323 questions total · 5pages · All types, answers revealed
A network administrator is setting up a secure remote management channel for Linux servers across the public internet. The security policy mandates that Telnet must not be used. Which protocol should be implemented?
SSH provides strong cryptographic authentication and encryption for remote command-line administration.
A company is developing its network security governance structure. Who holds the ultimate legal and fiduciary responsibility for an organization's overall information security posture and risk management decisions?
Executive leadership and board members bear ultimate fiduciary and governance responsibility.
Why this answer
The Board of Directors and Executive Management hold ultimate accountability for enterprise risk management and governance.
A security analyst notices unusual outbound traffic matching command-and-control (C2) beaconing patterns over HTTPS. The organization wants to inspect outbound encrypted traffic to detect malicious payloads without violating compliance policies. Which enterprise security architecture technique should be implemented?
SSL inspection decrypts and inspects outbound TLS traffic for malicious payloads and C2 beacons.
A network defense manager is deploying a SIEM solution and needs to map incoming logs to the MITRE ATT&CK framework. Which benefit does this mapping provide for network defense lifecycle management?
MITRE ATT&CK provides a knowledge base of real-world adversary behavior to evaluate and improve detection controls.
Why this answer
Mapping logs to MITRE ATT&CK provides a structured taxonomy of adversary tactics and techniques, enabling precise detection engineering and gap analysis.
An Incident Response team is investigating a Linux server where a persistent backdoor is suspected of hiding process IDs (PIDs) using user-space hooks. Which utility should the responder use to compare process lists returned by the kernel system call table against direct kernel memory inspection?
unhide is a forensic tool designed to find hidden processes and ports affected by rootkits manipulating the system call table.
Why this answer
rkhunter or chkrootkit can check for hidden processes, but specialized tools like unhide directly compare ps/top outputs with direct procfs/syscall examination to detect hidden PIDs.
A security analyst suspects that an internal host has been compromised and is communicating via an encrypted Command and Control (C2) channel utilizing DNS tunneling. Which Wireshark filter and analysis technique should the analyst employ to definitively identify this anomaly?
DNS tunneling manifests as unusually long and complex query names destined for recursive resolvers.
Why this answer
DNS tunneling embeds arbitrary data within DNS queries (typically in the subdomain labels). Filtering for DNS traffic and analyzing exceptionally long query names containing high entropy or Base64-encoded strings is the standard methodology to detect DNS tunneling.
Which protocol is commonly used to securely manage network perimeter devices via an encrypted command-line interface instead of plaintext Telnet?
SSH provides cryptographic security for remote logins and command execution.
Why this answer
SSH provides a secure, encrypted channel for remote administrative access.
This prevents connection table exhaustion during a SYN flood.
Why this answer
SYN cookies allow the firewall/router to respond to SYN requests without allocating state table memory until the three-way handshake is fully completed by the client ACK.
An incident responder is analyzing a memory dump using Volatility 3. To list all active network sockets and connections present in the captured memory image, which Volatility plugin should the analyst execute?
windows.netstat is the correct Volatility 3 plugin for extracting network connection artifacts.
Why this answer
In Volatility 3, the 'windows.netstat' plugin is used to scan kernel memory structures for active network connections and sockets.
A security engineer is hardening an industrial IoT gateway running Linux. Which THREE of the following steps are recognized hardening practices for securing embedded Linux IoT endpoints? (Choose THREE)
Enabling local firewalls ensures network-level traffic restrictions even if perimeter defenses fail.
Why this answer
Hardening IoT Linux devices involves removing unnecessary packages/services, enabling firewalls (nftables/iptables), and configuring automated secure updates.
An enterprise cloud security team is reviewing common cloud security vulnerabilities and misconfigurations that lead to data breaches. Which TWO threats are primary vectors in cloud environments? (Choose TWO)
Insecure APIs expose cloud infrastructure and data to unauthorized access and exploitation.
