Digital signatures and reliable logs provide non-repudiation.

Which is the correct order of the incident response process?

• a.Preparation, detection, containment, eradication, recovery, lessons learned✓
• b.Recovery, containment, detection, preparation, lessons learned
• c.Detection, preparation, recovery, containment, eradication
• d.Containment, detection, recovery, preparation, eradication

A standard incident response lifecycle proceeds through preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Preparation comes first so the team is ready before an incident. Lessons learned closes the loop to improve future response.

During incident response, which step focuses on limiting the damage and preventing the threat from spreading?

• a.Containment✓
• b.Preparation
• c.Recovery
• d.Eradication

Containment isolates affected systems to stop the incident from spreading while preserving evidence. It buys time to plan eradication without further loss. Short-term and long-term containment strategies balance disruption and safety.

Which system aggregates and correlates log data from many sources to detect security events in near real time?

• a.IDS
• b.DLP
• c.SIEM✓
• d.VPN

A security information and event management (SIEM) system centralizes logs from across the environment and correlates them to surface incidents. It supports alerting, dashboards, and investigation. Effective tuning reduces alert fatigue and false positives.

Which control monitors network traffic and actively blocks detected malicious activity inline?

• a.IPS✓
• b.IDS
• c.Honeypot
• d.SIEM

An intrusion prevention system (IPS) sits inline and can automatically block or drop malicious traffic it detects. Unlike an IDS, which only alerts, an IPS takes preventive action. Tuning is important to avoid blocking legitimate traffic.

Which technology inspects data in motion and at rest to prevent unauthorized exfiltration of sensitive information?

• a.Firewall
• b.VPN
• c.Data loss prevention✓
• d.Load balancer

Data loss prevention (DLP) detects and blocks sensitive data from leaving the organization through email, uploads, or removable media. It uses content inspection and policy rules. DLP helps enforce compliance and protect intellectual property.

Which process applies vendor updates to fix known software vulnerabilities?

• a.Hardening
• b.Patch management✓
• c.Baselining
• d.Tokenization

Patch management is the disciplined process of testing and deploying vendor updates to remediate vulnerabilities. Timely patching closes known exploit paths. A formal cycle balances speed with stability testing.

Reducing a system's attack surface by disabling unneeded services and applying secure configurations is called:

• a.Segmentation
• b.Failover
• c.Federation
• d.Hardening✓

Hardening strengthens a system by removing unnecessary services, closing ports, and applying secure settings and baselines. It reduces the attack surface before deployment. Configuration benchmarks guide consistent hardening.

Which practice ensures evidence remains admissible by documenting who handled it and when?

• a.Legal hold
• b.Chain of custody✓
• c.Data retention
• d.Nondisclosure

Chain of custody documents every person who handled evidence and each transfer, preserving integrity for legal proceedings. Gaps can render evidence inadmissible. It is essential in digital forensics and investigations.

During forensic acquisition, why is a cryptographic hash taken of a disk image?

• a.To compress the image
• b.To encrypt the evidence
• c.To prove the copy was not altered✓
• d.To speed up analysis

Hashing the original and the forensic image proves they are identical and that the evidence was not modified. Matching hashes demonstrate integrity throughout the investigation. Any change to the data would produce a different hash.

Which type of backup captures only the data changed since the last full backup and does not clear the archive bit each time?

• a.Incremental
• b.Full
• c.Differential✓
• d.Snapshot

A differential backup copies all data changed since the last full backup, growing larger each day until the next full. Restores require the last full plus the latest differential. Incremental backups, by contrast, capture changes since the last backup of any type.

Which metric defines the maximum acceptable amount of data loss measured in time?

• a.RTO
• b.MTTR
• c.MTBF
• d.RPO✓

The recovery point objective (RPO) is the maximum tolerable data loss expressed as a time window, guiding backup frequency. An RPO of one hour means backups must occur at least hourly. It differs from RTO, which addresses restoration time.

Which metric defines the maximum acceptable time to restore a service after an outage?

• a.MTBF
• b.MTTF
• c.RPO
• d.RTO✓

The recovery time objective (RTO) is the target duration within which a service must be restored after disruption. It drives decisions about redundancy and recovery capability. Meeting the RTO limits business impact from downtime.

Which recovery site is fully equipped and can take over operations almost immediately?

• a.Hot site✓
• b.Cold site
• c.Mobile site
• d.Warm site

A hot site is fully provisioned with hardware, data, and connectivity so it can assume operations quickly. It offers the fastest recovery but the highest cost. Cold sites are cheaper but require significant setup time.

Which scan identifies known weaknesses in systems without actively exploiting them?

• a.Fuzzing
• b.Penetration test
• c.Red team exercise
• d.Vulnerability scan✓

A vulnerability scan enumerates known weaknesses using signatures and checks without exploiting them. It is broad and repeatable for routine assessment. A penetration test goes further by attempting actual exploitation.

An authorized simulated attack that attempts to exploit vulnerabilities to test defenses is a:

• a.Penetration test✓
• b.Tabletop exercise
• c.Vulnerability scan
• d.Compliance audit

A penetration test authorizes ethical hackers to actively exploit weaknesses to demonstrate real-world risk. It validates whether vulnerabilities are truly exploitable and how far an attacker could get. Rules of engagement define scope and limits.

Which detection method flags activity that deviates from an established normal pattern?

• a.Signature-based
• b.Anomaly-based✓
• c.Rule-based
• d.Whitelist-based

Anomaly-based detection builds a baseline of normal behavior and alerts on deviations, enabling detection of novel attacks. It can catch previously unseen threats but may produce more false positives. Signature-based detection, by contrast, matches known patterns.

Which endpoint solution continuously records activity and enables investigation and automated response to threats on hosts?

• a.Screen lock policy
• b.Antivirus signature file
• c.Host firewall
• d.EDR✓

Endpoint detection and response (EDR) continuously monitors endpoint behavior, records telemetry, and supports rapid investigation and automated containment. It goes beyond signature antivirus by detecting suspicious behavior. It is central to modern threat hunting and response.

Which practice ensures logs cannot be tampered with by centralizing them on a protected, write-once server?

• a.Log rotation
• b.Log integrity and centralization✓
• c.Log compression
• d.Log sampling

Centralizing logs on a hardened, tamper-resistant server preserves their integrity for investigations. Attackers often try to delete local logs to hide activity, so protected central storage defeats this. Techniques like write-once media and hashing further ensure integrity.

A discussion-based session where a team walks through their response to a hypothetical incident is called a:

• a.Vulnerability assessment
• b.Full interruption test
• c.Penetration test
• d.Tabletop exercise✓

A tabletop exercise is a discussion-based walkthrough of a scenario to validate plans and roles without touching production. It reveals gaps in the incident response or continuity plan at low cost. It complements more disruptive technical tests.

Which automation approach uses playbooks to coordinate tools and streamline security operations tasks?

• a.DLP
• b.SIEM
• c.SOAR✓
• d.EDR

Security orchestration, automation, and response (SOAR) uses playbooks to automate and coordinate actions across security tools. It accelerates repetitive response tasks and reduces analyst workload. It often works alongside a SIEM to act on alerts.

Which principle requires that two people perform a sensitive action together to prevent fraud?

• a.Mandatory vacation
• b.Least privilege
• c.Separation of duties✓
• d.Job rotation

Separation of duties splits a critical task so no single person controls it end to end, reducing fraud and error. For example, one person requests a payment and another approves it. It is a key internal control in security and finance.

Rotating employees through different roles helps detect fraud and reduce dependence on any one person. This control is:

• a.Least privilege
• b.Separation of duties
• c.Job rotation✓
• d.Onboarding

Job rotation moves staff through different duties, which can expose irregularities hidden by a single long-tenured employee. It also reduces single points of knowledge. Mandatory vacations serve a similar detective purpose.

Which secure disposal method makes data on a drive unrecoverable by destroying the media physically?

• a.Deletion
• b.Defragmentation
• c.Formatting
• d.Physical destruction✓

Physical destruction, such as shredding or degaussing, renders storage media and its data unrecoverable. Simple formatting or deletion can leave data recoverable. Destruction is preferred for highly sensitive media at end of life.

Which threat intelligence source consists of shared indicators of compromise that defenders can ingest to detect attacks?

• a.Firmware feed
• b.Marketing feed
• c.Threat feed✓
• d.Social media feed

A threat intelligence feed supplies indicators of compromise such as malicious IPs, domains, and file hashes. Ingesting these into detection tools helps identify known threats quickly. Feeds should be evaluated for relevance and timeliness to be useful.

Which document outlines acceptable and prohibited uses of an organization's IT systems by employees?

• a.Memorandum of understanding
• b.Acceptable use policy✓
• c.Business impact analysis
• d.Service level agreement

An acceptable use policy (AUP) defines how employees may and may not use company systems and data. It sets expectations and provides grounds for enforcement. Users typically acknowledge it as a condition of access.

Which risk response involves purchasing insurance to shift financial impact to a third party?

• a.Risk acceptance
• b.Risk transference✓
• c.Risk mitigation
• d.Risk avoidance

Risk transference shifts the financial consequences of a risk to another party, commonly through insurance or contracts. The risk still exists, but its impact is borne elsewhere. It is chosen when handling the risk directly is impractical or costly.

Choosing to take no action and knowingly bear a low-level risk is called:

• a.Risk acceptance✓
• b.Risk transference
• c.Risk avoidance
• d.Risk mitigation

Risk acceptance is a conscious decision to tolerate a risk, usually when the cost of controls exceeds the potential loss. It should be formally documented and approved. Acceptance is appropriate for low-impact or low-likelihood risks.

Eliminating a risky activity entirely so the risk no longer applies is known as:

• a.Risk mitigation
• b.Risk avoidance✓
• c.Risk acceptance
• d.Risk transference

Risk avoidance removes the risk by discontinuing the activity that causes it. For example, not deploying a feature that would expose sensitive data. It fully eliminates that risk but may sacrifice a business opportunity.

Which regulation governs the protection of personal data for individuals in the European Union?

• a.SOX
• b.PCI DSS
• c.HIPAA
• d.GDPR✓

The General Data Protection Regulation (GDPR) sets strict requirements for handling the personal data of EU residents. It mandates consent, breach notification, and data subject rights. Non-compliance can result in substantial fines.

Which standard governs the secure handling of payment card data?

• a.HIPAA
• b.PCI DSS✓
• c.FERPA
• d.GDPR

The Payment Card Industry Data Security Standard (PCI DSS) defines controls for organizations that store, process, or transmit cardholder data. It is a contractual requirement rather than a law. Compliance reduces the risk of payment data breaches.

Which US regulation protects the privacy and security of health information?

• a.GDPR
• b.PCI DSS
• c.HIPAA✓
• d.GLBA

The Health Insurance Portability and Accountability Act (HIPAA) sets requirements for safeguarding protected health information. It applies to healthcare providers, plans, and their business associates. Violations can lead to significant penalties.

A calculation of expected yearly loss from a risk, found by multiplying single loss expectancy by annual rate of occurrence, is the:

• a.Annualized loss expectancy✓
• b.Risk appetite
• c.Exposure factor
• d.Residual risk

Annualized loss expectancy (ALE) estimates the expected yearly cost of a risk by multiplying single loss expectancy (SLE) by the annualized rate of occurrence (ARO). It supports cost-benefit decisions about controls. Spending more than the ALE on mitigation is usually not justified.

Which assessment identifies the critical processes and the impact of their disruption to guide continuity planning?

• a.Business impact analysis✓
• b.Vulnerability scan
• c.Gap analysis
• d.Penetration test

A business impact analysis (BIA) identifies critical business functions and quantifies the effect of their disruption over time. It informs RTO and RPO targets and prioritizes recovery. It is a foundation of business continuity planning.

Which agreement defines the measurable service levels a provider must meet, such as uptime guarantees?

• a.Service level agreement✓
• b.BPA
• c.NDA
• d.MOU

A service level agreement (SLA) specifies measurable commitments like availability and response times, with consequences for missing them. It sets clear expectations between provider and customer. Monitoring against the SLA holds the provider accountable.

Which legal agreement prohibits parties from disclosing confidential information they receive?

• a.SLA
• b.AUP
• c.Non-disclosure agreement✓
• d.MOU

A non-disclosure agreement (NDA) legally binds parties to keep shared confidential information secret. It is common when sharing sensitive data with vendors, partners, or employees. Breaching it can result in legal liability.

The residual risk that remains after all controls have been applied should be:

• a.Eliminated completely
• b.Accepted by management✓
• c.Transferred automatically
• d.Ignored entirely

Residual risk is what remains after mitigations are in place, and it cannot usually be reduced to zero. Senior management should formally acknowledge and accept it. This ensures leadership is aware of and owns the remaining exposure.

Which framework provides a widely used structure for managing cybersecurity risk through functions like Identify, Protect, Detect, Respond, and Recover?

• a.NIST Cybersecurity Framework✓
• b.MITRE ATT&CK
• c.PCI DSS
• d.OWASP Top Ten

The NIST Cybersecurity Framework organizes security activities into core functions: Identify, Protect, Detect, Respond, and Recover. It offers a flexible, risk-based approach adaptable to any organization. It helps align security programs with business goals.

Regular training that teaches employees to recognize phishing and follow security policies is called:

• a.Change management
• b.Security awareness training✓
• c.Penetration testing
• d.Vulnerability management

Security awareness training educates users to recognize threats like phishing and to follow safe practices. Because people are a common attack vector, this reduces human-related risk. Ongoing and simulated exercises reinforce the behavior over time.

A teenager with no coding ability downloads a ready-made exploit tool from a forum and launches it against a school website. Which threat actor best describes them?

• a.A hacktivist collective motivated by a political or ideological cause
• b.Unskilled attacker✓
• c.A nation-state group running a long-term espionage campaign for strategic advantage
• d.An organized crime syndicate seeking large-scale financial extortion

An unskilled attacker (often called a script kiddie) relies on prewritten tools and exploits without deep technical knowledge. Their capability is limited to what others have built, but automated tools still cause real damage. Motivation is often curiosity or notoriety rather than strategic gain.

A group defaces a corporation's website to protest its environmental record and posts a manifesto. What primarily motivates this threat actor?

• a.Financial gain achieved by reselling stolen payment card data on illicit markets
• b.Corporate espionage to steal a competitor's product designs and pricing strategy
• c.Long-term intelligence collection on behalf of a foreign government's interests
• d.Philosophical or political beliefs✓

Hacktivists are driven by ideology, politics, or social causes rather than money. Defacement and public manifestos draw attention to their message. Recognizing motivation helps defenders anticipate targets and tactics.

Which characteristic most distinguishes an insider threat from an external attacker?

• a.Insiders can only cause harm accidentally and never act with malicious intent
• b.Insiders always possess more advanced malware and custom zero-day exploits than outsiders
• c.Insiders are exclusively motivated by financial gain and never by revenge
• d.Authorized access to systems and knowledge of internal processes✓

Insiders already hold legitimate access and understand where valuable data lives, letting them bypass perimeter defenses. This access and knowledge is their defining advantage, whether the act is malicious or negligent. Monitoring, least privilege, and DLP help detect misuse.

During analysis of a sophisticated, multi-year campaign using several zero-days and custom implants, investigators note extensive funding and patience. Which actor attribute does this indicate?

• a.Internal origin, meaning the activity almost certainly came from a current employee
• b.High resources and funding consistent with a nation-state actor✓
• c.Accidental exposure caused by a simple misconfiguration rather than an attacker
• d.Low sophistication typical of an opportunistic smash-and-grab intruder

Sustained campaigns using multiple zero-days and bespoke tooling signal significant resources and funding, a hallmark of nation-state or advanced persistent threat groups. Sophistication and capability are key attributes for attribution. This shapes the required defensive posture.

Attackers steal sensitive customer records and threaten to publish them unless the company pays. Beyond the theft, what is the attackers' primary motivation?

• a.Service disruption intended purely to knock the company offline during peak hours
• b.Blackmail✓
• c.War or destabilization directed by a state sponsor against critical infrastructure
• d.Ethical disclosure meant to responsibly warn the company about a weakness

Threatening to release stolen data unless paid is extortion, a blackmail motivation. This is central to double-extortion ransomware, where data is both encrypted and threatened with exposure. Understanding motivation guides negotiation and response decisions.

An employee receives a text message claiming a package could not be delivered and prompting them to tap a link to reschedule. Which attack vector is being used?

• a.A message-based vector delivered by SMS text✓
• b.An unsecured wireless network broadcasting a deceptive access point name
• c.A malicious removable USB device left in a common area to tempt an employee
• d.A vulnerable client application exposed to the internet without patches

Smishing uses SMS text messages as the delivery vector for a social engineering lure. The link typically leads to a credential-harvesting page or malware. Messaging vectors exploit trust in familiar communication channels.

A hospital still runs a critical application on an operating system that the vendor no longer patches. Why is this a significant attack vector?

• a.Unsupported systems no longer receive security updates, leaving known vulnerabilities permanently open✓
• b.Unsupported systems automatically encrypt all traffic, which slows performance unacceptably
• c.Unsupported systems require multifactor authentication that frustrates clinical staff during care
• d.Unsupported systems always run faster because they lack modern security overhead and logging

End-of-life systems stop receiving vendor patches, so newly discovered vulnerabilities are never fixed and remain exploitable. Attackers specifically target these known gaps. Isolation, compensating controls, or replacement reduce the risk.

Attackers compromise a managed service provider and use its trusted remote-management tools to reach many downstream customers. This is an example of which vector?

• a.A supply chain attack✓
• b.A brute-force attack against each customer's externally exposed login portal
• c.An open service port discovered during an untargeted internet-wide scan
• d.A direct phishing campaign aimed individually at each victim organization's staff

Compromising a trusted provider to reach its customers is a supply chain attack. The MSP's legitimate access and tools let the attacker bypass each customer's defenses. Vendor risk assessment and least-privilege integration limit this exposure.

A caller invents a detailed story about being a new auditor who urgently needs employee records to complete a compliance deadline. Which technique underlies this approach?

• a.Shoulder surfing performed by physically watching a target enter their credentials
• b.Tailgating through a secured entrance behind an authorized badge holder
• c.Pretexting✓
• d.Dumpster diving to recover discarded documents containing sensitive information

Pretexting builds a fabricated but believable scenario to justify a request for information or access. The invented auditor role gives the attacker a reason the target will accept. Verifying identity through independent channels defeats it.

During an election, coordinated fake social media accounts deliberately spread false claims to manipulate public opinion. Which concept does this represent?

• a.Watering hole targeting of a website that a narrow group of victims frequents
• b.Business email compromise directed at a finance department for fraudulent transfers
• c.Impersonation of a specific individual to gain access to that person's accounts
• d.A disinformation campaign✓

Disinformation is the deliberate spread of false information to deceive or manipulate, distinct from misinformation shared without intent to harm. Coordinated inauthentic accounts amplify the false narrative. Awareness and source verification counter influence campaigns.

A fraudulent email uses a well-known bank's exact logo, colors, and formatting to convince recipients it is genuine. Which technique is central here?

• a.Pharming that redirects users to a fraudulent site by poisoning name resolution
• b.Brand impersonation✓
• c.Credential stuffing that reuses previously breached username and password pairs
• d.Typosquatting that registers a domain resembling a common misspelling of a real site

Brand impersonation copies a trusted organization's visual identity to lend credibility to a scam. Victims lower their guard because the message looks official. Verifying the sender and avoiding embedded links reduces the risk.

Over several friendly conversations, an attacker casually gathers small details about a company's VPN vendor and patch schedule without ever asking directly. This technique is called:

• a.A directory traversal attack against a misconfigured public web server
• b.A logic bomb planted to trigger malicious code on a specific future date
• c.Eliciting information✓
• d.A denial-of-service attack aimed at exhausting the company's network bandwidth

Eliciting information extracts useful details through seemingly innocent conversation rather than a direct request. Aggregated small facts can reveal exploitable weaknesses. Training staff to recognize probing questions limits leakage.

After opening a malicious attachment, a user's machine begins allowing an attacker to view the screen, move the mouse, and browse files remotely. Which malware is most likely present?

• a.A password-protected archive used only to smuggle data past email filters
• b.A remote access Trojan✓
• c.A logic bomb waiting for a specific condition before executing its payload
• d.Adware that displays unwanted advertisements but does not grant remote control

A remote access Trojan (RAT) gives an attacker interactive remote control of the infected host. It typically arrives disguised as a legitimate file and then opens a covert channel. Behavior-based detection and egress monitoring help catch its command traffic.

A departing developer inserts code that will delete production databases if their user account is ever removed from the payroll system. What kind of malware is this?

• a.A self-replicating worm that spreads across the network without any trigger condition
• b.A logic bomb✓
• c.A rootkit designed to hide processes and maintain stealthy administrative access
• d.Ransomware that encrypts files and demands payment for a decryption key

A logic bomb lies dormant until a specific condition or trigger is met, then executes its malicious payload. Here the trigger is the account's removal. Code reviews and separation of duties reduce the chance such code is planted.

A newly purchased laptop ships with numerous preinstalled trial programs that consume resources and expand the attack surface. What are these unwanted extras called?

• a.Bloatware✓
• b.A rootkit embedded in firmware to survive operating system reinstallation
• c.Ransomware that must be paid before the operating system will boot normally
• d.Spyware that secretly transmits the user's keystrokes to a remote server

Bloatware is unnecessary preinstalled software that wastes resources and can introduce vulnerabilities. It is not always overtly malicious but enlarges the attack surface. Removing it when hardening a new device is good practice.

An investigation finds malicious activity running entirely in memory through PowerShell, with no executable written to disk. Which malware characteristic does this describe?

• a.A boot sector infector that modifies the master boot record on the hard drive
• b.Fileless malware✓
• c.A removable-media worm that copies itself onto every USB drive it detects
• d.A traditional virus that infects executable files and requires them to run to spread

Fileless malware operates in memory and abuses legitimate tools like PowerShell, leaving little on disk for signature scanners to find. This living-off-the-land approach evades many defenses. Behavioral monitoring and script logging improve detection.

While logged into their bank, a user visits a malicious page that silently submits a funds-transfer request using the user's active session. Which attack is this?

• a.Cross-site request forgery✓
• b.SQL injection that manipulates backend database queries through unsanitized input
• c.A brute-force attack systematically guessing the user's online banking password
• d.DNS poisoning that redirects the banking domain to an attacker-controlled server

Cross-site request forgery (CSRF) tricks a victim's browser into sending an unwanted authenticated request to a site where they are logged in. The site trusts the session cookie automatically. Anti-CSRF tokens and same-site cookies prevent it.

An attacker with a low-level user account exploits a flaw to gain administrator rights on the same system. What is this technique called?

• a.Data exfiltration achieved by tunneling stolen files out through DNS queries
• b.A distributed denial-of-service attack overwhelming the host with junk traffic
• c.Lateral movement across separate hosts using stolen credentials and remote services
• d.Privilege escalation✓

Privilege escalation raises an attacker's permissions beyond what their account should have, often from user to administrator. It typically exploits a vulnerability or misconfiguration. Patching and least privilege limit escalation paths.

By entering '../../etc/passwd' in a URL parameter, an attacker retrieves files outside the web root. Which vulnerability is being exploited?

• a.Cross-site scripting that injects client-side script into pages viewed by others
• b.A race condition exploiting the gap between checking and using a resource
• c.Directory traversal✓
• d.Session replay reusing a captured authentication token to impersonate a user

Directory traversal uses sequences like ../ to escape the intended directory and access unauthorized files on the server. Poor input validation of file paths enables it. Canonicalizing and validating paths prevents the attack.

A program copies user input into a fixed-size memory buffer without checking length, letting an attacker overwrite adjacent memory and run code. This is a:

• a.Phishing message designed to harvest the user's login credentials
• b.SQL injection inserting crafted statements into a database query string
• c.Buffer overflow✓
• d.Cross-site request forgery abusing a trusted authenticated browser session

A buffer overflow writes more data than a buffer can hold, corrupting adjacent memory and potentially allowing arbitrary code execution. Unsafe memory handling in languages like C enables it. Bounds checking, ASLR, and DEP mitigate it.

