scenario questions

Which TWO deployment methods or modes are commonly used to collect traffic for a Network Intrusion Detection System (NIDS)? (Choose TWO)

An organization is developing a threat hunting hypothesis based on MITRE ATT&CK technique T1078 (Valid Accounts). Which hunting query methodology best aligns with detecting this technique?

An organization is hardening its network architecture against supply chain attacks targeting third-party software dependencies and vendor integrations. Which TWO best practices and controls should be implemented? (Choose TWO)

A security administrator is configuring a corporate proxy server (Squid) to inspect outbound HTTPS traffic from endpoints. To perform SSL interception (Man-in-the-Middle inspection) for content filtering and DLP, what cryptographic setup must be installed on client workstations?

A security team is conducting a routine audit of endpoint security compliance. Which TWO artifacts should the auditors inspect to verify that antivirus and endpoint detection and response (EDR) agents are functioning correctly across all workstations? (Choose two)

A network engineer is configuring a Linux firewall using nftables and needs to create a table for packet filtering, add a base chain for incoming traffic on the input hook, and set the default policy to drop. Which command sequence accomplishes this?

A security architect is designing an enterprise threat hunting program. Which TWO activities are considered core, proactive components of a mature threat hunting methodology rather than standard automated alerting? (Choose two)

A network security analyst is investigating an intrusion where an attacker used living-off-the-land binaries (LotLBeins). The analyst needs to inspect Windows PowerShell script block logging events. Which Windows Event Log channel and Event ID contain the full text of executed script blocks?

Which network device operates at Layer 3 and Layer 4 to inspect packet headers and make dynamic forwarding decisions based on established connection states?

A security analyst is reviewing IIS 10 web server logs and notices numerous requests attempting path traversal using URL-encoded characters such as '%2e%2e%2f'. Which built-in IIS feature or security tool should be configured to automatically block such requests?

During an incident response engagement, a security analyst discovers that an attacker executed a Server-Side Request Forgery (SSRF) vulnerability on an internal web application to access cloud instance metadata services (IMDS). Which remediation step should be applied immediately to the cloud application architecture to prevent future SSRF exploitation against IMDS?

During the preparation and detection phases of incident response, a CND analyst must gather and analyze multiple sources of telemetry to identify the root cause of a suspected breach. Which THREE data sources are typically classified as network-based telemetry rather than host-based telemetry? (Choose three)

A network security engineer wants to deploy a perimeter defense mechanism that acts as a decoy system, purposely loaded with vulnerabilities to lure attackers away from production assets and collect telemetry on their tactics. What is this technology called?

A security analyst is reviewing endpoint telemetry for signs of lateral movement and credential dumping. Which THREE of the following event log indicators or telemetry artifacts suggest potential credential dumping activity targeting LSASS? (Choose THREE)

A SOC analyst reviewing perimeter firewall logs notices a high volume of inbound TCP SYN packets with randomized source IP addresses targeting multiple open ports on a public-facing web server, and the server's connection table is nearly exhausted. The organization wants to stop this activity at the network edge without blocking legitimate clients. Which solution should the analyst recommend?

A network administrator is configuring an intrusion prevention system (IPS) and needs to understand how signature-based and anomaly-based detection engines operate. Which TWO statements accurately describe anomaly-based IPS detection? (Choose two)

A security administrator needs to configure Windows Defender Firewall with Advanced Security via Group Policy Object (GPO) to block all outbound connections except those explicitly permitted by a rule. Where should the administrator configure this setting?

An organization is designing a redundant network architecture to prevent single points of failure at the gateway level. Which THREE protocols or features are commonly used to provide gateway redundancy and high availability for default routers or firewalls? (Choose three)

An organization's web application is vulnerable to SQL injection (SQLi). An attacker is using union-based queries to extract database contents. Which defensive technology placed in front of the web application can inspect HTTP parameters and block SQLi signatures dynamically?

An enterprise security policy dictates that all sensitive data at rest on laptops must be cryptographically protected. Which technology should the network administrator ensure is deployed and active on all corporate mobile endpoints?

An intelligence-driven security team is utilizing the Diamond Model of Intrusion Analysis to track a sophisticated campaign. The team has identified the specific infrastructure used by the adversary to host malicious payloads. In the context of the Diamond Model, how is 'Infrastructure' classified?

A corporate network is segmented into multiple zones. The security policy dictates that the Finance department subnet must be completely isolated from the Guest Wi-Fi subnet, and traffic between them must pass through a security device enforcing access control lists. Where should this security device be placed?

A CND analyst is investigating a breach where the attacker exfiltrated data over DNS queries to an external authoritative server. The analyst wants to detect similar activity in the future by monitoring DNS traffic for anomalous patterns. Which of the following is the MOST effective indicator to monitor for DNS tunneling?

An organization is evaluating methods to secure data in transit across public networks. Which TWO cryptographic protocols or mechanisms provide secure communication channels?

An organization wants to protect internal workstations by deploying a host-based firewall that evaluates inbound and outbound connection requests based on application executable names rather than just IP addresses and port numbers. Which Windows built-in security feature provides this capability?

A security auditor is evaluating an organization's change management process for network firewall rule modifications. Which control deficiency represents the highest risk to network availability and security posture?

An enterprise security engineer needs to analyze VPC traffic flows in AWS to identify anomalous outbound communication from internal EC2 instances to unknown external IP addresses. Which AWS feature should be enabled and analyzed?

An administrator is configuring Mobile Device Management (MDM) for corporate tablets. Which TWO of the following security policies are standard capabilities enforceable via MDM? (Choose TWO)

An administrator is configuring Microsoft BitLocker Drive Encryption on a Windows Server 2019 machine. Which TWO authentication methods are natively supported by BitLocker for operating system volume startup protection?

An enterprise network administrator is troubleshooting persistent packet drops at the perimeter firewall. Which THREE diagnostic tools or commands are most effective for identifying where and why traffic is being dropped? (Choose THREE)

During an incident, a network defender needs to collect volatile evidence from a compromised Linux server before shutting it down. Which of the following commands should be used to capture the current network connections and listening ports?

A cloud security specialist is hardening a Google Cloud Storage bucket. The enterprise requirement mandates that once an object is written, it cannot be modified or deleted by any user, including root administrators, for a compliance retention period of 5 years. Which GCP storage feature must be configured?

A security analyst is investigating a suspected lateral movement attempt using Pass-the-Hash. Which Windows Security Event Log ID should the analyst examine to detect authentication via NTLM hash rather than plaintext password?

An enterprise security architect is configuring database security controls in Microsoft SQL Server 2019. Which THREE native features should be implemented to ensure comprehensive data protection and auditing?

An administrator notices unusual traffic volume exiting an internal server toward an unknown external IP address on TCP port 4443. Further investigation reveals data exfiltration. Which firewall feature should be configured at the perimeter to inspect and block unauthorized outbound application traffic and unknown protocols?

A security analyst is reviewing logs from a host-based Intrusion Prevention System (HIPS). The system successfully identified and blocked an injection attack by terminating the offending process instantly. What type of proactive preventive action did the HIPS execute?

An incident responder in a Security Operations Center notices recurring failed login attempts followed by a successful root login on an SSH server. The administrator needs to identify the first phase of the incident response lifecycle according to NIST SP 800-61. Which action should be performed first?

A company suspects that an insider is using a DNS tunneling tool to exfiltrate small amounts of sensitive data through the corporate recursive resolver. The tool encodes data in the leftmost labels of queries to a domain the company does not own. Which detection approach is most likely to reveal this activity on existing network telemetry?

An enterprise cloud security architect is hardening an Azure Kubernetes Service (AKS) cluster. The requirement is to ensure that node-to-node communication within the cluster is encrypted in transit. Which feature must be enabled during cluster creation or configuration?

