Scenario practice questions

A company implements a policy where a financial transaction must be initiated by one employee and approved by a different employee. This is an example of which access control concept?

Trap 1: Need-to-know

Need-to-know limits access to information required for a task, not the separation of duties between initiator and approver. It is tempting because both restrict who acts, but need-to-know governs data exposure, whereas requiring two distinct employees addresses conflicting duties within one transaction.

Trap 2: Least privilege

Least privilege grants users only the permissions their role requires; it does not require two separate people to complete one transaction. It is tempting because both reduce misuse, but least privilege constrains each user's rights, while separation of duties splits the transaction across two employees.

Trap 3: Job rotation

Job rotation moves staff through different roles over time to limit long-term fraud exposure; it does not enforce that one person initiates and another approves. Separation of duties is the concept requiring two distinct individuals to complete a transaction, so job rotation fails this scenario's two-person control requirement.

A
Need-to-know
Why it fails: Need-to-know limits access to information required for a task, not the separation of duties between initiator and approver. It is tempting because both restrict who acts, but need-to-know governs data exposure, whereas requiring two distinct employees addresses conflicting duties within one transaction.
B
Separation of duties
Splitting initiation and approval between two distinct employees prevents one person from completing the entire transaction alone. This enforces separation of duties, a preventive control that reduces fraud risk by requiring collusion to circumvent the process.
C
Least privilege
Why it fails: Least privilege grants users only the permissions their role requires; it does not require two separate people to complete one transaction. It is tempting because both reduce misuse, but least privilege constrains each user's rights, while separation of duties splits the transaction across two employees.
D
Job rotation
Why it fails: Job rotation moves staff through different roles over time to limit long-term fraud exposure; it does not enforce that one person initiates and another approves. Separation of duties is the concept requiring two distinct individuals to complete a transaction, so job rotation fails this scenario's two-person control requirement.

Question 2easymultiple choice

An employee receives an email from an unknown sender claiming to be from the IT department, asking for their password to perform an urgent system update. What type of social engineering attack is this?

Trap 1: Tailgating

Tailgating is physical: an unauthorised person follows an employee through a secured door. This attack arrives by email and requests credentials, which is phishing. Tailgating would be the answer if the scenario described someone entering a building behind a badge-holder.

Trap 2: USB drop attack

A USB drop attack relies on planting infected removable media for a victim to plug in. Nothing physical is involved here; the email itself solicits the password, making it phishing. USB drops fit scenarios where found drives are inserted into company machines.

Trap 3: Piggybacking

Piggybacking is physical entry: an attacker accompanies an authorised person through a door with their consent or knowledge. This scenario is an email requesting credentials, which is phishing. Piggybacking would apply if someone talked their way past reception into a server room.

A
Phishing
The message impersonates the IT department and pressures the recipient to disclose credentials urgently, which is phishing: fraudulent email harvesting sensitive data. It satisfies the stem's description, distinguishing it from vishing or pretexting conducted by other channels.
B
Tailgating
Why it fails: Tailgating is physical: an unauthorised person follows an employee through a secured door. This attack arrives by email and requests credentials, which is phishing. Tailgating would be the answer if the scenario described someone entering a building behind a badge-holder.
C
USB drop attack
Why it fails: A USB drop attack relies on planting infected removable media for a victim to plug in. Nothing physical is involved here; the email itself solicits the password, making it phishing. USB drops fit scenarios where found drives are inserted into company machines.
D
Piggybacking
Why it fails: Piggybacking is physical entry: an attacker accompanies an authorised person through a door with their consent or knowledge. This scenario is an email requesting credentials, which is phishing. Piggybacking would apply if someone talked their way past reception into a server room.

Question 3mediummultiple choice

An attacker intercepts communications between a client and server by establishing independent connections with each. The client believes it is talking to the server, but the attacker relays messages. What is this attack?

Trap 1: Phishing

Phishing deceives a user into revealing credentials or clicking malicious links; no independent connections are established or relayed. It is tempting because it is a common initial-access technique, but it targets human trust rather than transparently proxying traffic between client and server.

Trap 2: Replay attack

A replay attack captures and retransmits previously valid messages to impersonate a party; the attacker does not maintain two live connections. It is tempting because both involve intercepted traffic, but replay reuses captured data rather than relaying messages in real time.