At a coffee shop, an attacker sets up a rogue access point named identically to the shop's Wi-Fi to intercept connecting users' traffic. This is an:

• a.Amplified DNS reflection attack that floods a victim with unsolicited responses
• b.VLAN hopping attack that reaches traffic on a segment the attacker should not access
• c.ARP poisoning attack that corrupts the mapping of IP addresses to MAC addresses
• d.Evil twin✓

An evil twin is a rogue wireless access point impersonating a legitimate one to lure victims into connecting. Once connected, their traffic can be intercepted or manipulated. Verifying networks and using a VPN protect users on untrusted Wi-Fi.

Users typing the correct bank URL are silently sent to a fraudulent server because forged records were inserted into a resolver's cache. Which attack is this?

• a.A deauthentication attack forcing wireless clients to disconnect from the access point
• b.A MAC flooding attack overwhelming a switch's address table to force it to broadcast
• c.DNS cache poisoning✓
• d.A replay attack reusing previously captured valid authentication messages

DNS cache poisoning inserts forged records into a resolver so legitimate names resolve to attacker-controlled addresses. Victims are redirected without any visible URL change. DNSSEC and cache protections defend against it.

An attacker sends small spoofed requests to open DNS resolvers, which send much larger responses to the victim's address, overwhelming it. This is an:

• a.SQL injection attack against the victim's public database interface
• b.Privilege escalation attack elevating a standard account to administrator
• c.Amplified, reflected distributed denial-of-service attack✓
• d.Cross-site scripting attack executing script in other users' browsers

A reflected, amplified DDoS spoofs the victim's address so intermediary servers send large responses to the victim, multiplying the traffic. DNS and NTP are common amplifiers. Source-address validation and scrubbing services reduce the impact.

An on-path attacker forces two systems to negotiate an obsolete, weak version of TLS so the traffic can be broken. Which cryptographic attack is this?

• a.A brute-force attack trying every possible key until the correct one is found
• b.A rainbow table attack reversing unsalted password hashes with precomputed chains
• c.A downgrade attack✓
• d.A birthday attack exploiting the mathematics of hash collision probability

A downgrade attack coerces parties into using a weaker protocol or cipher that the attacker can defeat. Blocking legacy versions and enforcing strong minimums prevents it. This is why disabling old SSL and TLS versions matters.

Two different inputs are found that produce the same hash value, undermining a hash function's integrity guarantee. This is known as a:

• a.Collision✓
• b.Downgrade attack forcing negotiation of an older, weaker cryptographic protocol
• c.Salting technique adding random data to each password before hashing it
• d.Key stretching operation that intentionally slows down password hashing

A collision occurs when two different inputs hash to the same value, breaking the uniqueness a hash relies on. Birthday attacks exploit probability to find collisions faster than brute force. Moving to stronger algorithms like SHA-256 mitigates the risk.

A researcher demonstrates breaking out of a guest virtual machine to execute code directly on the underlying hypervisor. What is this class of vulnerability called?

• a.VM escape✓
• b.Data remnants, where deleted virtual disks leave recoverable sensitive information
• c.Resource exhaustion, where one tenant consumes shared capacity needed by others
• d.VM sprawl, where unmanaged virtual machines accumulate faster than they are tracked

VM escape breaks the isolation between a guest and the hypervisor, letting an attacker affect the host or other guests. It is a severe risk in multitenant environments. Hypervisor patching and strong isolation controls reduce it.

A company's confidential files are exposed because a cloud storage bucket was set to allow public access. Which root cause best describes this?

• a.A zero-day vulnerability that no vendor patch could have prevented at the time
• b.A cryptographic weakness in the algorithm protecting the stored data at rest
• c.A security misconfiguration✓
• d.A supply chain compromise introduced through a tainted third-party dependency

Misconfiguration is a leading cause of cloud data exposure, such as leaving storage publicly readable. The technology worked as configured; the settings were wrong. Secure baselines, automated checks, and least privilege prevent it.

Logs show a user account signing in from New York and, eight minutes later, from Singapore. Which indicator of compromise does this represent?

• a.A blocked-content alert generated when a user tries to reach a prohibited website
• b.Resource consumption caused by a runaway process using excessive CPU cycles
• c.Impossible travel✓
• d.Out-of-cycle logging showing unexpected timestamps on a scheduled batch process

Impossible travel flags logins from geographically distant locations within a timeframe too short to physically travel. It strongly suggests stolen credentials used from two places. Conditional access and risk-based authentication respond to it.

A security analyst notices a single user account with many simultaneous active sessions from different countries. This is best classified as which indicator?

• a.Normal single sign-on behavior expected when a user opens multiple applications
• b.Scheduled maintenance activity that briefly duplicates sessions during failover
• c.Legitimate load balancing distributing the user's requests across data centers
• d.Concurrent session usage suggesting account compromise✓

Multiple concurrent sessions from disparate locations for one account indicate possible credential theft or sharing. It is a recognized indicator of malicious activity. Session monitoring and forced re-authentication help contain it.

During an assessment, a networked camera is found reachable from the internet using the manufacturer's default username and password. Which two weaknesses combine here?

• a.A cryptographic downgrade combined with a hash collision in the login process
• b.A cross-site scripting flaw combined with a cross-site request forgery weakness
• c.A logic bomb paired with a self-propagating worm on the device firmware
• d.An exposed open service and unchanged default credentials✓

Internet-exposed services running default credentials are trivially compromised because the passwords are publicly documented. Attackers scan for exactly this combination. Changing defaults and restricting exposure closes the gap.

An attacker registers 'micros0ft-support.com' to catch users who mistype or misread the legitimate domain. This technique is:

• a.Watering hole targeting of a site the intended victims are known to visit
• b.Pharming that poisons DNS so correct addresses resolve to malicious servers
• c.Typosquatting✓
• d.Vishing that uses fraudulent phone calls to extract sensitive information

Typosquatting registers look-alike or misspelled domains to capture users who err when typing or reading a URL. The fraudulent site may harvest credentials or deliver malware. Defensive domain registration and user vigilance help.

Hundreds of infected corporate hosts periodically beacon to the same external server that issues them instructions. What does this server represent?

• a.A content delivery network edge node caching static assets closer to the users
• b.A reverse proxy load balancing inbound requests across backend web servers
• c.A command-and-control server✓
• d.A certificate authority validating the identity of the connecting endpoints

A command-and-control (C2) server directs a botnet of compromised hosts, sending commands and receiving stolen data. Regular beaconing to one destination is a classic indicator. Blocking C2 domains and inspecting egress traffic disrupts it.

A financially motivated, well-organized group operates ransomware as a business, complete with affiliates and support portals. Which threat actor type is this?

• a.Organized crime✓
• b.An unskilled attacker relying entirely on tools written by more capable people
• c.An accidental insider who exposes data through a careless but non-malicious mistake
• d.A hacktivist collective pursuing a political or social cause rather than profit

Organized crime groups are professional, financially motivated actors that run cybercrime like a business. Ransomware-as-a-service with affiliates reflects this structure. Their profit motive drives high-volume, opportunistic targeting.

A marketing team signs up for an unapproved cloud app and uploads customer data without involving security. Which internal risk does this illustrate?

• a.Shadow IT✓
• b.An evil twin access point deployed in the marketing department's office space
• c.A nation-state espionage operation targeting the organization's intellectual property
• d.A supply chain attack introduced through a compromised software update channel

Shadow IT is technology adopted by staff without organizational approval or oversight. It bypasses security review, creating unmanaged data exposure and compliance gaps. Discovery tools and clear policies bring it under control.

An employee gets a call from someone claiming to be the help desk, who asks them to read back a one-time code just sent to their phone. Which attack is underway?

• a.A watering hole attack staged on a website the employee routinely visits
• b.Vishing aimed at capturing a multifactor authentication code✓
• c.Smishing delivered through a fraudulent text message rather than a phone call
• d.A brute-force attempt against the employee's password on the login portal

Vishing uses a phone call and a convincing pretext to trick the victim into revealing information such as a one-time passcode. Capturing that code lets the attacker defeat multifactor authentication. Never sharing codes and verifying callers defeats it.

A visitor holds the door and an unauthorized person walks in after them, with the visitor's knowing cooperation. Which term best fits this scenario?

• a.Dumpster diving to recover access badges discarded in the building's trash
• b.Piggybacking✓
• c.Shoulder surfing performed by observing credentials entered on a nearby keypad
• d.Tailgating, in which the unauthorized entry happens without the insider's awareness

Piggybacking is unauthorized entry with the consent or cooperation of an authorized person, distinguishing it from tailgating, which occurs without that person's knowledge. Both defeat physical access controls. Access vestibules and awareness reduce them.

Within minutes, an infection spreads from one server to hundreds across the network with no user clicking anything, exploiting a single unpatched service. Which malware behavior is this?

• a.A worm exploiting a vulnerability to self-propagate✓
• b.A Trojan that must be manually executed by each user before it can run
• c.Ransomware whose only action is to encrypt files on the initially infected host
• d.Adware that displays pop-ups but does not move between networked systems

A worm self-replicates and spreads automatically by exploiting vulnerabilities, needing no user interaction. Rapid network-wide propagation from one flaw is its signature. Prompt patching and segmentation slow it.

A directory-enabled login form fails to sanitize input, letting an attacker alter the LDAP query to bypass authentication. This is a form of:

• a.A replay attack resubmitting a previously captured valid authentication request
• b.Injection✓
• c.A downgrade attack forcing a weaker cryptographic protocol during the session
• d.A denial-of-service attack aimed at making the directory service unavailable

Injection attacks insert crafted input that a system interprets as commands, whether SQL, LDAP, or XML. Unvalidated input to the directory query enables authentication bypass. Input validation and parameterized queries are the defense.

A banking function checks an account balance and then, a moment later, completes a withdrawal; an attacker exploits the delay to withdraw twice. Which flaw is this?

• a.A buffer overflow overwriting adjacent memory beyond a fixed-size array
• b.A cross-site scripting flaw running attacker script in another user's browser
• c.A time-of-check to time-of-use race condition✓
• d.A misconfiguration that left an administrative interface exposed to the internet

A time-of-check to time-of-use (TOCTOU) race condition exploits the gap between validating a condition and acting on it. The attacker changes state within that window to cause double spending. Atomic operations and locking prevent it.

On a local network, an attacker sends forged replies associating their MAC address with the gateway's IP so traffic flows through their machine. This is:

• a.A deauthentication attack disconnecting wireless clients from their access point
• b.ARP poisoning✓
• c.DNS poisoning that corrupts name-to-address resolution in a caching resolver
• d.An amplified reflection attack using open resolvers to flood a chosen victim

ARP poisoning forges address resolution replies to redirect local traffic through the attacker, enabling on-path interception. It works because ARP has no authentication. Dynamic ARP inspection and static entries mitigate it.

A user's browsing habits, form entries, and typed passwords are being secretly collected and sent to a third party. Which malware category fits best?

• a.Spyware✓
• b.A worm whose defining behavior is self-replication across networked systems
• c.A logic bomb that stays inert until a defined trigger condition is met
• d.Ransomware that encrypts data and demands payment to restore access

Spyware covertly gathers information about a user's activity and transmits it without consent. Keystroke capture and browsing surveillance are common behaviors. Reputable endpoint protection and cautious software installation reduce exposure.

A rival firm secretly funds intruders to steal a company's unreleased product blueprints. What is the primary motivation behind this activity?

• a.Service disruption intended to keep the target's website offline during a launch
• b.Financial extortion demanding payment to prevent release of the stolen files
• c.Ideological protest against the company's business practices and public conduct
• d.Espionage✓

Espionage seeks to steal confidential information such as trade secrets or intellectual property, often for competitive or strategic advantage. Competitor-sponsored theft is a classic case. Data protection and insider monitoring defend against it.

Malware is hidden inside what appears to be an ordinary image file, executing when a vulnerable viewer opens it. Which attack vector does this use?

• a.An unsecure wireless network broadcasting a deceptive access point name nearby
• b.A phone-based social engineering call impersonating internal technical support
• c.An exposed remote-desktop port left open to the public internet without a firewall
• d.A file-based vector using a malicious image✓

File-based vectors deliver malware inside documents, images, or other files that exploit a flaw in the handling application. The lure looks harmless, encouraging the victim to open it. Patching viewers and scanning attachments reduce risk.

Servers suddenly run at maximum CPU and electricity costs spike, later traced to unauthorized cryptocurrency mining software. Which indicator first signaled this?

• a.A missing-logs alert indicating that audit records had been deleted from the host
• b.Abnormal resource consumption✓
• c.A blocked-content notification from the secure web gateway's URL filter
• d.An account lockout triggered by repeated failed authentication attempts

Unusual resource consumption, such as sustained maximum CPU or unexpected power draw, can indicate cryptojacking or other unauthorized processes. Baselining normal utilization makes anomalies visible. Investigation confirms whether it is malicious.

Employees remove the manufacturer's built-in restrictions on their mobile devices to install unauthorized apps. Why does this increase organizational risk?

• a.It permanently encrypts the device so corporate data can never be recovered later
• b.It removes built-in security protections, expanding the device's attack surface✓
• c.It forces the device to use only vendor-signed applications from the official store
• d.It automatically enrolls the device into mobile device management for tighter control

Jailbreaking or rooting removes the vendor's security controls, allowing unsigned apps and undermining the device's protections. This enlarges the attack surface and can bypass MDM policy. Blocking rooted devices from corporate resources mitigates it.

Attackers compromise a niche industry forum that engineers at a target company visit daily, planting malware to infect those specific visitors. This is a:

• a.Credential-stuffing attack replaying leaked passwords against the company's portal
• b.Watering hole attack✓
• c.Smishing campaign sending malicious links through text messages to the engineers
• d.Business email compromise impersonating an executive to authorize a fraudulent payment

A watering hole attack compromises a site frequented by the intended victims so that visiting it delivers malware. It targets a community indirectly through a trusted resource. Endpoint protection and patching reduce exposure.

Antivirus reports a clean system, yet certain processes and files are invisible to the operating system's own tools while an attacker retains privileged access. Which malware is most consistent with this?

• a.Adware that only displays advertising and makes no attempt to hide its presence
• b.A macro virus embedded in a document that runs when the file is opened by a user
• c.A phishing email crafted to trick the user into revealing their account credentials
• d.A rootkit✓

A rootkit hides its presence at a low level, concealing processes and files while maintaining privileged control. Its stealth is why standard tools show a clean system. Secure boot, integrity checks, and offline scanning help detect it.

An attacker floods the 2.4 GHz band with noise so that nearby Wi-Fi clients cannot maintain a connection. Which attack is this?

• a.ARP poisoning that redirects local traffic through the attacker's own machine
• b.An evil twin that impersonates a legitimate access point to capture user traffic
• c.Wireless jamming✓
• d.A downgrade attack forcing clients onto an older, weaker encryption protocol

Jamming intentionally interferes with wireless signals to deny service by overwhelming the frequency with noise. It targets availability rather than data. Spectrum monitoring and directional antennas help locate and mitigate it.

Which statement about threat actor attributes is accurate for exam purposes?

• a.External actors are always more sophisticated and better funded than any insider could be
• b.Only nation-state actors ever have any financial motivation for their operations at all
• c.Actors vary in resources, sophistication, and whether they operate internally or externally✓
• d.Level of sophistication is irrelevant when categorizing and defending against threat actors

Threat actors differ along attributes such as internal versus external origin, resources and funding, and level of sophistication and capability. These attributes shape likely targets and tactics. Profiling them guides proportionate defenses.

A vendor's email account is compromised and used to send a genuine-looking invoice with changed bank details to the customer's accounts payable team. This is best described as:

• a.A rainbow table attack used to reverse the vendor's stored password hashes
• b.A watering hole attack staged on a website the finance team frequently visits
• c.Business email compromise✓
• d.A denial-of-service attack against the accounts payable email infrastructure

Business email compromise abuses a trusted or spoofed email account to trick staff into transferring funds or changing payment details. Using a real compromised vendor account makes it especially convincing. Out-of-band verification of banking changes stops it.

Attackers exploit a flaw in widely used software before the vendor is even aware of it, so no patch exists. What is this called?

• a.A zero-day vulnerability✓
• b.An end-of-life condition where the vendor has stopped issuing any further updates
• c.A misconfiguration introduced by an administrator applying incorrect security settings
• d.A supply chain compromise inserted into a trusted third-party build pipeline

A zero-day is a previously unknown vulnerability with no available patch, giving defenders zero days to prepare. Attackers value it because existing defenses may not detect the exploit. Segmentation and behavioral detection provide compensating protection.

An attacker captures a valid session token from unencrypted traffic and reuses it to access the victim's authenticated account. This is a:

• a.Buffer overflow attack overwriting memory beyond an allocated fixed-size buffer
• b.Distributed denial-of-service attack exhausting the web server's connection capacity
• c.SQL injection attack manipulating database queries through unsanitized form input
• d.Session replay attack✓

A replay attack captures a valid credential or token and resubmits it to gain unauthorized access. Unencrypted sessions and predictable tokens make it possible. Encryption, nonces, and short-lived tokens defeat replay.

An attacker overwhelms a switch's address table with thousands of fake MAC addresses, causing it to broadcast traffic to all ports. Which attack is this?

• a.An evil twin luring wireless users onto a rogue impersonating access point
• b.MAC flooding✓
• c.DNS poisoning corrupting the resolver cache to redirect users to false addresses
• d.A reflected amplification attack using open servers to overwhelm a chosen victim

MAC flooding fills a switch's content addressable memory with bogus addresses, forcing it to fail open and broadcast frames, which the attacker can then sniff. It exploits limited table size. Port security limiting learned MACs prevents it.

A penetration test flags that an application still protects passwords using unsalted MD5. Why is this a vulnerability?

• a.MD5 encrypts data so strongly that recovering forgotten passwords becomes impossible
• b.MD5 requires specialized hardware security modules that most servers do not include
• c.MD5 is cryptographically broken and, unsalted, is highly vulnerable to fast cracking✓
• d.MD5 is far too slow, which noticeably degrades the application's login performance

MD5 is a deprecated hash with known collision weaknesses, and without salting it is quickly cracked using precomputed tables. Password storage should use slow, salted algorithms like bcrypt or Argon2. Using broken cryptography is a recognized vulnerability.

A recently fired administrator uses retained credentials to sabotage systems out of anger. What is the primary motivation?

• a.Revenge✓
• b.Espionage conducted quietly to collect intelligence over a long period of time
• c.Political or ideological beliefs expressed through disruptive public activism
• d.Financial gain from selling the sabotaged company's data to a competing firm

Revenge motivates a disgruntled individual to cause harm, often after a perceived wrong such as termination. Prompt deprovisioning of access on offboarding is the key control. Motivation helps predict insider risk.

An analyst finds that a server's security logs stop for a two-hour window that coincides with suspicious file changes. Which indicator does the gap represent?

• a.Excessive resource consumption from an unauthorized cryptocurrency mining process
• b.Missing logs suggesting an attacker cleared traces of their activity✓
• c.A blocked-content event where the web filter denied access to a prohibited site
• d.Impossible travel between two logins occurring in an implausibly short timeframe

Missing or gapped logs are a red flag that an attacker may have deleted records to hide activity. The gap aligning with suspicious changes strengthens that inference. Centralized, tamper-resistant logging preserves evidence.

A device is compromised through an unauthenticated Bluetooth pairing exploit while in a crowded public space. Which category of attack vector is this?

• a.A message-based vector delivered through a malicious email attachment payload
• b.A default-credential vector exploiting an unchanged factory administrator password
• c.A supply chain vector introduced via a compromised hardware component at manufacture
• d.An unsecure network vector✓

Unsecure network vectors include wired, wireless, and Bluetooth connections that lack proper protection. Open or weakly secured Bluetooth can allow unauthorized pairing and exploitation. Disabling unused radios and requiring authentication reduce exposure.

An attacker convincingly poses as a specific senior manager and pressures IT to reset that manager's password. Which technique is central to this attack?

• a.Tailgating through a secured door directly behind the actual senior manager
• b.Impersonation✓
• c.Dumpster diving to recover printed records containing the manager's information
• d.Shoulder surfing to observe the manager entering credentials at their workstation

Impersonation involves pretending to be a specific, often authoritative person to manipulate a target into acting. The claimed identity and urgency pressure the help desk to comply. Strong identity verification procedures defeat it.

Opening a spreadsheet enables its embedded macros, which then infect the user's template so every new file carries the malicious code. Which malware type is this?

• a.A network worm that propagates automatically without any user interaction at all
• b.A hardware rootkit embedded in firmware below the operating system layer itself
• c.A macro virus✓
• d.A denial-of-service tool designed to exhaust a target server's available bandwidth

A macro virus embeds in documents and executes through the application's macro feature, often spreading via shared templates and files. It requires the user to enable or run the macro. Disabling macros by default and user caution mitigate it.

A trusted software vendor's update mechanism is subverted so that a signed update secretly installs a backdoor on all customers. Which risk does this exemplify?

• a.A brute-force attack that guessed the update server's administrative password
• b.A cross-site scripting flaw in the vendor's public customer support web portal
• c.A misconfiguration where an administrator mistakenly exposed an internal service
• d.A supply chain attack through a compromised software update✓

Subverting a vendor's build or update process to distribute malicious code is a supply chain attack that abuses established trust. A single tainted update can reach many organizations at once. Code signing integrity and vendor assurance help defend against it.

Attackers gain access to a company's domain registrar account and change its DNS records to point the website and email to their own servers. This is:

• a.A collision attack producing two inputs with the same cryptographic hash value
• b.A deauthentication attack forcing the company's wireless clients to disconnect
• c.Domain hijacking✓
• d.A MAC flooding attack overwhelming the switch to force traffic to broadcast out

Domain hijacking takes control of a domain's registration or DNS configuration, letting attackers redirect web and email traffic. It often follows a registrar account compromise. Registrar locks and strong account security prevent it.

A batch of network devices is found to contain an unauthorized chip added during manufacturing that could exfiltrate data. Which vulnerability category is this?

• a.An end-of-life condition in which the vendor no longer supports the hardware
• b.A hardware supply chain compromise✓
• c.A zero-day flaw in the device's operating system discovered after deployment
• d.A software misconfiguration applied by the receiving organization after delivery

Hardware supply chain compromises insert malicious components during manufacturing or distribution before the product reaches the buyer. Such implants are hard to detect and abuse deep trust. Trusted suppliers and hardware inspection reduce the risk.

Which set of characteristics is the strongest indicator that an email is a phishing attempt?

• a.A calendar invite from a coworker whose address matches the corporate directory
• b.A digitally signed message from a known colleague sent during normal business hours
• c.An internal newsletter with no links, delivered on its regular weekly schedule again
• d.Urgent tone, a mismatched sender domain, and a link to an unfamiliar login page✓

Classic phishing indicators include manufactured urgency, sender addresses that do not match the claimed organization, and links to unexpected credential pages. Recognizing these cues lets users avoid the lure. Reporting suspicious mail improves defenses.

After remediation, responders discover the attacker left a hidden service that allows them to return later without authenticating normally. What is this called?

• a.A logic bomb set to trigger its payload only on a specific future calendar date
• b.A backdoor✓
• c.A rogue access point impersonating the corporate wireless network to capture traffic
• d.A rainbow table used to reverse the organization's stored password hashes offline

A backdoor provides covert, persistent access that bypasses normal authentication, letting an attacker return at will. It is often installed to survive initial remediation. Thorough eradication and integrity monitoring are needed to remove it.

An intrusion shows an attacker maintaining stealthy access for over a year, moving slowly and avoiding detection while collecting sensitive data. This dwell pattern is most characteristic of:

• a.A hacktivist seeking rapid public impact through a highly visible website defacement
• b.An unskilled attacker who typically causes immediate, noisy, and short-lived damage
• c.An advanced persistent threat✓
• d.An opportunistic criminal aiming for a quick financial payout before being detected

Advanced persistent threats, often nation-state actors, prioritize long-term stealthy access and patient data collection. Extended dwell time with low-and-slow tactics is a defining trait. Detecting them requires behavioral analytics and threat hunting.

An attacker posts flyers with QR codes that lead to a credential-harvesting site disguised as a parking payment portal. Which emerging technique is this?