An organization's security policy states that all remote administrators must connect via an encrypted tunnel. Which protocol implementation satisfies this policy during command-line switch administration?

A network security engineer is deploying a new e-commerce web farm behind an Application Delivery Controller in the screened subnet. The organization requires that inbound HTTPS sessions be terminated and re-encrypted to the backend web servers, that the ADC validate client certificates, and that the ADC block HTTP requests containing SQL injection patterns before they reach the servers. Which capability must the ADC provide to meet these requirements?

A network defender is reviewing logs from a Cisco IOS router and notices numerous ICMP echo requests with varying source IP addresses and large payloads. The defender suspects an ICMP tunneling attack. Which of the following is the BEST method to confirm and analyze this activity?

A security administrator is evaluating Mobile Threat Defense (MTD) solutions for corporate Android devices. The administrator needs a solution that can detect rogue Wi-Fi access points and Man-in-the-Middle (MitM) attacks at the network layer. Which capability must the MTD solution provide?

An enterprise security team is implementing ISO/IEC 27035 for incident management. During the 'Planning and Preparation' phase, which activity must be completed to ensure effective governance when a major network breach occurs?

A security team is implementing defense-in-depth controls to protect an enterprise wireless network against advanced attacks. Which TWO advanced hardening and security configurations should be deployed? (Choose TWO)

An organization is implementing cloud security posture management (CSPM) for its multi-cloud environment. The security team needs to ensure that Amazon S3 storage buckets are not publicly accessible due to misconfigurations. Which automated preventive control should be enforced?

An enterprise is conducting a third-party security audit using the CIS Controls v8 framework. The audit scope includes CIS Control 4: 'Continuous Vulnerability Management'. Which activity must the network defense team demonstrate to achieve full compliance with this control?

An organization is adopting the NIST Cybersecurity Framework (CSF) v2.0. The security team is executing activities under the 'Govern (GV)' function, specifically establishing cybersecurity supply chain risk management processes. Which NIST SP 800-53 revision 5 control family primarily addresses this governance requirement?

An enterprise IT security team wants to monitor AWS API calls and receive alerts whenever an unauthorized user attempts to modify critical IAM policies or security group rules. Which combination of AWS services should be configured?

A hospital's network team observes that a single internal host is flooding the Layer 2 CAM table of an access switch with thousands of frames, each carrying a different source MAC address. As a result, the switch begins flooding all unicast traffic out of every port, allowing the attacker to capture traffic destined for other hosts. Which attack is being executed, and which countermeasure most directly addresses it?

A security administrator is configuring Azure Network Security Groups (NSGs) to protect a multi-tier application. Which rule evaluation principle does Azure apply when processing network traffic through an NSG?

A security compliance officer is reviewing firewall change management tickets. Which step is mandatory in the change management lifecycle before deploying a firewall rule modification into the production environment?

A penetration tester is evaluating a web application built on Node.js and discovers that user objects passed into an administrative function are vulnerable to prototype pollution. Which remediation strategy should the development team apply to prevent this vulnerability?

Which TWO features are commonly found in Enterprise Next-Generation Firewalls (NGFW) that distinguish them from traditional stateful inspection firewalls? (Choose TWO)

A network defender is analyzing threat intelligence feeds to understand the tactics, techniques, and procedures (TTPs) of an adversary. The intelligence provides detailed campaign histories and adversary motivations. Which level of threat intelligence does this represent?

A security engineer needs to configure secure log management and transmission from edge firewalls and switches to a centralized SIEM server. Which TWO protocols or features ensure that log data is transmitted securely and integrally across the network? (Choose two)

An organization is deploying a Data Loss Prevention (DLP) solution to protect sensitive intellectual property. Which TWO locations or data states must a comprehensive DLP architecture monitor?

A security engineer is performing a security audit on an enterprise PostgreSQL database server. Which THREE hardening steps should be implemented to secure database access and data at rest?

An incident handler receives an alert from Snort regarding a potential SQL injection attack against a web application. The alert shows a signature matching 'SELECT * FROM users WHERE'. Which type of detection methodology is Snort primarily utilizing in this scenario?

An enterprise Security Operations Center is integrating a Security Orchestration, Automation, and Response (SOAR) platform. Which THREE tasks are primary use cases for SOAR in incident response? (Choose THREE)

An enterprise is deploying an IPsec site-to-site VPN. The security team wants to ensure that if an attacker captures today's encrypted network traffic, they cannot decrypt it even if they eventually compromise the long-term preshared keys or private keys used during the initial key exchange. What cryptographic property must be enforced?

A security administrator is preparing a security baseline for iOS and iPadOS devices using an MDM solution. To protect corporate data at rest on managed mobile devices, which setting must be verified?

An organization is deploying an Intrusion Prevention System (IPS) in an enterprise data center. To minimize latency and avoid becoming a single point of failure that disrupts network uptime if the hardware fails, the engineering team chooses a specific deployment topology. Which deployment option provides inline inspection with hardware-level bypass capability?

An enterprise administrator needs to configure AWS Security Hub to automatically ingest and centralize security findings across all organizational accounts in AWS. Which service must be enabled first to create the organizational management structure before enabling Security Hub?

A security architect is designing network access control for a campus LAN. The requirement is to authenticate users and devices, assign VLANs dynamically based on identity, and quarantine non-compliant endpoints before granting production access. Which combination of protocols and features should the architect implement?

An organization is deploying ISO/IEC 27001 as its primary information security framework. The Chief Information Security Officer (CISO) needs to ensure that the Statement of Applicability (SoA) accurately reflects the selected security controls and justifies any exclusions. Which activity must the network defense team perform first to satisfy this compliance requirement?

A security analyst is investigating an EDR alert where a process spawned a suspicious child process. The analyst needs to review the process lineage tree. Which EDR capability is most useful for this task?

What is the primary purpose of deploying a Network Intrusion Detection System (NIDS) in promiscuous mode on a perimeter switch span/mirror port?

A wireless security audit reveals that an unauthorized rogue access point has been deployed within the corporate perimeter, configured with the exact same SSID as the corporate enterprise network to perform an evil twin attack. Which enterprise wireless feature should the network administrator configure on the Wireless LAN Controller (WLC) to automatically detect and contain this rogue AP?

An organization is implementing virtual network segmentation in an enterprise Azure environment. The requirement is to inspect all inter-subnet traffic between different virtual networks (East-West traffic) using centralized next-generation firewalls. Which Azure networking architecture should be deployed?

An auditor is reviewing an enterprise Azure environment and wants to ensure that all Azure Storage accounts enforce encryption of data at rest using customer-managed keys (CMK) stored in a secure hardware security module. Which Azure service should be integrated with Storage Accounts?

An enterprise network security team is analyzing BGP routing anomalies at the internet edge. An attacker is attempting to inject malicious routing updates to hijack corporate IP space (BGP prefix hijacking). Which mechanism should the network edge routers implement to cryptographically verify the origin autonomy of IP prefixes?

An organization needs to implement a mandatory framework that governs the classification, handling, and disposal of sensitive corporate data. Which policy type should the network security administrator draft first to establish baseline expectations?

An administrator needs to configure Microsoft BitLocker Drive Encryption via Group Policy to require a startup PIN on a Trusted Platform Module (TPM) equipped system. Which specific policy path must be navigated in the Local Group Policy Editor?

An enterprise network defense team is establishing the first phase of the Network Defense Lifecycle Management process. Which primary activity must occur during the initial 'Assessment and Analysis' phase?

A network administrator needs to deploy a security device that inspects inbound HTTP and HTTPS traffic at the application layer and drops requests containing SQL injection signatures before they reach the web server. Which device should the administrator deploy?