Trap 3: DoS

A DoS attack floods a service to exhaust resources and deny legitimate access; it does not establish paired connections or relay traffic. It is tempting because interception scenarios can degrade availability, but DoS describes volumetric or resource exhaustion, not the relay described.

A
Phishing
Why it fails: Phishing deceives a user into revealing credentials or clicking malicious links; no independent connections are established or relayed. It is tempting because it is a common initial-access technique, but it targets human trust rather than transparently proxying traffic between client and server.
B
Man-in-the-middle
The attacker terminates two separate TCP sessions — one with the client, one with the server — and relays traffic between them, so each endpoint authenticates against the attacker rather than the genuine peer. This active relay, not passive eavesdropping, defines the man-in-the-middle scenario described.
C
Replay attack
Why it fails: A replay attack captures and retransmits previously valid messages to impersonate a party; the attacker does not maintain two live connections. It is tempting because both involve intercepted traffic, but replay reuses captured data rather than relaying messages in real time.
D
DoS
Why it fails: A DoS attack floods a service to exhaust resources and deny legitimate access; it does not establish paired connections or relay traffic. It is tempting because interception scenarios can degrade availability, but DoS describes volumetric or resource exhaustion, not the relay described.

Question 4easymultiple choice

A security analyst notices unusual traffic on the network. Using Wireshark, they capture packets and see that an attacker is reading all unencrypted data from the network segment. Which type of attack is most likely being performed?

Trap 1: Spoofing

Spoofing falsifies a source address or identity to impersonate a trusted host; it does not itself read unencrypted data from the segment. It is tempting because spoofing often accompanies sniffing, and it is the right answer when the evidence shows forged addresses or impersonated identities rather than passive capture.

Trap 2: DoS

A DoS attack floods a target to exhaust its resources and deny service; it does not read unencrypted data off the segment. It is tempting because DoS also generates unusual traffic visible in Wireshark, and it is the right answer when the symptom is service unavailability rather than data disclosure.

Trap 3: Man-in-the-middle

A man-in-the-middle attack intercepts and relays traffic between two parties, typically altering or injecting it, rather than passively reading all broadcast data on the segment. It is tempting because MitM also exposes unencrypted data, and it is correct when the attacker sits between endpoints and relays their communications.

A
Spoofing
Why it fails: Spoofing falsifies a source address or identity to impersonate a trusted host; it does not itself read unencrypted data from the segment. It is tempting because spoofing often accompanies sniffing, and it is the right answer when the evidence shows forged addresses or impersonated identities rather than passive capture.
B
DoS
Why it fails: A DoS attack floods a target to exhaust its resources and deny service; it does not read unencrypted data off the segment. It is tempting because DoS also generates unusual traffic visible in Wireshark, and it is the right answer when the symptom is service unavailability rather than data disclosure.
C
Sniffing / Eavesdropping
Sniffing passively captures frames traversing a shared segment, letting the attacker read unencrypted payloads without altering traffic. This matches the stem's evidence: Wireshark shows data being read, not modified or blocked. Eavesdropping requires no injection or spoofing, only promiscuous-mode capture on the segment.
D
Man-in-the-middle
Why it fails: A man-in-the-middle attack intercepts and relays traffic between two parties, typically altering or injecting it, rather than passively reading all broadcast data on the segment. It is tempting because MitM also exposes unencrypted data, and it is correct when the attacker sits between endpoints and relays their communications.

Question 5hardmultiple choice

During a security assessment, a penetration tester captures network traffic and notices that the source IP address in packets appears to be from a different network. Which technique is the attacker likely using?

Trap 1: DNS spoofing

DNS spoofing forges name-resolution replies, redirecting clients to attacker-controlled addresses; it does not rewrite the source IP field inside captured packets. It is tempting because spoofing appears in the question, but IP source address falsification is IP spoofing, a distinct technique operating at the network layer.

Trap 2: ARP spoofing

ARP spoofing poisons the local Layer 2 ARP cache, mapping a victim's IP to the attacker's MAC within the same broadcast domain; it cannot rewrite the source IP to appear from a different network. It is tempting because ARP spoofing enables on-path interception, which would be the right answer if traffic were being redirected rather than re-addressed.

