Your FREE CompTIA Security+ (SY0-701) Practice Test 2026 – 450+ Q&A

CompTIA Security+ Practice Questions

1. Which of the following is a type of malware that requires user interaction to activate and replicate, often disguised as legitimate software?
   • Rootkit, whose code hides below the host kernel
   • Worm, whose code scans each nearby subnet alone
   • Ransomware, whose code locks up the local files
   • Trojan, whose code sits within a wanted upgrade

   Correct answer: Trojan, whose code sits within a wanted upgrade

   A Trojan is malware wrapped inside something the victim wants to install, so the victim runs it themselves and grants it their own privileges. Rootkit is wrong because a rootkit's defining trait is concealment beneath the operating system once access already exists, not disguise at the point of delivery. Worm is wrong because a worm propagates on its own across the network and needs no user to launch it. Ransomware is wrong because it is named for what its payload does, encrypting files for extortion, not for how it reaches the host.

2. In cybersecurity, what is a 'honeypot' primarily used for?
   • To lure an attacker onto a decoy server we monitor
   • To mask the source address of a user's web traffic
   • To cache static content at the border of a network
   • To sign a build so its origin stays provable later

   Correct answer: To lure an attacker onto a decoy server we monitor

   A honeypot is a deliberately exposed system holding nothing of value; its whole purpose is to attract attackers so defenders can detect the intrusion and study the tools and techniques used. Masking a source address is the job of a proxy or NAT gateway, which hides clients rather than inviting attackers. Caching static content at the border is a content delivery function aimed at performance, not detection. Signing a build proves the origin and integrity of software and does nothing to observe attacker behaviour.

3. Which type of attack involves flooding a target system with traffic to exhaust resources and bandwidth, rendering the system unresponsive?
   • Replay, which resends one captured user login token
   • SQL injection, which alters a stored database query
   • Session hijack, which reuses a valid browser cookie
   • Volumetric DDoS, which saturates a slow core uplink

   Correct answer: Volumetric DDoS, which saturates a slow core uplink

   A distributed denial-of-service attack sends traffic from many compromised sources at once so link capacity and server resources are consumed and legitimate requests can no longer be served. Replay is wrong because it re-sends one previously captured message to defeat authentication and generates almost no volume. SQL injection is wrong because it manipulates a database query through unsanitised input rather than exhausting bandwidth. Session hijack is wrong because it takes over one authenticated session with a valid cookie, leaving the service fully available to everyone else.

4. What is the primary purpose of a 'zero-day' exploit in cybersecurity?
   • To strike a software flaw the vendor has not spotted
   • To restore the lost files from an offline backup set
   • To rank an asset by its likely full replacement cost
   • To rotate a shared key on a strict calendar schedule

   Correct answer: To strike a software flaw the vendor has not spotted

   A zero-day exploit targets a weakness the software vendor does not yet know about, so no patch or signature exists and defenders have had zero days to prepare. Restoring lost files from an offline backup is a recovery control used after an incident, not an attack technique. Ranking an asset by replacement cost belongs to business impact analysis and risk assessment. Rotating a shared key on a schedule is routine key management, which limits the damage of a compromised key rather than exploiting anything.

5. In the context of cybersecurity, what is 'social engineering'?
   • Cracking one password hash with a rainbow table
   • Scanning one subnet for hosts still awake today
   • Flooding a link until real users cannot connect
   • Tricking staff into giving up their own secrets

   Correct answer: Tricking staff into giving up their own secrets

   Social engineering attacks the person rather than the technology, using persuasion, authority, urgency or familiarity to make someone disclose information or perform an action they should not. Cracking a password hash with a rainbow table is an offline computational attack against stored credentials. Scanning a subnet for live hosts is technical reconnaissance carried out against machines. Flooding a link until real users cannot connect is a denial-of-service technique. None of those three involves persuading a human being.

6. What type of cyber attack involves intercepting and altering communications between two parties without their knowledge?
   • Replay attack, which resends those captured frames
   • Downgrade attack, which selects a weaker handshake
   • Dictionary attack, which guesses at common secrets
   • MitM attack, which secretly relays entire messages

   Correct answer: MitM attack, which secretly relays entire messages

   In a man-in-the-middle, or on-path, attack the attacker positions themselves between two communicating parties and passes messages along, so both sides believe they are talking directly while the attacker can read or modify everything in transit. A replay attack re-sends previously captured traffic later and does not sit in the live conversation. A downgrade attack pushes the parties onto weaker cryptography, which is a step toward interception rather than the interception itself. A dictionary attack guesses secrets from a word list and touches no live session.

7. Which type of attack is characterized by the insertion or "injection" of a SQL query via the input data from the client to the application?
   • Buffer overflow, which crosses a memory boundary
   • SQL injection, which reaches the backend records
   • Directory traversal, which walks to parent paths
   • Session replay, which resends older client input

   Correct answer: SQL injection, which reaches the backend records

   SQL injection happens when input from the client is concatenated into a database statement without validation or parameterisation, so the attacker's text is parsed as SQL and reaches data the application never meant to expose. Buffer overflow overruns a memory allocation in a compiled program and has nothing to do with database statements. Directory traversal abuses path handling to read files outside the web root. Session replay re-sends previously captured client material to impersonate a user. Only injection changes the meaning of the query itself.

8. What is a 'buffer overflow' attack in the context of cybersecurity?
   • Sending a mail carrying a hostile attachment
   • Guessing a password by trying long wordlists
   • Redirecting a customer to a counterfeit site
   • Writing beyond a buffer into adjacent memory

   Correct answer: Writing beyond a buffer into adjacent memory

   A buffer overflow occurs when a program writes more data than the allocated buffer holds, so the surplus overwrites adjacent memory such as a saved return address, which can crash the process or let the attacker run code of their choosing. Sending a mail carrying a hostile attachment is a malware delivery method. Guessing a password from long wordlists is a credential attack. Redirecting a customer to a counterfeit site describes phishing or pharming. None of those three overruns a memory allocation.

9. In cybersecurity, what does 'phishing' primarily refer to?
   • Flooding a service using junk traffic until it fails
   • Baiting a user with faked mail for their credentials
   • Copying a proximity badge signal to unlock a doorway
   • Planting a hidden splitter onto a buried fibre trunk

   Correct answer: Baiting a user with faked mail for their credentials

   Phishing is fraud carried out through electronic messages that impersonate a trusted brand or colleague and push the recipient into surrendering credentials or personal data. Flooding a service until it fails is denial of service, an availability attack. Copying a proximity badge signal is a physical cloning attack against an access control system. Planting a hidden splitter on a fibre trunk is physical eavesdropping on the cable plant. Only the faked message manipulates the recipient into handing over their own information.

10. Which type of cybersecurity attack involves exploiting vulnerabilities in web applications by sending malicious scripts to end users?
    • Rootkit, which hides its running system service
    • Ransomware, which locks files pending a payment
    • Cross-site scripting, which runs in the browser
    • Replay, which resends a saved session recording

    Correct answer: Cross-site scripting, which runs in the browser

    Cross-site scripting exploits a web application that reflects or stores unsanitised input, so attacker-supplied script is delivered to other visitors and executes in their browsers under the site's origin, exposing cookies, tokens and page content. A rootkit conceals privileged code on a host operating system. Ransomware encrypts data and demands payment. A replay attack re-sends previously captured traffic to defeat authentication. None of those three runs attacker script inside another user's browser session.

11. What kind of attack involves the unauthorized interception and retransmission of a valid data transmission, often to bypass authentication processes?
    • Replay, which re-sends a recorded user logon exchange
    • Smurf, which reflects broadcast pings across a subnet
    • Typosquat, which registers a store name spelled wrong
    • Evil twin, which impersonates a trusted wireless link

    Correct answer: Replay, which re-sends a recorded user logon exchange

    In a replay attack the attacker captures a legitimate authentication exchange and transmits it again later, so a system that accepts the repeated message treats the attacker as the original user; timestamps, sequence numbers and nonces exist to defeat exactly this. Smurf is wrong because it amplifies broadcast ICMP echo traffic to deny service, not to reuse a credential. Typosquatting is wrong because it registers look-alike domain names to catch mistyped visits. An evil twin is wrong because it impersonates a wireless network to attract new associations rather than repeating a captured transmission.

12. In cybersecurity, what is 'vishing'?
    • Seeding a shared drive with new infected files
    • Cloning a badge to open a restricted stairwell
    • Phoning a target to extract secret PIN details
    • Texting a link to install a counterfeit wallet

    Correct answer: Phoning a target to extract secret PIN details

    Vishing is voice phishing: the attacker calls the victim, poses as a bank, help desk or authority figure, and talks them into revealing card numbers, PINs, passwords or account details. Seeding a shared drive with infected files is a malware distribution technique. Cloning a badge to open a restricted door is a physical access attack. Texting a malicious link is smishing, the SMS variant of the same social engineering family. Only the telephone call makes the attack vishing.

13. Which type of cybersecurity threat involves exploiting a flaw in software before a patch or solution is implemented?
    • Insider misuse, which abuses rights we freely gave
    • Zero-day attack, which lands before any fix exists
    • Password spray, which tries one very common secret
    • Supply chain swap, which taints the vendor's patch

    Correct answer: Zero-day attack, which lands before any fix exists

    A zero-day threat exploits a defect that has no released patch or workaround, so signature-based defences have nothing to match and administrators have nothing to apply. Insider misuse is wrong because it abuses access the person was legitimately given, with no software defect involved. Password spray is wrong because it tries a small number of common passwords across many accounts and exploits weak credentials, not code. A supply chain swap is wrong because it tampers with a vendor's distribution channel, which is a delivery route rather than an unpatched flaw.

14. What is the main difference between a virus and a worm in the context of cybersecurity threats?
    • A virus needs a human click; a worm moves alone
    • A virus locks up files; a worm buries a rootkit
    • A virus logs a keystroke; a worm mines the coin
    • A virus wipes the firmware; a worm shuts a port

    Correct answer: A virus needs a human click; a worm moves alone

    A virus only executes when a person opens the infected file or runs the infected program, so its spread is gated on user action; a worm is a standalone program that copies itself over the network with no user involvement, which is why worm outbreaks spread so much faster. The other three statements attach behaviours that belong to different malware families: encrypting files for extortion is ransomware, concealment beneath the operating system is a rootkit, capturing typed input is a keylogger, mining currency is a cryptominer, destroying firmware is a wiper, and blocking a port is a firewall function. None of them states the propagation difference the question asks about.

15. Which cybersecurity term describes a small piece of data used to identify and authenticate a user's session?
    • Certificate, which binds an owner to a public key
    • Checksum, which detects a single change in a file
    • Cipher suite, which names the agreed set of codes
    • Token, which proves the user is already logged in

    Correct answer: Token, which proves the user is already logged in

    After a successful login the server issues a short session token, and the client presents that value on each later request so the server can recognise and authorise the session without re-checking the password. A certificate binds a public key to an identity and is issued by a certificate authority for much longer periods. A checksum detects accidental corruption in a file and provides no identity at all. A cipher suite is the negotiated set of algorithms used to protect a connection, not a per-user credential.

16. What is the primary purpose of 'watering hole' attacks in cybersecurity?
    • To poison a site the target group really trusts
    • To flood a link with garbage until it collapses
    • To duplicate a badge for entry past a turnstile
    • To crack a passphrase hash from a rainbow table

    Correct answer: To poison a site the target group really trusts

    In a watering hole attack the adversary cannot reach the intended victims directly, so it compromises a legitimate third-party site those victims are known to visit and waits for them to infect themselves. Flooding a link until it collapses is denial of service, aimed at availability rather than at a chosen group. Duplicating a badge is a physical access attack against an entry point. Cracking a passphrase hash from a rainbow table is an offline credential attack. Only the poisoned trusted site selects its victims by who visits it.

17. In the context of cybersecurity, what is 'spear phishing'?
    • A bulk blast sent to a purchased address roster
    • A crafted mail aimed at one named senior person
    • A voice call placed to one company service desk
    • A rogue access point set up outside an entrance

    Correct answer: A crafted mail aimed at one named senior person

    Spear phishing is research-driven and narrow: the attacker learns the target's role, colleagues and current projects, then writes a message that only makes sense for that person, which is why it defeats filters and suspicion far more often than mass mail. A bulk blast to a purchased list is ordinary phishing, sent to everyone at once. A voice call to a company service desk is vishing. A rogue access point outside an entrance is a wireless attack. Only the tailored message defines spear phishing.

18. What type of cyber attack uses multiple compromised systems to target a single system, causing a Denial of Service (DoS)?
    • Logic bomb, which fires after a set date arrives
    • Botnet DDoS, which aims many hosts at one target
    • Rainbow table, which unwinds a hash into its key
    • Card skimmer, which lifts the stripe at the pump

    Correct answer: Botnet DDoS, which aims many hosts at one target

    A distributed denial-of-service attack is distributed because the traffic comes from a botnet of already compromised machines, which multiplies the volume and makes simple source blocking useless, and the result on the victim is a denial of service. A logic bomb is dormant code triggered by a condition on one host. A rainbow table is a precomputed lookup for reversing password hashes offline. A card skimmer lifts magnetic stripe data at a payment terminal. None of those three directs many compromised systems at one target at once.

19. Which type of attack involves an attacker relaying messages between two parties, making them believe they are talking directly to each other?
    • Man-in-the-middle, which sits between two live peers
    • Tailgate, which shadows two badged engineers indoors
    • Smurf, which rebounds amplified replies off networks
    • Rootkit, which installs itself inside the hypervisor

    Correct answer: Man-in-the-middle, which sits between two live peers

    A man-in-the-middle attacker inserts themselves into the path of a live conversation and forwards each message on, so both endpoints see plausible replies and believe they are connected directly to each other while the attacker reads or edits the traffic. Tailgating is a physical entry technique that follows an authorised person through a door. Smurf is an amplification flood that rebounds echo replies at a victim. A rootkit conceals itself beneath the operating system on one host. None of those three sits in the middle of a live conversation.

20. In cybersecurity, what does 'ransomware' do?
    • Records each keystroke typed on a keypad
    • Redirects a browser to unwanted ad pages
    • Encrypts your files for a ransom payment
    • Relays spam out of the infected machines

    Correct answer: Encrypts your files for a ransom payment

    Ransomware encrypts the victim's files, and increasingly copies them out first, then withholds the decryption key until an extortion payment is made, often with a deadline and a threat of permanent loss or publication. Recording each keystroke is what a keylogger does. Redirecting a browser to unwanted adverts is adware or browser hijacking. Relaying spam out of an infected machine is what a bot in a spam network does. Only the encrypt-then-extort pattern is ransomware.

21. What is the main goal of a 'rootkit' in terms of cybersecurity threats?
    • To bill a customer for a phoney antivirus repair
    • To wipe a filesystem beyond any hope of recovery
    • To keep hidden admin control of a target machine
    • To pump paid adverts into a hijacked browser tab

    Correct answer: To keep hidden admin control of a target machine

    A rootkit exists to hold privileged access on a compromised host and to stay unseen, hooking or replacing operating system components so that its files, processes and network connections do not appear to the administrator or to security tools. Billing a customer for a phoney antivirus repair describes scareware. Wiping a filesystem past recovery is what destructive wiper malware does. Pumping paid adverts into a hijacked browser is adware. None of those three is defined by concealed privileged control.

22. What is the primary purpose of a HIDS (Host-based Intrusion Detection System)?
    • To review the logs of a single machine carefully
    • To hand out addresses to devices at each startup
    • To create a private tunnel over a public network
    • To bar unsigned code from a locked-down web host

    Correct answer: To review the logs of a single machine carefully

    A host-based intrusion detection system runs on the host it protects and inspects that machine's own evidence, its logs, file integrity, running processes and local network activity, which lets it see encrypted or internal activity a network sensor never sees. Handing out addresses at startup is DHCP. Creating a private tunnel over a public network is a VPN. Barring unsigned code is application allow-listing, a preventive control rather than a detective one.

23. In cybersecurity, what is the primary function of a SIEM (Security Information and Event Management) system?
    • Handing out one address per joining device
    • Correlating live event logs in one console
    • Shredding a retired disk after service end
    • Patching a server on a quarterly timetable

    Correct answer: Correlating live event logs in one console

    A security information and event management platform ingests logs from servers, network gear and applications, normalises them, and correlates events in near real time so that a pattern spread across several sources raises one alert an analyst can act on. Handing out an address per joining device is DHCP. Shredding a retired disk after service end is media sanitisation. Patching a server on a fixed timetable is vulnerability management. None of those three performs real-time correlation and alerting across log sources.

24. Which technology is most effective for preventing data leakage via email?
    • Antivirus, which matches a file against known signatures
    • Data loss prevention, which blocks the sensitive content
    • Load balancer, which shares email traffic across servers
    • Password vault, which stores each user's private secrets

    Correct answer: Data loss prevention, which blocks the sensitive content

    Data loss prevention inspects the content itself, matching patterns such as card numbers, national identifiers or classified markings, and then blocks, quarantines or encrypts the message before it leaves the organisation. Antivirus matches a file against known malware signatures and says nothing about whether the content is confidential. A load balancer distributes traffic for availability. A password vault protects stored credentials at rest. Only content inspection at the gateway stops sensitive material leaving by email.

25. What is the primary purpose of using a WAF (Web Application Firewall)?
    • To retain a reserve copy of a database off premises
    • To share one address between many hosts on a subnet
    • To measure how fast a very busy public page appears
    • To inspect the HTTP traffic headed to a live server

    Correct answer: To inspect the HTTP traffic headed to a live server

    A web application firewall works at the application layer, examining the HTTP and HTTPS requests and responses reaching an application so it can recognise and block injection, cross-site scripting and other web-specific attacks that a packet filter cannot see. Retaining a reserve copy of a database off premises is backup and recovery. Sharing one address between many hosts is network address translation. Measuring how fast a page appears is performance monitoring. None of those three filters web requests for attacks.

26. In the context of network security, what is the main function of an IPS (Intrusion Prevention System)?
    • To preserve a whole copy of each packet header
    • To split one LAN into two tiny broadcast zones
    • To store a backup image of the router settings
    • To block known attack traffic as it flows past

    Correct answer: To block known attack traffic as it flows past

    An intrusion prevention system sits inline in the traffic path, compares what passes against signatures and behaviour rules, and drops or resets the matching sessions itself; that active blocking is what separates an IPS from an IDS, which only alerts. Preserving a copy of each packet header is capture for later analysis. Splitting one LAN into broadcast zones is segmentation. Storing a backup image of the router settings is change management. None of those three stops an attack in flight.

27. Which tool is primarily used for vulnerability scanning in a network?
    • Wireshark, which decodes a captured packet bit stream
    • Snort, which alerts on a suspicious inbound signature
    • Nessus, which reports the known unpatched server bugs
    • Nmap, which enumerates the open ports per workstation

    Correct answer: Nessus, which reports the known unpatched server bugs

    Nessus is a vulnerability scanner: it fingerprints hosts and services, tests them against a plugin feed of known flaws and misconfigurations, and reports what is missing or exposed with a severity rating. Wireshark decodes captured traffic and finds no vulnerabilities. Snort is an intrusion detection engine that alerts when live traffic matches a rule signature. Nmap discovers hosts and open ports, which is reconnaissance rather than a vulnerability assessment.

28. What is the primary purpose of the tcpdump tool in network security?
    • Capturing a raw packet for detailed inspection
    • Wiping unused space from a decommissioned disk
    • Signing a download so later tampering surfaces
    • Hardening a database against a vendor baseline

    Correct answer: Capturing a raw packet for detailed inspection

    tcpdump is a command-line packet capture tool: it puts an interface into promiscuous mode, filters with a Berkeley Packet Filter expression, prints the headers and can write a capture file for later analysis. Wiping unused space from a decommissioned disk is media sanitisation. Signing a download so tampering surfaces is an integrity control. Hardening a database against a vendor baseline is configuration management. None of those three records live traffic from an interface.

29. Which of the following is a primary use case for a protocol analyzer in network security?
    • Reading a handshake to find a broken exchange
    • Erasing a handset after it departs the estate
    • Issuing a plastic card to each new contractor
    • Rotating an access file on a nightly schedule

    Correct answer: Reading a handshake to find a broken exchange

    A protocol analyser decodes captured frames field by field, so an engineer can follow a session such as a TLS or DHCP handshake, see exactly which message was malformed, rejected or never sent, and decide whether the fault is a configuration error or an attack. Erasing a handset as it departs the estate is asset disposal. Issuing a plastic card to a new contractor is identity provisioning. Rotating an access file on a nightly schedule is log management.

30. What is the primary security function of a UTM (Unified Threat Management) appliance?
    • To keep an offline copy of yesterday's data sets
    • To deliver an address to each machine when asked
    • To fold several security tools into a single box
    • To time-stamp a receipt so its place is provable

    Correct answer: To fold several security tools into a single box

    Unified threat management puts firewalling, intrusion prevention, gateway antivirus, web and content filtering, and often VPN termination into one appliance with a single management interface, which is why smaller sites adopt it instead of buying and operating separate devices. Keeping an offline copy of data is backup. Delivering an address to each machine on request is DHCP. Time-stamping a receipt so its place is provable is a non-repudiation control. None of those three consolidates multiple security functions.

31. Which security technology is primarily used to inspect SSL/TLS encrypted traffic at the perimeter of a network?
    • Load balancer, which spreads jobs across servers
    • Interception proxy, which breaks the TLS session
    • Syslog server, which stores remote device events
    • Jump host, which screens the operator connection

    Correct answer: Interception proxy, which breaks the TLS session

    To read encrypted traffic at the perimeter the device must break the tunnel: the proxy terminates the client's TLS session using a certificate the endpoints already trust, inspects the plaintext, then opens its own TLS session onward to the real server. A load balancer distributes work for capacity and may terminate TLS, but it exists to spread load rather than to inspect content for threats. A syslog server stores records that devices send it and never touches the traffic itself. A jump host screens administrative access to internal systems and inspects nothing.

32. What is the main function of a CASB (Cloud Access Security Broker)?
    • To apply one policy set across many cloud apps
    • To spin up more compute when new demand climbs
    • To hold the master keys inside a secure module
    • To charge each team for the resources it burns

    Correct answer: To apply one policy set across many cloud apps

    A cloud access security broker sits between users and the cloud services they use, so the organisation's own rules on authentication, data handling, sharing and shadow IT are enforced consistently on services it does not own or operate. Spinning up more compute when new demand climbs is autoscaling. Holding master keys inside a secure module is what an HSM does. Charging each team for what it consumes is cloud cost management. None of those three enforces security policy between users and cloud applications.

33. In network security, what is the primary purpose of using a honeypot?
    • To score a defect by its likely business damage
    • To escrow a spare copy of a recovery passphrase
    • To draw an attacker onto a watched false target
    • To send staff email through a spam filter first

    Correct answer: To draw an attacker onto a watched false target

    A honeypot is an intentionally vulnerable-looking system with no production role, so any connection to it is suspicious by definition; that gives defenders a high-signal detection point and a safe place to observe tools, timing and intent. Scoring a defect by its likely business damage is risk assessment. Escrowing a spare copy of a recovery passphrase is key escrow. Sending staff email through a spam filter is message hygiene. None of those three is a decoy that attracts and records attackers.

34. Which technology is essential for securing a network against Zero Day exploits?
    • A pattern scanner tuned to spot known malware
    • A packet filter set to block unapproved ports
    • A behaviour engine alert to odd host activity
    • A backup vault isolated from the main network

    Correct answer: A behaviour engine alert to odd host activity

    Behaviour-based detection is what catches a zero-day, because a zero-day has no published signature by definition: detection has to come from what the code does rather than what it looks like, such as anomalous process creation, unexpected outbound connections, memory injection or privilege changes. A pattern scanner can only match malware it already knows and is blind to a new exploit. A packet filter enforces port rules and cannot judge behaviour. An isolated backup vault helps recovery after an incident but prevents nothing.

35. In the context of digital forensics, what is the main purpose of a write blocker?
    • To hash each copied image before it travels
    • To leave the seized medium exactly as found
    • To log the handovers of the sealed evidence
    • To carve deleted files out of spare sectors

    Correct answer: To leave the seized medium exactly as found

    A write blocker sits between the evidence drive and the examiner's workstation and permits read commands while refusing every write, so the operating system cannot mount, journal or timestamp the original and the acquired image still matches the source hash. Hashing each copied image proves integrity but does not stop a write happening. Logging the handovers is chain of custody, a documentation control. Carving deleted files out of unallocated sectors is an analysis technique performed on the copy.

36. What is the primary purpose of a Network Access Control NAC system?
    • To lease a fresh address to each new device
    • To admit a laptop after a fast health check
    • To send voice frames ahead of any bulk data
    • To keep a warm standby ready for a failover

    Correct answer: To admit a laptop after a fast health check

    Network access control evaluates a device as it joins, checking identity and health such as patch level, antivirus state and configuration, then grants full access, places it in a remediation segment or refuses it, according to policy. Leasing a fresh address to each new device is DHCP. Sending voice frames ahead of bulk data is quality of service. Keeping a warm standby ready is high availability. None of those three decides whether a device may join the network.

37. Which tool is used in cybersecurity to simulate attacks on a system or network to identify vulnerabilities?
    • Patch manager, which pushes out vendor upgrades
    • Backup agent, which streams whole disks offsite
    • Exploit framework, which fires real attack code
    • Log shipper, which forwards events onto storage

    Correct answer: Exploit framework, which fires real attack code

    Penetration testing tools launch working exploits against a target with the owner's permission, which proves whether a weakness can actually be reached and used rather than merely reported, and shows what an attacker would gain. A patch manager distributes vendor upgrades and fixes weaknesses instead of exercising them. A backup agent streams copies of disks offsite for recovery. A log shipper forwards event records to storage. None of those three simulates an attack to prove a vulnerability.

38. In cybersecurity, what is the primary function of a Next-Generation Firewall (NGFW)?
    • To preserve a signed copy of each audit journal
    • To replace a failed uplink with a spare circuit
    • To scan a mailbox for unwanted bulk advert mail
    • To add threat rules to a stateful packet filter

    Correct answer: To add threat rules to a stateful packet filter

    A next-generation firewall keeps stateful packet filtering and adds integrated intrusion prevention, application awareness and identity awareness, so one policy can allow a named application for a named group while still inspecting that traffic for exploits. Preserving a signed copy of each audit journal is an integrity control. Replacing a failed uplink with a spare circuit is redundancy. Scanning a mailbox for unwanted bulk advertising is a mail gateway function. None of those three combines intrusion prevention with firewall filtering.

39. What is the primary use of a Security Assertion Markup Language (SAML)?
    • Sealing outbound message bodies inside a protected mail envelope
    • Rating reported software defects against a public severity scale
    • Passing signed identity assertions toward a trusting web service
    • Filtering inbound packet streams at a stateful boundary firewall

    Correct answer: Passing signed identity assertions toward a trusting web service

    SAML exists to carry signed authentication and authorization assertions from an identity provider to a service provider, and that assertion exchange is what makes browser-based single sign-on work across separate web applications. Sealing the body of a mail message is the job of S/MIME or PGP, message formats that have nothing to do with identity assertions. Scoring reported software defects against a published severity scale is what a vulnerability scanner and CVSS do, and SAML never inspects code. Deciding which packets may cross a boundary is a firewall function performed on addresses and ports, several layers below the assertion exchange SAML carries out.

40. In network security, what is the main function of an IDS (Intrusion Detection System)?
    • Alerting analysts about traffic matching a known attack signature
    • Blocking unauthorized sessions at a boundary using standing rules
    • Encrypting application payloads in transit under a negotiated key
    • Granting network access by checking a valid supplicant credential

    Correct answer: Alerting analysts about traffic matching a known attack signature

    An IDS is a passive sensor: it inspects traffic, compares what it sees against signatures and behavioral baselines, and raises an alert for a human or a downstream tool to act on. Dropping unauthorized sessions at a boundary describes an inline firewall or an IPS, and a detection sensor sitting off the forwarding path has no way to interrupt a flow it is only watching. Protecting a payload with a negotiated key is the work of TLS or IPsec, traffic an IDS consumes rather than produces. Deciding whether a supplicant may join the network at all is 802.1X with RADIUS, an admission decision made before traffic ever reaches the sensor.

41. Which technology is primarily used for securing wireless networks?
    • L2TP
    • MPLS
    • SNMP
    • WPA2

    Correct answer: WPA2

    WPA2 is the Wi-Fi Alliance certification that defines how a wireless link is authenticated and encrypted, using CCMP with AES, and it is what a modern wireless network relies on for confidentiality and integrity over the air. L2TP is a tunneling protocol that builds a link between two endpoints and supplies no confidentiality of its own, which is why it is normally paired with IPsec. MPLS is a carrier forwarding technology that labels packets for fast switching and has no wireless or cryptographic role. SNMP is a management protocol used to poll and configure devices, so it reports on a wireless access point rather than securing the radio link it serves.

42. In the context of secure network design, what is the primary purpose of a Demilitarized Zone (DMZ)?
    • Encrypting departing traffic flows across a shared carrier connection
    • Placing public facing services outside the trusted internal perimeter
    • Holding synchronized data copies within a secondary recovery facility
    • Storing regulated customer records inside a hardened database cluster

    Correct answer: Placing public facing services outside the trusted internal perimeter

    A DMZ is a screened segment between the untrusted internet and the internal LAN, so anything the outside world must reach lives there instead of on the internal network and a compromise of one of those hosts does not put the attacker inside. Encrypting a flow between two sites is a site-to-site VPN, which protects data in flight and creates no trust boundary. Keeping synchronized copies at a recovery facility is a backup and continuity control that restores service after a loss rather than limiting exposure. A DMZ is deliberately the least trusted zone in the architecture, which is exactly why regulated records belong on hardened internal storage and never in it.

43. Which of the following is a security concept that ensures that data is only modified by authorized users and in authorized ways?
    • Confidentiality policy
    • Integrity requirements
    • Availability assurance
    • Nonrepudiation reviews

    Correct answer: Integrity requirements

    Integrity is the property that data has not been altered except by an authorized party acting in an authorized way, and hashing, digital signatures, input validation and change control are the mechanisms that enforce it. Confidentiality governs who may see data rather than who may change it, so it is fully satisfied by a record an attacker has silently rewritten but nobody has read. Availability governs whether the data is reachable when it is needed and says nothing about whether its contents are still true. Nonrepudiation binds an action to a specific actor so it cannot later be denied, a proof-of-origin property layered on top of integrity rather than the modification control itself.

44. What is the primary function of a network-based Intrusion Detection System (NIDS)?
    • Rewriting outbound headers to hide internal address space details
    • Terminating client sessions to enforce a published idle threshold
    • Distributing inbound requests to keep server pools equally loaded
    • Watching mirrored traffic to raise alerts about probable breaches

    Correct answer: Watching mirrored traffic to raise alerts about probable breaches

    A network IDS taps or mirrors a segment, examines the copied traffic against signatures and baselines, and raises an alert when something resembles an intrusion attempt; detection rather than interruption is its entire job. Rewriting source addresses on the way out is network address translation, a routing function that hides internal addressing and evaluates nothing for attack behavior. Cutting off sessions that have gone idle is a session-management control enforced by the application or gateway, not a decision a passive sensor is positioned to make. Spreading inbound requests over a pool of servers is load balancing, which serves availability and performs no detection at all.

45. In a security context, what is the main purpose of employing a honeypot in a network?
    • Drawing attackers toward a decoy server to study their techniques
    • Splitting traffic across two paths to raise total link throughput
    • Copying files onto remote media to hasten later disaster recovery
    • Hashing stored passwords with random salt to slow offline attacks

    Correct answer: Drawing attackers toward a decoy server to study their techniques

    A honeypot is a deliberately exposed decoy with no production role, so every connection it receives is unsolicited and worth studying; defenders use it to observe tooling, capture payloads and learn technique while the real assets stay untouched. Spreading traffic over two physical paths is link aggregation, a throughput and resilience measure that attracts nobody. Copying files to remote media is a backup control aimed at recovering after loss, and a decoy deliberately holds nothing worth restoring. Salting and hashing stored passwords slows offline attacks on a stolen credential store, which protects real secrets instead of presenting fabricated ones.

46. Which security principle is primarily concerned with minimizing the amount of damage that can be done in the event of a security breach?
    • Change management
    • Security training
    • Minimum privilege
    • Vendor assessment

    Correct answer: Minimum privilege

    Least privilege, the principle of issuing an account the minimum privilege its task actually needs, is what caps the damage of a breach: a compromised account inherits only that narrow set of rights, so the harm stops where the entitlements stop. Change management governs how modifications reach production and prevents self-inflicted outages, an availability and integrity concern rather than a containment one. Security training reduces how often a person is tricked into opening the door at all, lowering the chance of a breach without limiting what one costs. Vendor assessment rates the risk a third party carries before it is onboarded, a supply-chain judgment made in advance rather than a limit on an intruder already inside.

47. What is the primary purpose of Data Loss Prevention (DLP) technology?
    • Removing duplicate blocks from stored archives to reclaim expensive capacity
    • Rotating cryptographic keys inside a tamperproof module to minimize exposure
    • Recording user keystrokes on managed endpoints to build behavioral baselines
    • Detecting regulated content in outbound streams to stop unapproved transfers

    Correct answer: Detecting regulated content in outbound streams to stop unapproved transfers

    DLP works by classifying content such as card numbers, health records or source code and then watching every path that content can take out of the organization, blocking or quarantining a transfer policy does not allow, whether the data is at rest, in use or in motion. Removing duplicate blocks from an archive is deduplication, a storage-efficiency technique that never examines who is sending what to whom. Rotating keys inside a hardware security module shortens the window in which a compromised key is useful, a key-management control that acts on secrets rather than on content. Recording keystrokes to build behavioral baselines is user activity monitoring, which profiles people instead of identifying and halting the movement of regulated data.

48. In cloud computing, what is the primary security concern of a Multi-Tenancy environment?
    • Higher egress charges during large outbound archive transfers
    • Poor separation of stored records between neighboring tenants
    • Unpatched middleware inside a rarely rebooted guest appliance
    • Expired certificates on an internal management console portal

    Correct answer: Poor separation of stored records between neighboring tenants

    Multi-tenancy means several customers run on one shared pool of compute, storage and network, so the control that matters most is the boundary that stops one tenant reading, writing or inferring another tenant's data, enforced by the provider's hypervisor, storage layer and identity model. Charges for moving data out of a provider are a cost-model issue that exists on dedicated hosting too. Unpatched middleware in a guest is a genuine risk but it is the tenant's own vulnerability-management failure and it looks identical on single-tenant infrastructure. Expired certificates break trust in one management interface and are answered by certificate lifecycle management, which does nothing about tenant separation.

49. What is the main purpose of using a Security Information and Event Management (SIEM) system?
    • Deploying approved firmware images to registered hosts on a timetable
    • Assigning temporary addresses to client machines from a reserved pool
    • Correlating log events from many systems to surface genuine incidents
    • Compressing archived records into smaller volumes to cut storage cost

    Correct answer: Correlating log events from many systems to surface genuine incidents

    A SIEM earns its place through central correlation: it ingests logs from firewalls, endpoints, servers and applications, normalizes them onto a common schema and time base, and applies rules and statistics across sources so signals that look harmless alone are recognized together as a single incident. Pushing approved firmware to a fleet on a timetable is patch and configuration management, which changes systems rather than reading what they report. Handing out addresses from a reserved pool is DHCP, an addressing service whose logs a SIEM consumes but does not provide. Compressing archives into smaller volumes is a storage-cost measure; squeezing log data is a retention side effect, not the analysis the platform exists for.

50. Which of the following best describes the concept of 'Zero Trust' in network security?
    • Verifying user identity and device posture wherever requests originate
    • Trusting hosts and services inside the corporate perimeter permanently
    • Encrypting partitions and snapshots under a private workstation secret
    • Blocking addresses and domains identified by commercial threat sources

    Correct answer: Verifying user identity and device posture wherever requests originate

    Zero Trust strips trust away from network location: every request is authenticated, authorized and evaluated against user and device posture whether it originates in a branch office, a data center rack or a coffee shop. Granting standing trust to hosts and services already inside the corporate perimeter is precisely the older castle-and-moat assumption Zero Trust was created to replace. Encrypting partitions and snapshots under a per-machine secret protects data on a lost device and takes no part in deciding whether a request should be honored. Blocking addresses and domains named by a commercial threat feed is reputation filtering, a coarse allow or deny made on address history rather than on verified identity and context.

51. In the context of virtualization security, what is the main purpose of a hypervisor?
    • Creating guest machines from pooled physical host resources
    • Scanning stored documents for signatures of current malware
    • Encrypting replicated snapshot images under a delegated key
    • Balancing storage requests across several linked disk pools

    Correct answer: Creating guest machines from pooled physical host resources

    A hypervisor owns the physical processor, memory, storage and network and hands each guest a virtual slice of them, creating, scheduling and isolating virtual machines; that mediation is the reason a compromise inside one guest does not automatically reach another. Scanning documents for current malware signatures is antimalware work carried out inside a guest or on a file server, above the virtualization layer. Encrypting replicated snapshot images protects a virtual machine at rest, a storage control applied to the hypervisor's output rather than a function of the hypervisor itself. Distributing storage requests across disk pools is a storage controller's job and creates no guests.

52. In Secure Software Development Life Cycle SDLC models, which phase primarily focuses on defining security requirements and goals?
    • Detailed design
    • Staged handover
    • Formal planning
    • Systems testing

    Correct answer: Formal planning

    Security requirements and goals belong in the earliest phase of a secure SDLC, where the team agrees what the system must protect, which regulations apply, what an acceptable level of residual risk is, and what secure enough will mean at release; every later phase is then measured against that statement. The design phase converts already-agreed requirements into an architecture of trust boundaries, authentication flows and key handling, so it implements goals rather than setting them. Testing verifies that requirements were met, which presupposes they already exist. Handover moves a finished build into production with hardening and monitoring, far too late for a missing requirement to be added cheaply.

53. What is the primary security function of a WAF (Web Application Firewall)?
    • Compressing static CSS content to shorten average download delays
    • Inspecting inbound HTTP requests to block injection style attacks
    • Renewing expiring TLS certificates to avoid client trust warnings
    • Balancing incoming TCP sessions to distribute load across servers

    Correct answer: Inspecting inbound HTTP requests to block injection style attacks

    A WAF sits in front of an application and parses layer-7 requests and responses, matching them against rules that recognize SQL injection, cross-site scripting, path traversal and similar application-layer abuse, then blocking or sanitizing whatever fails. Compressing and caching static content is content-delivery work that speeds pages up and never evaluates a request for malicious structure. Renewing certificates keeps clients from warning about an expired or untrusted identity, a PKI lifecycle task a WAF may terminate but does not perform. Distributing sessions across a server pool is a load balancer's function, frequently hosted on the same appliance, which is exactly why the two roles are worth keeping distinct.

54. In the context of cloud computing, what is the main purpose of a Cloud Access Security Broker CASB?
    • Throttling the busiest sessions so critical flows keep their headroom
    • Caching frequent objects at edge servers to shorten retrieval latency
    • Rebuilding degraded drives from parity data held on surviving members
    • Enforcing company policy on traffic bound for outside hosted services

    Correct answer: Enforcing company policy on traffic bound for outside hosted services

    A CASB is a policy enforcement point placed between an organization's users and the cloud services they consume, whether it works through API integration, a forward proxy or a reverse proxy; it delivers visibility into sanctioned and shadow cloud use and applies access, data protection and compliance rules to that traffic. Throttling busy sessions so critical flows keep headroom is quality of service, a traffic-shaping function with no view of who is uploading what to which service. Caching objects at edge servers shortens page loads and is a content delivery concern. Rebuilding a degraded drive from parity is RAID recovery inside a storage array, several layers below any cloud policy decision.