An enterprise incident response team is analyzing a ransomware attack that encrypted network file shares and endpoints. Which TWO immediate containment and eradication actions should the team execute? (Choose TWO)

A GCP cloud security team is auditing a Kubernetes cluster running in Google Kubernetes Engine (GKE). Which THREE security hardening steps should be verified to ensure robust cluster security? (Choose THREE)

An enterprise endpoint security policy requires that all USB mass storage devices be blocked on workstations, while allowing encrypted company-issued smart cards and input devices. Which configuration approach should an administrator take using Group Policy?

An incident response team is performing eradication after a ransomware outbreak. The team has removed the persistent malware service and patched the entry-point vulnerability. What is the next immediate phase in the NIST SP 800-61 lifecycle?

During a comprehensive security audit of an enterprise network, the auditor discovers that system event logs are being purged every 7 days due to disk space constraints. However, corporate compliance requires retaining security audit logs for a minimum of 365 days. Which governance framework control failure has occurred?

An IoT device deployed in an industrial environment runs a minimal Linux kernel and needs its attack surface reduced by disabling unnecessary kernel modules like USB storage and Bluetooth. Where should the administrator configure module blacklisting?

A security architect is designing a high-security perimeter utilizing a dual-firewall DMZ architecture (back-to-back firewalls). Which traffic flow configuration best implements security best practices between the external router, perimeter firewall, DMZ, and internal firewall?

A network security administrator is configuring intrusion detection systems. Which TWO operational benefits does anomaly-based detection offer compared to signature-based detection? (Choose TWO)

A security analyst is configuring a Palo Alto Networks firewall and needs to configure a security rule that inspects web-browsing traffic for known malware signatures and prevents vulnerability exploits. Where within the security rule base should this threat profile be attached?

An organization's Endpoint Detection and Response (EDR) platform flags a suspicious PowerShell command line executing an encoded script block. Which Windows logging subsystem should the security analyst inspect for the decoded script contents?

An organization's security engineer is configuring a Web Application Firewall (WAF) to protect against common web attacks. Which TWO attack types should the WAF rules be specifically tuned to detect and block? (Choose TWO)

A security administrator is deploying a Microsoft Azure Virtual Network and needs to ensure that all outbound traffic from a specific subnet to the public internet is filtered using fully qualified domain name (FQDN) rules rather than IP addresses. Which Azure resource should be deployed to achieve this?

An organization is establishing forensic readiness to ensure that digital evidence can be legally and technically sound during an investigation. Which THREE practices directly contribute to organizational forensic readiness? (Choose three)

Which TWO of the following are characteristics of a honeynet compared to a standard honeypot? (Choose TWO)

An enterprise administrator is configuring Azure Storage security. Which TWO features should be enabled to ensure comprehensive protection against data exfiltration and unauthorized access? (Choose TWO)

A security team is reviewing perimeter firewall logs and observes that an external host is sending TCP segments with the FIN flag set but no prior SYN, and also sending TCP segments with both SYN and FIN flags set simultaneously. The firewall is stateful and currently drops these packets. Which statement best describes what the attacker is attempting and the correct defensive interpretation?

A security architect is configuring Linux Unified Key Setup (LUKS) disk encryption on enterprise laptops. To ensure that the encryption key can be decrypted automatically during boot via a Trusted Platform Module (TPM) 2.0 chip without manual passphrase entry, which tool should be integrated?

A GCP cloud administrator is setting up Cloud VPN to connect an on-premises datacenter to a GCP VPC. Which TWO components must be configured to establish a functional High Availability (HA) VPN gateway? (Choose TWO)

A threat intelligence team is gathering data from open and closed sources. Which TWO options represent sources of open-source intelligence (OSINT) commonly used by network defenders? (Choose TWO)

A security analyst at a financial firm is reviewing endpoint telemetry and observes a process named 'svchost.exe' with an unusual parent process and a command line containing a Base64-encoded string. The analyst suspects a fileless attack leveraging a built-in Windows utility. Which of the following endpoint detection techniques is MOST effective for identifying this type of malicious activity?

An organization's security team is deploying an EDR agent across corporate endpoints. During testing, the agent's kernel-mode driver causes a Blue Screen of Death (BSOD) during boot on systems running a third-party disk encryption filter driver. Which administrative action should be taken first to isolate and remediate the driver conflict?

An enterprise security team is hardening an Azure environment. Which THREE actions should be implemented to secure Azure Virtual Machines and management planes? (Choose THREE)

A small business wants to secure its web application against SQL injection without modifying application code. The application uses a MySQL database and receives user input through web forms. Which defensive measure should be implemented at the database layer to reduce the impact of SQL injection attacks?

A security administrator is deploying a Mobile Device Management (MDM) solution for corporate-owned Android devices. The administrator needs to ensure that if a device is lost or stolen, corporate data can be remotely wiped while preserving the user's personal data. Which of the following MDM capabilities should the administrator implement?

An enterprise security architect is designing a Zero Trust network segmentation model. Which THREE core principles are foundational to Zero Trust architecture regarding network access and device verification? (Choose three)

Which TWO of the following characteristics accurately differentiate a Next-Generation Firewall (NGFW) from a traditional stateless or stateful inspection firewall? (Choose two)

A network engineer is configuring an OpenVPN server in TUN mode for remote workers. What is the fundamental characteristic of TUN mode compared to TAP mode regarding network layer operation?

A security analyst observes that an internal host is generating excessive DNS queries containing encoded data within subdomains, indicative of a DNS tunneling attack. The network perimeter firewall allows outbound DNS traffic on UDP port 53 to any external IP. Which network security control should be implemented to mitigate this threat?

A company's intrusion detection system (IDS) flags multiple suspicious packets containing shellcode signatures destined for an internal database server. However, the security team determines that the application was updated and the traffic was a false positive. Which action should the security analyst take within the Snort configuration to prevent this specific signature from generating future alerts?

A CND engineer is preparing for an external PCI-DSS v4.0 compliance audit for the cardholder data environment (CDE). To satisfy Requirement 11.3 regarding penetration testing, how frequently must external network penetration testing be conducted according to the standard?

An enterprise is reviewing its Disaster Recovery (DR) and Business Continuity (BC) policies. During a risk assessment, the team calculates the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for critical database systems. Which THREE factors directly influence these metrics? (Choose three)

A security engineer is hardening a corporate Linux server against privilege escalation. A local user account executes a poorly written binary with the SUID (Set Owner User ID) permission set, gaining root privileges. Which command should the engineer run to locate and remove SUID permissions from unauthorized binaries across the filesystem?

A security analyst reviewing firewall logs notices periodic outbound connections from an internal engineering workstation to a small set of foreign IP addresses, always at roughly 60-second intervals, with payload sizes that vary slightly and destinations that rotate through a hardcoded list. The traffic uses TCP port 443 but the TLS certificate presented by the remote endpoint is self-signed and the User-Agent string is unusual. Which technique is most consistent with these observations?

An organization is aligning its defenses with the NIST SP 800-53 Rev. 5 'Access Control (AC)' control family. Which THREE controls are core requirements within this family? (Choose three)

A security analyst is auditing an AWS environment and needs to identify which IAM users or roles have assumed administrative privileges across AWS accounts using AWS CloudTrail. Which event source and name should the analyst search for?

A cloud security engineer is configuring a Google Cloud VPC firewall rule to allow traffic from an on-premises network to a specific subnet. The engineer wants to restrict access to only a set of known IP addresses. Which Google Cloud firewall rule component should the engineer use to define these IP addresses?

A network engineer is troubleshooting an enterprise Next-Generation Firewall (NGFW) and notices that encrypted HTTPS traffic is bypassing Deep Packet Inspection (DPI) signatures. What feature must be configured on the NGFW to inspect the payload of these encrypted sessions?

During containment of a worm outbreak, an incident response team decides to isolate an infected subnet from the rest of the corporate network. Which containment strategy does this represent?

