Refer to the Exhibit Practice Questions

It defines the system's default language settings.

Why it fails: The ProfileList key is dedicated to profile management and SID-to-path resolution, not language or regional settings. Regional settings are typically located in the HKEY_CURRENT_USER hive or under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls, making this option technically incorrect regarding the function of the ProfileList key.

It logs every application the user has executed.

Why it fails: ProfileList only stores profile path locations and account SIDs. It does not contain execution logs. Execution history is stored in different artifacts like UserAssist, Shimcache, or Prefetch, which serve entirely different purposes and are located in different registry hives and file system structures.

It lists all installed software on the system.

Why it fails: The list of installed software is typically tracked under the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall key. The ProfileList key is strictly for user account profile management and path mapping, providing no insights into the software inventory of the local machine or remote network connections.

The endpoint is vulnerable to root-level system file modification.

Why it fails: The output indicates SIP is enabled, which specifically prevents root-level modification of protected system files. If SIP were disabled, the system would be vulnerable; however, the active status confirms these safeguards are in place, meaning the premise of the option directly contradicts the command's reported state.

The disk encryption configuration is currently failing.

Why it fails: The command 'csrutil' relates exclusively to System Integrity Protection, not disk encryption. Disk encryption is a function of FileVault 2. The exhibit output provides no information regarding the encryption status of the physical volumes, making this an incorrect inference based on the utility's specific technical purpose.

The device has been successfully compromised by a kernel rootkit.

Why it fails: A status of 'enabled' indicates that the system is protecting itself against unauthorized kernel-level changes. While a system can still be compromised in user-space, SIP being enabled is a significant barrier to the persistence of a kernel-level rootkit, meaning this interpretation is factually incorrect for the output.

Event ID 4625

Why it fails: Event ID 4625 specifically records failed logon attempts. While important for detecting brute-force attacks or credential stuffing, it does not provide information about successful network logons. Investigators must distinguish between attempted and successful access to properly scope the impact of an authentication-based security incident.

Event ID 4624 with Logon Type 2

Why it fails: Logon Type 2 refers to an interactive logon, typically where the user is physically present at the keyboard or using a console session. This type does not indicate a remote network connection, making it an incorrect choice for identifying unauthorized remote access via network shares.

Event ID 4672

Why it fails: Event ID 4672 signifies that a user logged on with superuser privileges, often referred to as special privileges assigned to the new logon. It does not define the logon type or verify if the connection was established over the network or via a local interactive console session.

The switch will forward the third device's traffic while generating an alert log entry to the central syslog server without dropping packets.

Why it fails: The restrict violation mode generates log entries and SNMP traps while dropping traffic from unauthorized devices, whereas the shutdown mode actively disables the port. The configured shutdown command explicitly mandates that the interface be transitioned to an error-disabled state.

The switch will drop packets originating from the third device while keeping the physical port in an active operational state.

Why it fails: Dropping unauthorized packets while maintaining an active link represents the restrict violation mode. The configured shutdown mode goes further by entirely shutting down the physical interface to eliminate any further interaction from the unauthorized device.

The switch will temporarily quarantine the third device in a restricted guest VLAN while awaiting administrator approval.

Why it fails: Port security violation modes are shutdown, restrict and protect; none quarantines a device into a guest VLAN. It tempts because dynamic VLAN assignment via 802.1X or RADIUS does place unknown endpoints in a restricted VLAN, but that scenario requires authentication configuration, not the port-security snippet shown.

The RSA key length is insufficient for modern requirements

Why it fails: A 2048-bit RSA key length is currently considered the industry minimum for secure communications. While 3072-bit or higher is recommended for longer-term security, 2048-bit does not constitute a critical vulnerability in the context of generating a CSR, unlike the exposure of the private key itself.

The certificate will be self-signed and untrusted

Why it fails: The command generates a CSR, not a final certificate. A CSR is intended to be sent to a Certificate Authority for signing. The lack of a passphrase does not affect whether the resulting certificate will be signed or trusted by external entities, but rather compromises the security of the key.

The output file format defaults to a deprecated encoding

Why it fails: OpenSSL defaults to PEM encoding for CSRs and private keys, which is the standard format for most web servers and infrastructure. The -nodes flag affects the encryption status of the key file, not the encoding format or the structure of the data generated by the OpenSSL utility.

The application will run normally because AppData is a standard location.