Why this answer
According to cloud security frameworks (such as the OWASP Cloud Top 10 and CSA), Insecure APIs and Insecure IAM / Excessive Privileges are primary cloud threat vectors.
A network administrator is configuring a high-availability pair of firewalls in active/passive mode using virtual router redundancy protocol (VRRP). During a failover event, active TCP sessions drop, forcing users to re-authenticate to internal applications. Which firewall feature must be enabled to maintain stateful session continuity across the failover?
Session synchronization replicates active connection states to the standby unit so it can seamlessly take over existing TCP flows without interruption.
A network administrator suspects that an unauthorized rogue access point is operating within the enterprise office environment, spoofing the corporate SSID to capture user credentials. Which tool or technique should be used to detect and locate the physical source of the rogue AP?
WIPS continuously monitors RF spectrums and uses signal strength (RSSI) triangulation to pinpoint rogue AP locations.
Why this answer
Wireless Intrusion Prevention Systems (WIPS) analyze radio frequency spectrums, detect unauthorized APs, and use signal strength triangulation to locate them.
An organization is utilizing Google Cloud Platform (GCP) and needs to restrict network traffic between specific Google Kubernetes Engine (GKE) pods based on labels rather than IP addresses. Which GCP security feature should be configured?
Kubernetes Network Policies enable label-based firewall rules for pods inside a GKE cluster.
Why this answer
Kubernetes Network Policies implemented in GKE allow administrators to define granular traffic rules based on pod labels and namespaces.
During an incident triage meeting, a network defender needs to determine the appropriate containment actions for a compromised web server. Which TWO factors should be evaluated when selecting a containment strategy? (Choose TWO)
The cost and disruption of taking a system offline must be balanced against ongoing security risks.
Why this answer
Containment strategy decisions depend on potential business disruption, service availability requirements, and evidence preservation needs.
A security architect is designing a defense-in-depth strategy for a multi-tier web application. To adhere to the principle of least privilege within network defense lifecycle management, how should firewall rules be structured between the DMZ and the internal application tier?
An explicit allow list with a terminal deny rule enforces strict least privilege.
Why this answer
Least privilege requires dropping all traffic by default and explicitly permitting only required ports and IP addresses necessary for business operations.
An enterprise security team is reviewing the components of a robust Information Security Policy framework. Which TWO policy documents are considered foundational sub-policies under this governance umbrella? (Choose two)
The AUP defines proper employee behavior regarding corporate assets.
Why this answer
Acceptable Use Policies and Access Control Policies are foundational sub-policies that operationalize high-level information security governance.
An organization is drafting a remote work security policy. Which TWO technical controls must remote employees utilize when accessing internal corporate resources from home? (Choose two)
MFA mitigates the risk of compromised passwords.
An organization is setting up a threat hunting program. Which TWO characteristics differentiate proactive threat hunting from traditional reactive Security Operations Center (SOC) monitoring? (Choose TWO)
Threat hunting begins with forming hypotheses based on attacker TTPs.
Why this answer
Threat hunting is a proactive, hypothesis-driven pursuit of adversaries rather than waiting for automated alerts to trigger.
An administrator is hardening a Linux system against privilege escalation via SUID binaries. The administrator wants to find all files on the root partition that have the SUID bit set. Which find command should be executed?
This command searches the entire file system (/) for regular files (-type f) with the SUID bit set (-perm -4000) and suppresses permission errors.
Why this answer
The find command with -perm -4000 searches for files with the SUID permission bit set across the file system.
A security architect is designing a high-security DMZ architecture. Public-facing web servers must be isolated from the internal database servers, and an intermediary inspection zone is required. Which design pattern should the architect implement?
A three-legged firewall uses three distinct physical or logical interfaces to isolate the internal network, external network, and DMZ into separate security zones.
Why this answer
A three-legged firewall configuration (or dual-firewall DMZ architecture) places public servers in a DMZ zone separate from both the untrusted external internet and the trusted internal LAN, requiring traffic between zones to be inspected.
