Your FREE CompTIA Security+ (SY0-701) Practice Test 2026 – 450+ Q&A

Correct answer: To lure an attacker onto a decoy server we monitor

A honeypot exists to lure an attacker onto a decoy server we monitor, so defenders can detect the intrusion and study the attacker's tools and techniques. Luring an intruder across a decoy subnet describes a honeynet, a network of many decoy systems rather than a single one. Luring an intruder into opening bait files describes a honeyfile, which is a single document, not a system. Stalling an intruder's scans with delayed replies describes a tarpit, which slows the attacker rather than drawing them in to be studied.

Correct answer: To draw an attacker onto a watched false target

A honeypot exists to draw an attacker onto a watched false target: a decoy system with no production role, so any connection to it is suspicious and can be studied safely. Drawing an intruder into opening a planted bait file describes a honeyfile, and drawing one into using a planted credential describes a honeytoken; both are decoy data, not decoy systems. Stalling an attacker with a host's slow replies is a tarpit, which wastes attacker time rather than observing them.

Correct answer: Integrity requirements

Integrity is the property that data has not been altered except by an authorized party acting in an authorized way, and hashing, digital signatures, input validation and change control are the mechanisms that enforce it. Confidentiality governs who may see data rather than who may change it, so it is fully satisfied by a record an attacker has silently rewritten but nobody has read. Availability governs whether the data is reachable when it is needed and says nothing about whether its contents are still true. Nonrepudiation binds an action to a specific actor so it cannot later be denied, a proof-of-origin property layered on top of integrity rather than the modification control itself.

Correct answer: Drawing attackers toward a decoy server to study their techniques

A honeypot's main purpose is drawing attackers toward a decoy server to study their techniques: it has no production role, so every connection it receives is hostile and can be observed and recorded. Redirecting malware callbacks to a sinkhole is DNS sinkholing, which cuts off command traffic rather than inviting study. Slowing scanners with a tarpit deliberately stalls connections to waste an attacker's time. Seeding fake records into a database describes a honeytoken, a tripwire planted inside real data rather than a decoy system.

Correct answer: Minimum privilege

Least privilege, the principle of issuing an account the minimum privilege its task actually needs, is what caps the damage of a breach: a compromised account inherits only that narrow set of rights, so the harm stops where the entitlements stop. Change management governs how modifications reach production and prevents self-inflicted outages, an availability and integrity concern rather than a containment one. Security training reduces how often a person is tricked into opening the door at all, lowering the chance of a breach without limiting what one costs. Vendor assessment rates the risk a third party carries before it is onboarded, a supply-chain judgment made in advance rather than a limit on an intruder already inside.

Correct answer: Verifying user identity and device posture wherever requests originate

Zero Trust means verifying user identity and device posture wherever requests originate, so network location earns no standing trust and every request is evaluated on its own. Verifying identity through MFA and then trusting each device it uses checks only half the picture and grants implicit trust to the endpoint. Verifying device health once at enrollment and then trusting every later login is one-time admission, the opposite of continuous verification. Denying every request until an admin approves it misreads 'never trust' as 'never allow'; Zero Trust grants access automatically once policy checks pass.

Correct answer: Stacking several independent layers so a single failure stays contained

Defense in depth assumes that any one control will eventually fail, so it layers independent administrative, technical and physical controls along the path an attacker must take; a firewall, segmentation, endpoint protection, least privilege and monitoring each buy time and none of them is load-bearing on its own. Ranking discovered weaknesses so the worst are corrected first is risk-based vulnerability management, which sequences remediation instead of layering protection. Splitting a transaction so no single person completes it is separation of duties, an insider control. Rotating people through roles surfaces concealed misuse over time, another personnel control; each of those is one individual layer, not the layering principle itself.

Correct answer: Insider threats

Zero Trust's primary concern is insider threats: the traditional perimeter model granted implicit trust to anyone already inside the network, and Zero Trust removes that by verifying identity, device and authorization on every request, limiting what a malicious insider or compromised internal account can reach. Zero-day threats are unknown vulnerabilities, addressed by patching, exploit mitigation and behavioural detection; the shared word "zero" is a coincidence. Zero-click threats exploit flaws in software such as messaging apps with no user interaction and are countered by patching and attack-surface reduction, not by removing implicit trust. Social engineering threats manipulate people into acting, which awareness training counters; Zero Trust limits the damage afterwards but does not target the manipulation itself.

Correct answer: Assigning an account a rights bundle scoped for one function

Least privilege gives every user, service and process a bundle of rights scoped to the single function it performs and nothing wider, and it applies for as long as that function lasts, so a compromised or misused account carries the smallest possible reach. Forcing a periodic password change is a credential hygiene rule that limits how long a stolen secret stays valid without changing what the account can do. Locking an account after repeated failed logons frustrates guessing attacks, an authentication throttle rather than an entitlement decision. Putting an account in a group is the mechanism by which rights are often delivered, but a group can over-grant just as easily as it can grant correctly; the principle concerns the size of the grant, not the container it arrives in.

Correct answer: Naming certificates the issuing authority has withdrawn ahead of expiry

A CRL is a signed, periodically republished list of the serial numbers of certificates that the issuing certificate authority has revoked before their natural expiry, because a key was compromised, an employee left or a certificate was issued in error; a relying party consults it, or the equivalent OCSP response, before trusting a certificate that is otherwise still inside its validity dates. Holding private keys in tamper-evident hardware describes a hardware security module or a smart card, which protects keys rather than listing dead ones. Binding a verified applicant to a published key is what the certificate itself does at issuance. Publishing the hierarchy a client walks to a trusted root is the work of the CA and its intermediates, which establishes trust rather than withdrawing it.

Correct answer: It keeps copies of private keys in trusted third-party custody

Key escrow means a trusted third party keeps a protected copy of private keys so an authorized party can obtain them later. It has nothing to do with validation speed, which depends on revocation list or status protocol checking. Publishing public keys is what a public repository or directory does, and public keys need no escrow because they are already public. Signing certificate requests is the certificate authority's own function, performed with the authority's key rather than with escrowed material.

Correct answer: Non-repudiation proofs

Non-repudiation is the property that stops a sender from later denying that they produced and sent a message; a private-key digital signature supplies it because only the signer holds the key. Confidentiality keeps the content unreadable by outsiders but says nothing about who sent it. Integrity shows that content was not altered in transit, yet an altered-free message can still be disowned. Authentication proves who a party is at the time of a session, without binding them to a specific message afterwards.

Correct answer: The number of the keys each cipher needs to work

The defining difference is key count and key relationship: symmetric encryption uses one shared secret for both directions, while asymmetric encryption uses a mathematically linked public and private pair. Block size varies among algorithms within both families and separates nothing. Neither family restricts the kind of data it may protect. Neither family requires a hash before encrypting, and hashing is a separate primitive used alongside either one.

Correct answer: RSA

RSA is the odd one out because it is asymmetric: it works with a linked public and private key pair, and its security rests on the difficulty of factoring large numbers. AES is the symmetric block cipher that replaced DES as the standard. RC4 is a symmetric stream cipher, now deprecated. DES is the original symmetric block cipher whose short key made it obsolete. All three of those use the same secret to encrypt and to decrypt.

Correct answer: Asymmetric encryption

Asymmetric encryption is built on a linked key pair: anyone may encrypt with the freely published public key, and only the matching private key held by the recipient can decrypt the result. Symmetric enciphering uses one secret for both operations. Cryptographic digests are one-way and cannot be reversed with any key at all. Block-cipher chaining is a mode of operation that links blocks together and introduces no second key.

Correct answer: Two unlike messages that share one hash value

A collision occurs when two different inputs share an identical digest from the same hash function; because a hash maps unlimited input to a fixed-length output, collisions must exist, and a strong function makes finding one infeasible. Two keys producing matching ciphertext is not what the term names. Reusing a nonce across sessions is a separate weakness in a mode of operation. Packets arriving in the wrong order is a transport condition with no hashing involved.

Correct answer: Cryptographic hashing

Cryptographic hashing is the primary integrity mechanism: recompute the digest and compare it, and any change of even one bit produces a completely different value. Asymmetric encryption protects confidentiality and enables key exchange, but ciphertext can still be corrupted without detection. Steganographic hiding conceals that a message exists and does nothing to prove it is unchanged. Deterministic padding only fills a block to the required size and carries no verification value.

Correct answer: To recover data after a private key is destroyed

The business reason for escrowing keys is recoverability: if an employee leaves, a device fails or a key is destroyed, encrypted data would be permanently unreadable unless a protected copy of the key exists. Escrow adds a step to key management and shortens no handshake. It changes nothing about the algorithm or key length, so cipher strength is unaffected. Publishing a record of void certificates is the job of a revocation list or an online status responder.

Correct answer: It makes each stored hash value end up unique

A salt is a random value added to the input before hashing, so two users who choose the same password still store different digests, and precomputed tables built for unsalted hashes become useless. A salt does not conceal the stored output, which is usually readable to anyone with database access. It adds input rather than compressing it. It adds work rather than saving it, and slowing the routine down is often deliberate.

Correct answer: The way that each one takes in its plaintext

The categories are defined by how plaintext is taken in: a stream cipher runs a keystream against the data bit by bit or byte by byte, while a block cipher gathers plaintext into fixed-size blocks and transforms one block at a time. Accepted key lengths vary between individual algorithms inside both families. Round count is an internal design detail of a particular algorithm. Neither family is restricted to a particular kind of medium.

Correct answer: Shared secret creation

Diffie-Hellman lets two parties create a shared secret over a channel an eavesdropper can watch, because each side combines its own private value with the other's public value and reaches the same result. It does not encipher bulk data; the shared secret is handed to a symmetric cipher for that. It produces no signature and proves nothing about identity on its own. It produces no digest, so it performs no hashing.

Correct answer: The SET protocol

Secure Electronic Transaction was designed specifically to protect commercial transaction data as it moves between the parties to a trade, wrapping the order and payment details in certificates so each side proves who it is. The IKE exchange negotiates keys for a network-layer tunnel. A RADIUS proxy forwards authentication and accounting for network access. SRTP encrypts real-time voice and video streams. None of those three was built to secure trading documents.

Correct answer: It names the certificates that an issuer has withdrawn

It names the certificates that an issuer has withdrawn: a CRL is the CA's signed list of revoked serial numbers that relying parties check before trusting a certificate. Certificates that hit their expiry date fail on their own dates and are normally dropped from the CRL rather than listed on it. An open log of the certificates CAs issued is Certificate Transparency, not revocation. Answering status queries that check one certificate at a time is what an OCSP responder does.

Correct answer: Shamir secret sharing

Shamir secret sharing splits a secret into shares and sets a threshold, so any group smaller than the threshold learns absolutely nothing while a large enough group can rebuild the original. Escrowed private keys are whole keys held in custody, not fragments. Reversible data masks substitute readable values and can be undone by whoever holds the mapping. Rotating nonce values replace one complete value with another and never divide a secret into parts.

Correct answer: Collision resistance

Collision resistance is the property named: it must be computationally infeasible to discover any two inputs that map to one digest, which is what keeps signatures and file checksums trustworthy. Fixed-size digesting only means every input yields an output of the same length, and it is the very reason collisions must exist. Deterministic output means one input always yields the same digest. Uniform distribution describes how outputs spread across the range, not how hard it is to find a matching pair.

Correct answer: The chain of trusted issuers that ends at the root

The chain of trust is the certificate path: the end-entity certificate is signed by an intermediate authority, which is signed by another, up to a root the relying party already trusts, and each link is verified in turn. The order of cipher rounds is an internal algorithm detail. The lineup a client offers is the handshake proposal. The keys two peers share for a session are established after the chain has already been validated.

Correct answer: Use a shared secret for copies, a key-pair to swap

Each type is used where it is strong: a shared secret cipher encrypts terabytes quickly, and a public and private key pair lets two strangers settle that secret across an untrusted link without ever transmitting it. Using one shared secret for both tasks leaves the original problem of getting that secret to the far end, and hand delivery does not scale. A key pair is far too slow for terabytes. A one-way hash cannot restore a backup, and a courier is not a cryptographic mechanism.

Correct answer: A compensating safeguard

A compensating safeguard is an alternative put in place when the required primary measure cannot be implemented, and it must deliver comparable protection; segmenting an unpatchable server behind strict filtering is the textbook example. A preventative screening stops an event before it starts, which is not possible here because the flaw remains present. A managerial instruction is written direction such as a policy. A corrective improvement restores a system after an incident has already occurred.

Correct answer: Deterrent or discouraging

Warning signs, lighting and visible cameras are deterrent or discouraging controls, because their primary purpose is to make an attacker decide not to try. Detective controls identify an incident as it happens; cameras can record, but being visible is what makes them discourage. Preventive controls physically obstruct entry, as a locked gate or bollard does, and a sign obstructs nothing. Compensating controls substitute for a required control that cannot be implemented.

Correct answer: Preventive, deterrent, detective, corrective

Preventive, deterrent, detective and corrective are all functional control types, the labels that state what a control is meant to DO, and compensating and directive complete that same list of six. Technical, managerial, operational and physical describe how a control is implemented and by whom, which is the category axis rather than the functional one. Mandatory and discretionary name access control models, regulatory names a compliance driver, and hybrid names a deployment mix. Confidentiality and integrity are security properties, while advisory and manual describe a document and a method rather than a control type.

Correct answer: Directive control

A directive control works by instructing people, and a written policy requiring staff to lock a workstation states exactly the behavior the organization expects. A detective control establishes that something has already occurred, such as a log entry showing an unattended session. A deterrent control discourages an outsider from attempting an attack, which an internal policy read only by employees does not do. A technical control names the category of implementation, a mechanism enforced by the system itself rather than an instruction given to a person.

Correct answer: Corrective

Corrective controls act after an incident to remove the cause and restore systems to a known-good state, which is what removing the malicious files and restoring clean backups does. Operational is a control category describing controls carried out by people, such as backup procedures, not a functional type describing what the control does. Managerial is a category covering policies and risk assessments, not post-incident remediation. Physical is a category for tangible barriers such as locks and fences, not a functional type.

Correct answer: Physical or environmental

Guards, fences, locks, bollards and access badges all act on the tangible world, so CompTIA places them in the physical or environmental control category. Operational or staff-based controls are the procedures people carry out, such as awareness training and log review; a guard is a person, but the category counts what the control protects against, physical access. Technical or device-based controls live in software and system configuration, not in a badge or a gate. Deterrent or preventive describes control TYPES, which cut across every category, so it does not answer a question about category.

Correct answer: Managerial or strategic

Managerial controls are the governance instruments through which an organization directs risk, and both an acceptable use policy and a scheduled risk assessment are decisions and direction rather than mechanisms. Technical controls are enforced by systems, such as access control lists and encryption. Operational controls are the routine tasks staff perform, such as reviewing logs or provisioning accounts. Preventive names what a control is meant to do, which is a functional type and not one of the implementation categories.

Correct answer: Operational or manual

Operational controls are the ones people execute while running the business, so awareness training, account provisioning and log review performed by analysts all sit in this category. Physical controls protect the building and the equipment inside it. Directive controls state what staff are required to do, which is the written instruction rather than the work itself. Detective names what a control is for, identifying that an event has occurred, instead of naming how the control is implemented.

Correct answer: Availability of service

Availability is the property a denial-of-service attack strikes directly: nothing is read and nothing is altered, the application simply cannot be reached by the people entitled to use it. Confidentiality concerns unauthorized disclosure, and flooding a site discloses nothing. Integrity concerns unauthorized modification, and the stored data is left exactly as it was. Accountability concerns being able to attribute an action to a particular identity, which the outage does not undermine.

Correct answer: Non-repudiation

Non-repudiation is the assurance that whoever originated an action cannot later deny it, and it is produced by binding the request to a private key that only the customer holds, usually through a digital signature. Tamper-evidence shows that a seal or a record has been disturbed, which reveals interference after the fact but never ties a message to the person who sent it. Fault-tolerance keeps a service running through component failure, which is an availability property. Self-encryption protects data written to a drive and offers no evidence about the origin of a transaction.

Correct answer: Accounting or traceability

Accounting is the third A of AAA: once a subject has been authenticated and authorized, accounting records what was actually done, including the commands issued, the resources touched and how long the session lasted, and that record is what makes an audit possible. Authentication establishes that the subject really is who it claims to be. Authorization decides which resources that proven identity may use. Provisioning is the account lifecycle work of creating and removing access, which happens before a session ever starts rather than recording what goes on inside one.

Correct answer: Evaluating requests and issuing the access decision

The Zero Trust control plane is where the access decision is made: the policy engine evaluates each request against policy and the policy administrator issues the resulting grant or denial. Forwarding packets and blocking denied sessions is the work of the policy enforcement point in the data plane, which carries out a decision it did not make. Encrypting payloads and rotating symmetric keys protects traffic in flight but decides nothing about who may reach what. Assigning addresses and renewing leases is ordinary network plumbing that exists whether or not Zero Trust is deployed.

Correct answer: Enforcement point or gateway

The policy enforcement point sits in the data plane and is the component that actually opens, refuses or tears down the session once a verdict has been handed to it. The decision engine is the policy engine, which produces the verdict but never touches the traffic. The trust algorithm is the scoring logic the policy engine runs to reach that verdict. The resource portal is a deployment model that fronts an application, not the component charged with allowing or blocking a session.

Correct answer: It shrinks implicit trust zones so one breach cannot spread far

Threat scope reduction through microsegmentation means it shrinks implicit trust zones so one breach cannot spread far: small segments with policy between them cap how far a compromised workload can move laterally. Rechecking device trust per session is continuous authentication, which judges who is connecting rather than limiting where they can reach. Rechecking device posture per request is dynamic access evaluation, a policy decision point job, not segmentation. Hiding internal hosts from scans is the cloaking a software-defined perimeter provides, which limits discovery, not the blast radius after a breach.