A security engineer is designing a segmented network perimeter using a traditional three-tier architecture. Which zone should house public-facing web servers and mail relay servers, ensuring they are isolated from both the internal trusted LAN and the public internet via distinct firewall contexts?

An organization is utilizing PostgreSQL to store sensitive customer records and needs to implement Transparent Data Encryption (TDE) for data at rest. Which core native PostgreSQL mechanism or extension should the Database Administrator configure?

An administrator is deploying Windows Server Update Services (WSUS) for internal patch management. Which TWO of the following tasks are essential for maintaining a healthy WSUS environment? (Choose TWO)

A security architect is configuring an enterprise-grade Application Layer Gateway (ALG) stateful firewall to inspect active FTP data channels. The firewall must dynamically open ephemeral ports for incoming data connections based on control channel negotiations. Which firewall configuration mechanism must be enabled to support this behavior?

A systems administrator needs to secure data at rest on an enterprise Linux server by encrypting an entire secondary disk partition (e.g., /dev/sdb1) using LUKS (Linux Unified Key Setup). Which command should be executed first to initialize the encrypted partition?

When designing a secure network perimeter, what is the term used for breaking a large network into smaller, isolated subnetworks to contain breaches and control lateral movement?

A security architect is designing a Linux endpoint hardening baseline. Which THREE of the following configurations help enforce Mandatory Access Control (MAC) and restrict process privileges? (Choose THREE)

A network defender is configuring an enterprise SIEM using Splunk to alert on abnormal outbound data volumes. Which Splunk processing command should be used to aggregate total outbound bytes grouped by destination IP address?

A threat hunter is searching for persistence mechanisms on a Windows system and needs to check Autoruns data. Which registry hive contains user-specific startup application entries?

An organization's Security Information and Event Management (SIEM) system alerts on suspicious Active Directory enumeration activity. An internal workstation is executing frequent unauthenticated LDAP queries requesting large numbers of user and group attributes. Which protocol mechanism and defensive configuration should be implemented to mitigate this reconnaissance technique?

An enterprise security architect is deploying Digital Guardian DLP to protect intellectual property on Windows endpoints. An employee attempts to upload proprietary source code to a personal cloud storage provider via a web browser. Which DLP component intercepts this action at the browser level?

An enterprise administrator is setting up an AWS Site-to-Site VPN connection between an on-premises data center and an AWS VPC. To ensure maximum data confidentiality and integrity across the public internet, which IPsec cryptographic parameters should be enforced in the VPN tunnel configuration?

A network engineer is configuring TLS 1.3 on an enterprise load balancer. During cipher suite selection, the engineer observes that cipher suites like TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 are no longer listed in the configuration menu. What is the primary reason for this change in TLS 1.3?

An enterprise security engineer is investigating potential AWS IAM privilege escalation paths and misconfigurations. Which TWO AWS IAM actions or conditions represent known high-risk misconfigurations that can lead to privilege escalation? (Choose TWO)

An enterprise environment uses Microsoft Endpoint Configuration Manager (MECM) for patch management. An administrator needs to ensure that critical patches are installed on workstations with minimal user disruption outside of active hours. Which MECM feature should be configured?

A security engineer is hardening a GCP environment and needs to ensure that compute instances cannot be accessed directly via SSH from the public internet, even if they have external IP addresses. Which mechanism should be implemented?

An enterprise wishes to align its security management practices with the NIST Cybersecurity Framework (CSF). The security team is currently categorizing assets, establishing governance policies, and conducting risk assessments. Which NIST CSF core function are they executing?

An enterprise application stores user passwords in a PostgreSQL database. To comply with modern cryptographic standards, which hashing algorithm configuration should the database administrator verify is in use to ensure strong password protection against offline brute-force attacks?

An incident response team is performing disk forensics on an NTFS-formatted hard drive. The analyst needs to recover deleted files that were too large to fit in the Recycle Bin. Which internal NTFS metadata structure contains file record attributes including timestamps, permissions, and resident/non-resident data locations?

A security engineer is tasked with restricting network access to a sensitive database server so that only the application server VLAN can communicate with it on TCP port 1433. The database server is hosted on a virtualized hypervisor switch. Where should this micro-segmentation control be implemented for optimal enforcement?

An organization is designing a perimeter architecture with two firewalls from different vendors placed in series between the internet and the internal network. A security architect argues this dual-vendor design improves defense in depth. Which statement best describes a realistic operational consideration of this design?

An enterprise cloud architect is designing multi-region disaster recovery for Azure Virtual Machines. The requirement is to replicate virtual machine disks asynchronously across regions without keeping secondary VMs running constantly. Which Azure service feature should be utilized?

An incident responder identifies a compromised workstation and determines that isolating the machine from the network is necessary. Which tool native to Windows allows an administrator to block all inbound and outbound network traffic except for pre-configured exceptions?

An incident responder is investigating a suspected malware infection on a Windows machine. The malware is suspected of injecting code into a legitimate running process (Process Hollowing). Which THREE techniques or forensic artifacts should the analyst investigate to detect process injection? (Choose THREE)

A security analyst is preparing to harden a fleet of corporate Windows 10 endpoints against pass-the-hash attacks. Which built-in Windows feature should be enabled and configured to isolate LSASS memory using virtualization?

A security manager is designing a comprehensive security governance program for a multinational financial institution. Which TWO activities are fundamental responsibilities of security governance? (Choose TWO)

An organization is establishing a secure software development lifecycle (SSDLC) policy. At which specific phase should threat modeling be formally integrated to identify architectural security flaws prior to coding?

A network security engineer needs to configure a Linux-based iptables firewall to drop all incoming TCP packets that have the SYN flag set while the FIN flag is also set, which is a common malformed packet attack vector. Which iptables command should the engineer use?

An attacker compromises an internal workstation and attempts to perform lateral movement using PsExec. The security team wants to detect and block this activity across the internal Windows domain. Which Windows Defender Firewall with Advanced Security rule or Group Policy setting should be deployed?

An organization is hardening its perimeter firewall configuration against reconnaissance and volumetric attacks. Which THREE best practices should be implemented? (Choose THREE)

A security manager is designing a network access control (NAC) governance policy. The policy states that endpoints failing compliance checks (e.g., outdated antivirus definitions) must be quarantined. To which isolated network segment should these non-compliant endpoints be automatically assigned?

Which TWO configuration steps are typically required when deploying a firewall in Transparent (Layer 2) mode rather than Routed (Layer 3) mode? (Choose TWO)

A security analyst is hardening an enterprise Microsoft Exchange email server and needs to prevent Server-Side Request Forgery (SSRF) and insecure deserialization attacks targeting Exchange web components. Which security control or update management practice is most critical?

An incident responder is investigating a suspected data exfiltration incident over encrypted channels. Which THREE network artifacts or telemetry sources should the analyst inspect to identify malicious TLS traffic anomalies? (Choose THREE)

An organization is setting up a high-availability perimeter firewall pair. Which protocol is commonly utilized to provide seamless failover by sharing a virtual IP address between the active and standby firewalls?

A security engineer is evaluating a network intrusion prevention system (NIPS) that must inspect traffic flowing between two internal VLANs at 10 Gbps. The requirement is to detect and block exploits without introducing asymmetric routing, and the device must remain transparent to Layer 2 and Layer 3 topologies. Which deployment mode should the engineer choose?

A security engineer is configuring a Web Application Firewall (WAF) to protect an online banking portal. The WAF must detect and drop HTTP requests containing patterns typical of SQL injection attacks before they reach the web server. What category of WAF protection rule is being utilized?

An organization's security team is designing a defense-in-depth network architecture to protect critical internal data zones. Which THREE architectural principles and controls should be implemented to align with an adaptive defense strategy? (Choose THREE)

An enterprise security team needs to deploy a Snort rule that detects an HTTP GET request containing a specific directory traversal string (../../etc/passwd). Which rule header and options structure correctly formats this signature?