A security architect is designing a secure DMZ architecture utilizing multiple security zones on a firewall. Which THREE design principles should guide the implementation? (Choose THREE)
Traffic from the internet must terminate or be strictly inspected before reaching internal zones.
Why this answer
DMZ design principles include keeping public servers isolated, preventing direct transit from external to internal zones without filtering, and using least-privilege access rules.
During a threat hunting exercise, an analyst uses Microsoft Defender for Endpoint to query device process creation events. Which Kusto Query Language (KQL) operator filters a table to include only rows where the file name matches 'cmd.exe'?
The 'where' operator filters the dataset based on specified conditions.
Why this answer
The KQL 'where' operator is used to filter records based on a boolean expression.
A security analyst is reviewing indicators of compromise (IoCs) shared by an ISAC. The indicators include file hashes and IP addresses. Which open-source framework is specifically designed to structure, store, and share threat intelligence in a machine-readable format?
MISP is widely used for storing, sharing, and correlating threat intelligence and IOCs.
Why this answer
MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform designed for sharing IOCs and threat data.
A security analyst is troubleshooting an IPsec site-to-site VPN tunnel failure on a Linux-based StrongSwan gateway. The logs indicate an 'ESP packet decryption failed' error. Upon reviewing the security association parameters, the analyst notices a mismatch in the cryptographic checksum algorithm. Which IPsec protocol component is responsible for providing data integrity and authentication for the inner packet?
ESP provides integrity, authentication, and encryption services for IPsec, and its cryptographic parameters must match on both peers to avoid decryption failures.
Why this answer
The Encapsulating Security Payload (ESP) protocol provides origin authenticity, integrity, and confidentiality protection of packets. The Authentication Header (AH) provides integrity and authentication only, without confidentiality.
During a post-incident forensic investigation, an analyst needs to establish cryptographic proof that an acquired disk image has not been altered or tampered with since collection. Which tool and command parameter combination is standard for generating a cryptographically secure hash of the evidence file?
The sha256sum utility correctly computes a 256-bit cryptographic checksum of the specified evidence file to ensure integrity.
Why this answer
To verify evidence integrity, cryptographic hashing algorithms such as SHA-256 or MD5 are used. On Linux systems, the 'sha256sum' utility is standard for generating hashes to verify file integrity.
A cloud architect is designing network security controls for multi-tier applications hosted in AWS. Which THREE AWS services and features are used to enforce network isolation and traffic filtering? (Choose THREE)
Security Groups provide stateful instance-level and interface-level packet filtering.
Why this answer
Security Groups, Network ACLs (NACLs), and AWS Network Firewall provide multi-layered network isolation and traffic filtering in AWS.
A security engineer is configuring a Next-Generation Firewall (NGFW) to perform deep packet inspection (DPI) on encrypted TLS traffic. Due to privacy regulations, specific internal banking applications must be excluded from SSL decryption. How should the engineer configure the firewall to bypass decryption for these specific destinations without disabling overall inspection?
Decryption bypass lists permit specific sensitive domains to be excluded from SSL inspection while maintaining protection for other traffic.
Why this answer
NGFWs support SSL/TLS Decryption Exclusion (or SSL Decryption Profile exceptions) based on destination domain categories or specific URL lists, allowing traffic to pass encrypted while still applying Layer 7 application firewalls.
An enterprise network utilizes 802.1X port-based authentication with a RADIUS server. An attacker performs a port-stealing attack by spoofing the MAC address of an authenticated, active wired client to gain network access on a different switch port. Which switch security feature should be enabled to prevent this attack?
Port security restricts port access to a single learned MAC address, preventing port stealing.