Correct answer: Deception technology

Deception technology is the family of tools built to mislead an intruder: honeypots, honeynets, honeyfiles and honeytokens all present something attractive and false, so any interaction with them is both a high-confidence alert and a chance to watch how the attacker works. Network segmentation limits where traffic may flow but presents nothing fake. Privilege management decides what an account is allowed to do rather than baiting it. Behavioral analytics hunts for anomalies in genuine activity instead of planting decoys.

Correct answer: Honeytoken or item

A honeytoken is a single piece of bait data, such as a fake credential, API key or database record, placed where no legitimate process will ever touch it, so any use of it is unambiguous evidence of intrusion. A honeynet is a whole decoy network of systems. A honeypot is a decoy host built to be attacked and studied. A sinkhole redirects malicious traffic to a controlled destination rather than planting false data and waiting for someone to pick it up.

Correct answer: Change management

Change management is the governance process that requires a proposed change to be documented, assessed for impact and approved before it reaches production, precisely so an unplanned outage or a new security gap is caught on paper first. Incident response governs what happens once something has already gone wrong. Firewall auditing reviews an existing rule base for drift and unused entries but authorizes no change. Capacity planning forecasts future resource demand and plays no part in approving modifications.

Correct answer: To capture the precise steps of the rollback

The primary purpose of a backout plan is to capture the precise steps of the rollback, so that a failed change can be reversed quickly to the last known good state. Defining tests that prove the change worked is the validation or test plan, which decides success rather than how to undo failure. Recording the root cause if the change fails belongs to the post-incident review after the event. Stating the downtime users should expect is part of the impact analysis and communication plan, not the reversal procedure.

Correct answer: Baseline configuration

A baseline configuration is the documented, approved state of a system, covering its version, its settings and its dependencies, and it exists so that any later deviation can be recognized as drift. Maintenance scheduling reserves a time in which changes may be made rather than describing what the approved state is. Records classification labels information by sensitivity and says nothing about build settings. Compliance attestation asserts that a control set meets an external standard, which is a statement made to an auditor rather than a technical reference point.

Correct answer: Disk level

Full-disk encryption works at the disk level: the entire physical drive, including the operating system, swap and free space, is encrypted as one unit, so a lost laptop reveals nothing. Volume level encryption protects one logical volume and can leave other volumes on the same drive readable. File container level encryption protects only what is stored inside one encrypted container file. File system level encryption protects the files and directories within one mounted file system, not the raw drive beneath it.

Correct answer: Tokenization

Tokenization swaps each sensitive value for a surrogate of the same type and length, so a legacy application that expects a fixed-length field keeps working while the real value sits in a separate vault. Segmentation isolates parts of a network and does nothing to the field itself. Sanitization destroys data so that it cannot be recovered, which is the opposite of keeping it usable. Minimization reduces how much data is collected in the first place and cannot preserve a format that has to stay exactly as it is.

Correct answer: Steganography

Steganography hides a message inside a carrier file, such as the least significant bits of an image, so an observer never knows the message exists. Watermarking also embeds data in an image, but its purpose is to mark ownership, not to conceal a secret message. A covert channel hides communication by abusing a channel never meant for data transfer, such as timing or protocol fields, rather than a file. Obfuscation makes data or code hard to understand, without hiding that it is there.

Correct answer: TPM

A TPM, or trusted platform module, is a chip bound to a system board that holds keys in hardware and stores the measurements a machine takes as it boots, which is precisely the per-endpoint function described. An HSM, or hardware security module, is a separate tamper-resistant appliance sized for enterprise key operations rather than a component of one laptop. A KMS, or key management system, is software that tracks key lifecycles across an estate and stores nothing on a motherboard. A TEE, or trusted execution environment, is an isolated region inside a processor for running sensitive code and does not supply boot measurements.

Correct answer: Hardware security module

A hardware security module is the dedicated, tamper-resistant appliance built for this workload: bulk cryptographic operations and centralized key custody for a whole organization, with private keys that never leave the device in the clear. A secure enclave processor isolates a small region inside one chip to protect one device's sensitive code. A software defined network abstracts routing and switching and performs no key custody. A virtual desktop platform delivers user sessions from a server and has nothing to do with cryptographic throughput.

Correct answer: Migrating to quantum resistant primitives

Migrating to quantum resistant primitives, such as the lattice-based algorithms NIST has standardized, replaces the factoring and discrete-log mathematics that Shor's algorithm breaks. Lengthened RSA modulus sizes only raise the cost slightly, because Shor's algorithm still factors them efficiently. Elliptic curve key exchanges rely on the discrete-log problem and fall to the same quantum attack. Quantum random key material improves randomness, but keys used with a breakable public-key algorithm remain breakable.

Correct answer: It breaks prebuilt hashing tables so attackers cannot reuse digests

A unique per-user salt makes every stored digest different even when two people pick the same password, so an attacker's prebuilt table of password-to-digest pairs, a rainbow table, matches nothing and would have to be rebuilt for every account separately. Repeating costly derivation rounds is key stretching, which slows an attacker but leaves one precomputed table covering every unsalted account. Demanding longer mixed passphrases raises the cost of guessing without changing how the stored value is formed. Blocking repeated failed logins limits online guessing and has no effect on an offline attack against a stolen hash file.

Correct answer: Adaptive identity, a routine security concept

Adaptive identity is the zero trust control-plane function that keeps re-evaluating context, including device health, geolocation, time and behavioral patterns, and raises or lowers what the user must satisfy as that context shifts inside a live session. The policy administrator establishes and tears down the session once a decision has already been reached, so it executes rather than weighs signals. Implicit trust is the assumption zero trust is built to remove, not a component that performs work. Threat intelligence supplies external indicators about adversaries and sits outside the access decision path.

Correct answer: Trojan, whose code sits within a wanted upgrade

A Trojan is malware wrapped inside something the victim wants to install, so the victim runs it themselves and grants it their own privileges. Rootkit is wrong because a rootkit's defining trait is concealment beneath the operating system once access already exists, not disguise at the point of delivery. Worm is wrong because a worm propagates on its own across the network and needs no user to launch it. Ransomware is wrong because it is named for what its payload does, encrypting files for extortion, not for how it reaches the host.

Correct answer: Volumetric DDoS, which saturates a slow core uplink

Volumetric DDoS, which saturates a slow core uplink, floods the target from many sources until bandwidth and resources run out and the system stops responding. MAC flooding also sends a flood of frames, but its goal is to make a switch fail open so traffic can be sniffed. A broadcast storm is a switching loop caused by misconfiguration, not a targeted attack. A fork bomb exhausts a host's process table locally and needs no network traffic at all.

Correct answer: To strike a software flaw the vendor has not spotted

A zero-day exploit targets a weakness the software vendor does not yet know about, so no patch or signature exists and defenders have had zero days to prepare. Restoring lost files from an offline backup is a recovery control used after an incident, not an attack technique. Ranking an asset by replacement cost belongs to business impact analysis and risk assessment. Rotating a shared key on a schedule is routine key management, which limits the damage of a compromised key rather than exploiting anything.

Correct answer: Tricking staff into giving up their own secrets

Social engineering means tricking staff into giving up their own secrets or taking actions they should not, using persuasion, authority, urgency or familiarity to exploit people rather than technology. Mining staff profiles on social media for recon is open-source intelligence gathering, which may prepare an attack but does not itself manipulate anyone. Monitoring staff to catch leaks of company data is a data loss prevention and insider-threat control run by defenders. Reviewing staff access to catch misuse of data is an access review or audit, also a defensive control rather than an attack on people.

Correct answer: MitM attack, which secretly relays entire messages

In a man-in-the-middle, or on-path, attack the attacker positions themselves between two communicating parties and passes messages along, so both sides believe they are talking directly while the attacker can read or modify everything in transit. A replay attack re-sends previously captured traffic later and does not sit in the live conversation. A downgrade attack pushes the parties onto weaker cryptography, which is a step toward interception rather than the interception itself. A dictionary attack guesses secrets from a word list and touches no live session.

Correct answer: SQL injection, which reaches the backend records

SQL injection, which reaches the backend records, is the attack in which client input is concatenated into a database statement so the attacker's text is parsed as part of the SQL query itself. LDAP injection also abuses unsanitised input, but it alters a directory search filter, not a SQL statement. Command injection passes input to an operating system shell rather than a database engine. Stored XSS may be saved in a database table, but the payload is script that runs in a victim's browser, and it never changes the meaning of a query.

Correct answer: Writing beyond a buffer into adjacent memory

A buffer overflow is writing beyond a buffer into adjacent memory: the program copies more data than the allocation holds, overwriting neighbouring values such as a return address. Reading past a heap buffer to leak key bytes is a buffer over-read, the Heartbleed class, which discloses memory without overwriting it. Reusing heap memory after a process freed it is a use-after-free flaw. Injecting code into another process's memory is process or DLL injection, which uses legitimate APIs rather than overrunning an allocation.

Correct answer: Baiting a user with faked mail for their credentials

Phishing means baiting a user with faked mail for their credentials: a fraudulent message impersonates a trusted sender and pushes the recipient to hand over a login or personal data. Phoning a user while posing as IT support is vishing, the voice channel rather than mail. Poisoning DNS so a user lands on a cloned login page is pharming, which redirects traffic without any lure message. Infecting a site that a user group visits is a watering hole attack, which waits for victims instead of mailing them.

Correct answer: Cross-site scripting, which runs in the browser

Cross-site scripting, which runs in the browser, is correct: a vulnerable web application delivers attacker-supplied script to other users, and it executes in their browsers under the site's origin. Cross-site request forgery abuses a user's logged-in session to send forged requests, but no attacker script runs in the page. Server-side request forgery makes the server itself fetch internal hosts. SQL injection rewrites the back-end database query and targets the server, not end users.

Correct answer: Replay, which re-sends a recorded user logon exchange

In a replay attack the attacker captures a legitimate authentication exchange and transmits it again later, so a system that accepts the repeated message treats the attacker as the original user; timestamps, sequence numbers and nonces exist to defeat exactly this. Smurf is wrong because it amplifies broadcast ICMP echo traffic to deny service, not to reuse a credential. Typosquatting is wrong because it registers look-alike domain names to catch mistyped visits. An evil twin is wrong because it impersonates a wireless network to attract new associations rather than repeating a captured transmission.

Correct answer: Phoning a target to extract secret PIN details

Vishing is voice phishing, so phoning a target to extract secret PIN details is the correct description: the attacker uses a voice call and a pretext to talk the victim out of sensitive data. Texting a fake bank alert is smishing, the SMS form of the attack. Porting a victim's phone number onto a new SIM is SIM swapping, which hijacks the number rather than deceiving anyone in a call. Sending a fake bank email is ordinary email phishing.

Correct answer: Zero-day attack, which lands before any fix exists

A zero-day attack, which lands before any fix exists, is the threat defined by exploiting a flaw before a patch or solution is available. An N-day exploit targets a flaw that is already publicly known and patched, hitting systems that have not yet applied the fix. A legacy exploit targets end-of-life systems that the vendor no longer supports, which is a support problem rather than a race against a pending patch. A supply chain attack hides malicious code inside a trusted vendor update.

Correct answer: A virus needs a human click; a worm moves alone

A virus needs a human click; a worm moves alone: a virus runs only when someone opens the infected file or program, while a worm copies itself across the network with no user action. Saying a worm needs a host file reverses the classic distinction, since it is the virus that attaches to a host file and the worm that is standalone. Tying viruses to email and worms to USB drives, or the reverse, confuses delivery channels with the defining propagation difference, since both can travel either way.

Correct answer: To poison a site the target group really trusts

In a watering hole attack the adversary cannot reach the intended victims directly, so it compromises a legitimate third-party site those victims are known to visit and waits for them to infect themselves. Flooding a link until it collapses is denial of service, aimed at availability rather than at a chosen group. Duplicating a badge is a physical access attack against an entry point. Cracking a passphrase hash from a rainbow table is an offline credential attack. Only the poisoned trusted site selects its victims by who visits it.

Correct answer: A crafted mail aimed at one named senior person

Spear phishing is targeted: the attacker researches a specific person, then sends a crafted mail aimed at one named senior person that only makes sense for that recipient. A cloned copy of a real mail the staff once got is clone phishing, defined by copying a legitimate message. A cloned login page linked in a fake text alert is smishing. A poisoned site that the target group frequents is a watering hole attack, which waits for victims instead of messaging them.

Correct answer: Botnet DDoS, which aims many hosts at one target

A botnet DDoS, which aims many hosts at one target, is the attack that uses multiple compromised systems to overwhelm a single victim. A reflected DoS bounces replies off third-party servers that are spoofed into responding, not compromised. A SYN flood swamps a target with half-open connections and can be launched from a single host. An amplified DoS abuses services that return large DNS responses to small queries, relying on innocent resolvers rather than a botnet.

Correct answer: Man-in-the-middle, which sits between two live peers

Man-in-the-middle, which sits between two live peers, is the attack that relays each message so both parties believe they are talking directly while the attacker reads or alters the traffic. A replay attack re-sends captured traffic later instead of relaying a live exchange. A session hijack takes over one side of a logged-in session, so the victim is cut out rather than fooled into talking through the attacker. Eavesdropping passively captures traffic and never relays or forwards any messages.

Correct answer: Encrypts your files for a ransom payment

Ransomware encrypts your files for a ransom payment, withholding the decryption key and often threatening to publish stolen copies until the victim pays. Mining cryptocurrency on a victim's CPU is cryptojacking, which uses the word crypto but locks nothing. Faking an infection to sell a cleanup is scareware. Stealing saved passwords for resale is an infostealer, which takes credentials without holding files hostage.

Correct answer: To keep hidden admin control of a target machine

A rootkit exists to keep hidden admin control of a target machine, hooking or replacing operating system components so its files, processes and connections stay invisible to administrators and security tools. Hiding inside a wanted app until a user runs it describes a Trojan. Opening a remote way in that bypasses the logins is a backdoor, which grants access but is not defined by kernel-level concealment. Quietly recording every key the user types is a keylogger.

Correct answer: A behaviour engine alert to odd host activity

Behaviour-based detection is what catches a zero-day, because a zero-day has no published signature by definition: detection has to come from what the code does rather than what it looks like, such as anomalous process creation, unexpected outbound connections, memory injection or privilege changes. A pattern scanner can only match malware it already knows and is blind to a new exploit. A packet filter enforces port rules and cannot judge behaviour. An isolated backup vault helps recovery after an incident but prevents nothing.

Correct answer: Brute force recovery

Brute force recovery is the attack that simply walks the entire key space, testing candidate keys one after another until the ciphertext decrypts to something meaningful; only key length makes it impractical. A rainbow table lookup reverses stored password hashes using precomputed chains, not cipher keys. Padding oracle abuse reads a server's padding error responses to peel off plaintext without ever guessing a key. Session token replay reuses a captured token and defeats no cipher at all.

Correct answer: An attacker sits between two peers to pass data

An attacker sits between two peers to pass data is the man-in-the-middle position: each party believes it is talking to the other while the attacker relays, reads and can alter the traffic. Recording traffic to resend later is a replay attack and needs no position in the live exchange. Tapping a link to decrypt captured traffic is passive eavesdropping followed by cryptanalysis, with nothing relayed. Hijacking a session takes over one side of it after login rather than sitting between both peers.

Correct answer: Software built to damage a computer or steal its data

Software built to damage a computer or steal its data is the accurate definition, because malware is defined by its malicious intent, whatever form it takes. Software that copies itself to spread over a network describes a worm, which is one type of malware, not the definition of the whole category. Software bundled into an installer to show pop-up ads is adware, a potentially unwanted program. Software used to scan or probe a network for flaws is a vulnerability scanner, a legitimate assessment tool.

Correct answer: Smishing tactics

Smishing is phishing delivered by text message: the lure arrives as an SMS and pushes the target to a link or a phone number to surrender credentials. Pharming does not send a message at all; it corrupts name resolution so a correctly typed address lands on the attacker's server. A whaling campaign targets a senior executive, usually by email, and this employee is not one. Vishing is carried out over a live voice call rather than in writing.

Correct answer: Vishing callbacks

A live phone call from someone impersonating the bank to extract account details is voice phishing, so vishing callbacks is the best description. Pretexting calls use an invented story, but pretexting names the fabricated scenario, not the voice channel the question emphasizes. Whaling phone calls target senior executives such as the CEO, not a finance manager. Spear phishing is a targeted message, normally email, rather than a live voice call.

Correct answer: Advanced persistent threat

An advanced persistent threat is defined by exactly this profile: a well-resourced adversary that gains a foothold, stays hidden for months, moves laterally, and steals data slowly enough to stay under detection thresholds. A ransomware outbreak announces itself immediately because encrypting files is the goal. Worm propagation is automatic and noisy, spreading as fast as the network allows. A logic bomb waits for a trigger and then fires once; it does not roam a network for months.

Correct answer: Spear phishing email

A spear phishing email is written for one named recipient, impersonates a real internal sender and cites genuine context such as a recent project so it survives scrutiny. A whaling attack email is spear phishing aimed specifically at a senior executive; here the target is an accounting employee, and it is the manager who is impersonated. A clone phishing email copies a legitimate message the victim already received and swaps in a malicious link or attachment, which the scenario does not describe. A pretexting attack email relies on an invented scenario to justify a request; the real project reference supports the lure, but the attack type defined by targeting one named person is spear phishing.

Correct answer: Whaling email lures

Whaling email lures are phishing aimed specifically at senior executives such as a CEO, often requesting confidential wire transfers. Spear phishing is personalized phishing against any chosen individual; whaling is the executive-targeted subset, and the stem classifies it by the target's seniority. Clone phishing resends a copy of a legitimate message with a malicious link swapped in. Impersonation describes the pretext used, not the classification that comes from targeting an executive.

Correct answer: Business email compromise

Business email compromise is the fraud in which an attacker impersonates a trusted counterparty over email to reroute legitimate payments, and vendor bank-detail changes are its most common form. Cache poisoning corrupts resolver records to misdirect traffic and sends no invoice instruction. Stored cross-site scripts run in a visitor's browser from a vulnerable page. Rainbow cracking reverses stolen password hashes and plays no part in redirecting a payment.