• a.Vishing conducted over the phone using a spoofed caller identity and a pretext
• b.Quishing, which is phishing delivered through a malicious QR code✓
• c.Tailgating into a restricted area behind an employee holding a valid access badge
• d.A logic bomb embedded in the parking system to execute on a future trigger date

Quishing uses QR codes to direct victims to malicious sites, exploiting trust and the fact that the destination is hidden until scanned. It sidesteps some link filters. Previewing the URL and using caution with public QR codes helps.

An organization worries that staff installing apps from outside the official store could introduce malware. Which practice raises this specific risk?

• a.Sideloading applications from unofficial or unverified sources✓
• b.Enrolling all devices in mobile device management for centralized policy control
• c.Enforcing screen locks with a strong passcode and a short inactivity timeout
• d.Requiring full-disk encryption on every mobile device that stores any company data

Sideloading installs apps from sources outside the vetted official store, bypassing the platform's app review. This raises the chance of installing malicious or trojanized software. Restricting installation sources through MDM reduces the risk.

To slow attackers who steal a password database, developers deliberately use a hashing scheme that is computationally expensive per guess. What is this defensive technique called?

• a.Key stretching✓
• b.Certificate pinning, which ties a service to a specific expected public key
• c.Tokenization, which replaces sensitive values with non-sensitive substitute tokens
• d.Steganography, which conceals data within another seemingly innocuous carrier file

Key stretching applies a deliberately slow, resource-intensive function so each password guess costs more, blunting brute-force and dictionary attacks. Algorithms like bcrypt, scrypt, and PBKDF2 implement it. Combined with salting, it strengthens stored credentials.

A company discovers that internal server names and employee emails are freely searchable online, aiding attacker reconnaissance. This exposure is an example of:

• a.A race condition exploiting the timing gap between a check and a subsequent use
• b.A zero-day vulnerability with no vendor patch available to remediate it just yet
• c.Information available through open-source intelligence✓
• d.A downgrade attack forcing negotiation of a weaker cryptographic protocol version

Open-source intelligence (OSINT) is information gathered from publicly available sources, which attackers use during reconnaissance. Exposed names and emails ease targeting and phishing. Limiting public exposure and monitoring for leaks reduce the aid to attackers.

A phishing email succeeds largely because it claims an account will be closed within one hour unless the recipient acts immediately. Which social engineering principle is being exploited?

• a.Authority, established by impersonating a senior executive within the company itself
• b.Urgency✓
• c.Familiarity, built by referencing a long personal relationship with the recipient
• d.Social proof, created by citing that many coworkers have already complied with it

Urgency pressures victims to act quickly before thinking critically, a core social engineering principle. Artificial deadlines short-circuit careful verification. Training users to slow down and verify defeats manufactured urgency.

In a zero trust architecture, which component makes the access decision by evaluating policy against a request's context?

• a.The workload's data plane, which simply forwards packets after a decision is made
• b.A perimeter firewall that permits everything already inside the corporate network
• c.The policy engine in the control plane✓
• d.The end user's device, which self-certifies that it should be trusted by default

In zero trust, the control plane's policy engine evaluates identity, device posture, and context to decide whether to grant access. The data plane then enforces that decision on traffic. Separating decision from enforcement is central to the model.

Which zero trust component actually allows or blocks the connection once the policy decision is made?

• a.The policy administrator, which only relays decisions and helps configure the session
• b.The policy engine, which evaluates rules but does not itself sit in the traffic path
• c.The certificate authority, which issues identity certificates but enforces no traffic rules
• d.The policy enforcement point✓

The policy enforcement point (PEP) sits in the data path and enforces the allow-or-deny decision produced by the policy engine and administrator. It is where access is physically granted or blocked. This division keeps decision logic separate from enforcement.

A zero trust design continuously re-evaluates trust and narrows what each authenticated session can reach. Which paired concepts describe this?

• a.Implicit trust zones combined with a single one-time login valid for the whole day
• b.Adaptive identity and threat scope reduction✓
• c.Perimeter-only defense combined with unrestricted lateral movement once already inside
• d.Flat network design combined with permanent, static access rights for all of the users

Adaptive identity adjusts trust based on real-time context, while threat scope reduction limits the blast radius of any single session. Together they minimize what a compromised session can do. Both are core zero trust concepts.

A customer assumes the cloud provider will encrypt their stored data, but a breach reveals the customer was responsible for that setting. Which document clarifies these boundaries?

• a.A service level agreement that only specifies uptime percentages and support response times
• b.The cloud responsibility matrix✓
• c.A memorandum of understanding expressing non-binding intent between two partner organizations
• d.A business impact analysis that ranks the criticality of the organization's business processes

The responsibility matrix documents which security duties belong to the provider versus the customer across the stack. Misreading it is a frequent cause of cloud breaches. Reviewing it prevents assumptions about who secures what.

A DevOps team defines its entire cloud network and firewall configuration in version-controlled template files that can be redeployed identically. What is this practice?

• a.Shadow IT, in which staff deploy unsanctioned services without the security team's knowledge
• b.Infrastructure as code✓
• c.Data sovereignty, which governs the jurisdiction whose laws apply to the stored data
• d.A honeynet, which is a decoy network built specifically to attract and study attackers

Infrastructure as code (IaC) provisions and manages infrastructure through machine-readable definition files rather than manual configuration. It brings consistency, versioning, and repeatability, reducing configuration drift. Reviewing the code catches misconfigurations before deployment.

An architecture decomposes an application into many small, independently deployed services communicating over the network. Which security consideration grows most with this microservices approach?

• a.The removal of all logging requirements because each service is small and simple to run
• b.The complete elimination of any need for authentication between the internal services
• c.A larger attack surface from many exposed service interfaces requiring protection✓
• d.A guarantee that a compromise of one service can never affect any other service at all

Microservices multiply the number of network-exposed interfaces, enlarging the attack surface and the need for service-to-service authentication and monitoring. Each API must be secured. Consistent access control and observability across services are essential.

Over time, an organization accumulates hundreds of forgotten, unpatched virtual machines that no one actively manages. Which risk does this describe?

• a.Data sovereignty, concerning which country's laws govern where the data is being stored
• b.VM sprawl✓
• c.VM escape, where code breaks out of a guest to run on the underlying hypervisor host
• d.A screened subnet, which isolates public-facing servers from the internal network zone

VM sprawl is the uncontrolled growth of virtual machines beyond what can be tracked and maintained. Forgotten, unpatched VMs become vulnerable entry points. Lifecycle management and inventory controls keep sprawl in check.

Where should an organization place its public-facing web server so a compromise does not directly expose the internal network?

• a.In a screened subnet between the internet and the internal network✓
• b.Outside all firewalls with a public address and no filtering of inbound connections
• c.On the same segment as the domain controllers to simplify authentication traffic flow
• d.Directly on the internal LAN alongside employee workstations for easier management

A screened subnet isolates internet-facing servers so that compromising one does not grant direct access to the internal network. Firewalls control traffic on both sides of the zone. Proper device placement limits the blast radius of a public host breach.

Administrators must reach servers in a sensitive segment only through one hardened, heavily logged host. What is this host called?

• a.A load balancer distributing inbound requests across multiple identical backend servers
• b.A honeypot deliberately left vulnerable to attract and observe attacker behavior over time
• c.A reverse proxy caching content and terminating client TLS connections at the network edge
• d.A jump server✓

A jump server (bastion host) is a hardened intermediary through which administrators access protected segments. Centralizing and logging admin access there reduces exposure and aids monitoring. It must itself be tightly secured as a gateway.

A security appliance is configured so that if it stops functioning, all traffic is blocked rather than allowed through. This design choice is called:

• a.Port mirroring, which copies traffic to a monitoring interface for passive inspection
• b.Fail-open, which prioritizes continued availability over security during a device failure
• c.Fail-closed✓
• d.Load balancing, which spreads traffic across multiple redundant appliances for scaling

A fail-closed (fail-secure) design denies traffic when the control fails, favoring security over availability. Fail-open does the opposite, allowing traffic to preserve availability. The choice depends on whether security or uptime is the priority.

A network sensor is deployed to receive a copy of traffic through a mirror port so it can observe without sitting in the traffic path. This deployment is:

• a.A fail-closed configuration that denies all traffic whenever the sensor stops functioning
• b.An inline mode that can actively block malicious packets as they pass through the device
• c.A passive tap or monitor mode✓
• d.A proxy configuration that terminates and re-originates every single client connection

A tap or monitor (passive) deployment receives copied traffic and can observe or alert but cannot block, since it is not in the forwarding path. Inline devices, by contrast, can drop traffic. Passive placement avoids becoming a point of failure.

To protect a web application from SQL injection and cross-site scripting, which control inspects HTTP requests at the application layer?

• a.A web application firewall✓
• b.A load balancer that distributes client requests across several backend web servers
• c.A traditional packet-filtering firewall that only evaluates ports and IP addresses
• d.A network tap that passively copies traffic to an intrusion detection sensor

A web application firewall (WAF) inspects HTTP and HTTPS traffic at the application layer to block attacks like injection and cross-site scripting. It understands web request structure that a basic firewall does not. It complements, rather than replaces, network firewalls.

Which device combines stateful firewalling with integrated intrusion prevention, deep packet inspection, and application awareness in one platform?

• a.A passive network tap used only to copy traffic to an out-of-band analyzer for review
• b.A next-generation firewall✓
• c.A simple layer 2 switch that forwards frames based only on its MAC address tables
• d.A basic stateless access control list applied on a router interface for simple filtering

A next-generation firewall (NGFW) integrates traditional firewalling with deep packet inspection, application awareness, and intrusion prevention. This consolidated visibility enables policy based on applications and content, not just ports. It is a common perimeter and segmentation control.

A site-to-site VPN must authenticate and encrypt IP traffic between two office networks at the network layer. Which protocol suite is designed for this?

• a.SNMPv1, which monitors network devices but sends its community strings in plaintext
• b.HTTP, which serves web content in cleartext unless layered over a secure protocol
• c.SMTP, which transports email between mail servers without providing encryption itself
• d.IPSec✓

IPSec secures IP communications by authenticating and encrypting packets at the network layer, making it well suited to site-to-site VPNs. It provides confidentiality, integrity, and authentication. It commonly uses IKE to negotiate keys and security associations.

An organization wants to converge networking and security, delivering firewall, secure web gateway, and zero trust access from the cloud to remote sites and users. Which model fits?

• a.Secure access service edge✓
• b.A single on-premises perimeter firewall that backhauls all remote traffic to headquarters
• c.A screened subnet hosting only the organization's public-facing web and email servers
• d.An air-gapped network with no connectivity to any external or cloud-based service at all

Secure access service edge (SASE) converges networking and security functions into a cloud-delivered service close to users and sites. It combines capabilities like SD-WAN, secure web gateway, and zero trust access. This suits distributed workforces better than backhauling traffic.

Sensitive records are encrypted on disk but are decrypted into memory while an application processes them. Which data state is hardest to protect in this moment?

• a.Data at rest, because encrypted storage already fully protects it from any exposure
• b.Data in use✓
• c.Data in transit, because TLS has already secured it end to end during the transfer
• d.Archived data, because it has been moved to offline cold storage and is inaccessible

Data in use is the most challenging state to protect because the information must be decrypted in memory to be processed. Techniques like confidential computing and strict memory protections address it. At rest and in transit are more readily secured with encryption.

A support tool must display only the last four digits of a customer's card number while hiding the rest with asterisks. Which technique is this?

• a.Data masking✓
• b.Hashing, which produces an irreversible fixed-length digest of the whole underlying value
• c.Steganography, which conceals the data invisibly within another unrelated carrier file
• d.Full-disk encryption that protects the entire drive but reveals nothing selectively to staff

Data masking obscures parts of a value, showing only what is needed, such as the last four digits, while hiding the rest. It reduces exposure in interfaces and reports. Unlike tokenization, the original is not replaced with a separate stored token.

An organization labels information as public, internal, confidential, or restricted to drive how each is handled and protected. What is this practice called?

• a.Data remanence, which is residual data that persists on media after it is deleted
• b.Tokenization, which substitutes sensitive values with non-sensitive placeholder tokens
• c.Data classification✓
• d.Data sovereignty, which determines which nation's laws apply to the stored information

Data classification assigns sensitivity levels so that handling, access, and protection can be applied proportionally. Higher classifications warrant stronger controls. Clear labels make policy enforcement and compliance consistent.

A multinational must ensure certain citizens' personal data is stored only on servers physically located within their home country. Which concept governs this requirement?

• a.Data sovereignty✓
• b.High availability, which keeps services running through redundancy and automatic failover
• c.Load balancing, which spreads requests across multiple servers to improve performance
• d.Data masking, which hides portions of a field while displaying only what is truly needed

Data sovereignty means data is subject to the laws of the country where it is stored, which can mandate keeping it within specific borders. Geographic storage decisions must satisfy these legal requirements. Provider region controls help enforce it.

Two database servers are configured so that if the active one fails, the standby immediately takes over with the same data. Which resilience concept is this?

• a.High-availability clustering with failover✓
• b.Data classification, which labels information by sensitivity to guide its proper handling
• c.Load balancing, whose main purpose is distributing traffic for performance, not failover
• d.Network segmentation, which isolates zones to contain the spread of an active attack

High-availability clustering pairs systems so a standby assumes operation if the active node fails, minimizing downtime. Failover is the automatic transfer of service. This differs from load balancing, whose primary aim is distributing load.

A recovery facility has hardware and network connectivity in place but needs current data restored and some configuration before it can run operations. Which site type is this?

• a.A hot site
• b.A cold site
• c.A warm site✓
• d.A mobile site delivered on a trailer and positioned wherever it is temporarily needed

A warm site has equipment and connectivity but requires restoring data and some setup before taking over, balancing cost and recovery speed. A hot site is faster but pricier, and a cold site is cheaper but slower. The choice reflects the RTO.

To survive a regional disaster such as a hurricane, an organization replicates its data and systems to a facility hundreds of miles away. Which principle is applied?

• a.Geographic dispersion✓
• b.Least privilege applied to limit each user's permissions to only the minimum required
• c.Network segmentation used to contain lateral movement within a single data center
• d.Tokenization used to replace sensitive values with non-sensitive substitute tokens

Geographic dispersion places recovery capabilities far enough away that a single regional event cannot affect both sites. This protects against disasters that would take out a local backup. Distance must balance latency against risk isolation.

A company keeps encrypted backup copies at a separate location so a fire at the primary site cannot destroy every copy. Which two backup considerations are being applied?

• a.Load balancing and clustering to keep the production systems continuously available
• b.Snapshot frequency and journaling to capture every individual database transaction
• c.Onsite storage and plaintext retention for the fastest possible restore performance
• d.Offsite storage and encryption of the backups✓

Storing backups offsite protects against site-wide disasters, and encrypting them protects confidentiality if the media is lost or stolen. Both are key backup considerations. The 3-2-1 approach also emphasizes multiple copies and media types.

To validate disaster recovery without disrupting production, a team brings up the recovery systems and processes real transactions on them alongside the live systems. Which test is this?

• a.A full-interruption test that shuts down production entirely to force a real live failover
• b.A tabletop exercise that only discusses the plan verbally without touching live systems
• c.A vulnerability scan that enumerates known weaknesses without exploiting any of them
• d.A parallel processing test✓

A parallel test runs recovery systems alongside production to confirm they work without taking production offline. It provides strong assurance with limited risk. A full-interruption test is more realistic but disruptive.

During a brief power flicker, which device provides immediate battery power to keep servers running until a longer-term source engages?

• a.A surge protector, which absorbs voltage spikes but supplies no power during an outage
• b.A standby generator, which needs time to start and reach a stable output first
• c.A power distribution unit, which only allocates existing power among the connected devices
• d.An uninterruptible power supply✓

An uninterruptible power supply (UPS) delivers instantaneous battery power during outages or fluctuations, bridging the gap until a generator starts. It also conditions power against spikes and sags. UPS plus generator gives both immediate and sustained backup.

Before deploying new laptops, an organization applies a documented standard configuration that disables unneeded services and enforces security settings. What is this standard called?

• a.A secure baseline✓
• b.A screened subnet separating public-facing servers from the internal network segment
• c.A honeypot, which is a decoy system designed to lure and study attacker behavior over time
• d.A recovery point objective defining the maximum tolerable amount of data loss allowed

A secure baseline is a documented, standard secure configuration applied consistently to systems before deployment. It reduces attack surface and drift by starting every device from a known-good state. Benchmarks like CIS guide baseline creation.

Which environment typically prioritizes availability and safety over frequent patching, requiring careful segmentation because downtime can halt physical processes?

• a.A public cloud web application that scales elastically behind a managed load balancer
• b.A standard corporate email server that can be patched and rebooted on a weekly cycle
• c.A developer's laptop used for writing and testing application source code locally each day
• d.Industrial control systems and SCADA networks✓

ICS and SCADA systems control physical processes where downtime affects safety and operations, so patching windows are constrained. Strong network segmentation and strict access control compensate. Their legacy nature makes isolation essential.

A medical infusion pump runs a real-time operating system with limited memory and cannot easily accept traditional antivirus software. Which category and challenge does this represent?

• a.A virtual machine that can be snapshotted and rolled back at any convenient time needed
• b.A cloud-native container that can be redeployed instantly from an immutable base image
• c.A general-purpose server that can run any standard endpoint protection agent very easily
• d.An embedded system whose constraints limit traditional security controls✓

Embedded systems and their real-time operating systems have limited resources and long lifecycles, making conventional controls like antivirus impractical. Compensating controls such as segmentation and strict network filtering protect them. Vendor patching is often slow or unavailable.

A traditional network trusts any device once it is inside the corporate perimeter. Which weakness does zero trust specifically aim to remove?

• a.The presence of redundant components that keep services available during a failure
• b.The use of encryption for data transmitted across the untrusted public internet backbone
• c.The requirement that users authenticate at least once before accessing any resource
• d.Implicit trust granted based solely on network location✓

Zero trust eliminates implicit trust based on network location, since an attacker inside the perimeter would otherwise move freely. Instead it verifies every request by identity and context. This limits lateral movement after an initial breach.

In a public cloud, multiple customers share the same underlying physical hardware. Which security property must the provider guarantee between them?

• a.That all customers can freely read each other's data to enable easy collaboration together
• b.That every customer manages the provider's physical data center access controls directly
• c.Strong logical isolation between tenants✓
• d.That customers share a single common encryption key for simplicity across all tenants

Multitenancy means customers share infrastructure, so the provider must enforce strong logical isolation so one tenant cannot access another's data or workloads. A failure in isolation, such as VM escape, is a serious risk. Tenant boundaries are a core cloud security concern.

To ensure only authenticated devices can use a wired switch port before gaining network access, which standard should be implemented?

• a.HTTPS, which encrypts web traffic but does not authenticate a device onto a switch port
• b.DHCP, which automatically assigns IP addresses but does not verify any device identity
• c.NAT, which translates private addresses to public ones but performs no authentication
• d.IEEE 802.1X port-based network access control✓

IEEE 802.1X provides port-based network access control, requiring a device to authenticate, often via EAP and a RADIUS server, before the port forwards traffic. This blocks unauthorized devices at the edge. It is a foundational network access control.

A virtualization admin wants to capture a point-in-time state of a VM so it can be instantly rolled back if a patch fails. Which capability provides this?

• a.Network segmentation, which isolates zones to limit the spread of an active intrusion
• b.Snapshots✓
• c.Geographic dispersion, which places recovery capacity far from the primary location
• d.Load balancing, which distributes workload across servers but saves no restore point

A snapshot records a virtual machine's state at a point in time, enabling quick rollback if a change causes problems. It is ideal before risky updates. Snapshots are not a substitute for full backups but complement recovery workflows.

Which method conceals the very existence of a secret message by hiding it inside an ordinary-looking image file?

• a.Hashing, which produces a fixed-length fingerprint used to verify the integrity of data
• b.Symmetric encryption, which scrambles data but makes its presence obvious to observers
• c.Tokenization, which swaps a sensitive value for a non-sensitive reference token instead
• d.Steganography✓

Steganography hides data within another medium, such as an image, so the message's existence is concealed rather than merely scrambled. Encryption protects content but reveals that something is protected. Steganography aims for secrecy of existence itself.

An organization routes all outbound web traffic through a device that filters URLs, inspects content, and enforces acceptable use before requests reach the internet. What is this?

• a.A load balancer whose sole role is distributing incoming connections across many servers
• b.A jump server used exclusively by administrators to reach a protected network segment
• c.A forward proxy or secure web gateway✓
• d.A reverse proxy that sits in front of internal servers to handle inbound client requests

A forward proxy or secure web gateway mediates outbound requests, applying URL filtering, content inspection, and policy enforcement. It centralizes control and visibility over user web access. This differs from a reverse proxy, which fronts inbound server traffic.

In software-defined networking, the intelligence that decides how traffic is forwarded is separated from the devices that move the packets. What are these two layers called?

• a.The presentation layer and the session layer of the traditional OSI networking model
• b.The control plane and the data plane✓
• c.The application layer and the physical cabling layer, with no real separation of logic
• d.The perimeter zone and the internal zone divided only by a single boundary firewall

Software-defined networking separates the control plane, which makes forwarding decisions, from the data plane, which forwards packets. Centralizing control enables programmable, agile network management. Securing the controller is critical since it governs the whole network.

To avoid a single vendor vulnerability taking down everything, an organization deliberately runs critical workloads across two different cloud providers. Which resilience strategy is this?

• a.Implicit trust, which automatically grants access to anything inside the perimeter zone
• b.Data masking, which hides portions of sensitive fields shown within an interface view
• c.Platform diversity through a multi-cloud approach✓
• d.Vertical scaling, which adds more resources to a single existing server instance in place

Platform diversity and multi-cloud avoid a monoculture where one vendor flaw or outage affects all systems. Spreading workloads increases resilience against provider-specific failures. It adds complexity that must be managed carefully.

A security team wants visibility into traffic at key points without blocking it, feeding copies to their monitoring platform. Which device role accomplishes this?

• a.A jump server that administrators must pass through to reach the protected systems
• b.An inline next-generation firewall that actively drops any traffic it deems malicious
• c.A passive sensor collecting traffic through a tap or span port✓
• d.A load balancer that distributes inbound requests across a pool of many web servers

Passive sensors receive copied traffic via a tap or span port, giving visibility without sitting in the forwarding path. They can alert but not block, avoiding becoming a chokepoint. Placement at chokepoints maximizes monitoring coverage.

Access to a sensitive finance folder is limited strictly to members of the finance team, and no one else can open it. Which data protection method is applied?

• a.Geographic dispersion of backups to a facility located in a distant separate region
• b.Full-disk encryption applied uniformly to every laptop regardless of the user's role
• c.Load balancing of requests across multiple servers to improve overall performance
• d.Permission restrictions✓

Permission restrictions limit who can access data based on need, enforcing least privilege at the file or resource level. Only authorized roles can open the sensitive folder. This access control is a fundamental data protection method.

An online retailer analyzes expected holiday traffic to ensure it has enough compute, storage, and bandwidth to stay available under peak load. This process is:

• a.Capacity planning✓
• b.A penetration test that actively attempts to exploit weaknesses in the environment
• c.A business impact analysis that ranks processes by the effect of their disruption over time
• d.A tabletop exercise walking through an incident scenario through group discussion only

Capacity planning forecasts demand for people, technology, and infrastructure so resources can meet peak load without failing. Under-provisioning risks outages, an availability concern. It is a key part of resilience and continuity planning.

A hardened server runs only the single service it was built to provide, with all other software, ports, and accounts removed. Which principle does this reflect?

• a.Reducing the attack surface through least functionality✓
• b.Implementing implicit trust for all devices located inside the network perimeter zone
• c.Applying load balancing to distribute incoming requests across many identical servers
• d.Increasing redundancy by duplicating every component on the same physical host machine

Least functionality reduces the attack surface by removing unneeded services, ports, software, and accounts. A single-purpose hardened host offers attackers fewer footholds. It complements least privilege by hardening the system itself.