Why this answer
Port security on Cisco switches allows an administrator to limit the number of valid MAC addresses allowed on a port and secure it against MAC spoofing and port stealing by learning specific addresses or setting maximum limits. Additionally, Dynamic ARP Inspection (DAI) and IP Source Guard help, but port security specifically addresses MAC duplication and port stealing across switch ports.
An enterprise is securing its enterprise wireless infrastructure against unauthorized devices and wireless sniffing. Which THREE administrative and technical controls should be implemented? (Choose THREE)
802.11w prevents forged deauthentication and disconnection frames used in wireless attacks.
Why this answer
Enabling management frame protection, WIPS monitoring, and 802.1X enterprise authentication harden wireless networks against attacks.
An enterprise security auditor is reviewing an Elasticsearch cluster configuration. To prevent unauthorized access to stored indices containing sensitive PII and financial records, which authentication and transport layer security (TLS) settings must be enforced?
These specific Elasticsearch configuration settings enable cluster security features and TLS encryption for transport.
Why this answer
In Elasticsearch Security (formerly X-Pack), setting xpack.security.enabled: true and xpack.security.transport.ssl.enabled: true enforces node-to-node and client-to-cluster TLS encryption and authentication.
Which TWO of the following deployment scenarios or features are commonly associated with Network Intrusion Prevention Systems (NIPS)? (Choose two)
True. NIPS must be placed inline to actively prevent attacks by dropping malicious packets.
Why this answer
NIPS devices are placed inline to inspect traffic in real-time and can actively drop or block malicious packets before they reach internal targets.
A software developer is writing a Python Flask web application that accepts file uploads from users. To prevent arbitrary file upload vulnerabilities leading to Remote Code Execution (RCE), which validation procedure must the developer implement?
Checking magic bytes and enforcing an extension whitelist ensures the uploaded file is genuinely of the expected type.
Why this answer
Validating the file extension against an explicit whitelist, inspecting the file's magic bytes (file signature), and storing uploaded files outside the web root with randomized filenames prevents RCE.
A security administrator is hardening a corporate perimeter router and wants to protect the router's control plane against CPU exhaustion attacks from external flooding. Which feature should be implemented?
CoPP applies QoS policies to control-plane traffic, preventing DoS attacks against the router CPU.
Why this answer
Control Plane Policing (CoPP) or Control Plane Protection protects the router CPU by policing management and control traffic.
A network security engineer is designing a secure enterprise wireless network architecture to mitigate modern wireless attacks. Which THREE security configurations and protocols should be mandated? (Choose THREE)
WPA3-Enterprise provides robust mutual authentication and encryption suited for secure enterprise environments.
Why this answer
WPA3-Enterprise, 802.11w (PMF), and WIPS deployment form the cornerstone of a secure enterprise wireless defense strategy.
A cloud security auditor is reviewing a Google Cloud Platform (GCP) project for identity and access management hygiene. Which TWO security practices should be enforced to prevent unauthorized privilege escalation and credential theft? (Choose TWO)
User-managed service account keys can be leaked or stolen; relying on Google-managed keys or Workload Identity is safer.
Why this answer
Avoiding user-managed service account keys and adhering to the principle of least privilege by using predefined or custom IAM roles instead of primitive roles.
A cybersecurity architect is designing an enterprise Data Loss Prevention (DLP) deployment strategy across endpoint, network, and storage vectors. Which THREE technical capabilities are standard functions of enterprise storage discovery DLP tools?
Discovery DLP tools can automatically apply remediation policies to secure or remove misplaced sensitive files.
Why this answer
Storage discovery DLP tools scan repositories like file shares, databases, and cloud storage for sensitive unencrypted data at rest.
An enterprise Incident Response team is investigating a compromised endpoint using EDR telemetry and live response tools. Which THREE of the following actions can typically be performed directly from an enterprise EDR console during active triage? (Choose THREE)
Network containment is a core EDR feature to stop lateral movement.
Why this answer
Modern EDR solutions allow pulling file samples, isolating hosts from the network, and terminating malicious processes remotely.