Correct answer: Pretexting cover story

Pretexting is the invention of a believable scenario and false identity that gives the attacker a reason to ask for what they want, and posing as an auditor with a detailed backstory is a standard version of it. Tailgating is following someone through a controlled door. Watering hole planting seeds malware on a site the targets already trust. Privilege escalation happens after access is obtained and describes gaining higher rights, not the story used to gain entry.

Correct answer: Keylogger implant

A keylogger implant records every keystroke the victim types and sends the log to the attacker, which explains how banking passwords were stolen without any malicious site being visited. A form-grabber module captures the contents of web forms as they are submitted in the browser, not every keystroke typed across the system. A screen-capture module takes images of the display, so it records what is shown rather than the keys pressed. A clipboard-logger module saves only text that is copied and pasted, so typed passwords never pass through it.

Correct answer: A spyware collector

A spyware collector is the best description because the utility covertly monitors browsing habits and transmits personal data to a third party without consent. An adware installer delivers unwanted advertisements; it may accompany spyware, but its defining trait is displaying ads, not harvesting data. A keystroke logger captures typed input such as passwords. A browser hijacker changes the home page or search settings to redirect the user rather than quietly reporting their habits.

Correct answer: Trusted insider misuse

This is trusted insider misuse: the employee already holds legitimate access and deliberately uses it for an unapproved purpose before leaving. A negligent insider leak is accidental exposure with no intent, whereas copying the list on the way to a competitor is deliberate. A shadow IT data leak comes from staff using unapproved services, not from abusing sanctioned access. Hacktivist data theft is driven by an outside actor's cause, not by a departing employee's personal gain.

Correct answer: Rootkit driver

A rootkit installs at the deepest privilege level available and hooks system calls so that its own files, processes and registry entries are filtered out of any answer the operating system gives; that is why ordinary scanners see nothing. An adware toolbar is visible by design and shows unwanted advertising. Trojan bundles hide inside software the user chose to install but do not subvert the kernel. Botnet beacons call home for orders and hide traffic, not the kernel.

Correct answer: Zero-day software flaw

A zero-day software flaw is being exploited while the vendor is still unaware of it, so no patch exists and signature-based defenses have nothing to match. An N-day exploited defect is attacked after public disclosure, when the vendor already knows and a fix usually exists. A known exploited defect, such as an entry in CISA's KEV catalog, is likewise already disclosed to the vendor. An embargoed software bug has been reported privately to the vendor under coordinated disclosure, so the vendor is aware.

Correct answer: A race-condition bug

A race condition of the time-of-check to time-of-use kind arises because the security decision and the action on the resource are separate operations, and anything that changes between them is not re-validated. A downgrade rollback forces a weaker protocol version during negotiation. A precomputed lookup reverses hashes from a prepared table. A memory-leak defect exhausts resources over time and involves no window between a check and its use.

Correct answer: Brute-force crack

Trying every possible combination until one works is a brute-force crack, which searches the entire keyspace and only length and lockout limits slow it. Credential stuffing replays username and password pairs leaked from another breach. A mask-based attack tries only combinations that fit a known pattern, such as a capital letter followed by six digits. A hybrid attack takes dictionary words and appends or substitutes characters, so neither covers every possible combination.

Correct answer: Dictionary attack

A dictionary attack draws from a prepared list of real words and previously leaked passwords, which succeeds quickly against human-chosen credentials while testing a tiny fraction of the possible combinations. Password spraying tries a few very common passwords against many accounts instead of many passwords against one. Pass-the-hash reuses a stolen hash without ever recovering the password. A rainbow-table hit reverses captured hashes offline rather than guessing at a login.

Correct answer: Rainbow table lookups, blocked by randomized salts

Precomputed hash-to-plaintext tables are the signature of rainbow table lookups, and a unique random salt per password defeats them because the attacker's tables were built for unsalted input and would have to be rebuilt for every salt. A dictionary attack guesses words live rather than reversing a stolen hash file. Credential stuffing replays credentials leaked from another site. Password spraying tries a few common passwords widely; none of those three uses precomputed tables.

Correct answer: SQL injection, stopped by bound query parameters

Placing database syntax into an input field so the server executes it is SQL injection, and bound query parameters fix it at the root by sending the statement and the data separately so user input can never become code. Cross-site scripting puts browser script into a page rather than commands into a database. ARP poisoning misdirects traffic on the local link. Cross-site request forgery rides a victim's existing session; none of those three is a database command.

Correct answer: Stored cross-site scripting

Stored cross-site scripting saves the attacker's script in the vulnerable page itself, so it executes in the browser of every later visitor and can steal their session cookies. Reflected cross-site scripting echoes the script back from a crafted request, so it only runs for a victim who clicks that specific link rather than for other visitors of the page. DOM-based cross-site scripting is triggered by client-side code processing attacker-controlled input such as a URL fragment, again requiring the victim to load a crafted link. Cross-site request forgery makes a logged-in victim's browser send an unwanted request to a site; it rides the session rather than injecting script to steal cookies.

Correct answer: A typosquatting lure

The attacker is relying on a typosquatting lure: registering a near-miss spelling of a popular domain so users who slip on the keyboard land on the fake page. A homograph spoof uses lookalike Unicode characters in a link the victim clicks, not a typing mistake. DNS pharming poisons resolution so the correct name leads to a fake site. DNS hijacking seizes control of the real domain's registration or resolver instead of registering a new name.

Correct answer: DNS record poisoning

Corrupting the entries a resolver has cached is DNS poisoning: the resolver hands out the attacker's address for a legitimate name, so the victim's browser goes to the wrong server while the address bar still looks correct. ARP spoofing works at the local link layer using hardware addresses. A cipher downgrade forces weaker negotiated protection. SSL stripping removes the upgrade to an encrypted session; none of those three rewrites cached name records.

Correct answer: A logic bomb

A logic bomb is code that sits inert until a defined condition, such as a date or an account deletion, is met, and only then fires its payload. A Trojan horse is defined by disguising itself as wanted software, not by a trigger. A wiper describes a destructive payload, but the defining feature here is the dormant conditional trigger. A backdoor waits for an attacker to connect and grants access rather than deleting files on a condition.

Correct answer: Bloatware

Bloatware is the pile of unrequested applications a manufacturer preloads: it consumes storage, memory and battery and adds code that must be patched, widening the attack surface. Shadow IT is hardware or software that staff adopt without approval, not something the device ships with. Sideloading is a user installing apps from outside the official store. Insecure defaults are weak factory settings such as open services or default passwords, rather than a collection of preinstalled apps.

Correct answer: It occupies volatile memory and abuses approved binaries

Fileless malware never drops an executable on disk: it lives in memory and does its work through binaries the operating system already trusts, such as PowerShell or WMI, so a scanner looking for a malicious file finds nothing to match. Encrypting stored volumes and demanding anonymous payment describes ransomware. Hooking internal routines to conceal active processes describes a rootkit. Saturating adjacent subnets while generating fresh copies describes a worm.

Correct answer: Supply chain attack

A supply chain attack compromises a trusted supplier so malicious code reaches customers through a channel they already trust, such as a poisoned vendor update. A watering hole attack compromises a website the targets visit, not a vendor's build. An on-path attack tampers with traffic in transit, whereas this code was inserted before distribution. A code injection attack feeds malicious input to a running application rather than subverting the vendor's release.

Correct answer: Race condition

This is a race condition, specifically a time-of-check to time-of-use flaw: the resource is validated in one step and used in another, and an attacker who alters it in between gets the benefit of a check that no longer describes reality. Path traversal abuses unsanitized file paths to escape the intended directory. Stack smashing overruns a buffer in order to overwrite a saved return address. Type confusion makes code treat an object as a type it is not.

Correct answer: Memory injection

Memory injection is the vulnerability category for writing code into the address space of a live process and then executing it, which lets the attacker seize the program's control flow from inside a trusted process. Code obfuscation hides the meaning of code from an analyst; it does not place code inside another running process. Cookie poisoning alters session data held in the browser, so it never touches process memory. Domain shadowing creates hidden subdomain records under a hijacked DNS account, which is a name-resolution abuse rather than an in-process execution flaw.

Correct answer: Side-channel analysis

Side-channel analysis recovers a secret by measuring what the hardware leaks while it computes - power draw, electromagnetic emission or elapsed time - so the mathematics of the cipher is never attacked at all. Firmware implantation writes attacker code into a device's boot image, which changes the device rather than measuring it. Credential harvesting collects passwords from users or stores and yields no information about key material inside a chip. Directory enumeration lists accounts and objects in a directory service and reveals nothing about physical emissions.

Correct answer: Security misconfiguration

Security misconfiguration is the weakness introduced when a system is deployed with its factory administrative account intact and services running that nobody needs, because the settings - not the code - create the exposure. Certificate mismanagement covers expired, untracked or wrongly issued certificates, none of which is implied by unused services being enabled. Insufficient segmentation describes flat networking that lets an intrusion spread, which is a containment failure after compromise. Continuous authentication is a control that re-verifies a session over time, so it names a defence rather than the weakness the server carries.

Correct answer: Jailbreaking

Jailbreaking removes the manufacturer's software restrictions on a smartphone, typically an iPhone, so unsigned and unauthorized applications can run, widening malware exposure. Unknown sources is an Android setting the vendor provides for installing apps from outside the official store; turning it on uses the platform's own controls rather than removing them. USB debugging is a built-in developer option that lets a connected computer issue commands while the platform's protections stay in place. Shadow IT is staff using unsanctioned apps or services without approval, an organizational problem rather than a change to the device's operating system.

Correct answer: Bluejacking

Bluejacking is the nuisance technique of pushing unrequested messages to Bluetooth devices that are in range and discoverable; nothing is read from the target and nothing is controlled. Sideloading installs an application from outside the official store, which is a software-distribution problem rather than a radio-range message push. Bluebugging goes much further by taking command of the handset's functions over Bluetooth, so it is control rather than messaging. Obfuscation makes code or data hard to interpret and is not a way of contacting nearby devices.

Correct answer: Bluesnarfing

Bluesnarfing is the unauthorized pull of stored data such as contacts, messages and files from a Bluetooth device, so data theft over the radio link is its defining feature. Bluejacking sends unsolicited messages to nearby Bluetooth devices and copies nothing off them. Bluesmacking floods a Bluetooth device with oversized packets to knock it offline, a denial-of-service attack rather than theft. An evil twin is a rogue Wi-Fi access point that imitates a legitimate network, which is a wireless LAN attack, not a Bluetooth one.

Correct answer: Password spraying

Password spraying tries one or a few common passwords against many accounts, so each account sees too few failures to hit its lockout threshold. Password cracking recovers plaintext from stolen hashes offline and never touches a live login. A dictionary attack runs a long wordlist against one account and trips lockout quickly. A credential stuffing attack replays username and password pairs leaked from another breach rather than guessing common passwords.

Correct answer: Offline attacks crack captured hashes, while online attacks probe live endpoints

An offline attack works on password hashes the attacker has already captured, running on equipment the attacker owns, so there is no lockout counter and no defender watching; an online attack submits each guess to the running authentication service, where rate limits, lockout policy and alerting all apply. Session cookies belong to an already authenticated user and are needed by neither form of guessing. Neither form recovers symmetric or public key material; both target the secret a user chose. And neither switches off audit alerting or lockout policy - the offline case simply never reaches the system where those controls live.

Correct answer: MAC flooding

MAC flooding sends a switch so many forged source addresses that its address table overflows, after which the switch fails open and broadcasts frames out of every port for the attacker to capture. MAC spoofing forges a single address to impersonate one device and does not exhaust the table. ARP cache poisoning corrupts hosts' IP-to-MAC mappings to redirect traffic through the attacker, not through a broadcasting switch. DNS cache poisoning plants false name records in a resolver and has nothing to do with the switch's address table.

Correct answer: ARP poisoning

ARP poisoning sends forged ARP replies so the attacker's MAC address is cached against the gateway's IP address, putting the attacker on the path of victims' traffic. ARP flooding overwhelms hosts or a switch with a volume of ARP traffic rather than planting a false mapping. MAC flooding fills a switch's CAM table so it floods frames out of every port. MAC address spoofing changes the attacker's own hardware address to impersonate another device, which alone does not rebind the gateway's IP in victims' caches.

Correct answer: DNS amplification

DNS amplification sends small queries carrying the victim's spoofed source address to open resolvers, so the much larger responses all land on the victim and exhaust its bandwidth. DNS cache poisoning plants false records in a resolver to redirect users, not to flood anyone. DNS cache snooping probes a resolver's cache to learn which domains its users visited, which is reconnaissance. A DNS query flood overwhelms a DNS server with direct queries and relies on no spoofed source or larger reply.

Correct answer: Application-layer flood

An application-layer flood aims a modest number of well-formed requests at the costly parts of a web application - search, login, report generation - so the server exhausts its own processing and database capacity while the raw traffic volume stays unremarkable. Bandwidth amplification depends on multiplying response size to saturate a link, which is the volumetric behaviour the question excludes. Infrastructure flooding overwhelms lower-layer devices and circuits, again through sheer volume. Reconnaissance scanning maps hosts and services before an attack and is not a denial-of-service method.

Correct answer: Impossible travel

Impossible travel is the indicator raised when one identity authenticates from two places no person could move between in the elapsed time, here New York and Tokyo twelve minutes apart. An anonymous IP address flags a sign-in through a VPN, proxy or Tor exit, which says nothing about the time between locations. Leaked credentials flags a password found in a breach dump, not two logins. An unfamiliar location flags a single sign-in from somewhere new; it is the twelve-minute gap, not the novelty of Tokyo, that makes this impossible travel.

Correct answer: Resource consumption

Resource consumption is the indicator of compromise in which processor, memory, storage or bandwidth is heavily used with no authorised workload to account for it, the pattern left by mining software or another unsanctioned process. Out-of-cycle logging describes log entries appearing at times that do not match the scheduled activity, which is a timing signal rather than a utilisation signal. Unexplained lockouts follow failed authentication against user accounts and appear in identity records, not in utilisation graphs. Certificate spoofing presents a fraudulent certificate to a client and surfaces as a trust error, leaving processor and memory untouched.

Correct answer: Brute-force attack

A brute-force attack is indicated when repeated failed logins lock out many users, because the attacker keeps guessing against each account until the lockout threshold trips. Password spraying is wrong because it tries one common password across many accounts precisely to stay under lockout thresholds. Credential stuffing is wrong because it replays username and password pairs leaked elsewhere, producing few failures per account. A rainbow table is wrong because it cracks stolen hashes offline on the attacker's own machine, so no login attempt or lockout is ever recorded.

Correct answer: Hardening

Hardening is the mitigation that shrinks the attack surface by turning off services nobody needs, closing unused ports and deleting default accounts, so fewer entry points exist. Patching fixes known flaws in software that stays installed and removes nothing. Allow listing limits which applications may execute but leaves listening services, open ports and default accounts in place. Segmentation divides the network to contain traffic between zones rather than reducing what each system itself exposes.

Correct answer: Segmentation

Segmentation divides a network into separate zones with controlled paths between them, so a compromise in one zone cannot easily spread to the others. Quarantining moves a single suspect host or file away from everything else after it is flagged, rather than designing the whole network into zones. Containment is the incident response phase that limits an active incident, not a standing network design. Air gapping disconnects a system from all networks entirely, which removes connectivity instead of dividing a network into zones that still communicate.

Correct answer: Patch management

Patch management is the mitigation that applies vendor-released fixes to known vulnerabilities on a timely, managed schedule. Change management is wrong because it governs approval and rollback for any change, including patches, but does not itself obtain or apply fixes. A change advisory board is wrong because it is the group that reviews and approves proposed changes. Vulnerability scanning is wrong because it finds and reports known vulnerabilities, detecting the exposure without remediating it.

Correct answer: Encryption

Encryption keeps stored data unreadable to anyone without the key, so stolen drives or backup tapes expose nothing useful while the owner can still decrypt and use the data. Data masking hides values from users who view a display or a non-production copy, but the production data and its backups still hold the real values. Segmentation separates networks and systems to limit access, which offers no protection once the media itself is carried away. Sanitization wipes media at disposal, so it protects retired drives, not media in use that is stolen.

Correct answer: Monitoring

Monitoring is the mitigation technique of continuously collecting and analyzing logs and other telemetry so that threats are detected as they occur. Threat hunting is a proactive, analyst-led search for hidden attackers based on a hypothesis, run periodically rather than as continuous log collection. Hardening reduces the attack surface by removing services and tightening configuration, which prevents rather than detects. Isolation moves a compromised or risky system away from the rest of the environment, which contains a threat after it is found.

Correct answer: Configuration enforcement

Configuration enforcement is the mitigation in which tooling compares each system against an approved secure baseline and puts back any setting that has drifted, so the estate is corrected automatically rather than by hand. Enterprise authentication describes how users prove identity to the network and leaves system settings untouched. Microservice architecture is a way of decomposing an application into small services and says nothing about baseline compliance. Infrastructure monitoring reports the deviation once it appears but takes no corrective action of its own.

Correct answer: Asset decommissioning

Asset decommissioning is the mitigation activity that retires equipment and, as part of it, wipes, degausses or destroys data-bearing media so no residual data leaves with the hardware. A data retention policy sets how long records are kept but is not the retirement process for hardware. Data loss prevention monitors and blocks sensitive data leaving through live channels. Change management approves and records changes, but it does not itself sanitize retired media.

Correct answer: Privilege escalation

Privilege escalation is abusing a flaw or weak setting to gain rights beyond those granted, such as a standard user becoming an administrator. Lateral movement pivots from one host to another, usually at the same privilege level. A pass-the-ticket attack replays a stolen Kerberos ticket, and a pass-the-hash attack reuses a stolen credential hash; both authenticate as an existing account rather than exploiting a flaw to raise the rights of the current account.

Correct answer: Credential stuffing

Credential stuffing replays complete username and password pairs taken from one breach against unrelated services, and it succeeds because people reuse the same pair in several places. Directory traversal walks outside a web application's intended path to read files it should not serve, which requires no stolen credentials. Token impersonation reuses an access token already present on a compromised host, so no login pair is submitted anywhere. Volumetric flooding saturates a link with traffic and never attempts authentication at all.