A remote-access VPN is configured so that only traffic destined for corporate resources goes through the tunnel while general internet browsing goes out directly. This is:

• a.An air gap, which physically isolates the network from all external connections entirely
• b.A split tunnel✓
• c.A screened subnet, which hosts public-facing servers between two separate firewalls
• d.A full tunnel, which forces absolutely all of the client's traffic through the VPN link

A split tunnel routes only corporate-bound traffic through the VPN while other traffic exits locally, improving performance but reducing inspection of general browsing. A full tunnel sends everything through the VPN for maximum control. The choice trades performance against visibility.

A company embeds a third-party analytics library into its web app, and a flaw in that library exposes user data. Which architectural risk does this highlight?

• a.Fail-open behavior, in which a failed control allows traffic through by default
• b.Data sovereignty, concerning which jurisdiction's laws govern where the data is stored
• c.Third-party dependency risk in the software supply chain✓
• d.Geographic dispersion, concerning how far apart the recovery sites are located

Incorporating third-party code or services inherits their vulnerabilities, a software supply chain risk. A flaw in a dependency becomes a flaw in the application. Vetting components, monitoring advisories, and maintaining an SBOM manage this exposure.

A server uses multiple disks configured so that if one drive fails, no data is lost and the system keeps running. Which technology provides this disk-level redundancy?

• a.Load balancing that distributes requests across several separate front-end web servers
• b.Network segmentation that divides the LAN into isolated separate broadcast domains
• c.A snapshot taken once per week and stored on the same failing disk array as the data
• d.RAID with a fault-tolerant configuration✓

Redundant array of independent disks (RAID) with a fault-tolerant level, such as RAID 1 or 5, tolerates a drive failure without losing data or availability. It provides hardware-level resilience for storage. RAID is not a backup, since it does not protect against deletion or corruption.

A stolen laptop's drive is encrypted, so the thief cannot read any of its files without the key. Which control protected the data?

• a.Data masking that only hid selected characters while leaving the rest fully readable
• b.Full-disk encryption protecting data at rest✓
• c.A firewall rule that blocked inbound connections to the laptop over the network only
• d.TLS, which secures data in transit but does nothing for files that are stored on disk

Full-disk encryption protects data at rest, rendering the drive's contents unreadable without the key even if the device is stolen. It defends confidentiality when physical control is lost. TLS, by contrast, protects data in transit, not at rest.

An audit finds Telnet, FTP, and HTTP still in use for management. Which set of replacements provides encrypted equivalents?

• a.SSH for Telnet, SFTP for FTP, and HTTPS for HTTP✓
• b.Telnet with SNMPv1, FTP with TFTP, and HTTP left unchanged for compatibility reasons
• c.Telnet with rlogin, FTP with plain FTP on another port, and HTTP with HTTP proxying
• d.SSH for HTTP, FTPS for SSH, and Telnet retained for legacy device administration

Insecure plaintext protocols should be replaced with encrypted equivalents: SSH for Telnet, SFTP or FTPS for FTP, and HTTPS for HTTP. These protect credentials and data in transit. Disabling the legacy services entirely completes the hardening.

When primary automated systems fail, staff follow documented manual procedures to keep critical business functions going. What does this reflect?

• a.A penetration test evaluating whether attackers could exploit the manual procedures
• b.Network segmentation designed to contain an intruder's movement between zones
• c.A recovery point objective specifying the maximum acceptable amount of data loss
• d.Continuity of operations planning✓

Continuity of operations planning ensures essential functions continue during disruptions, including manual alternatives when automated systems are unavailable. It keeps the business running while recovery proceeds. Documented procedures and trained staff make it work.

In the zero trust control plane, which component establishes and configures the session between a subject and a resource once access is approved?

• a.The policy administrator✓
• b.The data plane, which forwards packets but plays no part in setting up the session
• c.The policy enforcement point, which physically sits in the traffic path to allow or deny
• d.The certificate revocation list, which lists certificates that are no longer trusted now

The policy administrator executes the policy engine's decision by establishing or tearing down the connection and issuing session credentials. It acts as the bridge between the decision and the enforcement point. Together they form the zero trust control plane.

An organization wants to enforce encryption, remote wipe, and app policies on employee-owned phones that access corporate email. Which technology enables this?

• a.A load balancer distributing inbound email connections across multiple servers
• b.Mobile device management✓
• c.A screened subnet that isolates public web servers from the internal network zone
• d.A honeypot deployed to lure attackers away from the real corporate resources

Mobile device management (MDM) enforces security policies such as encryption, remote wipe, and app control on enrolled devices, including personally owned ones in BYOD models. It extends organizational control to mobile endpoints. Policy separation protects corporate data on personal phones.

Administrators use a separate dedicated management network, isolated from production traffic, to configure critical devices. Why is this preferred?

• a.It increases the attack surface by exposing management interfaces to all normal users
• b.It keeps management access available and protected even if the production network is compromised✓
• c.It automatically encrypts all production application traffic without any configuration
• d.It removes the need to authenticate administrators when they connect to the devices

Out-of-band management uses a separate network for administrative access, so managing devices remains possible even if the production network is compromised or unavailable. It also isolates sensitive management interfaces from general users. This reduces both risk and dependency.

An investment firm cannot tolerate more than a few minutes of downtime, so it maintains a fully staffed, fully equipped duplicate facility with live-replicated data. Which site type is this?

• a.A cold site providing only space and power, requiring extensive setup before any use
• b.A warm site with equipment in place but needing data restoration before it can operate
• c.A hot site✓
• d.A mobile recovery unit towed to a location only after a disaster has been declared

A hot site is fully provisioned with equipment, current data, and often staff, allowing near-immediate takeover. It offers the fastest recovery at the highest cost. It suits organizations with very low tolerance for downtime.

Where in a secure architecture should end-of-life storage media be handled so that residual data cannot be recovered by outsiders?

• a.Left in place indefinitely because encryption alone guarantees permanent destruction
• b.Sold or donated immediately after a quick file deletion to maximize the salvage value
• c.Returned to general storage shelves once the files appear deleted in the interface view
• d.Sanitized or physically destroyed under a documented media disposal process✓

Media at end of life must be sanitized or destroyed through a documented process to prevent recovery of residual data. Simple deletion or formatting can leave data recoverable. Certificates of destruction provide auditable assurance.

Under zero trust, after a user authenticates, their device's security posture changes to non-compliant mid-session. What should ideally happen?

• a.Nothing, because access granted at login remains valid for the entire session by design
• b.All logging stops to conserve resources once the initial authentication has succeeded
• c.Access is re-evaluated and can be restricted based on the changed posture✓
• d.The user gains additional privileges automatically as a reward for staying connected

Zero trust continuously evaluates trust, so a change in device posture during a session can trigger reduced access or re-authentication. Trust is never permanent or based on a single login. This adaptive, ongoing verification limits risk from changing conditions.

To block users from resolving known malicious domains before any connection is made, an organization deploys protective DNS filtering. Which benefit does this provide?

• a.It stops connections to known-malicious domains at the name-resolution stage✓
• b.It encrypts all stored data at rest on the endpoints without needing any local agent
• c.It replaces the need for endpoint protection and network firewalls entirely for good
• d.It guarantees that no zero-day exploit can ever affect the protected endpoints again

Protective DNS filtering blocks resolution of known-malicious domains, stopping many threats such as phishing and command-and-control before a connection is established. It is a lightweight, broad control. It complements, but does not replace, other layered defenses.

A popular web service distributes incoming requests across a pool of identical servers so no single server is overwhelmed and one failing server does not take the site down. Which technology is this?

• a.A tabletop exercise conducted to walk through the incident response plan verbally as a group
• b.Data classification used to label information according to its sensitivity level for handling
• c.Full-disk encryption applied to protect data at rest on each of the servers involved here
• d.Load balancing✓

Load balancing spreads client requests across multiple servers, improving performance and availability while allowing a failed node to be bypassed. It supports both scaling and resilience. Health checks let the balancer route around unhealthy servers.

When selecting where to position a new intrusion prevention system, which factor most directly determines whether it can actively block attacks?

• a.Whether it is deployed inline in the traffic path rather than passively receiving copies✓
• b.The brand of the switch that happens to connect the device to the rest of the network
• c.The color-coding scheme used on the physical network cables in the data center racks
• d.The number of unrelated administrative user accounts defined on the appliance itself

An IPS must be inline, sitting directly in the traffic path, to actively block malicious packets; a passive tap deployment can only detect and alert. Device placement therefore determines its capability. This inline-versus-passive decision is a core architecture consideration.

An asset worth $200,000 would lose 25% of its value in a particular incident. What is the single loss expectancy?

• a.$150,000, representing the residual value of the asset remaining after the incident occurs
• b.$50,000✓
• c.$25,000, calculated by applying an unrelated fixed percentage to the total asset value
• d.$200,000, representing the asset's entire replacement value regardless of the actual loss

Single loss expectancy equals asset value multiplied by the exposure factor, here $200,000 times 0.25, which is $50,000. It estimates the loss from one occurrence of the risk. SLE feeds into the annualized loss expectancy calculation.

If a single loss expectancy is $10,000 and the event is expected to occur twice per year, what is the annualized loss expectancy?

• a.$10,000, which simply repeats the single loss expectancy without factoring in the frequency
• b.$12,000, produced by adding an arbitrary surcharge on top of the single loss expectancy
• c.$5,000, found by dividing the single loss expectancy by the annualized rate of occurrence
• d.$20,000✓

Annualized loss expectancy equals single loss expectancy times the annualized rate of occurrence, here $10,000 times 2, which is $20,000. It expresses expected yearly loss to justify control spending. Spending more than the ALE on mitigation is generally not cost-effective.

A board formally states the broad amount and type of risk the organization is willing to pursue to meet its objectives. Which term describes this statement?

• a.Residual risk
• b.Annualized loss expectancy, which quantifies the expected yearly cost of a specific risk
• c.Risk appetite✓
• d.Risk tolerance

Risk appetite is the overall level and type of risk an organization is willing to accept in pursuit of its goals, set at the strategic level. Risk tolerance is the acceptable deviation for a specific risk. Appetite guides how aggressively the organization operates.

Which document catalogs identified risks along with their likelihood, impact, owner, and mitigation status so they can be tracked over time?

• a.A non-disclosure agreement that legally binds parties to keep shared information secret
• b.An acceptable use policy that defines permitted and prohibited use of company systems
• c.A risk register✓
• d.A service level agreement that defines the measurable performance a vendor must meet

A risk register is the central record of identified risks, capturing likelihood, impact, ownership, and treatment status. It supports ongoing tracking and reporting to leadership. Keeping it current is essential to risk governance.

An organization integrates automated tools that constantly evaluate its risk posture as conditions change, rather than assessing only once a year. Which assessment type is this?

• a.An ad hoc assessment triggered irregularly whenever someone happens to request one
• b.A recurring annual assessment scheduled on a fixed once-per-year calendar cadence
• c.A continuous assessment✓
• d.A one-time assessment performed only at the launch of a single specific project effort

A continuous risk assessment constantly monitors the environment so emerging risks are identified in near real time. It contrasts with point-in-time approaches like annual or ad hoc assessments. Continuous insight supports faster, better-informed decisions.

After identifying a phishing risk, a company deploys email filtering and trains staff to reduce the likelihood and impact. Which risk management strategy is this?

• a.Risk avoidance, in which the risky activity is discontinued so the risk no longer applies
• b.Risk mitigation✓
• c.Risk acceptance, in which the organization knowingly tolerates the risk without any action
• d.Risk transference, in which the financial impact is shifted to an insurer or third party

Risk mitigation applies controls to reduce a risk's likelihood or impact, such as filtering and awareness training against phishing. The risk is lowered but not eliminated. It is the most common strategy for risks the business must live with.

A legacy system cannot meet the encryption standard, so leadership formally documents and approves a temporary deviation with compensating controls. What is this called?

• a.A residual risk calculation quantifying what remains after all the controls are applied
• b.A policy exception with a documented exemption✓
• c.A business impact analysis identifying critical processes and their disruption effects
• d.A service level agreement defining measurable performance commitments from a vendor

A policy exception (exemption) formally authorizes a documented deviation from a standard, usually time-limited and paired with compensating controls. It keeps deviations visible and accountable rather than hidden. Regular review ensures exceptions do not become permanent gaps.

A one-page document states, at a high level, that the organization is committed to protecting the confidentiality of customer data. Which governance artifact is this?

• a.A procedure, which gives the exact step-by-step instructions to accomplish a specific task
• b.A guideline, which offers optional, recommended but non-mandatory best practices to follow
• c.A policy✓
• d.A standard, which specifies mandatory technical requirements such as minimum key lengths

A policy is a high-level statement of management intent and direction, such as a commitment to protect customer data. Standards specify mandatory requirements, procedures give step-by-step instructions, and guidelines are advisory. Together they form the governance hierarchy.

Before modifying a production firewall, an organization requires the change to be requested, reviewed, approved, tested, and documented with a rollback plan. Which process governs this?

• a.Change management✓
• b.A business impact analysis that ranks processes by the effect of their disruption over time
• c.Incident response, which is the process followed only after a security event is detected
• d.Penetration testing, which authorizes simulated attacks to evaluate the real defenses

Change management controls how modifications are proposed, reviewed, approved, tested, and documented, including rollback plans. It reduces the risk of outages and security gaps from unmanaged changes. Backout plans allow safe recovery if a change fails.

Under GDPR, a company decides why and how personal data is processed, while a vendor merely processes that data on the company's instructions. What is the company's role?

• a.The supervisory authority, which is the regulator enforcing the data protection law
• b.The data subject, who is the individual that the personal data actually describes here
• c.The data processor, which only acts on documented instructions given by another party
• d.The data controller✓

Under GDPR, the data controller determines the purposes and means of processing personal data, bearing primary accountability. The processor acts on the controller's instructions. Distinguishing the roles clarifies legal responsibilities and liability.

A customer in the EU formally requests that a company erase all personal data it holds about them. Which GDPR right is being exercised?

• a.The right to erasure, also known as the right to be forgotten✓
• b.The right to rectification, which lets a person correct inaccurate personal data held
• c.The right of access, which lets a person obtain a copy of the data held about them
• d.The right to portability, which lets a person receive their data in a reusable format

The right to erasure, or right to be forgotten, lets individuals request deletion of their personal data under certain conditions. Organizations must have processes to honor valid requests. It is one of several data subject rights GDPR grants.

A retailer wants to shrink the systems subject to payment card security requirements. Which approach most directly reduces PCI DSS scope?

• a.Increasing the frequency of general security awareness training for all staff members
• b.Encrypting all employee laptops that never store or process any cardholder data at all
• c.Purchasing cyber-insurance to transfer the financial impact of a potential data breach
• d.Segmenting the cardholder data environment and tokenizing stored card numbers✓

Segmenting the cardholder data environment and replacing stored card numbers with tokens removes systems from PCI DSS scope, since fewer components touch actual card data. This lowers compliance cost and risk. Scope reduction is a core PCI DSS strategy.

A hospital must implement administrative, physical, and technical safeguards to protect patient health information. Which regulation imposes these categories of safeguards?

• a.GDPR, which governs the personal data of individuals located within the European Union
• b.HIPAA✓
• c.PCI DSS, which governs the protection of payment card data for merchants and processors
• d.SOX, which governs the accuracy and integrity of public companies' financial reporting

HIPAA's Security Rule requires administrative, physical, and technical safeguards to protect electronic protected health information. It applies to covered entities and their business associates. Violations can bring significant civil and criminal penalties.

Which US law was enacted primarily to ensure the accuracy and integrity of public companies' financial reporting and internal controls?

• a.GLBA, which governs how financial institutions protect consumers' nonpublic information
• b.The Sarbanes-Oxley Act✓
• c.GDPR, which regulates the processing of personal data belonging to European Union residents
• d.HIPAA, which sets requirements for safeguarding individuals' protected health information

The Sarbanes-Oxley Act (SOX) mandates controls and executive accountability over financial reporting for public companies. IT controls supporting the integrity of financial data fall in its scope. It arose from major corporate accounting scandals.

Which of the following is a direct consequence an organization may face for failing to meet a mandatory regulatory requirement?

• a.A guaranteed increase in customer trust regardless of the underlying nature of the violation
• b.Regulatory fines and potential loss of operating license✓
• c.The removal of any obligation to notify affected individuals about a reported data breach
• d.An automatic and permanent immunity from all future audits and regulatory examinations

Non-compliance can lead to fines, sanctions, loss of license, contractual penalties, and reputational damage. These consequences make compliance a business priority, not just a legal formality. The specific penalties depend on the regulation and severity.

An organization hires an independent accredited firm to formally examine and attest to its security controls for customers. Which type of assessment is this?

• a.An internal self-assessment performed by the organization's own staff for its own internal use
• b.A tabletop exercise walking a team through a hypothetical incident scenario verbally as a group
• c.A vulnerability scan that enumerates known weaknesses without exploiting any of them at all
• d.An external independent third-party audit✓

An external audit by an independent third party provides objective assurance and attestation that others, such as customers or regulators, can trust. Internal audits and self-assessments are valuable but lack that independence. Independence strengthens credibility of the findings.

After examining a service provider's controls, an independent auditor issues a formal signed statement about their effectiveness for the reporting period. This formal statement is called:

• a.An attestation✓
• b.A memorandum of understanding expressing the non-binding intentions of two separate parties
• c.A statement of work detailing the specific deliverables and tasks of a defined engagement
• d.A business impact analysis identifying critical functions and the effect of their disruption

Attestation is an auditor's formal declaration about the state or effectiveness of controls, such as in a SOC 2 report. It gives third parties confidence without their needing to audit directly. It is a common form of external assurance.

Two independent companies form a partnership and sign a document defining how they will share profits, responsibilities, and liabilities in the venture. Which agreement is this?

• a.A non-disclosure agreement legally binding the parties to protect the shared confidential data
• b.A service level agreement specifying measurable performance targets such as guaranteed uptime
• c.A memorandum of understanding expressing only a non-binding intention to cooperate together
• d.A business partnership agreement✓

A business partnership agreement (BPA) defines the terms between partners, including responsibilities, profit sharing, and liabilities. It differs from an SLA, which sets performance metrics, and an NDA, which protects confidentiality. Choosing the right agreement clarifies obligations.

A company wants contractual authority to inspect a critical vendor's security controls at any time during the relationship. Which provision should be included in the contract?

• a.A non-disclosure clause preventing either party from revealing shared confidential information
• b.A data retention clause specifying how long records must be kept before final disposal
• c.A right-to-audit clause✓
• d.A service level agreement clause specifying only the vendor's guaranteed monthly uptime percentage

A right-to-audit clause grants the customer contractual authority to assess the vendor's controls, providing ongoing assurance. Without it, the customer may have no leverage to verify security. It is a key element of third-party risk management.

Before onboarding a new software supplier, a company reviews the supplier's security questionnaire, financial stability, and history of breaches. This process is best described as:

• a.A tabletop exercise rehearsing the company's response to a hypothetical security incident
• b.A penetration test actively exploiting the supplier's externally facing internet systems
• c.A business impact analysis ranking the company's own internal processes by criticality
• d.Vendor due diligence✓

Vendor due diligence evaluates a prospective third party's security, financial health, and track record before engagement. It informs whether the vendor's risk is acceptable. Ongoing monitoring continues the assessment throughout the relationship.

A policy specifies that customer transaction records are kept for exactly seven years and then securely destroyed. Which governance concept does this implement?

• a.A data retention policy✓
• b.A right-to-audit clause granting authority to inspect a third party's security controls
• c.Data masking, which hides selected characters of a value while showing the remainder
• d.Data classification, which labels information by its sensitivity to guide proper handling

A data retention policy defines how long different data types are kept and when they are disposed of, balancing legal, business, and privacy needs. Keeping data too long increases risk and liability. Secure destruction at end of retention completes the lifecycle.

Which governance structure is typically responsible for setting overall risk direction and holding management accountable for the security program?

• a.External attackers, whose activity indirectly shapes the organization's technical controls
• b.Individual end users, who each independently define the organization's security strategy
• c.The board of directors and executive governance committee✓
• d.The help desk team, which handles day-to-day user support tickets and password resets

Boards and executive committees provide governance oversight, setting risk appetite and holding management accountable for the security program. Governance is a leadership responsibility, not solely a technical one. Clear structures ensure security aligns with business objectives.

A client provides testers with no prior information about the target environment, requiring them to discover everything as a real outside attacker would. Which engagement type is this?

• a.A partially known (gray-box) test, in which testers are given some limited internal information
• b.A tabletop exercise, in which participants only discuss a scenario without touching any systems
• c.An unknown environment (black-box) test✓
• d.A known environment (white-box) test, in which testers receive full internal documentation

An unknown environment, or black-box, penetration test gives the testers no internal knowledge, simulating an external attacker's perspective. Known (white-box) tests share full information, and partially known (gray-box) tests share some. The choice shapes realism and efficiency.

During continuity planning, a team determines that a payroll system must be restored within four hours and can lose at most one hour of data. Which two metrics are these?

• a.Recovery time objective and recovery point objective✓
• b.Single loss expectancy and annualized rate of occurrence, both used in quantitative analysis
• c.Risk appetite and risk tolerance, both describing how much risk the organization will accept
• d.Mean time between failures and mean time to repair, both describing hardware reliability

The recovery time objective (RTO) is the maximum acceptable time to restore a service, and the recovery point objective (RPO) is the maximum tolerable data loss. Here RTO is four hours and RPO is one hour. Both come from the business impact analysis.

Who is ultimately accountable for classifying a dataset and deciding who may access it, even though IT staff physically maintain the storage?

• a.The end user, who consumes the data but has no authority over its classification level
• b.The data custodian, who implements and maintains the controls but does not set the policy
• c.The data processor, who handles the data only on documented instructions from other parties
• d.The data owner✓

The data owner is accountable for a dataset, including its classification and access decisions, even when custodians handle day-to-day storage and protection. Ownership assigns responsibility for the data's proper handling. Custodians and stewards execute the owner's decisions.

Many privacy laws require that when personal data is breached, affected individuals and regulators must be informed within a defined timeframe. What is this obligation called?

• a.A breach notification requirement✓
• b.A memorandum of understanding stating the non-binding intentions of two cooperating parties
• c.A right-to-audit clause granting authority to inspect a partner's internal security controls
• d.A service level agreement defining the measurable performance a provider is required to meet

Breach notification requirements obligate organizations to inform affected individuals and often regulators within set deadlines after a data breach. Laws like GDPR and various state statutes impose these duties. Timely notification is both a legal and trust obligation.

A team rates risks as high, medium, or low based on expert judgment of likelihood and impact rather than precise dollar figures. Which analysis approach is this?

• a.Qualitative analysis✓
• b.A business impact analysis, which identifies critical functions and their disruption effects
• c.Quantitative analysis, which assigns specific monetary values such as SLE and ALE to risks
• d.A penetration test, which actively attempts to exploit the weaknesses in the environment

Qualitative risk analysis uses descriptive ratings like high, medium, and low based on judgment when precise figures are unavailable. It is faster and more subjective than quantitative analysis. Many programs combine both for a fuller picture.

When an employee leaves, the organization follows a checklist to disable accounts, revoke access, and collect equipment. Which governance element defines these steps?

• a.A standard specifying mandatory technical parameters such as the minimum password length
• b.A guideline offering optional, recommended best practices that staff may choose to follow
• c.A high-level policy stating only the organization's general commitment to protecting security
• d.An offboarding procedure✓

An offboarding procedure gives the step-by-step actions for securely separating an employee, such as disabling accounts and recovering assets. Procedures translate policy into concrete, repeatable steps. Prompt offboarding prevents lingering access from becoming a threat.

Before a penetration test begins, both parties sign a document defining the scope, permitted techniques, timing, and systems that are off-limits. What is this document?

• a.A service level agreement that specifies the measurable performance the tester must meet
• b.A business impact analysis that identifies critical processes and their disruption effects
• c.A non-disclosure agreement that solely governs the confidentiality of the shared information
• d.The rules of engagement✓

Rules of engagement define the scope, boundaries, permitted methods, and timing of a penetration test, protecting both parties. They prevent misunderstandings and unintended damage. Clear authorization also keeps the testing legal.