An enterprise is implementing Zero Trust Network Access (ZTNA) for remote workers accessing cloud-hosted virtual desktops in Azure. To ensure that user identity, device compliance, and location risk are evaluated before establishing a network session, which Azure service integration should be deployed?
Conditional Access enforces granular access controls based on real-time security signals before permitting session establishment.
Why this answer
Microsoft Entra Conditional Access evaluates signals like user risk, device compliance, and location to enforce access controls before granting access to applications.
A network administrator is implementing defense-in-depth measures against ARP spoofing and man-in-the-middle attacks on a Cisco switched enterprise network. Which THREE switch security features should be enabled on access layer ports? (Choose three)
DHCP snooping builds a trusted binding database used by DAI and IP Source Guard.
Why this answer
To mitigate layer 2 ARP and MAC manipulation attacks, administrators use DHCP snooping, Dynamic ARP Inspection (DAI), and IP Source Guard.
An attacker performs a pass-the-hash attack to move laterally across an enterprise network using compromised NTLM hashes. The security architecture team wants to implement host-based mitigations to render harvested NTLM hashes unusable for authentication. Which Windows security feature should be enabled?
Credential Guard isolates NTLM hashes and Kerberos tickets in a secure virtualized environment.
Why this answer
Credential Guard utilizes virtualization-based security (VBS) to isolate secrets (such as NTLM hashes and Kerberos tickets) so that they cannot be stolen or reused even if the LSASS process is compromised.
An organization is hardening Android enterprise devices and wants to prevent users from installing applications from unknown sources while ensuring corporate apps update automatically. Which policy configuration in the EMM/MDM console achieves this?
Blocking unknown sources prevents sideloading, while Managed Google Play handles curated app distribution and updates.
Why this answer
Disabling 'Unknown Sources' (installations from outside Google Play) combined with forcing Google Play managed accounts ensures secure app management.
An organization is implementing ISO/IEC 27001 Annex A controls regarding operations security. Specifically, control A.12.4.1 (Event Logging) requires event logs recording user activities, exceptions, and information security events to be produced, kept, and regularly reviewed. Which automated practice best satisfies regular log review governance?
SIEM centralization and analyst workflows satisfy active log review governance requirements.
Why this answer
Deploying a SIEM with automated correlation rules and scheduled analyst reviews ensures continuous oversight of security event logs.
An administrator needs to secure management access to Azure virtual machines by eliminating open management ports (such as RDP port 3389 and SSH port 22) on the public internet. Which Azure feature should be configured?
Azure Bastion provides secure RDP and SSH access over TLS to VMs without needing public IPs.
A CND analyst is deploying a centralized Security Information and Event Management (SIEM) solution. To enable proactive threat hunting and rapid incident detection across distributed network segments, what is the primary function of deploying forwarders or agents on endpoints?
SIEM agents collect, parse, and securely stream telemetry and logs from the host operating system to the central SIEM engine.
Why this answer
SIEM forwarders or agents installed on endpoints collect local event logs (such as Windows Security logs or Linux auditd logs), normalize them, and securely transmit them to the central SIEM collector for correlation, analysis, and alerting without requiring direct remote administrative shares.
An enterprise firewall is experiencing asymmetric routing where TCP SYN packets enter through Firewall A, but the return SYN-ACK packets exit through Firewall B due to dynamic routing changes. What firewall feature must be enabled to synchronize connection state tables between Firewall A and Firewall B and prevent connection drops?
Session synchronization shares active session tables across firewalls to handle asymmetric routing.
Why this answer
Stateful firewalls require session synchronization (such as Cisco Stateful Failover or Palo Alto HA session sync) to share connection state tables across cluster nodes in asymmetric paths.
A Chief Information Security Officer (CISO) needs to present an executive summary of current network risks to the board of directors. Which metric is most effective for communicating financial exposure resulting from potential network security breaches?