Correct answer: Evil twin

An evil twin is a rogue access point that copies a legitimate network's SSID so users connect to it instead of the real one. A Karma attack answers whatever SSIDs clients probe for from their saved lists rather than cloning one corporate SSID. Pharming redirects users to a fake site by poisoning DNS or hosts files, not with a wireless access point. Disassociation knocks clients off a network and is often paired with an evil twin but impersonates nothing.

Correct answer: Jamming

Deliberately transmitting radio interference to drown out a wireless channel is jamming, a physical-layer attack on availability. Beacon flooding sends thousands of fake network advertisements in valid 802.11 frames rather than raw noise. CTS flooding abuses clear-to-send control frames so stations defer transmitting, again using protocol frames, not interference. An evil twin is a rogue access point that impersonates a real network to intercept traffic rather than take it down.

Correct answer: Vulnerable components

Vulnerable components is the weakness an application inherits when it ships with third-party libraries that carry publicly documented defects, because the flaw arrives with the dependency rather than with the code the team wrote. Hardcoded credentials are secrets embedded in source or firmware, which is a separate defect that no dependency update creates. Outdated cryptography means weak algorithms or key sizes remain in use and would apply even to code with no external libraries. Unencrypted transport exposes data on the wire and is a protocol choice, not a dependency problem.

Correct answer: Birthday attack

A birthday attack uses the probability result behind the birthday problem to find two distinct inputs that hash to one digest far sooner than the digest length suggests, which is why it targets the collision resistance of a hash. Fault injection disturbs a device with voltage or clock glitches to make it compute incorrectly, so it attacks the hardware rather than the hash mathematics. Banner grabbing reads the version strings a service advertises and is a reconnaissance step. A buffer overflow writes past an allocated region in memory and has no connection to digest collisions.

Correct answer: Downgrade attack

A downgrade attack interferes with the handshake so both ends settle on an older protocol version or weaker cipher suite the attacker can then break. A replay attack resends captured valid traffic rather than changing what is negotiated. A birthday attack exploits hash collision probability, not protocol negotiation. A brute-force attack tries keys or passwords exhaustively, which a downgrade may make feasible but which is not the act of forcing the weaker choice.

Correct answer: Pass-the-hash

Pass-the-hash submits a captured password hash straight to the authentication protocol, so the attacker reaches other systems without ever recovering the plaintext secret. Typosquatting registers misspelled domain names to catch mistyped traffic and involves no credential material. Kerberoasting requests service tickets and then cracks them offline, which is the very recovery of the plaintext that this technique avoids. Steganography conceals a message inside an innocuous file and is a hiding method with no authentication role.

Correct answer: Unintentional insider

An unintentional insider is a trusted employee or partner who is manipulated or coerced into helping an attacker while unaware of the harm, so access is abused without intent. A malicious insider deliberately misuses access for personal gain or revenge. A colluding insider knowingly cooperates with an outside attacker. A disgruntled contractor acts out of a grievance against the organization, which also involves intent and awareness of the damage being done.

Correct answer: Lateral movement

Lateral movement is the stage in which an intruder who already holds one host reuses harvested credentials to reach further systems and widen the foothold inside the perimeter. Domain shadowing adds concealed records beneath a hijacked domain to support external infrastructure, which happens outside the victim network. Packet capturing records traffic for later analysis and gains no additional systems. Code obfuscation makes a payload harder for an analyst or scanner to read, so it protects the tooling rather than extending access.

Correct answer: Vulnerable embedded device

A vulnerable embedded device is the weakness here: the thermostat's credentials are hardcoded and its software cannot be patched by design, so the flaw is permanent and built into the device itself. Unsupported legacy firmware describes code the vendor has stopped maintaining, not a device that was never patchable. An insecure default configuration can be changed by the owner, whereas hardcoded credentials cannot. A firmware supply chain risk concerns tampered or compromised components introduced before delivery, which the stem does not describe.

Correct answer: ARP cache poisoning

ARP cache poisoning floods the segment with falsified address-resolution replies so hosts store the attacker's hardware address against the gateway's network address and send their traffic to the attacker first. A supply chain attack compromises a supplier's product before delivery and needs no presence on the victim's local segment. Stolen token replay reuses a captured session token to impersonate a user at the application layer. Rogue DHCP spoofing hands out false addressing configuration to clients as they join, which subverts leases rather than the address cache.

Correct answer: Evil twin

An evil twin is a rogue access point advertising the same SSID as the corporate network so staff connect to the attacker's radio and expose their traffic. MAC spoofing forges a device's hardware address to bypass filtering or impersonate a client; it does not broadcast a lookalike network. A WPS attack brute-forces the Wi-Fi Protected Setup PIN on an existing router to recover its passphrase. An IV attack exploits reused initialization vectors to crack WEP keys rather than luring users to a fake access point.

Correct answer: Password spraying

Password spraying tries one likely password once against many accounts, spreading the failures so thinly that no single account reaches its lockout threshold. Credential stuffing replays username and password pairs leaked from another breach, each pair tried against its own account rather than one common password across hundreds. Password cracking recovers plaintext from captured hashes offline and never submits logins. Brute-force cracking tries every possible combination, whether offline against hashes or online against one account, where it would trip the lockout the attacker is avoiding.

Correct answer: Logic bomb

Code planted inside an application that waits for a condition, here the author's removal from payroll, and then deletes files is a logic bomb. A time bomb is the variant that fires on a specific date or time, while this trigger is an event rather than a clock. A fork bomb replicates processes until the host's resources run out and has no dormant trigger. A decompression bomb is an archive that expands to exhaust storage when opened.

Correct answer: Fileless malware

Fileless malware runs in memory and drives trusted built-in tools such as PowerShell, so no executable is written to disk for a signature engine to match. Polymorphic malware also evades signatures, but it does so by mutating a file on disk rather than avoiding disk altogether. A firmware rootkit persists by rewriting device or boot firmware, which is stored code rather than memory-only activity. A kernel rootkit hides by modifying the operating system, which requires installing a driver or module on the host.

Correct answer: Supply chain attack, corrupted upstream packaging

A supply chain attack subverts something the victim already trusts - the vendor, the build system or the update channel - so signed malicious code is delivered by the legitimate distribution path to every downstream customer at once. A watering hole compromises a third-party site the targets happen to browse, so it reaches only visitors of that site and never rides the vendor's own signature. Password spraying tries a few common secrets against many accounts and gains nothing from vendor trust. Session hijacking steals an already authenticated token from a live user and affects only that session.

Correct answer: Privilege escalation, vertical entitlement widening

Privilege escalation is the vertical step: the attacker already holds a foothold and abuses a flaw or a misconfigured service to run with higher rights on that same machine. Lateral movement is the horizontal step to a different host and does not change the rights held. Credential stuffing replays passwords exposed in someone else's breach against other sites, which is an access technique rather than a rights change. Installing a backdoor keeps the access already obtained across reboots but grants no additional rights.

Correct answer: Directory traversal, relative pathname climbing

Directory traversal abuses a parameter that is used to build a file path: relative sequences such as ../ walk the attacker up and out of the intended directory so files elsewhere on the disk can be read. Command injection appends shell metacharacters so the server executes an extra operating system command; no path is walked. Cross-site scripting delivers markup that runs in another user's browser and never reaches the server file system. A buffer overflow writes past the end of an allocation and corrupts adjacent memory instead of resolving a path.

Correct answer: Cross-site request forgery, unauthorized state changing

Cross-site request forgery works because the browser attaches the victim's existing session automatically: a crafted link or form causes that browser to send a state-changing request, such as a transfer, which the site accepts as genuine. Clickjacking layers an invisible frame over a page so the victim clicks a control they cannot see, which requires the victim to act on the real interface. Session fixation plants an identifier the attacker already knows before the victim signs in, so the attacker rides the session rather than the victim's own request. An open redirect merely bounces a visitor to an unvalidated destination and changes no state on the trusted site.

Correct answer: Bloatware, superfluous preloaded vendor software

The answer is bloatware, superfluous preloaded vendor software: the extra programs on a new machine, trial applications and utilities the user never requested that consume resources and widen the attack surface without being written to harm the owner. Adware is software built to display or inject advertisements; some preinstalled packages have included it, but the term names the advertising behaviour, not unrequested trial programs as a group. Spyware covertly gathers data about the user's activity and sends it elsewhere, which is surveillance rather than commercial clutter. A rootkit hides itself with privileged, often kernel-level access to conceal malicious activity, which is deliberate stealth rather than visible trial software.

Correct answer: Downgrade attack, constrained fallback cipher selection

Forcing both sides to fall back from TLS 1.3 to SSL 3.0 is a downgrade attack, constrained fallback cipher selection: the attacker tampers with version negotiation so a weak, exploitable protocol is chosen. An SSL stripping attack removes encryption entirely by rewriting HTTPS links to plain HTTP rather than negotiating an older protocol version. An on-path attack is the position an attacker needs to intercept traffic, not the specific act of forcing an older version. A replay attack resends captured messages later and does not change the negotiated protocol.

Correct answer: End-of-life legacy platform, terminated maintenance lifecycle

The answer is end-of-life legacy platform, terminated maintenance lifecycle: once the vendor ends support, no patch will ever arrive for a newly found flaw, so every new weakness is permanent. End-of-sale only stops new purchases while security patches keep shipping. An unpatched known vulnerability has a released fix the owner has deferred, but here no fix exists. A zero-day is unpatched only until the vendor learns of it and ships a fix, which an unsupported product never receives.

Correct answer: Unchanged default credentials, provided administrative login

The device still accepts the manufacturer's admin/admin pair because no one replaced it at deployment, which is unchanged default credentials, provided administrative login. Hardcoded vendor credentials are embedded in code and cannot be changed by the owner, whereas these could have been. Weak password complexity describes a policy that allows short guessable passwords, but the problem here is that the vendor's published login was never replaced. Unpatched vendor firmware is a missing update and says nothing about the login itself.

Correct answer: Nation-state persistent threat, sustained covert sponsorship

A nation-state persistent threat, backed by sustained covert sponsorship, has government funding, custom tooling and strategic goals pursued quietly over years, which matches both the attribution and the behavior described. Competitive espionage is carried out by a rival company for market advantage, and it is not what the analyst attributed. A state-aligned hacktivist wants publicity for a political cause, so its protests are loud rather than stealthy. Organized crime, even when a nation tolerates it, is driven by money and monetizes access quickly through extortion rather than holding it for strategic intelligence.

Correct answer: System hardening, shrinking configuration footprint

Hardening is the work of making one host present as little as possible: uninstall what is not needed, switch off services and listening ports, and apply the secure baseline so the remaining configuration is deliberate. Segmentation changes where a host sits on the network and limits what can reach it, but the host itself still runs everything it did before. Sandboxing confines a single untrusted process inside a restricted execution environment rather than trimming the platform. Least privilege limits what accounts may do once they are on the system and leaves the installed software untouched.

Correct answer: Weaponized USB peripheral, forged input controller

The victim plugged in a cable that announces itself as a keyboard, types commands and copies data out, which is a weaponized USB peripheral, forged input controller, the removable-device vector. A rogue wired network with sniffed USB tethering only watches network traffic the phone shares, and it injects no keystrokes. Bluesnarfing pulls files over a Bluetooth pairing, with no cable involved at all. A supply chain implant is spyware loaded into the phone before it ever reaches the owner, not hardware the owner picks up at a charging station.

Correct answer: Watering hole attack, a common technique

A watering hole attack, a common technique against well-defended targets, compromises a legitimate site the intended victims are known to visit and infects them when they browse it. Spear phishing is also targeted, but it reaches victims through crafted messages rather than a site they already visit. Malvertising delivers malware through ads served across many sites, not by compromising one niche site chosen for its audience. A supply chain attack compromises a vendor's product or service that the target installs or uses, not a news site its staff read.

Correct answer: Dependency confusion, a known tactic

Dependency confusion exploits a build tool that resolves package names against a public registry when an identically named internal package cannot be found privately, so an attacker who registers that name publicly gets code executed inside the build pipeline. Command injection passes shell metacharacters into an application that hands input to the operating system. Directory traversal walks outside the intended path to read files the application never meant to expose. A buffer overflow writes past the end of an allocation to corrupt adjacent memory, and none of these three involves how a package name is resolved.

Correct answer: Man-in-the-browser attack, a known method

A man-in-the-browser attack places malware inside the browser process itself, so it reads and rewrites transactions after the transport encryption has already been unwrapped and after the user has authenticated, which is exactly why an HTTPS session offers no protection against it. A downgrade attack forces a weaker protocol version or cipher suite during negotiation. A replay attack re-sends captured traffic to make an action happen a second time. A typosquatting attack registers misspelled domain names to catch users who mistype an address.

Correct answer: To inspect the HTTP traffic headed to a live server

A WAF exists to inspect the HTTP traffic headed to a live server, blocking injection, cross-site scripting and similar web attacks. Filtering packets by port and address at the edge is a network or stateful firewall, which cannot read application content. Filtering the web pages staff browse out to is a forward proxy or URL filter protecting users, not a web server. Scanning a web app's source code before release is static application security testing, which happens in development rather than on live traffic.

Correct answer: To block known attack traffic as it flows past

An IPS sits inline and its main function is to block known attack traffic as it flows past, dropping or resetting matching sessions itself. Logging suspect packets copied from a SPAN port is passive capture, and paging analysts about suspect packets is what an IDS does; neither stops anything. Passing traffic whose port is on an allow list is basic firewall filtering by port, not signature-based attack prevention.

Correct answer: To fold several security tools into a single box

Unified threat management puts firewalling, intrusion prevention, gateway antivirus, web and content filtering, and often VPN termination into one appliance with a single management interface, which is why smaller sites adopt it instead of buying and operating separate devices. Keeping an offline copy of data is backup. Delivering an address to each machine on request is DHCP. Time-stamping a receipt so its place is provable is a non-repudiation control. None of those three consolidates multiple security functions.

Correct answer: Interception proxy, which breaks the TLS session

To read encrypted traffic at the perimeter the device must break the tunnel: the proxy terminates the client's TLS session using a certificate the endpoints already trust, inspects the plaintext, then opens its own TLS session onward to the real server. A load balancer distributes work for capacity and may terminate TLS, but it exists to spread load rather than to inspect content for threats. A syslog server stores records that devices send it and never touches the traffic itself. A jump host screens administrative access to internal systems and inspects nothing.

Correct answer: To apply one policy set across many cloud apps

A cloud access security broker sits between users and the cloud services they use, so the organisation's own rules on authentication, data handling, sharing and shadow IT are enforced consistently on services it does not own or operate. Spinning up more compute when new demand climbs is autoscaling. Holding master keys inside a secure module is what an HSM does. Charging each team for what it consumes is cloud cost management. None of those three enforces security policy between users and cloud applications.

Correct answer: To admit a laptop after a fast health check

Network access control evaluates a device as it joins, checking identity and health such as patch level, antivirus state and configuration, then grants full access, places it in a remediation segment or refuses it, according to policy. Leasing a fresh address to each new device is DHCP. Sending voice frames ahead of bulk data is quality of service. Keeping a warm standby ready is high availability. None of those three decides whether a device may join the network.

Correct answer: To add threat rules to a stateful packet filter

A next-generation firewall keeps stateful packet filtering and adds integrated intrusion prevention, application awareness and identity awareness, so one policy can allow a named application for a named group while still inspecting that traffic for exploits. Preserving a signed copy of each audit journal is an integrity control. Replacing a failed uplink with a spare circuit is redundancy. Scanning a mailbox for unwanted bulk advertising is a mail gateway function. None of those three combines intrusion prevention with firewall filtering.

Correct answer: Alerting analysts about traffic matching a known attack signature

An IDS is a passive sensor whose main function is alerting analysts about traffic matching a known attack signature or a behavioral anomaly. Alerting on outbound files with a sensitive data label is data loss prevention, which guards against exfiltration rather than detecting intrusions. Flagging inbound mail that fails the sender SPF record is an email security gateway check. Reporting hosts lacking critical patches is a vulnerability scanner's job, which finds weaknesses instead of watching for attacks.

Correct answer: WPA2

WPA2 is the Wi-Fi Alliance security standard that authenticates and encrypts a wireless network, using CCMP with AES, and it is what a wireless deployment relies on to protect traffic over the air. TKIP is the older encryption protocol from the original WPA, now deprecated, and it is a component rather than the network security technology. WPS is a convenience setup feature that pairs devices with a PIN or button and is itself a known weakness. RADIUS is an AAA protocol that WPA2-Enterprise can call for authentication, but it is not what secures the wireless link.

Correct answer: Placing public facing services outside the trusted internal perimeter

A DMZ is a screened segment between the untrusted internet and the internal LAN, so anything the outside world must reach lives there instead of on the internal network and a compromise of one of those hosts does not put the attacker inside. Encrypting a flow between two sites is a site-to-site VPN, which protects data in flight and creates no trust boundary. Keeping synchronized copies at a recovery facility is a backup and continuity control that restores service after a loss rather than limiting exposure. A DMZ is deliberately the least trusted zone in the architecture, which is exactly why regulated records belong on hardened internal storage and never in it.

Correct answer: Watching mirrored traffic to raise alerts about probable breaches

The primary function of a NIDS is watching mirrored traffic to raise alerts about probable breaches: it is passive and detects rather than blocks. Dropping inline packets to stop suspected attacks is what an IPS does, because it sits in the traffic path and can intervene. Checking host log files and critical system files is a host-based IDS or file-integrity function, not a network sensor. Collecting flow records to report bandwidth use is NetFlow monitoring, which measures traffic volume rather than inspecting it for intrusions.