55. What is the primary function of Secure Sockets Layer (SSL) / Transport Layer Security (TLS) in network security?
    • Resolving public names into numeric addresses for remote clients
    • Recording completed logons inside a protected audit trail record
    • Protecting data in transit using freshly negotiated session keys
    • Restricting incoming sessions by port against a stateful ruleset

    Correct answer: Protecting data in transit using freshly negotiated session keys

    TLS, and the SSL versions it replaced, exists to protect a channel between two endpoints: the handshake authenticates the server through its certificate, agrees a fresh symmetric key for that session, and every record afterwards is encrypted and integrity-protected with it. Turning names into numeric addresses is DNS, which TLS depends on for reachability but which supplies no confidentiality of its own. Writing completed logons into an audit trail is accounting and log management, evidence collected after the fact rather than protection of the wire. Restricting sessions by port is firewall filtering, a coarse header-based access decision that never touches the payload.

56. In cybersecurity, what is the primary purpose of employing containerization?
    • Screening a server room entrance behind a keycard controlled lock
    • Measuring combined processor load across a large cluster of nodes
    • Signing departing messages with a private key for future evidence
    • Isolating a bundled application from nearby workloads on one host

    Correct answer: Isolating a bundled application from nearby workloads on one host

    A container bundles an application with the libraries and configuration it needs and runs it under namespaces and control groups, so the process sees only its own filesystem, network and resource share; that boundary limits what a compromised or misbehaving application can touch on the host and among its neighbors. Controlling entry to a server room with a keycard lock is a physical control protecting hardware, not a runtime boundary between processes. Measuring processor load across a cluster is capacity monitoring, which reports utilization and confines nothing. Signing departing messages with a private key provides origin proof and integrity for a message, a cryptographic service applied to data rather than an execution boundary.

57. Which of the following best describes the concept of defense in depth in network security?
    • Stacking several independent layers so a single failure stays contained
    • Ranking discovered weaknesses so the worst findings get corrected first
    • Splitting a transaction between two approvers so neither acts unwatched
    • Rotating admins through roles so hidden fraud becomes detectable sooner

    Correct answer: Stacking several independent layers so a single failure stays contained

    Defense in depth assumes that any one control will eventually fail, so it layers independent administrative, technical and physical controls along the path an attacker must take; a firewall, segmentation, endpoint protection, least privilege and monitoring each buy time and none of them is load-bearing on its own. Ranking discovered weaknesses so the worst are corrected first is risk-based vulnerability management, which sequences remediation instead of layering protection. Splitting a transaction so no single person completes it is separation of duties, an insider control. Rotating people through roles surfaces concealed misuse over time, another personnel control; each of those is one individual layer, not the layering principle itself.

58. In network security, what is the main purpose of a VLAN (Virtual Local Area Network)?
    • Doubling the available uplink speeds between two neighboring switches
    • Splitting one switched fabric into separate logical broadcast domains
    • Encrypting traffic crossing a tagged link using preshared credentials
    • Mirroring copied packets toward an attached passive monitoring sensor

    Correct answer: Splitting one switched fabric into separate logical broadcast domains

    A VLAN divides one physical switch infrastructure into several independent broadcast domains, so ports in different VLANs cannot reach each other at layer 2 and traffic between them must pass a router or firewall where policy can be applied; the grouping follows function rather than cabling. Bonding links to raise available speed between two switches is link aggregation, a bandwidth measure that leaves every port in the same broadcast domain. Encrypting traffic on a tagged link is MACsec, which protects a link against eavesdropping without dividing it. Mirroring copies of packets to a sensor is a SPAN or tap configuration, which feeds monitoring tools and moves no forwarding boundary.

59. What is the primary purpose of implementing an IDS (Intrusion Detection System) in tandem with an IPS (Intrusion Prevention System)?
    • Compressing collected logs and shipping them toward a cheaper archive
    • Spotting hostile attempts and blocking them inside one traffic stream
    • Encrypting stored records and sealing them against later silent edits
    • Duplicating power supplies and pairing them for steady rack operation

    Correct answer: Spotting hostile attempts and blocking them inside one traffic stream

    Running detection and prevention together supplies both halves of the response: the detection engine recognizes an intrusion attempt from signatures or anomalous behavior, and because the prevention engine sits inline on the same traffic stream it can drop the session, reset the connection or install a block rule instead of only raising an alert. Compressing logs and moving them to cheaper storage is retention management, which reduces cost and never inspects live traffic. Encrypting stored records against silent alteration protects data at rest, a confidentiality and integrity control for stored objects. Duplicating power supplies keeps a rack running through a hardware fault, a redundancy measure with no view of an attack in progress.

60. Which technology is primarily used for isolating network traffic to improve security and performance in a virtualized environment?
    • SDN
    • NFV
    • NAC
    • VPN

    Correct answer: SDN

    Software-defined networking splits the control plane from the forwarding plane and hands path and policy decisions to a central controller, which is what lets a virtualized environment carve traffic into isolated segments programmatically and re-apply that isolation as workloads move. Network function virtualization moves appliances such as routers and load balancers onto commodity servers; it changes where a function runs rather than how traffic is separated. Network access control decides whether an endpoint may join at all, based on posture and identity, and it stops mattering once the device is admitted. A virtual private network builds an encrypted tunnel between two points across an untrusted path, which protects one conversation rather than partitioning a fabric.

61. In a cloud computing environment, what is the primary security benefit of implementing microsegmentation?
    • Encrypting stored partitions so a stolen laptop reveals nothing usable
    • Signing container images so tampered builds fail their admission check
    • Rotating privileged secrets so a leaked credential expires within days
    • Limiting movement between individual workloads so a breach stays local

    Correct answer: Limiting movement between individual workloads so a breach stays local

    Microsegmentation applies policy at the level of the individual workload rather than the subnet, so each virtual machine or container is permitted only the specific east-west conversations it needs; an attacker who lands on one workload finds the neighboring ones closed, and lateral movement, the step that turns a foothold into a breach, is exactly what gets denied. Encrypting stored partitions protects data on a machine that leaves the building and does nothing about traffic between live workloads. Signing container images stops a tampered build from starting, a supply-chain control applied before runtime. Rotating privileged secrets shortens how long a leaked credential is useful, a credential-management measure that never constrains where an authenticated workload may connect.

62. What is the primary purpose of a SIEM (Security Information and Event Management) system in a cybersecurity infrastructure?
    • Pushing signed policy updates onto a managed workstation fleet nightly
    • Blocking outbound connections toward addresses on a known hostile list
    • Gathering log records from many sources into one searchable repository
    • Wiping decommissioned drives so salvaged platters yield no usable data

    Correct answer: Gathering log records from many sources into one searchable repository

    A SIEM's first job is collection and normalization: it pulls logs and telemetry from firewalls, servers, endpoints, identity systems and applications into one indexed repository with a common time base and schema, which is the precondition for correlation, alerting, dashboards and investigation. Distributing signed policy updates to a workstation fleet is endpoint configuration management, which changes machines rather than reading their output. Blocking connections to addresses on a hostile list is a filtering decision made by a firewall or proxy, and the SIEM consumes those denials as events. Wiping decommissioned drives is media sanitization at the end of an asset's life, unrelated to collecting or analyzing running systems.

63. Which authentication protocol primarily relies on tickets for client-server authentication and does not transmit passwords over the network?
    • Diameter sessions
    • Terminal accounts
    • Directory lookups
    • Kerberos requests

    Correct answer: Kerberos requests

    Kerberos authenticates a client to a service using time-limited tickets issued by a Key Distribution Center; the password is used locally to derive a key and is never sent across the network, and the service validates the ticket rather than a credential. Diameter, the AAA successor to RADIUS, uses a request and answer exchange protected by transport-layer security and carries credentials to the server instead of granting tickets. Terminal device administration under TACACS+ separates authentication from authorization so individual commands can be approved, and it encrypts the packet body, but each login still sends the credential to the server. A directory lookup authenticates through an LDAP simple bind, which transmits the password to the directory server, the opposite of the property described.

64. In Identity and Access Management, what is the primary purpose of a Federation Service?
    • Storing hashed user credentials inside a shared onsite directory store
    • Timing out idle sessions after a published inactivity threshold passes
    • Letting a partner recognize logins issued by one external organization
    • Granting temporary rights for a single assignment then retracting them

    Correct answer: Letting a partner recognize logins issued by one external organization

    A federation service establishes trust between separate identity domains so a user authenticated by their home organization is accepted by a partner's application without holding an account there; the partner validates a signed assertion from the trusted issuer instead of a local credential. Storing hashed credentials in a directory is what a directory service does inside one organization, the very duplication federation removes the need for. Timing out idle sessions is a session-management control that limits exposure on an unattended device. Granting rights for a single assignment and retracting them afterwards is just-in-time privileged access, which decides how long an entitlement lasts rather than which organization vouched for the identity.

65. What is the primary security concern addressed by the implementation of a Zero Trust model?
    • Volume flooding
    • Insider threats
    • Virus outbreaks
    • Wiretap attacks

    Correct answer: Insider threats

    Zero Trust exists because the traditional perimeter granted standing trust to anything already inside it, which is exactly the position an insider, a stolen employee credential or a compromised internal host occupies; requiring identity, device posture and authorization on every request removes the free pass those actors relied on. A volumetric flood aims to exhaust bandwidth or connection state and is answered by upstream scrubbing and rate limiting, which continuous verification does not provide. A virus outbreak is contained by endpoint protection and patching, and no amount of per-request verification stops code already executing on a host. Wiretapping a link is defeated by encrypting traffic, a confidentiality control that applies whether or not trust is implicit.

66. Which of the following best describes a 'Privileged Access Management' (PAM) system?
    • Vaulting passwords for highly elevated accounts under live session recording
    • Mapping job titles onto permission bundles assigned across whole departments
    • Comparing logon sequences against a baseline of established account behavior
    • Tunneling remote traffic through an encrypted link toward internal resources

    Correct answer: Vaulting passwords for highly elevated accounts under live session recording

    Privileged access management concentrates on the small number of accounts that can change everything: it vaults and rotates their credentials, issues them just in time, brokers the connection so the human never handles the secret, and records the session for review. Mapping job titles to permission bundles is role-based access control, which governs ordinary entitlements for the whole workforce rather than the administrative tier. Comparing logons against a behavior baseline is user and entity behavior analytics, a detection technique that holds no credential at all. Building an encrypted tunnel to internal resources is remote access, which decides how a user reaches the network and not what elevated rights they may exercise once there.

67. What is the main purpose of using a Security Assertion Markup Language (SAML) in web security?
    • Reusing one original identity login across many unrelated web services
    • Converting readable input into ciphertext under an agreed block cipher
    • Checking sender domains against published records held in public zones
    • Selecting the resources an endpoint contacts under a quarantine policy

    Correct answer: Reusing one original identity login across many unrelated web services

    SAML lets a user authenticate once at an identity provider, which then issues a signed assertion that each participating service provider trusts, so one session opens many separate web applications without the user presenting a credential to any of them. Converting readable input into ciphertext under an agreed block cipher is what an encryption algorithm inside TLS or S/MIME does; SAML assertions are signed for authenticity and normally travel over a channel someone else encrypted. Checking a sender domain against records published for that domain is SPF, DKIM and DMARC, an email authentication family with no relationship to web session establishment. Selecting what an endpoint may reach after a posture check is network access control, an admission decision rather than an identity assertion.

68. What is the primary function of a RADIUS server in network security?
    • Filtering inbound packets statefully and dropping what the ruleset forbids
    • Validating remote credentials centrally and logging the length of sessions
    • Watching host processes closely and flagging what looks clearly unexpected
    • Encrypting stored volumes silently and holding keys inside sealed firmware

    Correct answer: Validating remote credentials centrally and logging the length of sessions

    RADIUS centralizes AAA for network access: a switch, wireless controller or VPN concentrator forwards a user's credentials to the RADIUS server, which authenticates them, returns the authorization attributes that shape the session, and stores accounting records covering its start, stop and duration. Stateful packet filtering against a ruleset is a firewall's work, performed on traffic rather than on identity. Watching host processes and flagging unexpected behavior is host intrusion detection or EDR, which lives on the endpoint and issues no network access decision. Encrypting stored volumes with keys held in firmware is full-disk encryption, a data-at-rest control unrelated to who is allowed onto the network.

69. In an Identity and Access Management system, what does the term "Least Privilege" primarily refer to?
    • Forcing an account to regenerate its password on a timetable
    • Locking an account after a sequence of failed logons appears
    • Assigning an account a rights bundle scoped for one function
    • Placing an account inside a group whose members share duties

    Correct answer: Assigning an account a rights bundle scoped for one function

    Least privilege gives every user, service and process a bundle of rights scoped to the single function it performs and nothing wider, and it applies for as long as that function lasts, so a compromised or misused account carries the smallest possible reach. Forcing a periodic password change is a credential hygiene rule that limits how long a stolen secret stays valid without changing what the account can do. Locking an account after repeated failed logons frustrates guessing attacks, an authentication throttle rather than an entitlement decision. Putting an account in a group is the mechanism by which rights are often delivered, but a group can over-grant just as easily as it can grant correctly; the principle concerns the size of the grant, not the container it arrives in.

70. Which technology is primarily used for multi-factor authentication to enhance security?
    • Certificate pinning
    • Screensaver locking
    • Passphrase rotation
    • Fingerprint scanner

    Correct answer: Fingerprint scanner

    Multi-factor authentication requires evidence from different categories, and a fingerprint scanner supplies the inherence factor, something the user is, which cannot be shared or typed the way a memorized secret can, so pairing it with a password or a token produces a genuine multi-factor login. Certificate pinning ties a client to an expected server certificate and defends a TLS connection against a fraudulent issuer; it authenticates the server, not the person. Screensaver locking protects an unattended workstation and simply re-presents whatever authentication is already configured. Passphrase rotation replaces one knowledge secret with another knowledge secret, which remains a single factor however often it changes.

71. What does the OAuth protocol primarily provide in the context of Identity and Access Management?
    • Demanding an additional factor beyond a passphrase during interactive logon
    • Wrapping wireless frames within a rotating cipher during radio transmission
    • Granting one application delegated rights over owner resources using tokens
    • Moving stored files between hosts inside an authenticated encrypted channel

    Correct answer: Granting one application delegated rights over owner resources using tokens

    OAuth is an authorization framework: the resource owner approves a scoped, revocable grant, and the application receives an access token that lets it act on specific resources for a limited time while the owner's password never leaves the identity provider. Demanding an additional factor at logon is multi-factor authentication, which strengthens proof of who the user is and says nothing about what a third-party application may do on their behalf. Wrapping wireless frames in a rotating cipher describes WPA link encryption, a data-in-transit protection at the radio layer. Moving files inside an authenticated encrypted channel is SFTP or SCP, a transfer protocol that carries data rather than delegating rights.

72. In a Single Sign-On (SSO) implementation, what is the primary security risk?
    • One stolen credential opens the whole set of connected services
    • One legacy application lacks support for the new login protocol
    • One busy directory server carries a heavier constant query load
    • One extra trust chain adds another stage during initial rollout

    Correct answer: One stolen credential opens the whole set of connected services

    Single sign-on concentrates risk: one credential and one session now open every connected application, so a phished password, a stolen session cookie or an outage at the identity provider affects all of them at once, which is why SSO is normally paired with strong multi-factor authentication and a hardened, highly available provider. A legacy application that cannot speak the federation protocol is an integration limit; it simply stays outside the SSO estate rather than making it less safe. Extra query load on a directory server is a capacity question answered with more instances. Additional trust relationships do lengthen the initial build, but a one-time configuration cost is not a security exposure.

73. What is the primary function of TACACS+ in network security?
    • Detecting known malware signatures inside files copied onto employee endpoints
    • Authorizing individual commands issued by an administrator on managed consoles
    • Reserving minimum bandwidth for voice traffic crossing congested carrier links
    • Producing periodic integrity reports about system binaries on hardened servers

    Correct answer: Authorizing individual commands issued by an administrator on managed consoles

    TACACS+ is the AAA protocol built for device administration: it separates authentication from authorization so that once an administrator has logged in, each command they issue can be checked against policy and permitted or refused, and it encrypts the entire packet body rather than only the password. Matching files against malware signatures is antimalware scanning performed on an endpoint. Reserving bandwidth for voice on a congested link is quality of service, a traffic-prioritization feature configured on the very routers TACACS+ protects but unrelated to who may configure them. Producing integrity reports on system binaries is file integrity monitoring, which detects unauthorized change after the fact instead of deciding an administrator's rights in advance.

74. Which term best describes a system where different authentication methods are used at different times or in different contexts for the same user?
    • Password authentication
    • Kerberos authentication
    • Two-step authentication
    • Adaptive authentication

    Correct answer: Adaptive authentication

    Adaptive, or risk-based, authentication evaluates the context of each attempt, including device, location, network, time and recent behavior, and varies what it demands: a routine login passes on a password while a login from an unfamiliar country triggers an additional challenge, so the same user meets different requirements at different moments. Password authentication asks for the same single secret every time and has no notion of context. Kerberos authentication is a ticket-based protocol whose exchange is identical for every session it issues. Two-step authentication always requires the same two factors regardless of circumstance, a fixed policy rather than one that responds to risk.

75. What is the main advantage of implementing a Role-Based Access Control RBAC system in an organization?
    • Recording keystrokes from a locked console inside an immutable journal
    • Expiring temporary access promptly after a timed renewal period closes
    • Encrypting sensitive database columns so a copied extract stays opaque
    • Gathering permissions under a functional role shared by many employees

    Correct answer: Gathering permissions under a functional role shared by many employees

    RBAC gathers permissions under a role and then assigns people to roles, so an administrator maintains a handful of shared role definitions instead of thousands of individual grants; joiners inherit a role's rights on their first day, movers swap roles, and leavers lose everything at once, which makes entitlements consistent and reviewable. Recording console keystrokes into an immutable journal is privileged session auditing, evidence gathered after access has been used. Expiring temporary access when a renewal period closes is just-in-time provisioning, which controls how long a grant lasts rather than how grants are structured. Encrypting sensitive database columns protects the data itself if it is copied or stolen and does nothing to simplify who is entitled to read it.

76. In the context of Public Key Infrastructure (PKI), what role does the Certificate Revocation List (CRL) play?
    • Holding private keys inside tamper evident hardware under tight control
    • Naming certificates the issuing authority has withdrawn ahead of expiry
    • Binding each published key to a single independently verified applicant
    • Publishing the hierarchy of trust traversed by a validating application

    Correct answer: Naming certificates the issuing authority has withdrawn ahead of expiry

    A CRL is a signed, periodically republished list of the serial numbers of certificates that the issuing certificate authority has revoked before their natural expiry, because a key was compromised, an employee left or a certificate was issued in error; a relying party consults it, or the equivalent OCSP response, before trusting a certificate that is otherwise still inside its validity dates. Holding private keys in tamper-evident hardware describes a hardware security module or a smart card, which protects keys rather than listing dead ones. Binding a verified applicant to a published key is what the certificate itself does at issuance. Publishing the hierarchy a client walks to a trusted root is the work of the CA and its intermediates, which establishes trust rather than withdrawing it.

77. Which authentication factor category does a fingerprint scanner fall under?
    • Knowledge authentication
    • Ownership authentication
    • Proximity authentication
    • Inherence authentication

    Correct answer: Inherence authentication

    Inherence authentication is the right category: a fingerprint is a measured physical trait of the person, the classic "something you are" factor. Knowledge authentication tests a memorised secret such as a PIN or passphrase. Ownership authentication tests a device the person carries, such as a hardware token. Proximity authentication tests where the person is, using location or network context, which a fingerprint reader never evaluates.

78. In Identity and Access Management, what is a primary security feature of using smart cards as an authentication factor?
    • They carry an embedded certificate that proves who the user is
    • They store a list of reusable passwords for many local systems
    • They report the exact place from which a login attempt started
    • They update the access rights of a person without admin action

    Correct answer: They carry an embedded certificate that proves who the user is

    A smart card's security value comes from the certificate and private key burned into its chip: the card proves the holder's identity cryptographically and the private key never leaves the card. Smart cards are not password vaults, so they do not hold reusable passwords for other systems. They carry no radio or satellite receiver and cannot report where a login started. They are credentials, not an administration tool, so they never change anyone's access rights on their own.

79. What is the main purpose of implementing a Directory Service in network security?
    • Logging each authentication attempt for a formal audit review
    • Centralizing the storage of user records and their attributes
    • Issuing and revoking the public key certificates users supply
    • Distributing software updates to the machines that are joined

    Correct answer: Centralizing the storage of user records and their attributes

    A directory service exists to hold identity data in one authoritative place: user, group and device objects with the attributes other systems query when they authenticate or authorize someone. Audit logging of authentication attempts is done by the event log and the collector that reads it. Issuing and revoking certificates is the job of a certificate authority. Pushing software updates is a patch management function, not a directory function.

80. Which access control model dynamically assigns roles to users based on attributes and environmental conditions?
    • MAC, clearance-driven access control
    • DAC, owner-controlled access control
    • ABAC, attribute-based access control
    • RBAC, role-membership access control

    Correct answer: ABAC, attribute-based access control

    ABAC evaluates attributes of the subject, the object, the action and the environment at the moment of the request, so what is granted changes with conditions such as time of day, device posture or location. MAC decides from fixed clearance and classification labels set by the system, not by conditions. DAC lets the resource owner grant access at their own discretion. RBAC grants permissions through static role memberships that an administrator assigns in advance.

81. In a PKI, what is the function of a Key Escrow?
    • It shortens the time an appliance needs to verify certificates
    • It keeps copies of private keys in trusted third-party custody
    • It publishes the public key that enrolled users currently hold
    • It signs certificate requests submitted by each of the clients

    Correct answer: It keeps copies of private keys in trusted third-party custody

    Key escrow means a trusted third party keeps a protected copy of private keys so an authorized party can obtain them later. It has nothing to do with validation speed, which depends on revocation list or status protocol checking. Publishing public keys is what a public repository or directory does, and public keys need no escrow because they are already public. Signing certificate requests is the certificate authority's own function, performed with the authority's key rather than with escrowed material.

82. Which concept in risk management involves determining the impact of an adverse event that may affect the assets, resources, or operations of an organization?
    • Threat modeling workshop
    • Network baseline capture
    • Business impact analysis
    • Change management review

    Correct answer: Business impact analysis

    A business impact analysis is the study that determines what an adverse event would cost an organization: it identifies critical functions and quantifies the operational and financial consequence of losing the assets and resources behind them. A threat modeling workshop maps how an attacker could reach a system, not what the loss would be. A network baseline capture records normal traffic so deviations can be spotted. A change management review evaluates proposed changes before they are approved.

83. In risk management, what does the term 'risk appetite' refer to?
    • The total budget of the controls reducing a risk
    • The odds that a given risk actually occurs today
    • The loss that a single risk event would generate
    • The amount of risk the business will freely bear

    Correct answer: The amount of risk the business will freely bear

    Risk appetite is the amount of risk an organization is prepared to take on in pursuit of its objectives, set by senior leadership as a matter of strategy. A control budget is a spending figure, not a statement of how much risk is welcome. The odds that a risk occurs is its likelihood. The loss a single event would create is its impact, which feeds a risk calculation but says nothing about how much risk leadership is willing to carry.

84. Which of the following best describes a 'risk register' in the context of risk management?
    • A list of each risk found with its suspected cause
    • A list of risk transfers that legal has signed off
    • A list of incidents that the risk board has closed
    • A list of audits the risk owner must still approve

    Correct answer: A list of each risk found with its suspected cause

    A risk register is the working inventory of identified risks: each entry records the risk, its suspected cause, its owner, its rating and the treatment chosen. Signed transfer agreements are contract records held by legal, not the register itself. Closed incidents belong in an incident log and describe events that already happened rather than risks that might. A schedule of outstanding audits is an assurance planning document.

85. In the context of risk management, what is 'residual risk'?
    • The risk level measured before a control is applied
    • The risk that remains once the controls are present
    • The risk a business hands an insurer under contract
    • The risk that management signs off and leaves alone

    Correct answer: The risk that remains once the controls are present

    Residual risk is what is left after the selected controls have been implemented and are working; it is the amount the organization actually carries. The level measured before treatment is inherent risk. Risk handed to an insurer under contract has been transferred, which is a treatment choice rather than the leftover. Risk that management deliberately signs off is accepted risk, a decision that can be taken about either inherent or residual exposure.

86. What is the primary purpose of 'quantitative risk analysis' in risk management?
    • It rates each risk using a descriptive severity band
    • It groups each risk beneath its owning business unit
    • It expresses each risk as a measured monetary figure
    • It escalates each risk to the committee that accepts

    Correct answer: It expresses each risk as a measured monetary figure

    Quantitative risk analysis puts numbers on exposure: it derives values such as single loss expectancy, annualized rate of occurrence and annualized loss expectancy so that risks can be compared in money. Rating a risk with descriptive words such as high or moderate is qualitative analysis. Sorting risks by owning business unit is a cataloging step. Escalating a risk to a governance committee is part of the response process, after the analysis is finished.

87. Which approach in risk management prioritizes risks based on their severity and likelihood of occurrence?
    • Risk prioritization
    • Risk identification
    • Risk quantification
    • Risk categorization

    Correct answer: Risk prioritization

    Risk prioritization is the ranking step: risks already on the register are ordered by how severe they would be and how likely they are, so the most pressing get attention and budget first. Risk identification is the earlier step that discovers risks and puts them on the register. Risk quantification assigns numeric probability and loss values but does not itself order the work. Risk categorization groups risks by type or source and produces no ranking at all.

88. In the context of risk management, what is 'risk transference'?
    • Redesigning a process so the risk can no longer arise
    • Adding controls that lower the risk to a stated level
    • Documenting the risk and opting to live with it today
    • Passing the money risk to an insurer under a contract

    Correct answer: Passing the money risk to an insurer under a contract

    Risk transference moves the financial consequence of a risk to another entity, most often through insurance or a contractual indemnity, although accountability for the risk stays with the organization. Redesigning a process so the exposure cannot arise is avoidance. Adding controls to bring exposure down is mitigation. Documenting a risk and deciding to carry it is acceptance.

89. What does a 'Single Loss Expectancy' (SLE) calculation involve in risk management?
    • The money lost each time a named risk event occurs
    • The money gone across a single year of risk events
    • The money set aside to fund a planned risk control
    • The money a risk can drain before a business folds

    Correct answer: The money lost each time a named risk event occurs

    Single loss expectancy is the monetary loss expected from one occurrence of a specific risk, calculated as asset value multiplied by exposure factor. Loss summed across a whole year is annualized loss expectancy, which multiplies single loss expectancy by the annualized rate of occurrence. Money set aside to fund a control is a budget line. The amount a firm can absorb before failing is a solvency limit, not an expectancy calculation.

90. In risk management, what is the primary goal of 'risk mitigation'?
    • To shift each risk over to a vendor or insurer
    • To drop the odds that a named risk ever occurs
    • To trim the likelihood or the impact of a risk
    • To grade each risk so the worst is fixed first

    Correct answer: To trim the likelihood or the impact of a risk

    Risk mitigation reduces exposure by lowering how likely a risk is, how much damage it would do, or both, until what remains is tolerable. Moving a risk to a vendor or insurer is transference. Ending the chance of occurrence altogether is avoidance, and in practice no control drives likelihood to zero. Ranking risks so the worst are handled first is prioritization, which decides the order of treatment rather than reducing anything.

91. Which document in risk management outlines the steps to be taken in the event of a specific risk occurrence?
    • The risk control inventory
    • The risk response playbook
    • The risk training schedule
    • The risk exposure register

    Correct answer: The risk response playbook

    A risk response playbook sets out, in advance, the actions to take when a particular risk actually materializes, including who acts and in what order. A control inventory lists the safeguards in place but not the sequence to follow during an event. A training schedule plans awareness sessions. An exposure register catalogs the risks and their ratings, and points to a response plan rather than containing the steps itself.

92. In risk management, what is the purpose of conducting a 'gap analysis'?
    • It estimates how much a single failure would cost them
    • It counts the steps that a workflow repeats each cycle
    • It tests whether the team can follow the recovery plan
    • It compares what we do with what the standard requires

    Correct answer: It compares what we do with what the standard requires

    A gap analysis measures the distance between where an organization's practices actually stand and where a chosen standard, framework or policy requires them to stand, and the difference becomes the remediation plan. Costing a single failure is an impact calculation. Counting repeated steps is a process efficiency exercise. Testing whether a team can execute a recovery plan is a drill, which validates a plan instead of measuring a shortfall against a standard.

93. What does 'Mean Time Between Failures' (MTBF) represent in the context of risk management?
    • The mean time that one repair of failures takes
    • The longest outage that a firm can safely stand
    • The recent user data that a restore can forfeit
    • The mean time that a unit runs between failures

    Correct answer: The mean time that a unit runs between failures

    Mean time between failures is a reliability figure: it is the average operating interval separating one failure of a repairable item from the next. The average time to bring a failed system back is mean time to repair. The longest outage the business can stand is maximum tolerable downtime. The amount of recent data a restore may sacrifice is the recovery point objective, which is measured in data rather than in reliability.

94. Which of the following best describes 'Qualitative Risk Analysis' in risk management?
    • It converts each risk into an annual dollar estimate
    • It rates each risk with a descriptive severity label
    • It offloads each risk onto an external named insurer
    • It archives each risk after its control is validated

    Correct answer: It rates each risk with a descriptive severity label

    Qualitative risk analysis uses judgment and descriptive scales, rating likelihood and impact as high, medium or low so risks can be compared quickly without financial modeling. Converting exposure into an annual dollar estimate is quantitative analysis. Offloading a risk onto an outside insurer is transference, a response rather than an analysis. Archiving a risk once its control is validated is a monitoring activity that follows treatment.

95. What is the primary focus of 'Operational Risk Management'?
    • It weighs risk against the long-term firm strategy
    • It weighs risk inside an investment fund portfolio
    • It weighs risk among the day-to-day work processes
    • It weighs risk from newly passed national statutes

    Correct answer: It weighs risk among the day-to-day work processes

    Operational risk management deals with loss arising from the organization's own day-to-day running: failed processes, human error, and systems that break or are misused. Risk weighed against long-term direction set by the board is strategic risk. Risk inside an investment portfolio is financial or market risk. Risk created by newly passed legislation is compliance risk, which is tracked separately from operations.

96. In risk management, what is 'Risk Acceptance'?
    • Choosing to bear a risk without adding new defenses
    • Choosing to buy insurance so the insurer holds risk
    • Choosing to stop the activity that creates the risk
    • Choosing to add controls that shrink the risk level

    Correct answer: Choosing to bear a risk without adding new defenses

    Risk acceptance is a deliberate, documented decision to carry a risk as it stands because the exposure sits inside what the organization tolerates and further treatment is not worth the cost. Buying cover so an insurer carries the loss is transference. Stopping the activity that creates the exposure is avoidance. Adding controls to shrink the exposure is mitigation. Acceptance is the only one of the four that changes nothing about the risk itself.

97. What is a 'Risk Threshold' in the context of risk management?
    • The total risk left once the safeguards are applied
    • The exposure measure at which a risk gets escalated
    • The average risk that a whole portfolio now carries
    • The share of risk that a contracted partner absorbs

    Correct answer: The exposure measure at which a risk gets escalated

    A risk threshold is the defined trigger point: once the measured exposure crosses it, the risk can no longer be handled routinely and must be escalated or treated. What is left once safeguards are applied is residual risk. An average across the portfolio is a summary statistic that no decision hangs on. The share a partner contractually absorbs describes transferred risk rather than the point at which action becomes mandatory.

98. In risk management, what is the primary purpose of 'Continuous Monitoring'?
    • It sets a one-off baseline that then goes unchecked
    • It reports the budget spent on the security program
    • It schedules a single yearly review of the controls
    • It rechecks how well each control performs each day

    Correct answer: It rechecks how well each control performs each day

    Continuous monitoring keeps security posture under near-real-time observation, rechecking control performance so that failures, configuration drift and new exposures surface between formal assessments instead of months later. A baseline set once and then left unchecked is the opposite of continuous. Reporting program spend is a budget activity. A single annual review is periodic assessment, and the gap between reviews is exactly what continuous monitoring exists to close.

99. Which document in risk management outlines the overall risk strategy and policies of an organization?
    • A policy setting out the firm's overall risk aims
    • A plan describing which steps follow a risk event
    • A study ranking the overall risk to each function
    • A register naming each active risk and its holder

    Correct answer: A policy setting out the firm's overall risk aims

    A risk management policy is the governing document: it states the organization's overall risk aims, who owns risk decisions, how risk is measured and what tolerances apply. The steps that follow a risk event belong in a response plan. A study ranking exposure across critical functions is a business impact analysis. A register of active risks with named holders is the risk register, an operational record produced under the policy rather than the policy itself.

100. What role does 'Due Diligence' play in risk management?
     • It is the summary of a risk found during a review
     • It is the transfer of a risk onto a partner group
     • It is the scrutiny needed to spot a risk early on
     • It is the decision to run a risk that stays small

     Correct answer: It is the scrutiny needed to spot a risk early on

     Due diligence is the reasonable investigation an organization performs before committing itself, so that risks in a vendor, an acquisition or a new system are spotted and addressed while there is still time to act. A summary written up after a review is evidence produced after the fact. Shifting a risk onto a partner group is transference. Running a risk that stays inside tolerance is acceptance, a decision that due diligence informs but is not the same as.

101. Which term describes the process of prioritizing risks for further analysis or action by assessing their likelihood and impact?
     • Risk acceptance
     • Risk governance
     • Risk monitoring
     • Risk assessment

     Correct answer: Risk assessment

     Risk assessment is the process that examines identified risks, judges how likely each is and how much damage it would do, and ranks them so that further analysis or treatment can be aimed at the worst first. Risk acceptance is a treatment decision taken about a single risk. Risk governance is the oversight structure that sets policy and assigns authority. Risk monitoring watches risks and controls over time, after they have already been assessed and treated.

102. In risk management, what does 'Annual Loss Expectancy' (ALE) represent?
     • The cost of the controls bought in one fiscal year
     • The largest blow the firm could absorb in one year
     • The loss an asset is expected to sustain each year
     • The money that a single incident costs in one year

     Correct answer: The loss an asset is expected to sustain each year

     Annualized loss expectancy is the expected yearly loss for an asset from a given risk, found by multiplying single loss expectancy by the annualized rate of occurrence. The cost of controls bought during the year is spending, not expected loss. The largest blow a firm could survive is a solvency limit. The money one incident costs is single loss expectancy, the per-event figure that annualized loss expectancy is built from.

103. Which cryptographic attack involves attempting to decrypt a cipher by trying every possible key?
     • Rainbow table lookup
     • Brute force recovery
     • Padding oracle abuse
     • Session token replay

     Correct answer: Brute force recovery

     Brute force recovery is the attack that simply walks the entire key space, testing candidate keys one after another until the ciphertext decrypts to something meaningful; only key length makes it impractical. A rainbow table lookup reverses stored password hashes using precomputed chains, not cipher keys. Padding oracle abuse reads a server's padding error responses to peel off plaintext without ever guessing a key. Session token replay reuses a captured token and defeats no cipher at all.

104. Which cryptographic principle prevents the sender of a message from denying the message's content and transmission?
     • Non-repudiation proofs
     • Confidentiality shield
     • Integrity verification
     • Authentication factors

     Correct answer: Non-repudiation proofs

     Non-repudiation is the property that stops a sender from later denying that they produced and sent a message; a private-key digital signature supplies it because only the signer holds the key. Confidentiality keeps the content unreadable by outsiders but says nothing about who sent it. Integrity shows that content was not altered in transit, yet an altered-free message can still be disowned. Authentication proves who a party is at the time of a session, without binding them to a specific message afterwards.

105. What is the main difference between symmetric and asymmetric encryption?
     • The size of the block each cipher shifts at once
     • The kind of data each cipher is allowed to guard
     • The number of the keys each cipher needs to work
     • The type of hash each cipher must apply up front

     Correct answer: The number of the keys each cipher needs to work

     The defining difference is key count and key relationship: symmetric encryption uses one shared secret for both directions, while asymmetric encryption uses a mathematically linked public and private pair. Block size varies among algorithms within both families and separates nothing. Neither family restricts the kind of data it may protect. Neither family requires a hash before encrypting, and hashing is a separate primitive used alongside either one.

106. Which of the following algorithms is not a symmetric key algorithm?
     • AES
     • RSA
     • RC4
     • DES

     Correct answer: RSA

     RSA is the odd one out because it is asymmetric: it works with a linked public and private key pair, and its security rests on the difficulty of factoring large numbers. AES is the symmetric block cipher that replaced DES as the standard. RC4 is a symmetric stream cipher, now deprecated. DES is the original symmetric block cipher whose short key made it obsolete. All three of those use the same secret to encrypt and to decrypt.

107. What cryptographic concept involves the use of two keys, a public key for encryption, and a private key for decryption?
     • Symmetric enciphering
     • Cryptographic digests
     • Block-cipher chaining
     • Asymmetric encryption

     Correct answer: Asymmetric encryption

     Asymmetric encryption is built on a linked key pair: anyone may encrypt with the freely published public key, and only the matching private key held by the recipient can decrypt the result. Symmetric enciphering uses one secret for both operations. Cryptographic digests are one-way and cannot be reversed with any key at all. Block-cipher chaining is a mode of operation that links blocks together and introduces no second key.

108. In cryptography, what is a 'collision'?
     • Two unlike messages that share one hash value
     • Two unlike keys that give the same ciphertext
     • Two unlike sessions that reuse a single nonce
     • Two unlike packets that arrive in wrong order

     Correct answer: Two unlike messages that share one hash value

     A collision occurs when two different inputs share an identical digest from the same hash function; because a hash maps unlimited input to a fixed-length output, collisions must exist, and a strong function makes finding one infeasible. Two keys producing matching ciphertext is not what the term names. Reusing a nonce across sessions is a separate weakness in a mode of operation. Packets arriving in the wrong order is a transport condition with no hashing involved.

109. Which cryptographic method is primarily used to ensure the integrity of data?
     • Asymmetric encryption
     • Steganographic hiding
     • Cryptographic hashing
     • Deterministic padding

     Correct answer: Cryptographic hashing

     Cryptographic hashing is the primary integrity mechanism: recompute the digest and compare it, and any change of even one bit produces a completely different value. Asymmetric encryption protects confidentiality and enables key exchange, but ciphertext can still be corrupted without detection. Steganographic hiding conceals that a message exists and does nothing to prove it is unchanged. Deterministic padding only fills a block to the required size and carries no verification value.

110. In PKI, what is the main purpose of a key escrow?
     • To recover data after a private key is destroyed
     • To shorten the delay a handshake takes to finish
     • To raise the strength of the chosen cipher suite
     • To publish a record of the certificates now void

     Correct answer: To recover data after a private key is destroyed

     The business reason for escrowing keys is recoverability: if an employee leaves, a device fails or a key is destroyed, encrypted data would be permanently unreadable unless a protected copy of the key exists. Escrow adds a step to key management and shortens no handshake. It changes nothing about the algorithm or key length, so cipher strength is unaffected. Publishing a record of void certificates is the job of a revocation list or an online status responder.