ALE calculates the expected yearly financial loss due to security risks, making it ideal for executive boards.
Why this answer
Single Loss Expectancy (SLE) and Annualized Loss Expectancy (ALE) translate technical risks into business financial terms.
An attacker targets an enterprise Active Directory domain by performing a DCSync attack, successfully replicating domain controller password data without being a domain controller. Which Active Directory access control rights must be audited and protected to prevent non-administrative users from executing DCSync?
DCSync requires these specific domain-level replication rights to impersonate a domain controller.
Why this answer
DCSync relies on specific Active Directory replication rights: 'Replicating Directory Changes' (GUID 11f46d12-861c-4d42-b41c-50f443a82f7f) and 'Replicating Directory Changes All'. Ensuring that only authorized Domain Controllers hold these extended rights is critical.
An incident responder needs to capture a forensically sound image of a Windows workstation's disk. Which command-line tool can create a bit-stream disk image while calculating a cryptographic hash simultaneously?
dc3dd is a patched version of dd that includes hashing (MD5/SHA) on-the-fly during acquisition for digital forensics.
Why this answer
The 'dc3dd' or 'dd' command (or specialized tools like FTK Imager) can image disks and generate hashes, but dc3dd is specifically enhanced for digital forensics with hash verification.
A security analyst needs to configure Snort to generate an alert whenever an inbound packet matches a specific rule condition, without blocking the traffic. Which rule action keyword should be used in the Snort configuration file?
Alert generates a notice and logs the packet while permitting traffic to flow.
Why this answer
The 'alert' action tells Snort to generate an alert and log the packet, allowing traffic to pass.
An organization is conducting a mandatory security audit for PCI-DSS compliance regarding its cardholder data environment (CDE). The auditor asks for proof of network segmentation. What should the network security administrator present?
PCI-DSS requires documented network diagrams and rule verification showing that cardholder data systems are isolated from flat corporate networks.
Why this answer
To prove PCI-DSS network segmentation, administrators must present current network diagrams showing firewalls effectively isolating the CDE from out-of-scope networks, along with the results of effective penetration testing confirming that isolation.
An enterprise is drafting an Acceptable Use Policy (AUP) for employee internet and device usage. Which element is essential to include in the policy document to ensure enforceability?
Users must be informed of monitoring and the specific penalties for non-compliance for the policy to be legally and organizationally enforceable.
Why this answer
An AUP must explicitly state the consequences of policy violations and inform users that their activities on company assets are subject to monitoring.
An organization is establishing forensic readiness for critical database servers. Which technical control directly supports forensic readiness by ensuring volatile RAM contents can be preserved during a suspected live kernel attack?
Pre-staging memory acquisition ensures volatile system state can be captured forensically.
Why this answer
Pre-installed memory acquisition tools or kernel crash dump configurations enable capturing volatile RAM before a reboot.
A security team is conducting a penetration test against a corporate network and attempts a Man-in-the-Middle (MitM) attack using ICMP redirection and IPv6 Router Advertisement (RA) spoofing. Which THREE network controls effectively mitigate these specific local network redirection attacks? (Choose three)
Disabling ICMP redirects prevents hosts from modifying their routing tables based on forged packets.
Why this answer
To defend against router advertisement spoofing and ICMP redirection attacks, administrators use RA Guard, ICMP redirect filtering, and secure switch port configurations.
An organization is experiencing a ransomware outbreak on an endpoint. The Incident Response team decides to immediately disconnect the infected machine from the network without shutting it down, in order to preserve volatile memory. Which EDR feature should the responder trigger?
Host isolation cuts off lateral network traffic while allowing the EDR management console to communicate with the agent for forensics.
Why this answer
EDR platforms include network isolation capabilities that sever network connectivity to the endpoint while maintaining remote management connectivity for the security team.
Cowrie is a dedicated SSH and Telnet honeypot designed to log attacker interactions and brute-force attempts.