An organization takes reasonable, ongoing steps a prudent entity would take to protect its assets and meet its obligations. Which concept describes this ongoing reasonable action?

• a.Risk acceptance
• b.Separation of duties, which splits a sensitive task among several people to deter any fraud
• c.Due diligence
• d.Due care✓

Due care is the ongoing exercise of reasonable precautions a prudent organization would take, while due diligence is the investigation and research that informs decisions. Both are used to demonstrate responsible governance. Together they help defend against negligence claims.

The security team periodically compiles key risks, their status, and trends into a summary for executives to support decision-making. This activity is called:

• a.Penetration testing, which authorizes simulated attacks to validate the technical defenses
• b.Risk reporting✓
• c.Data masking, which hides portions of sensitive fields displayed within an application interface
• d.Change management, which controls how modifications to systems are approved and then tracked

Risk reporting communicates the current risk landscape, status, and trends to stakeholders such as executives and the board. It enables informed, risk-based decisions and resource allocation. Effective reporting is clear, timely, and tied to business impact.

A bank must protect customers' nonpublic personal financial information and explain its information-sharing practices. Which US law imposes these requirements?

• a.HIPAA, which specifically governs the protection of individuals' protected health information
• b.GDPR, which governs the processing of the personal data of European Union member residents
• c.The Gramm-Leach-Bliley Act✓
• d.PCI DSS, which is a contractual standard governing the handling of payment card data records

The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to protect customers' nonpublic personal information and disclose their information-sharing practices. It includes a Safeguards Rule for security controls. It applies specifically to financial services firms.

Why should security policies include a defined schedule for periodic review and revision?

• a.So they stay aligned with evolving threats, technology, regulations, and business needs✓
• b.Because review permanently eliminates all residual risk associated with the policy's subject
• c.Because policies that are reviewed can never afterward be challenged in any court of law
• d.So that employees are no longer required to acknowledge or follow them once they are reviewed

Policies must be reviewed and revised on a schedule so they remain effective as threats, technology, laws, and the business change. Stale policies create gaps and compliance issues. Governance includes ownership and a defined revision cadence.

When selecting a firm to perform an independent security audit, why should the auditor have no financial stake in the outcome?

• a.Because regulators require every external auditor to also sell remediation products to clients
• b.To avoid a conflict of interest that could compromise the audit's objectivity✓
• c.Because a financial stake would make the audit finish faster and cost the client much less
• d.Because auditors with a financial stake are legally required to work at no cost to the client

An auditor with a financial stake in the outcome has a conflict of interest that can bias findings and undermine trust in the results. Independence is essential to a credible, objective assessment. Vendor selection should screen for such conflicts.

To reduce manual effort and errors, an organization implements tools that continuously collect evidence and generate compliance status reports automatically. Which benefit does this automation primarily provide?

• a.It eliminates any need for human oversight of the compliance program from that point going forward
• b.More consistent, timely, and accurate monitoring of compliance status✓
• c.It provides a guarantee that the organization can never experience any future data breach at all
• d.It permanently removes the organization from the scope of every applicable regulation it faces

Automating compliance evidence collection and reporting improves consistency, timeliness, and accuracy while reducing manual burden. It supports continuous rather than point-in-time compliance visibility. Human oversight is still required to interpret and act on results.

A bank requires customers to enter a password and then approve a push notification on their enrolled phone before accessing their account. Which authentication factors are being combined?

• a.Two separate instances of something you know, which does not truly raise assurance
• b.Something you know and something you have✓
• c.Something you are and somewhere you are, tied to a physical biometric location
• d.Something you have and something you do, based on continuous behavioral analysis

The password is knowledge (something you know) and the enrolled phone is possession (something you have), so two distinct factor categories are combined. Genuine multifactor authentication requires categories that fail independently, so stealing one does not defeat the other. Two passwords would still be a single category and add little assurance.

An organization deploys single sign-on so employees authenticate once to reach many applications. What is the primary security trade-off administrators must plan for?

• a.A compromised SSO credential can unlock every connected application at once✓
• b.Encryption of network traffic between the applications is automatically disabled by design
• c.Users are forced to memorize a separate, complex password for every individual application they use
• d.Applications can no longer share any authentication information between one another

SSO concentrates risk because one authentication grants access to many systems, so a stolen SSO credential becomes a master key. That is why SSO should be paired with strong MFA and session controls. The convenience of one login is exactly what raises the stakes if it is compromised.

A user logs into a partner's cloud application using their own company credentials, and the company's identity system vouches for them. In this federated setup, what role does the company's identity system play?

• a.Certificate authority that signs the TLS certificate presented by the application
• b.Service provider, which hosts the partner application and stores its user data
• c.Relying party that consumes the assertion and makes the final resource decision
• d.Identity provider that authenticates the user and issues assertions✓

In federation the identity provider (IdP) authenticates the user and issues a signed assertion, while the partner acts as the service provider or relying party that trusts it. This lets users access external apps without those apps ever handling company passwords. Distinguishing the IdP from the SP is central to understanding SAML and OIDC flows.

A photo-printing website asks to access a user's cloud photo library without ever seeing the user's cloud password, using a delegated access token. Which framework is being used?

• a.OAuth 2.0✓
• b.Kerberos, which issues time-limited tickets for authentication inside a single domain
• c.RADIUS, which centralizes network access authentication, authorization, and accounting
• d.SAML, an XML-based standard used mainly for enterprise browser single sign-on assertions

OAuth 2.0 is an authorization framework that issues scoped access tokens so one service can act on a user's behalf without receiving their password. It delegates access, not identity, which is why scopes limit what the token can do. Limiting scope and token lifetime is key to using it safely.

A developer needs not just delegated access but also verified identity information about the user, returned in a signed ID token. Which protocol layered on OAuth 2.0 provides this?

• a.802.1X
• b.LDAP
• c.TACACS+, which separates authentication, authorization, and accounting for device admin
• d.OpenID Connect✓

OpenID Connect adds an identity layer on top of OAuth 2.0, returning a signed ID token that proves who the user is. OAuth alone handles authorization, so OIDC is what supplies authenticated identity. This distinction is why OIDC is used for modern web and mobile sign-in.

In a Windows domain, a workstation presents a time-stamped ticket to reach a file server without re-entering a password. Why does Kerberos rely on tightly synchronized clocks across the domain?

• a.Because tickets are stored permanently and never expire once they are issued to a host
• b.Because time stamps limit ticket validity and help prevent replay attacks✓
• c.Because the key distribution center encrypts all file contents using the workstation clock
• d.Because domain controllers bill each user for the exact number of seconds of access used

Kerberos tickets carry time stamps and short lifetimes, so synchronized clocks let servers reject stale or replayed tickets. If clocks drift too far apart, valid tickets are refused and stale ones might be accepted. This is why time synchronization is a hard requirement in Kerberos realms.

An administrator notices directory queries and bind credentials are traveling in cleartext over port 389. Which change encrypts this directory traffic?

• a.Disable anonymous binds but keep the existing plaintext connection on port 389
• b.Move the directory server into the screened subnet that faces the public internet
• c.Use LDAPS, wrapping LDAP in TLS on port 636✓
• d.Switch the directory to broadcast its queries over UDP so that lookups complete faster

LDAPS encapsulates LDAP inside TLS, typically on port 636, encrypting both queries and bind credentials in transit. Cleartext LDAP exposes directory passwords to any on-path attacker. Encrypting the channel, not just restricting binds, is what protects the credentials.

A network team wants centralized administrator login to routers with the ability to authorize individual commands and log each one separately. Which protocol best fits because it separates authentication, authorization, and accounting?

• a.TACACS+✓
• b.SAML, an assertion format used mostly for browser-based web single sign-on flows
• c.RADIUS, which combines the authentication and authorization steps into a single exchange
• d.Kerberos, which is designed for domain single sign-on using time-limited tickets

TACACS+ separates authentication, authorization, and accounting into independent functions, enabling per-command authorization and detailed logging for device administration. RADIUS merges authentication and authorization, giving less granular command control. This separation is why TACACS+ is favored for network device admin.

To reduce standing administrative rights, a company grants elevated access only for a short approved window and records the session. Which control is this?

• a.Mandatory access control, enforcing sensitivity labels assigned by a central authority
• b.Privileged access management with just-in-time elevation✓
• c.Discretionary access control, letting each resource owner set their own file permissions
• d.Single sign-on, which authenticates the user once for access to many applications

Privileged access management with just-in-time elevation removes always-on admin rights, granting them briefly on request and recording the activity. This shrinks the window an attacker can abuse stolen admin credentials. Time-boxing and session recording are what distinguish it from static privileged accounts.

A DevOps team stops hardcoding database passwords in scripts and instead retrieves them at runtime from a centralized secrets manager that rotates them automatically. What risk does this primarily reduce?

• a.The risk of exposed, static, long-lived credentials embedded directly in source code✓
• b.The risk that end users will choose weak passphrases for their own personal accounts
• c.The risk that TLS certificates will silently expire and break client connections later
• d.The risk of denial-of-service caused by too many simultaneous inbound connections

A secrets manager keeps credentials out of code and rotates them, so a leaked repository or old backup no longer hands attackers valid passwords. Hardcoded secrets are long-lived and hard to rotate once exposed. Centralized, rotating retrieval directly addresses that exposure.

An access system evaluates the user's department, the device's health, the time of day, and data sensitivity before allowing a request. Which access control model is described?

• a.Discretionary access control, where the owner of the resource decides who may access it
• b.Attribute-based access control✓
• c.Rule-based access control, applying one fixed access list equally to every single user
• d.Role-based access control, which grants permissions strictly by the user's assigned job role

Attribute-based access control (ABAC) makes decisions from multiple attributes of the user, device, resource, and context, enabling fine-grained, dynamic policies. Role-based control keys only on job role and is less context-aware. Combining many attributes is the defining trait of ABAC.

A cloud platform blocks logins from unmanaged devices and requires MFA when a sign-in comes from an unusual country. What is this adaptive approach called?

• a.Implicit trust, which grants access automatically to anyone already inside the network
• b.Full-disk encryption, which protects data stored locally on the endpoint while at rest
• c.Conditional access based on risk and device posture✓
• d.Static access lists that never change regardless of context or the current risk signals

Conditional access evaluates signals such as device compliance, location, and risk to decide whether and how to grant access, stepping up authentication when risk rises. It embodies zero-trust thinking by never trusting a session on network location alone. Adapting requirements to context is its central idea.

A security team tuning a fingerprint reader wants the setting where the false acceptance rate equals the false rejection rate, used to compare device accuracy. What is this point called?

• a.Crossover error rate✓
• b.The annualized rate of occurrence of an unauthorized person entering through the door
• c.The single loss expectancy associated with one individual failed authentication event
• d.The maximum tolerable downtime allowed before the failed reader has to be replaced

The crossover error rate (CER) is where false acceptance and false rejection rates are equal, giving a single number to compare biometric accuracy. A lower CER means a more accurate sensor overall. It lets teams tune sensitivity while understanding the balance between wrongly admitting and wrongly rejecting users.

During an audit, several active accounts belong to employees who left the company months ago. Which identity lifecycle failure does this reveal?

• a.Failure to deprovision accounts promptly at offboarding✓
• b.Improper encryption of the directory database in which the user accounts are stored
• c.Excessive multifactor prompts that cause users to approve push requests carelessly
• d.Weak password complexity requirements enforced at the moment of initial account creation

Leftover active accounts show a breakdown in deprovisioning, the offboarding step that disables access when someone leaves. Orphaned accounts are prime targets because no one monitors them. Tying account deactivation to HR offboarding prevents this gap.

An engineer needs to encrypt large volumes of stored data quickly using a single shared key and selects AES. Why is a symmetric cipher like AES preferred here over an asymmetric one?

• a.Because asymmetric ciphers are technically unable to encrypt data of any size at all
• b.Because AES automatically distributes its own keys with no coordination required at all
• c.Because symmetric encryption uniquely provides non-repudiation of the original sender
• d.Because symmetric ciphers are much faster for bulk data encryption✓

Symmetric ciphers such as AES are far faster and less compute-intensive than asymmetric algorithms, making them ideal for encrypting large data volumes. Asymmetric crypto is slow and typically used only to exchange keys or sign. Speed on bulk data is the reason AES is chosen here.

A protocol encrypts a real-time voice stream one bit or byte at a time as it is generated, rather than in fixed 128-bit blocks. Which cipher type suits this continuous data best?

• a.An asymmetric cipher, using the recipient's public key to protect each individual byte
• b.A stream cipher✓
• c.A hashing algorithm, which produces a fixed digest and cannot be reversed to plaintext
• d.A block cipher in ECB mode, which encrypts every identical block in exactly the same way

A stream cipher encrypts data continuously, bit or byte at a time, which fits real-time streams like voice where data arrives incrementally. Block ciphers work on fixed-size chunks and can add latency or padding. Matching the cipher to the data flow is the key idea here.

Two parties who have never met need to agree on a shared secret over an open network without ever transmitting the secret itself. Which mechanism enables this?

• a.A certificate revocation list distributed to every client on the network on a daily basis
• b.A cryptographic hash function applied to each party's public identity string on both ends
• c.Diffie-Hellman key exchange✓
• d.Symmetric AES encryption using a key that must already be shared beforehand in person

Diffie-Hellman lets two parties derive a shared secret over an untrusted channel without sending the secret, using public exchanges and private values. It solves the bootstrapping problem of symmetric keys. This is why it underpins secure session establishment in protocols like TLS.

A security architect wants assurance that if a server's long-term private key is later stolen, past recorded TLS sessions still cannot be decrypted. Which property, achieved with ephemeral keys, provides this?

• a.Perfect forward secrecy✓
• b.Non-repudiation, which proves which specific party originally sent each recorded message
• c.Certificate pinning, which hardcodes an expected certificate directly into the client app
• d.Key escrow, which stores a recoverable copy of the key with a trusted third-party agent

Perfect forward secrecy uses ephemeral, per-session keys that are discarded, so compromising the long-term key does not expose previously recorded sessions. Each session's secret is independent of the server's static key. This limits the blast radius of a future key theft.

A mobile device team wants strong asymmetric security with smaller keys and lower power use than RSA. Which algorithm family meets this need?

• a.SHA-3, a hashing standard that only produces fixed-length integrity digests of data
• b.AES, a symmetric block cipher that is entirely unrelated to public-key operations
• c.Elliptic curve cryptography✓
• d.RSA with 4096-bit keys, maximizing key length regardless of the device's battery life

Elliptic curve cryptography achieves comparable security to RSA with much smaller keys, reducing computation, memory, and power draw. This efficiency suits constrained mobile and IoT devices. Smaller keys for equivalent strength are ECC's defining advantage.

To make stored password hashes far more expensive to crack, a developer chooses an algorithm deliberately designed to be slow and memory-hard, such as Argon2 or bcrypt. What is this technique called?

• a.Tokenization, which replaces the password with an unrelated reference value in a vault
• b.Certificate stapling, which attaches a signed revocation status to the TLS handshake
• c.Steganography, which conceals the password inside an unrelated image or media file
• d.Key stretching✓

Key stretching applies deliberately slow, resource-intensive functions like bcrypt, PBKDF2, or Argon2 so each password guess costs an attacker significant time. This blunts brute-force and dictionary attacks against stolen hashes. Intentional slowness is exactly the point of the technique.

An API includes a keyed hash with each message so the receiver can confirm both that the content is unchanged and that it came from a party sharing the secret key. What is this construct?

• a.A digital certificate that was issued and signed by a publicly trusted authority
• b.A symmetric AES ciphertext block chained to the previously encrypted message block
• c.A plain SHA-256 digest, which verifies integrity but says nothing about the sender
• d.An HMAC✓

A hash-based message authentication code (HMAC) combines a shared secret key with a hash, providing both integrity and authenticity. A plain hash detects change but not who produced it. Mixing in the secret key is what proves the message came from a key holder.

Before a certificate authority can issue a TLS certificate, an admin generates a request containing the server's public key and identifying details, signed by the matching private key. What is this request called?

• a.A certificate signing request✓
• b.A certificate revocation list, which enumerates the certificates that are no longer trusted
• c.A key escrow deposit that places a recoverable copy of the private key with a third party
• d.An online certificate status protocol response confirming a certificate's validity in real time

A certificate signing request (CSR) packages the public key and identity information and is signed by the corresponding private key to prove key ownership. The CA validates it before issuing a signed certificate. The private key itself never leaves the requester, which is why only the CSR is sent.

To limit exposure of its most trusted key, an organization keeps its root CA offline and issues day-to-day certificates from a subordinate CA. What is the main security benefit?

• a.Clients can skip verifying the certificate chain entirely because the root is offline
• b.The intermediate CA removes the need to ever renew certificates before they expire
• c.The offline root key stays protected while the intermediate handles routine issuance✓
• d.Certificates no longer need to be validated against any revocation source by clients

Keeping the root CA offline protects the most critical key, while an intermediate CA does everyday signing. If an intermediate is compromised it can be revoked without destroying the entire trust hierarchy. This tiered design contains damage and preserves the root's integrity.

A high-traffic site wants clients to learn a certificate's revocation status without each client separately querying the CA, reducing latency and privacy leakage. Which approach fits?

• a.Pinning the certificate so the client rejects any other certificate that is presented
• b.Distributing a full certificate revocation list to every visiting browser once every hour
• c.Disabling revocation checking entirely in order to speed up the TLS handshake time
• d.OCSP stapling✓

OCSP stapling has the server periodically fetch a signed revocation status and attach it to the TLS handshake, so clients get proof without contacting the CA themselves. This cuts latency and stops the CA from seeing which clients visit. The server, not each client, does the checking.

A mobile banking app hardcodes the expected server certificate so that even a fraudulent but validly-signed certificate from another CA is rejected. This defense is called:

• a.Certificate pinning✓
• b.Key stretching, which slows down brute-force attempts against stored password hashes
• c.Wildcard certification, covering every subdomain under one shared certificate at once
• d.Cross-certification between two otherwise independent certificate authority hierarchies

Certificate pinning embeds the expected certificate or key in the app so it refuses any other certificate, even one a CA would normally trust. This blocks man-in-the-middle attacks using rogue but validly issued certificates. The trade-off is that pinned certificates must be updated before they change.

A company wants one certificate to secure store.example.com, mail.example.com, and any other host under example.com. Which certificate type covers all subdomains at one level?

• a.A code-signing certificate that is used to prove the authorship of software binaries
• b.An extended validation certificate that requires rigorous vetting of the organization
• c.A self-signed certificate that is generated without any external authority involved at all
• d.A wildcard certificate✓

A wildcard certificate uses a name like *.example.com to secure any single-level subdomain, simplifying management. The convenience comes with risk, since one compromised private key affects every covered host. Understanding its scope and shared-key risk is the exam point.

An internal test server presents a certificate that no public CA vouches for, so browsers warn users. Why does a self-signed certificate trigger this warning?

• a.Because no trusted third party has verified the certificate's authenticity✓
• b.Because self-signed certificates are hardcoded to expire within twenty-four hours only
• c.Because self-signed certificates always use a weaker cipher than CA-issued certificates
• d.Because the private key is automatically published alongside the certificate's public key

A self-signed certificate is not vouched for by any CA in the browser's trust store, so the client cannot confirm the server's identity and warns the user. The encryption strength can be identical; the issue is missing third-party validation. Trust chaining, not cipher strength, is what is absent.

So encrypted data is not permanently lost when an employee leaves or forgets a passphrase, an organization stores a protected recovery copy of decryption keys with a trusted custodian. This practice is:

• a.Certificate pinning, which hardcodes a trusted certificate to detect fraudulent impostors
• b.Perfect forward secrecy, which isolates each session's keys from the long-term server key
• c.Salting, which adds a unique random value to every password before it is hashed and stored
• d.Key escrow✓

Key escrow stores a recoverable copy of cryptographic keys with a trusted party so data can be recovered if the original key is lost. It supports business continuity but also creates a high-value target that must be tightly controlled. The recovery copy is the essence of escrow.

Anticipating that today's algorithms may weaken over time, an architect designs systems so cryptographic algorithms can be swapped with minimal disruption. This design goal is called:

• a.Steganographic embedding of secret data within ordinary-looking image or media files
• b.Cryptographic agility✓
• c.Homomorphic encryption, which allows computation to be performed directly on ciphertext
• d.Ephemeral keying, which discards each session's keys immediately after the exchange ends

Cryptographic agility is designing systems so algorithms and key sizes can be replaced as standards evolve or weaknesses emerge. It matters because ciphers age and quantum computing threatens some today. Building in swap-ability avoids costly rip-and-replace later.

Before publishing a software update, a vendor signs the installer with its private key so users can verify the code's origin and that it was not modified. Which control is this?

• a.Code signing✓
• b.A certificate revocation list, which clients consult before installing any new software
• c.Tokenization, which substitutes sensitive values with non-sensitive placeholder tokens
• d.Full-disk encryption, which protects data stored at rest on the end user's local device

Code signing attaches a digital signature to software so users can confirm the publisher and detect tampering before running it. A broken or missing signature signals modification or an untrusted source. This provides integrity and authenticity for distributed code.

An executive needs to send email that is both encrypted and digitally signed using certificate-based keys. Which standard provides this for email messages?

• a.DKIM, which attaches a domain signature to message headers for server-side verification
• b.DMARC, which tells receiving servers how to handle messages that fail alignment checks
• c.SPF, which lists the mail servers that are authorized to send for a given domain name
• d.S/MIME✓

S/MIME uses certificates and key pairs to encrypt and digitally sign individual email messages, giving confidentiality, integrity, and authentication at the message level. SPF, DKIM, and DMARC authenticate the sending domain but do not encrypt the message body. Per-message signing and encryption are what S/MIME adds.

A team discovers two different files produce the same MD5 digest, letting an attacker substitute a malicious file undetected. What weakness does this demonstrate?

• a.A hash collision in a broken algorithm✓
• b.A downgrade attack forcing negotiation of an older and weaker TLS protocol version
• c.A replay attack that reuses previously captured authentication credentials on a service
• d.A brute-force attack succeeding against an otherwise strong password hashing scheme

A hash collision occurs when two different inputs produce the same digest, and MD5 and SHA-1 are broken because collisions can be engineered. This lets an attacker swap a benign file for a malicious one with a matching hash. Using collision-resistant algorithms like SHA-256 prevents it.

Two users choose the identical password, yet their stored hashes differ because a unique random value was added to each before hashing. What is that per-password value?

• a.A salt✓
• b.A pepper, which is a single secret value shared across every password in the whole system
• c.A nonce that is transmitted openly to the client during every login handshake attempt
• d.An initialization vector reused to chain each successive block of ciphertext together

A salt is a unique random value added to each password before hashing, so identical passwords yield different hashes and precomputed rainbow tables fail. A pepper, by contrast, is a single secret applied to all passwords. Per-password uniqueness is what distinguishes a salt.

TLS encrypts the bulk session with a fast symmetric key but uses the server's public key only to protect that symmetric key during setup. Combining both this way is known as:

• a.Steganography, which hides the symmetric key inside an innocuous cover image or file
• b.Hybrid encryption using a digital envelope✓
• c.A hash-based message authentication code applied across the entire encrypted data stream
• d.Key escrow, which deposits session keys with a neutral third-party recovery custodian

Hybrid encryption uses fast symmetric encryption for the data and slower asymmetric encryption only to protect the symmetric key, a pattern called a digital envelope. This captures the speed of symmetric crypto and the key-distribution ease of asymmetric crypto. TLS relies on exactly this combination.

To stop attackers from feeding forged DNS responses to clients, an organization signs its DNS records so resolvers can cryptographically verify their authenticity. Which extension provides this?

• a.A web application firewall that inspects inbound HTTP requests for injection patterns
• b.A virtual private network that tunnels all client traffic back to the headquarters site
• c.Network address translation, which hides many internal hosts behind one public address
• d.DNSSEC✓

DNSSEC adds digital signatures to DNS records so resolvers can verify responses are authentic and unmodified, defeating cache poisoning and spoofing. It provides origin authentication and integrity but not confidentiality. Signed records are what let a resolver trust an answer.