111. What is the primary purpose of using a salt in cryptographic hashing?
     • It hides the hash output from the casual user
     • It makes each stored hash value end up unique
     • It shrinks the data before the hash is formed
     • It speeds up the hash routine on shared files

     Correct answer: It makes each stored hash value end up unique

     A salt is a random value added to the input before hashing, so two users who choose the same password still store different digests, and precomputed tables built for unsalted hashes become useless. A salt does not conceal the stored output, which is usually readable to anyone with database access. It adds input rather than compressing it. It adds work rather than saving it, and slowing the routine down is often deliberate.

112. What is the primary difference between stream ciphers and block ciphers in cryptography?
     • The length of the keys that each one accepts
     • The number of the rounds that each one makes
     • The type of medium that each one can protect
     • The way that each one takes in its plaintext

     Correct answer: The way that each one takes in its plaintext

     The categories are defined by how plaintext is taken in: a stream cipher runs a keystream against the data bit by bit or byte by byte, while a block cipher gathers plaintext into fixed-size blocks and transforms one block at a time. Accepted key lengths vary between individual algorithms inside both families. Round count is an internal design detail of a particular algorithm. Neither family is restricted to a particular kind of medium.

113. Which of the following best describes a man-in-the-middle attack in the context of cryptography?
     • An attacker breaks the code without a valid key
     • An attacker floods a link until it drops frames
     • An attacker sits between two peers to pass data
     • An attacker forges a digest so a file validates

     Correct answer: An attacker sits between two peers to pass data

     A man-in-the-middle attack puts the adversary in the path of a conversation: each party believes it is talking to the other, while the attacker passes traffic along and can read or alter everything. Breaking a code outright is cryptanalysis and needs no interposed position. Flooding a link until frames drop is a denial-of-service condition. Forging a digest so a file validates is a collision attack against the hash function itself.

114. What is the primary function of the Diffie-Hellman algorithm in cryptography?
     • Shared secret creation
     • Bulk data encipherment
     • Digital file signature
     • Fast message digesting

     Correct answer: Shared secret creation

     Diffie-Hellman lets two parties create a shared secret over a channel an eavesdropper can watch, because each side combines its own private value with the other's public value and reaches the same result. It does not encipher bulk data; the shared secret is handed to a symmetric cipher for that. It produces no signature and proves nothing about identity on its own. It produces no digest, so it performs no hashing.

115. Which cryptographic protocol provides security for electronic data interchange (EDI) transactions?
     • The IKE exchange
     • The RADIUS proxy
     • The SRTP streams
     • The SET protocol

     Correct answer: The SET protocol

     Secure Electronic Transaction was designed specifically to protect commercial transaction data as it moves between the parties to a trade, wrapping the order and payment details in certificates so each side proves who it is. The IKE exchange negotiates keys for a network-layer tunnel. A RADIUS proxy forwards authentication and accounting for network access. SRTP encrypts real-time voice and video streams. None of those three was built to secure trading documents.

116. In cryptography, what is the main purpose of a Certificate Revocation List (CRL)?
     • It names the preloaded roots that a platform validates
     • It names the certificates that an issuer has withdrawn
     • It names the algorithms that a server advertises today
     • It names the hostnames where a certificate stays valid

     Correct answer: It names the certificates that an issuer has withdrawn

     A certificate revocation list is the issuer's published record of certificates that are no longer to be trusted, because a key was compromised, an owner left, or details changed before the natural expiry date. Preloaded roots live in the relying party's own trust store. Advertised algorithms are proposed during the handshake. Valid hostnames are carried inside the certificate itself, in its subject and alternative name fields.

117. What cryptographic concept involves splitting data into parts where individual parts do not reveal the whole?
     • Escrowed private keys
     • Reversible data masks
     • Rotating nonce values
     • Shamir secret sharing

     Correct answer: Shamir secret sharing

     Shamir secret sharing splits a secret into shares and sets a threshold, so any group smaller than the threshold learns absolutely nothing while a large enough group can rebuild the original. Escrowed private keys are whole keys held in custody, not fragments. Reversible data masks substitute readable values and can be undone by whoever holds the mapping. Rotating nonce values replace one complete value with another and never divide a secret into parts.

118. Which property of cryptographic hash functions ensures that, if two different messages produce the same hash, it's computationally infeasible to find them?
     • Collision resistance
     • Fixed-size digesting
     • Deterministic output
     • Uniform distribution

     Correct answer: Collision resistance

     Collision resistance is the property named: it must be computationally infeasible to discover any two inputs that map to one digest, which is what keeps signatures and file checksums trustworthy. Fixed-size digesting only means every input yields an output of the same length, and it is the very reason collisions must exist. Deterministic output means one input always yields the same digest. Uniform distribution describes how outputs spread across the range, not how hard it is to find a matching pair.

119. In the context of PKI, what does the term 'chain of trust' refer to?
     • The order in which a cipher repeats its own rounds
     • The chain of trusted issuers that ends at the root
     • The lineup of ciphers a client offers in the hello
     • The bundle of keys shared by two peers per session

     Correct answer: The chain of trusted issuers that ends at the root

     The chain of trust is the certificate path: the end-entity certificate is signed by an intermediate authority, which is signed by another, up to a root the relying party already trusts, and each link is verified in turn. The order of cipher rounds is an internal algorithm detail. The lineup a client offers is the handshake proposal. The keys two peers share for a session are established after the chain has already been validated.

120. A security analyst needs to encrypt several terabytes of database backups quickly using a single shared secret, and separately needs a way for two parties who have never met to agree on that secret over an untrusted network. Which combination correctly matches each task to the right cryptography type?
     • Use one shared secret for both tasks, sent by hand
     • Use a public key pair for both tasks, however slow
     • Use a shared secret for copies, a key-pair to swap
     • Use a one-way hash for backups, a courier for keys

     Correct answer: Use a shared secret for copies, a key-pair to swap

     Each type is used where it is strong: a shared secret cipher encrypts terabytes quickly, and a public and private key pair lets two strangers settle that secret across an untrusted link without ever transmitting it. Using one shared secret for both tasks leaves the original problem of getting that secret to the far end, and hand delivery does not scale. A key pair is far too slow for terabytes. A one-way hash cannot restore a backup, and a courier is not a cryptographic mechanism.

121. An organization cannot patch a legacy payroll server because the vendor no longer supports it, but a policy requires that all systems handling sensitive data be on a supported, patched platform. To satisfy the requirement's intent, the team isolates the server on its own segmented VLAN behind strict firewall rules. According to CompTIA's control taxonomy, what BEST describes this firewall-and-segmentation measure?
     • A compensating safeguard
     • A preventative screening
     • A managerial instruction
     • A corrective improvement

     Correct answer: A compensating safeguard

     A compensating safeguard is an alternative put in place when the required primary measure cannot be implemented, and it must deliver comparable protection; segmenting an unpatchable server behind strict filtering is the textbook example. A preventative screening stops an event before it starts, which is not possible here because the flaw remains present. A managerial instruction is written direction such as a policy. A corrective improvement restores a system after an incident has already occurred.

122. A help-desk analyst is asked to define malware for a new-hire onboarding deck. Which description most accurately captures what malware is?
     • Software sold by a vendor without a written test plan
     • Software able to conceal its own bugs and crash dumps
     • Software licensed to run on a limited number of hosts
     • Software built to damage a computer or steal its data

     Correct answer: Software built to damage a computer or steal its data

     Malware is defined by intent: it is any program written deliberately to damage, disrupt, or obtain unauthorized access to a computer or the data on it. Software sold without a written test plan may be defective, but poor quality is not malicious intent. Software able to conceal its own bugs and crash dumps is behaving badly, yet it neither damages the host nor takes data. Software restricted to a set number of hosts is simply licensed that way, which is a commercial term rather than an attack.

123. An employee receives a text message claiming to be from the company's IT department, urging them to click a link to 'reverify' their VPN credentials. What type of attack is this?
     • Pharming attacks
     • Smishing tactics
     • Whaling campaign
     • Vishing attempts

     Correct answer: Smishing tactics

     Smishing is phishing delivered by text message: the lure arrives as an SMS and pushes the target to a link or a phone number to surrender credentials. Pharming does not send a message at all; it corrupts name resolution so a correctly typed address lands on the attacker's server. A whaling campaign targets a senior executive, usually by email, and this employee is not one. Vishing is carried out over a live voice call rather than in writing.

124. A finance manager gets a phone call from someone claiming to be the company's bank, using urgency and an official-sounding script to extract account verification details. This social-engineering technique is best described as which of the following?
     • Smishing messages
     • Typosquat domains
     • Vishing callbacks
     • Session hijacking

     Correct answer: Vishing callbacks

     Vishing is voice phishing: the attacker calls, adopts an authoritative identity such as the bank, and uses time pressure to talk the target into revealing account details. Smishing runs over text messages, not a live call. Typosquat domains wait for a victim to mistype an address and involve no conversation. Session hijacking steals an authenticated session token over the network and never requires the victim to speak to anyone.

125. A security team detects an intruder who maintained covert access to the network for eight months, moving laterally and exfiltrating intellectual property in small amounts to avoid detection. This pattern is most characteristic of which threat?
     • Random ransomware outbreak
     • Advanced persistent threat
     • Automated worm propagation
     • Delayed logic-bomb payload

     Correct answer: Advanced persistent threat

     An advanced persistent threat is defined by exactly this profile: a well-resourced adversary that gains a foothold, stays hidden for months, moves laterally, and steals data slowly enough to stay under detection thresholds. A ransomware outbreak announces itself immediately because encrypting files is the goal. Worm propagation is automatic and noisy, spreading as fast as the network allows. A logic bomb waits for a trigger and then fires once; it does not roam a network for months.

126. An attacker crafts an email that appears to come from a specific manager and is addressed to one named employee in accounting, referencing a real recent project. What type of attack is this?
     • Untargeted mass mail
     • Watering hole ambush
     • Rear door tailgating
     • Spear phishing email

     Correct answer: Spear phishing email

     Spear phishing is targeted: the message is written for one named recipient, borrows a real internal identity, and references genuine context so it survives scrutiny that a generic lure would not. Untargeted mass mail goes to thousands with no personalisation. A watering hole ambush compromises a site the victims already visit and waits for them, sending no message. Tailgating is a physical entry technique and has nothing to do with email.

127. A CEO receives a highly personalized fraudulent email impersonating a board member and requesting an urgent confidential wire transfer. Because the target is a senior executive, this attack is specifically classified as which of the following?
     • Whaling email lures
     • Smishing text pings
     • Pretext phone calls
     • Rogue access points

     Correct answer: Whaling email lures

     Whaling is the name given to phishing aimed at a high-value executive; the payoff justifies deep research, and requests for confidential wire transfers are the classic payload. Smishing arrives by text message rather than email. Pretext phone calls use a fabricated story over a live voice channel. Rogue access points are wireless devices planted to intercept traffic, which is a network attack rather than a targeted message to a chief executive.

128. A fraudulent message impersonating a vendor instructs an accounts-payable clerk to change the bank account on file so future invoice payments are redirected to the attacker. This scheme is best described as which of the following?
     • Malicious cache poisoning
     • Stored cross-site scripts
     • Business email compromise
     • Targeted rainbow cracking

     Correct answer: Business email compromise

     Business email compromise is the fraud in which an attacker impersonates a trusted counterparty over email to reroute legitimate payments, and vendor bank-detail changes are its most common form. Cache poisoning corrupts resolver records to misdirect traffic and sends no invoice instruction. Stored cross-site scripts run in a visitor's browser from a vulnerable page. Rainbow cracking reverses stolen password hashes and plays no part in redirecting a payment.

129. Before launching an attack, an adversary calls an employee while posing as a new auditor and invents a detailed backstory to justify requesting system access. The fabricated scenario the attacker uses is known as what?
     • Quiet tailgating entry
     • Pretexting cover story
     • Watering hole planting
     • Sudden privilege climb

     Correct answer: Pretexting cover story

     Pretexting is the invention of a believable scenario and false identity that gives the attacker a reason to ask for what they want, and posing as an auditor with a detailed backstory is a standard version of it. Tailgating is following someone through a controlled door. Watering hole planting seeds malware on a site the targets already trust. Privilege escalation happens after access is obtained and describes gaining higher rights, not the story used to gain entry.

130. A user reports that their banking passwords were stolen even though they never visited a malicious site. Investigation reveals software that silently records every keystroke and emails the log to an external server. What is this software?
     • Keylogger implant
     • Ransomware locker
     • Backdoor listener
     • Polymorphic virus

     Correct answer: Keylogger implant

     A keylogger captures every key the victim presses and ships the record to the attacker, which explains stolen credentials with no malicious website ever visited. Ransomware announces itself by encrypting files and demanding payment. A backdoor listener opens a channel for remote command access but does not by itself record typing. A polymorphic virus rewrites its own code to evade signatures; that is an evasion technique rather than a credential-capture method.

131. A user installs a free utility that secretly monitors browsing habits and transmits personal data to an advertiser without consent. Which type of malware best describes this?
     • A ransomware locker
     • A boot-sector virus
     • A spyware collector
     • A self-copying worm

     Correct answer: A spyware collector

     Spyware is software that gathers information about a user without consent and passes it to a third party, which is exactly what a free utility reporting browsing habits to an advertiser is doing. Ransomware denies access to data and demands payment. A boot-sector virus infects startup code to gain control before the operating system loads. A worm copies itself across a network on its own and is defined by spreading, not by covert data collection.

132. A current employee with legitimate database access copies the customer list before resigning to join a competitor. What category of threat does this represent?
     • Careless script kiddie
     • Foreign espionage crew
     • Upstream vendor breach
     • Trusted insider misuse

     Correct answer: Trusted insider misuse

     This is insider misuse: the person already holds authorised access, so nothing has to be broken into, and the harm comes from using legitimate rights for an unapproved purpose. A script kiddie is an unskilled outsider running borrowed tools. A foreign espionage crew is an external state-backed actor. An upstream vendor breach reaches the organization through a supplier's product or access, whereas here the actor is on the payroll and entitled to the data.

133. A piece of malware is engineered to hide at the operating-system kernel level, intercepting system calls so that its files and processes are invisible to standard antivirus tools. What is this malware?
     • Rootkit driver
     • Adware toolbar
     • Trojan bundles
     • Botnet beacons

     Correct answer: Rootkit driver

     A rootkit installs at the deepest privilege level available and hooks system calls so that its own files, processes and registry entries are filtered out of any answer the operating system gives; that is why ordinary scanners see nothing. An adware toolbar is visible by design and shows unwanted advertising. Trojan bundles hide inside software the user chose to install but do not subvert the kernel. Botnet beacons call home for orders and hide traffic, not the kernel.

134. A vulnerability has been discovered and exploited in the wild, but the software vendor is not yet aware of it and no patch exists. What is this vulnerability called?
     • Classic race condition
     • Zero-day software flaw
     • Lax firewall exception
     • Known unpatched defect

     Correct answer: Zero-day software flaw

     A zero-day is a flaw already being exploited while the vendor is still unaware of it, so no fix exists and signature-based defenses have nothing to match. A race condition is a timing defect that may be perfectly well known. A permissive firewall exception is a configuration weakness rather than a defect in code. A known unpatched defect is the opposite case: the vendor has published a fix and the organization has simply not applied it.

135. A web application checks whether a user has permission to access a file and then opens it as two separate steps. An attacker exploits the brief gap between the check and the use to swap the file. This class of vulnerability is known as what?
     • A downgrade rollback
     • A precomputed lookup
     • A memory-leak defect
     • A race-condition bug

     Correct answer: A race-condition bug

     A race condition of the time-of-check to time-of-use kind arises because the security decision and the action on the resource are separate operations, and anything that changes between them is not re-validated. A downgrade rollback forces a weaker protocol version during negotiation. A precomputed lookup reverses hashes from a prepared table. A memory-leak defect exhausts resources over time and involves no window between a check and its use.

136. An attacker uses an automated tool to try every possible password combination against a login until one succeeds. What is this attack called?
     • Dictionary attack
     • Password spraying
     • Brute-force crack
     • Rainbow-table hit

     Correct answer: Brute-force crack

     Brute forcing works through the entire candidate space one combination at a time, which is why it always succeeds eventually and why length and lockout thresholds matter so much. A dictionary attack tries only a prepared word list, which is a small fraction of the space. Password spraying tries a handful of very common passwords against many accounts to stay under lockout limits. A rainbow-table hit reverses a stolen hash offline and never touches the login page.

137. An attacker attempts to gain access to an account by trying a precompiled list of common words and known passwords rather than every possible combination. Which attack is this?
     • Password spraying
     • Dictionary attack
     • Pass-the-hash run
     • Rainbow-table hit

     Correct answer: Dictionary attack

     A dictionary attack draws from a prepared list of real words and previously leaked passwords, which succeeds quickly against human-chosen credentials while testing a tiny fraction of the possible combinations. Password spraying tries a few very common passwords against many accounts instead of many passwords against one. Pass-the-hash reuses a stolen hash without ever recovering the password. A rainbow-table hit reverses captured hashes offline rather than guessing at a login.

138. An attacker obtains a database of password hashes and uses a large set of precomputed hash-to-plaintext tables to reverse them quickly. What technique is being used, and what control best defeats it?
     • Dictionary attack, blocked by fast account lockout
     • Credential stuffing, blocked by new device binding
     • Rainbow table lookups, blocked by randomized salts
     • Password spraying, blocked by login rate throttles

     Correct answer: Rainbow table lookups, blocked by randomized salts

     Precomputed hash-to-plaintext tables are the signature of rainbow table lookups, and a unique random salt per password defeats them because the attacker's tables were built for unsalted input and would have to be rebuilt for every salt. A dictionary attack guesses words live rather than reversing a stolen hash file. Credential stuffing replays credentials leaked from another site. Password spraying tries a few common passwords widely; none of those three uses precomputed tables.

139. An attacker inserts a malicious database command into a web form's input field to read and modify records the application should not expose. This attack and its primary mitigation are best described as which of the following?
     • XSS scripting, stopped by strict output encoding
     • ARP poisoning, stopped by dynamic ARP inspection
     • CSRF attacks, stopped by per-session form tokens
     • SQL injection, stopped by bound query parameters

     Correct answer: SQL injection, stopped by bound query parameters

     Placing database syntax into an input field so the server executes it is SQL injection, and bound query parameters fix it at the root by sending the statement and the data separately so user input can never become code. Cross-site scripting puts browser script into a page rather than commands into a database. ARP poisoning misdirects traffic on the local link. Cross-site request forgery rides a victim's existing session; none of those three is a database command.

140. An attacker injects a malicious script into a vulnerable web page so that the script executes in the browsers of other visitors, stealing their session cookies. What is this attack?
     • Stored cross-site scripting
     • Server-side request forgery
     • Unrestricted file uploading
     • Encoded directory traversal

     Correct answer: Stored cross-site scripting

     Cross-site scripting places attacker script into a page so that it runs inside other visitors' browsers under the site's own origin, which is what makes session cookies reachable. Server-side request forgery makes the server itself issue requests the attacker chooses, targeting internal systems rather than visitors. Unrestricted file uploading lets a hostile file reach the server. Encoded directory traversal reads files outside the web root; none of those three executes in another visitor's browser.

141. An attacker registers the domain 'gooogle-login.com' hoping users who mistype the real address will land on a fake credential-harvesting page. This technique is known as what?
     • A typosquatting lure
     • A watering-hole trap
     • A shoulder-surf peek
     • A pretexting session

     Correct answer: A typosquatting lure

     Typosquatting registers names that are near misses for a popular address, betting on slips of the keyboard to deliver visitors to a lookalike page. A watering-hole trap compromises a legitimate site the targets already visit rather than registering a new name. Shoulder surfing is observing a screen or keypad in person. A pretexting session relies on a fabricated story told to a victim; none of the three depends on a mistyped address.

142. An attacker corrupts the cached records of a DNS resolver so that users requesting a legitimate banking site are silently redirected to a malicious server. What is this attack called?
     • ARP address spoofing
     • TLS cipher downgrade
     • SSL stripping attack
     • DNS record poisoning

     Correct answer: DNS record poisoning

     Corrupting the entries a resolver has cached is DNS poisoning: the resolver hands out the attacker's address for a legitimate name, so the victim's browser goes to the wrong server while the address bar still looks correct. ARP spoofing works at the local link layer using hardware addresses. A cipher downgrade forces weaker negotiated protection. SSL stripping removes the upgrade to an encrypted session; none of those three rewrites cached name records.

143. After a ransomware event, an organization restores from its most recent backup and discovers it lost roughly four hours of customer transactions. Which resilience metric describes the maximum amount of data, measured in time, that the organization is willing to lose?
     • The RTO target
     • The RPO figure
     • The MTTR timer
     • The MTBF value

     Correct answer: The RPO figure

     The recovery point objective states how much data, expressed as a span of time, the organization accepts losing in a disaster, and it therefore sets how often backups must run; a four-hour loss means the objective was four hours or the schedule missed it. The recovery time objective is about how quickly service must return, not how much data may vanish. Mean time to repair measures restoration effort. Mean time between failures measures reliability of a component.

144. A business continuity team states that a critical order-entry application must be fully operational within two hours of any outage. Which metric does this two-hour target represent?
     • The MTBF gauge
     • The RPO window
     • The RTO target
     • The MTD budget

     Correct answer: The RTO target

     A deadline for having a service running again is the recovery time objective: it is the maximum period the business will tolerate between the outage starting and the application being usable once more. Mean time between failures describes how long hardware runs before it breaks. The recovery point objective describes acceptable data loss. Maximum tolerable downtime is the outer limit past which the business itself fails, and the recovery time objective is deliberately set inside it.

145. A reliability engineer reports that a fleet of identical disk controllers has a mean time between failures of 100,000 hours. What does this MTBF value primarily help the organization predict?
     • How long a restoration of the failed unit takes
     • How long a fixable unit runs between two faults
     • How much of the newest data a recovery forfeits
     • How many spare units the vendor should hold now

     Correct answer: How long a fixable unit runs between two faults

     Mean time between failures is a reliability prediction for repairable equipment: it estimates the average span a unit will operate before the next fault, which is what drives maintenance intervals and spare-part planning. How long a restoration takes is mean time to repair. How much of the newest data a recovery forfeits is the recovery point objective. How many spares to hold is a procurement decision that the figure informs but does not state.

146. An incident manager wants to track how long, on average, the operations team takes to restore a failed service after detecting an outage. Which metric should be reported?
     • The average time taken to restore one failed service
     • The average gap between a service outage and another
     • The quantity of data that a recovery would sacrifice
     • The number of failures registered in a calendar year

     Correct answer: The average time taken to restore one failed service

     Mean time to repair is the average elapsed time from the moment a failure is detected to the moment service is restored, so it measures how effective the response and repair process is. The average gap between one service outage and the next is mean time between failures, a reliability rather than a response figure. The data a recovery would sacrifice is the recovery point objective. A count of failures per calendar year is the annualized rate of occurrence.

147. A web application experiences traffic spikes that overwhelm a single server. A security analyst recommends a device that distributes incoming requests across several backend servers and removes unhealthy nodes from rotation. Which technology is being described?
     • A forward proxy
     • A packet filter
     • A load balancer
     • A syslog server

     Correct answer: A load balancer

     A load balancer sits in front of a pool of servers, spreads incoming requests across them, and uses health checks to stop sending work to a node that has failed, which is exactly the behaviour described. A forward proxy brokers outbound requests on behalf of internal clients. A packet filter permits or denies traffic by header fields. A syslog server collects log messages centrally; none of those three distributes a workload across backend servers.

148. A storage administrator configures four drives so that data and parity are striped across all of them, allowing the array to keep operating if any single drive fails. Which storage resilience technology is in use?
     • A SAN volume
     • A NAS export
     • A JBOD shelf
     • A RAID array

     Correct answer: A RAID array

     Striping data with parity across several drives so the set survives one drive loss is a RAID array; the parity information lets the missing blocks be recalculated while the array stays online. A storage area network volume is block storage delivered over a fabric and says nothing about redundancy inside it. A network attached storage export is a file share. A shelf of independent disks presents each drive on its own with no parity and no fault tolerance.

149. A network engineer needs administrators to reach internal production servers without exposing those servers directly to remote-access connections. The chosen design routes all administrative sessions through a single hardened, heavily monitored host. What is this host called?
     • A jump server
     • A relay agent
     • A proxy cache
     • A web gateway

     Correct answer: A jump server

     A jump server is a single hardened, closely monitored system that administrators connect to first and from which they reach protected hosts, so production systems never accept remote sessions directly. A relay agent forwards a specific protocol's messages between segments. A proxy cache stores retrieved content to serve it again quickly. A web gateway inspects and filters user browsing; none of those three is designed as the controlled entry point for administrative access.

150. An organization handles personal data for European customers and must ensure that data is stored and processed according to the laws of the country where it physically resides, even when using a global cloud provider. Which concept governs this requirement?
     • Data obfuscation
     • Data sovereignty
     • Data replication
     • Data portability

     Correct answer: Data sovereignty

     Data sovereignty is the principle that information is subject to the laws of the country in which it is physically stored, which is why organizations must choose cloud regions deliberately rather than letting a provider place data anywhere. Data obfuscation disguises values so they are less useful if exposed. Data replication copies data to additional locations, which can make the sovereignty problem worse. Data portability is the ability to move data between providers on request.

151. To prevent an industrial control system from being reached by malware spreading on the corporate network, engineers physically disconnect it from all other networks so there is no electronic path between them. Which protective measure is this?
     • Perimeter routing
     • Wireless bridging
     • Tunnel encryption
     • Air-gap isolation

     Correct answer: Air-gap isolation

     An air gap is physical isolation: there is no cable, no wireless link and no shared device between the protected system and any other network, so network-borne malware has no route at all. Perimeter routing still carries traffic between zones through a controlled device. Wireless bridging creates a link rather than removing one. Tunnel encryption protects traffic in transit but leaves a live connection in place, which is precisely what an air gap refuses to have.

152. A company wants remote employees and branch offices to reach cloud applications securely while applying consistent inspection and zero trust access policies from the cloud, converging SD-WAN with security functions such as SWG, CASB, and ZTNA. Which architecture best fits this goal?
     • The NGFW model
     • The MPLS model
     • The SASE model
     • The SIEM model

     Correct answer: The SASE model

     Secure access service edge is the architecture that folds network connectivity and security controls into one cloud-delivered service, so remote users and branches receive the same inspection and zero trust policy wherever they connect from. A next-generation firewall is an appliance model that backhauls remote traffic to a data centre. A multiprotocol label switching network provides transport with no security stack. A security information and event management platform analyses logs after the fact.

153. A remote worker needs to access internal corporate resources over the public internet as though directly on the office LAN. The solution creates an encrypted tunnel between the worker's device and the corporate gateway. Which technology provides this?
     • A virtual private network (VPN) solution
     • A web application firewall (WAF) gateway
     • A public key infrastructure (PKI) server
     • A host intrusion prevention (HIPS) agent

     Correct answer: A virtual private network (VPN) solution

     A virtual private network builds an encrypted tunnel from the remote device to the corporate gateway, so traffic crosses the public internet protected and the host reaches internal resources as though it were cabled to the office LAN. A web application firewall inspects requests aimed at a published web application; it shields a server and never places a remote client onto the internal network. A public key infrastructure server issues, publishes and revokes certificates, supplying trust material rather than carrying traffic anywhere. A host intrusion prevention agent blocks hostile activity on the one machine it runs on and creates no remote-access path at all.

154. A security architect is designing a site-to-site connection and wants a protocol suite that authenticates and encrypts IP packets, supporting both an authentication-only mode and an encrypting mode using ESP. Which protocol suite meets this need?
     • The SMTP electronic mail protocol
     • The IPsec packet protection suite
     • The SNMPv3 network device monitor
     • The NetBIOS local session service

     Correct answer: The IPsec packet protection suite

     IPsec secures IP itself: the Authentication Header gives integrity and origin authentication with no encryption, while Encapsulating Security Payload adds confidentiality, and because it works at the network layer every protocol above it inherits the protection. That is exactly what a site-to-site tunnel needs. SMTP only relays mail between servers and carries no packet-level cryptography of its own. SNMPv3 polls and receives traps from managed devices; it protects its own management messages and leaves the rest of the traffic untouched. NetBIOS session service sets up legacy name-based sessions and has no authentication or encryption capability whatsoever.

155. A network administrator wants to require that any device plugging into a switch port must authenticate to a RADIUS server before being granted network access, using EAP for the authentication exchange. Which standard provides this port-based access control?
     • The IEEE 802.1Q frame identification standard
     • The IEEE 802.1AE hardware encryption standard
     • The IEEE 802.1X supplicant admission standard
     • The IEEE 802.1AB adjacency discovery standard

     Correct answer: The IEEE 802.1X supplicant admission standard

     802.1X defines port-based network access control: the connecting device acts as a supplicant, the switch acts as authenticator, and EAP carries the exchange to a RADIUS server, which decides whether the port is opened for general traffic. It is the foundation most network access control deployments are built on. 802.1Q inserts a VLAN tag into the Ethernet frame so a trunk can identify which VLAN a frame belongs to, which is segmentation rather than authentication. 802.1AE encrypts frames hop by hop once a link is already trusted. 802.1AB lets a device advertise itself so neighbours can be mapped.

156. A security operations team wants a single platform that collects log and event data from servers, firewalls, and applications across the enterprise, normalizes it, and correlates events to generate alerts and support investigations. Which type of system provides this capability?
     • DLP, a content classification platform
     • NAC, a compliance enforcement platform
     • FDE, a workstation encryption platform
     • SIEM, a centralized analytics platform

     Correct answer: SIEM, a centralized analytics platform

     A SIEM is the one product in this group built to take log and event records from servers, firewalls and applications, put them into a common format, correlate them against rules and raise the alerts and reports an analyst works from. DLP classifies content and stops sensitive material from leaving the organization; it never becomes the central record of everything that happened. NAC checks the posture of a device and decides whether it may join the network at all, a decision made before any correlation could occur. FDE encrypts a machine's disk so a stolen laptop yields nothing, which protects data at rest and produces no cross-source visibility.

157. An organization deploys a tool that automatically executes predefined playbooks to enrich, triage, and respond to alerts across multiple security products, reducing manual analyst effort. Which security operations capability is this?
     • SOAR, a workflow orchestration platform
     • SIEM, a historical correlation platform
     • EDR, a workstation containment platform
     • FIM, a configuration integrity platform

     Correct answer: SOAR, a workflow orchestration platform

     SOAR is the layer that holds the playbooks: it connects to the other security products through their APIs and executes enrichment, triage and containment steps in sequence, so work an analyst would otherwise repeat by hand happens automatically. A SIEM detects by correlating collected records and hands the analyst an alert, but it does not drive multi-product response on its own. EDR acts on one endpoint at a time, isolating or cleaning that host rather than coordinating action across a whole toolset. FIM watches specific files and configurations for unexpected change and reports it, with no orchestration role.

158. A manager is comparing SIEM and SOAR for the SOC. Which statement best captures the primary distinction between the two?
     • SIEM encrypts archived documents to guard secrets, while SOAR signs message traffic using gateways
     • SIEM rotates account passwords to block misuse, while SOAR filters inbound packets using firewalls
     • SIEM images infected laptops to store evidence, while SOAR restores deleted archives using backups
     • SIEM correlates logged records to expose threats, while SOAR drives response steps using playbooks

     Correct answer: SIEM correlates logged records to expose threats, while SOAR drives response steps using playbooks

     The split is detection versus response. A SIEM ingests records from many sources, normalizes them and correlates them so a threat becomes visible as an alert; SOAR takes that alert and runs an automated playbook across the other tools to enrich, decide and contain. Neither product is defined by cryptography: encrypting stored records and signing messages are jobs for storage encryption and mail security. Neither one administers accounts or firewalls: password rotation belongs to identity management and packet filtering to the firewall itself. Neither performs forensic imaging or backup restoration, which sit with the forensics and recovery teams.

159. A vendor offers a platform that ingests and correlates telemetry from endpoints, network, cloud workloads, identity, and email into one unified detection-and-response console, so analysts can see a full attack chain across layers. Which technology is described?
     • MDM, mobile device management
     • XDR, extended threat coverage
     • WAF, web application firewall
     • CASB, cloud service brokering

     Correct answer: XDR, extended threat coverage

     XDR is defined by breadth: it takes native telemetry from endpoints, network sensors, cloud workloads, identity systems and mail, correlates it centrally and presents one console in which an analyst can follow an attack from the first click to the final action. MDM enrolls and configures phones and tablets and reports only on those devices. A WAF sits in front of a web application and inspects HTTP requests for injection and abuse, seeing nothing beyond that application. A CASB governs how users reach cloud services and enforces policy there, which is one layer of the picture rather than all of them.

160. A security team installs agents on laptops and servers to continuously record process execution, file changes, and network connections so threats can be detected and the host isolated and remediated. Which capability is being deployed?
     • SIEM, historical log correlation
     • NAC, device posture verification
     • EDR, endpoint behavior telemetry
     • DLP, outbound content protection

     Correct answer: EDR, endpoint behavior telemetry

     EDR puts an agent on each laptop and server that continuously records process execution, file writes and outbound connections, evaluates that behavior for attack patterns, and gives the responder the ability to isolate the machine from the network and remediate it. A SIEM collects records centrally from many systems but owns no agent on the host and cannot quarantine one. NAC evaluates a device at the moment it asks to join and grants or refuses admission, which says nothing about what the device does once it is on the network. DLP inspects outbound content to stop confidential material leaving the organization and does not track process execution.

161. Before allowing a suspicious email attachment into the production environment, a security team detonates it inside an isolated, instrumented virtual environment to observe its behavior safely. Which technique is this?
     • Automated sandboxing
     • Promiscuous sniffing
     • Persistent tunneling
     • Irreversible masking

     Correct answer: Automated sandboxing

     Sandboxing runs the suspect file inside an isolated, instrumented virtual machine where its process, file and network behavior is recorded, so a verdict can be reached without the sample ever touching a production host. Sniffing captures frames already crossing a network segment; it observes traffic but never executes the attachment. Tunneling wraps one protocol inside another so it can traverse a network that would otherwise block it, which moves data rather than analysing it. Masking replaces real field values with realistic substitutes so a copy of a database can be handed to testers safely.

162. A web application redirects a user to their corporate identity provider, which returns a signed XML assertion confirming the user's identity so the application grants access without its own login. Which standard is being used?
     • LDAP, directory attribute queries
     • SMTP, electronic message delivery
     • SAML, browser federation exchange
     • ICMP, network reachability probes

     Correct answer: SAML, browser federation exchange

     SAML carries signed XML assertions from the identity provider to the service provider, and that assertion is what lets the application trust the sign-in and grant access without ever running a login of its own; this is the classic web single sign-on flow. LDAP reads and writes entries in a directory tree and answers attribute queries, but it is a lookup protocol, not a federation exchange between two organizations. SMTP moves mail between servers. ICMP carries reachability and error messages such as echo requests and destination-unreachable notices, and it has no identity role at all.

163. A mobile app needs to access a user's photos stored in a cloud service without ever receiving the user's password, instead receiving a scoped access token granting limited permission. Which framework provides this delegated authorization?
     • Kerberos, encrypted ticket exchanges
     • RADIUS, centralized password lookups
     • SAML, federated identity credentials
     • OAuth, restricted application grants

     Correct answer: OAuth, restricted application grants

     OAuth exists precisely so an application can act on a resource owner's behalf without ever seeing the password: the user approves a limited scope, and the application receives a token that carries only that scope and can be revoked later. Kerberos issues encrypted tickets inside a realm to prove who a principal is, which authenticates a session rather than handing a stranger's app a narrow slice of someone's data. RADIUS centralizes account checks for network and remote-access equipment. SAML passes signed assertions so a site can trust a sign-in, establishing identity rather than granting scoped reach into stored photos.

164. A developer needs not only to authorize access to an API but also to verify the end user's identity, so they add an identity layer that issues a signed ID token on top of the existing authorization framework. Which protocol provides this identity layer?
     • IPsec, network traffic protection
     • OIDC, standardized profile claims
     • LDAP, hierarchical record lookups
     • SCIM, remote account provisioning

     Correct answer: OIDC, standardized profile claims

     OIDC sits on top of OAuth 2.0 and adds what OAuth deliberately leaves out: a signed ID token plus a standard set of claims describing the end user, so the application learns who signed in as well as what the caller is allowed to reach. IPsec protects packets between two network endpoints and says nothing about who the human is. LDAP answers queries against a directory tree; an application can look a person up there, but no signed assertion is produced for it to trust. SCIM automates creating, updating and deleting accounts across systems, which is provisioning rather than sign-in.

165. After authenticating once to a central identity service in the morning, an employee can open the email, HR, and expense applications all day without re-entering credentials. Which capability does this describe?
     • SSO, multi-application logon reuse
     • MFA, independent factor challenges
     • PAM, temporary credential checkout
     • TOTP, expiring six-digit passcodes

     Correct answer: SSO, multi-application logon reuse

     Single sign-on centralizes the login: the employee proves identity once to the identity service, and every connected application accepts the resulting session or assertion, so mail, HR and expenses all open without a second prompt. MFA is about strength rather than reuse; it adds a second independent factor to a login and makes that first login harder instead of removing later ones. PAM checks elevated credentials out of a vault for a limited window and covers administrators, not ordinary daily application access. A TOTP is one short-lived code entered as a factor during a login.

166. An organization assigns permissions to job functions such as 'Help Desk' and 'Accountant,' and users receive access by being placed into the role that matches their position. Which access control model is in use?
     • MAC, system-assigned label limitations
     • DAC, owner-controlled resource sharing
     • RBAC, position-based privilege bundles
     • ABAC, attribute-driven entry decisions

     Correct answer: RBAC, position-based privilege bundles

     RBAC attaches permissions to a named job function and then grants a person access by making them a member of that function, so administration is done once per role and every new help desk hire inherits the same rights. MAC would decide from labels the system assigns and the user cannot change, which is not what happens when a title determines access. DAC leaves each resource to its owner, so rights would differ folder by folder rather than following a job title. ABAC would weigh live attributes such as device state or time of day, and none of that is being evaluated here.

167. An organization needs access decisions that consider multiple dynamic conditions at once, such as the user's department, the device's compliance state, the time of day, and the resource's classification. Which access control model evaluates these characteristics to make a decision?
     • RBAC, group-linked privilege inheritance
     • MAC, system-enforced clearance decisions
     • DAC, owner-determined resource authority
     • ABAC, policy-driven attribute evaluation

     Correct answer: ABAC, policy-driven attribute evaluation

     ABAC writes access as policy over attributes, so the decision engine can weigh the requester's department, the posture of the device, the hour of the request and the classification of the resource together, and the answer can differ from one request to the next. RBAC can only ask which role someone holds, so device state and time of day are outside what it can express. MAC compares a fixed clearance against a fixed label and ignores dynamic conditions. DAC leaves the decision with the resource owner, who is not evaluating compliance state at request time.

168. A security architect must choose between RBAC and ABAC for a system needing fine-grained, context-sensitive decisions. Which statement correctly distinguishes the two models?
     • RBAC follows a stored clearance label, while ABAC weighs invoice, ledger and payroll record
     • RBAC follows a granted job role, while ABAC weighs subject, resource and environment status
     • RBAC follows a shared directory listing, while ABAC weighs cabling, socket and switch ports
     • RBAC follows a scheduled backup index, while ABAC weighs banner, footer and template layout

     Correct answer: RBAC follows a granted job role, while ABAC weighs subject, resource and environment status

     The real difference is what each model is allowed to look at. RBAC resolves a request by asking which job function the person holds and what that function may do, while ABAC evaluates a policy over attributes of the subject, the resource and the surrounding environment, which is why it can express fine-grained, context-sensitive rules. Clearance labels belong to mandatory access control and a directory listing of owner-set rights to discretionary access control, so neither pairing describes these two models. Backup catalogues, cabling and page templates are not inputs either model can evaluate.