A security manager is updating the corporate Acceptable Use Policy (AUP). To address emerging cloud collaboration tools, which specific section should be revised to regulate employee data sharing on external platforms?
This section governs how employees handle and transfer corporate data to external platforms.
Why this answer
The Acceptable Use Policy (AUP) explicitly defines what employees can and cannot do using company hardware and networks, including cloud collaboration tools.
A security analyst is reviewing vulnerability assessment reports for a fleet of Windows endpoints and notes that third-party software (such as browsers and PDF readers) accounts for most missing patches. Which deployment strategy should the organization implement to streamline third-party patch management?
Integrating third-party catalogs enables centralized automated deployment of application updates alongside OS patches.
Why this answer
Modern endpoint management and EDR/patch tools integrate third-party catalog feeds to automatically package and push vendor patches to endpoints.
During an internal network security audit, an auditor needs to verify that administrative accounts are not sharing credentials. Which compliance artifact should the auditor inspect to validate individual accountability?
Inspecting AD confirms whether distinct named accounts are assigned instead of shared generic logins.
Why this answer
Account management policies and access control lists detailing individual named accounts versus shared accounts are required for individual accountability.
This command correctly restricts SSH access to the specified subnet.
Why this answer
The ufw allow command accepts rules specifying source subnets and ports.
What is the primary function of a Demilitarized Zone (DMZ) bastion host?
Bastion hosts are hardened systems placed on the perimeter to handle untrusted connections.
Why this answer
A bastion host is a hardened computer specifically designed and configured to withstand attacks while facing the public internet.
An organization wants to secure data in transit between microservices communicating within a Kubernetes cluster. Which service mesh technology provides mutual TLS (mTLS) encryption automatically between service pods without modifying application code?
Istio uses Envoy sidecars to transparently encrypt service-to-service traffic using mTLS.
Why this answer
Istio (or Linkerd) is a service mesh that injects sidecar proxies (like Envoy) to automatically handle mutual TLS (mTLS) between Kubernetes pods.
A network administrator is configuring secure remote access for employees. The security policy mandates that the remote access solution must support multi-factor authentication (MFA) and encrypt all traffic from the client device. Which TWO technologies or protocols can meet these requirements? (Choose two)
SSL/TLS VPNs encrypt traffic and integrate with modern MFA identity providers.
Disabling DTDs and external entity loading in XML parsers prevents XXE vulnerabilities.
Why this answer
XXE attacks exploit vulnerable XML parsers that permit the parsing of Document Type Definitions (DTDs) containing external entity references.
An organization is implementing database transparent data encryption (TDE) and needs to understand its architectural security boundaries. Which THREE security characteristics or limitations are true regarding TDE?
Once data is loaded into memory or accessed by authenticated users, TDE does not restrict query visibility.
Why this answer
TDE protects data at rest on disk and backup files, but does not protect data in transit or data accessed in memory while the database is running.
An enterprise is deploying a zero-trust architecture for its AWS cloud workloads. Services must communicate across VPCs without exposing traffic to the public internet or traversing VPC peerings that open full subnet access. Which feature should be implemented?
AWS PrivateLink uses interface endpoints powered by HyperVNI to securely expose specific services across VPCs without VPC peering.
Why this answer
AWS PrivateLink provides private connectivity between VPCs, services, and on-premises applications securely without exposing traffic to the public internet.
An enterprise network uses an Intrusion Detection System (IDS) deployed in passive monitoring mode via a switch span port. The security operations center (SOC) notices that the IDS generates high volumes of alerts for internal vulnerability scanning activities, obscuring real attacks. Which network design modification should be implemented to reduce false positive alert fatigue without disabling the detection signatures?
Excluding authorized scanning IPs or creating suppression rules for known administrative scans is the correct tuning method to reduce alert fatigue.