Why it fails: The policy contains an explicit 'Deny' rule for the AppData path. In 'Enforce' mode, the security agent will evaluate this rule before allowing execution. Since the rule is a hard block, the application will be prevented from running, regardless of whether it is legitimate or malicious software.

The application will run, but the activity will be logged for review.

Why it fails: The 'Mode' field is set to 'Enforce', meaning the security agent will actively block disallowed actions. If the mode were set to 'Audit', the activity would be logged but allowed. Since 'Enforce' is active, the agent must block the application rather than just recording the event for later review.

The system will automatically move the application to Program Files.

Why it fails: Security agents do not perform automated file relocation as part of their execution control policies. They perform either 'Allow' or 'Deny' evaluations based on predefined rules. Attempting to move files would require elevated privileges and a complex file system driver, which is outside the scope of execution control.

The traffic is permitted because the second rule matches the source subnet.

Why it fails: ACLs are processed sequentially. The first line of the configuration is a deny statement that matches all IP traffic directed at the specific host and port. Once a packet matches a deny rule, the router drops the packet immediately, preventing any evaluation of the later permit statement.

The traffic is permitted because permit rules take precedence over deny rules.

Why it fails: ACLs do not prioritize permit rules over deny rules; they prioritize the order of the rules as they appear in the configuration. The router follows the logic provided by the administrator, and because the deny rule is placed first, it overrides any subsequent permit commands for matching packets.

The router generates an error because the ACL rules are contradictory.

Why it fails: The router does not check for logic errors or shadowed rules when applying an ACL. It simply follows the list from top to bottom. While the rules are technically redundant and poorly ordered for the administrator's goal, the router will execute them exactly as configured without throwing errors.

Channel 1 selection is a performance concern.

Why it fails: While Channel 1 might suffer from co-channel interference if other APs in the vicinity are using it, it is not a security vulnerability. Channel selection is a radio frequency management task that affects throughput and latency, not the cryptographic integrity of the wireless network connection.

WPA2-PSK is insufficient for modern enterprise needs.

Why it fails: While WPA2-PSK is less secure than WPA2-Enterprise, it is not the most significant risk in this specific configuration. The enabled WPS feature provides a direct, known exploit path to bypass the WPA2 encryption entirely, which is a much higher priority for immediate remediation than the PSK protocol.

Management Frame Protection is disabled.

Why it fails: Disabling MFP prevents protection against de-authentication attacks, which is a concern for availability. However, WPS is a more critical vulnerability because it leads to full network compromise and persistent credential theft, whereas MFP issues are limited to service disruption via denial-of-service attacks on the wireless client.

Reboot the workstation immediately

Why it fails: Rebooting will clear volatile memory, destroying critical evidence such as the decrypted command string or active socket connections. Forensic best practices dictate that the system state must be preserved for analysis before any destructive actions like reboots are performed, as memory artifacts are essential for identifying the payload.

Delete the PowerShell process

Why it fails: Terminating a process is an insufficient containment measure because the attacker may have already established other persistence mechanisms or secondary backdoors. The malicious process could also be a child of another service, leading to immediate respawning. Full network isolation is required to ensure the host is contained.

Update the antivirus definitions

Why it fails: Updating antivirus is a long-term remediation step, not an immediate containment action. During an active incident involving encoded command execution, the priority is to stop the adversary's access. Relying on antivirus signatures is reactive and unlikely to stop a custom script that is already running in memory.

SQL Injection; Containment

Why it fails: The error log refers to an XSS attempt, not SQL injection, which would involve database queries. Furthermore, the event indicates a blocked attempt, meaning the immediate containment of a breach is not required; rather, the event must be identified and analyzed to determine if further action is needed.

Cross-Site Request Forgery; Eradication

Why it fails: This is not a CSRF attack, as the payload is clearly XSS script injection. Eradication is also incorrect because the attack was blocked, and no system infection has occurred. The incident requires identification and analysis, not the removal of a persistent threat or malware from the web servers.

Buffer Overflow; Preparation

Why it fails: This is not a buffer overflow, which involves memory corruption at the process level. Additionally, this event is occurring in real-time and must be handled via the incident response process, not the Preparation phase, which is for pre-incident planning and establishing the security framework before any attacks occur.

Cross-Site Request Forgery (CSRF)

Why it fails: CSRF attacks rely on the browser automatically including cookies in cross-site requests. HttpOnly does not stop this behavior. To prevent CSRF, developers should use anti-CSRF tokens or the SameSite cookie attribute, as these mechanisms specifically target the request context rather than script-based access to stored cookies.