A security engineer is configuring a Snort Intrusion Prevention System (IPS) rule to detect ICMP echo requests with payloads larger than 1000 bytes, which may indicate covert channel data exfiltration. Which rule header and options combination is correct?

A CND engineer is preparing for an internal audit of the organization's security awareness program. The auditor wants evidence that employees can recognize and report phishing attempts. Which artifact BEST demonstrates the effectiveness of the program?

An organization is enforcing device hardening standards across all corporate laptops. Which TWO of the following controls should be implemented to secure client endpoints against physical and BIOS/UEFI tampering? (Choose TWO)

A security team receives alerts indicating that an attacker is performing ARP cache poisoning on the local subnet to conduct a Man-in-the-Middle (MitM) attack. Which switch feature should the network administrator enable to mitigate this threat?

An enterprise network administrator needs to enforce data loss prevention rules across corporate endpoints. They deploy McAfee Data Loss Prevention Endpoint. Which client component inspects and blocks data movement to USB mass storage devices locally on the workstation?

An organization wants to deploy a low-interaction honeypot within its DMZ network to detect unauthorized reconnaissance activity, scanning, and basic service probing without risking the compromise of an actual operating system. Which tool is best suited for this requirement?

When deploying an Intrusion Prevention System (IPS) in an inline network architecture, which THREE critical operational factors must security engineers evaluate to prevent network disruption? (Choose THREE)

An enterprise database administrator is configuring Microsoft SQL Server Always On Availability Groups and needs to ensure that database traffic transmitted between replicas across the network is encrypted. Which configuration setting must be enabled?

An incident response investigator is analyzing a Linux server compromised via a web shell. To determine when the web shell file was last accessed or modified, the investigator examines file timestamps. Which Linux command displays the complete file status including access, modification, and change (mtime, atime, ctime) times?

During a network security audit, the compliance officer evaluates the organization's security metrics program. Which THREE metrics are considered best practice indicators of security governance effectiveness? (Choose THREE)

A security analyst is deploying Snort IDS to inspect incoming web traffic and needs to write a rule that triggers when the HTTP URI contains the exact string 'admin_login.php' regardless of case. Which Snort rule option modifier accomplishes this?

A network administrator is configuring automated compliance auditing using OpenSCAP. Which standard data format must be utilized to write machine-readable vulnerability and security configuration checklists for the SCAP scanner?

Which type of firewall inspects traffic at the application layer (Layer 7) and understands specific application protocols like HTTP, FTP, or SIP to make granular filtering decisions?

A security team is deploying a Microsoft Azure environment with a hub-and-spoke virtual network topology. They need to inspect all traffic between spoke virtual networks and the on-premises datacenter for intrusion detection. Traffic must be forced through a third-party network virtual appliance (NVA) hosted in the hub VNet. Which Azure feature should they configure on the spoke subnets to ensure this traffic redirection occurs?

A cloud security team is reviewing GCP VPC configurations. To ensure that virtual machine instances without external IP addresses can still reach Google APIs and services (such as Cloud Storage and BigQuery) securely, which feature must be configured?

An organization is hardening its public-facing email infrastructure against spoofing and phishing attacks. The security engineer needs to configure a DNS record that specifies which mail servers are authorized to send email on behalf of the domain. Which DNS record type must be created?

During a network security audit, the auditor requests evidence that the principle of least privilege is enforced for administrative access to core network infrastructure routers. Which artifact should the network administrator provide to demonstrate compliance?

An enterprise cloud security architect is hardening an AWS environment to protect against unauthorized data exfiltration from S3 buckets. Which TWO preventative security measures should be implemented? (Choose TWO)

An administrator managing an enterprise AWS environment wants to ensure that all newly created S3 buckets across all accounts automatically block public access. Which feature should be configured at the AWS account level?

An incident handler needs to preserve the evidentiary integrity of a hard drive seized from a compromised web server. Which initial step must be performed immediately upon physical removal of the drive to ensure chain of custody?

A security analyst configuring Endpoint Detection and Response (EDR) behavioral rules needs to monitor for living-off-the-land binaries (LotLB) executing reconnaissance commands. Which legitimate Windows utility is frequently abused by attackers for network discovery and should be monitored?

A CND analyst is reviewing endpoint hardening for a fleet of Windows 11 laptops that use BitLocker with TPM 2.0. The organization wants to prevent an attacker with brief physical access from booting the machine from removable media or reaching a recovery prompt to extract the drive. Which pre-boot control should the analyst verify is enabled in UEFI firmware?

A retail company's security team is designing defenses against Distributed Denial of Service (DDoS) attacks targeting its public web tier. The team wants to reduce the impact of volumetric floods while preserving legitimate customer traffic. Which THREE measures are appropriate components of the defense strategy? (Choose three.)

A financial services company stores customer records in a Microsoft SQL Server 2019 database. A security administrator must ensure that sensitive columns such as credit card numbers are encrypted at rest and that even a database administrator with full server access cannot read the plaintext values without an additional secret. Which SQL Server feature should be implemented to meet this requirement?

An Azure cloud administrator needs to secure communication channels between on-premises datacenters and Azure Virtual Networks. Which TWO connectivity methods provide encrypted, secure transit over public or private connections? (Choose TWO)

A security engineer is reviewing the phases of the Network Defense Lifecycle. Which THREE stages are recognized core components of this lifecycle? (Choose THREE)

A security analyst is hardening an Apache HTTP Server against web attacks. Which TWO directives or modules should be configured to enhance application security and mitigate common web threats?

A security analyst is reviewing alerts generated by an Endpoint Detection and Response (EDR) agent. The agent flags a process spawning cmd.exe with encoded arguments. Which phase of incident response involves triaging this alert to determine if it is a true positive?

An organization deploys an inline Intrusion Prevention System (IPS) that begins dropping legitimate business-critical transactions due to false positives caused by a custom application protocol. What is the most appropriate immediate action for the security team while maintaining perimeter visibility?

A CND analyst is configuring Snort IDS to detect a specific payload pattern within HTTP traffic where an attacker attempts to exploit a directory traversal vulnerability using the string '../'. Which Snort rule header and option configuration correctly detects this pattern within the URI component of HTTP requests?

A network security analyst observes an ongoing brute-force attack against an SSH service running on a Linux server. Which tool can the analyst configure to automatically inspect authentication failure logs and dynamically block attacker IP addresses via iptables?

An enterprise network administrator needs to place a publicly accessible web server on the network perimeter. Which network zone should the administrator configure to isolate this server from the internal corporate network while keeping it accessible from the internet?

A network security administrator is establishing baseline security hardening for newly deployed enterprise switches. Which TWO configurations must be applied to secure management planes? (Choose two)

A security analyst is reviewing network traffic logs and discovers indicators of an Advanced Persistent Threat (APT) utilizing covert command-and-control (C2) communication. Which TWO methods are commonly used by attackers to obfuscate C2 traffic through legitimate network services? (Choose TWO)

An enterprise security architect is integrating the Cyber Kill Chain model into their SIEM alerting logic. An alert fires when an attacker attempts to establish command and control (C2) over DNS tunneling. According to Lockheed Martin's Cyber Kill Chain, which phase does this represent?

An administrator needs to segment an internal network into multiple Virtual LANs (VLANs) to isolate the finance department from human resources. Which IEEE standard protocol must be configured on the interconnecting switch trunk ports to tag frames belonging to different VLANs?

A network engineer is configuring IPsec site-to-site VPN policies. During Phase 2 negotiations, which TWO parameters must match identically on both VPN peers for the security association (SA) to establish successfully? (Choose two)

A security analyst is investigating a compromised network segment and discovers that an attacker bypassed network perimeter access controls by tunneling malicious command-and-control traffic through allowed protocols. Which THREE protocols are most commonly abused for covert data exfiltration and tunneling through corporate firewalls? (Choose three)

A security analyst is hardening an enterprise network to support robust forensic readiness. Which THREE administrative or technical controls should be implemented to ensure successful post-incident investigations? (Choose THREE)

An administrator wants to ensure that critical system files on Windows endpoints are automatically monitored for unauthorized modifications and that any changes trigger an alert. Which built-in Windows tool or feature should be utilized?