Trap 3: MAC spoofing

MAC spoofing alters the layer-2 hardware address in Ethernet frames, leaving the layer-3 source IP unchanged, so captured packets would not show a foreign network address. It is tempting because both are spoofing techniques, but only IP spoofing falsifies the source IP address observed in traffic.

A
DNS spoofing
Why it fails: DNS spoofing forges name-resolution replies, redirecting clients to attacker-controlled addresses; it does not rewrite the source IP field inside captured packets. It is tempting because spoofing appears in the question, but IP source address falsification is IP spoofing, a distinct technique operating at the network layer.
B
ARP spoofing
Why it fails: ARP spoofing poisons the local Layer 2 ARP cache, mapping a victim's IP to the attacker's MAC within the same broadcast domain; it cannot rewrite the source IP to appear from a different network. It is tempting because ARP spoofing enables on-path interception, which would be the right answer if traffic were being redirected rather than re-addressed.
C
MAC spoofing
Why it fails: MAC spoofing alters the layer-2 hardware address in Ethernet frames, leaving the layer-3 source IP unchanged, so captured packets would not show a foreign network address. It is tempting because both are spoofing techniques, but only IP spoofing falsifies the source IP address observed in traffic.
D
IP spoofing
IP spoofing forges the source address field in packet headers so traffic appears to originate from a different network, matching the observed foreign source addresses. It is distinct from MAC spoofing, which alters Layer 2 addresses.

Question 6mediummultiple choice

A company's BCP requires that critical systems be restored within 2 hours of disruption. Which metric defines this?

Trap 1: Mean Time to Repair (MTTR)

MTTR measures the average time taken to repair a failed component once work begins, not the maximum tolerable downtime after disruption. It is tempting because both concern repair duration, but the BCP's two-hour target is a Recovery Time Objective (RTO), an agreed maximum for restoring service.

Trap 2: Service Level Agreement (SLA)

An SLA is a contractual commitment covering service availability and support response, not a recovery-time metric. It is tempting because SLAs often quote restoration targets, but the BCP's two-hour requirement is a Recovery Time Objective (RTO), which specifies the maximum tolerable downtime for critical systems.

Trap 3: Recovery Point Objective (RPO)

RPO defines the maximum acceptable data loss measured backwards from the disruption, expressed as a time interval, not the restoration deadline. It is tempting because both are BCP recovery metrics, but the two-hour requirement concerns downtime, which is the Recovery Time Objective (RTO).

A
Mean Time to Repair (MTTR)
Why it fails: MTTR measures the average time taken to repair a failed component once work begins, not the maximum tolerable downtime after disruption. It is tempting because both concern repair duration, but the BCP's two-hour target is a Recovery Time Objective (RTO), an agreed maximum for restoring service.
B
Recovery Time Objective (RTO)
Recovery Time Objective defines the maximum acceptable time to restore a system after disruption. A two-hour restoration requirement is therefore an RTO, distinguishing it from Recovery Point Objective, which instead specifies tolerable data loss measured in time.
C
Service Level Agreement (SLA)
Why it fails: An SLA is a contractual commitment covering service availability and support response, not a recovery-time metric. It is tempting because SLAs often quote restoration targets, but the BCP's two-hour requirement is a Recovery Time Objective (RTO), which specifies the maximum tolerable downtime for critical systems.
D
Recovery Point Objective (RPO)
Why it fails: RPO defines the maximum acceptable data loss measured backwards from the disruption, expressed as a time interval, not the restoration deadline. It is tempting because both are BCP recovery metrics, but the two-hour requirement concerns downtime, which is the Recovery Time Objective (RTO).

Question 7hardmultiple choice

A company has a reciprocal agreement with another organization for disaster recovery. During a major outage, the company attempts to activate the agreement but finds that the partner's facility is also impacted by the same disaster. This scenario highlights a primary disadvantage of which recovery strategy?

Trap 1: Cold site

A cold site is an empty company-owned space needing hardware installation, not a partner's operational facility, so the shared-disaster impact does not describe it. It is tempting because cold sites are cheap and slow to activate, matching the improvised feel of relying on someone else's site.

Trap 2: Warm site

A warm site is a company-owned facility with partial equipment, not a partner's building, so the partner being hit by the same disaster does not illustrate its drawback. It is tempting because warm sites balance cost and recovery speed, resembling the informal sharing a reciprocal agreement implies.