Correct answer: Poor separation of stored records between neighboring tenants

Multi-tenancy means several customers run on one shared pool of compute, storage and network, so the control that matters most is the boundary that stops one tenant reading, writing or inferring another tenant's data, enforced by the provider's hypervisor, storage layer and identity model. Charges for moving data out of a provider are a cost-model issue that exists on dedicated hosting too. Unpatched middleware in a guest is a genuine risk but it is the tenant's own vulnerability-management failure and it looks identical on single-tenant infrastructure. Expired certificates break trust in one management interface and are answered by certificate lifecycle management, which does nothing about tenant separation.

Correct answer: Creating guest machines from pooled physical host resources

A hypervisor owns the physical processor, memory, storage and network and hands each guest a virtual slice of them, creating, scheduling and isolating virtual machines; that mediation is the reason a compromise inside one guest does not automatically reach another. Scanning documents for current malware signatures is antimalware work carried out inside a guest or on a file server, above the virtualization layer. Encrypting replicated snapshot images protects a virtual machine at rest, a storage control applied to the hypervisor's output rather than a function of the hypervisor itself. Distributing storage requests across disk pools is a storage controller's job and creates no guests.

Correct answer: Inspecting inbound HTTP requests to block injection style attacks

The primary function of a WAF is inspecting inbound HTTP requests to block injection style attacks such as SQL injection and cross-site scripting aimed at a web application. Comparing IP packets with signatures to block known exploits describes a network intrusion prevention system, which works across protocols rather than parsing application requests. Filtering outbound web requests to block known malicious websites is the job of a forward proxy or URL filter protecting users, not the application. Scanning outbound network traffic to stop sensitive files leaking is data loss prevention.

Correct answer: Enforcing company policy on traffic bound for outside hosted services

Enforcing company policy on traffic bound for outside hosted services is the core purpose of a CASB, which sits between users and cloud providers to give visibility into sanctioned and shadow cloud use and apply access and data-protection rules. Filtering inbound web requests that target the firm's public web apps is a web application firewall. Filtering outbound browsing by URL category and malware is a secure web gateway. Granting remote users per-application access to private internal apps is zero trust network access.

Correct answer: Protecting data in transit using freshly negotiated session keys

Protecting data in transit using freshly negotiated session keys is the job of TLS: the handshake authenticates the server by certificate and agrees a symmetric session key that encrypts and integrity-protects each record. Encrypting every IP packet at the network layer between gateways describes IPsec, not a transport-layer session. Encrypting stored files at rest inside secure hardware modules is data-at-rest protection. Signing every email message with a sender certificate is S/MIME, which protects the message rather than the connection.

Correct answer: Isolating a bundled application from nearby workloads on one host

Containerization exists for isolating a bundled application from nearby workloads on one host: the app ships with its libraries and runs under namespaces and control groups that limit what a compromise can reach. Running a full guest operating system upon one bare-metal server describes a virtual machine on a hypervisor, not a container sharing the host kernel. Detonating a suspect file inside a disposable guest is sandboxing for malware analysis. Separating tenants into virtual networks is network segmentation, which isolates traffic rather than packaged application processes.

Correct answer: Splitting one switched fabric into separate logical broadcast domains

A VLAN divides one physical switch infrastructure into several independent broadcast domains, so ports in different VLANs cannot reach each other at layer 2 and traffic between them must pass a router or firewall where policy can be applied; the grouping follows function rather than cabling. Bonding links to raise available speed between two switches is link aggregation, a bandwidth measure that leaves every port in the same broadcast domain. Encrypting traffic on a tagged link is MACsec, which protects a link against eavesdropping without dividing it. Mirroring copies of packets to a sensor is a SPAN or tap configuration, which feeds monitoring tools and moves no forwarding boundary.

Correct answer: Spotting hostile attempts and blocking them inside one traffic stream

Pairing an IDS with an IPS means spotting hostile attempts and blocking them inside one traffic stream: detection recognises the attack and the inline prevention engine drops or resets it. Correlating alerts from many sensors and ranking them for an analyst is the role of a SIEM. Launching playbooks that quarantine hosts is SOAR orchestration, acting after an alert rather than inline. Filtering packets by port and address is a basic firewall rule set, which does not inspect for attack content.

Correct answer: SDN

Software-defined networking splits the control plane from the forwarding plane and hands path and policy decisions to a central controller, which is what lets a virtualized environment carve traffic into isolated segments programmatically and re-apply that isolation as workloads move. Network function virtualization moves appliances such as routers and load balancers onto commodity servers; it changes where a function runs rather than how traffic is separated. Network access control decides whether an endpoint may join at all, based on posture and identity, and it stops mattering once the device is admitted. A virtual private network builds an encrypted tunnel between two points across an untrusted path, which protects one conversation rather than partitioning a fabric.

Correct answer: Limiting movement between individual workloads so a breach stays local

Microsegmentation applies policy at the level of the individual workload rather than the subnet, so each virtual machine or container is permitted only the specific east-west conversations it needs; an attacker who lands on one workload finds the neighboring ones closed, and lateral movement, the step that turns a foothold into a breach, is exactly what gets denied. Encrypting stored partitions protects data on a machine that leaves the building and does nothing about traffic between live workloads. Signing container images stops a tampered build from starting, a supply-chain control applied before runtime. Rotating privileged secrets shortens how long a leaked credential is useful, a credential-management measure that never constrains where an authenticated workload may connect.

Correct answer: The RPO figure

The recovery point objective states how much data, expressed as a span of time, the organization accepts losing in a disaster, and it therefore sets how often backups must run; a four-hour loss means the objective was four hours or the schedule missed it. The recovery time objective is about how quickly service must return, not how much data may vanish. Mean time to repair measures restoration effort. Mean time between failures measures reliability of a component.

Correct answer: The RTO target

A deadline for having a service running again is the recovery time objective: it is the maximum period the business will tolerate between the outage starting and the application being usable once more. Mean time between failures describes how long hardware runs before it breaks. The recovery point objective describes acceptable data loss. Maximum tolerable downtime is the outer limit past which the business itself fails, and the recovery time objective is deliberately set inside it.

Correct answer: How long a fixable unit runs between two faults

Mean time between failures is a reliability prediction for repairable equipment: it estimates the average span a unit will operate before the next fault, which is what drives maintenance intervals and spare-part planning. How long a restoration takes is mean time to repair. How much of the newest data a recovery forfeits is the recovery point objective. How many spares to hold is a procurement decision that the figure informs but does not state.

Correct answer: The average time taken to restore one failed service

The average time taken to restore one failed service is mean time to repair, the measured interval from detection to restoration that shows how effective the response is. The average time from an outage until it is detected is mean time to detect, which ends before repair starts. The average time from one outage until another is mean time between failures, a reliability figure. The target for the longest acceptable outage is the recovery time objective, a planned limit rather than a measured average.

Correct answer: A load balancer

A load balancer sits in front of a pool of servers, spreads incoming requests across them, and uses health checks to stop sending work to a node that has failed, which is exactly the behaviour described. A forward proxy brokers outbound requests on behalf of internal clients. A packet filter permits or denies traffic by header fields. A syslog server collects log messages centrally; none of those three distributes a workload across backend servers.

Correct answer: A RAID array

Striping data and parity across four drives so the set survives any single drive failure is a RAID array using parity, such as RAID 5, which rebuilds the lost blocks from parity. A RAID 0 striped array spreads data across drives with no parity, so one failed drive destroys the whole set. A RAID 1 mirrored array writes identical copies to paired drives instead of striping parity. A JBOD spanned array chains drives into one volume with no parity, so a lost drive loses its data.

Correct answer: A jump server

A jump server is a single hardened, closely monitored system that administrators connect to first and from which they reach protected hosts, so production systems never accept remote sessions directly. A relay agent forwards a specific protocol's messages between segments. A proxy cache stores retrieved content to serve it again quickly. A web gateway inspects and filters user browsing; none of those three is designed as the controlled entry point for administrative access.

Correct answer: Data sovereignty

Data sovereignty is the principle that data is subject to the laws of the country where it is physically stored, so cloud regions must be chosen deliberately. A data controller is the party that decides why and how personal data is processed, and a data processor handles it on the controller's behalf; both are GDPR roles, not location rules. Geographic restrictions are access controls based on a user's location, not the legal jurisdiction over stored data.

Correct answer: Air-gap isolation

Air-gap isolation physically disconnects the system from every other network, so no electronic path exists for malware to cross. A unidirectional gateway still links the networks, only restricting traffic to one direction. Microsegmentation applies fine-grained policy between workloads on a connected network. A screened subnet is a buffer zone between trusted and untrusted networks that remains reachable by design.

Correct answer: The SASE model

Secure access service edge is the architecture that folds network connectivity and security controls into one cloud-delivered service, so remote users and branches receive the same inspection and zero trust policy wherever they connect from. A next-generation firewall is an appliance model that backhauls remote traffic to a data centre. A multiprotocol label switching network provides transport with no security stack. A security information and event management platform analyses logs after the fact.

Correct answer: A virtual private network (VPN) solution

A virtual private network (VPN) solution builds an encrypted tunnel from the remote device to the corporate gateway, placing the device on the internal network as though it were cabled to the office LAN. An SSH port-forward tunnel encrypts traffic but carries only the specific ports forwarded, not full network access. A TLS tunnel protects one application connection at a time rather than joining the device to the LAN. An SD-WAN solution links branch sites across carrier circuits rather than connecting an individual remote worker's device.

Correct answer: The IPsec packet protection suite

IPsec secures IP itself: the Authentication Header gives integrity and origin authentication with no encryption, while Encapsulating Security Payload adds confidentiality, and because it works at the network layer every protocol above it inherits the protection. That is exactly what a site-to-site tunnel needs. SMTP only relays mail between servers and carries no packet-level cryptography of its own. SNMPv3 polls and receives traps from managed devices; it protects its own management messages and leaves the rest of the traffic untouched. NetBIOS session service sets up legacy name-based sessions and has no authentication or encryption capability whatsoever.

Correct answer: The IEEE 802.1X supplicant admission standard

802.1X defines port-based network access control: the connecting device acts as a supplicant, the switch acts as authenticator, and EAP carries the exchange to a RADIUS server, which decides whether the port is opened for general traffic. It is the foundation most network access control deployments are built on. 802.1Q inserts a VLAN tag into the Ethernet frame so a trunk can identify which VLAN a frame belongs to, which is segmentation rather than authentication. 802.1AE encrypts frames hop by hop once a link is already trusted. 802.1AB lets a device advertise itself so neighbours can be mapped.

Correct answer: Multiple availability zones, geographic site redundancy

High availability at site level means the workload already runs in more than one physically separate location, so losing an entire building removes capacity but not the service. Redundant feeds and generators harden one building against one class of failure and still leave that building as the single point of failure. Mirrored arrays duplicate a volume inside the same room, so they survive a disk, not a site. Backups are a recovery mechanism measured in hours: the data survives, but the payment service is down while someone restores it.

Correct answer: Serverless function platform, event triggered invocation

In a serverless model the unit of deployment is a function that the provider runs on demand: there is no guest operating system for the customer to patch, no capacity to size, and the meter runs only while the code executes. Infrastructure as a service hands over the virtual machine but the tenant still owns the guest operating system and its patch cycle. A privately run hypervisor cluster leaves the customer operating the virtualization layer as well. Colocation is only floor space, power and cooling, so the customer still buys, racks and maintains the hardware.

Correct answer: Infrastructure code, versioned declarative recipes

Infrastructure as code turns the environment itself into a file: a declarative template that can be diffed, reviewed and rolled back like source, so two deployments from the same commit are identical and every change carries an author and a reason. A machine snapshot reproduces one host but not the network, identity and policy around it, and the image itself is a binary that version control cannot meaningfully diff. A written runbook still depends on a human performing the steps correctly each time. An advisory board records approval for a change, which is governance rather than reproducible provisioning.

Correct answer: Tokenization, vaulted surrogate identity substitution

Tokenization, vaulted surrogate identity substitution, is the answer: the application stores a meaningless token and only the separate token vault can map it back to the card number, so the real values leave the production systems while payments still resolve. Static data masking also substitutes characters, but it overwrites the value permanently, so a masked number can never be used to charge the card. Format-preserving encryption keeps the shape of the number, yet the real card value is still present in the system as ciphertext and can be decrypted with the key. Keyed hashing produces a one-way digest, so the original number cannot be recovered to complete a payment.

Correct answer: Data masking, fictitious replacement attribute entries

Data masking, fictitious replacement attribute entries is the best fit: each field is overwritten with an invented value of the same shape, so test records look real while no genuine person remains in the environment. Tokenization keeps a vault mapping that turns each stand-in back into the real value, which suits production payment systems rather than a test copy. Encryption turns fields into ciphertext that no longer keeps the original format and is still reversible with the key. Anonymization generalises values into bands or ranges, destroying the realistic record format the developers need.

Correct answer: SSH, encrypted administrative shell wrapping

SSH is the direct replacement for Telnet: the same interactive command line, wrapped in an encrypted, integrity-protected channel with host key verification, so credentials and commands cannot be read or altered on the wire. FTP moves files and sends its own login in the clear, so it repeats the weakness rather than fixing it. TFTP has no authentication at all and exists to fetch configuration or image files. SNMP polls and sets device variables and, in its older versions, authorizes with a community string sent in the clear.

Correct answer: DNSSEC, hierarchical delegated trust anchoring

DNSSEC signs each zone and links every zone to its parent, so a resolver can follow the chain from a trust anchor down to the record it received and detect anything that was altered or fabricated along the way. DHCP snooping polices address offers on switch ports and never touches name resolution. Encrypted DNS transport hides the query from onlookers, but the resolver still has no way to prove that the answer it decrypts is the one the zone owner published. NAT rewrites addresses at a boundary and makes no statement about authenticity.

Correct answer: TPM chip, tamper-proof measurement anchoring

A TPM is soldered to one board and serves that one machine: it holds keys in hardware and records each boot component into its platform configuration registers, so a key can be sealed to a known-good measurement and refuse to release on a tampered system. An HSM is a separate network-attached appliance built for many hosts, not a per-laptop chip. A self-encrypting drive holds its own media key and encrypts blocks, but it measures nothing about the boot sequence. UEFI settings decide which bootloader signatures are accepted; the enforcement lives in firmware policy rather than in a key-storage chip.

Correct answer: HSM appliance, hardened cryptographic processor

An HSM is a hardened box whose only job is key material: it generates keys inside the boundary, never exports the private halves in the clear, performs the operations on request for many applications at once, and destroys its contents if the enclosure is opened. A certificate authority decides which identities deserve a certificate and signs them, and it commonly relies on an HSM to hold its own signing key. RADIUS authenticates users against a directory and issues no keys. A KVM switch shares a keyboard and monitor across servers and has no cryptographic role.

Correct answer: Policy decision point, central control assessor

The decision itself belongs to the control plane: the policy engine weighs identity, device posture and threat signals against the written rules and returns a grant or a deny, which the enforcement point then carries out on the data path. An implicit trust zone is the area behind a gate where traffic moves without further checks, which is exactly what zero trust tries to shrink. The subject is the user or workload asking for something, so it is the party the decision is made about, not the party making it. Adaptive identity signals are inputs consumed during that evaluation rather than the component performing it.

Correct answer: Explicit verification, rechecking every single request

The principle is usually quoted as never trust, always verify. Zero trust takes location out of the trust calculation: every request is authenticated and authorized on its own merits whether it came from a branch office, a home network or the rack next door, and a session that was allowed a minute ago is checked again. The perimeter model does the opposite by treating the inside as safe once the boundary is crossed, which is the assumption zero trust was created to remove. Least privilege governs how much access an identity gets after it is trusted, not whether trust is assumed in the first place. Layered defense stacks independent controls and says nothing about implicit trust.

Correct answer: Forward proxy, egress blocklist policy enforcement

A forward proxy is deployed on behalf of the clients: every outbound session is made by the proxy, so the external site sees only the proxy's address, and because the proxy terminates the request it can apply category, reputation and content rules before letting it out. Address translation also replaces the source address, but it inspects nothing above the header and enforces no content policy. A tap silently copies frames for monitoring and cannot alter or block a session. A load balancer spreads inbound connections over a pool of servers, which is the opposite direction of travel.

Correct answer: Reverse proxy, inbound session termination endpoint

A reverse proxy answers on behalf of the servers behind it: clients connect to the proxy, the encrypted session ends there, and the proxy opens its own connections to whichever back-end node it chooses, so the origin hostnames and addresses are never exposed. A jump server exists for administrators to log in through and carries no public client traffic. A protocol analyzer observes and decodes packets but terminates nothing. A screened subnet is a network zone created by firewall rules; it describes where the servers sit rather than a device that fronts them.

Correct answer: Jump server, consolidated administrative pivot waypoint

A jump server concentrates privileged access into one place: administrators authenticate to that box, every session from it can be logged and recorded, and the sensitive systems accept management connections only from its address, so a compromised workstation cannot reach them directly. A syslog collector receives the logs those systems emit and grants no one access to anything. A remote access concentrator ends encrypted tunnels and drops users onto the network, which is the broad access a jump host is meant to replace. A directory service answers who a user is and what groups they hold, not where they must connect from.

Correct answer: Active-passive cluster, automatic standby handover

In an active-passive pair one firewall carries the traffic while the other holds the same configuration and state and watches it over a heartbeat; when the heartbeat stops, the standby claims the shared address and continues the sessions without anyone being paged. Link aggregation combines physical ports into one logical link and protects against a cable or port failure, not the loss of the whole unit. A cold spare is hardware on a shelf that someone has to rack, configure and cable first. Synchronizing rules between a pair keeps them consistent but does not itself decide when one should take over.

Correct answer: Fail-open behavior

Fail-open is the availability-first choice: the moment the inline unit stops working, the path around it opens and packets continue to move even though nothing is inspecting them any more. Fail-closed is the opposite trade, dropping the traffic rather than letting anything past unexamined, which the business here has explicitly refused. Fail-back describes returning a workload to its primary once that primary is healthy again, so it applies after a recovery rather than during the outage. Fail-stop means the component halts cleanly and announces its own failure, which is a behavior of the device, not a decision about the traffic around it.