An administrator is managing mobile devices via an Enterprise Mobility Management (EMM) platform. Which TWO of the following features are characteristic of a Containerized Work Profile (such as Android Enterprise)? (Choose TWO)

A security engineer is deploying an inline NIPS appliance between the perimeter firewall and the internal core switch. During testing, legitimate TCP sessions from branch offices are being reset mid-transfer, and packet captures show the sensor injecting RST packets to both endpoints. Which configuration change will most directly stop the NIPS from breaking these legitimate flows?

A network security engineer is tasked with securing corporate Wi-Fi clients against Evil Twin attacks where an attacker sets up a fake access point with identical SSID parameters. Which enterprise wireless security practice effectively mitigates client association to fake APs?

A security engineer is configuring a firewall to prevent IP address spoofing from the external untrusted interface. Which built-in routing/firewall feature checks the source IP address of incoming packets against the routing table to verify that the packet arrived on the interface expected for that source network?

A network administrator is configuring a wireless intrusion prevention system (WIPS) to detect and mitigate rogue access points in an enterprise. The administrator needs to ensure that the WIPS can identify and classify access points that are not authorized. Which TWO techniques should the administrator enable? (Choose two.)

A security architect is designing a Zero Trust Architecture (ZTA) framework in accordance with NIST SP 800-207. Which THREE core tenets must be incorporated into the network defense strategy? (Choose three)

Which TWO methods are commonly used by Intrusion Detection and Prevention Systems (IDPS) to identify malicious network traffic? (Choose TWO)

An incident responder is investigating a Windows system compromise where an attacker established persistence. Which THREE Windows registry locations are frequently abused by adversaries for establishing auto-run persistence? (Choose THREE)

Which TWO of the following are primary benefits of implementing network segmentation at an enterprise perimeter? (Choose TWO)

A security engineer discovers that an attacker is exploiting a vulnerability in a web application's JSON Web Token (JWT) implementation by modifying the algorithm header to 'none' and bypassing signature verification. How should the application's JWT validation code be updated to fix this vulnerability?

A security engineer is configuring a Symantec Data Loss Prevention (DLP) Network Monitor policy to intercept outgoing HTTP traffic containing credit card numbers. Which detection technology should be selected to match standard credit card formats using Luhn algorithm validation?

A CND engineer is implementing continuous network defense monitoring for a demilitarized zone that hosts public web servers. The team wants to detect both network-level and host-level anomalies in near real time. Which TWO technologies should be deployed to meet this requirement? (Choose two.)

A security analyst configuring a Linux-based iptables firewall wants to ensure that any established or related incoming TCP connections are automatically allowed through without hitting subsequent rule checks. Which target and match extension combination should be used?

A healthcare organization is implementing a data loss prevention (DLP) program for endpoints running Windows 10. The security team wants to prevent protected health information (PHI) from leaving the organization through email and removable media. Which TWO controls should be enabled in a Microsoft Defender for Endpoint DLP policy to directly block these exfiltration channels? (Choose two.)

An administrator needs to enforce mandatory password complexity, minimum length, and account lockout policies for local user accounts on standalone Windows Server endpoints that are not joined to an Active Directory domain. Which tool should be used?

An application security team is performing static code analysis on a Java Spring Boot web application. The scanner flags a potential SQL injection vulnerability in a JDBC template query. Which remediation method should the developer implement to secure the database interaction?

An organization is implementing comprehensive endpoint hardening for Windows 10/11 endpoints. Which THREE of the following measures directly contribute to reducing the attack surface against memory-based exploits and credential theft? (Choose THREE)

A system administrator is hardening a fleet of Linux servers by setting strict umask values for all users to ensure newly created files are not readable by others. Where should this default system-wide umask be configured?

A CND analyst is conducting a security audit of network device configurations. The audit checklist requires verifying that AAA (Authentication, Authorization, and Accounting) protocols are properly implemented. Which protocol combination represents the industry standard for centralized network device administration?

An organization is following the Network Defense Lifecycle. After successfully designing and implementing perimeter security controls, the security manager moves to the 'Monitor and Evaluate' phase. Which task is characteristic of this phase?

A network administrator is setting up a secure remote management channel for Linux servers across the public internet. The security policy mandates that Telnet must not be used. Which protocol should be implemented?

A company is developing its network security governance structure. Who holds the ultimate legal and fiduciary responsibility for an organization's overall information security posture and risk management decisions?

A security analyst notices unusual outbound traffic matching command-and-control (C2) beaconing patterns over HTTPS. The organization wants to inspect outbound encrypted traffic to detect malicious payloads without violating compliance policies. Which enterprise security architecture technique should be implemented?

A network defense manager is deploying a SIEM solution and needs to map incoming logs to the MITRE ATT&CK framework. Which benefit does this mapping provide for network defense lifecycle management?

An Incident Response team is investigating a Linux server where a persistent backdoor is suspected of hiding process IDs (PIDs) using user-space hooks. Which utility should the responder use to compare process lists returned by the kernel system call table against direct kernel memory inspection?

A security analyst suspects that an internal host has been compromised and is communicating via an encrypted Command and Control (C2) channel utilizing DNS tunneling. Which Wireshark filter and analysis technique should the analyst employ to definitively identify this anomaly?

Which protocol is commonly used to securely manage network perimeter devices via an encrypted command-line interface instead of plaintext Telnet?

An attacker performs a TCP SYN flood attack against a perimeter web server protected by a firewall. The security engineer enables SYN cookies on the firewall/router. How does this feature mitigate the attack?

An incident responder is analyzing a memory dump using Volatility 3. To list all active network sockets and connections present in the captured memory image, which Volatility plugin should the analyst execute?

A security engineer is hardening an industrial IoT gateway running Linux. Which THREE of the following steps are recognized hardening practices for securing embedded Linux IoT endpoints? (Choose THREE)

An enterprise cloud security team is reviewing common cloud security vulnerabilities and misconfigurations that lead to data breaches. Which TWO threats are primary vectors in cloud environments? (Choose TWO)

A network administrator is configuring a high-availability pair of firewalls in active/passive mode using virtual router redundancy protocol (VRRP). During a failover event, active TCP sessions drop, forcing users to re-authenticate to internal applications. Which firewall feature must be enabled to maintain stateful session continuity across the failover?

A network administrator suspects that an unauthorized rogue access point is operating within the enterprise office environment, spoofing the corporate SSID to capture user credentials. Which tool or technique should be used to detect and locate the physical source of the rogue AP?

An organization is utilizing Google Cloud Platform (GCP) and needs to restrict network traffic between specific Google Kubernetes Engine (GKE) pods based on labels rather than IP addresses. Which GCP security feature should be configured?

During an incident triage meeting, a network defender needs to determine the appropriate containment actions for a compromised web server. Which TWO factors should be evaluated when selecting a containment strategy? (Choose TWO)

A security architect is designing a defense-in-depth strategy for a multi-tier web application. To adhere to the principle of least privilege within network defense lifecycle management, how should firewall rules be structured between the DMZ and the internal application tier?

An enterprise security team is reviewing the components of a robust Information Security Policy framework. Which TWO policy documents are considered foundational sub-policies under this governance umbrella? (Choose two)

An organization is drafting a remote work security policy. Which TWO technical controls must remote employees utilize when accessing internal corporate resources from home? (Choose two)

A security analyst is reviewing an application that stores user passwords in a database. The analyst finds that passwords are hashed with SHA-256 and a unique salt per user. The organization wants to increase resistance to offline brute-force attacks using GPUs. Which change should the analyst recommend?