Man-in-the-Middle (MitM) interception

Why it fails: MitM interception is prevented by transport encryption, such as TLS/HTTPS. The Secure flag handles the requirement for encryption. The HttpOnly flag is strictly concerned with preventing client-side script access to cookie data and has no effect on network-level visibility or interception of data during transit.

SQL Injection (SQLi)

Why it fails: SQL injection occurs when untrusted user input is directly processed by a database query. This is a server-side vulnerability unrelated to how a browser stores or manages cookies. HttpOnly is a browser-side protection mechanism and provides no mitigation for database-level input validation or command execution vulnerabilities.

Only existing files are modified.

Why it fails: These flags apply to both existing and future objects created within the container. If it only applied to existing objects, administrators would need to manually re-run the command every time a new file was added, creating significant management overhead and increasing the risk of security misconfiguration.

The permissions are applied to C:\Data only, not children.

Why it fails: The flags specifically instruct Windows to propagate the Access Control Entry to child objects. If the flags were omitted, the permissions would be applied only to the C:\Data folder itself, leaving the contents vulnerable or inaccessible depending on the existing inherited or explicit permission settings.

The user cannot delete the folder.

Why it fails: The (M) flag stands for Modify, which includes the ability to read, write, and delete files. These flags do not restrict deletion; rather, they define the scope of inheritance. The deletion capability is a function of the modify permission itself, not the inheritance flags applied to the ACL.

Only failure events are being audited

Why it fails: The output explicitly shows that both Success and Failure are configured. A failure-only configuration would likely display 'Failure' without the 'Success' indicator, whereas this output shows the category is fully enabled for the credential validation subcategory, indicating a comprehensive auditing stance.

Auditing is completely disabled for this category

Why it fails: If auditing were disabled, the subcategory would display 'No Auditing' or be absent from the list. The presence of 'Success and Failure' confirms that the policy is active and capturing the necessary authentication data for security monitoring purposes.

Only success events are being audited

Why it fails: The policy output clearly states 'Success and Failure', meaning auditing is not restricted to successful logins. Security policies that only audit successes would leave a massive gap in visibility, failing to detect failed brute-force attempts or credential stuffing attacks.

Enable IGMP snooping on all leaf switches so multicast traffic is pruned to only the ports that requested the group.

Why it fails: IGMP snooping optimizes multicast delivery within a Layer 2 domain, but it does not create tenant boundaries. If multiple tenants share a bridge domain or VNI, snooping will still forward traffic to interested receivers regardless of tenant ownership. It also does not address broadcast or unknown unicast. This mechanism improves efficiency but fails to provide the strict isolation the design requires.

Configure a unique anycast gateway MAC address on each leaf switch to prevent hosts from roaming between tenants.

Why it fails: An anycast gateway MAC is used so that distributed Layer 3 gateways appear identical to hosts, enabling seamless mobility within a tenant. It does not isolate tenants because the gateway can still route between VNIs if routing is configured. The MAC address itself is not a segmentation control. This option confuses gateway high availability with tenant isolation and does not stop BUM traffic from crossing boundaries.

Use a separate physical spine-leaf fabric for each tenant and interconnect them with a firewall.

Why it fails: Physically separate fabrics would provide isolation, but the scenario specifies a single VXLAN overlay fabric supporting many tenants, and building a dedicated fabric per tenant is not scalable or cost-effective. A firewall between fabrics adds complexity and does not address BUM traffic inside a shared fabric. This approach contradicts the design premise and is not the intended VXLAN-native solution.

The service account lacks the 'Log on as a service' right.

Why it fails: If the account lacked the specific user right, the error code would typically reflect a privilege issue rather than an authentication failure. Error 0x8007052e specifically points to an incorrect credential or account status, which is a distinct problem from missing local security policy assignments on the host machine.

The network path to the domain controller is unreachable.

Why it fails: Connectivity issues to the domain controller would typically result in different network-related error codes or timeout errors. Since the system is reporting a specific logon failure, it indicates that the authentication request reached the domain controller but was rejected, rather than failing to reach the authentication service entirely.

The service binary is corrupted or missing.

Why it fails: A corrupted binary would typically result in a 'Service failed to start' error unrelated to logon credentials. The presence of a specific logon error code confirms that the service manager successfully located and attempted to execute the service, but failed during the authentication phase with the specified domain account.