Correct answer: Fail-closed design

A fail-closed design blocks all traffic when the security control itself fails, accepting an outage as the safer outcome for highly sensitive systems. A fail-open bypass uses a bypass switch or NIC that passes traffic straight through uninspected when the device fails, which keeps service up but is exactly what this organization forbids. An inline-mode design only places the device in the traffic path so it is able to block; an inline device can still be configured to fail open, so placement alone does not decide failure behavior. A tap-mode design receives a copy of traffic passively and never sits in the path, so its failure blocks nothing.

Correct answer: Air gap, comprehensive physical connectivity removal

An air gap means there is no path at all: no cable, no wireless bridge, no shared switch, so an attacker on the corporate network has nothing to route over and data crosses only by hand on removable media. Virtual segmentation separates traffic logically while the frames still share the same physical switches and can be reached if the configuration is wrong. A screened subnet is a filtered network that exists specifically to be reachable from outside. A one-way gateway is still a connection, and although it enforces the direction of flow it is not physical separation.

Correct answer: Embedded system, purpose-built firmware device

An embedded device is built for one job: the software is burned in as firmware, the processor and memory are sized for that job and nothing else, and updates arrive rarely because they usually require the vendor and a maintenance window on the production line. A hypervisor host is a general platform whose whole purpose is to run arbitrary guest workloads. A workstation runs a general operating system with an interactive user and a routine monthly patch cycle. A storage appliance is purpose-built but sits in a data center serving files, with the capacity and the update path of ordinary server hardware.

Correct answer: Industrial process control, operational technology deployment

SCADA exists to supervise physical processes: it reads sensors and drives actuators in pumps, breakers and valves spread over a wide area, which is the definition of an operational technology estate and the reason its priorities are availability and safety before confidentiality. Corporate networks move documents and mail between people and are engineered around information rather than physical plant. Cloud tenancy provides elastic compute for software workloads and has no field devices to actuate. Payment systems handle cardholder transactions under card industry rules and again control no physical process.

Correct answer: Weak default credentials, infrequent firmware updates

Consumer-grade sensors and cameras ship with a published password, often cannot enforce a strong one, and receive firmware fixes rarely or never once the model stops selling, so a known flaw stays exploitable for the life of the device. Excessive domain privilege is an identity problem on managed servers and workstations, not on a thermostat that holds no domain account. Hypervisor escape belongs to virtualized multi-tenant hosting, and these devices are bare hardware. Injection flaws affect applications that build database queries, which most building sensors never do.

Correct answer: Software-defined networking, unified policy control

Software-defined networking lifts the decision-making out of each switch and puts it in a controller: the devices keep only the fast forwarding path, and an operator or an application programs the whole fabric from one place through the controller's interface. Spanning tree is a distributed protocol that each switch runs for itself to break loops, which is exactly the per-device intelligence this design removes. Network function virtualization moves appliances such as firewalls into software but leaves each of them with its own control logic. Address translation rewrites headers at a boundary and does not program forwarding anywhere.

Correct answer: Port security, permitted MAC identifier capping

Port security, permitted MAC identifier capping, limits how many source MAC addresses a switch access port may learn and takes a violation action beyond that, stopping both extra rogue devices and MAC flooding. 802.1X requires port-based sign-in before access but does not cap the number of addresses learned behind an authenticated port. MAC filtering on a static allowlist admits known addresses but sets no per-port count. ARP inspection checks MAC-to-IP bindings against DHCP snooping data to stop ARP spoofing, not table flooding.

Correct answer: Least connection method, lowest concurrent workload

The least-connection scheduler asks a live question before every placement: which member is carrying the smallest number of open sessions right now, and it sends the next one there, so a node stuck with long-running sessions stops receiving work automatically. Round robin walks the list in order and is blind to how busy anyone is. Weighted distribution divides traffic by a static ratio the administrator sets from expected capacity, which never reacts to the current moment. Source hashing computes the destination from the client's address so the same client keeps landing on the same node regardless of load.

Correct answer: Session persistence, sticky backend anchoring

Persistence pins a client to one member for the life of its session, usually with a cookie or a source-address table on the balancer, so the shopping cart or login state cached on that node is still there for the next request. Health probing decides which members are eligible at all and would gladly move a client to a different healthy node. Connection draining lets existing sessions finish while a node is taken out of service, which is the orderly end of persistence rather than the mechanism that provides it. Round robin deliberately spreads consecutive requests around, which is what breaks a cached session.

Correct answer: Confidential computing, sealed memory execution enclave

Data has three states, and the hardest one to cover is data in use: while a record is loaded into memory and being computed on, it is normally plaintext and visible to anything with sufficient privilege on the host. Confidential computing closes that window with hardware enclaves that keep the working set encrypted and out of reach of the operating system and hypervisor. Full-disk encryption applies to a drive that is at rest and is transparent once the system is running. Transport encryption covers the journey between hosts. Encrypted backups protect stored copies, which is the at-rest state again.

Correct answer: Stored-volume encryption, unreadable seized drive content

Stored-volume encryption, unreadable seized drive content, is the BEST control: encryption keeps the database files and underlying volumes as ciphertext, so a stolen drive or copied file yields nothing readable without a key held elsewhere. Data masking hides fields only in what users and reports see, while the stored data stays in the clear. Password hashing protects credentials but leaves the rest of the records readable. Database permissions are enforced by the running server, and an attacker holding the raw drive bypasses them entirely.

Correct answer: IPSEC

IPSEC is the correct choice because it is the network-layer protocol suite that authenticates and encrypts IP packets, which is why site-to-site VPN tunnels are built on it. MACSEC encrypts traffic, but only hop by hop on a single Layer 2 link, so it cannot protect a routed tunnel between sites. L2TP builds a tunnel but provides no encryption on its own and is normally paired with IPsec. GRE encapsulates packets at the network layer but neither encrypts nor authenticates them.

Correct answer: Logical isolation maintained for every tenant workload

Logical isolation maintained for every tenant workload is what makes multitenancy safe: separate identities, storage namespaces, network segments and compute boundaries keep one customer from reaching another's data on shared hardware. Edge firewall rules filter traffic entering the platform but do nothing between tenants already inside it. Shared-key volume encryption protects data at rest from the outside, yet a single key shared by all tenants separates no one. Single sign-on federation streamlines authentication but does not decide which tenant's data a signed-in user can reach.

Correct answer: Hybrid cloud deployment

Correct answer: hybrid cloud deployment. A hybrid model keeps the most sensitive workloads on private infrastructure the organization controls while running elastic, lower-sensitivity workloads on public cloud capacity, which is exactly the split described. A public-only deployment moves the sensitive workloads out of the organization's own data center. A hosted deployment places every workload with a third party. An onsite-only deployment keeps everything in house and gives up public cloud elasticity.

Correct answer: Container virtualization

Correct answer: container virtualization. Containers package an application with only the libraries it requires and execute against the shared host kernel, which is what makes the unit lightweight and portable. Hardware-level emulation runs a complete guest operating system per virtual machine, so no kernel is shared. Filesystem deduplication removes repeated storage blocks and packages no application. Hypervisor introspection inspects running virtual machines from the outside and is a monitoring technique.

Correct answer: RAID 5

Correct answer: RAID 5. RAID 5 stripes data across all members and distributes parity blocks among them, so the array rebuilds after any one drive fails. RAID 0 stripes with no parity, so a single failure destroys the whole set. RAID 1 mirrors rather than stripes and writes no parity. RAID 3 does stripe, but it concentrates parity on one dedicated drive instead of distributing it across the array.

Correct answer: Synchronous replication to a hot standby node

Synchronous replication to a hot standby node is correct because every transaction is committed on the standby before the client receives an acknowledgement, so automatic failover loses no committed work. Asynchronous replication acknowledges first and copies later, so the last transactions can be lost at failover. Transaction log shipping sends logs in batches on a schedule and leaves a gap of unshipped work. Asynchronous mirroring has the same lag as asynchronous replication, and a warm node also needs time before it can take over.

Correct answer: SFTP

Correct answer: SFTP. SFTP performs its file operations inside an established SSH session, so credentials and file contents are protected by the SSH channel itself. TFTP offers no authentication and no encryption. FTPS is also encrypted, but it wraps classic FTP in TLS rather than running over SSH as the requirement states. SMTP transports mail between servers and is not a file transfer service.

Correct answer: LDAPS

Correct answer: LDAPS. LDAPS carries directory queries inside TLS, so the bind credentials and query results that plain LDAP would send in cleartext are encrypted. IPSEC protects IP traffic in general and is not a directory access protocol. SMTPS secures mail submission. HTTPS secures web traffic. None of those three speaks the directory protocol the stem needs to replace.

Correct answer: SASE

Correct answer: SASE. Secure Access Service Edge converges wide-area networking with security services such as secure web gateway, firewall and zero trust access, all delivered from the provider's cloud edge, so branch offices and remote users receive one centrally managed policy. SIEM aggregates and correlates log data. CASB governs how individual cloud applications are used but does not carry the branch's network traffic. SOAR automates response playbooks after detection.

Correct answer: TLS encryption using a validated certificate

Correct answer: TLS encryption using a validated certificate. TLS encrypts the session while a certificate that chains to a trusted authority proves the server is who it claims to be, and both properties are required to protect data in transit for a public site. SHA-256 hashing provides integrity evidence but no confidentiality and no proof of identity. IPv4 allowlisting restricts which addresses may connect and encrypts nothing. HTTP authentication sends the credential over an unprotected channel however long that password is.

Correct answer: VLAN segmentation

VLAN segmentation places the finance ports in their own broadcast domain, so they are logically separated from general users while sharing the same physical switches. DMZ segmentation creates a screened subnet for public-facing servers, not an internal department boundary. Port ACL enforcement filters traffic on individual switch ports but leaves every user in the same broadcast domain. NAC port enforcement decides whether a device may connect at all; it admits or refuses hosts rather than dividing the admitted ones into separate logical networks.

Correct answer: Network microsegmentation

Correct answer: network microsegmentation. Microsegmentation writes policy around each individual workload rather than around a subnet, so east-west traffic between two servers inside the same data center is filtered as well. Datacenter virtualization abstracts the underlying hardware without adding any per-workload policy. Directory synchronization copies identity data between stores. Infrastructure templating standardizes how systems are built and enforces nothing at runtime.

Correct answer: Data sovereignty

Data sovereignty is the principle that data about a jurisdiction's residents is subject to that jurisdiction's laws, so it dictates which geographic regions may store and process the records. Data retention is also driven by legal obligations, but it governs how long data is kept, not where. Data classification labels data by sensitivity and drives handling controls rather than location. Geographic dispersion spreads data across distant sites for resilience, which can breach residency rules instead of satisfying them.

Correct answer: FaaS, where the customer safeguards its function code and entitlements

Correct answer: FaaS, where the customer safeguards its function code and entitlements. In a serverless Function as a Service model the provider runs short-lived functions on demand and owns the servers, operating systems and runtime entirely, so under shared responsibility the customer's remaining duties are the function code, its configuration, its identity permissions and its data. PaaS leaves the runtime and middleware with the provider, not the customer. IaaS is wrong for this stem because the customer there still patches guest operating systems, which the stem explicitly rules out. SaaS delivers a finished application the customer only configures, and no function code is deployed at all.

Correct answer: HSM

Correct answer: HSM. A hardware security module is a dedicated tamper-resistant appliance built to generate, store and manage cryptographic keys for an entire enterprise at high transaction volume, and data center models are commonly validated to FIPS 140-2 or 140-3. A TPM is a chip bound to one host that protects that machine's own keys and boot measurements. An SED encrypts the contents of a single drive with a key it holds internally. A UTM is a consolidated security gateway and performs no enterprise key management.

Correct answer: Payment tokenization

Correct answer: payment tokenization. Tokenization swaps each card number for a randomly generated surrogate with no mathematical relationship to the original, and the real value can be retrieved only through a separately secured token vault, which is precisely the vault-backed mapping described. Irreversible hashing cannot be reversed at all, so the original card number could never be recovered for a later transaction. Attribute encryption transforms the value with a key, so a mathematical relationship to the original does remain. Column-level masking obscures the value for display while the real number stays in place.

Correct answer: Enclave execution inside a processor package

Correct answer: enclave execution inside a processor package. Data in use is data loaded into memory and actively processed, and confidential computing protects it by running the computation inside a hardware trusted execution environment that the host operating system and hypervisor cannot read. Full-disk encryption protects data at rest and releases plaintext to memory once the volume is unlocked. Transport encryption protects data in transit between endpoints. Immutable archiving serves recovery and retention, not live processing.

Correct answer: Hot standby site

A hot standby site keeps fully duplicated, continuously synchronized systems and data running, so it can take over almost immediately with minimal downtime. A warm standby site holds a scaled-down environment that must be scaled up or brought current before it carries full production load. A cold standby site has equipment that is powered off and must be configured and loaded, which takes much longer. A pilot light site runs only the core data services and must build out the rest after a disaster.

Correct answer: Infrastructure as code

Correct answer: infrastructure as code. Infrastructure as code defines servers, networks and their configuration in machine-readable files that live in version control, so every environment is provisioned from the same reviewed definition and drift is reduced. Templates hand-built by operators are not version controlled and diverge as each operator edits them. Baselines captured from golden images capture one point in time and age immediately. Deployments driven by change tickets rely on humans repeating manual steps, which is the source of the drift.

Correct answer: Certificate issuance server

Correct answer: certificate issuance server. The certificate authority in a PKI is the component that issues and digitally signs certificates, binding a public key to a verified identity so relying clients can trust the server they reach. A certificate revocation list publishes serial numbers that are no longer trusted and issues nothing. A certificate signing request is the applicant's submission to the authority, not the issuer. A certificate status protocol such as OCSP answers real-time validity queries about certificates that were already issued.

Correct answer: Encapsulating Security Payload (ESP), a known networking format

Encapsulating Security Payload is the IPsec protocol that encrypts the data it carries, and it supplies integrity and origin authentication for that protected data as well, which is why it is chosen when confidentiality is required. IP Authentication Header provides integrity and authentication for the packet but performs no encryption whatsoever, so anything it protects still travels in the clear. Internet Key Exchange negotiates the keys and security associations before any user data is protected and is not itself the protection. Payload Compression Protocol shrinks payloads to offset the expansion encryption causes and offers no confidentiality of its own.

Correct answer: Token, which proves the user is already logged in

After a successful login the server issues a short session token, and the client presents that value on each later request so the server can recognise and authorise the session without re-checking the password. A certificate binds a public key to an identity and is issued by a certificate authority for much longer periods. A checksum detects accidental corruption in a file and provides no identity at all. A cipher suite is the negotiated set of algorithms used to protect a connection, not a per-user credential.

Correct answer: To review the logs of a single machine carefully

A host-based intrusion detection system runs on the host it protects and inspects that machine's own evidence, its logs, file integrity, running processes and local network activity, which lets it see encrypted or internal activity a network sensor never sees. Handing out addresses at startup is DHCP. Creating a private tunnel over a public network is a VPN. Barring unsigned code is application allow-listing, a preventive control rather than a detective one.

Correct answer: Correlating live event logs in one console

A security information and event management platform ingests logs from servers, network gear and applications, normalises them, and correlates events in near real time so that a pattern spread across several sources raises one alert an analyst can act on. Handing out an address per joining device is DHCP. Shredding a retired disk after service end is media sanitisation. Patching a server on a fixed timetable is vulnerability management. None of those three performs real-time correlation and alerting across log sources.

Correct answer: Data loss prevention, which blocks the sensitive content

Data loss prevention inspects the content itself, matching patterns such as card numbers, national identifiers or classified markings, and then blocks, quarantines or encrypts the message before it leaves the organisation. Antivirus matches a file against known malware signatures and says nothing about whether the content is confidential. A load balancer distributes traffic for availability. A password vault protects stored credentials at rest. Only content inspection at the gateway stops sensitive material leaving by email.

Correct answer: Nessus, which reports the known unpatched server bugs

Nessus is a vulnerability scanner: it fingerprints hosts and services, tests them against a plugin feed of known flaws and misconfigurations, and reports what is missing or exposed with a severity rating. Wireshark decodes captured traffic and finds no vulnerabilities. Snort is an intrusion detection engine that alerts when live traffic matches a rule signature. Nmap discovers hosts and open ports, which is reconnaissance rather than a vulnerability assessment.

Correct answer: Capturing a raw packet for detailed inspection

tcpdump is a command-line packet capture tool: it puts an interface into promiscuous mode, filters with a Berkeley Packet Filter expression, prints the headers and can write a capture file for later analysis. Wiping unused space from a decommissioned disk is media sanitisation. Signing a download so tampering surfaces is an integrity control. Hardening a database against a vendor baseline is configuration management. None of those three records live traffic from an interface.

Correct answer: Reading a handshake to find a broken exchange

A protocol analyser decodes captured frames field by field, so an engineer can follow a session such as a TLS or DHCP handshake, see exactly which message was malformed, rejected or never sent, and decide whether the fault is a configuration error or an attack. Erasing a handset as it departs the estate is asset disposal. Issuing a plastic card to a new contractor is identity provisioning. Rotating an access file on a nightly schedule is log management.

Correct answer: To leave the seized medium exactly as found

A write blocker sits between the evidence drive and the examiner's workstation and permits read commands while refusing every write, so the operating system cannot mount, journal or timestamp the original and the acquired image still matches the source hash. Hashing each copied image proves integrity but does not stop a write happening. Logging the handovers is chain of custody, a documentation control. Carving deleted files out of unallocated sectors is an analysis technique performed on the copy.

Correct answer: Exploit framework, which fires real attack code

An exploit framework, which fires real attack code at a target with the owner's permission, is the penetration-testing tool that simulates an attack to prove a weakness can actually be used. A vulnerability scanner checks OS and software versions against known flaws and reports them without exploiting anything. A honeypot decoy logs the attacks it draws in from real adversaries rather than simulating one. A protocol analyzer decodes captured traffic, including attack traffic, but launches nothing.