An organization is setting up a threat hunting program. Which TWO characteristics differentiate proactive threat hunting from traditional reactive Security Operations Center (SOC) monitoring? (Choose TWO)

An administrator is hardening a Linux system against privilege escalation via SUID binaries. The administrator wants to find all files on the root partition that have the SUID bit set. Which find command should be executed?

A security architect is designing a high-security DMZ architecture. Public-facing web servers must be isolated from the internal database servers, and an intermediary inspection zone is required. Which design pattern should the architect implement?

A security architect is designing a secure DMZ architecture utilizing multiple security zones on a firewall. Which THREE design principles should guide the implementation? (Choose THREE)

During a threat hunting exercise, an analyst uses Microsoft Defender for Endpoint to query device process creation events. Which Kusto Query Language (KQL) operator filters a table to include only rows where the file name matches 'cmd.exe'?

An attacker performs a cross-site scripting (XSS) attack against a web application, successfully stealing sensitive session cookies from victim browsers. The security team is tasked with updating the application's cookie configuration attributes. Which two cookie flags must be set to protect session cookies against theft via XSS and network sniffing?

A security analyst is reviewing indicators of compromise (IoCs) shared by an ISAC. The indicators include file hashes and IP addresses. Which open-source framework is specifically designed to structure, store, and share threat intelligence in a machine-readable format?

During a post-incident forensic investigation, an analyst needs to establish cryptographic proof that an acquired disk image has not been altered or tampered with since collection. Which tool and command parameter combination is standard for generating a cryptographically secure hash of the evidence file?

A cloud architect is designing network security controls for multi-tier applications hosted in AWS. Which THREE AWS services and features are used to enforce network isolation and traffic filtering? (Choose THREE)

A security engineer is configuring a Next-Generation Firewall (NGFW) to perform deep packet inspection (DPI) on encrypted TLS traffic. Due to privacy regulations, specific internal banking applications must be excluded from SSL decryption. How should the engineer configure the firewall to bypass decryption for these specific destinations without disabling overall inspection?

A security engineer is hardening a fleet of Windows 10 endpoints against credential theft. The engineer wants to prevent attackers from extracting plaintext passwords or NTLM hashes from memory. Which of the following Windows features should the engineer enable to achieve this goal?

An enterprise is securing its enterprise wireless infrastructure against unauthorized devices and wireless sniffing. Which THREE administrative and technical controls should be implemented? (Choose THREE)

An enterprise security auditor is reviewing an Elasticsearch cluster configuration. To prevent unauthorized access to stored indices containing sensitive PII and financial records, which authentication and transport layer security (TLS) settings must be enforced?

Which TWO of the following deployment scenarios or features are commonly associated with Network Intrusion Prevention Systems (NIPS)? (Choose two)

A software developer is writing a Python Flask web application that accepts file uploads from users. To prevent arbitrary file upload vulnerabilities leading to Remote Code Execution (RCE), which validation procedure must the developer implement?

A CND analyst at a healthcare provider is asked to classify a new data set containing patient appointment notes, physician referrals, and insurance billing codes. The organization follows a four-tier internal classification scheme (Public, Internal, Confidential, Restricted). Which classification level BEST fits this data set?

A security administrator is hardening a corporate perimeter router and wants to protect the router's control plane against CPU exhaustion attacks from external flooding. Which feature should be implemented?

A network security engineer is designing a secure enterprise wireless network architecture to mitigate modern wireless attacks. Which THREE security configurations and protocols should be mandated? (Choose THREE)

A small business wants to prevent employees from accessing known malicious websites and to log all outbound web requests for later review. The administrator has no budget for a full next-generation firewall and wants a solution that can be deployed as a transparent bridge without changing client IP configurations. Which perimeter control best fits these requirements?

A network defender is hardening a perimeter firewall to resist evasion techniques that manipulate packet fragmentation and TCP options. Which TWO measures should be implemented to improve the firewall's ability to correctly reassemble and inspect fragmented traffic? (Choose two.)

A cloud security auditor is reviewing a Google Cloud Platform (GCP) project for identity and access management hygiene. Which TWO security practices should be enforced to prevent unauthorized privilege escalation and credential theft? (Choose TWO)

A cybersecurity architect is designing an enterprise Data Loss Prevention (DLP) deployment strategy across endpoint, network, and storage vectors. Which THREE technical capabilities are standard functions of enterprise storage discovery DLP tools?

An enterprise is implementing Zero Trust Network Access (ZTNA) for remote workers accessing cloud-hosted virtual desktops in Azure. To ensure that user identity, device compliance, and location risk are evaluated before establishing a network session, which Azure service integration should be deployed?

A network administrator is implementing defense-in-depth measures against ARP spoofing and man-in-the-middle attacks on a Cisco switched enterprise network. Which THREE switch security features should be enabled on access layer ports? (Choose three)

An attacker performs a pass-the-hash attack to move laterally across an enterprise network using compromised NTLM hashes. The security architecture team wants to implement host-based mitigations to render harvested NTLM hashes unusable for authentication. Which Windows security feature should be enabled?

An organization is hardening Android enterprise devices and wants to prevent users from installing applications from unknown sources while ensuring corporate apps update automatically. Which policy configuration in the EMM/MDM console achieves this?

An organization is implementing ISO/IEC 27001 Annex A controls regarding operations security. Specifically, control A.12.4.1 (Event Logging) requires event logs recording user activities, exceptions, and information security events to be produced, kept, and regularly reviewed. Which automated practice best satisfies regular log review governance?

An administrator needs to secure management access to Azure virtual machines by eliminating open management ports (such as RDP port 3389 and SSH port 22) on the public internet. Which Azure feature should be configured?

A CND analyst is deploying a centralized Security Information and Event Management (SIEM) solution. To enable proactive threat hunting and rapid incident detection across distributed network segments, what is the primary function of deploying forwarders or agents on endpoints?

An enterprise firewall is experiencing asymmetric routing where TCP SYN packets enter through Firewall A, but the return SYN-ACK packets exit through Firewall B due to dynamic routing changes. What firewall feature must be enabled to synchronize connection state tables between Firewall A and Firewall B and prevent connection drops?

A Chief Information Security Officer (CISO) needs to present an executive summary of current network risks to the board of directors. Which metric is most effective for communicating financial exposure resulting from potential network security breaches?

An attacker targets an enterprise Active Directory domain by performing a DCSync attack, successfully replicating domain controller password data without being a domain controller. Which Active Directory access control rights must be audited and protected to prevent non-administrative users from executing DCSync?

An incident responder needs to capture a forensically sound image of a Windows workstation's disk. Which command-line tool can create a bit-stream disk image while calculating a cryptographic hash simultaneously?

A security analyst needs to configure Snort to generate an alert whenever an inbound packet matches a specific rule condition, without blocking the traffic. Which rule action keyword should be used in the Snort configuration file?

An organization is conducting a mandatory security audit for PCI-DSS compliance regarding its cardholder data environment (CDE). The auditor asks for proof of network segmentation. What should the network security administrator present?

An enterprise is drafting an Acceptable Use Policy (AUP) for employee internet and device usage. Which element is essential to include in the policy document to ensure enforceability?

An organization is establishing forensic readiness for critical database servers. Which technical control directly supports forensic readiness by ensuring volatile RAM contents can be preserved during a suspected live kernel attack?

A security team is conducting a penetration test against a corporate network and attempts a Man-in-the-Middle (MitM) attack using ICMP redirection and IPv6 Router Advertisement (RA) spoofing. Which THREE network controls effectively mitigate these specific local network redirection attacks? (Choose three)

An organization is experiencing a ransomware outbreak on an endpoint. The Incident Response team decides to immediately disconnect the infected machine from the network without shutting it down, in order to preserve volatile memory. Which EDR feature should the responder trigger?