Trap 3: Hot site

A hot site is a company-owned, fully equipped duplicate facility, not a partner's premises, so a shared-disaster impact on a partner does not describe it. It is tempting because hot sites offer near-zero recovery time, which is what a reciprocal agreement appears to promise.

A
Cold site
Why it fails: A cold site is an empty company-owned space needing hardware installation, not a partner's operational facility, so the shared-disaster impact does not describe it. It is tempting because cold sites are cheap and slow to activate, matching the improvised feel of relying on someone else's site.
B
Warm site
Why it fails: A warm site is a company-owned facility with partial equipment, not a partner's building, so the partner being hit by the same disaster does not illustrate its drawback. It is tempting because warm sites balance cost and recovery speed, resembling the informal sharing a reciprocal agreement implies.
C
Reciprocal agreement
Reciprocal agreements depend on a partner's facility remaining available, so a single regional disaster can incapacitate both sites simultaneously. This shared-fate exposure is the strategy's core weakness, directly satisfying the stem's constraint that the partner's facility was impacted by the same outage, leaving no viable recovery location.
D
Hot site
Why it fails: A hot site is a company-owned, fully equipped duplicate facility, not a partner's premises, so a shared-disaster impact on a partner does not describe it. It is tempting because hot sites offer near-zero recovery time, which is what a reciprocal agreement appears to promise.

Question 8easymultiple choice

A security analyst notices that a user's account has been used to access sensitive files outside of normal working hours from an unknown IP address. Which security principle is most directly violated?

Trap 1: Availability

Availability concerns uptime and service access, not unauthorised entry; the account and files remain reachable. It is tempting because out-of-hours access could suggest a denial-of-service or outage, and availability would be the violated principle if an attacker flooded or disabled the file service.

Trap 2: Non-repudiation

Non-repudiation ensures a party cannot deny performing an action, typically via signatures or tamper-evident logs; here the account was used by someone else, so the breach concerns authentication and authorisation. Non-repudiation would be the violated principle if a user denied authorising a transaction they actually made.

Trap 3: Integrity

Integrity covers unauthorised modification of data, whereas the stem describes only access to sensitive files, with no alteration evidenced. It is tempting because compromised credentials often precede tampering, and integrity would be the violated principle if the attacker had modified or deleted the files after gaining entry.

A
Availability
Why it fails: Availability concerns uptime and service access, not unauthorised entry; the account and files remain reachable. It is tempting because out-of-hours access could suggest a denial-of-service or outage, and availability would be the violated principle if an attacker flooded or disabled the file service.
B
Non-repudiation
Why it fails: Non-repudiation ensures a party cannot deny performing an action, typically via signatures or tamper-evident logs; here the account was used by someone else, so the breach concerns authentication and authorisation. Non-repudiation would be the violated principle if a user denied authorising a transaction they actually made.
C
Integrity
Why it fails: Integrity covers unauthorised modification of data, whereas the stem describes only access to sensitive files, with no alteration evidenced. It is tempting because compromised credentials often precede tampering, and integrity would be the violated principle if the attacker had modified or deleted the files after gaining entry.
D
Confidentiality
Unauthorised access to sensitive files exposes data to someone without clearance, directly breaching confidentiality, which governs who may read information. The odd hours and unknown IP indicate compromise, so the violated principle is the protection of data from disclosure.

Question 9easymultiple choice

A security analyst at a Security Operations Centre (SOC) receives an alert from the SIEM indicating multiple failed login attempts for a user account followed by a successful login from an unusual geographic location. According to SOC tier responsibilities, which tier should perform the initial triage of this alert?

Trap 1: IT support team

IT support manages user accounts and endpoints, not SIEM alert triage, which sits with the SOC. It is tempting because IT support would eventually reset the compromised account, but that remediation action follows SOC detection and escalation, not the initial triage step.

Trap 2: Tier 2 analyst

Tier 2 handles deeper investigation and incident response, not initial alert triage, which is Tier 1's defined responsibility. It is tempting because Tier 2 does perform triage, but only for escalated or complex incidents that Tier 1 has already assessed and passed upward.

Trap 3: Tier 3 analyst

Tier 3 handles deep incident investigation, threat hunting and remediation, not first-pass alert triage. It is tempting because the unusual-geography login looks severe, but Tier 3 is the correct choice only once Tier 1 triage confirms a genuine incident requiring advanced analysis.