Why this answer
Tuning or relocating the IDS sensor by filtering out authorized internal scanner source IPs from the monitoring profile or moving the span port configuration to exclude trusted management subnets reduces false positives. Alternatively, tuning the signature rules to whitelist specific source IPs is standard practice.
A network administrator is hardening a Cisco switch infrastructure against Layer 2 attacks. Which THREE features should be enabled and configured on the access and distribution layers? (Choose THREE)
DAI prevents ARP spoofing and poisoning attacks.
Why this answer
Layer 2 hardening includes Port Security (limiting MAC addresses), DHCP Snooping (blocking rogue DHCP), and Dynamic ARP Inspection (stopping ARP poisoning).
An organization's security policy requires that all remote workers connect to the corporate network via a VPN that routes all client internet traffic through the corporate data center security stack. Which type of VPN architecture must the remote client be configured to use?
A full-tunnel VPN forces all user traffic through the corporate security gateway, satisfying the requirement to inspect all internet traffic.
An Incident Response team analyzing an enterprise endpoint discovers evidence of a fileless malware attack leveraging Windows Management Instrumentation (WMI). Which THREE of the following WMI artifacts or logging mechanisms should the investigator examine? (Choose THREE)
WMI operational logs track activity, queries, and failures useful for detecting malicious WMI scripting.
Why this answer
WMI persistence involves permanent event subscriptions (filters, consumers, and bindings) logged in specific WMI namespaces and event channels.
An organization wants to deploy a wireless intrusion prevention system (WIPS) sensor to detect unauthorized access points and rogue devices broadcasting corporate SSIDs. Where should the WIPS sensor be deployed?
Dedicated WIPS sensors or access points with scanning radios are placed throughout facilities to capture wireless frames across all channels.
Why this answer
WIPS sensors should be distributed throughout the physical office space to effectively monitor all 802.11 radio frequency channels and detect rogue access points or ad-hoc connections.
An auditor is evaluating an organization's compliance with ISO/IEC 27001 Annex A physical and environmental security controls. Which THREE security measures should the auditor expect to find implemented in the primary data center? (Choose three)
Environmental controls protect hardware from thermal and moisture damage.
Why this answer
Data center physical security requires visitor logs, biometric or badge access controls, and environmental monitoring systems.
A network defense administrator is reviewing security baselines using the Center for Internet Security (CIS) Benchmarks. A particular benchmark rule requires disabling the LLMNR (Link-Local Multicast Name Resolution) protocol on Windows domain member servers. Which security risk does this policy directly mitigate?
Disabling LLMNR prevents attackers from intercepting name resolution queries to capture hashes.
Why this answer
Disabling LLMNR and NBT-NS mitigates spoofing and responder attacks (such as LLMNR/NBT-NS poisonings) used to capture NTLMv2 password hashes.
An attacker attempts a Kerberoasting attack by requesting a Service Ticket (TGS) for a service account running with a Service Principal Name (SPN) from a compromised domain user account, then attempts to crack the service account's password offline. Which security hardening practice should be implemented in Active Directory to mitigate this risk?
gMSAs eliminate manual password management and use automatic, complex, frequently rotated passwords.
Why this answer
Kerberoasting targets service accounts with weak passwords. Mitigation involves enforcing strong, complex passwords (12+ characters) or utilizing Group Managed Service Accounts (gMSAs), which automatically manage complex passwords and rotate them frequently.
An organization implements IEEE 802.1X port-based authentication across its enterprise switch infrastructure. A new IP security camera is connected to a switch port, but it does not support 802.1X supplicant software. How should the network administrator configure the switch port to authenticate and isolate the camera securely?
MAB allows devices lacking 802.1X software to be authenticated based on their MAC address against a backend RADIUS/ISE server.
Why this answer
For non-supplicant devices like IoT equipment, switch ports can be configured with MAC Authentication Bypass (MAB), which uses the device's MAC address as credentials against a RADIUS server, combined with a restricted VLAN.
Practice CND by domain
Target a specific domain to shore up weak areas.