169. On a Windows file server, the user who creates a folder can decide which other users are granted read or write access to it at their own discretion. Which access control model does this illustrate?
     • MAC, policy-locked sensitivity checks
     • DAC, owner-assigned privilege entries
     • RBAC, function-based authority groups
     • ABAC, condition-weighted access rules

     Correct answer: DAC, owner-assigned privilege entries

     DAC is the model in which the person who owns an object controls its access list, which is exactly what happens when the creator of a folder decides who else may read or write it. MAC would take that choice away: the system compares a label it assigned against a clearance, and the owner cannot widen it. RBAC would tie the rights to a job function, so membership of a role rather than the creator's preference would decide. ABAC would evaluate conditions such as device posture or time at the moment of the request, none of which the folder creator is setting.

170. In a high-security government system, every file is assigned a sensitivity label such as Secret or Top Secret, and the operating system, not the file owner, decides access based on each user's clearance. Which access control model is enforced?
     • DAC, owner-delegated permission editing
     • RBAC, office-based privilege assignment
     • ABAC, runtime-weighted access decisions
     • MAC, kernel-enforced label restrictions

     Correct answer: MAC, kernel-enforced label restrictions

     MAC is enforced by the system itself: each object carries a sensitivity label, each subject carries a clearance, and the operating system compares them on every request, so neither the owner nor the user can widen access. DAC does the opposite by handing that decision to the owner of the object. RBAC decides from the job function a person holds, which classified systems still use for administration but which is not what the clearance comparison here describes. ABAC evaluates dynamic conditions in policy rather than enforcing a fixed classification hierarchy.

171. A security policy ensures that each user account is given only the permissions strictly necessary to perform that person's job and nothing more. Which principle is being applied?
     • Least privilege policy
     • Implicit deny standard
     • Job rotation procedure
     • Change control process

     Correct answer: Least privilege policy

     Least privilege is the rule that every account, service and process is granted the minimum rights its task requires and no more, which shrinks what an attacker gains from any single compromised credential. Implicit deny is a different idea: it governs what happens to a request no rule covers, blocking anything not expressly allowed rather than sizing an individual account's rights. Job rotation moves staff between duties so irregularities surface and no one person keeps exclusive control of a process. Change control governs how modifications are proposed, reviewed and approved.

172. A bank requires that initiating a wire transfer and approving it must be performed by two different employees so that no single person can complete the entire transaction alone. Which security principle is being enforced?
     • Retention of records
     • Escalation of alerts
     • Separation of duties
     • Validation of inputs

     Correct answer: Separation of duties

     Separation of duties breaks a sensitive process into steps held by different people, so initiating a payment and approving it are never in the same pair of hands and fraud would require collusion. Retention of records keeps evidence of what happened for a defined period; it supports an investigation afterwards but leaves one clerk able to finish the transfer today. Escalation of alerts routes a suspicious event to a higher tier of responders, which is a monitoring path rather than a division of the work itself. Validation of inputs checks that submitted data is well formed and never asks who submitted it.

173. An organization deploys a solution so that administrators must check out elevated credentials from a vault for a specific, time-limited session, with all privileged activity recorded and the password rotated afterward. Which capability is this?
     • PAM, monitored administrative checkout
     • SSO, cross-application session sharing
     • MFA, supplementary factor verification
     • DLP, sensitive document classification

     Correct answer: PAM, monitored administrative checkout

     PAM is the discipline built around administrative accounts: the credential lives in a vault, an administrator draws it for a defined window, the whole session is recorded for later review, and the password is changed once the window closes so a copied secret is worthless. SSO removes repeated logins for ordinary applications and grants no elevated rights. MFA strengthens how any account proves itself but does not vault, time-box or rotate anything. DLP examines content leaving the organization and has no role in issuing or auditing administrative credentials.

174. Employees in a marketing team begin using an unsanctioned cloud file-sharing service to collaborate, without IT's knowledge or approval. What does this situation represent, and why is it a security concern?
     • Honeypot usage, because decoy servers misdirect attackers and scanners
     • Shadow IT, because unmanaged services sidestep patching and monitoring
     • Security baselining, because approved builds fix settings and defaults
     • Identity federation, because trust links admit suppliers and outsiders

     Correct answer: Shadow IT, because unmanaged services sidestep patching and monitoring

     Shadow IT is technology adopted without the knowledge or approval of the people responsible for securing it, and the risk follows directly from that: nobody patches it, nobody watches its logs, corporate data lands in an account no administrator can reach, and offboarding never touches it. A honeypot is deliberately placed by defenders as bait and is watched closely rather than unknown. Baselining is the approved standard build a system is measured against. Federation is a sanctioned trust relationship between identity domains, established on purpose and under contract.

175. A SOC analyst documents an attack by mapping each observed adversary behavior, such as spearphishing, credential dumping, and lateral movement, to standardized tactic and technique identifiers in a globally recognized knowledge base. Which framework is being used?
     • The OWASP core application weaknesses
     • The PCI cardholder audit requirements
     • The MITRE ATT&CK reference collection
     • The ISO/IEC quality management series

     Correct answer: The MITRE ATT&CK reference collection

     MITRE ATT&CK is the curated, publicly maintained body of adversary tactics and techniques, each with a stable identifier, which is why analysts use it to describe what an intruder did in language another team will read the same way. OWASP publishes the widely cited list of common web application weaknesses, which describes coding flaws rather than intruder behavior. The PCI requirements govern how cardholder data must be handled by merchants. The ISO/IEC quality management series concerns how an organization runs quality processes and has nothing to do with intrusions.

176. An organization deploys a tool that computes cryptographic hashes of critical system files and configuration files, then alerts the SOC whenever any of those hashes change unexpectedly. Which control is this?
     • NTP, authenticated clock synchronization
     • DLP, confidential content classification
     • CASB, sanctioned application enforcement
     • FIM, unauthorized modification detection

     Correct answer: FIM, unauthorized modification detection

     FIM takes a cryptographic fingerprint of the files that matter, stores it as a baseline, and re-computes it on a schedule, so any edit to a binary or a configuration file that nobody approved shows up as a mismatch and raises an alert. NTP keeps clocks aligned so that timestamps across systems can be compared; it inspects no files. DLP examines content on its way out of the organization and cares about where data is going rather than whether a system file was altered. CASB governs how users reach cloud services and sees nothing on the host.

177. A SOC consolidates log records from hundreds of servers, network devices, and applications into a single central repository so analysts can search and correlate them in one place. What is this practice called?
     • Log compression
     • Log aggregation
     • Log obfuscation
     • Log attestation

     Correct answer: Log aggregation

     Aggregation is the act of bringing records from hundreds of separate sources into a single store, which is what makes a cross-system search or correlation possible at all. Compression shrinks the space those records occupy and changes nothing about where they live. Obfuscation deliberately hides field values so a reader cannot recover the original detail, which works against an analyst trying to investigate. Attestation proves a stored record has not been altered since it was written, a valuable integrity property that still leaves the records scattered across every device that produced them.

178. An IT team establishes a documented, approved standard configuration that defines required settings, enabled services, and security parameters that all newly built web servers must conform to. What is this standard called?
     • Security baseline
     • Recovery playbook
     • Escalation matrix
     • Capacity forecast

     Correct answer: Security baseline

     A baseline is the approved definition of how a system should be built: which settings are required, which services may run, and which security parameters are mandatory, so every new server starts from the same hardened state and later drift can be measured against it. A recovery playbook describes the steps to restore service after an outage. An escalation matrix says who is contacted, and in what order, once an event exceeds a threshold. A capacity forecast projects future resource demand so hardware is bought in time, and none of these defines the build a server must match.

179. An administrator establishes a structured process to identify missing updates, test fixes, schedule deployment, and verify installation across all endpoints and servers on a regular cadence. Which security operations process is this?
     • Media sanitation
     • Vendor screening
     • Patch management
     • Threat profiling

     Correct answer: Patch management

     Patch management is the full lifecycle around vendor updates: discover what is missing, test the fix so it does not break production, schedule and deploy it across the estate, then confirm it actually installed everywhere. Media sanitation is about destroying or wiping storage so retired equipment carries no readable data away. Vendor screening evaluates a supplier's security posture before a contract is signed. Threat profiling studies which adversaries are likely to target the organization and how they operate, which informs defence but installs nothing.

180. Following a suspected breach, a specialist applies a structured process to identify, collect, preserve, analyze, and report on digital evidence from computers and storage media in a way that maintains its integrity for potential legal proceedings. Which discipline is this?
     • Vendor assessment
     • Disaster recovery
     • Media replacement
     • Digital forensics

     Correct answer: Digital forensics

     Digital forensics governs how electronic evidence is handled from the moment an incident is suspected: acquire it without altering the original, document custody at every step, analyse the copy, and report findings in a form that survives challenge in a legal setting. Vendor assessment reviews a supplier's controls before or during a contract. Disaster recovery restores service after a disruption, and restoring a compromised system quickly often destroys the very artefacts an investigation needs. Media replacement swaps out failing or retired storage hardware.

181. A U.S. hospital is reviewing the regulations that govern how it stores and shares patient medical records electronically. Which law specifically sets national standards for protecting individuals' protected health information (PHI) and requires safeguards such as access controls and breach notification?
     • FISMA
     • HIPAA
     • FERPA
     • COPPA

     Correct answer: HIPAA

     HIPAA is the United States law that sets national standards for protected health information: covered entities and their business associates must apply administrative, physical and technical safeguards, restrict access to the minimum necessary, and notify individuals and regulators after a qualifying breach. FISMA governs how federal agencies secure their own information systems, not what a private hospital does with patient records. FERPA protects student education records held by schools. COPPA restricts the online collection of personal information from children under thirteen and applies to web services aimed at minors.

182. An online retailer operating in the EU must comply with a regulation that grants individuals rights such as access, rectification, and erasure of their personal data and requires breach reporting to a supervisory authority within 72 hours. Which regulation is this?
     • GLBA
     • CFAA
     • GDPR
     • FCRA

     Correct answer: GDPR

     GDPR is the European Union regulation that gives data subjects enforceable rights over their own information, including access to it, correction of it and erasure of it, and it obliges a controller to report a qualifying personal data breach to its supervisory authority within 72 hours. GLBA is a United States statute covering how financial institutions handle customer financial information. CFAA is the United States computer crime statute used to prosecute unauthorized access to protected systems. FCRA governs the accuracy and use of consumer credit reports and grants no such erasure right.

183. Under GDPR, a marketing company decides what customer personal data to collect and why, then hires a cloud email vendor that sends campaigns strictly according to the marketing company's instructions. How are these two parties classified?
     • The agency serves as custodian and the vendor serves as supervisor
     • The agency serves as subject and the vendor serves as intermediary
     • The agency serves as recipient and the vendor serves as originator
     • The agency serves as controller and the vendor serves as processor

     Correct answer: The agency serves as controller and the vendor serves as processor

     Under GDPR the classification follows who decides. The marketing business chooses what personal data is collected and why, which makes it the controller, and the email vendor acts only on those documented instructions, which makes it the processor. Custodian is not a role the regulation defines, and a supervisor is the national authority that enforces the law rather than a hired supplier. The data subject is the individual the records describe, which neither company is. Calling the agency a mere recipient inverts the facts: it is the party setting the purpose, and the vendor originates nothing.

184. A merchant that stores and transmits cardholder data must comply with a security standard maintained by the major payment card brands rather than by a government. Which framework imposes requirements such as network segmentation, encryption of cardholder data, and regular vulnerability scanning?
     • PCI DSS specification
     • ISO 27001 publication
     • NIST CSF requirements
     • CIS Controls guidance

     Correct answer: PCI DSS specification

     PCI DSS is maintained by the council the major card brands founded, and it binds any organization that stores, processes or transmits cardholder data through the merchant's acquiring contract rather than through legislation. Its content is exactly what the scenario lists: segment the cardholder data environment, encrypt the data, and scan for vulnerabilities on a defined cycle. ISO 27001 is an international management-system standard an organization opts into. The NIST framework is voluntary guidance published by a government agency. The CIS material offers prioritized hardening advice with no card brand behind it.

185. An organization wants to become formally certified against an internationally recognized standard that specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS). Which standard should it pursue?
     • ISO 27001 requirement
     • PCI DSS documentation
     • NIST CSF publications
     • SOC 2 recommendations

     Correct answer: ISO 27001 requirement

     ISO/IEC 27001 states the requirements for establishing, operating, maintaining and improving an information security management system, and it is the one here an accredited body can audit an organization against and issue a certificate for. PCI DSS applies only where payment card data is handled and is enforced by contract with the card brands. The NIST framework is voluntary guidance organized around outcomes, and no certificate is issued against it. A SOC 2 engagement produces an auditor's report on service organization controls for customers to read, which is an attestation rather than a management-system certification.

186. A security manager wants to organize the company's cybersecurity program around six core functions: Govern, Identify, Protect, Detect, Respond, and Recover. Which framework provides this voluntary, outcome-based structure?
     • MITRE ATT&CK matrix
     • OWASP risk rankings
     • NIST CSF categories
     • Lockheed Kill Chain

     Correct answer: NIST CSF categories

     The NIST Cybersecurity Framework organizes security outcomes into functions, and version 2.0 added Govern alongside Identify, Protect, Detect, Respond and Recover, giving a voluntary structure a programme can be arranged around and measured against. The MITRE matrix catalogues what adversaries do, technique by technique, which supports detection engineering rather than programme governance. The OWASP material ranks common web application weaknesses for developers. The Lockheed model describes the stages of a single intrusion from reconnaissance to action on objectives, which is an attack narrative, not a management structure.

187. A CISO is establishing the policies, roles, and oversight committees that direct how security decisions are made and held accountable across the enterprise, aligning them with business objectives and regulatory requirements. This overall practice is best described as which of the following?
     • Penetration testing
     • Security governance
     • Business continuity
     • Threat intelligence

     Correct answer: Security governance

     Governance is the direction-setting layer: it establishes who decides, which committees hold the programme to account, what the policies say, and how all of that maps onto business objectives and regulatory duties. Penetration testing is a point-in-time technical assessment that tries to exploit weaknesses and reports what worked. Business continuity plans how essential operations keep running through a disruption. Threat intelligence gathers and analyses information about adversaries so defenders can anticipate them, and each of these is an activity that governance oversees rather than the oversight itself.

188. A new employee receives ongoing instruction on recognizing phishing emails, reporting suspicious activity, handling sensitive data, and following the company's policies. According to CompTIA's security program guidance, what is this practice called?
     • Emergency response planning
     • Employee policy attestation
     • Software escrow arrangement
     • Security awareness training

     Correct answer: Security awareness training

     Security awareness training is the continuing programme that teaches people to spot a phishing message, report something that looks wrong, treat sensitive information correctly and follow the rules the organization has set, which is why it is treated as a control over the human layer. Emergency response planning prepares a small responder team for a disruption and is exercised rather than taught to every new hire. Policy attestation records that someone has read and accepted the rules, which is a signature rather than instruction. Software escrow places source code with a third party in case a supplier fails.

189. An organization's security program encompasses the continuous process of identifying threats, assessing their likelihood and impact, and deciding how to treat them so that exposure stays within acceptable limits. Which discipline describes this entire ongoing process?
     • Incident triage
     • Backup rotation
     • Media shredding
     • Risk management

     Correct answer: Risk management

     Risk management is the whole cycle: identify what could go wrong, judge how likely it is and what it would cost, choose to mitigate, transfer, avoid or accept it, then re-check as conditions change, so what remains stays inside the tolerance leadership has set. Incident triage sorts alerts by urgency once something has already happened. Backup rotation cycles media through a retention scheme so restorable copies of different ages exist. Media shredding destroys retired storage so nothing readable leaves the building, and each of these treats one risk rather than running the process.

190. During a quantitative risk assessment, an analyst multiplies the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Which value does this calculation produce?
     • Maximum tolerable downtime
     • Exposure factor percentage
     • Annualized loss expectancy
     • Quantitative risk appetite

     Correct answer: Annualized loss expectancy

     Multiplying what one occurrence costs by how many occurrences are expected in a year produces the yearly figure a control's cost is weighed against, and that figure is the annualized loss expectancy. Maximum tolerable downtime states how long a function can be unavailable before the damage becomes unacceptable, which comes out of a business impact analysis rather than this multiplication. The exposure factor is the proportion of an asset's value destroyed by a single event, an input that helps produce the per-occurrence cost. Risk appetite is the exposure leadership is willing to carry, a policy statement, not a computed result.

191. In a quantitative risk assessment, a server is valued at $40,000 and a fire is estimated to destroy 25 percent of it. What is the single loss expectancy (SLE) for one fire event?
     • $40,000
     • $4,000
     • $30,000
     • $10,000

     Correct answer: $10,000

     The single loss expectancy is the asset value multiplied by the exposure factor, so $40,000 times 0.25 gives $10,000 of loss for one fire. $40,000 is the entire asset value, which would be the loss only if a single fire destroyed the server completely. $30,000 is the value that survives the fire rather than the value it removes. $4,000 applies a 10 percent exposure factor instead of the 25 percent the assessment estimated.

192. While calculating loss for a risk assessment, an analyst needs the percentage of an asset's value that would be lost if a specific threat were realized. Which term describes this percentage?
     • Exposure factor
     • Event frequency
     • Asset valuation
     • Impact analysis

     Correct answer: Exposure factor

     The exposure factor is the share of an asset's value destroyed when one specific threat is realized, expressed as a percentage, and it is multiplied by asset value to produce the single loss expectancy. Event frequency counts how often a threat occurs in a year rather than how much value one occurrence removes. Asset valuation establishes the total worth of the asset, which is the figure the percentage is applied to, not the percentage itself. Impact analysis describes the business consequences of a disruption and yields no such ratio.

193. An analyst is estimating how many times per year a particular threat, such as a server room flood, is expected to occur for use in an ALE calculation. Which metric is the analyst determining?
     • Maximum tolerable downtime
     • Annualized occurrence rate
     • Exposure factor percentage
     • Qualitative impact ranking

     Correct answer: Annualized occurrence rate

     The annualized occurrence rate, usually written ARO, states how many times a threat is expected to happen in a single year, and multiplying it by the single loss expectancy produces the annualized loss expectancy. Maximum tolerable downtime is the longest interruption a business can absorb, a duration rather than a frequency. Exposure factor percentage is the portion of asset value lost in one event and says nothing about how often that event occurs. Qualitative impact ranking sorts risks into bands such as high or low and produces no yearly count.

194. A team performs an automated, non-intrusive examination of systems to identify and report known weaknesses such as missing patches and misconfigurations, but it does not attempt to exploit them. What is this activity called?
     • A tabletop rehearsal
     • A vulnerability scan
     • A malware detonation
     • A control validation

     Correct answer: A vulnerability scan

     A vulnerability scan is the automated check that compares hosts against a database of published flaws and reports missing patches and weak settings without ever using them. A tabletop rehearsal is a discussion walkthrough of a plan and inspects no live host. A malware detonation runs one suspect file inside a sandbox to watch its behavior, which studies a sample rather than surveying systems. A control validation tests whether a chosen safeguard behaves as designed and does not enumerate the flaws present on a host.

195. An organization hires an outside firm to actively attempt to breach its systems by exploiting vulnerabilities, simulating a real attacker to validate defenses. What is this authorized engagement called?
     • A tabletop session
     • A privilege review
     • A perimeter survey
     • A penetration test

     Correct answer: A penetration test

     A penetration test is the authorized engagement in which testers actively exploit weaknesses to prove real impact and confirm that the defenses hold. A tabletop session talks a scenario through around a table and touches no production system. A privilege review inspects who holds which permissions and never attempts to use them against the environment. A perimeter survey maps which edge assets are exposed but deliberately stops short of breaking into any of them.

196. A company commissions an external penetration test in which the testers are given full knowledge of the network architecture, source code, and credentials before they begin. Which testing approach is this?
     • Known environment testing
     • Blind environment testing
     • Cloud environment testing
     • Local environment testing

     Correct answer: Known environment testing

     Known environment testing, the approach older material calls white box, hands the testers architecture documents, source code, and credentials before work starts so every path can be reviewed rather than discovered. Blind environment testing withholds that material so the team has to operate the way an outsider would. Cloud environment testing names where the target workload lives, not how much the testers were told. Local environment testing likewise describes a network location instead of a disclosure level.

197. A vendor contract guarantees that a cloud service will be available 99.95 percent of the time each month, with credits owed if that target is missed. Which type of agreement defines these measurable service commitments?
     • A cloud hosting agreement
     • A joint venture agreement
     • A data transfer agreement
     • A service level agreement

     Correct answer: A service level agreement

     A service level agreement is the contract that fixes measurable performance targets, such as an availability percentage and a response time, together with the credits or penalties owed when a target is missed. A cloud hosting agreement covers where a workload runs and who maintains it without committing the provider to any numeric availability figure. A joint venture agreement sets out how two firms share a jointly owned undertaking. A data transfer agreement governs what information may be sent where and on what lawful basis.

198. Two organizations entering an informal collaboration want to document their mutual intentions and broad responsibilities, while making clear the document is not a legally binding contract. Which agreement best fits this purpose?
     • Description of deliverables
     • Memorandum of understanding
     • Screening of subcontractors
     • Certification of compliance

     Correct answer: Memorandum of understanding

     A memorandum of understanding records what two parties intend to do together and how broad responsibilities are shared, and it is written so that it creates no enforceable obligation. A description of deliverables lists the items a paid engagement must produce and belongs inside a binding statement of work. Screening of subcontractors is the due-diligence activity a party performs on the firms it hires, not a document recording what two parties intend. A certification of compliance attests that a control set meets a named standard, which is an assertion about a system rather than a mutual intention.

199. A company installs warning signs, motion-activated lighting, and visible security cameras around its data center perimeter. According to the CompTIA control type taxonomy, into which category do these measures PRIMARILY fall?
     • Directive or prescriptive
     • Corrective or restorative
     • Compensating or surrogate
     • Deterrent or discouraging

     Correct answer: Deterrent or discouraging

     Deterrent controls are placed where an attacker will see them so that the attempt is never made: a warning sign, a lit approach and a camera in plain view all advertise that the site is watched. Directive controls tell staff what they are required to do, which is an internal instruction rather than a signal aimed outward. Corrective controls act after an incident to restore what was damaged, and a sign or a lamp repairs nothing. Compensating controls stand in for a required control that cannot be implemented, which is not the reason perimeter signage and lighting are installed.

200. An organization wants to map every control it deploys to one of the functional control types used by CompTIA. Which set lists ONLY valid functional control types?
     • Technical, managerial, operational, physical
     • Preventive, deterrent, detective, corrective
     • Mandatory, discretionary, regulatory, hybrid
     • Confidentiality, integrity, advisory, manual

     Correct answer: Preventive, deterrent, detective, corrective

     Preventive, deterrent, detective and corrective are all functional control types, the labels that state what a control is meant to DO, and compensating and directive complete that same list of six. Technical, managerial, operational and physical describe how a control is implemented and by whom, which is the category axis rather than the functional one. Mandatory and discretionary name access control models, regulatory names a compliance driver, and hybrid names a deployment mix. Confidentiality and integrity are security properties, while advisory and manual describe a document and a method rather than a control type.

201. A security policy document instructs all employees that they must lock their workstations whenever they step away from their desks. What functional type of control is this written instruction itself?
     • Detective control
     • Deterrent control
     • Technical control
     • Directive control

     Correct answer: Directive control

     A directive control works by instructing people, and a written policy requiring staff to lock a workstation states exactly the behavior the organization expects. A detective control establishes that something has already occurred, such as a log entry showing an unattended session. A deterrent control discourages an outsider from attempting an attack, which an internal policy read only by employees does not do. A technical control names the category of implementation, a mechanism enforced by the system itself rather than an instruction given to a person.

202. After a malware infection, an organization runs antivirus to remove the malicious files and restores affected files from clean backups. Which functional control type BEST describes these post-incident remediation actions?
     • Preventive
     • Managerial
     • Corrective
     • Procedural

     Correct answer: Corrective

     Corrective controls act once an incident has been detected, to limit the damage and return the system to a known-good state; deleting the malicious files and restoring clean copies is precisely that work. Preventive controls are intended to stop the infection before it takes hold and have already failed by the time cleanup begins. Managerial names the governance layer of policy, risk assessment and planning rather than any hands-on repair. Procedural describes a documented way of working, not the act of repairing damage.

203. Which CompTIA control category encompasses measures such as security guards, fences, locks, bollards, and access badges that protect tangible assets?
     • Technical or computerized
     • Managerial or supervisory
     • Physical or environmental
     • Operational or procedural

     Correct answer: Physical or environmental

     Physical controls act on the tangible world, so guards, fences, locks, bollards and badge readers all belong here: each one constrains people and objects rather than data. Technical controls are implemented in software and device configuration, such as firewall rules, encryption and access control lists. Managerial controls are the governance layer of policy, risk decisions and oversight. Operational controls are the routine work people carry out, such as awareness training and manual log review.

204. A risk committee creates a formal acceptable use policy and conducts an annual risk assessment. Within the CompTIA control category model, what type of controls are these governance and policy activities?
     • Technical or electronic
     • Operational or everyday
     • Managerial or strategic
     • Preventive or proactive

     Correct answer: Managerial or strategic

     Managerial controls are the governance instruments through which an organization directs risk, and both an acceptable use policy and a scheduled risk assessment are decisions and direction rather than mechanisms. Technical controls are enforced by systems, such as access control lists and encryption. Operational controls are the routine tasks staff perform, such as reviewing logs or provisioning accounts. Preventive names what a control is meant to do, which is a functional type and not one of the implementation categories.

205. An administrator configures security awareness training, account provisioning procedures, and routine log review carried out by analysts. Which control CATEGORY do these human-performed, day-to-day activities belong to?
     • Operational or manual
     • Physical or perimeter
     • Directive or advisory
     • Detective or reactive

     Correct answer: Operational or manual

     Operational controls are the ones people execute while running the business, so awareness training, account provisioning and log review performed by analysts all sit in this category. Physical controls protect the building and the equipment inside it. Directive controls state what staff are required to do, which is the written instruction rather than the work itself. Detective names what a control is for, identifying that an event has occurred, instead of naming how the control is implemented.

206. Which element of the CIA triad is directly compromised when a denial-of-service attack prevents legitimate users from reaching a web application?
     • Confidentiality of data
     • Availability of service
     • Integrity of processing
     • Accountability of users

     Correct answer: Availability of service

     Availability is the property a denial-of-service attack strikes directly: nothing is read and nothing is altered, the application simply cannot be reached by the people entitled to use it. Confidentiality concerns unauthorized disclosure, and flooding a site discloses nothing. Integrity concerns unauthorized modification, and the stored data is left exactly as it was. Accountability concerns being able to attribute an action to a particular identity, which the outage does not undermine.

207. A bank wants to be able to prove that a customer who submitted a wire transfer request cannot later credibly deny having sent it. Which security concept addresses this requirement?
     • Tamper-evidence
     • Fault-tolerance
     • Self-encryption
     • Non-repudiation

     Correct answer: Non-repudiation

     Non-repudiation is the assurance that whoever originated an action cannot later deny it, and it is produced by binding the request to a private key that only the customer holds, usually through a digital signature. Tamper-evidence shows that a seal or a record has been disturbed, which reveals interference after the fact but never ties a message to the person who sent it. Fault-tolerance keeps a service running through component failure, which is an availability property. Self-encryption protects data written to a drive and offers no evidence about the origin of a transaction.

208. In the AAA framework used for access control, which component records what an authenticated user did, such as the commands run and resources accessed?
     • Authentication or identity
     • Authorization or privilege
     • Accounting or traceability
     • Provisioning or onboarding

     Correct answer: Accounting or traceability

     Accounting is the third A of AAA: once a subject has been authenticated and authorized, accounting records what was actually done, including the commands issued, the resources touched and how long the session lasted, and that record is what makes an audit possible. Authentication establishes that the subject really is who it claims to be. Authorization decides which resources that proven identity may use. Provisioning is the account lifecycle work of creating and removing access, which happens before a session ever starts rather than recording what goes on inside one.

209. A network architect designing under a Zero Trust model is implementing the control plane. Which function is a responsibility of the Zero Trust control plane rather than the data plane?
     • Forwarding packets and blocking the denied sessions
     • Encrypting payloads and rotating the symmetric keys
     • Evaluating requests and issuing the access decision
     • Assigning addresses and renewing the expired leases

     Correct answer: Evaluating requests and issuing the access decision

     The Zero Trust control plane is where the access decision is made: the policy engine evaluates each request against policy and the policy administrator issues the resulting grant or denial. Forwarding packets and blocking denied sessions is the work of the policy enforcement point in the data plane, which carries out a decision it did not make. Encrypting payloads and rotating symmetric keys protects traffic in flight but decides nothing about who may reach what. Assigning addresses and renewing leases is ordinary network plumbing that exists whether or not Zero Trust is deployed.

210. In a Zero Trust architecture, which component is responsible for ENFORCING the access decision by allowing or blocking a session between a subject and a resource?
     • Enforcement point or gateway
     • Decision engine or evaluator
     • Trust algorithm or heuristic
     • Resource portal or connector

     Correct answer: Enforcement point or gateway

     The policy enforcement point sits in the data plane and is the component that actually opens, refuses or tears down the session once a verdict has been handed to it. The decision engine is the policy engine, which produces the verdict but never touches the traffic. The trust algorithm is the scoring logic the policy engine runs to reach that verdict. The resource portal is a deployment model that fronts an application, not the component charged with allowing or blocking a session.

211. In a Zero Trust architecture, what is the role of the threat scope reduction (microsegmentation) approach?
     • It mirrors critical disk arrays so one failure cannot halt work
     • It encrypts stored backup volumes so one theft cannot leak data
     • It caches popular static objects so one client cannot wait long
     • It shrinks implicit trust zones so one breach cannot spread far

     Correct answer: It shrinks implicit trust zones so one breach cannot spread far

     Threat scope reduction, implemented as microsegmentation, cuts the network into small zones that extend no implicit trust to each other, so an attacker who compromises one workload cannot move laterally into the rest and the blast radius stays small. Mirroring disk arrays protects against hardware failure, which is an availability measure rather than containment. Encrypting stored backups protects data that has left the building and does nothing about lateral movement. Caching static objects at the edge is a performance technique with no bearing on trust boundaries.

212. A security team deploys decoy systems and fake credentials across the network specifically to mislead attackers and study their behavior. Which category of techniques does this represent?
     • Deception technology
     • Network segmentation
     • Privilege management
     • Behavioral analytics

     Correct answer: Deception technology

     Deception technology is the family of tools built to mislead an intruder: honeypots, honeynets, honeyfiles and honeytokens all present something attractive and false, so any interaction with them is both a high-confidence alert and a chance to watch how the attacker works. Network segmentation limits where traffic may flow but presents nothing fake. Privilege management decides what an account is allowed to do rather than baiting it. Behavioral analytics hunts for anomalies in genuine activity instead of planting decoys.

213. An administrator plants a single fake API key in a configuration repository that no legitimate process should ever use, so that any attempt to use it raises an immediate alert. What deception technique is this?
     • Honeynet or subnet
     • Honeypot or server
     • Honeytoken or item
     • Sinkhole or router

     Correct answer: Honeytoken or item

     A honeytoken is a single piece of bait data, such as a fake credential, API key or database record, placed where no legitimate process will ever touch it, so any use of it is unambiguous evidence of intrusion. A honeynet is a whole decoy network of systems. A honeypot is a decoy host built to be attacked and studied. A sinkhole redirects malicious traffic to a controlled destination rather than planting false data and waiting for someone to pick it up.

214. Before a planned modification to a production firewall, an organization requires that the change be documented, analyzed for impact, and approved by a review board. Which security governance process mandates these steps?
     • Change management
     • Incident response
     • Firewall auditing
     • Capacity planning

     Correct answer: Change management

     Change management is the governance process that requires a proposed change to be documented, assessed for impact and approved before it reaches production, precisely so an unplanned outage or a new security gap is caught on paper first. Incident response governs what happens once something has already gone wrong. Firewall auditing reviews an existing rule base for drift and unused entries but authorizes no change. Capacity planning forecasts future resource demand and plays no part in approving modifications.

215. During a change management review, the team documents a backout plan. What is the PRIMARY purpose of a backout plan?
     • To record the agreed roster of the approvers
     • To confirm the planned timing of the release
     • To predict the likely expense of the project
     • To capture the precise steps of the rollback

     Correct answer: To capture the precise steps of the rollback

     A backout plan is written before a change is applied so that, if the change misbehaves, the team already holds the exact sequence that returns the system to the state it was in beforehand. Recording the agreed roster of approvers belongs to the authorization step rather than the recovery step. Confirming the planned timing of the release fixes the maintenance window. Predicting the likely expense of the project belongs to the business case. Each is a genuine part of change management, but none of them tells anyone how to undo a change that has failed.

216. A configuration management practice records the version, settings, and dependencies of every approved system build so that unauthorized drift can be detected. Which change management concept does this describe?
     • Baseline configuration
     • Maintenance scheduling
     • Records classification
     • Compliance attestation

     Correct answer: Baseline configuration

     A baseline configuration is the documented, approved state of a system, covering its version, its settings and its dependencies, and it exists so that any later deviation can be recognized as drift. Maintenance scheduling reserves a time in which changes may be made rather than describing what the approved state is. Records classification labels information by sensitivity and says nothing about build settings. Compliance attestation asserts that a control set meets an external standard, which is a statement made to an auditor rather than a technical reference point.

217. An organization implements full-disk encryption on all laptops. At which level of encryption is this protection being applied?
     • File level
     • Disk level
     • Link level
     • Page level

     Correct answer: Disk level

     Full-disk encryption works at the disk level: the whole drive, including the operating system, the page file and every temporary file, is encrypted as a single unit, which is what protects a laptop lost while powered off. File level encryption protects chosen files and leaves the rest of the volume readable. Link level encryption protects data while it crosses a network segment rather than data sitting at rest. Page level encryption is a database technique applied to storage pages inside the engine.

218. A developer needs to protect sensitive fields in a payment system but must keep the data format and length identical so legacy applications still function. Which technique BEST meets this requirement?
     • Segmentation
     • Tokenization
     • Sanitization
     • Minimization

     Correct answer: Tokenization

     Tokenization swaps each sensitive value for a surrogate of the same type and length, so a legacy application that expects a fixed-length field keeps working while the real value sits in a separate vault. Segmentation isolates parts of a network and does nothing to the field itself. Sanitization destroys data so that it cannot be recovered, which is the opposite of keeping it usable. Minimization reduces how much data is collected in the first place and cannot preserve a format that has to stay exactly as it is.

219. A security analyst hides a confidential message inside the least significant bits of an image file so its very existence is concealed. Which technique is being used?
     • Steganography
     • Cryptanalysis
     • Anonymization
     • Randomization

     Correct answer: Steganography

     Steganography hides a message inside a carrier file, here in the least significant bits of an image, so that an observer never learns a message is present at all. Cryptanalysis is the study of breaking ciphers rather than concealing anything. Anonymization strips identifying details out of a data set but leaves the remaining data plainly visible. Randomization adds unpredictability to values or keys, which changes what the data looks like without hiding that it is there.

220. An organization wants hardware-based protection that securely stores cryptographic keys on a motherboard and supports measured boot for individual endpoints. Which technology is designed for this purpose?
     • HSM
     • KMS
     • TPM
     • TEE

     Correct answer: TPM

     A TPM, or trusted platform module, is a chip bound to a system board that holds keys in hardware and stores the measurements a machine takes as it boots, which is precisely the per-endpoint function described. An HSM, or hardware security module, is a separate tamper-resistant appliance sized for enterprise key operations rather than a component of one laptop. A KMS, or key management system, is software that tracks key lifecycles across an estate and stores nothing on a motherboard. A TEE, or trusted execution environment, is an isolated region inside a processor for running sensitive code and does not supply boot measurements.

221. A company must perform thousands of high-volume cryptographic operations and securely manage keys at enterprise scale using a dedicated, tamper-resistant appliance. Which solution is MOST appropriate?
     • Hardware security module
     • Secure enclave processor
     • Software defined network
     • Virtual desktop platform

     Correct answer: Hardware security module

     A hardware security module is the dedicated, tamper-resistant appliance built for this workload: bulk cryptographic operations and centralized key custody for a whole organization, with private keys that never leave the device in the clear. A secure enclave processor isolates a small region inside one chip to protect one device's sensitive code. A software defined network abstracts routing and switching and performs no key custody. A virtual desktop platform delivers user sessions from a server and has nothing to do with cryptographic throughput.

222. A team is concerned that future quantum computers could break their current public-key algorithms. Which approach directly addresses this concern?
     • Extending to longer certificate lifetimes
     • Converting to hardened wireless protocols
     • Restricting to approved software catalogs
     • Migrating to quantum resistant primitives

     Correct answer: Migrating to quantum resistant primitives

     Only cryptography built on problems a quantum computer cannot solve efficiently answers this concern, so moving to quantum resistant primitives, such as the lattice-based schemes now being standardized, is the response that actually applies. Extending certificate lifetimes leaves the same breakable public-key mathematics in place for longer. Converting to hardened wireless protocols improves link security while still relying on the very algorithms in question. Restricting to approved software catalogs controls what may run and changes nothing about the mathematics protecting the data.

223. An application stores user passwords by adding a unique random value to each password before hashing it. What is the PRIMARY security benefit of adding this unique random value per user?
     • It repeats costly derivation rounds so guessing cannot finish early
     • It breaks prebuilt hashing tables so attackers cannot reuse digests
     • It demands longer mixed passphrases so cracking cannot succeed soon
     • It blocks repeated failed logins so scripts cannot continue probing

     Correct answer: It breaks prebuilt hashing tables so attackers cannot reuse digests

     A unique per-user salt makes every stored digest different even when two people pick the same password, so an attacker's prebuilt table of password-to-digest pairs, a rainbow table, matches nothing and would have to be rebuilt for every account separately. Repeating costly derivation rounds is key stretching, which slows an attacker but leaves one precomputed table covering every unsalted account. Demanding longer mixed passphrases raises the cost of guessing without changing how the stored value is formed. Blocking repeated failed logins limits online guessing and has no effect on an offline attack against a stolen hash file.

224. A piece of malware lies dormant on a server until a specific condition is met, such as a particular date or the deletion of an employee's account, at which point it deletes critical files. Which threat does this describe?
     • A boot virus
     • A spam robot
     • A logic bomb
     • A fake alert

     Correct answer: A logic bomb

     A logic bomb is malicious code that sits inert until a defined condition is satisfied, such as a date arriving or an account being removed, and only then releases its payload, which is exactly the behavior described. A boot virus infects the boot sector and runs every time the machine starts, with no condition to wait for. A spam robot quietly relays unsolicited mail from a compromised host. A fake alert frightens a user into installing or paying for something and deletes nothing by itself.

225. A device ships with numerous unnecessary preinstalled applications that consume resources and expand the attack surface without the user's request. What does this describe?
     • Keylogger
     • Bloatware
     • Scareware
     • Shellcode

     Correct answer: Bloatware

     Bloatware is software a manufacturer preloads that the owner never asked for: it consumes storage and memory and adds code that still has to be patched, widening the attack surface while offering nothing in return. A keylogger secretly captures keystrokes and is planted by an attacker rather than shipped by the vendor. Scareware manufactures alarming warnings to push a purchase. Shellcode is the small payload an exploit runs once it has seized control, not a preinstalled application.