A site-to-site VPN must both encrypt payloads and authenticate them between two gateways, protecting the entire original IP packets. Which IPsec component and mode apply?

• a.The TLS record protocol, which secures application streams rather than raw IP packets
• b.GRE encapsulation alone, which forwards packets without providing any confidentiality
• c.ESP in tunnel mode✓
• d.AH in transport mode, which authenticates the packet but does not encrypt the payload

Encapsulating Security Payload (ESP) provides both encryption and authentication, and tunnel mode wraps the entire original IP packet, which suits gateway-to-gateway VPNs. AH authenticates but does not encrypt, and transport mode leaves original headers exposed. ESP plus tunnel mode meets both requirements.

A security review flags that servers still accept SSL 3.0 and TLS 1.0, enabling downgrade attacks. What is the recommended remediation?

• a.Enable every available protocol version so the widest possible range of clients can connect
• b.Replace the certificates with self-signed ones to sidestep protocol version negotiation
• c.Disable obsolete protocols and require TLS 1.2 or 1.3✓
• d.Rely only on the certificate's validity and ignore which protocol version was negotiated

Downgrade attacks force use of older, weaker protocols, so disabling SSL and early TLS and requiring TLS 1.2 or 1.3 removes the vulnerable options. Certificate validity is unrelated to the negotiated protocol version. Eliminating weak versions is what closes the downgrade path.

Network monitoring currently uses a version of SNMP that sends community strings in cleartext. Which version adds authentication and encryption for management traffic?

• a.Syslog over UDP, which forwards event messages without providing any confidentiality
• b.SNMPv1, which is the original version relying solely on plaintext community strings
• c.SNMPv3✓
• d.NetFlow, which exports traffic-flow statistics rather than managing network devices

SNMPv3 adds authentication and encryption, protecting management credentials and data that earlier versions sent in cleartext. Versions 1 and 2c rely on community strings exposed to sniffing. Upgrading to v3 secures the management plane.

A VoIP deployment must keep call audio confidential and protected from tampering in transit. Which protocol secures the media stream?

• a.SMTP over TLS, which protects the transfer of email messages between mail servers
• b.SIP alone, which sets up and tears down call sessions but does not encrypt the media
• c.SNMP, which is used to poll and configure network devices remotely across the LAN
• d.SRTP✓

Secure Real-time Transport Protocol (SRTP) encrypts and authenticates the audio and video media stream in VoIP, protecting call content. SIP handles signaling and needs its own protection, such as SIP over TLS. Securing the media, not just signaling, is SRTP's role.

A domain owner wants receiving servers to reject spoofed mail claiming to come from their domain and to receive reports on abuse. Which policy layer builds on SPF and DKIM to enforce this?

• a.OCSP, which lets clients check a certificate's revocation status in near real time
• b.S/MIME, which encrypts and signs individual messages using each user's own certificate
• c.DMARC✓
• d.TLS, which encrypts the transport channel between two mail servers while in transit

DMARC builds on SPF and DKIM, telling receivers how to handle messages that fail alignment and providing aggregate reports on abuse. It is what turns sender authentication into an enforceable, reportable policy. SPF and DKIM verify; DMARC decides and reports.

During an investigation, analysts find event times inconsistent across servers, making correlation impossible. Securing and synchronizing which service fixes this?

• a.Network Time Protocol✓
• b.Domain Name System resolution of internal and external hostnames to their IP addresses
• c.Simple Mail Transfer Protocol, which delivers outbound email messages between servers
• d.Dynamic Host Configuration Protocol, which leases IP addresses out to client devices

Network Time Protocol (NTP) synchronizes clocks so log timestamps agree across systems, which is essential for correlating events during investigations. It should be secured because forged time can hide or misorder activity. Accurate, trusted time is the foundation of usable logs.

A firewall administrator prefers a secure file-transfer protocol that uses a single connection over one port, simplifying firewall rules. Which fits better than FTPS?

• a.TFTP, a lightweight protocol that provides no authentication or encryption whatsoever
• b.SFTP over SSH✓
• c.HTTP, which transmits the requested content without any form of transport encryption
• d.Plain FTP, which negotiates a separate dynamic data port for every file it transfers

SFTP runs over a single SSH connection on one port, so firewall rules are simple, unlike FTPS which uses separate control and dynamic data ports. Both are secure, but SFTP is friendlier to firewalls. Single-connection design is the practical advantage here.

To keep users' DNS lookups private from on-path observers on public Wi-Fi, a browser encrypts queries inside HTTPS. This technique is called:

• a.Split-horizon DNS, which returns different answers to internal versus external users
• b.Recursive resolution, in which a resolver queries the authoritative servers in sequence
• c.DNS over HTTPS✓
• d.A DNS sinkhole, which redirects known malicious domains to a controlled safe address

DNS over HTTPS (DoH) tunnels DNS queries inside HTTPS so on-path observers cannot see or tamper with lookups, improving privacy. DNS over TLS achieves similar protection on a dedicated port. Encrypting the query channel is what defeats passive DNS snooping.

Before a laptop plugged into a conference-room network jack gets access, a switch forces it to authenticate to a RADIUS server. Which standard enforces this port-based control?

• a.IEEE 802.1X✓
• b.WPA3, which is the current security standard used specifically for wireless client access
• c.NAT, which translates private internal addresses into publicly routable ones for internet use
• d.STP, which prevents switching loops by blocking redundant paths in the network topology

IEEE 802.1X provides port-based network access control, requiring devices to authenticate through an authenticator to a RADIUS server before the port passes traffic. It works on both wired and wireless links. Authenticating at the port before granting access is its defining function.

A wireless network requires both the client and the server to present certificates, eliminating passwords entirely for the strongest mutual authentication. Which EAP method is this?

• a.PSK, in which every device is configured with one identical pre-shared passphrase value
• b.EAP-MD5, which offers only a weak one-way password hash with no encryption or mutual proof
• c.EAP-TLS✓
• d.PEAP, which protects an inner authentication method inside a server-side TLS tunnel only

EAP-TLS requires certificates on both the client and the server, providing mutual authentication without passwords, which makes it the strongest common EAP method. Managing client certificates is the operational cost. Mutual certificate authentication is what sets it apart from tunnel-only methods.

A hotel Wi-Fi redirects newly connected guests to a web page requiring them to accept terms before internet access is granted. What is this mechanism?

• a.A pre-shared key that is rotated automatically for each guest on every new connection
• b.A RADIUS federation trust established between the hotel and each guest's home employer
• c.An evil twin access point that impersonates the legitimate hotel network's broadcast name
• d.A captive portal✓

A captive portal intercepts new connections and forces users to a web page to authenticate or accept terms before granting access. It is common on guest and public networks. The forced redirect before access is the identifying behavior.

A remote laptop must filter inbound and outbound connections based on rules even when it is off the corporate network. Which control operates directly on that endpoint?

• a.A load balancer that distributes incoming client requests across a pool of backend servers
• b.A network intrusion prevention system placed inline at the corporate data center edge
• c.A screened subnet that isolates public-facing servers from the internal trusted network
• d.A host-based firewall✓

A host-based firewall runs on the endpoint itself, filtering traffic wherever the device is, including off the corporate network. Network firewalls protect only while traffic passes through them. Traveling with the device is the host firewall's advantage.

An endpoint agent not only detects malicious behavior on the host but actively blocks the offending process in real time. Which best describes it?

• a.A data loss prevention agent that scans outbound files for sensitive or regulated content
• b.A host-based intrusion prevention system✓
• c.A host-based intrusion detection system, which only logs and alerts on suspicious activity
• d.A security information and event management platform that aggregates logs from many hosts

A host-based intrusion prevention system (HIPS) both detects and actively blocks malicious activity on the host, unlike a HIDS that only alerts. The distinction is the ability to stop, not merely observe. Inline prevention on the endpoint is the key trait.

To stop unknown executables from running, an administrator configures endpoints so only explicitly approved applications can launch and everything else is blocked. This is:

• a.Antivirus signature scanning, which matches files against a database of known malware hashes
• b.Blocklisting, which denies only the specific programs already known to be malicious
• c.Application allowlisting✓
• d.Sandboxing, which runs an untrusted program inside an isolated disposable container

Application allowlisting permits only approved programs to run and denies everything else, which stops unknown and zero-day executables by default. Blocklisting is the weaker inverse, blocking only known-bad items. Default-deny for applications is the strength of allowlisting.

A laptop is stolen while powered off, but the thief cannot read any data because the entire drive, including the operating system, was encrypted and unlocks only with the user's key. Which protection was in place?

• a.Full-disk encryption✓
• b.A host-based firewall that filters inbound network connections made to the device
• c.Antivirus software that scans downloaded files for known malicious code signatures
• d.A screen-lock timeout that requires a password after a period of user inactivity only

Full-disk encryption renders the entire drive unreadable without the key, protecting data at rest if a powered-off device is stolen. A screen lock or firewall would not stop someone removing the drive. Encrypting the whole volume is what defeats offline data theft.

To ensure a device loads only firmware and bootloaders signed by trusted keys, blocking bootkits that load before the OS, an administrator enables which UEFI feature?

• a.Full-disk encryption, which protects stored data at rest but not the early boot chain
• b.A host firewall, which filters network traffic only after the operating system has loaded
• c.Application allowlisting, which restricts which programs may run once the OS is running
• d.Secure Boot✓

Secure Boot verifies signatures on firmware and bootloaders so only trusted code runs during startup, blocking bootkits and rootkits that load before the OS. Disk encryption protects data but not the boot chain. Signature checking at boot is Secure Boot's purpose.

A company must enforce passcodes, push required apps, and remotely wipe hundreds of employee smartphones from one console. Which system provides this centralized control?

• a.A virtual private network client that tunnels the phone's traffic back to headquarters
• b.A host-based intrusion detection system installed individually on each mobile phone
• c.Mobile device management✓
• d.A data loss prevention gateway that inspects only the email leaving the organization

Mobile device management (MDM) centrally enforces policies, deploys apps, and can remotely lock or wipe enrolled devices. It gives administrators consistent control over a fleet of phones and tablets. Central lifecycle management is what defines MDM.

On employee-owned phones, a company isolates corporate email and files inside a managed, encrypted workspace separate from personal apps, so only that workspace can be wiped. This approach is:

• a.Geofencing, which disables the device whenever it leaves a defined geographic map region
• b.Containerization✓
• c.Full-disk encryption of the entire personal device, including all of the user's own photos
• d.A pre-shared wireless key that is configured identically on every enrolled employee phone

Containerization separates corporate data into a managed, encrypted workspace on a personal device, allowing selective wipe without touching personal content. This balances BYOD flexibility with corporate control. Isolating work data from personal data is its core benefit.

A logistics app automatically locks certain features whenever a company tablet leaves the warehouse's GPS boundary. Which control uses location this way?

• a.Containerization, which separates managed corporate data from the personal app data
• b.Remote wipe, which erases the device entirely once it is reported as lost or stolen
• c.Full-disk encryption, which protects the stored data if the device is powered down
• d.Geofencing✓

Geofencing defines a virtual geographic boundary and changes device behavior based on whether the device is inside or outside it. Here it disables features off-site to reduce risk. Acting on GPS-defined location is the defining trait of geofencing.

An employee reports their corporate phone lost in a taxi. Which MDM action best prevents data exposure by erasing the device's contents immediately?

• a.Rotating the wireless pre-shared key that is used across the entire office network
• b.Forcing a password change on the user's cloud email account from the admin console
• c.Remote wipe✓
• d.Enabling geofencing so the phone will alert when it next leaves the office boundary

Remote wipe erases the device's data from the management console, preventing exposure if it cannot be recovered. It is the direct response to a lost or stolen managed device. Immediate data erasure is what protects the information.

An MDM policy blocks devices whose operating system protections have been bypassed to gain unrestricted privileges, since such devices can evade security controls. What condition is being detected?

• a.A device with its screen-lock timeout configured to a longer inactivity interval
• b.A device that is simply running an older but still vendor-supported operating system version
• c.A device that is temporarily connected to an untrusted public wireless network
• d.Jailbreaking or rooting✓

Jailbreaking or rooting removes the OS's built-in security restrictions, letting apps run with full privileges and bypass controls. MDM detects and blocks such devices because they can no longer be trusted to enforce policy. The removal of platform protections is the risk being caught.

Thousands of internet-connected cameras were conscripted into a botnet because they all shipped with the same factory username and password. Which hardening step would most directly have prevented this?

• a.Exposing each camera's web interface directly to the internet for convenient remote viewing
• b.Placing every camera onto the same flat network segment for easier centralized management
• c.Changing the default credentials✓
• d.Enabling universal plug and play so the cameras open firewall ports automatically

Default credentials are publicly documented, so leaving them lets attackers log in en masse, which is how large IoT botnets form. Changing them to unique strong passwords closes that trivial entry path. Removing known defaults is the single most impactful step here.

A medical infusion pump runs a real-time embedded OS that the vendor rarely patches and cannot run endpoint agents. Which compensating control best reduces its risk?

• a.Isolating it on a segmented network with strict access controls✓
• b.Installing a full endpoint detection and response agent directly onto the infusion pump
• c.Enabling full-disk encryption on the pump's very limited internal flash storage chip
• d.Requiring users to run frequent authenticated credentialed vulnerability scans against it

Embedded and legacy medical devices often cannot be patched or run agents, so network isolation and tight access control are the practical compensating controls. Segmentation limits what can reach the device and what it can reach. When you cannot fix the device, you constrain its exposure.

An industrial plant connects its operational technology control network to the corporate IT network for reporting, raising concern about attacks crossing over. Which architecture best limits this exposure?

• a.Directly bridging both networks so engineers can freely manage control systems from any desk
• b.An industrial DMZ segmenting OT from IT with controlled data flows✓
• c.Disabling all logging on the control systems to conserve their very limited processing power
• d.Assigning every industrial controller a public IP address for convenient remote vendor access

An industrial DMZ places a controlled buffer between OT and IT, brokering only necessary data flows and preventing direct access to control systems. This contains threats that reach IT from spreading into OT. Segmentation with a mediated boundary is the recommended pattern.

An IoT vendor wants to push firmware updates over the air while ensuring devices reject any update not produced by the vendor. Which mechanism should the device enforce?

• a.Allowing updates from any server on the local network to speed up the deployment
• b.Disabling updates entirely so the firmware can never be tampered with by anyone remotely
• c.Verifying a digital signature on the firmware before installing✓
• d.Accepting any update that is delivered over an encrypted TLS channel automatically

Requiring a valid digital signature ensures the firmware truly came from the vendor and was not altered before the device installs it. An encrypted channel protects transit but does not prove authorship. Signature verification is what authenticates the update's source and integrity.

Beyond ports and IP addresses, a firewall must identify and block specific applications like peer-to-peer file sharing and inspect encrypted traffic. Which firewall type provides this?

• a.A next-generation firewall✓
• b.A basic access control list that is applied statically to a single router interface
• c.A stateful firewall that tracks connection state but is blind to the application identity
• d.A traditional packet-filtering firewall that examines only headers and port numbers

A next-generation firewall adds application awareness, deep packet inspection, and often TLS inspection and integrated intrusion prevention. This lets it identify and control specific apps rather than just ports. Application-layer visibility is what defines an NGFW.

A public web application keeps getting hit with SQL injection and cross-site scripting attempts. Which control specifically inspects HTTP requests to filter these application-layer attacks?

• a.A network intrusion detection sensor that only alerts on suspicious packets without blocking
• b.A web application firewall✓
• c.A load balancer that distributes traffic evenly across several identical backend web servers
• d.A traditional network firewall that filters traffic based on IP addresses and port numbers

A web application firewall inspects HTTP/HTTPS requests and filters application-layer attacks like SQL injection and cross-site scripting. Network firewalls operate lower in the stack and miss these payloads. Understanding web request content is what makes a WAF effective here.

To hide backend web servers and terminate TLS for inbound client requests, an organization places a device in front of its servers that accepts connections on their behalf. Which device is this?

• a.A reverse proxy✓
• b.A jump server that administrators connect through to reach isolated management segments
• c.A network intrusion detection sensor that mirrors traffic for passive inspection only
• d.A forward proxy, which sits in front of internal clients making outbound requests to the web

A reverse proxy sits in front of servers, accepting client connections, hiding backend details, and often terminating TLS and load balancing. A forward proxy, by contrast, fronts clients making outbound requests. Serving on behalf of the servers is what makes it reverse.

Before granting network access, a system checks that a connecting device has current antivirus, required patches, and disk encryption, quarantining it if not. Which technology enforces this?

• a.A load balancer that spreads client sessions evenly across multiple application servers
• b.A screened subnet that hosts internet-facing services away from internal trusted systems
• c.A reverse proxy that terminates inbound TLS connections on behalf of backend web servers
• d.Network access control✓

Network access control (NAC) checks device posture, such as patches, antivirus, and encryption, before admitting a device, quarantining or remediating non-compliant ones. This keeps unhealthy endpoints off the network. Posture assessment at admission is the NAC function.

To stop someone from unplugging a printer and connecting a rogue laptop or hub to a switch port, an administrator limits which and how many MAC addresses a port accepts. This is:

• a.Network address translation, which maps private internal addresses to public routable ones
• b.Quality of service, which prioritizes latency-sensitive traffic such as voice over data
• c.Spanning Tree Protocol, which prevents switching loops by blocking redundant network links
• d.Port security✓

Port security restricts which MAC addresses, and how many, a switch port allows, blocking unauthorized devices or hubs plugged into the port. Violations can shut down or restrict the port. Controlling access at the physical switch port is its purpose.

Without buying more switches, a network team wants to logically separate finance and guest traffic on the same physical infrastructure. Which technology accomplishes this?

• a.Port forwarding, which directs specific external traffic to a chosen internal host and port
• b.VLANs✓
• c.Link aggregation, which bundles multiple physical links together for greater bandwidth
• d.Network address translation, which conserves scarce public IPv4 addresses for many hosts

Virtual LANs (VLANs) logically segment one physical switch infrastructure into separate broadcast domains, isolating traffic like finance from guest. This limits reach and contains issues without extra hardware. Logical separation on shared switches is the VLAN advantage.

So administrators can still reach and recover network devices even when the production data path is down or compromised, they use a physically separate management channel. This is:

• a.Out-of-band management✓
• b.A screened subnet placed between the public internet and the internal user network
• c.In-band management, which shares the very same links that carry production user traffic
• d.A reverse proxy that accepts inbound web requests on behalf of internal application servers

Out-of-band management uses a dedicated, separate channel to reach devices independent of the production network, so admins retain access during outages or attacks. In-band management fails when the data path fails. Independence from the production path is the security benefit.

To block users from reaching known malicious or phishing domains, a company routes all lookups through a service that refuses to resolve blacklisted names. This control is:

• a.A virtual private network that encrypts all of the client traffic back to the headquarters
• b.A load balancer that distributes inbound web requests across several backend servers
• c.Network address translation, which hides many internal hosts behind one public address
• d.DNS filtering✓

DNS filtering, sometimes called protective DNS, refuses to resolve known malicious or unwanted domains, stopping connections before they start. It is a lightweight, broad control against phishing and malware callbacks. Blocking at name resolution is what makes it effective early.

Inbound mail should be scanned for malware, phishing links, and spam before reaching user inboxes, and outbound mail checked for data leakage. Which appliance performs this?

• a.An intrusion detection sensor that passively mirrors and analyzes raw network packets
• b.A web application firewall that inspects HTTP requests bound for public web applications
• c.A network access control server that checks each device's posture before admitting it
• d.A secure email gateway✓

A secure email gateway filters inbound and outbound mail for malware, phishing, spam, and data leakage before messages reach users or leave the organization. It is a focused control at the email boundary. Inspecting mail specifically is what distinguishes it from general network tools.

A wireless upgrade replaces the pre-shared key handshake with one resistant to offline dictionary attacks even when a weak passphrase is used. Which standard introduces this via SAE?

• a.WPA3✓
• b.Open authentication, which provides no encryption of the wireless traffic whatsoever
• c.WPA2-Personal, which still relies on the older four-way pre-shared key handshake method
• d.WEP, the original wireless privacy protocol that has long since been broken and deprecated

WPA3 replaces the PSK handshake with Simultaneous Authentication of Equals (SAE), which resists offline dictionary attacks even against weak passphrases. WPA2's four-way handshake could be captured and cracked offline. SAE's resistance to offline guessing is the major improvement.

Rather than sharing one Wi-Fi passphrase company-wide, an organization wants each employee to authenticate with their own credentials against a RADIUS server. Which wireless mode is required?

• a.WPA2/WPA3-Enterprise with 802.1X✓
• b.WPA2-Personal, in which every device is configured with the exact same pre-shared key
• c.WEP with a shared static key that is entered manually on each connecting client device
• d.An open network with a captive portal that only displays an acceptable use notice to users

Enterprise wireless mode uses 802.1X with a RADIUS server so each user authenticates individually, enabling per-user credentials, accounting, and revocation. Personal mode shares one key among all devices. Individual authentication is the reason Enterprise is required here.

At a coffee shop, an attacker broadcasts a Wi-Fi network using the same name as the legitimate one to lure clients into connecting through them. This attack is a(n):

• a.Jamming attack that overwhelms the wireless spectrum to deny service to all nearby users
• b.WPS brute-force attack that guesses the router's eight-digit setup PIN over and over again
• c.Evil twin✓
• d.Deauthentication flood that forcibly disconnects clients from the real access point repeatedly

An evil twin is a rogue access point that mimics a legitimate network's name to trick clients into connecting, enabling interception of their traffic. It relies on users trusting a familiar SSID. Impersonating the real network is the defining tactic.

A router feature meant to simplify setup lets clients join with an eight-digit PIN, but the PIN is brute-forceable in hours. Security guidance is to disable which feature?

• a.The 5 GHz radio band, which offers more non-overlapping channels than the 2.4 GHz band
• b.MAC address filtering, which restricts which device hardware addresses may connect at all
• c.SSID broadcasting, which advertises the network's name to any nearby wireless clients
• d.Wi-Fi Protected Setup✓

Wi-Fi Protected Setup (WPS) uses an eight-digit PIN that is vulnerable to brute force because it is validated in two halves, so it should be disabled. Its convenience comes at a serious security cost. Turning WPS off removes this easily exploited weakness.

An attacker repeatedly sends spoofed management frames that kick clients off a wireless network, often to force reconnection to a rogue access point. This is a:

• a.Rainbow table attack that precomputes hashes to reverse a captured passphrase quickly
• b.SQL injection attack targeting the router's web-based administrative management interface
• c.Deauthentication attack✓
• d.Cross-site scripting attack that executes script inside the victim's own browser session

A deauthentication attack forges management frames to disconnect wireless clients, which can cause denial of service or push victims onto an evil twin. Protected Management Frames mitigate it. Spoofing disconnect frames is the mechanism of the attack.

Before deploying access points in a new office, engineers map signal strength and interference to place APs and set power levels appropriately. This process is a:

• a.Business impact analysis that ranks critical processes by their tolerance for disruption
• b.Penetration test that attempts to actively exploit vulnerabilities across the network
• c.Wireless site survey✓
• d.Vulnerability scan that enumerates known weaknesses across all networked host systems

A wireless site survey measures signal coverage, interference, and capacity to plan access point placement and power settings. Good surveys prevent dead zones and rogue-AP opportunities from weak coverage. Mapping the RF environment is the purpose of the survey.

An administrator relies on allowing only known hardware addresses onto the Wi-Fi, but an attacker still gets on. Why is MAC filtering weak on its own?

• a.Because it requires every client to complete a certificate-based mutual handshake first
• b.Because it forces all of the devices on the network to share a single static pre-shared key
• c.Because MAC addresses can be sniffed and spoofed by an attacker✓
• d.Because MAC filtering encrypts the wireless traffic with an outdated and easily broken cipher

MAC addresses travel in cleartext and can be captured and spoofed, so an attacker can clone an allowed address to bypass filtering. It provides no real authentication or encryption. Being trivially forgeable is why MAC filtering is only a weak add-on.

A wireless network protects user passwords by wrapping the inner authentication inside a TLS tunnel established with only a server-side certificate. Which EAP method is this?