An attacker on the same wireless network as a corporate user sets up a rogue access point that broadcasts the same SSID as the legitimate corporate network and offers a stronger signal. Users connect automatically, and the attacker captures their credentials through a fake captive portal. Which attack has been performed?

A security manager is updating the corporate Acceptable Use Policy (AUP). To address emerging cloud collaboration tools, which specific section should be revised to regulate employee data sharing on external platforms?

A security analyst is reviewing vulnerability assessment reports for a fleet of Windows endpoints and notes that third-party software (such as browsers and PDF readers) accounts for most missing patches. Which deployment strategy should the organization implement to streamline third-party patch management?

A CND engineer is reviewing the organization's incident response plan. The plan states that after containment and eradication, the team must validate that the affected systems are clean before restoring normal operations. Which activity BEST fulfills this validation requirement?

A security analyst is examining a memory dump from a compromised Windows 10 host. The analyst suspects that a malicious process injected code into a legitimate process. Which of the following memory analysis techniques is MOST effective for identifying injected code?

During an internal network security audit, an auditor needs to verify that administrative accounts are not sharing credentials. Which compliance artifact should the auditor inspect to validate individual accountability?

An administrator needs to configure a Linux firewall using UFW (Uncomplicated Firewall) to allow incoming SSH traffic from a specific subnet (192.168.100.0/24). Which command should be executed?

What is the primary function of a Demilitarized Zone (DMZ) bastion host?

An organization wants to secure data in transit between microservices communicating within a Kubernetes cluster. Which service mesh technology provides mutual TLS (mTLS) encryption automatically between service pods without modifying application code?

A network administrator is configuring secure remote access for employees. The security policy mandates that the remote access solution must support multi-factor authentication (MFA) and encrypt all traffic from the client device. Which TWO technologies or protocols can meet these requirements? (Choose two)

A security practitioner is deploying an intrusion prevention system (IPS) rule to detect XML External Entity (XXE) injection attacks in HTTP POST requests. Which core feature of an XML parser is being abused in an XXE attack and must be disabled?

An organization is implementing database transparent data encryption (TDE) and needs to understand its architectural security boundaries. Which THREE security characteristics or limitations are true regarding TDE?

An enterprise is deploying a zero-trust architecture for its AWS cloud workloads. Services must communicate across VPCs without exposing traffic to the public internet or traversing VPC peerings that open full subnet access. Which feature should be implemented?

An enterprise network uses an Intrusion Detection System (IDS) deployed in passive monitoring mode via a switch span port. The security operations center (SOC) notices that the IDS generates high volumes of alerts for internal vulnerability scanning activities, obscuring real attacks. Which network design modification should be implemented to reduce false positive alert fatigue without disabling the detection signatures?

A network administrator is hardening a Cisco switch infrastructure against Layer 2 attacks. Which THREE features should be enabled and configured on the access and distribution layers? (Choose THREE)

An organization's security policy requires that all remote workers connect to the corporate network via a VPN that routes all client internet traffic through the corporate data center security stack. Which type of VPN architecture must the remote client be configured to use?

An Incident Response team analyzing an enterprise endpoint discovers evidence of a fileless malware attack leveraging Windows Management Instrumentation (WMI). Which THREE of the following WMI artifacts or logging mechanisms should the investigator examine? (Choose THREE)

An organization wants to deploy a wireless intrusion prevention system (WIPS) sensor to detect unauthorized access points and rogue devices broadcasting corporate SSIDs. Where should the WIPS sensor be deployed?

An auditor is evaluating an organization's compliance with ISO/IEC 27001 Annex A physical and environmental security controls. Which THREE security measures should the auditor expect to find implemented in the primary data center? (Choose three)

A network defense administrator is reviewing security baselines using the Center for Internet Security (CIS) Benchmarks. A particular benchmark rule requires disabling the LLMNR (Link-Local Multicast Name Resolution) protocol on Windows domain member servers. Which security risk does this policy directly mitigate?

An organization implements IEEE 802.1X port-based authentication across its enterprise switch infrastructure. A new IP security camera is connected to a switch port, but it does not support 802.1X supplicant software. How should the network administrator configure the switch port to authenticate and isolate the camera securely?

An enterprise network uses VLANs to separate departments. Users in the Marketing VLAN need to access a printer located in the Sales VLAN. Which network device is strictly required to route traffic between these two distinct VLANs?

Which TWO components are standard elements of a well-designed enterprise DMZ architecture? (Choose TWO)

An organization wants to protect its internal network against unauthorized DHCP servers (DHCP spoofing and rogue DHCP starvation attacks). Which switch security feature should be enabled on all untrusted access switch ports?

An administrator needs to secure SNMP traffic on enterprise network switches so that management queries and responses are both encrypted and authenticated. Which version of SNMP must be configured?

A security engineer is performing a security audit of an enterprise firewall and discovers several misconfigurations. Which THREE of the following practices represent severe security vulnerabilities in firewall deployment? (Choose three)

An organization's security policy states that all Windows 10/11 endpoints must enforce AppLocker rules to block unauthorized executables. An administrator creates an Executable Rule allowing signed applications from a trusted software publisher, but users are still able to run unsigned tools from user-writable directories like C:\Users\Public. What is the most likely reason?

A security operations center (SOC) analyst is investigating a compromised Linux web server. Which TWO log files and forensic artifacts should the analyst examine to determine the initial access vector and persistence mechanisms used by the attacker? (Choose TWO)

A security analyst is hardening a Linux-based web server and wants to implement mandatory access control (MAC) to restrict processes to only the resources necessary for their function. Which built-in Linux kernel security module should the analyst configure?

An organization is implementing database activity monitoring (DAM) to detect unauthorized data access and SQL injection attempts against their enterprise SQL Server databases. Where should the DAM sensor ideally be placed to capture all database queries accurately without relying solely on database logs?

A network engineer is configuring an enterprise DMZ and needs to ensure proper network isolation and protection between the internet, the DMZ, and the internal corporate network. Which THREE best practices should be implemented in this architecture? (Choose three)

An enterprise application developer is implementing JSON Web Tokens (JWT) for stateless session authentication. Which implementation flaw represents the highest risk of signature forgery and unauthorized privilege escalation?

An enterprise security administrator needs to isolate a compromised AWS EC2 instance for forensic investigation without terminating the instance or losing its volatile memory state. Which action should the administrator take?

During network defense lifecycle management, a security team identifies an end-of-life operating system that no longer receives vendor security patches. Which mitigation strategy represents best practice when immediate replacement is impossible?

A security analyst is investigating a suspected malware outbreak on a domain controller. To ensure forensic integrity and maintain a proper chain of custody before powering down the machine, what is the correct sequence of volatility when acquiring volatile evidence using live response tools such as FTK Imager or LiME?

A CND analyst is conducting post-incident threat prediction after a recent breach. The analyst needs to identify which internal host initiated the most outbound connections to known malicious IP addresses over the past 72 hours to prioritize containment and predict future attack paths. Which data source and analysis technique should the analyst use?

An enterprise is updating its email security controls to prevent phishing, credential harvesting, and spoofing attacks. Which THREE protocols and DNS records should be implemented and strictly enforced? (Choose THREE)

A security administrator is hardening Linux servers against local privilege escalation and unauthorized access. Which TWO of the following configurations should be implemented? (Choose TWO)

An organization's Security Operations Center (SOC) receives an alert regarding an unusual outbound connection to a known command-and-control (C2) IP address. According to the NIST SP 800-61 Rev. 2 incident response lifecycle, which phase immediately follows the Containment, Eradication, and Recovery phase?

An organization is implementing enterprise wireless security using WPA3-Enterprise. To ensure maximum cryptographic strength and protection against downgrade attacks, which security mode and key derivation function must be enforced?