226. Which characteristic best distinguishes fileless malware from traditional malware?
     • It encrypts stored volumes and demands anonymous payment
     • It occupies volatile memory and abuses approved binaries
     • It hooks internal routines and conceals active processes
     • It saturates adjacent subnets and generates fresh copies

     Correct answer: It occupies volatile memory and abuses approved binaries

     Fileless malware never drops an executable on disk: it lives in memory and does its work through binaries the operating system already trusts, such as PowerShell or WMI, so a scanner looking for a malicious file finds nothing to match. Encrypting stored volumes and demanding anonymous payment describes ransomware. Hooking internal routines to conceal active processes describes a rootkit. Saturating adjacent subnets while generating fresh copies describes a worm.

227. An organization discovers that malicious code was inserted into a software update from a trusted third-party vendor before it was distributed to customers. Which type of attack is this?
     • Side channel attack
     • Token replay attack
     • Supply chain attack
     • Spoofed site attack

     Correct answer: Supply chain attack

     A supply chain attack compromises a trusted supplier so that malicious code arrives through a channel the customer already trusts, which is why a poisoned vendor update can reach every downstream customer at once. A side channel attack infers secrets from timing, power draw or emissions rather than from a delivered update. A token replay attack captures a valid session token and presents it again later. A spoofed site attack lures a victim to a counterfeit page, and none of these subverts the vendor's own build.

228. A vulnerability arises because an application checks a resource's state and then acts on it in two separate steps, allowing an attacker to alter the resource between the check and the use. What is this flaw called?
     • Race condition
     • Path traversal
     • Stack smashing
     • Type confusion

     Correct answer: Race condition

     This is a race condition, specifically a time-of-check to time-of-use flaw: the resource is validated in one step and used in another, and an attacker who alters it in between gets the benefit of a check that no longer describes reality. Path traversal abuses unsanitized file paths to escape the intended directory. Stack smashing overruns a buffer in order to overwrite a saved return address. Type confusion makes code treat an object as a type it is not.

229. An attacker exploits a flaw to write code into a running process's memory space and execute it, hijacking the program's control flow. Which vulnerability category does this represent?
     • Code obfuscation
     • Cookie poisoning
     • Domain shadowing
     • Memory injection

     Correct answer: Memory injection

     Memory injection is the vulnerability category for writing code into the address space of a live process and then executing it, which lets the attacker seize the program's control flow from inside a trusted process. Code obfuscation hides the meaning of code from an analyst; it does not place code inside another running process. Cookie poisoning alters session data held in the browser, so it never touches process memory. Domain shadowing creates hidden subdomain records under a hijacked DNS account, which is a name-resolution abuse rather than an in-process execution flaw.

230. Which attack derives secret information by measuring physical characteristics such as power consumption, electromagnetic emissions, or timing rather than breaking the algorithm directly?
     • Firmware implantation
     • Side-channel analysis
     • Credential harvesting
     • Directory enumeration

     Correct answer: Side-channel analysis

     Side-channel analysis recovers a secret by measuring what the hardware leaks while it computes - power draw, electromagnetic emission or elapsed time - so the mathematics of the cipher is never attacked at all. Firmware implantation writes attacker code into a device's boot image, which changes the device rather than measuring it. Credential harvesting collects passwords from users or stores and yields no information about key material inside a chip. Directory enumeration lists accounts and objects in a directory service and reveals nothing about physical emissions.

231. A web server is left with default administrative credentials and unnecessary services enabled, allowing easy compromise. Which vulnerability does this represent?
     • Certificate mismanagement
     • Continuous authentication
     • Insufficient segmentation
     • Security misconfiguration

     Correct answer: Security misconfiguration

     Security misconfiguration is the weakness introduced when a system is deployed with its factory administrative account intact and services running that nobody needs, because the settings - not the code - create the exposure. Certificate mismanagement covers expired, untracked or wrongly issued certificates, none of which is implied by unused services being enabled. Insufficient segmentation describes flat networking that lets an intrusion spread, which is a containment failure after compromise. Continuous authentication is a control that re-verifies a session over time, so it names a defence rather than the weakness the server carries.

232. A user removes the manufacturer's software restrictions on a smartphone to install unauthorized applications, increasing the device's exposure to malware. What is this action commonly called?
     • Provisioning
     • Cryptomining
     • Jailbreaking
     • Tokenization

     Correct answer: Jailbreaking

     Jailbreaking is the removal of the vendor's software restrictions from a mobile device so that unsigned applications can be installed, and it widens the attack surface exactly as described. Provisioning is the managed issuing and configuring of a device for a user, which enforces vendor controls instead of stripping them. Cryptomining consumes a device's processor to generate currency and does not alter the platform's signing restrictions. Tokenization swaps a sensitive value for a surrogate in a data store and has nothing to do with mobile operating-system limits.

233. An attacker sends unsolicited messages to nearby Bluetooth-enabled devices. Which attack is this?
     • Sideloading
     • Bluejacking
     • Bluebugging
     • Obfuscation

     Correct answer: Bluejacking

     Bluejacking is the nuisance technique of pushing unrequested messages to Bluetooth devices that are in range and discoverable; nothing is read from the target and nothing is controlled. Sideloading installs an application from outside the official store, which is a software-distribution problem rather than a radio-range message push. Bluebugging goes much further by taking command of the handset's functions over Bluetooth, so it is control rather than messaging. Obfuscation makes code or data hard to interpret and is not a way of contacting nearby devices.

234. An attacker connects to a victim's Bluetooth device without authorization and copies contacts, messages, and files. Which attack is this?
     • Piggybacking
     • Bluesnarfing
     • Clickjacking
     • Segmentation

     Correct answer: Bluesnarfing

     Bluesnarfing is the unauthorised pull of stored data - contacts, messages and files - from a Bluetooth device, so theft of content over the radio link is its defining feature. Piggybacking is entering a controlled physical space on someone else's credential, which is a building-access problem. Clickjacking layers an invisible frame over a web page so a click is redirected, and it requires a browser rather than a Bluetooth pairing. Segmentation is a defensive design that divides a network into zones and is not an attack at all.

235. An attacker tries one or a few common passwords across many different user accounts to avoid triggering account lockouts. Which technique is this?
     • Keystroke logging
     • Password spraying
     • Session hijacking
     • Reflection attack

     Correct answer: Password spraying

     Password spraying tries a very small set of likely secrets against a large population of accounts, which keeps the failure count per account beneath the lockout threshold while still covering a wide target list. Keystroke logging captures what a user types at the endpoint, so it needs code on the victim's machine and never generates authentication attempts. Session hijacking takes over an already authenticated session and therefore skips the login step entirely. A reflection attack bounces spoofed requests off third-party servers to flood a victim, which is a denial-of-service technique rather than credential guessing.

236. What is the key difference between an online brute-force attack and an offline brute-force attack?
     • Offline attacks crack captured hashes, while online attacks probe live endpoints
     • Offline attacks need session cookies, while online attacks need encrypted tokens
     • Offline attacks recover symmetric keys, while online attacks recover public keys
     • Offline attacks disable audit alerts, while online attacks disable lockout rules

     Correct answer: Offline attacks crack captured hashes, while online attacks probe live endpoints

     An offline attack works on password hashes the attacker has already captured, running on equipment the attacker owns, so there is no lockout counter and no defender watching; an online attack submits each guess to the running authentication service, where rate limits, lockout policy and alerting all apply. Session cookies belong to an already authenticated user and are needed by neither form of guessing. Neither form recovers symmetric or public key material; both target the secret a user chose. And neither switches off audit alerting or lockout policy - the offline case simply never reaches the system where those controls live.

237. An attacker floods a switch with forged MAC addresses to overflow its address table, causing it to broadcast traffic out all ports so the attacker can capture it. Which attack is this?
     • Smurf attack
     • RFID cloning
     • MAC flooding
     • Cookie theft

     Correct answer: MAC flooding

     MAC flooding fills a switch's forwarding table with bogus hardware addresses until the table is exhausted, and the switch then floods frames out of every port so an attached attacker can read traffic that was never meant for it. A Smurf attack sends spoofed echo requests to a broadcast address to swamp a victim with replies, which denies service instead of exposing frames. RFID cloning copies the identifier from a contactless badge or tag and has no effect on switching. Cookie theft steals a browser session token and operates well above the switching layer.

238. An attacker sends forged ARP replies on a LAN to associate their MAC address with the default gateway's IP, intercepting victims' traffic. What is this attack?
     • ARP poisoning
     • SQL injection
     • Card skimming
     • Replay attack

     Correct answer: ARP poisoning

     ARP poisoning broadcasts falsified address-resolution replies so that the attacker's hardware address is cached against the gateway's network address, placing the attacker on the path of every conversation leaving the segment. SQL injection inserts crafted input into a database query and never touches layer-2 address caches. Card skimming captures payment data at a reader, which is a physical-device attack. A replay attack resends captured, still-valid traffic to obtain an effect a second time, and that requires no forged mapping of address to hardware.

239. A DDoS attack sends small DNS queries with a spoofed source address so that large DNS responses are directed at the victim. What is this technique called?
     • DNS amplification
     • TLS renegotiation
     • Command injection
     • Keystroke logging

     Correct answer: DNS amplification

     DNS amplification is the flooding method in which tiny queries carrying the victim's forged source address are sent to open resolvers, so the far larger answers all arrive at the victim and consume its bandwidth. TLS renegotiation abuse forces repeated handshakes on one connection to burn server processor time, and it neither spoofs a source nor multiplies response size. Command injection runs attacker-supplied operating-system commands through a vulnerable application, which is a code-execution flaw. Keystroke logging records typed input on an endpoint and generates no network flood.

240. Which DDoS variant targets a web application's resource-intensive functions, such as search or login, with seemingly legitimate requests rather than overwhelming raw bandwidth?
     • Application-layer flood
     • Bandwidth amplification
     • Infrastructure flooding
     • Reconnaissance scanning

     Correct answer: Application-layer flood

     An application-layer flood aims a modest number of well-formed requests at the costly parts of a web application - search, login, report generation - so the server exhausts its own processing and database capacity while the raw traffic volume stays unremarkable. Bandwidth amplification depends on multiplying response size to saturate a link, which is the volumetric behaviour the question excludes. Infrastructure flooding overwhelms lower-layer devices and circuits, again through sheer volume. Reconnaissance scanning maps hosts and services before an attack and is not a denial-of-service method.

241. Security analysts notice an account logging in from New York and, twelve minutes later, from Tokyo. Which indicator of compromise does this represent?
     • Missing telemetry
     • Blocked downloads
     • Impossible travel
     • Repeated lockouts

     Correct answer: Impossible travel

     Impossible travel is the compromise indicator raised when one identity authenticates from two places that no person could cross in the elapsed time, which points to a credential being used by someone else. Missing telemetry is the indicator seen when expected log data stops arriving, so it hides activity instead of exposing a geographic contradiction. Blocked downloads record content the security stack refused to deliver and reveal nothing about where a session began. Repeated lockouts follow a run of failed authentication, whereas both sessions described here succeeded.

242. An administrator observes that a server's CPU and memory are pegged at near 100% with no legitimate workload to explain it. Which indicator of compromise does this best illustrate?
     • Out-of-cycle logging
     • Resource consumption
     • Unexplained lockouts
     • Certificate spoofing

     Correct answer: Resource consumption

     Resource consumption is the indicator of compromise in which processor, memory, storage or bandwidth is heavily used with no authorised workload to account for it, the pattern left by mining software or another unsanctioned process. Out-of-cycle logging describes log entries appearing at times that do not match the scheduled activity, which is a timing signal rather than a utilisation signal. Unexplained lockouts follow failed authentication against user accounts and appear in identity records, not in utilisation graphs. Certificate spoofing presents a fraudulent certificate to a client and surfaces as a trust error, leaving processor and memory untouched.

243. Repeated failed authentication attempts that trigger many users being locked out can serve as an indicator of which activity?
     • Brute-force attack
     • Certificate expiry
     • Firmware tampering
     • Directory failover

     Correct answer: Brute-force attack

     A brute-force attack is the activity indicated when many accounts lock out after a burst of failed authentication, because the attacker is submitting guess after guess until the lockout policy stops each account. Certificate expiry breaks trust between systems and produces validation errors, not a run of bad passwords counted against user accounts. Firmware tampering alters low-level device code and leaves no trace in authentication counters. Directory failover moves authentication to a surviving replica, which preserves logins rather than accumulating failures against them.

244. Which mitigation technique reduces a system's attack surface by disabling unnecessary services, closing unused ports, and removing default accounts?
     • Bloatware
     • Shredding
     • Hardening
     • Isolation

     Correct answer: Hardening

     Hardening is the mitigation that shrinks the attack surface by turning off services nobody needs, closing ports that carry no traffic and deleting factory accounts, so fewer entry points exist to attack. Bloatware is unwanted software shipped with a system and enlarges the attack surface rather than reducing it. Shredding destroys printed material or media at disposal and does nothing to a running configuration. Isolation separates a system or process from others to limit reach, which contains an intrusion instead of removing the unnecessary functions that invite one.

245. An organization divides its network into isolated zones so that a compromise in one zone cannot easily spread to others. Which mitigation technique is this?
     • Segmentation
     • Whitelisting
     • Tokenization
     • Provisioning

     Correct answer: Segmentation

     Segmentation divides a network into separate zones with controlled paths between them, so an intruder who lands in one zone cannot reach the rest without crossing an enforcement point. Whitelisting permits only approved applications to execute, which governs software on a host rather than the reachability between zones. Tokenization replaces a sensitive value with a meaningless substitute and protects data content, not network topology. Provisioning issues and configures accounts and systems, which is a lifecycle activity with no containment effect.

246. Which mitigation directly addresses known software vulnerabilities by applying vendor-released fixes in a timely, managed way?
     • Patch management
     • Privilege review
     • Correlation rule
     • Fire suppression

     Correct answer: Patch management

     Patch management is the controlled process of obtaining, testing and deploying supplier fixes so that publicly known defects are closed on a predictable schedule. Privilege review re-examines who holds which rights and removes excess, which curbs abuse of access but leaves the defective code in place. A correlation rule joins events in a monitoring platform to raise an alert, so it detects rather than remediates. Fire suppression is an environmental safety control for the facility and has no bearing on software defects.

247. Which mitigation ensures that data remains unreadable to attackers even if storage media or backups are stolen?
     • Degaussing
     • Federation
     • Geofencing
     • Encryption

     Correct answer: Encryption

     Encryption keeps stored data unintelligible to anyone without the key, so a drive or backup set that leaves the building is worthless to whoever takes it. Degaussing erases magnetic media at disposal and therefore protects nothing on media that is still in service and carrying data. Federation lets one organisation accept another's authentication decisions and governs identity, not the readability of stored blocks. Geofencing restricts activity by physical location and cannot travel with media that has already been removed from the site.

248. An organization deploys continuous log collection and analysis to detect threats as they occur. Which mitigation strategy does this represent?
     • Sandboxing
     • Honeytoken
     • Onboarding
     • Monitoring

     Correct answer: Monitoring

     Monitoring is the continuous collection and analysis of telemetry such as event logs so that malicious activity is noticed while it is happening. Sandboxing runs untrusted code in a confined environment to observe or contain it, which isolates one sample rather than watching the estate. A honeytoken is a planted decoy credential or file whose use raises an alert, so it is one narrow tripwire rather than a collection programme. Onboarding brings a new person or supplier into the organisation with the right accounts and training and produces no detection capability.

249. Which mitigation technique uses tools to detect and automatically correct deviations from an approved secure baseline across systems?
     • Configuration enforcement
     • Enterprise authentication
     • Microservice architecture
     • Infrastructure monitoring

     Correct answer: Configuration enforcement

     Configuration enforcement is the mitigation in which tooling compares each system against an approved secure baseline and puts back any setting that has drifted, so the estate is corrected automatically rather than by hand. Enterprise authentication describes how users prove identity to the network and leaves system settings untouched. Microservice architecture is a way of decomposing an application into small services and says nothing about baseline compliance. Infrastructure monitoring reports the deviation once it appears but takes no corrective action of its own.

250. When an organization retires old equipment, securely wiping and destroying data-bearing media is part of which mitigation activity?
     • Continuous monitoring
     • Geographic dispersion
     • Asymmetric encryption
     • Asset decommissioning

     Correct answer: Asset decommissioning

     Asset decommissioning is the retirement stage in which equipment leaves service and its data-bearing media is wiped, degaussed or destroyed so no residual information escapes with the hardware. Continuous monitoring watches systems that are still in production and stops reporting on a device the moment it is unplugged, so it cannot sanitise anything. Geographic dispersion places facilities far apart for resilience and has no bearing on what happens to a retired disk. Asymmetric encryption protects data in transit and at rest but does not remove it from media that is being discarded.

251. An attacker abuses a flaw to gain higher permissions than originally granted, such as moving from a standard user to an administrator. What is this called?
     • Registry persistence
     • Dependency confusion
     • Certificate spoofing
     • Privilege escalation

     Correct answer: Privilege escalation

     Privilege escalation is the abuse of a flaw or weak setting to hold rights beyond those granted, such as a standard account gaining administrative control of the host. Registry persistence keeps attacker code running across reboots at whatever rights it already has, so it maintains access rather than raising it. Dependency confusion tricks a build system into pulling a malicious package from a public source, which is a supply-chain problem. Certificate spoofing presents a fraudulent certificate to fool a client and changes nothing about the account rights on the host.

252. An attacker reuses username and password pairs leaked from one breached site to log in to accounts on other sites. Which attack is this?
     • Directory traversal
     • Credential stuffing
     • Token impersonation
     • Volumetric flooding

     Correct answer: Credential stuffing

     Credential stuffing replays complete username and password pairs taken from one breach against unrelated services, and it succeeds because people reuse the same pair in several places. Directory traversal walks outside a web application's intended path to read files it should not serve, which requires no stolen credentials. Token impersonation reuses an access token already present on a compromised host, so no login pair is submitted anywhere. Volumetric flooding saturates a link with traffic and never attempts authentication at all.

253. A malicious actor sets up a rogue wireless access point with the same SSID as a legitimate corporate network to lure users into connecting. Which attack is this?
     • Fork bomb
     • Evil twin
     • War chalk
     • Web shell

     Correct answer: Evil twin

     An evil twin is a hostile access point broadcasting a network name identical to the genuine one, so clients associate with the attacker and their traffic can be read or altered. A fork bomb exhausts a host by spawning processes until it can do no useful work, which denies service locally instead of impersonating a network. War chalk marks the physical location of wireless networks that have already been found and creates no access point. A web shell is attacker code left on a compromised web server for later command execution, which needs no wireless element.

254. An attacker intentionally transmits radio interference to disrupt a wireless network's availability. What is this attack called?
     • Vishing
     • Jamming
     • Baiting
     • Bootkit

     Correct answer: Jamming

     Jamming deliberately floods the radio spectrum with interference so legitimate stations cannot reach the access point, which attacks availability rather than confidentiality. Vishing is a telephone-based deception that persuades a person to disclose information and does not disturb any radio channel. Baiting leaves tempting media or offers where a victim will find them and depends on a human taking the bait. A bootkit infects the boot process so it loads before the operating system, which is a persistence technique on one host.

255. Which vulnerability arises when an application includes outdated open-source libraries or components with known flaws?
     • Hardcoded credentials
     • Outdated cryptography
     • Vulnerable components
     • Unencrypted transport

     Correct answer: Vulnerable components

     Vulnerable components is the weakness an application inherits when it ships with third-party libraries that carry publicly documented defects, because the flaw arrives with the dependency rather than with the code the team wrote. Hardcoded credentials are secrets embedded in source or firmware, which is a separate defect that no dependency update creates. Outdated cryptography means weak algorithms or key sizes remain in use and would apply even to code with no external libraries. Unencrypted transport exposes data on the wire and is a protocol choice, not a dependency problem.

256. A cryptographic attack exploits the mathematics of hash collisions to find two different inputs that produce the same hash. Which attack is this?
     • Birthday attack
     • Fault injection
     • Banner grabbing
     • Buffer overflow

     Correct answer: Birthday attack

     A birthday attack uses the probability result behind the birthday problem to find two distinct inputs that hash to one digest far sooner than the digest length suggests, which is why it targets the collision resistance of a hash. Fault injection disturbs a device with voltage or clock glitches to make it compute incorrectly, so it attacks the hardware rather than the hash mathematics. Banner grabbing reads the version strings a service advertises and is a reconnaissance step. A buffer overflow writes past an allocated region in memory and has no connection to digest collisions.

257. An attacker forces a secure connection to negotiate an older, weaker protocol or cipher that is easier to break. Which attack is this?
     • Downgrade attack
     • Traffic sniffing
     • Integer overflow
     • Container escape

     Correct answer: Downgrade attack

     A downgrade attack interferes with negotiation so the two ends settle on an obsolete protocol version or weak cipher that the attacker can already defeat, leaving the session nominally secure but practically readable. Traffic sniffing passively captures frames that are already exposed and changes no negotiated parameter. Integer overflow occurs when arithmetic wraps past the limits of its type and corrupts program logic. Container escape breaks out of a container into the host, which is an isolation failure rather than a cryptographic negotiation problem.

258. An attacker captures a user's password hash from memory and uses it to authenticate to other systems without ever cracking the plaintext password. Which attack is this?
     • Typosquatting
     • Kerberoasting
     • Pass-the-hash
     • Steganography

     Correct answer: Pass-the-hash

     Pass-the-hash submits a captured password hash straight to the authentication protocol, so the attacker reaches other systems without ever recovering the plaintext secret. Typosquatting registers misspelled domain names to catch mistyped traffic and involves no credential material. Kerberoasting requests service tickets and then cracks them offline, which is the very recovery of the plaintext that this technique avoids. Steganography conceals a message inside an innocuous file and is a hiding method with no authentication role.

259. Which insider-related risk involves a trusted employee or partner being manipulated or coerced into aiding an attack without realizing the harm?
     • Competitive espionage
     • Unintentional insider
     • Recreational intruder
     • Hacktivist defacement

     Correct answer: Unintentional insider

     An unintentional insider is the trusted person whose access is turned against the organisation through deception or pressure while they believe they are doing something ordinary, so the harm is real but the intent is absent. Competitive espionage is a deliberate campaign by a rival to obtain commercial secrets, which is intentional on both sides. A recreational intruder acts for challenge or status using tools written by others and holds no trusted position. Hacktivist defacement is a public act of protest by an outsider, so no insider is manipulated at all.

260. After compromising one workstation, an attacker uses stolen credentials to access additional internal systems and expand their foothold. Which activity is this?
     • Domain shadowing
     • Packet capturing
     • Code obfuscation
     • Lateral movement

     Correct answer: Lateral movement

     Lateral movement is the stage in which an intruder who already holds one host reuses harvested credentials to reach further systems and widen the foothold inside the perimeter. Domain shadowing adds concealed records beneath a hijacked domain to support external infrastructure, which happens outside the victim network. Packet capturing records traffic for later analysis and gains no additional systems. Code obfuscation makes a payload harder for an analyst or scanner to read, so it protects the tooling rather than extending access.

261. An IoT thermostat with hardcoded credentials and no patching capability introduces what kind of weakness in an enterprise environment?
     • Insufficient log retention
     • Improper error suppression
     • Vulnerable embedded device
     • Missing input sanitization

     Correct answer: Vulnerable embedded device

     A vulnerable embedded device is the weakness an unpatchable controller with fixed built-in credentials brings onto a corporate network, because the secret cannot be changed and the software cannot be updated, leaving a permanent foothold. Insufficient log retention destroys the evidence needed after an event but creates no entry point. Improper error suppression hides faults from operators and is a software quality defect in code the organisation controls. Missing input sanitization allows crafted data to reach an interpreter, which describes an application flaw rather than an unmaintainable appliance.

262. An attacker on a local network sends forged Address Resolution Protocol replies that map the default gateway's IP address to the attacker's MAC address, causing victim traffic to be routed through the attacker's machine. Which attack is this?
     • Supply chain attack
     • Stolen token replay
     • Rogue DHCP spoofing
     • ARP cache poisoning

     Correct answer: ARP cache poisoning

     ARP cache poisoning floods the segment with falsified address-resolution replies so hosts store the attacker's hardware address against the gateway's network address and send their traffic to the attacker first. A supply chain attack compromises a supplier's product before delivery and needs no presence on the victim's local segment. Stolen token replay reuses a captured session token to impersonate a user at the application layer. Rogue DHCP spoofing hands out false addressing configuration to clients as they join, which subverts leases rather than the address cache.

263. Security staff discover a wireless access point broadcasting the same SSID as the corporate network, set up by an attacker in the parking lot to trick employees into connecting and exposing their traffic. Which threat does this describe?
     • Time bomb
     • Evil twin
     • Port scan
     • Data leak

     Correct answer: Evil twin

     An evil twin is a rogue access point advertising the same network name as the corporate wireless service, so staff associate with the attacker's radio and expose their traffic to inspection. A time bomb is malicious code held until a chosen date and executes on the host that carries it. A port scan enumerates which services are reachable on a target and creates no wireless network. A data leak names a category of impact rather than an attack technique, so it identifies nothing about the rogue radio the staff actually found.

264. An attacker takes a single commonly used password, such as 'Spring2026!', and tries it against hundreds of different user accounts to avoid triggering account-lockout thresholds. Which attack is this?
     • Dictionary attack
     • Process hollowing
     • Anomaly detection
     • Password spraying

     Correct answer: Password spraying

     Password spraying takes one likely secret and tries it once against a very large set of accounts, which spreads the failures thinly enough that no single account reaches its lockout limit. A dictionary attack works the other way round, driving a long word list against one account, so it trips exactly the lockout the described attacker is avoiding. Process hollowing replaces the image of a running process with malicious code and submits no logins. Anomaly detection is the defensive analytic that would notice the pattern, not the attack itself.

265. A developer plants malicious code in an application that remains dormant until a specific condition is met, such as the developer's name being removed from the payroll database, at which point it deletes files. What is this threat?
     • War flying
     • Data theft
     • Logic bomb
     • Log wiping

     Correct answer: Logic bomb

     A logic bomb is code planted inside a legitimate application that stays inert until a stated condition is met - here the author's record leaving the payroll system - and then runs its destructive payload. War flying surveys wireless networks from an aircraft or drone and is a reconnaissance activity outside any application. Data theft is the removal of information, whereas the code described deletes files rather than copying them out. Log wiping erases evidence after an event and is a concealment step, not a triggered payload.

266. Investigators find malicious activity running entirely in memory using legitimate tools such as PowerShell, with no executable written to disk, making it difficult for traditional signature-based antivirus to detect. What type of attack is this?
     • Malicious update
     • Domain hijacking
     • Fileless malware
     • Collision attack

     Correct answer: Fileless malware

     Fileless malware runs from memory and drives trusted built-in interpreters such as the system shell, so no executable is written to disk for a signature engine to match. A malicious update delivers a tampered installer through a legitimate channel, which does place a file on disk. Domain hijacking seizes control of a registered name and its records and is not a host execution technique. A collision attack finds two inputs sharing one hash value and belongs to cryptanalysis rather than endpoint evasion.

267. An adversary compromises a trusted software vendor and embeds malicious code into a routine product update, which is then distributed to thousands of downstream customers who trust the vendor's signed package. Which type of attack is this?
     • Watering hole attack, frequented portal poisoning
     • Password spraying attack, popular secret guessing
     • Supply chain attack, corrupted upstream packaging
     • Session hijacking attack, harvested cookie replay

     Correct answer: Supply chain attack, corrupted upstream packaging

     A supply chain attack subverts something the victim already trusts - the vendor, the build system or the update channel - so signed malicious code is delivered by the legitimate distribution path to every downstream customer at once. A watering hole compromises a third-party site the targets happen to browse, so it reaches only visitors of that site and never rides the vendor's own signature. Password spraying tries a few common secrets against many accounts and gains nothing from vendor trust. Session hijacking steals an already authenticated token from a live user and affects only that session.

268. After gaining access to a standard user account, an attacker exploits a misconfigured service to obtain administrative rights on the same system. Which activity does this describe?
     • Privilege escalation, vertical entitlement widening
     • Lateral movement, unauthorized workstation crossing
     • Credential stuffing, harvested passphrase replaying
     • Backdoor installation, surviving restart durability

     Correct answer: Privilege escalation, vertical entitlement widening

     Privilege escalation is the vertical step: the attacker already holds a foothold and abuses a flaw or a misconfigured service to run with higher rights on that same machine. Lateral movement is the horizontal step to a different host and does not change the rights held. Credential stuffing replays passwords exposed in someone else's breach against other sites, which is an access technique rather than a rights change. Installing a backdoor keeps the access already obtained across reboots but grants no additional rights.

269. An attacker manipulates a web application's file parameter by submitting '../../etc/passwd' to read files outside the intended web directory. What is this attack called?
     • Command injection, shell metacharacter chaining
     • Cross-site scripting, visitor browser execution
     • Buffer overflow, unchecked boundary overwriting
     • Directory traversal, relative pathname climbing

     Correct answer: Directory traversal, relative pathname climbing

     Directory traversal abuses a parameter that is used to build a file path: relative sequences such as ../ walk the attacker up and out of the intended directory so files elsewhere on the disk can be read. Command injection appends shell metacharacters so the server executes an extra operating system command; no path is walked. Cross-site scripting delivers markup that runs in another user's browser and never reaches the server file system. A buffer overflow writes past the end of an allocation and corrupts adjacent memory instead of resolving a path.

270. A logged-in user is tricked into clicking a crafted link that causes their authenticated browser to submit an unwanted state-changing request, such as transferring funds, to a banking site without their intent. Which attack is this?
     • Clickjacking overlay attack, misleading display framing
     • Cross-site request forgery, unauthorized state changing
     • Session fixation reuse, predicted identifier implanting
     • Open redirect abuse, unvalidated destination forwarding

     Correct answer: Cross-site request forgery, unauthorized state changing

     Cross-site request forgery works because the browser attaches the victim's existing session automatically: a crafted link or form causes that browser to send a state-changing request, such as a transfer, which the site accepts as genuine. Clickjacking layers an invisible frame over a page so the victim clicks a control they cannot see, which requires the victim to act on the real interface. Session fixation plants an identifier the attacker already knows before the victim signs in, so the attacker rides the session rather than the victim's own request. An open redirect merely bounces a visitor to an unvalidated destination and changes no state on the trusted site.

271. A laptop ships from the manufacturer with numerous preinstalled trial applications and utilities that the user did not request, consume resources, and may widen the attack surface. What are these programs collectively called?
     • Spyware, covert behavioral surveillance software
     • Keylogger, undetected keystroke capture software
     • Bloatware, superfluous preloaded vendor software
     • Ransomware, extortion driven encryption software

     Correct answer: Bloatware, superfluous preloaded vendor software

     Bloatware is the unwanted extra software a manufacturer ships on a new machine: trials, toolbars and duplicate utilities that nobody asked for. It is not written to harm the owner, but it consumes memory and disk, and every extra listening component enlarges the attack surface. Spyware is written specifically to observe the user and send what it collects to someone else. A keylogger is a narrower tool whose whole purpose is to record keystrokes. Ransomware encrypts the owner's files and demands payment, which is deliberate extortion rather than commercial clutter.

272. An attacker forces a secure communication session to negotiate an older, weaker protocol version, such as falling back from TLS 1.3 to SSL 3.0, in order to exploit known weaknesses. What type of attack is this?
     • Birthday attack, statistical hash collision probability
     • Replay attack, captured protocol message retransmission
     • Key reinstallation attack, replayed handshake sequences
     • Downgrade attack, constrained fallback cipher selection

     Correct answer: Downgrade attack, constrained fallback cipher selection

     A downgrade attack interferes with the handshake so both sides settle on an older, weaker version - falling back from a current TLS release to a deprecated SSL version - and the attacker then breaks the weak cipher instead of the strong one. A birthday attack exploits the mathematics of collisions to find two inputs with the same digest, which does not touch version negotiation. A replay attack retransmits a message that was already captured, so the agreed protocol version is unchanged. A key reinstallation attack forces a nonce to be reused inside an otherwise current handshake, so the protocol stays the same and only the key stream is broken.

273. An organization continues running a server operating system that the vendor no longer supports, meaning no further security patches are released for newly discovered flaws. Which vulnerability does this represent?
     • End-of-life legacy platform, terminated maintenance lifecycle
     • Zero-day exposure window, undisclosed unpatched vulnerability
     • Security control misconfiguration, overly permissive defaults
     • Improper input validation, unconstrained parameter acceptance

     Correct answer: End-of-life legacy platform, terminated maintenance lifecycle

     A platform past its end-of-life date is outside the support lifecycle, so nothing the vendor learns about later ever becomes a patch for it and every new flaw is permanent. A zero-day is temporarily unpatched because nobody has disclosed it yet; support still exists and a fix follows disclosure. A misconfiguration is a setting the owner can correct without any vendor involvement. Improper input validation is a defect in the application's own code that is fixed by the developers who wrote it.

274. A penetration tester discovers that a network device is still using the credentials 'admin/admin' set by the manufacturer because they were never changed during deployment. Which vulnerability is this?
     • Excessive network ports, unnecessary unfiltered applications
     • Unchanged default credentials, provided administrative login
     • Deprecated cipher negotiation, obsolete encryption algorithm
     • Race condition defect, exploitable synchronization intervals

     Correct answer: Unchanged default credentials, provided administrative login

     Default credentials are the account the manufacturer ships with, and they are published in the product documentation, so an unchanged admin/admin pair means anyone who can reach the device is already an administrator. Open ports expose services that should have been switched off, but reaching a service is not the same as logging in to it. A deprecated cipher negotiation lets an attacker who can capture traffic break the encryption, which requires a position on the path. A race condition depends on winning a timing window between a check and its use, not on a documented password.

275. A security analyst attributes a sophisticated, well-funded intrusion with long-term strategic objectives and stealthy persistence to a nation-state group. Which threat actor type best describes this adversary?
     • Unskilled script-kiddie threat, borrowed toolkit opportunism
     • Ideological hacktivist threat, publicized protest defacement
     • Organized criminal threat, lucrative ransomware monetization
     • Nation-state persistent threat, sustained covert sponsorship

     Correct answer: Nation-state persistent threat, sustained covert sponsorship

     A state-sponsored advanced persistent threat is defined by its backing and its patience: government funding buys custom tooling and skilled operators, and the goal is strategic intelligence held over years, which is why the access is quiet rather than noisy. A script kiddie runs tools written by other people and takes whatever target is easy. A hacktivist wants the incident to be seen, because publicity is the point of the campaign. Organized crime is well resourced but monetizes access quickly through extortion and resale, so it does not sit silently for years.

276. To reduce the attack surface of a newly deployed server, an administrator removes unnecessary software, disables unused services and ports, and applies a secure baseline configuration. Which mitigation technique is being applied?
     • Network segmentation, isolating broadcast partition
     • Software sandboxing, confining unverified processes
     • System hardening, shrinking configuration footprint
     • Least privilege, restricting delegated entitlements

     Correct answer: System hardening, shrinking configuration footprint

     Hardening is the work of making one host present as little as possible: uninstall what is not needed, switch off services and listening ports, and apply the secure baseline so the remaining configuration is deliberate. Segmentation changes where a host sits on the network and limits what can reach it, but the host itself still runs everything it did before. Sandboxing confines a single untrusted process inside a restricted execution environment rather than trimming the platform. Least privilege limits what accounts may do once they are on the system and leaves the installed software untouched.

277. An employee notices a USB cable left in a public charging station and connects their phone, unaware it is a malicious cable designed to inject keystrokes and exfiltrate data. Which attack vector does this best illustrate?
     • Weaponized USB peripheral, forged input controller
     • Cloned RFID badge, duplicated proximity credential
     • Rogue NFC reader, intercepted contactless transfer
     • Wireless GPS spoofer, fabricated navigation signal

     Correct answer: Weaponized USB peripheral, forged input controller

     A cable or drive that the victim plugs in themselves is the removable-media vector. The hardware inside declares itself to the operating system as a keyboard, so the host trusts it as an input device and runs whatever it types, and the same connection can copy data back out. A cloned proximity badge is copied at a distance and used at a door reader, so the victim never connects anything. A rogue contactless reader also works at range and skims a payment token rather than executing code on the phone. A spoofed positioning signal misleads navigation and delivers no payload to the device at all.

278. A bank wants its public-facing payment service to remain reachable even if an entire data center loses power. Which architectural approach BEST meets this requirement?
     • Duplicated power supplies, isolated facility protection
     • Multiple availability zones, geographic site redundancy
     • Mirrored storage arrays, single-room volume duplication
     • Nightly offsite backups, delayed restoration capability

     Correct answer: Multiple availability zones, geographic site redundancy

     High availability at site level means the workload already runs in more than one physically separate location, so losing an entire building removes capacity but not the service. Redundant feeds and generators harden one building against one class of failure and still leave that building as the single point of failure. Mirrored arrays duplicate a volume inside the same room, so they survive a disk, not a site. Backups are a recovery mechanism measured in hours: the data survives, but the payment service is down while someone restores it.

279. An organization wants to run a workload without managing the underlying operating system, patching, or server capacity, paying only for execution time. Which cloud model BEST fits this need?
     • Infrastructure hosting service, tenant patched instances
     • Private hypervisor cluster, self operated virtualization
     • Colocation cabinet leasing, customer maintained hardware
     • Serverless function platform, event triggered invocation

     Correct answer: Serverless function platform, event triggered invocation

     In a serverless model the unit of deployment is a function that the provider runs on demand: there is no guest operating system for the customer to patch, no capacity to size, and the meter runs only while the code executes. Infrastructure as a service hands over the virtual machine but the tenant still owns the guest operating system and its patch cycle. A privately run hypervisor cluster leaves the customer operating the virtualization layer as well. Colocation is only floor space, power and cooling, so the customer still buys, racks and maintains the hardware.

280. A security architect wants to provision identical, repeatable cloud environments and track every configuration change in version control. Which approach BEST achieves this?
     • Machine snapshots, replicated appliance blueprints
     • Written runbooks, sequential operator instructions
     • Infrastructure code, versioned declarative recipes
     • Advisory boards, periodic authorization gatherings

     Correct answer: Infrastructure code, versioned declarative recipes

     Infrastructure as code turns the environment itself into a file: a declarative template that can be diffed, reviewed and rolled back like source, so two deployments from the same commit are identical and every change carries an author and a reason. A machine snapshot reproduces one host but not the network, identity and policy around it, and the image itself is a binary that version control cannot meaningfully diff. A written runbook still depends on a human performing the steps correctly each time. An advisory board records approval for a change, which is governance rather than reproducible provisioning.

281. A company must store credit card numbers so the production application can still process payments, but it wants to remove the actual card values from its systems and replace them with non-sensitive substitutes. Which data protection technique BEST meets this requirement?
     • One-way digests, computationally irreversible outputs
     • Tokenization, vaulted surrogate identity substitution
     • Full-disk encryption, powered-off hardware protection
     • Transport security, in-flight channel confidentiality

     Correct answer: Tokenization, vaulted surrogate identity substitution

     Tokenization removes the card number from the environment entirely: the application holds a meaningless surrogate, and only the token vault can map it back, so the systems that used to be in scope now store nothing worth stealing yet payments still resolve. Hashing is deliberately one-way, so the original number can never be recovered and the transaction could not be completed. Full-disk encryption protects a drive that is powered off; once the server is running, the application reads the real card numbers. Transport security protects the copy in flight and leaves the stored value untouched.