• a.EAP-TLS, which requires both the client and the server to present valid certificates
• b.PEAP✓
• c.EAP-MD5, which sends only a weak challenge-response with no protective outer tunnel
• d.PSK authentication, in which all clients share one identical static passphrase value

Protected EAP (PEAP) builds a TLS tunnel using only a server certificate and then runs the inner authentication protected inside it. This shields credentials without requiring client certificates. Server-side certificate plus a protected inner method is the PEAP pattern.

A retail store offers customer Wi-Fi but must ensure guests cannot reach point-of-sale systems or each other. Which combination best achieves this?

• a.Placing the guests and the POS terminals together on one shared VLAN for simpler management
• b.Disabling all encryption on the guest network to reduce the processing overhead placed on the access points
• c.A separate guest VLAN with client isolation and firewall rules blocking internal access✓
• d.Publishing the POS network passphrase to guests so that support requests are easier to handle

A separate guest VLAN with client isolation stops guests from reaching each other, and firewall rules block access to internal systems like the POS. This layered segmentation protects cardholder systems from untrusted users. Isolating and restricting guest traffic is the correct design.

To defend against deauthentication and disassociation spoofing, a modern wireless standard cryptographically protects management frames. This feature is:

• a.SSID hiding, which stops the network name from being openly broadcast to nearby clients
• b.Protected Management Frames✓
• c.MAC filtering, which restricts access to a preset list of allowed hardware addresses only
• d.Band steering, which nudges dual-band clients toward the less congested 5 GHz spectrum

Protected Management Frames (802.11w) authenticate and protect management frames so attackers cannot forge deauthentication or disassociation messages. This directly counters common wireless denial-of-service tricks. Cryptographically protecting management frames is the defense.

In a zero-trust data center, an architect enforces security policies between individual workloads so even east-west traffic inside the same subnet is inspected and controlled. This granular approach is:

• a.Microsegmentation✓
• b.A flat network design in which all servers communicate freely without any restrictions
• c.Perimeter security, which relies on a single strong firewall placed only at the network edge
• d.Port forwarding, which exposes specific internal services directly to external clients

Microsegmentation applies fine-grained policies between individual workloads, controlling east-west traffic that traditional perimeter firewalls never see. This limits lateral movement after a breach. Enforcing policy workload-to-workload is the zero-trust idea it implements.

Analysts receive an alert only after the SIEM links a failed VPN login, a privilege change, and a large data transfer from the same account within minutes. Which SIEM capability produced this insight?

• a.Log rotation, which archives and overwrites the oldest log files on a fixed recurring schedule
• b.Retention, which defines how long the collected logs are preserved before being deleted
• c.Compression, which reduces the on-disk storage footprint of the collected log data over time
• d.Correlation of events across multiple sources✓

Correlation links related events from different sources into a single meaningful alert that no individual log would reveal alone. It is what turns raw log volume into actionable detection. Connecting the dots across sources is the core value of a SIEM.

To investigate incidents efficiently, an organization forwards logs from firewalls, servers, and applications to one central collector. What is the main security value of this aggregation?

• a.It automatically encrypts every individual endpoint's local drive against physical theft
• b.It guarantees that no attacker can ever manage to breach the network's outer perimeter
• c.It preserves logs centrally even if an attacker deletes them on a host✓
• d.It replaces the need for any endpoint detection or antivirus software running on the hosts

Centralized log aggregation preserves evidence even when an attacker wipes local logs to cover their tracks, and it enables cross-system correlation. Logs left only on a compromised host are easily destroyed. Central, protected collection is what keeps them trustworthy and available.

Correlating events across systems only works if their log timestamps agree. Which practice ensures accurate cross-system timelines during an investigation?

• a.Storing every log only on the individual device that generated it for the sake of isolation
• b.Rotating logs frequently so that older timestamped entries are quickly discarded from disk
• c.Letting each device keep its own manually set local clock independently and indefinitely
• d.Synchronizing all devices to a common trusted time source✓

Synchronizing devices to a common trusted time source, such as NTP, keeps timestamps consistent so events can be ordered and correlated accurately. Drifting clocks make reconstruction unreliable or impossible. Consistent time is the backbone of any credible timeline.

A new detection rule floods analysts with alerts that turn out to be benign scheduled backups, causing real alerts to be missed. What should the team do?

• a.Escalate every single alert to executive management for individual manual review each time
• b.Ignore every alert produced by that rule permanently without any further verification at all
• c.Disable all logging from the backup servers so that the noisy alerts simply stop appearing
• d.Tune the rule to reduce false positives✓

Tuning the rule to exclude the known benign backup activity reduces false positives so analysts can focus on genuine threats. Disabling logging or blindly ignoring alerts would create blind spots. Refining detection logic preserves visibility while cutting noise.

A platform builds behavioral baselines for each account and flags when a user suddenly accesses systems at 3 a.m. from a new location and downloads gigabytes of data. Which capability is this?

• a.Signature-based antivirus that scans files against a database of already known malware
• b.A stateful firewall that permits return traffic for connections that were already established
• c.User and entity behavior analytics✓
• d.Data loss prevention that blocks specific sensitive keywords in outbound email attachments

User and entity behavior analytics (UEBA) baselines normal behavior and flags anomalies like odd hours, new locations, and abnormal data volumes. It catches account misuse and insider threats that signature tools miss. Deviation from a learned baseline is what triggers it.

Investigators want to see which hosts talked to which, how much, and when across the network over the past month without storing full packet payloads. Which data source fits?

• a.Full packet captures retained for every single conversation on the network for many months
• b.Endpoint antivirus quarantine logs that list the files removed from each individual host
• c.Certificate transparency logs that record the issuance of publicly trusted certificates
• d.NetFlow records✓

NetFlow records connection metadata such as source, destination, volume, and timing without storing payloads, making long retention practical. It answers who talked to whom and how much. Metadata-only capture is why it scales for historical analysis.

To reconstruct exactly what data an attacker exfiltrated, analysts need the actual payload contents of the suspicious session, not just flow summaries. Which tool provides this?

• a.A configuration management database that lists assets and their ownership details only
• b.NetFlow, which records connection metadata but never captures the actual payload contents
• c.A vulnerability scanner that enumerates the missing patches on the affected server host
• d.A full packet capture✓

A full packet capture records complete payloads, letting analysts reconstruct exactly what was transmitted, including exfiltrated content. NetFlow shows that data moved but not what it contained. Payload-level detail is why packet capture is needed here.

A team debates installing software on each server versus polling devices remotely for monitoring. What is a key advantage of the agent-based approach?

• a.It requires absolutely no configuration on any of the monitored endpoints at any time
• b.It works identically on legacy devices that are unable to run any installed software agent
• c.It eliminates all network traffic between the monitored hosts and the central collector
• d.It can collect richer, real-time host data even when the network path is limited✓

Agents run on the host and can gather deep, real-time telemetry and continue collecting even when connectivity is intermittent. Agentless polling is lighter to deploy but sees less and depends on the network. Richer host visibility is the agent trade-off.

When a phishing email is reported, a system automatically extracts the URLs, checks them against threat intelligence, quarantines matching messages, and opens a ticket. Which platform orchestrates this?

• a.SOAR✓
• b.A network load balancer that distributes inbound client requests across backend web servers
• c.A traditional antivirus product that scans files against a database of known malware signatures
• d.A certificate authority that issues and signs the digital certificates used by internal hosts

Security orchestration, automation, and response (SOAR) runs playbooks that chain tools together to enrich, decide, and act automatically. Here it triages phishing end to end without manual steps. Coordinating tools through playbooks is the SOAR function.

Leadership asks why automating routine response steps with playbooks is worthwhile. Which is the strongest security justification?

• a.It responds faster and more consistently, reducing human error and dwell time✓
• b.Automation guarantees that the organization will never again experience a security breach of any kind
• c.Automation permanently removes any need for human analysts to remain on the security team at all going forward
• d.It makes all of the collected security logs entirely unnecessary because responses are now automatic

Automation executes response steps quickly and identically every time, reducing human error and shrinking the time attackers dwell. It augments analysts rather than replacing them or eliminating logs. Speed and consistency, cutting dwell time, is the real benefit.

A cloud team defines servers and firewall rules in version-controlled templates so every deployment is identical and reviewable. Which security benefit does infrastructure as code most directly provide?

• a.It guarantees that the deployed systems will never need to be patched after being provisioned
• b.It removes the requirement to monitor or log any activity occurring on the deployed resources
• c.It enforces consistent, auditable configurations and reduces configuration drift✓
• d.It encrypts all of the data at rest automatically without requiring any key management effort

Infrastructure as code produces repeatable, reviewable deployments so environments are consistent and drift is reduced, and changes are tracked in version control. Misconfigurations can be caught in review before deployment. Consistency and auditability are its core security value.

To stop developers from accidentally creating a publicly readable storage bucket, a cloud platform automatically blocks or flags such configurations at deployment. This automated preventive control is a:

• a.A honeypot deployed specifically to attract attackers away from the real production storage
• b.A disaster recovery hot site kept ready to assume operations after a major regional outage
• c.Guardrail (policy-as-code)✓
• d.A security awareness training module that is delivered to the developers once every year

A guardrail, often implemented as policy-as-code, automatically prevents or flags risky configurations like public buckets before they take effect. It bakes security policy into the deployment pipeline. Automated enforcement of policy at deploy time is what defines it.

A build pipeline automatically scans source code for vulnerabilities before each release is deployed. Testing the code without executing it, by examining the source directly, is called:

• a.Dynamic application security testing, which probes the running application while it executes
• b.Penetration testing performed manually by an external red team roughly once per year
• c.Static application security testing✓
• d.Fuzzing, which feeds malformed random inputs to a running program to make it crash

Static application security testing (SAST) analyzes source code without running it, catching flaws early in development. Dynamic testing, by contrast, requires a running application. Examining code at rest is what makes SAST static.

A security tool interacts with a deployed web application, sending crafted inputs to observe how the live system responds and reveal runtime flaws. This testing method is:

• a.Static analysis, which reads the raw source code without ever running the program itself
• b.A software bill of materials, which lists every third-party component and its exact version
• c.A tabletop exercise, in which responders verbally walk through a hypothetical incident
• d.Dynamic application security testing✓

Dynamic application security testing (DAST) exercises a running application with crafted inputs to find runtime and configuration flaws that only appear during execution. It complements static analysis, which sees code but not runtime behavior. Testing the live app is the DAST approach.

After a widely-used logging library was found vulnerable, security teams scrambled to learn where it was embedded. Which artifact would have let them instantly identify affected software?

• a.A business impact analysis that ranks critical processes by the cost of their downtime
• b.A data retention schedule that specifies how long each type of record must be kept
• c.A certificate revocation list of the public key infrastructure entries no longer trusted
• d.A software bill of materials✓

A software bill of materials (SBOM) inventories every component in software, so teams can instantly find where a vulnerable library is used. Without it, locating affected systems is slow and error-prone. Component transparency is exactly what an SBOM provides.

During a breach, confusion arises over who declares an incident, who talks to regulators, and who leads technical containment. Which document should have defined these responsibilities in advance?

• a.An incident response plan✓
• b.A memorandum of understanding outlining an informal partnership between two organizations
• c.A service level agreement defining the uptime commitments made to external customers
• d.An acceptable use policy that specifies the permitted employee use of company systems

An incident response plan defines roles, responsibilities, and procedures before an incident, so responders act decisively rather than improvising. Predefined ownership of decisions and communications prevents chaos. Preparing these roles in advance is the plan's purpose.

Regulations require notifying affected individuals within a set window after a data breach is confirmed. Which part of incident preparation ensures this happens correctly and on time?

• a.The disaster recovery hot site that is kept synchronized for the rapid failover of systems
• b.The network segmentation design that isolates cardholder data from other internal systems
• c.The vulnerability scanning schedule that runs authenticated scans once every calendar quarter
• d.A predefined communication and notification plan✓

A communication and notification plan predefines who must be told, how, and by when, so legal and regulatory deadlines are met during the stress of an incident. Improvising notifications risks missed deadlines and penalties. Planned communications ensure timely, correct disclosure.

Two weeks after resolving a ransomware incident, the team meets to document what worked, what failed, and how to prevent recurrence. Which incident response phase is this?

• a.Eradication, in which the malware and any attacker footholds are completely removed
• b.Lessons learned✓
• c.Preparation, in which tools, training, and playbooks are readied before incidents occur
• d.Containment, in which the affected systems are isolated to halt the further spread of harm

The lessons learned phase reviews the incident after recovery to improve future response and close the gaps that were exposed. It feeds back into preparation, making the process cyclical. Turning experience into improvement is the point of this phase.

On discovering an actively compromised workstation still communicating with a command-and-control server, the responder's immediate priority is to:

• a.Notify every customer publicly before the actual scope of the compromise is even confirmed
• b.Immediately rebuild the workstation from scratch before capturing any forensic evidence
• c.Wait and passively observe the attacker for several more weeks before taking any action
• d.Isolate the host from the network to stop the attacker's communication✓

Containment through isolation immediately cuts the attacker's command-and-control channel and stops further damage or spread. Rebuilding first would destroy evidence, and public notice before scope is known is premature. Halting active harm is the first responder priority.

After recovering from repeated incidents caused by the same unpatched service, management insists the team identify and fix the underlying reason, not just the symptoms. This analysis is called:

• a.Chain of custody, which documents each person who handled a given piece of evidence
• b.Root cause analysis✓
• c.A penetration test that simulates a real attacker to validate exploitable weaknesses
• d.A business impact analysis that prioritizes processes by the cost of their disruption

Root cause analysis finds the underlying reason an incident occurred so the fix prevents recurrence rather than treating symptoms. Repeated incidents signal an unaddressed root cause. Eliminating the source is what distinguishes it from a quick patch.

A threat report lists specific malicious file hashes, IP addresses, and domains associated with an active campaign so defenders can search their environment. These artifacts are called:

• a.Recovery point objectives that specify the maximum tolerable amount of data loss allowed
• b.Indicators of compromise✓
• c.Rules of engagement that set the agreed scope and limits of an authorized penetration test
• d.Service level objectives that define measurable targets for system availability levels

Indicators of compromise (IOCs) are observable artifacts like hashes, IPs, and domains tied to malicious activity, used to hunt for and detect intrusions. Defenders match them against logs and endpoints. Concrete evidence of specific threats is what IOCs provide.

Rather than waiting for alerts, analysts proactively form a hypothesis about how an attacker might operate and search logs for evidence of it. This proactive practice is:

• a.Vulnerability scanning, which enumerates known missing patches automatically on systems
• b.Signature-based detection, which alerts only on previously catalogued attack patterns
• c.Threat hunting✓
• d.Penetration testing, which actively exploits weaknesses to prove real-world exploitability

Threat hunting is proactive, hypothesis-driven searching for adversaries that automated tools have not flagged. It assumes a breach may already exist and looks for subtle evidence. Actively seeking hidden threats is what separates it from passive alerting.

A SOC maps observed adversary behaviors to a standardized knowledge base of tactics and techniques to understand its coverage gaps. Which framework are they using?

• a.MITRE ATT&CK✓
• b.PCI DSS, a standard that governs the secure handling of payment cardholder data specifically
• c.OWASP Top Ten, a ranked list of the most critical web application security risks to address
• d.The NIST Cybersecurity Framework, which organizes programs into five high-level functions

MITRE ATT&CK is a knowledge base of real-world adversary tactics and techniques used to map detections and find coverage gaps. It gives teams a common language for attacker behavior. Behavior-based mapping is what makes it useful for measuring defensive coverage.

An analyst gathers freely available information about a threat actor from public reports, forums, and social media to enrich an investigation. This intelligence source is:

• a.Open-source intelligence✓
• b.Classified government intelligence shared solely through cleared and secured channels
• c.Internal application logs generated exclusively by the organization's own hosted systems
• d.A proprietary paid feed available only under a restrictive commercial licensing agreement

Open-source intelligence (OSINT) is gathered from publicly available sources such as reports, forums, and social media. It is low-cost and broad but must be validated for reliability. Sourcing from public information is what makes it OSINT.

Anticipating litigation, counsel directs IT to suspend the routine deletion of certain emails and files so potential evidence is preserved. This directive is a:

• a.Service level agreement that specifies measurable performance commitments to clients
• b.Data retention schedule that automatically purges records after a fixed period of time
• c.Non-disclosure agreement that binds parties to keep the shared information confidential
• d.Legal hold✓

A legal hold suspends normal data destruction to preserve information that may be relevant to litigation or investigation. Deleting data under hold can lead to spoliation penalties. Preserving potential evidence against routine deletion is its purpose.

To ensure any analyst handles a malware alert the same proven way, the SOC documents step-by-step response procedures for that specific scenario. This document is a:

• a.An incident response playbook✓
• b.A business continuity plan describing how the whole organization keeps operating in a crisis
• c.A memorandum of understanding that formalizes an informal agreement between two parties
• d.A risk register cataloguing identified risks along with their owners and chosen treatments

An incident response playbook gives step-by-step procedures for a specific scenario so responses are consistent and repeatable regardless of who responds. It reduces improvisation under pressure. Scenario-specific, repeatable steps are what define a playbook.

During evidence collection on a live system, a forensic analyst captures the contents of RAM and running network connections before imaging the hard drive. Which principle drives this sequence?

• a.Chain of custody, which documents who handled each item of evidence and when it moved
• b.Separation of duties, which requires two people to complete one sensitive transaction
• c.Order of volatility✓
• d.The recovery time objective, which defines how quickly a service must be fully restored

Order of volatility dictates collecting the most transient evidence first, such as memory and active connections, before more persistent data like disks. Volatile data disappears when power or state changes. Preserving fleeting evidence first is the principle at work.

Before analyzing a seized hard drive, an examiner connects it through a device that allows reading but physically prevents any writes to the original media. This device is a:

• a.A honeypot decoy system deployed to attract and safely observe attacker behavior in a lab
• b.A write blocker✓
• c.A hardware security module that securely generates and stores cryptographic keys in hardware
• d.A load balancer that distributes incoming client requests across several backend servers

A write blocker permits reading the original evidence media while preventing any writes, preserving its integrity so findings remain admissible. Any modification could taint the evidence and the investigation. Read-only access to the original is exactly what it guarantees.

Rather than copying visible files, a forensic tool creates an exact bit-for-bit duplicate of an entire drive, including deleted-file remnants and slack space. This copy is a:

• a.A differential backup that stores the changes made since the last full backup was taken
• b.A forensic image✓
• c.A snapshot that preserves the state of a virtual machine at a single point in time only
• d.A logical backup that captures only the currently visible files and their folder structure

A forensic image is a bit-for-bit copy capturing everything on the drive, including deleted data and slack space that ordinary backups omit. Analysts work from the image to protect the original. Complete, exact duplication is what makes it forensically sound.

Investigators recover a photo and examine its embedded creation time, GPS coordinates, and device model to establish where and when it originated. This embedded data is called:

• a.A digital signature applied by the camera's manufacturer to prove its authenticity
• b.Steganographic content that was deliberately concealed inside the pixels of the image
• c.A cryptographic hash value that is computed to verify the file's overall integrity later
• d.Metadata✓

Metadata is data about the file, such as timestamps, GPS coordinates, and device details, which can be crucial evidence. It reveals context the visible content does not. Extracting and interpreting embedded metadata is a standard forensic technique.

To understand an attack's sequence, an analyst combines timestamps from firewall, authentication, and endpoint logs into a single chronological reconstruction. Building this is called creating a:

• a.A business impact analysis that measures the cost of disrupting each critical business process
• b.A penetration testing report describing the exploited weaknesses and their recommended fixes
• c.A forensic timeline✓
• d.A software bill of materials that enumerates every component contained within an application

A forensic timeline merges timestamped events from many sources into one chronology, revealing the attacker's sequence of actions. It depends on synchronized clocks to be accurate. Ordering events across systems is what the timeline delivers.

A defense attorney challenges digital evidence, arguing it may have been altered after collection. Which combination best supports its admissibility in court?

• a.Storing the evidence on a shared drive that is freely accessible to the whole response team
• b.Analyzing the original drive directly and relying on the analyst's memory of the exact steps
• c.Deleting the intermediate copies quickly to avoid confusion over which copy is authoritative
• d.An unbroken chain of custody plus matching hashes of the original and the image✓

An unbroken chain of custody documents every handler, and matching hashes prove the image is identical to the original and unaltered. Together they demonstrate integrity for the court. Documented handling plus verifiable integrity is what supports admissibility.

Before signing with a cloud vendor, a company insists on contract language permitting it to review the vendor's security controls periodically. This provision is a:

• a.Recovery point objective that specifies the maximum acceptable amount of lost data allowed
• b.Memorandum of understanding describing a broad, non-binding cooperative relationship
• c.Right-to-audit clause✓
• d.Service level agreement that defines measurable uptime and response time commitments only

A right-to-audit clause gives the customer the contractual ability to assess a vendor's security controls, which is vital when outsourcing sensitive functions. Without it, the customer cannot verify the vendor's claims. Securing that inspection right is the clause's purpose.

A vulnerability scan run with valid login credentials on target hosts finds far more issues than one run without. Why does the credentialed scan reveal more?

• a.Because it only checks the network perimeter and deliberately ignores internal host details
• b.Because it actively exploits each weakness it finds in order to confirm that it is realistic
• c.Because it runs considerably faster and therefore has enough time to test far more systems across the entire network
• d.Because it can inspect installed software, patches, and configurations from inside✓

A credentialed scan logs in and inspects installed software, patch levels, and configurations from the inside, revealing far more than an external view. Non-credentialed scans see only what is exposed on the network. Authenticated inside access is why it finds more.

A scan returns hundreds of findings, so the team prioritizes remediation using a standardized 0-10 severity score reflecting exploitability and impact. This scoring system is:

• a.CVSS✓
• b.CVE, which assigns a unique identifier to each publicly disclosed software vulnerability
• c.OSINT, which is intelligence gathered from publicly and freely available open sources
• d.SIEM, which aggregates and correlates security event logs collected from many sources

The Common Vulnerability Scoring System (CVSS) rates severity on a 0-10 scale from factors like exploitability and impact, helping teams prioritize. A CVE only names a vulnerability; CVSS scores its seriousness. A standardized severity number is what CVSS contributes.

When discussing a specific flaw, engineers reference a standardized identifier assigned to each publicly known vulnerability so everyone means the same issue. This identifier is a:

• a.A CVE✓
• b.A CVSS base score expressing the vulnerability's severity on a standardized numeric scale
• c.A false positive, meaning a scanner finding that turns out not to be a real issue at all
• d.An indicator of compromise, such as a malicious file hash or a known suspicious domain

A Common Vulnerabilities and Exposures (CVE) identifier gives each publicly known vulnerability a unique reference so tools and teams communicate unambiguously. It names the flaw, while CVSS scores its severity. A shared, unique name is what a CVE provides.

A scanner reports a critical vulnerability, but manual testing shows the affected feature is not even installed. Before spending effort patching, the analyst should:

• a.Immediately schedule emergency downtime and patch every single server across all of production
• b.Disable the vulnerability scanner permanently so that it stops generating any further reports
• c.Validate the finding to confirm whether it is a false positive✓
• d.Report the finding to executives as a confirmed breach requiring immediate customer notification

Validating a finding confirms whether it is real or a false positive before resources are spent remediating. Scanners can misreport based on version banners or inapplicable checks. Verifying before acting prevents wasted effort and false alarms.

A legacy application cannot be patched for a known vulnerability without breaking it, so the team adds strict network filtering and monitoring around it instead. This alternative is a:

• a.A compensating control✓
• b.A residual risk, which is simply whatever risk remains after all controls have been applied
• c.An acceptable use policy that governs how employees may use the organization's systems
• d.A false positive, since the reported vulnerability does not actually affect anything at all

A compensating control provides protection by alternative means when the primary fix, such as a patch, cannot be applied. Filtering and monitoring reduce the risk around the unpatched app. Substituting an equivalent safeguard is the essence of a compensating control.