Correct answer: Passing signed identity assertions toward a trusting web service

SAML exists to carry signed authentication and authorization assertions from an identity provider to a service provider, and that assertion exchange is what makes browser-based single sign-on work across separate web applications. Sealing the body of a mail message is the job of S/MIME or PGP, message formats that have nothing to do with identity assertions. Scoring reported software defects against a published severity scale is what a vulnerability scanner and CVSS do, and SAML never inspects code. Deciding which packets may cross a boundary is a firewall function performed on addresses and ports, several layers below the assertion exchange SAML carries out.

Correct answer: Detecting regulated content in outbound streams to stop unapproved transfers

DLP works by classifying content such as card numbers, health records or source code and then watching every path that content can take out of the organization, blocking or quarantining a transfer policy does not allow, whether the data is at rest, in use or in motion. Removing duplicate blocks from an archive is deduplication, a storage-efficiency technique that never examines who is sending what to whom. Rotating keys inside a hardware security module shortens the window in which a compromised key is useful, a key-management control that acts on secrets rather than on content. Recording keystrokes to build behavioral baselines is user activity monitoring, which profiles people instead of identifying and halting the movement of regulated data.

Correct answer: Correlating log events from many systems to surface genuine incidents

A SIEM's main purpose is correlating log events from many systems to surface genuine incidents: it normalizes logs from firewalls, endpoints and servers and applies rules across sources. Executing response playbooks across tools is SOAR, which acts on alerts rather than correlating the logs. Recording process events on each endpoint to stop hostile acts is EDR, confined to one host at a time. Inspecting packet events for known signatures is an IDS or IPS function on network traffic.

Correct answer: Formal planning

Security requirements and goals belong in the earliest phase of a secure SDLC, where the team agrees what the system must protect, which regulations apply, what an acceptable level of residual risk is, and what secure enough will mean at release; every later phase is then measured against that statement. The design phase converts already-agreed requirements into an architecture of trust boundaries, authentication flows and key handling, so it implements goals rather than setting them. Testing verifies that requirements were met, which presupposes they already exist. Handover moves a finished build into production with hardening and monitoring, far too late for a missing requirement to be added cheaply.

Correct answer: Gathering log records from many sources into one searchable repository

The primary purpose of a SIEM is gathering log records from many sources into one searchable repository, normalizing and time-aligning them so correlation, alerting and investigation become possible. Running automated playbooks that isolate a host when an alert fires is SOAR, which acts on the SIEM's output rather than collecting it. Recording process activity on each host to stop malicious code is EDR, an endpoint agent that the SIEM reads from. Inspecting outbound traffic so regulated data stays inside is DLP, another source of events rather than the aggregation point.

Correct answer: Kerberos requests

Kerberos authenticates a client to a service using time-limited tickets issued by a Key Distribution Center; the password is used locally to derive a key and is never sent across the network, and the service validates the ticket rather than a credential. Diameter, the AAA successor to RADIUS, uses a request and answer exchange protected by transport-layer security and carries credentials to the server instead of granting tickets. Terminal device administration under TACACS+ separates authentication from authorization so individual commands can be approved, and it encrypts the packet body, but each login still sends the credential to the server. A directory lookup authenticates through an LDAP simple bind, which transmits the password to the directory server, the opposite of the property described.

Correct answer: Letting a partner recognize logins issued by one external organization

A federation service establishes trust between separate identity domains so a user authenticated by their home organization is accepted by a partner's application without holding an account there; the partner validates a signed assertion from the trusted issuer instead of a local credential. Storing hashed credentials in a directory is what a directory service does inside one organization, the very duplication federation removes the need for. Timing out idle sessions is a session-management control that limits exposure on an unattended device. Granting rights for a single assignment and retracting them afterwards is just-in-time privileged access, which decides how long an entitlement lasts rather than which organization vouched for the identity.

Correct answer: Vaulting passwords for highly elevated accounts under live session recording

Privileged access management concentrates on the small number of accounts that can change everything: it vaults and rotates their credentials, issues them just in time, brokers the connection so the human never handles the secret, and records the session for review. Mapping job titles to permission bundles is role-based access control, which governs ordinary entitlements for the whole workforce rather than the administrative tier. Comparing logons against a behavior baseline is user and entity behavior analytics, a detection technique that holds no credential at all. Building an encrypted tunnel to internal resources is remote access, which decides how a user reaches the network and not what elevated rights they may exercise once there.

Correct answer: Reusing one original identity login across many unrelated web services

SAML lets a user authenticate once at an identity provider, which then issues a signed assertion that each participating service provider trusts, so one session opens many separate web applications without the user presenting a credential to any of them. Converting readable input into ciphertext under an agreed block cipher is what an encryption algorithm inside TLS or S/MIME does; SAML assertions are signed for authenticity and normally travel over a channel someone else encrypted. Checking a sender domain against records published for that domain is SPF, DKIM and DMARC, an email authentication family with no relationship to web session establishment. Selecting what an endpoint may reach after a posture check is network access control, an admission decision rather than an identity assertion.

Correct answer: Validating remote credentials centrally and logging the length of sessions

RADIUS centralizes AAA for network access: a switch, wireless controller or VPN concentrator forwards a user's credentials to the RADIUS server, which authenticates them, returns the authorization attributes that shape the session, and stores accounting records covering its start, stop and duration. Stateful packet filtering against a ruleset is a firewall's work, performed on traffic rather than on identity. Watching host processes and flagging unexpected behavior is host intrusion detection or EDR, which lives on the endpoint and issues no network access decision. Encrypting stored volumes with keys held in firmware is full-disk encryption, a data-at-rest control unrelated to who is allowed onto the network.

Correct answer: Fingerprint scanner

Multi-factor authentication requires evidence from different categories, and a fingerprint scanner supplies the inherence factor, something the user is, which cannot be shared or typed the way a memorized secret can, so pairing it with a password or a token produces a genuine multi-factor login. Certificate pinning ties a client to an expected server certificate and defends a TLS connection against a fraudulent issuer; it authenticates the server, not the person. Screensaver locking protects an unattended workstation and simply re-presents whatever authentication is already configured. Passphrase rotation replaces one knowledge secret with another knowledge secret, which remains a single factor however often it changes.

Correct answer: Granting one application delegated rights over owner resources using tokens

OAuth is an authorization framework: the resource owner approves a scoped, revocable grant, and the application receives an access token that lets it act on specific resources for a limited time while the owner's password never leaves the identity provider. Demanding an additional factor at logon is multi-factor authentication, which strengthens proof of who the user is and says nothing about what a third-party application may do on their behalf. Wrapping wireless frames in a rotating cipher describes WPA link encryption, a data-in-transit protection at the radio layer. Moving files inside an authenticated encrypted channel is SFTP or SCP, a transfer protocol that carries data rather than delegating rights.

Correct answer: One stolen credential opens the whole set of connected services

The primary SSO risk is that one stolen credential opens the whole set of connected services, which is why SSO is paired with MFA and a hardened identity provider. A copy of every password hash in each application is wrong because SSO keeps credentials at the identity provider and the applications receive assertions instead. An expired signing certificate makes assertions fail validation; it does not expose them in clear. A merged audit log is wrong because SSO assertions carry the user identity, so each application still logs who signed in.

Correct answer: Authorizing individual commands issued by an administrator on managed consoles

TACACS+ is the AAA protocol built for device administration: it separates authentication from authorization so that once an administrator has logged in, each command they issue can be checked against policy and permitted or refused, and it encrypts the entire packet body rather than only the password. Matching files against malware signatures is antimalware scanning performed on an endpoint. Reserving bandwidth for voice on a congested link is quality of service, a traffic-prioritization feature configured on the very routers TACACS+ protects but unrelated to who may configure them. Producing integrity reports on system binaries is file integrity monitoring, which detects unauthorized change after the fact instead of deciding an administrator's rights in advance.

Correct answer: Adaptive authentication

Adaptive, or risk-based, authentication evaluates the context of each attempt, including device, location, network, time and recent behavior, and varies what it demands: a routine login passes on a password while a login from an unfamiliar country triggers an additional challenge, so the same user meets different requirements at different moments. Password authentication asks for the same single secret every time and has no notion of context. Kerberos authentication is a ticket-based protocol whose exchange is identical for every session it issues. Two-step authentication always requires the same two factors regardless of circumstance, a fixed policy rather than one that responds to risk.

Correct answer: Gathering permissions under a functional role shared by many employees

The main advantage of RBAC is gathering permissions under a functional role shared by many employees, so administrators maintain a few role definitions instead of thousands of individual grants and joiners, movers and leavers are handled by changing role membership. Evaluating permissions against each user's attributes at every request describes ABAC, which gains context awareness at the cost of more complex policy. Letting each resource owner give any role or colleague access directly is discretionary access control, which decentralizes rather than simplifies administration. Matching each user's clearance label to the label set on each resource is mandatory access control, which enforces classification rather than job function.

Correct answer: Inherence authentication

Inherence authentication is the right category: a fingerprint is a measured physical trait of the person, the classic "something you are" factor. Knowledge authentication tests a memorised secret such as a PIN or passphrase. Ownership authentication tests a device the person carries, such as a hardware token. Proximity authentication tests where the person is, using location or network context, which a fingerprint reader never evaluates.

Correct answer: They carry an embedded certificate that proves who the user is

The key feature is that they carry an embedded certificate that proves who the user is, backed by a private key that never leaves the chip. A certificate revocation list is published by the CA and checked by the relying server, not stored on the user's card. Smart-card logon uses asymmetric key pairs, not a symmetric key shared with the server. The CA root certificate is installed in the server's trust store; the card holds the user's own certificate.

Correct answer: Centralizing the storage of user records and their attributes

A directory service exists to hold identity data in one authoritative place: user, group and device objects with the attributes other systems query when they authenticate or authorize someone. Audit logging of authentication attempts is done by the event log and the collector that reads it. Issuing and revoking certificates is the job of a certificate authority. Pushing software updates is a patch management function, not a directory function.

Correct answer: ABAC, attribute-based access control

ABAC evaluates attributes of the subject, the object, the action and the environment at the moment of the request, so what is granted changes with conditions such as time of day, device posture or location. MAC decides from fixed clearance and classification labels set by the system, not by conditions. DAC lets the resource owner grant access at their own discretion. RBAC grants permissions through static role memberships that an administrator assigns in advance.

Correct answer: SIEM, a centralized analytics platform

SIEM, a centralized analytics platform, is the system that ingests logs from servers, firewalls and applications, normalizes them and correlates events into alerts. SOAR is wrong because it runs playbooks that act on alerts a SIEM already produced; it is not the collection and correlation layer. EDR is wrong because it records telemetry from endpoints only, not from firewalls and every application. UEBA is wrong because it baselines user behavior to spot anomalies and depends on the log data a SIEM gathers.

Correct answer: SOAR, a workflow orchestration platform

SOAR is the layer that holds the playbooks: it connects to the other security products through their APIs and executes enrichment, triage and containment steps in sequence, so work an analyst would otherwise repeat by hand happens automatically. A SIEM detects by correlating collected records and hands the analyst an alert, but it does not drive multi-product response on its own. EDR acts on one endpoint at a time, isolating or cleaning that host rather than coordinating action across a whole toolset. FIM watches specific files and configurations for unexpected change and reports it, with no orchestration role.

Correct answer: SIEM correlates logged records to expose threats, while SOAR drives response steps using playbooks

The split is detection versus response. A SIEM ingests records from many sources, normalizes them and correlates them so a threat becomes visible as an alert; SOAR takes that alert and runs an automated playbook across the other tools to enrich, decide and contain. Neither product is defined by cryptography: encrypting stored records and signing messages are jobs for storage encryption and mail security. Neither one administers accounts or firewalls: password rotation belongs to identity management and packet filtering to the firewall itself. Neither performs forensic imaging or backup restoration, which sit with the forensics and recovery teams.

Correct answer: XDR, extended threat coverage

XDR is defined by breadth: it takes native telemetry from endpoints, network sensors, cloud workloads, identity systems and mail, correlates it centrally and presents one console in which an analyst can follow an attack from the first click to the final action. MDM enrolls and configures phones and tablets and reports only on those devices. A WAF sits in front of a web application and inspects HTTP requests for injection and abuse, seeing nothing beyond that application. A CASB governs how users reach cloud services and enforces policy there, which is one layer of the picture rather than all of them.

Correct answer: EDR, endpoint behavior telemetry

EDR puts an agent on each laptop and server that continuously records process execution, file writes and outbound connections, evaluates that behavior for attack patterns, and gives the responder the ability to isolate the machine from the network and remediate it. A SIEM collects records centrally from many systems but owns no agent on the host and cannot quarantine one. NAC evaluates a device at the moment it asks to join and grants or refuses admission, which says nothing about what the device does once it is on the network. DLP inspects outbound content to stop confidential material leaving the organization and does not track process execution.

Correct answer: Automated sandboxing

Automated sandboxing detonates the suspect file inside an isolated, instrumented virtual machine where its process, file and network behavior is recorded, so a verdict is reached without the sample touching production. Static code analysis inspects code without ever running it, so nothing is observed in action. Email quarantining holds a message aside for review but does not execute the attachment. Network segmentation isolates zones of the production network rather than providing an instrumented detonation environment.

Correct answer: SAML, browser federation exchange

SAML carries signed XML assertions from the identity provider to the service provider, and that assertion is what lets the application trust the sign-in and grant access without ever running a login of its own; this is the classic web single sign-on flow. LDAP reads and writes entries in a directory tree and answers attribute queries, but it is a lookup protocol, not a federation exchange between two organizations. SMTP moves mail between servers. ICMP carries reachability and error messages such as echo requests and destination-unreachable notices, and it has no identity role at all.

Correct answer: OAuth, restricted application grants

OAuth exists precisely so an application can act on a resource owner's behalf without ever seeing the password: the user approves a limited scope, and the application receives a token that carries only that scope and can be revoked later. Kerberos issues encrypted tickets inside a realm to prove who a principal is, which authenticates a session rather than handing a stranger's app a narrow slice of someone's data. RADIUS centralizes account checks for network and remote-access equipment. SAML passes signed assertions so a site can trust a sign-in, establishing identity rather than granting scoped reach into stored photos.

Correct answer: OIDC, standardized profile claims

OIDC sits on top of OAuth 2.0 and adds what OAuth deliberately leaves out: a signed ID token plus a standard set of claims describing the end user, so the application learns who signed in as well as what the caller is allowed to reach. IPsec protects packets between two network endpoints and says nothing about who the human is. LDAP answers queries against a directory tree; an application can look a person up there, but no signed assertion is produced for it to trust. SCIM automates creating, updating and deleting accounts across systems, which is provisioning rather than sign-in.

Correct answer: SSO, multi-application logon reuse

SSO, multi-application logon reuse, is the capability described: one morning authentication is accepted by email, HR and expense applications for the rest of the day. FIM is wrong because federation shares identities across separate organizations or domains, not among one company's internal apps. IdP is wrong because the identity provider is the central service that issues identity assertions to each application, not the capability of reusing its login. MFA is wrong because it adds verification factors to a login rather than letting one login be reused.

Correct answer: RBAC, position-based privilege bundles

RBAC, position-based privilege bundles, is role-based access control: permissions are attached to a job function and a person gains them by being placed in that role. ABAC could read a position attribute, but it evaluates policies over many attributes per request rather than granting access through membership in a named role. RuBAC applies administrator-written rules, such as time-of-day or source restrictions, to every user alike regardless of job. DAC lets the owner of each resource decide who gets access, so rights would follow the owner's choices rather than the job title.

Correct answer: ABAC, policy-driven attribute evaluation

ABAC writes access as policy over attributes, so the decision engine can weigh the requester's department, the posture of the device, the hour of the request and the classification of the resource together, and the answer can differ from one request to the next. RBAC can only ask which role someone holds, so device state and time of day are outside what it can express. MAC compares a fixed clearance against a fixed label and ignores dynamic conditions. DAC leaves the decision with the resource owner, who is not evaluating compliance state at request time.

Correct answer: RBAC follows a granted job role, while ABAC weighs subject, resource and environment status

The real difference is what each model is allowed to look at. RBAC resolves a request by asking which job function the person holds and what that function may do, while ABAC evaluates a policy over attributes of the subject, the resource and the surrounding environment, which is why it can express fine-grained, context-sensitive rules. Clearance labels belong to mandatory access control and a directory listing of owner-set rights to discretionary access control, so neither pairing describes these two models. Backup catalogues, cabling and page templates are not inputs either model can evaluate.

Correct answer: DAC, owner-assigned privilege entries

DAC is the model in which the person who owns an object controls its access list, which is exactly what happens when the creator of a folder decides who else may read or write it. MAC would take that choice away: the system compares a label it assigned against a clearance, and the owner cannot widen it. RBAC would tie the rights to a job function, so membership of a role rather than the creator's preference would decide. ABAC would evaluate conditions such as device posture or time at the moment of the request, none of which the folder creator is setting.

Correct answer: MAC, kernel-enforced label restrictions

MAC is enforced by the system itself: each object carries a sensitivity label, each subject carries a clearance, and the operating system compares them on every request, so neither the owner nor the user can widen access. DAC does the opposite by handing that decision to the owner of the object. RBAC decides from the job function a person holds, which classified systems still use for administration but which is not what the clearance comparison here describes. ABAC evaluates dynamic conditions in policy rather than enforcing a fixed classification hierarchy.

Correct answer: Least privilege policy

A least privilege policy grants each account only the permissions strictly necessary for its job and nothing more, which is exactly what the stem describes. An implicit deny access policy blocks any request that no rule explicitly allows; it governs unmatched traffic, not how many rights an account holds. A role-based access policy assigns permissions by job role, but a role can still carry far more rights than the work needs, so it is a model, not the minimising principle. Just-in-time access limits WHEN elevated rights exist, not how narrowly they are scoped.

Correct answer: Separation of duties

Separation of duties breaks a sensitive process into steps held by different people, so initiating a payment and approving it are never in the same pair of hands and fraud would require collusion. Retention of records keeps evidence of what happened for a defined period; it supports an investigation afterwards but leaves one clerk able to finish the transfer today. Escalation of alerts routes a suspicious event to a higher tier of responders, which is a monitoring path rather than a division of the work itself. Validation of inputs checks that submitted data is well formed and never asks who submitted it.