282. Developers need realistic-looking customer records in a test environment but must not expose real personal data. Which technique BEST allows them to keep the format of the data while hiding the true values?
     • Data masking, fictitious replacement attribute entries
     • Role-based access control, membership scoped screening
     • Database transaction auditing, recorded query sampling
     • Backup archive encryption, safeguarding offline copies

     Correct answer: Data masking, fictitious replacement attribute entries

     Masking rewrites each field with an invented value of the same shape and length, so a test record still looks and behaves like a customer record while the real person behind it is gone from the environment. Access control limits who may open the table, but the developers who need the test data would be granted exactly that access and would then see genuine records. Transaction auditing records the queries after the fact and prevents no exposure. Encrypting the backups protects the archive copy, while the live test database still returns the real values.

283. An architect is selecting a protocol to securely manage network devices and wants to replace the cleartext protocol historically used for remote command-line administration. Which protocol should be used?
     • FTP, unencrypted server filesystem uploading
     • TFTP, unauthenticated firmware image loading
     • SSH, encrypted administrative shell wrapping
     • SNMP, community string counter interrogating

     Correct answer: SSH, encrypted administrative shell wrapping

     SSH is the direct replacement for Telnet: the same interactive command line, wrapped in an encrypted, integrity-protected channel with host key verification, so credentials and commands cannot be read or altered on the wire. FTP moves files and sends its own login in the clear, so it repeats the weakness rather than fixing it. TFTP has no authentication at all and exists to fetch configuration or image files. SNMP polls and sets device variables and, in its older versions, authorizes with a community string sent in the clear.

284. A security team needs to ensure that DNS responses cannot be forged or tampered with in transit by validating their authenticity with digital signatures. Which technology BEST provides this protection?
     • DHCP snooping, unauthorized address monitoring
     • HTTPS resolution, encrypted request forwarding
     • NAT gateway, unroutable perimeter readdressing
     • DNSSEC, hierarchical delegated trust anchoring

     Correct answer: DNSSEC, hierarchical delegated trust anchoring

     DNSSEC signs each zone and links every zone to its parent, so a resolver can follow the chain from a trust anchor down to the record it received and detect anything that was altered or fabricated along the way. DHCP snooping polices address offers on switch ports and never touches name resolution. Encrypted DNS transport hides the query from onlookers, but the resolver still has no way to prove that the answer it decrypts is the one the zone owner published. NAT rewrites addresses at a boundary and makes no statement about authenticity.

285. A hardware vendor wants a dedicated chip on each laptop motherboard to securely store encryption keys and support measured boot. Which component provides this capability?
     • HSM appliance, bulk cryptographic offloading
     • TPM chip, tamper-proof measurement anchoring
     • SED controller, transparent drive encryption
     • UEFI firmware, signed bootloader enforcement

     Correct answer: TPM chip, tamper-proof measurement anchoring

     A TPM is soldered to one board and serves that one machine: it holds keys in hardware and records each boot component into its platform configuration registers, so a key can be sealed to a known-good measurement and refuse to release on a tampered system. An HSM is a separate network-attached appliance built for many hosts, not a per-laptop chip. A self-encrypting drive holds its own media key and encrypts blocks, but it measures nothing about the boot sequence. UEFI settings decide which bootloader signatures are accepted; the enforcement lives in firmware policy rather than in a key-storage chip.

286. An enterprise wants a centralized, tamper-resistant appliance to generate, store, and manage cryptographic keys for many applications across the data center. Which device BEST meets this requirement?
     • HSM appliance, hardened cryptographic processor
     • CA infrastructure, certificate issuance control
     • RADIUS server, centralized login authentication
     • KVM concentrator, shared administrative console

     Correct answer: HSM appliance, hardened cryptographic processor

     An HSM is a hardened box whose only job is key material: it generates keys inside the boundary, never exports the private halves in the clear, performs the operations on request for many applications at once, and destroys its contents if the enclosure is opened. A certificate authority decides which identities deserve a certificate and signs them, and it commonly relies on an HSM to hold its own signing key. RADIUS authenticates users against a directory and issues no keys. A KVM switch shares a keyboard and monitor across servers and has no cryptographic role.

287. A zero trust architecture is being designed. Which component is responsible for making the access decision by evaluating policy before a subject is allowed to reach a resource?
     • Implicit trust zone, unverified network segment
     • Subject system agent, guarded resource consumer
     • Adaptive identity signal, contextual risk input
     • Policy decision point, central control assessor

     Correct answer: Policy decision point, central control assessor

     The decision itself belongs to the control plane: the policy engine weighs identity, device posture and threat signals against the written rules and returns a grant or a deny, which the enforcement point then carries out on the data path. An implicit trust zone is the area behind a gate where traffic moves without further checks, which is exactly what zero trust tries to shrink. The subject is the user or workload asking for something, so it is the party the decision is made about, not the party making it. Adaptive identity signals are inputs consumed during that evaluation rather than the component performing it.

288. In a zero trust model, which principle dictates that no user or device is trusted by default, even when located inside the corporate network perimeter?
     • Perimeter security, trusting every internal connection
     • Least privilege, restricting every account entitlement
     • Explicit verification, rechecking every single request
     • Layered defense, overlapping every protective boundary

     Correct answer: Explicit verification, rechecking every single request

     The principle is usually quoted as never trust, always verify. Zero trust takes location out of the trust calculation: every request is authenticated and authorized on its own merits whether it came from a branch office, a home network or the rack next door, and a session that was allowed a minute ago is checked again. The perimeter model does the opposite by treating the inside as safe once the boundary is crossed, which is the assumption zero trust was created to remove. Least privilege governs how much access an identity gets after it is trusted, not whether trust is assumed in the first place. Layered defense stacks independent controls and says nothing about implicit trust.

289. An organization wants outbound user web traffic to pass through a device that filters content and hides internal client addresses from external sites. Which device performs this role?
     • Forward proxy, egress blocklist policy enforcement
     • Address translation gateway, source header rewrite
     • Network tap, silent full-duplex packet duplication
     • Load balancer, backend pool distribution scheduler

     Correct answer: Forward proxy, egress blocklist policy enforcement

     A forward proxy is deployed on behalf of the clients: every outbound session is made by the proxy, so the external site sees only the proxy's address, and because the proxy terminates the request it can apply category, reputation and content rules before letting it out. Address translation also replaces the source address, but it inspects nothing above the header and enforces no content policy. A tap silently copies frames for monitoring and cannot alter or block a session. A load balancer spreads inbound connections over a pool of servers, which is the opposite direction of travel.

290. A web team wants a device positioned in front of their public web servers to terminate TLS, distribute incoming requests, and shield the servers' identities from clients. Which technology fits this role?
     • Jump server, hardened administrative entry waypoint
     • Reverse proxy, inbound session termination endpoint
     • Protocol analyzer, captured packet inspection suite
     • Screened subnet, semitrusted public service enclave

     Correct answer: Reverse proxy, inbound session termination endpoint

     A reverse proxy answers on behalf of the servers behind it: clients connect to the proxy, the encrypted session ends there, and the proxy opens its own connections to whichever back-end node it chooses, so the origin hostnames and addresses are never exposed. A jump server exists for administrators to log in through and carries no public client traffic. A protocol analyzer observes and decodes packets but terminates nothing. A screened subnet is a network zone created by firewall rules; it describes where the servers sit rather than a device that fronts them.

291. Administrators must connect to sensitive internal systems only through a single hardened, monitored host rather than directly from their workstations. Which architectural element provides this controlled entry point?
     • Syslog collector, centralized message retention archive
     • Remote access concentrator, encrypted tunnel terminator
     • Directory service, authoritative member attribute store
     • Jump server, consolidated administrative pivot waypoint

     Correct answer: Jump server, consolidated administrative pivot waypoint

     A jump server concentrates privileged access into one place: administrators authenticate to that box, every session from it can be logged and recorded, and the sensitive systems accept management connections only from its address, so a compromised workstation cannot reach them directly. A syslog collector receives the logs those systems emit and grants no one access to anything. A remote access concentrator ends encrypted tunnels and drops users onto the network, which is the broad access a jump host is meant to replace. A directory service answers who a user is and what groups they hold, not where they must connect from.

292. A network designer wants two firewalls in a configuration where, if the active firewall fails, the standby immediately takes over with no manual intervention. Which capability provides this?
     • Link aggregation, redundant physical consolidation
     • Cold spare, unscheduled technician reconfiguration
     • Active-passive cluster, automatic standby handover
     • Rule synchronization, paired appliance replication

     Correct answer: Active-passive cluster, automatic standby handover

     In an active-passive pair one firewall carries the traffic while the other holds the same configuration and state and watches it over a heartbeat; when the heartbeat stops, the standby claims the shared address and continues the sessions without anyone being paged. Link aggregation combines physical ports into one logical link and protects against a cable or port failure, not the loss of the whole unit. A cold spare is hardware on a shelf that someone has to rack, configure and cable first. Synchronizing rules between a pair keeps them consistent but does not itself decide when one should take over.

293. A security architect must decide how a critical inline security appliance behaves if it crashes. The business requires that network traffic keep flowing even if inspection is lost. Which design choice meets this requirement?
     • Fail-closed policy
     • Fail-open behavior
     • Fail-back recovery
     • Fail-stop shutdown

     Correct answer: Fail-open behavior

     Fail-open is the availability-first choice: the moment the inline unit stops working, the path around it opens and packets continue to move even though nothing is inspecting them any more. Fail-closed is the opposite trade, dropping the traffic rather than letting anything past unexamined, which the business here has explicitly refused. Fail-back describes returning a workload to its primary once that primary is healthy again, so it applies after a recovery rather than during the outage. Fail-stop means the component halts cleanly and announces its own failure, which is a behavior of the device, not a decision about the traffic around it.

294. For a device protecting highly sensitive systems, the organization decides that if the security control fails, all traffic must be blocked rather than allowed through uninspected. Which design does this describe?
     • Fail-closed design
     • Fail-open behavior
     • Failover promotion
     • Fail-back rollback

     Correct answer: Fail-closed design

     Fail-closed is the security-first choice: if the control cannot do its job, nothing is allowed through, and the outage is accepted as the safer of the two outcomes for a highly sensitive system. Fail-open would keep the traffic moving while nothing inspects it, which is precisely the risk this organization refuses to take. Failover moves the workload to a partner unit and is about redundancy rather than what happens to packets when protection is gone. Fail-back is the later step of returning to the original unit after it is repaired.

295. A power plant must keep its control network completely physically isolated, with no network connection to the corporate network or the internet. Which approach BEST describes this isolation?
     • Virtual segmentation, software defined zone division
     • Screened subnet, guarded public application boundary
     • Air gap, comprehensive physical connectivity removal
     • Unidirectional gateway, enforced one-way data egress

     Correct answer: Air gap, comprehensive physical connectivity removal

     An air gap means there is no path at all: no cable, no wireless bridge, no shared switch, so an attacker on the corporate network has nothing to route over and data crosses only by hand on removable media. Virtual segmentation separates traffic logically while the frames still share the same physical switches and can be reached if the configuration is wrong. A screened subnet is a filtered network that exists specifically to be reachable from outside. A one-way gateway is still a connection, and although it enforces the direction of flow it is not physical separation.

296. A manufacturer ships industrial equipment that runs a real-time operating system on a low-power chip with fixed functionality and limited ability to receive patches. Which category does this BEST describe?
     • Hypervisor host, concurrent guest environments
     • General workstation, interactive user endpoint
     • Storage appliance, replicated filesystem array
     • Embedded system, purpose-built firmware device

     Correct answer: Embedded system, purpose-built firmware device

     An embedded device is built for one job: the software is burned in as firmware, the processor and memory are sized for that job and nothing else, and updates arrive rarely because they usually require the vendor and a maintenance window on the production line. A hypervisor host is a general platform whose whole purpose is to run arbitrary guest workloads. A workstation runs a general operating system with an interactive user and a routine monthly patch cycle. A storage appliance is purpose-built but sits in a data center serving files, with the capacity and the update path of ordinary server hardware.

297. A utility uses SCADA systems to monitor and control field devices across remote substations. Which environment do SCADA systems primarily support?
     • Corporate office networks, shared productivity infrastructure
     • Industrial process control, operational technology deployment
     • Public cloud subscription, on-demand application environments
     • Retail payment systems, cardholder transaction authorizations

     Correct answer: Industrial process control, operational technology deployment

     SCADA exists to supervise physical processes: it reads sensors and drives actuators in pumps, breakers and valves spread over a wide area, which is the definition of an operational technology estate and the reason its priorities are availability and safety before confidentiality. Corporate networks move documents and mail between people and are engineered around information rather than physical plant. Cloud tenancy provides elastic compute for software workloads and has no field devices to actuate. Payment systems handle cardholder transactions under card industry rules and again control no physical process.

298. A facilities team is adding internet-connected sensors, cameras, and thermostats to buildings. Which characteristic is the MOST common security concern for these IoT devices?
     • Weak default credentials, infrequent firmware updates
     • Excessive administrative privilege, wide domain scope
     • Unpatched hypervisor escapes, shared tenancy exposure
     • Injection flaws, unsanitized database query execution

     Correct answer: Weak default credentials, infrequent firmware updates

     Consumer-grade sensors and cameras ship with a published password, often cannot enforce a strong one, and receive firmware fixes rarely or never once the model stops selling, so a known flaw stays exploitable for the life of the device. Excessive domain privilege is an identity problem on managed servers and workstations, not on a thermostat that holds no domain account. Hypervisor escape belongs to virtualized multi-tenant hosting, and these devices are bare hardware. Injection flaws affect applications that build database queries, which most building sensors never do.

299. An architect wants to separate the network's control plane from the data plane so traffic forwarding can be programmed centrally through software. Which technology provides this capability?
     • Spanning tree, distributed switch-local convergence
     • Function virtualization, appliance software hosting
     • Software-defined networking, unified policy control
     • Address translation, internal boundary readdressing

     Correct answer: Software-defined networking, unified policy control

     Software-defined networking lifts the decision-making out of each switch and puts it in a controller: the devices keep only the fast forwarding path, and an operator or an application programs the whole fabric from one place through the controller's interface. Spanning tree is a distributed protocol that each switch runs for itself to break loops, which is exactly the per-device intelligence this design removes. Network function virtualization moves appliances such as firewalls into software but leaves each of them with its own control logic. Address translation rewrites headers at a boundary and does not program forwarding anywhere.

300. A company wants to limit each switch access port to a specific number of learned MAC addresses to prevent rogue devices and MAC flooding. Which feature provides this control?
     • DHCP snooping, rogue allocation offer rejection
     • BPDU guard, unexpected topology packet blocking
     • VLAN pruning, unused broadcast domain stripping
     • Port security, permitted MAC identifier capping

     Correct answer: Port security, permitted MAC identifier capping

     Port security is configured on the access port itself: the switch counts how many source addresses it has learned there, and once the maximum is reached any further address triggers the violation action, which stops both an extra device plugged into the jack and the flood of fabricated addresses used to overwhelm the address table. DHCP snooping polices address leases on a port rather than counting the hosts behind it. BPDU guard shuts down a port that receives spanning tree frames from an unexpected neighbour, which catches a rogue switch but not a rogue workstation. VLAN pruning keeps unneeded broadcast domains off a trunk and sets no limit on how many hosts may appear on an access port.

301. An architect must distribute incoming connections across a server pool and wants new sessions sent to the server with the fewest active connections at the moment. Which load balancing method describes this?
     • Least connection method, lowest concurrent workload
     • Round robin method, consecutive backend progression
     • Weighted distribution method, fixed ratio allotment
     • Source hash method, deterministic client attachment

     Correct answer: Least connection method, lowest concurrent workload

     The least-connection scheduler asks a live question before every placement: which member is carrying the smallest number of open sessions right now, and it sends the next one there, so a node stuck with long-running sessions stops receiving work automatically. Round robin walks the list in order and is blind to how busy anyone is. Weighted distribution divides traffic by a static ratio the administrator sets from expected capacity, which never reacts to the current moment. Source hashing computes the destination from the client's address so the same client keeps landing on the same node regardless of load.

302. A load balancer must ensure a user's session keeps returning to the same back-end server so cached session data remains valid. Which capability provides this behavior?
     • Health probing, unresponsive backend eviction
     • Session persistence, sticky backend anchoring
     • Connection draining, gradual backend shutdown
     • Round-robin cycling, ordered backend rotation

     Correct answer: Session persistence, sticky backend anchoring

     Persistence pins a client to one member for the life of its session, usually with a cookie or a source-address table on the balancer, so the shopping cart or login state cached on that node is still there for the next request. Health probing decides which members are eligible at all and would gladly move a client to a different healthy node. Connection draining lets existing sessions finish while a node is taken out of service, which is the orderly end of persistence rather than the mechanism that provides it. Round robin deliberately spreads consecutive requests around, which is what breaks a cached session.

303. An organization wants the ability to encrypt data while it is being actively processed in memory, not just at rest or in transit. Which protection BEST addresses data in this state?
     • Full-disk encryption, protecting stored volume contents
     • Transport layer security, shielding packet transmission
     • Encrypted backup archives, safeguarding offline volumes
     • Confidential computing, sealed memory execution enclave

     Correct answer: Confidential computing, sealed memory execution enclave

     Data has three states, and the hardest one to cover is data in use: while a record is loaded into memory and being computed on, it is normally plaintext and visible to anything with sufficient privilege on the host. Confidential computing closes that window with hardware enclaves that keep the working set encrypted and out of reach of the operating system and hypervisor. Full-disk encryption applies to a drive that is at rest and is transparent once the system is running. Transport encryption covers the journey between hosts. Encrypted backups protect stored copies, which is the at-rest state again.

304. A security architect must protect data at rest on database servers so that stolen drives or files reveal no readable content. Which control BEST addresses this requirement?
     • Transport layer security, protected network transmissions
     • Rate limiting, constrained simultaneous request admission
     • Stored-volume encryption, unreadable seized drive content
     • Data classification labeling, sensitivity tier assignment

     Correct answer: Stored-volume encryption, unreadable seized drive content

     Encrypting the data at rest means the bytes written to the database files and the underlying volumes are ciphertext, so a drive pulled from the rack or a file copied off the array yields nothing without the key, which lives elsewhere. Transport security protects the same records only while they travel between client and server and leaves the stored copy readable. Rate limiting caps how quickly requests arrive and protects availability rather than confidentiality. Classification labels tell people and tools how sensitive a record is, but a label alone does not make a stolen file unreadable.

305. An architect needs a protocol that authenticates and encrypts IP traffic for a site-to-site tunnel and operates at the network layer. Which protocol suite is the BEST choice?
     • EAPOL
     • IPSEC
     • HTTPS
     • LDAPS

     Correct answer: IPSEC

     Correct answer: IPSEC. IPsec is the network-layer protocol suite that both authenticates and encrypts entire IP packets, which is why site-to-site VPN tunnels are built on it. EAPOL carries authentication exchanges across a single LAN link and encrypts no user traffic. HTTPS protects one web session at the transport layer rather than every packet flowing between two sites. LDAPS secures directory lookups with TLS and cannot carry arbitrary routed traffic.

306. A SaaS provider runs multiple customers on shared infrastructure. Which architectural control BEST ensures one tenant cannot access another tenant's data?
     • Snapshot archiving scheduled for every tenant workload
     • Bandwidth throttling applied for every tenant workload
     • Logical isolation maintained for every tenant workload
     • Password complexity required for every tenant workload

     Correct answer: Logical isolation maintained for every tenant workload

     Correct answer: logical isolation maintained for every tenant workload. Multitenancy is made safe by strong logical isolation and access segmentation, so one customer's identities, storage paths and compute never reach another's. Snapshot archiving protects availability and copies tenant data without separating who may read it. Bandwidth throttling rations capacity and enforces no access boundary at all. Password complexity strengthens individual credentials while leaving every tenant inside the same trust boundary.

307. An organization is choosing between cloud and on-premises hosting and wants to keep its most sensitive workloads in its own data center while running elastic, less-sensitive workloads in the public cloud. Which deployment model fits this?
     • Hybrid cloud deployment
     • Public cloud deployment
     • Hosted cloud deployment
     • Onsite cloud deployment

     Correct answer: Hybrid cloud deployment

     Correct answer: hybrid cloud deployment. A hybrid model keeps the most sensitive workloads on private infrastructure the organization controls while running elastic, lower-sensitivity workloads on public cloud capacity, which is exactly the split described. A public-only deployment moves the sensitive workloads out of the organization's own data center. A hosted deployment places every workload with a third party. An onsite-only deployment keeps everything in house and gives up public cloud elasticity.

308. A development team packages an application with only its required libraries into a lightweight, portable unit that shares the host OS kernel. Which technology are they using?
     • Hardware-level emulation
     • Container virtualization
     • Filesystem deduplication
     • Hypervisor introspection

     Correct answer: Container virtualization

     Correct answer: container virtualization. Containers package an application with only the libraries it requires and execute against the shared host kernel, which is what makes the unit lightweight and portable. Hardware-level emulation runs a complete guest operating system per virtual machine, so no kernel is shared. Filesystem deduplication removes repeated storage blocks and packages no application. Hypervisor introspection inspects running virtual machines from the outside and is a monitoring technique.

309. A security team configures storage so that data and parity are striped across multiple drives, allowing the array to survive the failure of any single drive. Which RAID level provides this with single-drive fault tolerance and striping with distributed parity?
     • RAID 0
     • RAID 1
     • RAID 3
     • RAID 5

     Correct answer: RAID 5

     Correct answer: RAID 5. RAID 5 stripes data across all members and distributes parity blocks among them, so the array rebuilds after any one drive fails. RAID 0 stripes with no parity, so a single failure destroys the whole set. RAID 1 mirrors rather than stripes and writes no parity. RAID 3 does stripe, but it concentrates parity on one dedicated drive instead of distributing it across the array.

310. A company wants automatic failover to a secondary database that stays continuously synchronized with the primary so that no committed transactions are lost on failover. Which configuration BEST meets this requirement?
     • Incremental backups shipped to a tape library
     • Hourly snapshots exported to a remote archive
     • Synchronous replication to a hot standby node
     • Manual dumps scheduled by a database operator

     Correct answer: Synchronous replication to a hot standby node

     Correct answer: synchronous replication to a hot standby node. Synchronous replication commits every transaction on the standby before acknowledging it to the client, so an automatic failover to that node loses no committed work. Incremental backups shipped to tape restore only to the age of the last shipment. Hourly snapshots exported to a remote archive still leave up to an hour of transactions unrecoverable. Manual dumps run by an operator are neither continuous nor automatic.

311. An organization needs to securely transfer files between partners and wants a protocol that runs file transfers over an encrypted SSH channel. Which protocol should be selected?
     • TFTP
     • SFTP
     • FTPS
     • SMTP

     Correct answer: SFTP

     Correct answer: SFTP. SFTP performs its file operations inside an established SSH session, so credentials and file contents are protected by the SSH channel itself. TFTP offers no authentication and no encryption. FTPS is also encrypted, but it wraps classic FTP in TLS rather than running over SSH as the requirement states. SMTP transports mail between servers and is not a file transfer service.

312. A security architect wants email server administration and directory queries to be encrypted, replacing the legacy cleartext directory access protocol. Which secure protocol should be chosen for directory access?
     • IPSEC
     • SMTPS
     • LDAPS
     • HTTPS

     Correct answer: LDAPS

     Correct answer: LDAPS. LDAPS carries directory queries inside TLS, so the bind credentials and query results that plain LDAP would send in cleartext are encrypted. IPSEC protects IP traffic in general and is not a directory access protocol. SMTPS secures mail submission. HTTPS secures web traffic. None of those three speaks the directory protocol the stem needs to replace.

313. A company wants branch offices and remote users to reach cloud applications securely with centralized policy and inspection delivered from the cloud edge. Which architecture BEST describes this converged networking and security model?
     • SIEM
     • CASB
     • SOAR
     • SASE

     Correct answer: SASE

     Correct answer: SASE. Secure Access Service Edge converges wide-area networking with security services such as secure web gateway, firewall and zero trust access, all delivered from the provider's cloud edge, so branch offices and remote users receive one centrally managed policy. SIEM aggregates and correlates log data. CASB governs how individual cloud applications are used but does not carry the branch's network traffic. SOAR automates response playbooks after detection.

314. A security architect must protect data in transit for a public website so that browsers verify the server's identity and encrypt the session. Which combination BEST provides this?
     • SHA-256 hashing using a documented algorithm
     • TLS encryption using a validated certificate
     • IPv4 allowlisting using a perimeter firewall
     • HTTP authentication using a lengthy password

     Correct answer: TLS encryption using a validated certificate

     Correct answer: TLS encryption using a validated certificate. TLS encrypts the session while a certificate that chains to a trusted authority proves the server is who it claims to be, and both properties are required to protect data in transit for a public site. SHA-256 hashing provides integrity evidence but no confidentiality and no proof of identity. IPv4 allowlisting restricts which addresses may connect and encrypts nothing. HTTP authentication sends the credential over an unprotected channel however long that password is.

315. A network is being segmented so that the finance department's systems are logically separated from general user systems on the same physical switches. Which technology BEST accomplishes this logical separation?
     • STP reconvergence
     • VLAN segmentation
     • DHCP reservations
     • CDP advertisement

     Correct answer: VLAN segmentation

     Correct answer: VLAN segmentation. A VLAN places the finance ports into their own broadcast domain, so that traffic stays logically separate even though it rides the same physical switches as everyone else. STP reconvergence prevents switching loops and separates nothing. DHCP reservations pin addresses to particular hosts without changing which hosts can reach each other. CDP advertisement shares neighbor information between devices.

316. An architect wants extremely granular control where security policy is enforced down to individual workloads in a data center, limiting east-west movement between servers. Which approach BEST describes this?
     • Network microsegmentation
     • Datacenter virtualization
     • Directory synchronization
     • Infrastructure templating

     Correct answer: Network microsegmentation

     Correct answer: network microsegmentation. Microsegmentation writes policy around each individual workload rather than around a subnet, so east-west traffic between two servers inside the same data center is filtered as well. Datacenter virtualization abstracts the underlying hardware without adding any per-workload policy. Directory synchronization copies identity data between stores. Infrastructure templating standardizes how systems are built and enforces nothing at runtime.

317. A company processing European residents' personal data must keep that data within specific geographic boundaries to satisfy legal obligations. Which architectural consideration directly drives where the data may be stored?
     • Data sovereignty
     • Data replication
     • Data portability
     • Data obfuscation

     Correct answer: Data sovereignty

     Correct answer: data sovereignty. Data sovereignty, also called data residency, is the legal requirement that data about residents of a jurisdiction be stored and processed inside defined geographic boundaries, so it dictates which regions may hold the records. Data replication is a technique for copying data and will breach residency outright if the target region is wrong. Data portability is the subject's right to receive their data in a reusable form. Data obfuscation hides values without moving them anywhere.

318. A company is moving an application to a model where the cloud provider runs individual functions on demand and the customer manages no servers or operating systems at all. Which architecture model is being described, and what is its key security implication for the customer?
     • PaaS, where the customer maintains the language runtime and middleware
     • IaaS, where the customer patches each hosted operating system instance
     • SaaS, where the customer configures the vendor's ready web application
     • FaaS, where the customer safeguards its function code and entitlements

     Correct answer: FaaS, where the customer safeguards its function code and entitlements

     Correct answer: FaaS, where the customer safeguards its function code and entitlements. In a serverless Function as a Service model the provider runs short-lived functions on demand and owns the servers, operating systems and runtime entirely, so under shared responsibility the customer's remaining duties are the function code, its configuration, its identity permissions and its data. PaaS leaves the runtime and middleware with the provider, not the customer. IaaS is wrong for this stem because the customer there still patches guest operating systems, which the stem explicitly rules out. SaaS delivers a finished application the customer only configures, and no function code is deployed at all.

319. A security architect must select a hardware component that generates, stores, and manages cryptographic keys for an entire enterprise at high volume and is often certified to FIPS 140-2/140-3 for use in data centers. Which component best fits this requirement?
     • TPM
     • SED
     • HSM
     • UTM

     Correct answer: HSM

     Correct answer: HSM. A hardware security module is a dedicated tamper-resistant appliance built to generate, store and manage cryptographic keys for an entire enterprise at high transaction volume, and data center models are commonly validated to FIPS 140-2 or 140-3. A TPM is a chip bound to one host that protects that machine's own keys and boot measurements. An SED encrypts the contents of a single drive with a key it holds internally. A UTM is a consolidated security gateway and performs no enterprise key management.

320. A database stores credit card numbers and the architect wants to replace each real card number with a non-sensitive substitute value that has no mathematical relationship to the original, with the mapping held in a separate secured vault. Which data protection technique is being used?
     • Payment tokenization
     • Irreversible hashing
     • Attribute encryption
     • Column-level masking

     Correct answer: Payment tokenization

     Correct answer: payment tokenization. Tokenization swaps each card number for a randomly generated surrogate with no mathematical relationship to the original, and the real value can be retrieved only through a separately secured token vault, which is precisely the vault-backed mapping described. Irreversible hashing cannot be reversed at all, so the original card number could never be recovered for a later transaction. Attribute encryption transforms the value with a key, so a mathematical relationship to the original does remain. Column-level masking obscures the value for display while the real number stays in place.

321. An architect is documenting how an organization protects information across its lifecycle and needs to address the state in which data is actively being processed in a system's memory or CPU. Which protection is specifically designed for data in use?
     • Full-disk encryption inside a storage volume
     • Transport encryption inside a network tunnel
     • Enclave execution inside a processor package
     • Immutable archiving inside a duplicate vault

     Correct answer: Enclave execution inside a processor package

     Correct answer: enclave execution inside a processor package. Data in use is data loaded into memory and actively processed, and confidential computing protects it by running the computation inside a hardware trusted execution environment that the host operating system and hypervisor cannot read. Full-disk encryption protects data at rest and releases plaintext to memory once the volume is unlocked. Transport encryption protects data in transit between endpoints. Immutable archiving serves recovery and retention, not live processing.

322. An organization needs a recovery site that holds duplicated, continuously synchronized systems and data so it can take over operations almost immediately after a disaster, with minimal downtime. Which recovery site type meets this requirement?
     • Cold backup site
     • Warm shared site
     • Mobile unit site
     • Hot standby site

     Correct answer: Hot standby site

     Correct answer: hot standby site. A hot site is a fully equipped duplicate of production whose systems and data are kept continuously synchronized, so operations can be taken over within minutes of a disaster. A cold site supplies space, power and connectivity but no configured systems, so bringing it up takes days. A warm site holds hardware and connectivity while its data must still be loaded and reconciled. A mobile unit is a transportable facility whose readiness depends entirely on what is installed in it.

323. A security architect wants to manage infrastructure through version-controlled definition files so that servers and networks are provisioned consistently and configuration drift is reduced. Which practice provides this capability?
     • Templates by operators
     • Baselines from imaging
     • Deployments via ticket
     • Infrastructure as code

     Correct answer: Infrastructure as code

     Correct answer: infrastructure as code. Infrastructure as code defines servers, networks and their configuration in machine-readable files that live in version control, so every environment is provisioned from the same reviewed definition and drift is reduced. Templates hand-built by operators are not version controlled and diverge as each operator edits them. Baselines captured from golden images capture one point in time and age immediately. Deployments driven by change tickets rely on humans repeating manual steps, which is the source of the drift.

324. A bank requires that its public-facing web application servers be able to verify their identity to clients using digital certificates issued by a trusted authority. Which architectural component issues and signs those certificates?
     • Certificate revocation list
     • Certificate signing request
     • Certificate issuance server
     • Certificate status protocol

     Correct answer: Certificate issuance server

     Correct answer: certificate issuance server. The certificate authority in a PKI is the component that issues and digitally signs certificates, binding a public key to a verified identity so relying clients can trust the server they reach. A certificate revocation list publishes serial numbers that are no longer trusted and issues nothing. A certificate signing request is the applicant's submission to the authority, not the issuer. A certificate status protocol such as OCSP answers real-time validity queries about certificates that were already issued.

325. Which phase of the incident response process focuses on limiting the spread and impact of an active incident, such as isolating an infected host from the network?
     • Evidence acquisition
     • Post-incident review
     • Incident containment
     • Baseline restoration

     Correct answer: Incident containment

     Correct answer: incident containment. Containment is the phase that limits the spread and impact of an active incident, for example by isolating or quarantining an infected host so the threat cannot reach further systems while responders prepare eradication. Evidence acquisition captures artifacts for later analysis and does not stop the spread. Post-incident review happens after the incident is closed. Baseline restoration returns systems to service, which belongs to recovery.

326. In the incident response lifecycle, which activity is performed during the 'lessons learned' phase?
     • Reimaging servers from carefully verified media
     • Capturing volatile memory during live incidents
     • Documenting findings to improve later responses
     • Blocking hostile traffic at perimeter firewalls

     Correct answer: Documenting findings to improve later responses

     Correct answer: documenting findings to improve later responses. The lessons learned phase is the post-incident review: the team analyzes what happened, judges how the response performed and records recommendations that update the plan, playbooks and controls for future incidents. Reimaging servers from verified media is recovery work. Capturing volatile memory is a collection activity performed while the incident is live. Blocking hostile traffic at the firewall is containment.

327. During which incident response phase would an organization develop its IR plan, assemble the response team, and train staff before any incident occurs?
     • Incident preparation
     • Endpoint containment
     • Forensic acquisition
     • Business restoration

     Correct answer: Incident preparation

     Correct answer: incident preparation. Preparation is the phase that happens before any incident: writing the incident response plan, naming the response team and its roles, acquiring tooling and training staff so the organization can act when something is detected. Endpoint containment is only possible once an incident is already underway. Forensic acquisition collects evidence from systems that have already been touched. Business restoration returns services to normal after the threat is removed.

328. A response team has removed malware and confirmed the threat is gone. They now rebuild systems from clean backups and return them to normal operation while monitoring for reinfection. Which incident response phase is this?
     • Malware eradication
     • Service restoration
     • Network containment
     • Evidence collection

     Correct answer: Service restoration

     Correct answer: service restoration. Recovery is the phase that rebuilds or restores affected systems from clean backups, validates that they function correctly and returns them to production under close monitoring for signs that the threat has returned. Malware eradication is the step that has already been completed in this scenario. Network containment isolated the systems earlier, before the threat was removed. Evidence collection preserves artifacts and restores no service.

329. Which incident response activity involves completely removing the cause of an incident, such as deleting malicious files, disabling breached accounts, and closing exploited vulnerabilities?
     • Incident eradication
     • Stakeholder briefing
     • Endpoint containment
     • Business restoration

     Correct answer: Incident eradication

     Correct answer: incident eradication. Eradication removes the cause of the incident and everything the attacker left behind: deleting malicious files and persistence, disabling compromised accounts and closing the vulnerabilities that were exploited. A stakeholder briefing communicates status and removes nothing. Endpoint containment only isolates the affected host so the threat cannot spread, leaving the malicious code in place. Business restoration returns clean systems to production afterward.

330. An organization runs a discussion-based exercise where the IR team walks through their response to a hypothetical ransomware scenario around a conference table, without touching any production systems. What type of exercise is this?
     • Recovery exercise
     • Parallel exercise
     • Tabletop exercise
     • Failover exercise

     Correct answer: Tabletop exercise

     Correct answer: tabletop exercise. A tabletop is discussion based: the response team sits around a table and talks through roles, decisions and dependencies for a hypothetical scenario, so the plan is validated without touching production. A recovery exercise actually restores systems from backup media. A parallel exercise brings alternate systems up and runs them alongside production to compare results. A failover exercise moves live workloads to the alternate site, which is exactly what this team is avoiding.

331. In digital forensics, what is the purpose of maintaining a chain of custody for collected evidence?
     • To compress the evidence into a searchable archive
     • To record the evidence handlers with precise times
     • To encrypt the evidence against any outside reader
     • To scan the evidence for any concealed executables

     Correct answer: To record the evidence handlers with precise times

     Correct answer: to record the evidence handlers with precise times. Chain of custody is the documented record of every person who collected, accessed, transferred or stored an item, with the times of each transfer, which is what demonstrates the evidence was not altered and keeps it admissible. Compressing evidence into an archive manages storage and proves nothing about handling. Encrypting evidence protects it from outside readers but records no custody. Scanning evidence for concealed executables is analysis work performed after custody is already established.

332. When collecting digital evidence, which principle dictates the order in which sources should be captured, prioritizing the most volatile data first?
     • Rules of engagement
     • Order of volatility
     • Chain of possession
     • Right of inspection

     Correct answer: Order of volatility

     Correct answer: order of volatility. The order of volatility ranks evidence sources by how quickly they disappear, so CPU registers, cache, RAM and network state are captured before disk images and archived logs, because the volatile sources are lost the moment power or connectivity changes. Rules of engagement define the scope and limits of an authorized test. Chain of possession documents who handled evidence, not the sequence in which sources are captured. A right of inspection is a contractual clause permitting review of a partner's controls.

333. A company instructs employees to stop deleting emails and documents related to a pending lawsuit so the data is preserved as potential evidence. What is this directive called?
     • Retention purge
     • Forensic triage
     • Statutory audit
     • Litigation hold

     Correct answer: Litigation hold

     Correct answer: litigation hold. A litigation hold, also called a legal hold, is the formal instruction issued when litigation is anticipated or underway that suspends normal deletion so that potentially responsive records are preserved as evidence. A retention purge does the opposite and destroys records once a schedule expires. Forensic triage prioritizes which systems to examine first. A statutory audit is a compliance review against a regulation and does not suspend deletion.

334. In security alerting, what does the term 'false positive' describe?
     • A genuine intrusion the sensor never detected
     • A routine backup correctly left without alarm
     • A live compromise promptly caught and blocked
     • A harmless action wrongly reported as hostile

     Correct answer: A harmless action wrongly reported as hostile

     Correct answer: a harmless action wrongly reported as hostile. A false positive is an alert raised for activity that turns out to be benign, and a high volume of them causes alert fatigue that leads analysts to dismiss real detections. A genuine intrusion that produced no alert is a false negative. A routine backup that correctly raised nothing is a true negative. A live compromise that was caught and blocked is a true positive.

335. A security tool fails to generate any alert for an actual intrusion that successfully occurred. What is this missed detection called?
     • An alarm triggered by completely harmless traffic
     • A breach slipping past deployed detection systems
     • An alert matching one genuinely malicious payload
     • A silent interval correctly ignored by monitoring

     Correct answer: A breach slipping past deployed detection systems

     Correct answer: a breach slipping past deployed detection systems. A false negative is genuine malicious activity that the control failed to detect or alert on, which is the most dangerous outcome because the compromise proceeds unnoticed. An alarm triggered by harmless traffic is a false positive. An alert matching a genuinely malicious payload is a true positive, a correct detection. A quiet interval that the monitoring correctly leaves alone is a true negative.

336. Which process establishes a definition of typical, normal activity for a system or network so that deviations from it can be flagged as anomalies?
     • Baselining
     • Sandboxing
     • Throttling
     • Journaling

     Correct answer: Baselining

     Correct answer: baselining. Baselining records what normal looks like for a system or network, including typical traffic volumes, login patterns and resource usage, so monitoring tools can compare live behavior against that reference and raise an anomaly when it deviates. Sandboxing detonates suspect files in an isolated environment. Throttling limits the rate at which requests are served. Journaling writes a log of pending changes so a filesystem or database can recover after a crash.

337. An organization continuously evaluates whether its deployed security controls remain effective and compliant by automatically checking system configurations against required standards. Which capability is this?
     • Quarterly attestation
     • Periodic snapshotting
     • Automated remediation
     • Continuous monitoring

     Correct answer: Continuous monitoring

     Correct answer: continuous monitoring. Continuous monitoring is the ongoing automated assessment of systems, configurations and controls against required standards, giving near real-time visibility into posture and flagging drift as soon as it appears. Quarterly attestation samples compliance at four points a year and leaves long blind windows between them. Periodic snapshotting preserves recoverable copies of state and evaluates no control. Automated remediation corrects findings after they have been raised rather than performing the evaluation itself.