A client hires testers and gives them no internal knowledge, network diagrams, or credentials, forcing them to discover everything as an outside attacker would. This engagement is:

• a.A white-box test, in which the testers are given full internal documentation and access
• b.A black-box (unknown environment) test✓
• c.A tabletop exercise, in which responders verbally discuss a hypothetical incident scenario
• d.A credentialed vulnerability scan run using valid login accounts on each of the target hosts

In a black-box or unknown-environment test, testers receive no inside information and must discover the environment like a real external attacker. This realistically simulates an outsider but takes longer. Zero prior knowledge is what defines the black-box approach.

A company invites independent researchers to find and report vulnerabilities in its products in exchange for rewards, under defined rules. This program is a:

• a.A penetration test scoped and performed by a single contracted external assessment firm
• b.A red team exercise conducted internally by the organization's own dedicated security staff
• c.A tabletop exercise walking key stakeholders through a hypothetical incident scenario together
• d.A bug bounty program✓

A bug bounty program crowdsources vulnerability discovery from independent researchers who are rewarded for valid, responsibly disclosed findings. It scales testing beyond a single firm under clear rules. Paying external researchers for reported flaws is what defines it.

An organization wants to automate checking systems against security benchmarks using standardized, machine-readable content. Which protocol suite enables this automation?

• a.NetFlow, which exports summaries of network conversations for later traffic analysis
• b.SCAP✓
• c.Syslog, a standard for forwarding event messages to a central logging server for storage
• d.SNMP, which is primarily used to poll and configure network devices across the network

The Security Content Automation Protocol (SCAP) provides standardized, machine-readable content so tools can automatically assess systems against benchmarks and report compliance. This makes configuration and vulnerability checks repeatable and consistent. Automating standardized assessment is SCAP's role.

To harden new servers consistently, an admin applies a widely-recognized set of vendor-neutral configuration recommendations. These published hardening standards are known as:

• a.A certificate revocation list that enumerates certificates which should no longer be trusted
• b.CIS Benchmarks✓
• c.A recovery time objective that defines how quickly a disrupted service must be restored
• d.A memorandum of understanding describing a cooperative arrangement between two parties

CIS Benchmarks are consensus-based, vendor-neutral configuration guides that provide consistent secure baselines for operating systems and applications. Applying them reduces misconfiguration across a fleet. Recognized, repeatable hardening guidance is what they offer.

Monitoring flags that a production server's settings no longer match the approved secure template, indicating unauthorized changes over time. This deviation is called:

• a.A denial-of-service condition caused by exhausting the server's finite processing resources
• b.Configuration drift✓
• c.A zero-day vulnerability for which the vendor has not yet released any patch or fix at all
• d.A false positive, meaning the monitoring tool reported an issue that is not actually real

Configuration drift is the gradual divergence of a system from its approved baseline due to ad hoc changes over time. It reintroduces risk and inconsistency that hardening removed. Detecting and correcting drift keeps systems aligned to their secure template.

In a Windows domain, administrators enforce password rules, disable removable storage, and set firewall settings on thousands of machines from one place. Which mechanism applies these centrally?

• a.A host-based intrusion detection system installed separately on each individual workstation
• b.A jump server that administrators connect through to reach sensitive network zones securely
• c.A hardware security module that stores cryptographic keys in tamper-resistant hardware
• d.Group Policy✓

Group Policy centrally enforces security settings across all domain-joined machines from a single point, ensuring consistent hardening at scale. Managing thousands of endpoints individually would be error-prone. Central, consistent policy enforcement is what Group Policy delivers.

A newly deployed web server is found listening on Telnet, FTP, and several other unused ports. Which hardening action most reduces its attack surface?

• a.Disabling the unnecessary services and closing their ports✓
• b.Installing additional monitoring agents while leaving all of the open ports still running
• c.Adding more RAM and CPU so the server can comfortably handle the extra listening services
• d.Assigning the server a public IP address so that administrators can reach it remotely

Disabling unneeded services and closing their ports removes entry points, directly shrinking the attack surface. Every running service is a potential vulnerability to exploit. Least functionality, running only what is needed, is the core hardening principle here.

A penetration tester gains admin access to a network switch simply by trying the manufacturer's documented username and password. Which hardening step was skipped?

• a.Scheduling a recurring credentialed vulnerability scan against the switch every month
• b.Changing the default administrative credentials✓
• c.Enabling full-disk encryption on the switch's internal configuration storage memory
• d.Placing the switch behind a web application firewall to inspect inbound HTTP requests

Default credentials are publicly documented, so failing to change them leaves a trivial path to full control. Changing them to strong, unique values is a basic hardening step. Removing known factory logins closes this obvious entry point.

To balance security with stability, an organization tests vendor updates and deploys them on a predictable monthly schedule, with emergency out-of-band patches for critical flaws. This disciplined approach is:

• a.Never patching the systems at all in order to avoid any risk of an update breaking them
• b.A structured patch management cadence✓
• c.Relying solely on antivirus signatures instead of ever updating the underlying software
• d.Applying every single update instantly in production the moment it is released, untested

A structured patch management cadence tests and deploys updates on a predictable schedule while allowing emergency patches for critical issues. This balances security with operational stability. Disciplined, tested, scheduled patching is the recommended practice.

A security tool automatically detonates suspicious email attachments in an isolated disposable environment to observe their behavior before delivery. This technique is:

• a.Sandboxing✓
• b.Full-disk encryption, which protects stored data on a device only while it is powered off
• c.Load balancing, which spreads inbound client requests evenly across multiple servers
• d.Signature matching, which only recognizes malware that is already catalogued in a database

Sandboxing runs suspicious files in an isolated, disposable environment to observe behavior without risking real systems, catching threats signatures miss. Malicious actions reveal themselves safely inside the sandbox. Behavioral analysis in isolation is what defines the technique.

Reviewing authentication logs, an analyst notices hundreds of failed logins for many accounts from one IP, followed by a single success. What does this pattern most likely indicate?

• a.A misconfigured time server causing the log timestamps to appear out of sequence
• b.A password-spraying or brute-force attack that ultimately succeeded✓
• c.A scheduled backup job authenticating with its own valid dedicated service account
• d.A normal user who simply forgot and slowly re-entered their own correct password once

Many failures across accounts from one source followed by a success is the signature of password spraying or brute forcing that eventually worked. Normal users do not generate hundreds of failures across many accounts. Recognizing this pattern enables early detection of credential attacks.

A compliance mandate requires that security logs be kept for at least one year for potential investigations. Which policy governs how long logs are stored before deletion?

• a.An acceptable use policy defining the permitted employee use of organizational systems
• b.A recovery time objective specifying how fast a service must be restored after an outage
• c.A service level agreement listing the measurable performance guarantees made to customers
• d.A log retention policy✓

A log retention policy specifies how long logs are kept before deletion, balancing investigative and compliance needs against storage cost. Retaining logs too briefly can destroy evidence needed later. Defining storage duration is exactly what this policy governs.

During a risk workshop, someone confuses terms. A hurricane is the potential danger, an unbolted roof is the weakness, and the chance of damage combining both is the:

• a.The control, meaning the safeguard put in place to reduce the likelihood or impact of harm
• b.Risk✓
• c.The vulnerability, meaning the specific weakness that a hazard is able to take advantage of
• d.The threat, meaning the potential danger or hazardous event that could conceivably occur

Risk is the likelihood and impact of a threat exploiting a vulnerability, combining the two. The hurricane is the threat and the unbolted roof is the vulnerability. Distinguishing these terms is fundamental to accurate risk assessment.

By uninstalling unused software, closing ports, and disabling default accounts, an administrator shrinks the number of ways an attacker could get in. This overall reduction is described as minimizing the:

• a.The residual risk that unavoidably remains after all reasonable controls have been applied
• b.The recovery point objective, meaning the maximum tolerable amount of data that can be lost
• c.Attack surface✓
• d.The false positive rate, meaning benign findings that are mistakenly reported as real threats

The attack surface is the sum of all points where an attacker could attempt entry, and hardening reduces it by removing services, ports, and accounts. A smaller attack surface means fewer opportunities to exploit. Minimizing exposure is the goal of hardening.

A vendor integrates endpoint, email, network, and cloud telemetry into one platform that correlates detections across all of them for unified response. This extended approach is called:

• a.DLP, which inspects data in motion and at rest to prevent its unauthorized exfiltration
• b.SIEM, which chiefly aggregates and correlates log data forwarded from many disparate sources
• c.EDR, which focuses solely on collecting and responding to endpoint host telemetry alone
• d.XDR✓

Extended detection and response (XDR) unifies telemetry from endpoints, email, network, and cloud, correlating across them for broader detection and coordinated response. EDR is limited to endpoints. Cross-domain correlation and response is what distinguishes XDR.

Defenders plant fake credentials and decoy files that no legitimate user should ever touch, so any access to them immediately signals an intruder. These tripwires are called:

• a.Compensating controls added when a system cannot be patched against a known vulnerability
• b.Honeytokens✓
• c.False positives generated when a detection rule mistakes benign activity for a real attack
• d.Indicators of compromise supplied by an external commercial threat intelligence feed provider

Honeytokens are decoy credentials or files that legitimate users never use, so any interaction is a high-confidence sign of intrusion. They generate very low false positives because there is no legitimate reason to touch them. Serving as tripwires for attackers is their purpose.

The SOC receives an alert that an employee attempted to upload a spreadsheet full of Social Security numbers to a personal cloud drive, and the transfer was blocked. Which control generated this?

• a.A network intrusion prevention system inspecting inbound packets for known exploit patterns
• b.Data loss prevention✓
• c.A security orchestration platform that fully automates repetitive analyst response workflows
• d.A web application firewall that filters malicious HTTP requests to public web applications

Data loss prevention inspects content and blocks sensitive data, like Social Security numbers, from leaving through channels such as personal cloud uploads. It enforces policy on data in motion. Recognizing and stopping sensitive data exfiltration is the DLP function.

A team continuously scans their cloud accounts for misconfigurations like open storage buckets, over-permissive roles, and disabled logging, alerting on drift from policy. This tooling is:

• a.A hardware security module that generates and safeguards cryptographic keys in hardware
• b.Cloud security posture management✓
• c.A traditional network firewall that filters traffic by its source and destination addresses
• d.An intrusion detection sensor that passively mirrors and analyzes on-premises network traffic

Cloud security posture management (CSPM) continuously assesses cloud configurations against best practices, flagging risky settings like public buckets or excessive permissions. Misconfiguration is a leading cause of cloud breaches. Ongoing configuration assurance is what CSPM provides.

Before allowing container images into production, a pipeline scans them for vulnerable packages and embedded secrets and blocks images that fail policy. This practice most directly addresses risk in the:

• a.Container image supply chain✓
• b.Email authentication framework that verifies the sending domain of inbound mail messages
• c.Wireless network authentication process used by employees who connect their laptops to Wi-Fi
• d.Physical access control system governing entry into the on-premises corporate data center

Scanning images for vulnerable components and leaked secrets before deployment secures the container supply chain, where a bad base image can spread risk widely. Blocking non-compliant images prevents known flaws from reaching production. Vetting what enters the pipeline is the point.

After deploying automated playbooks, a SOC reports the average time from alert to containment dropped from hours to minutes. Which operational metric improved?

• a.The recovery point objective, which specifies the maximum acceptable data-loss window allowed
• b.The false acceptance rate, which measures how often a biometric wrongly admits an impostor
• c.The annualized loss expectancy, which estimates the expected yearly cost of a given risk
• d.Mean time to respond✓

Mean time to respond measures how quickly the team acts on and contains an incident after detection, and automation drives it down. Faster response limits attacker dwell time and damage. Reducing this metric is a core goal of security automation.

Facing more alerts than staff can handle, a SOC manager wants analysts to work the most dangerous alerts first. Which practice organizes work this way?

• a.Forwarding every single alert to executives so leadership can decide what to examine first
• b.Risk-based alert triage and prioritization✓
• c.Investigating alerts strictly in the random order in which they happen to reach the console
• d.Automatically closing any alert that has not been reviewed within the first five minutes

Risk-based triage ranks alerts by potential impact and likelihood so limited analyst time goes to the most serious threats first. Working in arrival order or auto-closing risks missing critical events. Prioritizing by risk is what makes finite resources effective.

When an alert fires, the SOC platform automatically adds context such as the source IP's reputation, geolocation, and past activity to help analysts decide faster. This automated context-adding is called:

• a.Segmentation, which divides a network into zones to limit how far an attack can spread
• b.Enrichment✓
• c.Log rotation, which archives older log files and reclaims their storage space on the disk
• d.Sandboxing, which executes a suspicious file inside an isolated and disposable environment

Enrichment automatically augments an alert with context like reputation, geolocation, and history so analysts can judge it quickly and accurately. It reduces manual lookups and speeds decisions. Adding decision-supporting context to raw alerts is what enrichment does.

Rather than scanning once a year, a mature program continuously discovers assets, scans them, prioritizes findings, remediates, and verifies in an ongoing cycle. This is best described as:

• a.A one-time penetration test performed by an outside firm just before a new product launches
• b.An annual tabletop exercise in which responders discuss a single hypothetical breach scenario
• c.Continuous vulnerability management✓
• d.A single baseline configuration applied to systems only at their initial deployment time

Continuous vulnerability management is an ongoing cycle of discovery, assessment, prioritization, remediation, and verification rather than a periodic event. It keeps pace with new assets and new vulnerabilities. Treating it as a continuous loop is what makes the program mature.

An organization once deployed a patch that crashed a critical application fleet-wide. To prevent recurrence, patches should first be:

• a.Installed only on the systems that are already failing and are going to be rebuilt anyway
• b.Applied directly to every production system simultaneously in order to save time and effort
• c.Tested in a non-production environment before broad deployment✓
• d.Skipped entirely so that no future update can ever again disrupt the critical application

Testing patches in a non-production environment first catches breaking changes before they hit critical systems fleet-wide. Skipping patches leaves known vulnerabilities open, which is worse. Validating stability before broad rollout balances security and availability.

An analyst writes a script that queries the firewall's API to automatically add malicious IPs from a threat feed to a blocklist every hour. The primary benefit of this automation is:

• a.Faster, consistent blocking without manual effort✓
• b.It guarantees that the organization can never again be targeted by any network-based attack
• c.It removes the requirement to keep any logs of the blocking actions that are being performed
• d.It eliminates the need to ever review or tune the threat feed that supplies these addresses

Automating blocklist updates via the firewall API applies protection faster and more consistently than manual entry, reducing the window of exposure. It still requires logging and periodic tuning of the feed. Speed and consistency without manual toil is the real benefit.

Before issuing laptops, IT applies a standard secure image with encryption enabled, unneeded software removed, and logging turned on. Applying this consistent secure starting point is called establishing a:

• a.A recovery time objective that defines how quickly a disrupted service must be restored
• b.Security baseline✓
• c.A memorandum of understanding describing an informal partnership between two organizations
• d.A honeypot decoy that is intended to lure attackers away from the real production systems

A security baseline is a standard secure configuration applied consistently so every system starts from a known hardened state. It prevents ad hoc, insecure builds and simplifies auditing. A repeatable secure starting point is what a baseline provides.

In endpoint logs, an analyst sees a standard user account suddenly added to the local administrators group minutes after a suspicious download. This sequence most likely represents:

• a.A misconfigured clock causing the log entries to appear in the wrong chronological order
• b.A routine software update that legitimately required elevated rights during its installation
• c.Privilege escalation following an initial compromise✓
• d.A scheduled backup service that authenticates using its own dedicated service account only

A normal user being elevated to local admin right after a suspicious download is a classic sign of privilege escalation after initial compromise. Attackers seek higher rights to expand control. Correlating the download with the elevation reveals the escalation.

Hunting through network logs, an analyst finds a host making small, regular connections to an unfamiliar external server at precise intervals around the clock. This pattern most likely indicates:

• a.A legitimate software update check that the vendor schedules only once every single month
• b.Command-and-control beaconing✓
• c.A user manually browsing to a popular website repeatedly throughout their normal workday
• d.A backup job transferring large volumes of data to an approved offsite storage location

Regular, small, precisely timed connections to an unknown server are characteristic of malware beaconing to a command-and-control host. The machine-like periodicity distinguishes it from human browsing. Spotting this rhythm is a staple of threat hunting.

After one workstation was compromised, logs show that account then authenticating to dozens of other machines it never normally touches. This activity is characteristic of:

• a.Lateral movement✓
• b.Normal single sign-on granting the user seamless access to their usual set of applications
• c.A vulnerability scanner performing authorized credentialed checks across the environment
• d.A load balancer distributing user sessions across a pool of identical backend servers

Lateral movement is an attacker using a compromised account to reach additional systems it normally would not touch, expanding their foothold. A sudden spread of authentications from one account is the tell. Detecting this early limits how far an intrusion spreads.

An analyst notices unusually large volumes of DNS queries to a single domain, with data encoded in the subdomain names. This technique for sneaking data out is called:

• a.A normal recursive resolution process in which a resolver contacts the authoritative servers
• b.DNS tunneling exfiltration✓
• c.A cache-poisoning attack that inserts forged records into a resolver's stored set of answers
• d.A distributed denial-of-service attack that overwhelms the DNS server with heavy query traffic

DNS tunneling hides data inside DNS queries, often encoded in subdomain labels, to smuggle information past controls that permit DNS. High query volume to one domain with odd subdomains is the signature. Recognizing DNS as an exfiltration channel is the key insight.

After capturing a forensic image, the examiner stores it on protected media, restricts access, and records every handoff. The main reason for these precautions is to:

• a.Avoid the need to ever compute or compare any cryptographic hashes of the acquired image
• b.Reduce the amount of disk storage that the collected evidence image will ultimately consume
• c.Speed up the analysis by allowing many analysts to modify the same image at the same time
• d.Preserve evidence integrity and admissibility✓

Restricting access and documenting handoffs preserve the evidence's integrity and its admissibility in legal proceedings. Any unlogged access or change could let opposing counsel challenge it. Protecting integrity and the chain of custody is the reason for these controls.

To detect a specific attack pattern reliably, an engineer writes logic in the SIEM that fires only when a defined sequence of events occurs together. This configured detection logic is a:

• a.A correlation rule✓
• b.A disaster recovery runbook describing the steps to restore operations after a major outage
• c.A firewall access control list that permits or denies traffic based on address and port
• d.A backup schedule that determines how frequently system data is copied to safe storage

A correlation rule defines conditions across multiple events that together indicate a threat, so the SIEM alerts only on the meaningful pattern. Well-crafted rules reduce noise and catch multi-step attacks. Encoding detection logic across events is what a correlation rule does.

When EDR detects ransomware behavior on a host, it automatically isolates that machine from the network within seconds without waiting for an analyst. This automated action is called:

• a.A scheduled vulnerability scan that runs against the host once every calendar quarter
• b.Automated host isolation (quarantine)✓
• c.A tabletop exercise where responders discuss how they would handle such an incident
• d.A manual escalation that pages an on-call analyst to investigate before anything is done

Automated host isolation quarantines a compromised machine from the network in seconds, stopping ransomware from spreading before a human can react. Speed is critical because encryption and lateral movement happen fast. Machine-speed containment is the value of this automation.

A security report highlights the average number of days an attacker remained undetected in the environment before discovery. Reducing this figure limits damage. This metric is:

• a.The recovery point objective, which defines the maximum tolerable window of lost data
• b.The annualized rate of occurrence, estimating how often a given risk happens each year
• c.Dwell time✓
• d.The false rejection rate, measuring how often a biometric wrongly denies a valid user

Dwell time is how long an attacker goes undetected in the environment, and shorter dwell time means less opportunity for damage and exfiltration. It reflects detection effectiveness. Minimizing time-to-detection is a central goal of security operations.

Many incidents began with users enabling macros in malicious Office documents. Which hardening policy most directly reduces this initial access vector?

• a.Requiring longer and more complex passwords on every single user account across the domain
• b.Disabling macros by default and blocking them from untrusted sources✓
• c.Encrypting the full disk on every endpoint so stored files are protected when powered off
• d.Deploying a load balancer in front of the mail servers to spread the inbound message load

Disabling macros by default and blocking them from untrusted sources removes a common malware delivery mechanism at its source. Password and disk controls do not address the macro vector. Targeting the specific initial access path is what makes this effective.

A team wants recurring scans but worries aggressive scanning could disrupt fragile production systems during business hours. The best practice is to:

• a.Scan continuously at maximum intensity regardless of the impact on production services
• b.Rely only on the vendor's assurance that the systems contain no vulnerabilities at all
• c.Schedule scans during maintenance windows and tune scan intensity✓
• d.Never scan the production systems at all so there is no possibility of any disruption

Scheduling scans during maintenance windows and tuning their intensity gets vulnerability visibility while minimizing operational disruption. Never scanning leaves blind spots; unrestrained scanning risks outages. Balancing coverage with safety is the practical approach.

Security operations periodically sends fake phishing emails to employees and tracks who clicks, using results to target additional training. This program is a:

• a.A tabletop exercise in which the response team verbally walks through a scenario together
• b.A business impact analysis that ranks the critical processes according to their downtime cost
• c.Phishing simulation campaign✓
• d.A penetration test in which ethical hackers actively exploit technical vulnerabilities to gain access

A phishing simulation sends benign fake phishing to measure susceptibility and drive targeted awareness training. It turns human risk into a measurable, improvable metric. Testing and coaching users against real-looking lures is the program's aim.

So responders apply the right resources, an organization rates each incident by scope and impact, from a minor single-host event up to an enterprise-wide breach. This step is called:

• a.Recovery, in which the affected systems are restored to normal, trusted operational status
• b.Chain of custody, documenting each individual who handled a given piece of evidence and when
• c.Incident classification and severity rating✓
• d.Eradication, in which the malware and any attacker footholds are completely removed from hosts

Incident classification and severity rating gauges scope and impact so the response is proportionate and the right people and resources are engaged. A minor event and a major breach demand very different responses. Sizing the incident early guides everything that follows.

Companies in the same industry exchange threat data through a trusted community so a breach at one helps the others defend proactively. Such an industry group is called a(n):

• a.Information sharing and analysis center (ISAC)✓
• b.A certificate authority that issues and signs the digital certificates used by member companies
• c.A cloud access security broker that enforces policy between users and the cloud apps they use
• d.A managed security service provider that operates and monitors the security tools for its clients

An Information Sharing and Analysis Center (ISAC) lets organizations in a sector share threat intelligence so each benefits from others' experiences. Collective defense turns one victim's detection into everyone's protection. Trusted industry threat sharing is the ISAC's purpose.

During an investigation, analysts realize a critical server was never forwarding its logs, leaving a gap in the timeline. The lesson for operations is to ensure:

• a.That every server in the environment is fully rebuilt from scratch after each investigation
• b.Comprehensive log source coverage✓
• c.That logs are deleted quickly to save storage space on the central logging platform daily
• d.That only the perimeter firewall forwards logs, since internal systems rarely matter much

Comprehensive log source coverage ensures every relevant system feeds the central platform, so investigations have no blind spots. A single non-reporting server can hide critical steps of an attack. Verifying that all important sources actually log is the lesson.

Analysts are overwhelmed manually copying data between the SIEM, ticketing system, and threat intel portal for every alert. Which improvement most directly addresses this repetitive toil?

• a.Hiring twice as many analysts to perform exactly the same manual copying tasks more quickly
• b.Extending the workday of the existing analysts so that more alerts can be handled manually
• c.Turning off the SIEM alerts entirely so that there is nothing left for the analysts to process
• d.Integrating the tools with automated playbooks✓

Integrating tools with automated playbooks eliminates repetitive manual data movement, freeing analysts for judgment-intensive work. Adding staff or hours scales the toil rather than removing it. Automating the hand-offs between tools is the direct fix.

After each incident and quarterly review, a SOC updates its playbooks, tuning, and training based on measured outcomes and lessons learned. This ongoing refinement reflects a principle of:

• a.A one-time hardening effort that is completed only once when the systems are first deployed
• b.Continuous improvement✓
• c.Implicit trust, granting access automatically to anything that is already inside the perimeter
• d.Security through obscurity, relying mainly on hiding system details from potential attackers

Continuous improvement uses feedback from incidents and reviews to steadily refine detection, response, and training over time. Security operations mature by learning and adjusting, not by standing still. Iterating on measured outcomes is the principle at work.