Correct answer: PAM, monitored administrative checkout

PAM is the discipline built around administrative accounts: the credential lives in a vault, an administrator draws it for a defined window, the whole session is recorded for later review, and the password is changed once the window closes so a copied secret is worthless. SSO removes repeated logins for ordinary applications and grants no elevated rights. MFA strengthens how any account proves itself but does not vault, time-box or rotate anything. DLP examines content leaving the organization and has no role in issuing or auditing administrative credentials.

Correct answer: Shadow IT, because unmanaged services sidestep patching and monitoring

Shadow IT, because unmanaged services sidestep patching and monitoring, is correct: the team adopted a cloud tool without IT's knowledge or approval, so nobody secures, logs or offboards it. An insider threat requires an employee to misuse legitimate access with harmful intent, and these staff are only trying to collaborate. Third-party risk concerns vendors the organization has vetted and contracted, whereas this service was never approved at all. BYOD risk concerns personal devices under mobile device management, and the scenario is about an unsanctioned cloud service, not devices.

Correct answer: The MITRE ATT&CK reference collection

MITRE ATT&CK is the curated, publicly maintained body of adversary tactics and techniques, each with a stable identifier, which is why analysts use it to describe what an intruder did in language another team will read the same way. OWASP publishes the widely cited list of common web application weaknesses, which describes coding flaws rather than intruder behavior. The PCI requirements govern how cardholder data must be handled by merchants. The ISO/IEC quality management series concerns how an organization runs quality processes and has nothing to do with intrusions.

Correct answer: FIM, unauthorized modification detection

FIM takes a cryptographic fingerprint of the files that matter, stores it as a baseline, and re-computes it on a schedule, so any edit to a binary or a configuration file that nobody approved shows up as a mismatch and raises an alert. NTP keeps clocks aligned so that timestamps across systems can be compared; it inspects no files. DLP examines content on its way out of the organization and cares about where data is going rather than whether a system file was altered. CASB governs how users reach cloud services and sees nothing on the host.

Correct answer: Log aggregation

Aggregation is the act of bringing records from hundreds of separate sources into a single store, which is what makes a cross-system search or correlation possible at all. Compression shrinks the space those records occupy and changes nothing about where they live. Obfuscation deliberately hides field values so a reader cannot recover the original detail, which works against an analyst trying to investigate. Attestation proves a stored record has not been altered since it was written, a valuable integrity property that still leaves the records scattered across every device that produced them.

Correct answer: Security baseline

A security baseline is the documented, approved configuration every new server must match: the required settings, permitted services and mandatory security parameters, and the yardstick later drift is measured against. A security policy states high-level management intent and rules, not per-server settings. A vendor hardening guide is the manufacturer's published recommendation, which the team may draw on but which is not its own approved standard. A CIS hardening guide is likewise an external benchmark of suggested settings; the baseline is the organization's approved configuration built from such sources.

Correct answer: Patch management

Patch management is the full lifecycle of identifying missing updates, testing fixes, scheduling deployment, and verifying installation on a regular cadence. Change management approves and records changes of every kind but does not find missing updates itself. Configuration management maintains secure baselines and settings rather than tracking vendor fixes. Asset management inventories hardware and software, which feeds patching but does not test or deploy anything.

Correct answer: Digital forensics

Digital forensics is the discipline that identifies, collects, preserves, analyzes and reports on digital evidence in a way that keeps its integrity for legal proceedings. Incident response is the broader process of detecting, containing and recovering from a breach, and it calls on forensics rather than being it. E-discovery is the legal process of identifying and producing electronically stored information for litigation, not analyzing a breach. Chain of custody is the record of who handled evidence, one control within forensics rather than the discipline.

Correct answer: Incident containment

Incident containment is the phase that limits the spread and impact of an active incident, for example by isolating an infected host from the network. Incident remediation fixes the underlying weakness after the threat is removed rather than stopping its spread. Incident escalation passes the incident to a higher authority or team and does not itself limit damage. Incident detection identifies that an incident is occurring and comes before any action to restrict it.

Correct answer: Documenting findings to improve later responses

Documenting findings to improve later responses is the lessons learned activity: after the incident closes, the team reviews what happened and updates plans, playbooks and controls. Documenting evidence to keep a chain of custody is a forensic task during the response. Documenting affected hosts to scope eradication happens while the incident is still being handled. Documenting baselines to catch future anomalies is preparation and detection work, not a post-incident review.

Correct answer: Incident preparation

Writing the IR plan, assembling the team and training staff before anything happens is incident preparation, the first phase of the incident response lifecycle. A post-incident review, or lessons learned, happens after an incident and may revise the plan, but it cannot come before any incident occurs. Disaster recovery planning prepares for restoring IT after a major outage, which is a separate plan from the incident response phases. Incident recovery planning concerns restoring systems once a threat has been eradicated, which is later in the lifecycle.

Correct answer: Service restoration

Correct answer: service restoration. Recovery is the phase that rebuilds or restores affected systems from clean backups, validates that they function correctly and returns them to production under close monitoring for signs that the threat has returned. Malware eradication is the step that has already been completed in this scenario. Network containment isolated the systems earlier, before the threat was removed. Evidence collection preserves artifacts and restores no service.

Correct answer: Incident eradication

Incident eradication is the phase that removes the cause entirely: deleting malicious files, disabling breached accounts and closing exploited vulnerabilities. Incident recovery follows eradication and returns cleaned systems to production. Incident isolation is a containment action that stops the spread but leaves the malicious artifacts in place. Incident sanitization is not a response phase; sanitization refers to wiping storage media so data cannot be recovered before reuse or disposal.

Correct answer: Tabletop exercise

This is a tabletop exercise: the response team sits around a table and talks through roles, decisions and dependencies for a hypothetical scenario, so the plan is validated without touching production. A simulation exercise acts out the incident with injected events and live tools. A workshop exercise is a discussion session aimed at producing a deliverable such as a plan or policy, not walking through a response. A functional exercise exercises real operations and systems in a controlled setting.

Correct answer: To record the evidence handlers with precise times

Chain of custody exists to record the evidence handlers with precise times: every person who collected, accessed, transferred or stored an item, and when, so the evidence can be shown untampered and stays admissible. Preserving evidence from routine purge cycles is a legal hold. Capturing evidence in order of volatility is the collection sequence, not a handling record. Imaging through a hardware write blocker protects the original during acquisition but documents nobody who handled it.

Correct answer: Order of volatility

Correct answer: order of volatility. The order of volatility ranks evidence sources by how quickly they disappear, so CPU registers, cache, RAM and network state are captured before disk images and archived logs, because the volatile sources are lost the moment power or connectivity changes. Rules of engagement define the scope and limits of an authorized test. Chain of possession documents who handled evidence, not the sequence in which sources are captured. A right of inspection is a contractual clause permitting review of a partner's controls.

Correct answer: Litigation hold

The directive is a litigation hold, also called a legal hold, which suspends normal deletion so records relevant to anticipated or pending litigation are preserved. A retention policy is the standing schedule for keeping and destroying records and is not triggered by a lawsuit. Chain of custody documents who handled evidence after it is collected. E-discovery is the wider process of identifying and producing electronic records, not the instruction to stop deleting them.

Correct answer: A harmless action wrongly reported as hostile

A false positive is a harmless action wrongly reported as hostile: an alert fires on benign activity, and a high volume of them causes alert fatigue that makes analysts dismiss real detections. A real intrusion that sensors wrongly ignored is a false negative. A harmless event the sensors rightly ignored is a true negative. A real intrusion that sensors rightly flagged is a true positive, a correct detection.

Correct answer: A breach slipping past deployed detection systems

A breach slipping past deployed detection systems is a false negative: real malicious activity occurred and the tool generated no alert at all, which lets the compromise continue unnoticed. A breach alert drowning in floods of false alarms describes alert fatigue, where an alert existed but was missed by analysts. A breach alert raised, then closed without triage is a process failure after a true positive. A breach alert raised late by the detection tools is delayed detection, yet the stem says no alert was ever generated.

Correct answer: Baselining

Baselining records what normal looks like for a system or network, such as typical traffic volumes, login times and resource use, so monitoring can compare live activity against it and flag anomalies. Heuristics judge a file or behavior by suspicious traits, not against a recorded norm for that environment. Benchmarking compares a configuration with a hardening standard such as a CIS benchmark, which defines secure settings rather than normal activity. Normalization converts logs from different sources into a common format for a SIEM, which is about data structure, not what typical behavior looks like.

Correct answer: Continuous monitoring

Correct answer: continuous monitoring. Continuous monitoring is the ongoing automated assessment of systems, configurations and controls against required standards, giving near real-time visibility into posture and flagging drift as soon as it appears. Quarterly attestation samples compliance at four points a year and leaves long blind windows between them. Periodic snapshotting preserves recoverable copies of state and evaluates no control. Automated remediation corrects findings after they have been raised rather than performing the evaluation itself.

Correct answer: SNMP

Correct answer: SNMP. The Simple Network Management Protocol polls device health and performance data from routers, switches and servers, and in versions 1 and 2c the community string that authorizes those reads travels in cleartext, which is why SNMPv3 with authentication and privacy is required. ICMP carries reachability and error messages, not device metrics. LDAP queries a directory. SMTP transports mail between servers.

Correct answer: An IDS reports suspected packets passively while an IPS blocks them inline

An IDS reports suspected packets passively while an IPS blocks them inline: the detection system watches a copy of the traffic and alerts, while the prevention system sits in the path and can drop or reset a session. Signature matching and baseline anomaly detection are methods both systems use, so neither pairing separates them. Both come in host-based and network-based forms, so scope is not the difference either.

Correct answer: Implicit deny

The catch-all rule at the bottom that refuses anything not permitted earlier is implicit deny. An explicit deny is a written rule that blocks named traffic, such as a specific address or port, rather than everything left over. Fail-closed describes how a device behaves when it crashes or loses power, blocking traffic instead of passing it. Secure by default is a broad design principle for shipping hardened settings, not the name of the final firewall rule.

Correct answer: Next-generation firewall

Correct answer: next-generation firewall. An NGFW adds application awareness, user identity from the directory, deep packet inspection and an integrated intrusion prevention engine on top of traditional firewall functions, so policy can name an application and a user rather than a port. A packet-filtered firewall decides only on addresses, ports and protocol flags. A screened-subnet firewall describes a DMZ topology rather than an inspection capability. A perimeter-based firewall names where the device sits, not how deeply it inspects.

Correct answer: Content filtering

Blocking employee web requests by URL category, such as gambling or malware hosting, is content filtering, typically enforced by a proxy or secure web gateway. Packet filtering permits or drops traffic by IP address, port and protocol, and it cannot tell a gambling URL from any other site on the same port. Stateful packet filtering adds connection tracking to those same address and port rules, so it still never sorts destinations into acceptable use categories. A web app firewall protects the organization's own web applications from inbound attacks, not employees' outbound browsing.

Correct answer: DNS sinkholing

A DNS sinkhole answers a lookup for a known-malicious domain with a controlled address or a refusal, so the client never learns where the real host is and the session is never opened. DNS forwarding only hands a query to another resolver to answer. DNS delegation points a subdomain at a different authoritative server. DNS validation checks the DNSSEC signatures on a response, which proves the answer was not tampered with but says nothing about whether the domain is malicious.

Correct answer: To prove the message came from an authorised sender

SPF lists the hosts allowed to send for the domain, DKIM signs the message so a receiver can check that signature against a key published in DNS, and DMARC ties the two together with a policy the domain owner publishes. Their combined job is authenticating the sending domain, which is what removes the value from spoofed mail. Shrinking a message is a transport optimisation. Keeping copies for a retention period is archiving. Encrypting the body protects confidentiality, and an encrypted message can still carry a forged sender address.

Correct answer: Deleting the unused services on a new host

Deleting the unused services on a new host is the hardening practice that removes unnecessary software, services and accounts, so less code listens and fewer credentials exist to attack. Blocking inbound ports at the firewall filters traffic but leaves the software installed and running. Updating the running services on the image patches flaws without removing anything. Limiting the service accounts on the image reduces their privileges but keeps those accounts in place.

Correct answer: To stop logins that use known default passwords

Changing or disabling vendor default credentials serves to stop logins that use known default passwords, because those usernames and passwords are published in manuals and public lists. Stopping default services that run on open ports is a separate hardening step, disabling unneeded services, and a changed password leaves those services running. Stopping admin passwords that cross in cleartext requires encrypted management protocols such as SSH or HTTPS, since even a new password is readable on the wire. Stopping admin sessions that cross in cleartext likewise depends on encrypting the session, not on which password was set.

Correct answer: A hardened baseline the servers must match

A hardened baseline the servers must match is the approved secure configuration that configuration management compares production against, correcting any drift so every server stays in a known-good state. A golden image is the template new servers are cloned from at build time; it does not continuously check or correct running servers. A patch level covers only which updates are installed, not the full secure configuration. A patch window is the scheduled maintenance period for restarts, a timing control rather than a configuration standard.

Correct answer: BYOD

BYOD is the deployment model in which employees use personally owned devices for work, which is why separating corporate from personal data and managing hardware the company does not own are the hard problems. COSU is a corporate-owned, single-use device locked to one task. MDM is mobile device management, the tool used to enforce policy on devices, not a model of who owns them. MAM is mobile application management, which controls corporate apps and data and is often used with BYOD but is not itself the deployment model.

Correct answer: MDM

MDM enrols phones and tablets and pushes policy to them centrally: encryption requirements, passcode rules, application restrictions and remote lock or wipe. DLP inspects content to stop sensitive data leaving, but it does not enrol or configure a device. NAC decides whether a device is admitted to the network. EDR watches endpoint process behaviour for attacks and supports response. None of the three enforces a device configuration policy across a mobile fleet.

Correct answer: Shredding the drive into small metal chips

Shredding the drive into small metal chips physically destroys the media, which is why it guarantees the data cannot be recovered. Degaussing the drive under a strong magnet is a purge method, not physical destruction, and it has no effect on flash-based SSDs. Drilling a hole through the drive's casing damages the enclosure but can leave platter surfaces readable. Smashing the drive's controller board flat destroys only the electronics, so the platters or flash chips can be moved to a working board and read.

Correct answer: A private work profile inside the device

Containerization puts corporate apps and data in an encrypted, isolated work profile that the organization manages and can wipe on its own, while the user's personal content stays outside it and untouched. A shared network link is tethering, which lends the handset's connection to other devices. A fixed zone perimeter is geofencing, which triggers actions based on where the device is. Releasing the provider lock is carrier unlocking, which frees the handset for another network. None of the three separates work data from personal data.

Correct answer: Ordering the findings by the greatest risk

Prioritisation is the analysis step between finding and fixing: severity, exploitability, asset criticality and exposure are weighed together so limited remediation capacity goes to the vulnerabilities that carry the most risk. Sending findings to a queue is ticketing, which moves work without ranking it. Checking after a patch runs is remediation validation, which happens once a fix is already applied. Archiving preserves evidence for auditors. None of the three decides what gets fixed first.

Correct answer: CVSS

CVSS is the open standard that scores a vulnerability from 0.0 to 10.0 out of its exploitability and impact metrics, so findings from different tools can be compared and ranked consistently. An SBOM is an inventory of the components inside a piece of software. A SIEM collects and correlates log data for detection and investigation. SOAR automates response workflows. None of the three produces a severity rating for a vulnerability.

Correct answer: False positive

A false positive is a finding the scanner reports that is not actually present or exploitable on the target, which is why results are validated before remediation. A false negative is the reverse: a real flaw the scan misses. A true negative correctly reports no flaw where none exists. A true positive is a reported flaw that really is there.

Correct answer: Signing off the risk formally as it stands

Signing off the risk formally as it stands is risk acceptance: management knowingly keeps the unremediated weakness and records its approval, often as a documented exception. Passing the risk to an insurer by contract is transference, which shifts the financial consequence but not the flaw. Deferring the fix to a later change window still plans remediation, whereas this organization has decided it will not fix the issue. Offsetting the risk with an added control is mitigation through a compensating control, which reduces the exposure instead of accepting it as it is.

Correct answer: A scan that signs in with issued credentials

A scan that signs in with issued credentials is a credentialed scan: it logs on to the target and reads patch levels, installed packages and configuration directly, which gives the insider view and fewer false positives. A scan that runs inside the local network is an internal scan, which changes where the scanner sits but still probes unauthenticated. A scan that uses an agent on each local host is agent-based scanning, which relies on installed software rather than login credentials handed to the scanner. A scan that tries vendor default credentials is a non-credentialed check for weak logins, not an authenticated assessment.

Correct answer: A code the app derives from the clock

TOTP combines a shared secret with the current time, so the authenticator app and the server compute the same value independently and it expires within a fixed interval, leaving a captured code useless moments later. A code kept for months is a static password, reusable by anyone who steals it. A code read out of a chip describes a smart card or token, which proves possession with no time element. A code held per site in a vault is a password manager entry, stored rather than regenerated.

Correct answer: Rights that expire when the short window ends

Just-in-time access grants elevated permissions only for the interval they are needed and revokes them automatically when it closes, so no standing administrative privilege sits on the account waiting to be abused. Rights that widen as someone moves between teams is privilege creep, the accumulation this control exists to prevent. Rights bounded by office hours are time-of-day restrictions, which limit when a standing permission works. Rights renewed at an annual review are periodic recertification, far too slow to be the mechanism described.

Correct answer: A rule that rejects the last few passwords

Password history is a rule that rejects the last few passwords: the system remembers a set number of prior passwords and refuses any match, so a user cannot cycle straight back to a recent one. A rule that rejects changes within one day is minimum password age, which supports history by stopping rapid cycling but remembers nothing itself. A rule that rejects any breached passwords checks a blocklist of compromised values, not the user's own prior ones. A rule that rejects passwords past 90 days is maximum password age, which forces a change but does not refuse reuse.