338. Which network management protocol is commonly used to collect device health and performance metrics, but in older versions transmits community strings in plaintext, creating a security concern?
     • ICMP
     • LDAP
     • SMTP
     • SNMP

     Correct answer: SNMP

     Correct answer: SNMP. The Simple Network Management Protocol polls device health and performance data from routers, switches and servers, and in versions 1 and 2c the community string that authorizes those reads travels in cleartext, which is why SNMPv3 with authentication and privacy is required. ICMP carries reachability and error messages, not device metrics. LDAP queries a directory. SMTP transports mail between servers.

339. What is the key behavioral difference between an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS)?
     • An IDS halts hostile flows immediately while an IPS observes them silently
     • An IDS reports suspected packets passively while an IPS blocks them inline
     • An IDS decrypts captured sessions locally while an IPS restores them later
     • An IDS needs installed agents everywhere while an IPS avoids them entirely

     Correct answer: An IDS reports suspected packets passively while an IPS blocks them inline

     Correct answer: an IDS reports suspected packets passively while an IPS blocks them inline. An intrusion detection system observes a copy of the traffic and raises alerts, so it never interrupts a flow, whereas an intrusion prevention system sits in the traffic path and can drop, reset or block a session in real time. The reversed statement is wrong on both halves: the IDS is the passive one. Neither system exists to decrypt and then re-encrypt sessions for the other. Both are available as agent-based host sensors and as agentless network sensors, so agents do not distinguish them.

340. A firewall rule set ends with a final rule that denies any traffic not explicitly permitted by earlier rules. What is this concept called?
     • Implicit deny
     • Reverse proxy
     • Default route
     • Port security

     Correct answer: Implicit deny

     Correct answer: implicit deny. Implicit deny is the principle that anything not explicitly permitted by an earlier rule is refused, which is enforced by the catch-all deny rule at the bottom of an access control list so only sanctioned traffic passes. A reverse proxy terminates and forwards client connections on a server's behalf. A default route decides where packets go when no specific route matches, which permits rather than blocks. Port security limits which MAC addresses may use a switch port.

341. Which type of firewall can make filtering decisions based on the application and user identity, integrate IPS functions, and perform deep packet inspection, going beyond simple port and protocol rules?
     • Next-generation firewall
     • Packet-filtered firewall
     • Screened-subnet firewall
     • Perimeter-based firewall

     Correct answer: Next-generation firewall

     Correct answer: next-generation firewall. An NGFW adds application awareness, user identity from the directory, deep packet inspection and an integrated intrusion prevention engine on top of traditional firewall functions, so policy can name an application and a user rather than a port. A packet-filtered firewall decides only on addresses, ports and protocol flags. A screened-subnet firewall describes a DMZ topology rather than an inspection capability. A perimeter-based firewall names where the device sits, not how deeply it inspects.

342. An organization deploys a control that inspects employee web requests and blocks access to gambling, malware-hosting, and other policy-violating sites based on URL categories. Which capability is this?
     • Content filtering
     • Bandwidth shaping
     • Session recording
     • Traffic mirroring

     Correct answer: Content filtering

     Correct answer: content filtering. A web content filter inspects outbound web requests and allows or blocks them against URL categories and site reputation, which is how gambling and malware-hosting destinations are refused while acceptable use policy is enforced. Bandwidth shaping prioritizes or rations traffic without judging where it is going. Session recording captures what an administrator does during a privileged session. Traffic mirroring copies packets to a sensor for analysis and blocks nothing.

343. Which security control prevents users from reaching known-malicious domains by intercepting and blocking name resolution requests at the DNS layer?
     • DNS sinkholing
     • DNS forwarding
     • DNS delegation
     • DNS validation

     Correct answer: DNS sinkholing

     A DNS sinkhole answers a lookup for a known-malicious domain with a controlled address or a refusal, so the client never learns where the real host is and the session is never opened. DNS forwarding only hands a query to another resolver to answer. DNS delegation points a subdomain at a different authoritative server. DNS validation checks the DNSSEC signatures on a response, which proves the answer was not tampered with but says nothing about whether the domain is malicious.

344. An email security gateway adds DMARC, DKIM, and SPF checks. What is the primary purpose of these three mechanisms together?
     • To shrink the message so that transfers move faster
     • To store the message for the whole retention period
     • To prove the message came from an authorised sender
     • To encrypt the message before it leaves the gateway

     Correct answer: To prove the message came from an authorised sender

     SPF lists the hosts allowed to send for the domain, DKIM signs the message so a receiver can check that signature against a key published in DNS, and DMARC ties the two together with a policy the domain owner publishes. Their combined job is authenticating the sending domain, which is what removes the value from spoofed mail. Shrinking a message is a transport optimisation. Keeping copies for a retention period is archiving. Encrypting the body protects confidentiality, and an encrypted message can still carry a forged sender address.

345. Which hardening practice reduces a system's attack surface by removing software, services, and accounts that are not required for its function?
     • Applying the vendor defaults on a new host
     • Increasing the log retention on a new host
     • Rotating the encryption keys on a new host
     • Deleting the unused services on a new host

     Correct answer: Deleting the unused services on a new host

     Hardening shrinks the attack surface: services, applications and accounts that the host does not need are switched off or removed, so there is less code listening and fewer credentials to steal. Applying vendor defaults does the opposite, since default configurations enable extra services and ship well-known accounts. Increasing log retention improves what can be investigated afterwards but changes nothing an attacker can reach. Rotating encryption keys limits the damage of a key compromise without removing any exposed service.

346. What is the security purpose of changing or disabling default vendor credentials on a newly deployed device?
     • To lock accounts that fail three straight times
     • To verify updates that carry a vendor signature
     • To filter traffic that leaves the office router
     • To stop logins that use known default passwords

     Correct answer: To stop logins that use known default passwords

     Vendor default usernames and passwords are printed in manuals and collected in public lists, so an unchanged device can be logged into by anyone who can reach it; changing or disabling those accounts closes that path. Locking an account after repeated failures limits password guessing, not the use of a password the attacker already knows. Verifying an update's signature is code signing. Filtering what leaves the site is egress filtering. None of the three touches the credentials the device shipped with.

347. An organization uses a configuration management tool to ensure all production servers continuously match an approved secure template, automatically correcting any drift. This is an example of enforcing what?
     • A production subnet the servers must reach
     • A secure channel the servers must maintain
     • A management agent the servers must accept
     • A hardened baseline the servers must match

     Correct answer: A hardened baseline the servers must match

     A secure baseline is the approved configuration state a system is required to conform to, so comparing production against it continuously and correcting any drift keeps every server in a known-good, hardened condition. A production subnet is a network segment, which fixes where a server sits rather than how it is configured. A secure channel protects traffic between two hosts while it is in transit. A management agent is the software that carries settings onto a machine, so it is the delivery mechanism and not the standard being enforced.

348. Which mobile device deployment model allows employees to use their personally owned devices to access corporate resources, raising data separation and management challenges?
     • BYOD
     • CYOD
     • COPE
     • COBO

     Correct answer: BYOD

     BYOD means the hardware belongs to the employee and is used for work, which is why data separation, privacy and limited enforcement are the hard problems in that model. CYOD still ends with a company-purchased device the employee chose from an approved list. COPE is a corporate-owned device the employee may also use personally. COBO is a corporate-owned device restricted to business use. In all three the organization owns the hardware, so none of them raises the ownership problem described.

349. A company centrally enforces encryption, app restrictions, and remote-wipe policies across all enrolled smartphones and tablets. Which technology provides this?
     • DLP
     • MDM
     • NAC
     • EDR

     Correct answer: MDM

     MDM enrols phones and tablets and pushes policy to them centrally: encryption requirements, passcode rules, application restrictions and remote lock or wipe. DLP inspects content to stop sensitive data leaving, but it does not enrol or configure a device. NAC decides whether a device is admitted to the network. EDR watches endpoint process behaviour for attacks and supports response. None of the three enforces a device configuration policy across a mobile fleet.

350. During secure asset disposal, which method guarantees data cannot be recovered by physically destroying the storage media?
     • Formatting the drive with a new filesystem
     • Unmounting the drive from the running host
     • Shredding the drive into small metal chips
     • Encrypting the drive with a saved password

     Correct answer: Shredding the drive into small metal chips

     Physical destruction leaves no intact media for anyone to read, which is why shredding or pulverizing is the disposal method that guarantees recovery is impossible. Writing a new filesystem replaces the index while the underlying blocks stay on the platters and are recoverable with forensic tools. Unmounting only detaches the volume from the running system, so every byte remains. Encrypting the drive under a password that is retained leaves the data in place and readable to anyone holding that password.

351. On a mobile device, which technology cryptographically and logically separates personal data and apps from corporate data and apps?
     • A shared network link through the device
     • A fixed zone perimeter around the device
     • A private work profile inside the device
     • A provider lock released from the device

     Correct answer: A private work profile inside the device

     Containerization puts corporate apps and data in an encrypted, isolated work profile that the organization manages and can wipe on its own, while the user's personal content stays outside it and untouched. A shared network link is tethering, which lends the handset's connection to other devices. A fixed zone perimeter is geofencing, which triggers actions based on where the device is. Releasing the provider lock is carrier unlocking, which frees the handset for another network. None of the three separates work data from personal data.

352. After a vulnerability scan, which step prioritizes findings so the most critical, exploitable, and high-impact vulnerabilities are remediated first?
     • Sending the findings to the helpdesk queue
     • Ordering the findings by the greatest risk
     • Checking the findings after the patch runs
     • Archiving the findings for the audit trail

     Correct answer: Ordering the findings by the greatest risk

     Prioritisation is the analysis step between finding and fixing: severity, exploitability, asset criticality and exposure are weighed together so limited remediation capacity goes to the vulnerabilities that carry the most risk. Sending findings to a queue is ticketing, which moves work without ranking it. Checking after a patch runs is remediation validation, which happens once a fix is already applied. Archiving preserves evidence for auditors. None of the three decides what gets fixed first.

353. Which standardized framework produces a numeric severity score from 0.0 to 10.0 to help organizations rank the criticality of vulnerabilities?
     • CVSS
     • SBOM
     • SIEM
     • SOAR

     Correct answer: CVSS

     CVSS is the open standard that scores a vulnerability from 0.0 to 10.0 out of its exploitability and impact metrics, so findings from different tools can be compared and ranked consistently. An SBOM is an inventory of the components inside a piece of software. A SIEM collects and correlates log data for detection and investigation. SOAR automates response workflows. None of the three produces a severity rating for a vulnerability.

354. A scanning vendor reports a vulnerability that, upon investigation, does not actually exist on the target system. In vulnerability management, what is this finding called?
     • Risk exception
     • Attack surface
     • Patch baseline
     • False positive

     Correct answer: False positive

     A false positive is a finding the scanner reports that is not actually present or exploitable on the target, which is why scan output is validated before remediation effort is spent on it. A risk exception is the documented decision to leave a real vulnerability unfixed. Attack surface is the sum of the points at which a system can be reached. A patch baseline is the patch level a system is required to hold. Each is a real term, but none of them names a finding that turned out not to exist.

355. An organization decides to accept the risk of a low-severity vulnerability it will not fix, documenting management approval. In vulnerability management, what is this response called?
     • Signing off the risk formally as it stands
     • Handing off the risk to an outside insurer
     • Shutting off the risk by halting the pilot
     • Cutting off the risk with a second control

     Correct answer: Signing off the risk formally as it stands

     Risk acceptance is the decision to keep operating with a known, unremediated weakness, recorded and formally approved so ownership of that choice is explicit; in vulnerability management it is filed as an exception or exemption. Handing the exposure to an insurer is transference, which moves the financial consequence and leaves the flaw. Halting the activity is avoidance, which removes the exposure by stopping the work. Adding another control is mitigation, which reduces the risk rather than accepting it.

356. Which type of vulnerability assessment requires valid login credentials so the scanner can evaluate the system from an authenticated, insider perspective for deeper accuracy?
     • A scan that reaches the network from outside
     • A scan that signs in with issued credentials
     • A scan that watches the wire traffic quietly
     • A scan that reads the public service banners

     Correct answer: A scan that signs in with issued credentials

     A credentialed scan authenticates to the target, so it reads installed package versions, patch levels and configuration directly instead of inferring them from outside, which gives deeper coverage and far fewer false positives. Reaching the network from outside is the external black-box view that sees only what is exposed. Watching traffic quietly is passive scanning, which never queries the host. A scan that reads public service banners infers versions from what a listening service announces, which is exactly the guesswork credentials remove.

357. Which authentication method uses a temporary code that changes every 30 to 60 seconds and is generated by an authenticator app synchronized with the server?
     • A code the app derives from the clock
     • A code the user keeps for many months
     • A code the scanner reads from a badge
     • A code the vault stores for each site

     Correct answer: A code the app derives from the clock

     TOTP combines a shared secret with the current time, so the authenticator app and the server compute the same value independently and it expires within a fixed interval, leaving a captured code useless moments later. A code kept for months is a static password, reusable by anyone who steals it. A code read out of a chip describes a smart card or token, which proves possession with no time element. A code held per site in a vault is a password manager entry, stored rather than regenerated.

358. An administrator account's elevated permissions are automatically removed after a fixed time window unless explicitly renewed. Which access management concept enforces this?
     • Rights that widen when the user changes teams
     • Rights that expire when the short window ends
     • Rights that apply when the office hours begin
     • Rights that renew when the annual review runs

     Correct answer: Rights that expire when the short window ends

     Just-in-time access grants elevated permissions only for the interval they are needed and revokes them automatically when it closes, so no standing administrative privilege sits on the account waiting to be abused. Rights that widen as someone moves between teams is privilege creep, the accumulation this control exists to prevent. Rights bounded by office hours are time-of-day restrictions, which limit when a standing permission works. Rights renewed at an annual review are periodic recertification, far too slow to be the mechanism described.

359. Which password policy control prevents users from immediately reusing a recent password by remembering and rejecting a set number of prior passwords?
     • A rule that locks the account after errors
     • A rule that forces a mixture of characters
     • A rule that rejects the last few passwords
     • A rule that resets the password each month

     Correct answer: A rule that rejects the last few passwords

     Password history stores a number of previously used passwords and refuses them, so a user cannot satisfy a change by cycling straight back to a familiar or already-compromised secret. Locking an account after repeated errors is a lockout threshold aimed at guessing attacks. Forcing a mixture of characters is a complexity requirement about the shape of the password. Resetting on a schedule is a maximum-age setting, which says when a change is due but never which value is rejected.

360. What is a primary security benefit of automating repetitive security operations tasks through scripting and orchestration?
     • It maps each alert to a shared threat model
     • It scores each finding on a ten point scale
     • It stores each log line in a sealed archive
     • It repeats each step the same way each time

     Correct answer: It repeats each step the same way each time

     The security value of automation is consistency: a script or playbook performs the same steps in the same order on every run, so the outcome does not vary with who is on shift and the slips that come with manual repetition disappear. Mapping alerts to a shared threat model is enrichment that adds context to a detection. Scoring findings is severity rating. Sealing log lines in an archive is retention and evidence preservation. Each is real work, but none of them is what automating a repetitive task buys.

361. Which potential drawback should an organization weigh before automating a security process?
     • A single new hire studies for several extra weeks
     • A single audit item draws a lengthy written reply
     • A single patch cycle takes a separate test window
     • A single flawed rule repeats one error many times

     Correct answer: A single flawed rule repeats one error many times

     Automation runs at machine speed and scale, so a flawed rule or a wrong parameter is applied identically across every target long before a human notices, which is why automated changes need testing, staged rollout and guardrails. Training a new hire is a staffing cost that automation reduces rather than creates. Answering an audit item is a compliance workflow. Scheduling a test window before a patch is ordinary change practice. None of the three is a hazard introduced by automating the work.

362. Which data source records authentication successes and failures, account lockouts, and privilege changes, making it essential for investigating suspicious access?
     • The audit log the domain controller writes
     • The flow record the border router provides
     • The zone file the primary server publishes
     • The crash dump the failing kernel produces

     Correct answer: The audit log the domain controller writes

     Security and audit logs are where logon successes and failures, account lockouts, and privilege or policy changes are written, so they are the trail an investigator follows to establish who authenticated and what rights changed. A flow record shows which addresses talked and how much data moved, not who signed in. A zone file maps names to addresses for a domain. A crash dump captures state after a failure. None of the three holds an authentication event.

363. During an investigation, analysts review records of which internal IP address was assigned a given private address at a specific time. Which log source provides this mapping?
     • The signature file the scanner tool loads
     • The cipher list the gateway daemon offers
     • The boot log the firmware loader produces
     • The lease record the address server keeps

     Correct answer: The lease record the address server keeps

     DHCP logs record each lease: the address handed out, the client it was given to, and the time it was granted and released, so an investigator can say which machine held a particular internal address when an event occurred. A signature file lists the detection patterns a scanner loads. A cipher list states which algorithms a service will negotiate. A boot log traces startup. None of the three ties an address to a client at a point in time.

364. Which metadata field, captured in network flow records (such as NetFlow), is most useful for identifying which hosts communicated, how much data moved, and over which ports—without capturing packet payloads?
     • The subject, issuer and key size fields
     • The address, port and byte count fields
     • The file hash, owner and creator fields
     • The user agent, host and referer fields

     Correct answer: The address, port and byte count fields

     A flow record summarises one conversation: source and destination addresses, the ports and protocol, and the packet and byte counts, with no payload stored, which is exactly what is needed to say who talked to whom, over what, and how much moved. Subject, issuer and key size are certificate fields. File hash, owner and creator are filesystem and forensic attributes. User agent, host and referer are HTTP request headers. None of the three appears in a flow record.

365. An administrator publishes a DNS TXT record listing the mail servers authorized to send email on behalf of the company's domain so receiving servers can reject spoofed messages. Which email authentication mechanism is being configured?
     • PGP
     • PKI
     • SPF
     • TLS

     Correct answer: SPF

     SPF is published as a DNS TXT record listing the hosts allowed to send mail for the domain, so a receiving server can compare the connecting sender against that list and reject a forgery. PGP encrypts and signs message content between users. PKI is the wider framework of certificate authorities and keys that other controls are built on. TLS encrypts the connection between mail servers. None of the three publishes a list of authorised sending hosts.

366. A mail server attaches a cryptographic signature to outbound messages using a private key, while the matching public key is published in DNS so recipients can verify the message was not altered in transit. Which email security control is described?
     • SMTP
     • IMAP
     • DKIM
     • OCSP

     Correct answer: DKIM

     DKIM signs an outbound message with the sending domain's private key and publishes the matching public key in DNS, so a receiver can verify both where the message came from and that its signed content was not altered in transit. SMTP is the protocol that carries the mail. IMAP is how a client reads mail from a server. OCSP checks whether a certificate has been revoked. None of the three attaches a verifiable signature to a message.

367. After deploying SPF and DKIM, a security team wants to instruct receiving servers how to handle messages that fail those checks and to receive aggregate reports about spoofing attempts. Which policy framework provides this?
     • SMTPS
     • LDAPS
     • DMARC
     • HTTPS

     Correct answer: DMARC

     DMARC is the policy layer above SPF and DKIM: the domain owner publishes what a receiver should do with mail that fails those checks and where to send the aggregate reports that reveal spoofing attempts. SMTPS and HTTPS are ordinary protocols wrapped in TLS, and LDAPS is directory access over TLS. Each of the three protects a channel between two hosts; none of them states how failing mail should be handled or reports abuse back to the domain owner.

368. A company wants to enforce screen-lock passcodes, push security policies, and remotely wipe lost devices across hundreds of employee smartphones and tablets. Which solution provides this centralized control?
     • A gateway that ends the tunnels remote staff build
     • A firewall that inspects the traffic one host sees
     • A console that pushes the rules to enrolled phones
     • A gatekeeper that admits the hosts a policy clears

     Correct answer: A console that pushes the rules to enrolled phones

     Mobile device management enrols the fleet and pushes policy to it from one console: passcode and encryption requirements, application restrictions, and remote lock or wipe when a handset goes missing. A gateway that terminates staff tunnels is a VPN concentrator. A firewall that inspects what a single machine sees protects that machine only. A gatekeeper admitting hosts a policy has cleared is network access control, which governs admission rather than device configuration.

369. An organization allows employees to use their personally owned phones for work, accepting that the company has limited control over the hardware. Which mobile deployment model does this describe?
     • Privately bought phones used for work
     • Company supplied phones used for work
     • Shared reception phones used for work
     • Catalogue picked phones used for work

     Correct answer: Privately bought phones used for work

     Under BYOD the hardware belongs to the employee, so the organization has the least control of any deployment model: it can manage its own container and data but cannot dictate the device, its condition or what else runs on it. Phones picked from a company catalogue are still bought by the employer. Phones the company supplied are corporate-owned from the start. Shared handsets kept at a reception desk are company assets as well. In each of those the organization owns the hardware and can control it fully.

370. Before donating retired laptops, an organization must guarantee that no recoverable confidential data remains on the solid-state drives. Which action best ensures the data cannot be recovered?
     • A quick partition reformat of the drive
     • A full cryptographic erase of the drive
     • A signed firmware rollback of the drive
     • A local backup restoration of the drive

     Correct answer: A full cryptographic erase of the drive

     Sanitization is what makes data unrecoverable while leaving the hardware usable: a cryptographic erase destroys the key the drive's contents were encrypted under, so every remaining block on a solid-state drive is unreadable, including the wear-levelled cells an overwrite never reaches. Repartitioning and reformatting rewrite structures while the data blocks stay intact. A firmware rollback changes the controller software, not the stored contents. Restoring a backup writes more data onto the drive instead of removing what is already there.

371. A SOC wants metadata about network conversations such as source and destination IPs, ports, and byte counts to baseline traffic and detect anomalies, without capturing full packet payloads. Which data source provides this?
     • Flow records exported by the core routers
     • Packet captures written by the tap probes
     • Syslog messages queued by the relay hosts
     • Virus alerts raised by the desktop agents

     Correct answer: Flow records exported by the core routers

     Flow records summarise each conversation by address, port, protocol and volume without keeping payload, which is what makes them cheap enough to retain for baselining traffic and spotting anomalies. Packet captures do keep the payload and cost far more storage. Syslog messages carry event text from devices and applications rather than a per-conversation traffic summary. Antivirus alerts report malware findings on individual endpoints. None of the three gives network-wide conversation metadata.

372. A network team uses a protocol that lets a management station poll routers and switches for performance counters and receive unsolicited trap notifications about device events. Which protocol provides this monitoring capability?
     • LDAP
     • SFTP
     • SNMP
     • SMTP

     Correct answer: SNMP

     SNMP lets a management station poll agents on routers and switches for performance counters and receive traps when a device raises an event, and SNMPv3 adds authentication and encryption to that exchange. LDAP queries a directory for identity objects. SFTP transfers files over SSH. SMTP relays mail between servers. None of the three collects device metrics or receives trap notifications.

373. A change management policy requires that disruptive infrastructure updates be performed only during a pre-approved, scheduled period when impact to users is minimized. What is this period called?
     • The maintenance window
     • The recovery objective
     • The dependency mapping
     • The regression testing

     Correct answer: The maintenance window

     A maintenance window is the pre-approved, scheduled period in which disruptive work is allowed to happen, chosen so the impact on users is as small as possible. A recovery objective states how much data loss or downtime is tolerable after an outage. Dependency mapping identifies what else a change will touch. Regression testing confirms the change did not break existing function. Each belongs to change management, but none of them names the period the work is confined to.

374. Part of a documented change request specifies the exact steps to return a system to its prior working state if the deployment fails or causes problems. What is this component of change management called?
     • The impact study
     • The backout plan
     • The change owner
     • The signoff form

     Correct answer: The backout plan

     A backout plan is the documented route back: the steps that return the system to its prior working state if the deployment fails or causes harm, written and approved before the change is attempted. An impact study assesses what the change would affect. A change owner is the person accountable for it. A signoff form records the authorisation that lets it proceed. None of the three describes how to undo a deployment.

375. Before a major change is implemented, a cross-functional group reviews the request, evaluates risk and impact, and grants formal authorization. What is this group called?
     • The change advisory board
     • The incident triage group
     • The vendor selection team
     • The capacity review panel

     Correct answer: The change advisory board

     The change advisory board is the cross-functional group that reviews a change request, weighs its risk and impact on the business, and grants or withholds formal authorisation before implementation. An incident triage group handles events that have already happened. A vendor selection team evaluates suppliers. A capacity review panel plans for growth in load. None of the three authorises changes.

376. An administrator configures endpoints so that only an explicitly approved set of applications may execute, and everything else is blocked by default. Which control is being applied?
     • An application block list
     • An application patch list
     • An application asset list
     • An application allow list

     Correct answer: An application allow list

     An allow list names the applications permitted to execute and blocks everything else by default, which is the most restrictive form of application control and the one form that stops code nobody has seen before. A block list works the other way round: it names what is forbidden, so anything not yet listed still runs freely. A patch list records which updates are approved for deployment. An asset list inventories what is installed across the estate. Neither of those two decides what may execute.

377. In a Windows Active Directory environment, an administrator centrally enforces password complexity, account lockout, and security settings across all domain-joined computers from a single location. Which mechanism provides this?
     • The event viewer
     • The group policy
     • The logon script
     • The domain trust

     Correct answer: The group policy

     Group Policy is defined in Active Directory and applied to every domain-joined computer, which is how password complexity, lockout thresholds and other security settings are set once and enforced everywhere. An event viewer reads the logs those settings produce. A logon script runs commands as a user signs in and enforces nothing once it has finished. A domain trust lets one domain accept another's authentications. None of the three distributes a security configuration across the domain.

378. While hardening a newly built server, an administrator turns off unused network services and closes ports that no application requires. What is the primary security benefit of this action?
     • It leaves the host with newer patch levels
     • It leaves the host with faster local reads
     • It leaves the host with wider log coverage
     • It leaves the host with fewer entry points

     Correct answer: It leaves the host with fewer entry points

     Turning off unused services and closing unneeded ports removes listeners an attacker could reach, so the attack surface, meaning the set of ways into the system, is smaller than it was. Newer patch levels are the result of patching, which is a separate activity that still has to be done. Faster local reads are a performance effect and are not a security outcome at all. Wider log coverage comes from logging configuration. None of the three follows from shutting a service down.

379. An EDR platform detects active malware on an employee laptop and the analyst immediately uses the tool to cut the device off from the network while preserving it for analysis. Which response action is this?
     • Eradication
     • Containment
     • Restoration
     • Attribution

     Correct answer: Containment

     Cutting the infected laptop off the network while keeping it intact is containment: the spread is stopped immediately and the machine, its memory and its evidence are preserved for analysis. Eradication is the later step that removes the malware and closes the way in. Restoration returns the cleaned system to normal service. Attribution is the effort to identify who was behind the intrusion. None of the three describes isolating a host to stop a threat spreading.

380. Which incident response phase includes developing the response plan, training staff, establishing communication procedures, and deploying detection tooling before any incident occurs?
     • The containment stage
     • The preparation stage
     • The eradication stage
     • The restoration stage

     Correct answer: The preparation stage

     Preparation is the work done before anything happens: writing and exercising the response plan, training the team, agreeing communication and escalation paths, and deploying the detection and response tooling every later stage depends on. Containment limits the damage of an incident already under way. Eradication removes the cause once it is understood. Restoration brings services back and confirms they are clean. All three begin only after an incident has been detected.

381. To test its incident response plan without disrupting production systems, an organization gathers stakeholders to walk through a simulated breach scenario and discuss how they would respond. Which type of exercise is this?
     • Red-team exercise
     • Tabletop exercise
     • Failover exercise
     • Phishing exercise

     Correct answer: Tabletop exercise

     A tabletop exercise is exactly this: stakeholders sit down and talk a scenario through, so the plan, the roles and the hand-offs get tested while production keeps running untouched. A red-team exercise sends an attack team against the live environment, which is the disruption the organization set out to avoid. A failover exercise cuts service across to standby infrastructure and can interrupt users. A phishing exercise mails simulated lures to staff to measure awareness, not to rehearse the response plan.

382. During an investigation, every transfer and handling of seized evidence is documented with who had it, when, and why, so its integrity can be defended in court. What is this documentation called?
     • The record of access
     • The notice of breach
     • The chain of custody
     • The order of seizure

     Correct answer: The chain of custody

     The chain of custody is the unbroken written record of every person who held an item, when they took it and why, and it is what allows a court to accept the exhibit as unaltered. The record of access shows who opened a file or system, not who physically held an exhibit. The notice of breach is the letter sent to regulators and affected people after data is exposed. The order of seizure is the legal authority to take the item in the first place and says nothing about later handling.

383. When collecting digital evidence from a running system, a forensic analyst captures the data most likely to be lost first, such as CPU registers and RAM, before imaging the disk. Which principle guides this sequence?
     • The order of volatility
     • The period of retention
     • The scope of engagement
     • The window of detection

     Correct answer: The order of volatility

     The order of volatility ranks evidence by how quickly it disappears, so registers, cache and memory are captured before disks and archives that survive a reboot. The period of retention states how long records are kept before disposal. The scope of engagement fixes what a tester is permitted to touch. The window of detection measures how long an intrusion ran before anyone noticed. None of those three governs the sequence in which live data is collected.

384. Anticipating litigation, an organization issues a directive requiring that all emails and documents related to a specific matter be preserved and exempt from routine deletion. What is this directive called?
     • Court filing memo
     • Data deletion log
     • Vendor audit form
     • Legal hold notice

     Correct answer: Legal hold notice

     A legal hold notice is the instruction that suspends routine destruction so everything relevant to a foreseeable case survives, and it overrides the normal schedule until counsel lifts it. A court filing memo is a submission to the court and tells staff nothing about preserving mailboxes. A data deletion log records what was destroyed, which is the opposite of halting destruction. A vendor audit form documents a supplier review and has no effect on internal records.

385. A security team configures a vulnerability scanner with valid login accounts so it can authenticate to hosts and inspect installed software, patch levels, and configurations from the inside. Which type of scan is this?
     • A credentialed scan
     • A segmentation scan
     • An application scan
     • An enumeration scan

     Correct answer: A credentialed scan

     A credentialed scan signs in with a real account, so it reads installed package versions, patch state and local settings directly instead of inferring them from the outside, which is why its results are more accurate. A segmentation scan proves that network zones cannot reach one another and never authenticates to a host. An application scan drives a web front end hunting injection and session flaws. An enumeration scan only discovers live hosts, ports and services.

386. A vulnerability scanner reports that a server is missing a critical patch, but manual verification confirms the patch is already installed and the service is not actually vulnerable. How should this finding be classified?
     • Accepted risk finding
     • Zero-day exploit case
     • False positive result
     • Missed alert incident

     Correct answer: False positive result

     The tool reported a weakness that verification proved absent, and that is precisely a false positive; validating findings before scheduling remediation is what keeps engineers from patching what was never broken. An accepted risk finding is a genuine exposure that management has knowingly decided to live with. A zero-day exploit case involves a real flaw for which no patch yet exists. A missed alert incident is the reverse error, where a real weakness is present and the tool stays silent.

387. A vulnerability management team needs an industry-standard numeric score from 0.0 to 10.0 to gauge the severity of each discovered flaw and prioritize remediation. Which system provides this score?
     • The CVE report entry
     • The CWE defect class
     • The NVD public index
     • The CVSS base metric

     Correct answer: The CVSS base metric

     CVSS is the scoring standard: its base metric group produces the 0.0 to 10.0 rating that lets a team rank one flaw against another and remediate in severity order. CVE is a catalogue that gives each disclosed vulnerability a unique identifier and carries no severity value. CWE classifies the underlying weakness type, such as buffer overflow or improper input validation. The NVD republishes CVE data with added detail, but the scale it shows is CVSS's rather than one of its own.

388. An analyst gathers threat indicators from publicly available sources such as security blogs, vendor advisories, social media, and public reputation feeds. Which category of intelligence source is this?
     • Proprietary intelligence
     • Open-source intelligence
     • Operational intelligence
     • Underground intelligence

     Correct answer: Open-source intelligence

     Blogs, vendor advisories, social media and public reputation feeds are all openly published, so collecting indicators from them is open-source intelligence, the broadest and cheapest collection category. Proprietary intelligence arrives through paid, closed vendor feeds that only subscribers can read. Operational intelligence names a tier of analysis supporting a particular campaign or incident, not the place the data came from. Underground intelligence is harvested from criminal marketplaces and invitation-only forums that are not public.

389. Organizations want to exchange machine-readable threat indicators automatically between their security platforms using a standardized language and transport. Which pair of standards supports this?
     • SAML and OAuth
     • STIX and TAXII
     • DKIM and DMARC
     • PGP and S/MIME

     Correct answer: STIX and TAXII

     STIX supplies the structured vocabulary for describing an indicator, an actor or a campaign, and TAXII supplies the transport services that move those objects between platforms, so the two together are what make automated indicator exchange work. SAML and OAuth federate logins and delegate authorization between applications. DKIM and DMARC authenticate the sending domain of email. PGP and S/MIME encrypt and sign individual messages between people.

390. Rather than waiting for alerts, an analyst forms a hypothesis about a possible undetected intrusion and proactively searches logs and endpoint data for evidence of it. Which security operations activity is this?
     • Risk profiling
     • Asset tracking
     • Threat hunting
     • Log forwarding

     Correct answer: Threat hunting

     Threat hunting is the proactive, hypothesis-led search of telemetry for an intruder that no rule has alerted on; the hunter assumes a compromise already happened and goes looking for it. Risk profiling rates assets and processes by exposure, a governance exercise rather than a search for an active intruder. Asset tracking keeps the inventory of what the organization owns accurate. Log forwarding is the plumbing that ships events into the platform a hunter later queries.

391. A SOC scripts the routine provisioning of user accounts and the disabling of accounts at termination so the steps run identically every time without manual intervention. Which benefit of automation does this primarily illustrate?
     • Uniform repeatable execution
     • Quicker after-hours reaction
     • Improved workforce retention
     • Broader operational coverage

     Correct answer: Uniform repeatable execution

     Scripting account creation and account disablement means the same commands, in the same order, with the same settings, on the hundredth run as on the first, and that removal of human variation is the benefit on display here. Quicker after-hours reaction is a genuine benefit of automation, but nothing in this scenario is time-critical. Improved workforce retention comes from sparing analysts dull work and is a side effect, not what identical execution demonstrates. Broader operational coverage describes a smaller team handling more ground, which is a scale argument rather than a consistency one.

392. A platform builds behavioral baselines for each user and flags a finance employee who suddenly downloads gigabytes of data at 3 a.m. from an unusual location as anomalous. Which capability is this?
     • SOAR
     • SASE
     • CASB
     • UEBA

     Correct answer: UEBA

     UEBA is the capability that learns what normal looks like for each user and device and then scores departures from it, which is how a finance clerk pulling gigabytes at three in the morning from a strange location gets surfaced. SOAR executes response playbooks once something has already been detected. SASE combines network access and security services at the edge for remote users. CASB governs how sanctioned and unsanctioned cloud applications are used, enforcing policy at the broker rather than baselining individual behaviour.

393. Before a device is permitted onto the corporate network, a system checks that it has current antivirus signatures, required patches, and an enabled firewall, and quarantines it if it fails. Which technology enforces this?
     • IPS
     • DLP
     • WAF
     • NAC

     Correct answer: NAC

     NAC checks a device against a posture policy before it is admitted to the network, so a machine missing patches, current signatures or an enabled firewall is placed in a quarantine segment until it complies. IPS inspects traffic already flowing and drops what matches an attack signature. DLP examines content for regulated data leaving the organization. WAF filters HTTP requests aimed at a web application and never evaluates the health of the connecting endpoint.

394. On a quarterly basis, managers must review and re-approve the permissions held by each of their direct reports, removing any access that is no longer needed. Which identity governance practice is this?
     • Credential provisioning
     • Entitlement attestation
     • Identity reconciliation
     • Enrollment verification

     Correct answer: Entitlement attestation

     Entitlement attestation is the periodic cycle in which the manager who knows the job confirms each permission is still warranted and revokes what is not, which is the standard defence against privilege creep. Credential provisioning issues the account and its initial rights at the start of the relationship. Identity reconciliation compares directory accounts against the authoritative personnel record to find orphans. Enrollment verification proves that the person receiving a credential is who they claim to be.

395. A security operations team must track expiration dates and renew TLS certificates before they lapse to prevent service outages and browser warnings. Which operational practice addresses this?
     • Certificate lifecycle management
     • Certificate transparency logging
     • Certificate authority delegation
     • Certificate suspension procedure

     Correct answer: Certificate lifecycle management

     Certificate lifecycle management is the discipline of knowing what has been issued, when each item expires, and renewing or replacing it in time, which is exactly what keeps a service from going dark behind a browser warning. Certificate transparency logging publishes issuance records so that mis-issued certificates can be spotted by third parties. Certificate authority delegation lets a subordinate authority sign on behalf of a root. Certificate suspension procedure covers putting a certificate temporarily on hold, and none of those three watches an expiry date.

396. To ensure every new virtual machine starts in a known, hardened state, the operations team builds golden images with approved configurations and deploys all instances from them automatically. Which security operations practice does this support?
     • Continuous integration pipeline
     • Distributed workload scheduling
     • Immutable baseline provisioning
     • Automated evidence preservation

     Correct answer: Immutable baseline provisioning

     Building approved images once and deploying every instance from them is immutable baseline provisioning: the configuration is fixed before launch, so no machine drifts away from the approved state and nothing is hand-configured after boot. A continuous integration pipeline builds and tests application code, which is a delivery concern rather than a host hardening one. Distributed workload scheduling decides which node runs which job. Automated evidence preservation captures artefacts for an investigation after an incident.

397. An organization classifies its security documents so that the high-level mandatory statement of management intent sits above more detailed documents. Which document type expresses the broad, enforceable management direction that other documents support?
     • Internal standard
     • Written procedure
     • Current guideline
     • Enterprise policy

     Correct answer: Enterprise policy

     A policy sits at the top of the documentation hierarchy: it is where management states, in binding terms, what the organization will and will not do, and every document below it exists to carry that intent out. A standard is narrower, fixing the specific technical settings that implement the policy. A procedure is narrower still, listing the ordered steps one person performs to complete a single task. A guideline carries no obligation at all and merely recommends.

398. A security team writes a document that lists the exact, step-by-step instructions an administrator must follow to disable a terminated employee's accounts. Which type of governance document is this?
     • Approved procedure
     • Operational policy
     • Corporate standard
     • Existing guideline

     Correct answer: Approved procedure

     A procedure is the step-by-step instruction set for one task, written so that any qualified administrator performs the work the same way and in the same order, which is exactly what a disable-the-accounts runbook is. A policy states management intent and never descends to individual commands. A standard sets the mandatory technical values a system must meet, not the sequence of actions taken. A guideline is advice that may be followed or set aside.

399. A company publishes a document offering recommended but non-mandatory advice on choosing strong passphrases. Because it is advisory rather than required, which governance document type best describes it?
     • Departmental policy
     • Enterprise standard
     • Practical guideline
     • Operating procedure

     Correct answer: Practical guideline

     A guideline is the only document type in the hierarchy that is optional: it recommends good practice, here on passphrase choice, and no one is in breach for departing from it. A policy is binding management direction. A standard imposes uniform mandatory requirements on systems. A procedure prescribes the exact steps for a task. All three of those compel, and it is the absence of compulsion that identifies this document.

400. An organization mandates that all stored passwords be hashed with a specific algorithm and minimum length to ensure consistency across systems. Which governance document type defines these specific, mandatory technical requirements?
     • Institutional policy
     • Operational standard
     • Documented procedure
     • Supporting guideline

     Correct answer: Operational standard

     A standard is where mandatory, uniform technical requirements live, so naming a specific hashing algorithm and a minimum length that every system must implement is standard-setting work. A policy states the broad intent that passwords be protected but does not name an algorithm. A procedure walks an administrator through a task rather than defining the requirement itself. A guideline could only suggest an algorithm, and this requirement is compulsory.

401. Leadership wants security decisions to be centralized so that a single executive team and committee set direction for the entire enterprise. Which governance structure does this describe?
     • Centralized governance
     • Distributed governance
     • Contractual governance
     • Operational governance

     Correct answer: Centralized governance

     Concentrating security decisions in one executive team and one committee that direct the whole enterprise is the centralized model: authority, standards and exceptions all resolve at a single point. Distributed governance spreads that authority across business units that each decide for themselves. Contractual governance drives behaviour through terms agreed with third parties. Operational governance concerns the day-to-day running of controls rather than where decision rights sit.

402. A large conglomerate lets each subsidiary set and enforce its own security policies tailored to its local needs, with little central control. Which governance approach is this?
     • Institutional governance
     • Transactional governance
     • Decentralized governance
     • Multinational governance

     Correct answer: Decentralized governance

     When each subsidiary writes and enforces its own security policy with little central direction, decision rights sit at the edges, and that dispersal of authority is the decentralized model. Institutional governance describes oversight exercised through formal institutional structures rather than the location of authority. Transactional governance manages individual dealings and exchanges. Multinational governance simply describes operating in several countries, which says nothing about who holds the authority to set policy.

403. A board of directors forms a group of senior leaders that meets regularly to review cyber risk, approve security strategy, and hold the program accountable. Which governance body is being described?
     • The purchasing council
     • The architecture board
     • The management cabinet
     • The steering committee

     Correct answer: The steering committee

     A steering committee is the standing body of senior stakeholders that reviews cyber risk, approves strategy and holds the security program to account on behalf of the board, which is precisely the group described. A purchasing council approves spending and selects suppliers, a remit that stops well short of security strategy. An architecture board rules on technical designs and standards for new systems. A management cabinet is a general executive grouping with no defined authority over the security program.

404. A regulatory framework explicitly applies to an organization and carries legal penalties for non-compliance, leaving the organization no choice but to follow it. How are such considerations categorized?
     • Voluntary commitments
     • Statutory obligations
     • Internal expectations
     • Advisory publications

     Correct answer: Statutory obligations

     A requirement imposed by law or by a regulator, with penalties attached and no opt-out, is a statutory obligation, and it is treated as a floor the organization must meet whatever its own risk appetite says. Voluntary commitments are frameworks an organization elects to adopt and may abandon without legal consequence. Internal expectations are set by the organization for itself. Advisory publications offer recommended practice that no authority enforces.

405. Within the data lifecycle, one role holds ultimate accountability for a particular data set, including its classification and authorizing access. Which role is this?
     • The designated data owner
     • The senior data custodian
     • The vendor data processor
     • The regional data steward

     Correct answer: The designated data owner

     The data owner is the senior figure who carries accountability for a specific set of information: they decide its classification, approve who may see it, and answer for it if it is exposed. A custodian implements those decisions technically but does not make them. A processor handles the information on instructions from another organization. A steward looks after quality and definitions, again under authority delegated from the owner.

406. An IT administrator is responsible for the technical handling of data, such as performing backups, applying access controls, and maintaining storage, but does not decide classification. Which role does this person hold?
     • The authorized data owner
     • The external data steward
     • The legal data controller
     • The onsite data custodian

     Correct answer: The onsite data custodian

     Running the backups, applying the access control lists and looking after the storage is custodial work: the custodian protects the data day to day under rules somebody else has set, and classification is explicitly not their call. The owner is the one who sets that classification and grants approval. The steward governs quality, meaning and appropriate use. The controller decides the purposes and means of processing personal data under privacy law.

407. Under privacy roles, the individual whose personal data is being collected and processed is given specific rights over that data. What is this person called?
     • The joint data controller
     • The remote data processor
     • The affected data subject
     • The backup data custodian

     Correct answer: The affected data subject

     The data subject is the living person the personal information is about, and privacy law gives that person rights over it, including access, correction and erasure. A controller is the organization that determines why and how the information is processed. A processor acts on the controller's documented instructions. A custodian is the technical caretaker of the storage. None of those three is the human being the record describes.

408. An organization appoints a role focused on ensuring data quality, consistent definitions, and proper use of data on behalf of the data owner. Which role best fits this responsibility?
     • The contracted data owner
     • The assigned data steward
     • The vendor data processor
     • The prime data controller

     Correct answer: The assigned data steward

     A data steward is charged with the meaning of the data: definitions, quality, consistency across systems and appropriate use, all exercised on behalf of the owner rather than in place of them. An owner holds the accountability and the classification decision itself. A processor handles information under instruction from another party. A controller sets the purposes and means of processing, which is a privacy-law role rather than a quality one.

409. A company appoints a senior executive accountable for the overall data privacy program and compliance with privacy laws across the enterprise. Which title best describes this role?
     • Chief technical officer
     • Global security officer
     • Lead regulatory officer
     • Data protection officer

     Correct answer: Data protection officer

     The data protection officer is the designated executive for the privacy program: they monitor compliance with privacy law, advise the business on its obligations and act as the contact point for regulators and data subjects. A chief technical officer owns engineering and product direction. A global security officer leads the broad security function, of which privacy is only one strand. A lead regulatory officer tracks the full span of regulation that touches the business rather than the privacy program itself.

410. Before engaging a new cloud provider, a company thoroughly investigates the vendor's financial stability, security posture, and reputation to ensure it is trustworthy. What is this vetting activity called?
     • Vendor risk transfer
     • Vendor exit planning
     • Vendor due diligence
     • Vendor budget review

     Correct answer: Vendor due diligence

     Investigating a prospective supplier's finances, security posture and reputation before signing anything is due diligence: the work is done up front, and its purpose is to decide whether to enter the relationship at all. Vendor risk transfer shifts residual exposure to an insurer or to the supplier through contract terms. Vendor exit planning prepares for the end of the relationship. Vendor budget review examines cost, which says nothing about whether the supplier can be trusted.

411. An organization continually re-evaluates an existing vendor's ongoing performance and security posture throughout the contract term. Which third-party risk activity does this describe?
     • Continuous vendor oversight
     • Financial vendor assessment
     • Terminal vendor offboarding
     • Provisional vendor approval

     Correct answer: Continuous vendor oversight

     Re-examining a supplier's performance and security posture repeatedly while the contract runs is continuous oversight, the due-care half of third-party risk management that follows the initial vetting and never stops until the relationship ends. Financial vendor assessment is the solvency check that belongs to the selection stage. Terminal vendor offboarding recovers data and revokes access when the contract ends. Provisional vendor approval admits a supplier on conditions before full engagement.

412. Two companies sign a legally binding master contract that establishes the general terms, responsibilities, and liabilities governing all future transactions between them. Which agreement is this?
     • Data licensing agreement
     • Master service agreement
     • Joint research agreement
     • Payment escrow agreement

     Correct answer: Master service agreement

     A master service agreement sets the umbrella terms once, so liability, confidentiality, payment and dispute handling are settled for every engagement that follows and each new project only has to describe the work itself. A data licensing agreement grants rights to use a particular dataset. A joint research agreement governs shared study and the intellectual property arising from it. A payment escrow agreement puts funds with a third party until conditions are met.

413. After signing a master agreement, a client issues a document that defines the specific deliverables, timelines, and tasks for a single project. Which document is this?
     • Schedule of rates
     • Statement of work
     • Bill of materials
     • Register of risks

     Correct answer: Statement of work

     A statement of work is the project-level document issued under an existing master contract: it names the deliverables, the milestones and the tasks for one engagement, leaving the legal terms to the umbrella agreement above it. A schedule of rates fixes unit prices and day rates. A bill of materials itemises the components that make up a product. A register of risks records identified threats to the project with owners and mitigations.

414. Before sharing sensitive product designs with a contractor, a company requires the contractor to sign a document legally obligating it to keep that information confidential. Which agreement is this?
     • Formal nondisclosure agreement
     • Business partnership agreement
     • Technology licensing agreement
     • Employment severance agreement

     Correct answer: Formal nondisclosure agreement

     A nondisclosure agreement is the instrument that binds the receiving party to keep what it is shown secret and to use it only for the agreed purpose, which is what protects the design files handed to the contractor. A business partnership agreement sets out how partners share control, profit and liability. A technology licensing agreement grants the right to use technology on stated terms. An employment severance agreement settles the terms on which someone leaves a job.

415. Two firms form a formal, legally binding contract to operate a joint venture and share in its profits and liabilities. Which agreement type best describes this relationship?
     • Mutual nondisclosure agreement
     • Commercial insurance agreement
     • Equipment purchasing agreement
     • Business partnership agreement

     Correct answer: Business partnership agreement

     A business partnership agreement is what two firms sign to run a venture together: it fixes each partner's contribution, the split of profits, the exposure to liabilities and how disputes and exits are handled. A mutual nondisclosure agreement only protects information the parties exchange. A commercial insurance agreement transfers particular risks to an insurer for a premium. An equipment purchasing agreement covers the sale of goods and nothing about shared ownership of a venture.

416. A company negotiates a clause in its vendor contract allowing it to inspect and verify the vendor's security controls and compliance during the engagement. Which contractual provision is this?
     • Subcontracting clause
     • Data-residency clause
     • Right-to-audit clause
     • Non-disclosure clause

     Correct answer: Right-to-audit clause

     A right-to-audit clause is the contractual permission to go and look: it lets the customer examine the supplier's controls, records and evidence of compliance while the engagement is running, instead of relying on the supplier's own assurances. A subcontracting clause governs whether work may be passed to a fourth party. A data-residency clause fixes the countries in which data may be stored. A non-disclosure clause restricts what each side may reveal.

417. A vendor announces that a product will no longer be sold or actively developed but will still receive limited support for a period. Which term describes this stage?
     • Support withdrawal
     • End-of-life status
     • Vendor divestiture
     • Warranty extension

     Correct answer: End-of-life status

     End-of-life is the point at which a vendor stops selling and stops developing a product while a defined period of limited support continues, which is the window customers use to plan migration before assistance disappears entirely at end-of-service-life. Support withdrawal is that later moment when help stops altogether. Vendor divestiture is the sale of a business line to another company. Warranty extension simply prolongs a repair guarantee and says nothing about whether the product is still sold.

418. A piece of network hardware has reached the date after which the manufacturer will provide no patches, updates, or support of any kind. Which term applies?
     • End-of-service-life (EOSL), a routine lifecycle marker
     • End-of-life (EOL), a documented lifecycle announcement
     • End-of-sale (EOS), a standardized lifecycle transition
     • Release-to-manufacturing (RTM), a known lifecycle step

     Correct answer: End-of-service-life (EOSL), a routine lifecycle marker

     End-of-service-life is the date beyond which the manufacturer issues no patches, no updates and no support of any kind, so a device that passes it can never be remediated again and has to be replaced, isolated or compensated for with other controls. End-of-life marks the end of active production and marketing, and a vendor normally still ships fixes for a stated period afterwards, so it is not the point at which support stops. End-of-sale is simply the last date the product can be ordered; units already in service keep their support entitlement. Release-to-manufacturing sits at the opposite end of the lifecycle, when a finished build is handed over for production.

419. A regulator requires an organization to formally declare, in writing, that it is in compliance with a specific control framework and to provide evidence on demand. This formal declaration is best described as which of the following?
     • Gap analysis, a familiar governance deliverable
     • Risk register, an ordinary governance procedure
     • Compliance attestation, a known governance term
     • Due diligence, an accepted governance reference

     Correct answer: Compliance attestation, a known governance term

     Compliance attestation is the formal, signed declaration in which an organization states that it meets the requirements of a named control framework and undertakes to produce supporting evidence when the regulator asks for it. A gap analysis compares the controls in place against a target standard and produces a list of shortfalls; it is an internal finding, not a declaration to anyone. A risk register is the running inventory of identified risks with their owners, ratings and chosen treatments. Due diligence is the investigation one party performs on another before entering a relationship, and it produces evidence about someone else rather than a statement about oneself.

420. An organization fails to meet a mandatory regulatory requirement and faces fines, loss of a license, and reputational harm. These outcomes are examples of which compliance concept?
     • Monitoring of controls, a common governance undertaking
     • Consequences of non-compliance, a known governance term
     • Acceptance of risk, a documented governance deliverable
     • Retention of records, a structured governance procedure

     Correct answer: Consequences of non-compliance, a known governance term

     Consequences of non-compliance is the term for exactly these outcomes: regulatory fines and sanctions, loss of a license or authorization, contractual penalties and reputational damage. They are the downside the organization is exposed to when a mandatory requirement is missed, which is why they are what a compliance program exists to prevent. Monitoring of controls is the ongoing checking work, so it is the activity rather than the outcome of failing. Acceptance of risk is a deliberate management decision to carry an exposure and is not imposed from outside. Retention of records governs how long information is kept and when it is destroyed.

421. A compliance team continuously tracks systems and processes to confirm the organization stays aligned with applicable laws and standards over time. Which compliance activity is this?
     • Compliance attestation, a known governance measure
     • Compliance training, a common governance procedure
     • Compliance remediation, a familiar governance term
     • Compliance monitoring, a defined governance effort

     Correct answer: Compliance monitoring, a defined governance effort

     Compliance monitoring is the continuous work of checking that systems, processes and controls still satisfy the laws, regulations and internal standards that apply, usually through automated evidence collection and recurring internal reporting. Compliance attestation is a point-in-time declaration made to an outside party, so it captures a moment rather than tracking alignment over time. Compliance training instructs staff on their obligations and changes behavior rather than measuring conformance. Compliance remediation is the corrective work carried out after a shortfall has already been identified.

422. An auditor employed by the company itself reviews internal controls and reports findings to management to improve the security program. What kind of audit is this?
     • External audit, a routine assurance arrangement
     • Regulatory audit, a defined assurance reference
     • Internal audit, a documented assurance activity
     • Control self-assessment, a known assurance step

     Correct answer: Internal audit, a documented assurance activity

     An internal audit is carried out by auditors on the organization's own payroll who evaluate the control environment and report their findings to management and the audit committee, giving independence from the operations they review while remaining inside the organization. An external audit is performed by an outside firm precisely so that the reviewer has no employment relationship with the organization at all. A regulatory audit is conducted by a government supervisor exercising statutory powers, not by staff who report to management. A control self-assessment is completed by the process owners themselves, with no auditor involved and no independent challenge.

423. To satisfy a partner's trust requirements, a company hires an independent third-party firm to objectively evaluate and attest to its security controls. What type of audit is this?
     • External audit, a familiar security arrangement
     • Internal audit, a documented security reference
     • Regulatory audit, a published security activity
     • Vulnerability assessment, a known security step

     Correct answer: External audit, a familiar security arrangement

     An external audit is the engagement in which an independent outside firm evaluates the organization's controls and attests to the result, and that independence is exactly what makes the opinion usable as assurance by a partner. An internal audit is staffed by the organization's own employees, so however rigorous it is, it cannot supply the outside objectivity the partner is asking for. A regulatory audit is imposed by a supervisor rather than commissioned by the organization to satisfy a commercial counterparty. A vulnerability assessment enumerates technical weaknesses in systems and never attests to whether governance controls are designed and operating properly.

424. Penetration testers are given no prior knowledge of the target environment and must discover everything from scratch, simulating an outside attacker. Which testing approach is this?
     • Known environment (white-box) testing, a common assessment method
     • Unknown environment (black-box) testing, a known assessment style
     • Partially known (gray-box) testing, a routine assessment approach
     • Physical intrusion (on-site) testing, a defined assessment format

     Correct answer: Unknown environment (black-box) testing, a known assessment style

     Unknown environment testing, historically called black-box testing, gives the tester no diagrams, no source and no credentials, so the whole picture has to be built from outside exactly as an uninformed attacker would build it. Known environment testing hands over full internal documentation and privileged access before work starts, which removes the discovery phase entirely. Partially known testing supplies a deliberate subset, typically a standard user account or a partial network map. Physical intrusion testing targets doors, badges and facilities, so it describes what is attacked rather than how much the tester was told.

425. Penetration testers are provided some limited information, such as user-level credentials, but not full architecture details, blending insider and outsider perspectives. Which testing approach is this?
     • Known environment (white-box) testing, a routine assessment technique
     • Unknown environment (black-box) testing, a familiar assessment method
     • Social engineering (pretext-based) testing, a common assessment style
     • Partially known (gray-box) testing, a documented assessment reference

     Correct answer: Partially known (gray-box) testing, a documented assessment reference

     Partially known testing, historically called gray-box testing, supplies the tester with a limited slice of information such as a standard user account or a partial network map, which blends the efficiency of an informed reviewer with the realism of someone who still has to discover most of the environment. Known environment testing provides complete documentation and privileged access from the start. Unknown environment testing provides nothing at all and forces discovery from outside. Social engineering testing probes how staff respond to pretexts and phishing, so it names the target of the test rather than how much the tester was told.

426. Before launching attacks, penetration testers gather information about a target by querying public records and DNS without interacting directly with the target's systems. Which activity is this?
     • Active reconnaissance, a known attacker method
     • Privilege escalation, a routine attacker phase
     • Lateral movement, a defined attacker technique
     • Passive reconnaissance, a common attacker step

     Correct answer: Passive reconnaissance, a common attacker step

     Passive reconnaissance collects intelligence from sources that never touch the target itself, such as registrar and public name records, corporate filings, job adverts and social media, so nothing the tester does appears in the target's own logs. Active reconnaissance sends traffic to the target to enumerate hosts, ports and services, which produces sharper information but is detectable. Privilege escalation happens after access has already been obtained and raises the rights of an existing foothold. Lateral movement is the spread from one compromised host to another inside the environment.

427. During an engagement, testers send packets to and scan the target's live systems to map open ports and services. Which reconnaissance type is this?
     • Active reconnaissance, a common attacker method
     • Passive reconnaissance, a known attacker tactic
     • Social engineering, a routine attacker activity
     • Credential harvesting, a defined attacker phase

     Correct answer: Active reconnaissance, a common attacker method

     Active reconnaissance interacts directly with the target, sending packets to sweep address ranges, enumerate open ports and fingerprint the services behind them, which yields precise and current information at the cost of leaving evidence in the target's logs. Passive reconnaissance deliberately avoids that contact and relies on third-party and public sources instead. Social engineering manipulates people into disclosing information or taking an action and does not map infrastructure. Credential harvesting gathers usernames and passwords for later authentication rather than discovering which systems exist.

428. An organization invites the public to find and responsibly report vulnerabilities in its applications in exchange for monetary rewards. Which program is this?
     • Red team simulation, an identified undertaking
     • Penetration testing engagement, a known effort
     • Bug bounty program, an established arrangement
     • Security awareness campaign, a common practice

     Correct answer: Bug bounty program, an established arrangement

     A bug bounty program opens vulnerability discovery to the public and pays a reward for each valid finding that is reported responsibly, so the number of people looking scales far beyond anything the organization could staff or schedule itself. A red team simulation uses a small contracted offensive team working to an agreed scope and a fixed fee. A penetration testing engagement is likewise a scoped, time-boxed contract with named testers rather than an open invitation. A security awareness campaign trains employees to recognize attacks and pays nothing for reported flaws.

429. During a security exercise, a designated offensive team attacks while a defensive team protects, and a third group enforces rules and scoring. Which group label refers to the defenders?
     • Red team, a common exercise function
     • Blue team, a known exercise identity
     • White team, a routine exercise label
     • Purple team, a defined exercise role

     Correct answer: Blue team, a known exercise identity

     The blue team is the defending side in an adversarial exercise: it monitors telemetry, detects the intrusion, contains it and restores service while the attack is under way. The red team is the offensive side, emulating an adversary against those defenses. The white team writes the rules, adjudicates disputes and scores the exercise, which is the third group the scenario describes. The purple team is the coordinating arrangement that feeds attacker findings straight into detection engineering, so it improves defenses afterwards rather than operating them during the exercise.

430. In an attack simulation exercise, the offensive group is tasked with emulating real adversaries to probe the organization's defenses. Which team label applies to this group?
     • Blue team, a known exercise function
     • Red team, a common exercise identity
     • White team, a routine exercise label
     • Purple team, a defined exercise role

     Correct answer: Red team, a common exercise identity

     The red team is the offensive group that emulates genuine adversary tradecraft against the organization's defenses so the exercise measures how those defenses behave under realistic pressure. The blue team is the defending group that monitors, detects and responds. The white team sets the rules, arbitrates and scores rather than taking either side. The purple team exists to transfer knowledge between attackers and defenders after or alongside the engagement, and it is not the group tasked with probing the defenses.

431. A new employee is required to sign a document that defines what is and is not permitted when using company computers, email, and internet. Which policy is this?
     • Clean desk policy, a routine governance instrument
     • Remote access policy, a known governance statement
     • Acceptable use policy, a defined governance record
     • Incident response policy, a common governance text

     Correct answer: Acceptable use policy, a defined governance record

     An acceptable use policy states which uses of corporate computers, mail accounts and network access are permitted and which are forbidden, and because it defines the boundaries every user must respect it is the document new staff are asked to read and sign. A clean desk policy governs how papers, removable media and unattended screens are secured in a workspace. A remote access policy sets the conditions under which staff may connect to internal systems from outside the office, which is one narrow slice of use rather than the whole of it. An incident response policy defines how suspected security events are reported, triaged and managed.

432. An organization runs a security awareness campaign that sends fake phishing emails to employees and records who clicks, in order to measure and improve user behavior. What is this technique called?
     • Phishing simulation campaign, a known technique
     • Security awareness briefing, a routine approach
     • User activity monitoring, a familiar capability
     • Vulnerability scanning service, a common method

     Correct answer: Phishing simulation campaign, a known technique

     A phishing simulation campaign sends controlled, harmless lookalike messages to staff and records who interacts with them, which produces a measured susceptibility rate and gives anyone who clicks an immediate teaching moment. A security awareness briefing delivers instruction but generates no behavioral measurement at all. User activity monitoring records what accounts do on production systems to flag anomalies, so it observes real work rather than staging a controlled test. A vulnerability scanning service probes systems for technical weaknesses and tells the organization nothing about how its people respond to a lure.

433. As part of a security awareness program, a company tracks how employee click rates on simulated phishing drop over time and reports the trend to leadership. This use of metrics is best described as which of the following?
     • Scoping and staffing of incident response, an ordinary commitment
     • Testing and patching of endpoint software, a familiar undertaking
     • Drafting and signing of vendor contracts, an accepted arrangement
     • Reporting and monitoring of program effectiveness, a known effort

     Correct answer: Reporting and monitoring of program effectiveness, a known effort

     Reporting and monitoring of program effectiveness is the awareness-program activity that gathers metrics such as the click rate on successive simulations, watches how they move over time and puts the trend in front of leadership so the program can be funded and adjusted on evidence. Scoping and staffing of incident response builds a response capability and does not measure anything about awareness. Testing and patching of endpoint software closes technical weaknesses in machines rather than tracking human behavior. Drafting and signing of vendor contracts is procurement work with no bearing on awareness metrics.

434. An organization sets rules for how long different categories of records must be kept and when they should be securely destroyed to meet legal and business needs. Which governance policy is this?
     • Acceptable use policy, a common governance instrument
     • Change management policy, a known governance document
     • Data retention policy, a routine governance statement
     • Password complexity policy, a defined governance text

     Correct answer: Data retention policy, a routine governance statement

     A data retention policy fixes, for each category of record, how long the organization must keep it and when it must be securely destroyed, reconciling statutory minimums, legal holds and the business need against the risk of holding information longer than it can be justified. An acceptable use policy governs how staff may use company systems. A change management policy governs how proposed changes are raised, reviewed and approved. A password complexity policy sets construction and rotation rules for credentials, none of which addresses how long records survive.

435. A formal change management process requires that every proposed change be reviewed and authorized before implementation to prevent unmanaged disruptions. Which body typically performs this review and approval?
     • Internal audit group, a common oversight commission
     • Change advisory board, a routine oversight function
     • Incident response team, a standard oversight entity
     • Security governance council, a known oversight body

     Correct answer: Change advisory board, a routine oversight function

     A change advisory board is the standing group that reviews each proposed change, weighs its risk, impact and backout arrangements, and then authorizes or rejects it before implementation, which is the control point a formal change process depends on. An internal audit group examines whether the process was followed after the fact and does not approve individual changes. An incident response team handles events that have already gone wrong. A security governance council sets priorities, policy direction and funding for the security program rather than ruling on individual change requests.

436. When responding to a risk, an organization chooses to stop the activity that creates the risk entirely so the threat can no longer affect it. Which risk treatment strategy is this?
     • Risk acceptance, a known treatment option
     • Risk transfer, a routine treatment choice
     • Risk mitigation, a common treatment label
     • Risk avoidance, a familiar treatment path

     Correct answer: Risk avoidance, a familiar treatment path

     Risk avoidance removes the exposure altogether by not undertaking the activity, or by discontinuing it, so there is no longer anything for the threat to act against. Risk acceptance keeps the activity running and knowingly absorbs the exposure as it stands. Risk transfer keeps the activity and shifts the financial consequence to an insurer or a counterparty, leaving the underlying threat in place. Risk mitigation also keeps the activity and applies controls to reduce how likely the event is or how much it would cost, which lowers the exposure without eliminating it.

437. A governance team is documenting the order of precedence among security documents. Which document type is a high-level, mandatory management statement that defines the organization's overall intent and expectations regarding security?
     • Policy, a common governance artifact
     • Standard, a routine governance label
     • Procedure, a defined governance text
     • Guideline, a related governance item

     Correct answer: Policy, a common governance artifact

     A policy is the high-level, mandatory statement of management intent that sets the organization's security goals and expectations, and it sits at the top of the document hierarchy because every other document is written to support it. A standard specifies the mandatory, measurable technical or operational requirements that implement a policy, so it is subordinate and far more detailed. A procedure gives the step-by-step instructions for performing a specific task. A guideline offers recommended practice that staff are free to adapt, so it is advisory rather than mandatory.

438. A company publishes a document that all employees must sign, defining permitted and prohibited uses of corporate laptops, email, and internet access. Which security governance document is this?
     • Statement of work (SOW), a common written instrument
     • Rules of engagement (ROE), a familiar written record
     • Acceptable use policy (AUP), a standard written text
     • Business impact analysis (BIA), a known written item

     Correct answer: Acceptable use policy (AUP), a standard written text

     An acceptable use policy is the governance document that sets out permitted and prohibited use of corporate laptops, mail and internet access, and it is published to every employee and signed as a condition of access. A statement of work defines the deliverables, tasks and timelines for one specific engagement with a supplier. Rules of engagement constrain an authorized security test by fixing its scope and permitted methods. A business impact analysis quantifies what a disruption would cost the organization and identifies which functions must be recovered first.

439. Before deploying a configuration change to production firewalls, a security team requires that the change be submitted, reviewed, approved, scheduled, and accompanied by a documented backout plan. Which security program process enforces this discipline?
     • Change management, a published program capability
     • Incident response, a standardized program routine
     • Vulnerability remediation, a known program effort
     • Configuration enforcement, a defined program task

     Correct answer: Change management, a published program capability

     Change management is the discipline that requires every change to be requested, reviewed, authorized, given an implementation window and supported by a rollback plan before it touches production, which is precisely the sequence the firewall change has to pass through. Incident response deals with events after something has gone wrong rather than governing planned work. Vulnerability remediation fixes identified weaknesses but says nothing about how any change is authorized or scheduled. Configuration enforcement keeps deployed systems on an approved baseline and corrects drift; it applies settings rather than deciding which settings may be applied.

440. An organization is sorting its data into categories such as public, internal, confidential, and restricted so that appropriate protections can be applied based on sensitivity. Which governance activity is being performed?
     • Data minimization, a known governance concept
     • Data classification, a common governance term
     • Data tokenization, a routine governance label
     • Data sovereignty, a defined governance notion

     Correct answer: Data classification, a common governance term

     Data classification sorts information into sensitivity tiers such as public, internal, confidential and restricted so that handling, storage, encryption and access rules can be attached to the tier rather than negotiated for every individual file. Data minimization limits how much personal data is collected in the first place and does not sort what has been collected. Data tokenization swaps a sensitive value for a surrogate that maps back only inside a secure vault, protecting a field rather than sorting the whole set. Data sovereignty concerns which country's law governs data because of where it is stored.

441. In a data governance model, an individual holds accountability for a specific data set, including decisions about its classification and who may access it, while delegating day-to-day storage and backup tasks to others. Which role does this individual hold?
     • Data user, a common governance designation
     • Data custodian, a routine governance title
     • Data processor, a defined governance label
     • Data owner, a familiar governance position

     Correct answer: Data owner, a familiar governance position

     The data owner is the senior accountable role that decides how a data set is classified and who may be granted access to it, and that accountability stays with the owner even when the hands-on work is handed to someone else. The data custodian performs exactly that delegated work, running storage, backup and the technical controls the owner has specified. The data processor acts on personal data only under the documented instructions of a controller. The data user is the person who consumes the data to do a job and makes no decisions about its protection.

442. Two companies forming a long-term strategic partnership want a formal, legally binding contract that defines the responsibilities, expectations, and terms of their ongoing business relationship. Which agreement type best fits this need?
     • Business partners agreement (BPA), a routine contractual record
     • Memorandum of understanding (MOU), a published contractual form
     • Mutual non-disclosure agreement (NDA), a known contractual item
     • Master service agreement (MSA), a standard contractual document

     Correct answer: Business partners agreement (BPA), a routine contractual record

     A business partners agreement is the binding contract two organizations sign to set out the responsibilities, contributions, revenue arrangements and expectations of an ongoing partnership, which is what a long-term strategic relationship needs. A memorandum of understanding records shared intentions and is generally not enforceable, so it cannot carry the obligations the two firms want to fix. A mutual non-disclosure agreement protects information the parties exchange but says nothing about how they will work together. A master service agreement fixes baseline terms for future work orders rather than establishing the partnership itself.

443. During third-party vendor due diligence, a buyer insists that the contract include a clause permitting it to inspect and review the vendor's security controls and compliance at any time. Which contractual provision is this?
     • Indemnification clause, a known contract detail
     • Arbitration clause, a common contract provision
     • Right-to-audit clause, a familiar contract term
     • Confidentiality clause, a defined contract item

     Correct answer: Right-to-audit clause, a familiar contract term

     A right-to-audit clause is the contractual provision that entitles the customer to inspect, test and review the supplier's security controls, evidence and compliance posture during the life of the contract, which is what converts a vendor's assurances into something verifiable. An indemnification clause allocates who bears losses and third-party claims. An arbitration clause fixes how disputes will be resolved outside the courts. A confidentiality clause restricts what each side may disclose about information exchanged under the contract, and none of these three creates any inspection right.

444. Before a penetration test begins, both parties sign a document defining the test's scope, timing, permitted techniques, target systems, and points of contact so the testers stay within authorized boundaries. What is this document called?
     • Memorandum of understanding, a known written text
     • Statement of applicability, a common written item
     • Standards of conduct, a routine written reference
     • Rules of engagement, a defined written instrument

     Correct answer: Rules of engagement, a defined written instrument

     Rules of engagement is the document both sides sign before an authorized test, fixing the scope, the testing window, the techniques that may be used, the systems that are in scope and the emergency contacts, so the testers can be held to agreed limits and the customer knows what to expect. A memorandum of understanding records non-binding intentions between organizations. A statement of applicability lists which controls of a standard an organization has selected and why. Standards of conduct set behavioral expectations for employees and have nothing to do with test boundaries.

445. An organization wants independent assurance that a cloud provider's stated security controls are designed and operating effectively, so it requests a formal report produced by an external auditor. Which type of audit is the organization relying on?
     • Internal audit, a routine assurance mechanism
     • Third-party audit, a known assurance activity
     • Regulatory audit, a defined assurance measure
     • Vulnerability scan, a common assurance method

     Correct answer: Third-party audit, a known assurance activity

     A third-party audit is performed by an outside firm with no stake in the outcome, and that independence is what allows its report to be accepted as evidence that the provider's controls are both designed properly and operating as described. An internal audit is carried out by the provider's own staff, so it cannot supply the outside objectivity the customer is buying. A regulatory audit is imposed by a supervisor under statutory powers and is not something a customer can request. A vulnerability scan finds technical weaknesses at a moment in time and says nothing about whether governance controls operate over a period.

446. In a zero trust architecture, which control plane component continuously adjusts a user's access requirements based on signals such as device posture, location, and behavior during an active session?
     • Policy administrator, a common security label
     • Adaptive identity, a routine security concept
     • Implicit trust, a familiar security construct
     • Threat intelligence, a known security element

     Correct answer: Adaptive identity, a routine security concept

     Adaptive identity is the zero trust control-plane function that keeps re-evaluating context, including device health, geolocation, time and behavioral patterns, and raises or lowers what the user must satisfy as that context shifts inside a live session. The policy administrator establishes and tears down the session once a decision has already been reached, so it executes rather than weighs signals. Implicit trust is the assumption zero trust is built to remove, not a component that performs work. Threat intelligence supplies external indicators about adversaries and sits outside the access decision path.

447. Attackers compromise a niche industry news website that is frequently visited by employees of a target company, planting malware so that those employees become infected when browsing. What type of attack is this?
     • Watering hole attack, a common technique
     • Brute force attack, an ordinary approach
     • Password spraying attack, a known method
     • Evil twin attack, an identified maneuver

     Correct answer: Watering hole attack, a common technique

     A watering hole attack compromises a legitimate third-party site that the intended victims are known to visit and waits for them to arrive, which is how an attacker reaches a well-defended organization through a poorly defended one it trusts. A brute force attack works through candidate credentials against an account until one succeeds. A password spraying attack tries a small number of common passwords across many accounts to stay under lockout thresholds. An evil twin attack stands up a rogue wireless access point that impersonates a legitimate network so that clients associate with the attacker.

448. A developer's build system automatically pulls a package from a public repository because an internal package of the same name does not exist there, allowing an attacker who published a malicious public package to execute code. What attack does this describe?
     • Command injection, a routine exploit
     • Directory traversal, a common method
     • Buffer overflow, a familiar approach
     • Dependency confusion, a known tactic

     Correct answer: Dependency confusion, a known tactic

     Dependency confusion exploits a build tool that resolves package names against a public registry when an identically named internal package cannot be found privately, so an attacker who registers that name publicly gets code executed inside the build pipeline. Command injection passes shell metacharacters into an application that hands input to the operating system. Directory traversal walks outside the intended path to read files the application never meant to expose. A buffer overflow writes past the end of an allocation to corrupt adjacent memory, and none of these three involves how a package name is resolved.

449. Malware injects itself into a user's browser process to silently capture and modify online banking transactions after the user has authenticated, even over an HTTPS session. Which threat best describes this?
     • Downgrade attack, a standardized approach
     • Replay attack, a well-documented maneuver
     • Man-in-the-browser attack, a known method
     • Typosquatting attack, a routine technique

     Correct answer: Man-in-the-browser attack, a known method

     A man-in-the-browser attack places malware inside the browser process itself, so it reads and rewrites transactions after the transport encryption has already been unwrapped and after the user has authenticated, which is exactly why an HTTPS session offers no protection against it. A downgrade attack forces a weaker protocol version or cipher suite during negotiation. A replay attack re-sends captured traffic to make an action happen a second time. A typosquatting attack registers misspelled domain names to catch users who mistype an address.

450. When configuring an IPsec VPN, an engineer must ensure the payload data is encrypted for confidentiality. Which IPsec protocol provides encryption of the data payload, which the other does not?
     • IP Authentication Header (AH), a familiar networking convention
     • Encapsulating Security Payload (ESP), a known networking format
     • Internet Key Exchange (IKE), a defined networking specification
     • Payload Compression Protocol (IPComp), a common networking term

     Correct answer: Encapsulating Security Payload (ESP), a known networking format

     Encapsulating Security Payload is the IPsec protocol that encrypts the data it carries, and it supplies integrity and origin authentication for that protected data as well, which is why it is chosen when confidentiality is required. IP Authentication Header provides integrity and authentication for the packet but performs no encryption whatsoever, so anything it protects still travels in the clear. Internet Key Exchange negotiates the keys and security associations before any user data is protected and is not itself the protection. Payload Compression Protocol shrinks payloads to offset the expansion encryption causes and offers no confidentiality of its own.

451. A security team wants vulnerability scanning that does not require installing software on each endpoint and instead queries hosts remotely over the network. Which scanning approach are they choosing?
     • Agent-based scanning, a common model
     • Credentialed scanning, a known style
     • Agentless scanning, a routine method
     • Passive monitoring, a defined option

     Correct answer: Agentless scanning, a routine method

     Agentless scanning reaches each host across the network from a central scanner, so nothing has to be installed or maintained on the endpoint; the trade-off is that a machine which is powered off or unreachable at scan time is simply missed. Agent-based scanning depends on resident software deployed to every endpoint, which is the requirement the team is trying to avoid. Credentialed scanning describes the level of access handed to the scanner and is orthogonal to whether software is installed locally. Passive monitoring only inspects traffic it happens to observe and never queries a host at all.

452. A company asks a prospective SaaS vendor for an independent auditor's report covering the operating effectiveness of the vendor's security controls over a period of time. Which report should the company request?
     • Prior year internal audit memo copy, a recognized deliverable
     • Vendor written security policy document set, a common package
     • Recent external network vulnerability scan file, a known item
     • SOC 2 Type II attestation report, a well-documented reference

     Correct answer: SOC 2 Type II attestation report, a well-documented reference

     A SOC 2 Type II attestation report is produced by an independent auditor and covers whether the service provider's controls were suitably designed and, crucially, whether they operated effectively across a defined review window, which is precisely the evidence a buyer needs for vendor due diligence. A prior year internal audit memo is the vendor's own work product and carries no independence. A vendor written security policy document set states what the provider intends to do rather than proving the controls ran. A recent external network vulnerability scan file lists technical findings at a single moment and never addresses control effectiveness over time.

453. Under a privacy regulation, an organization collects only the specific personal data fields strictly necessary to deliver the requested service and nothing more. Which privacy principle is being applied?
     • Data minimization, a known privacy notion
     • Data sovereignty, a routine privacy label
     • Data obfuscation, a familiar privacy term
     • Data portability, a standard privacy idea

     Correct answer: Data minimization, a known privacy notion

     Data minimization is the privacy principle that only the personal data genuinely needed for the stated purpose may be collected and kept, which shrinks the breach surface and the compliance burden at the same time. Data sovereignty concerns which jurisdiction's law governs information because of where it physically resides. Data obfuscation disguises values that have already been gathered and therefore does nothing to limit collection. Data portability is the right of an individual to receive their personal data in a reusable format and move it to another provider.

454. A customer submits a formal request asking a company to disclose all personal information the company holds about them and to provide a copy of that data. Fulfilling this request supports which privacy capability?
     • Breach notice duty, a routine obligation
     • Subject access request, a common measure
     • Privacy impact review, a defined control
     • Records retention schedule, a known step

     Correct answer: Subject access request, a common measure

     A subject access request is the mechanism privacy law gives an individual to make an organization confirm what personal data it holds about them and hand over a copy of it, normally inside a statutory deadline. A breach notice duty obliges the organization to inform regulators and affected people after a compromise, so it is triggered by an incident rather than by a person's request. A privacy impact review assesses the risk of a planned processing activity before it begins. A records retention schedule sets how long each class of record is kept and when it is destroyed.