A
Tier 1 analyst
Tier 1 analysts handle initial alert triage, validating whether the failed logins followed by an anomalous successful login represent a genuine incident before escalation. This monitoring and classification duty sits squarely within Tier 1 responsibilities, with Tier 2 and Tier 3 engaged only after triage confirms escalation is warranted.
B
IT support team
Why it fails: IT support manages user accounts and endpoints, not SIEM alert triage, which sits with the SOC. It is tempting because IT support would eventually reset the compromised account, but that remediation action follows SOC detection and escalation, not the initial triage step.
C
Tier 2 analyst
Why it fails: Tier 2 handles deeper investigation and incident response, not initial alert triage, which is Tier 1's defined responsibility. It is tempting because Tier 2 does perform triage, but only for escalated or complex incidents that Tier 1 has already assessed and passed upward.
D
Tier 3 analyst
Why it fails: Tier 3 handles deep incident investigation, threat hunting and remediation, not first-pass alert triage. It is tempting because the unusual-geography login looks severe, but Tier 3 is the correct choice only once Tier 1 triage confirms a genuine incident requiring advanced analysis.

Question 10hardmultiple choice

A security operations center (SOC) analyst is investigating an alert about a user downloading a suspicious file. The analyst opens the file on a sandboxed virtual machine and observes that it attempts to modify registry keys and establish persistence. This type of analysis is known as:

Trap 1: Static analysis

Static analysis examines file contents, strings and headers without executing the sample, so registry modification and persistence cannot be observed that way. It tempts because static analysis is the correct first-pass triage technique when you need indicators quickly without risking execution.

Trap 2: Reverse engineering

Reverse engineering disassembles or decompiles code to reconstruct its logic, whereas this scenario only observes runtime behaviour in a sandbox. It tempts because reverse engineering is the right choice when you must understand obfuscated code or derive detection signatures from a binary's internals.

Trap 3: Threat hunting

Threat hunting is a proactive search for undetected adversaries across the estate, not the execution of one sample in an isolated virtual machine. It tempts because hunting is correct when no alert exists and analysts proactively query telemetry for indicators of compromise.

A
Dynamic analysis
Dynamic analysis executes the sample in an isolated sandbox and observes its runtime behaviour, such as registry modification and persistence mechanisms. This directly satisfies the stem's constraint: the analyst opened the file on a sandboxed virtual machine and watched what it did, rather than inspecting static code without execution.
B
Static analysis
Why it fails: Static analysis examines file contents, strings and headers without executing the sample, so registry modification and persistence cannot be observed that way. It tempts because static analysis is the correct first-pass triage technique when you need indicators quickly without risking execution.
C
Reverse engineering
Why it fails: Reverse engineering disassembles or decompiles code to reconstruct its logic, whereas this scenario only observes runtime behaviour in a sandbox. It tempts because reverse engineering is the right choice when you must understand obfuscated code or derive detection signatures from a binary's internals.
D
Threat hunting
Why it fails: Threat hunting is a proactive search for undetected adversaries across the estate, not the execution of one sample in an isolated virtual machine. It tempts because hunting is correct when no alert exists and analysts proactively query telemetry for indicators of compromise.

Question 11mediummultiple choice

During a security audit, it is discovered that a single employee can approve purchase orders and also receive the goods. Which security principle is being violated?

Trap 1: Defense in depth

Defence in depth layers multiple independent controls so one failure does not expose the system; it does not describe restricting a single person's combined duties. It is tempting because layered controls are a genuine audit concern, but the scenario describes one individual holding two conflicting transaction rights, which is separation of duties.

Trap 2: Least privilege

Least privilege grants only the minimum access needed for a role, but the employee legitimately holds both approval and receiving rights, so no excess permission exists. The violation is that these two conflicting duties reside in one person, which separation of duties prevents by splitting them across different individuals.

Trap 3: Need-to-know

Need-to-know limits access to information strictly required for a task; it governs data exposure, not the combination of transaction authorities. It is tempting because both concepts restrict access, but the purchase-order scenario concerns conflicting duties held by one employee, which separation of duties addresses.

A
Separation of duties
Separation of duties requires that no single person controls both authorisation and custody of an asset. One employee approving purchase orders and receiving the goods enables concealed fraudulent purchases, so splitting those responsibilities is the control being violated.
B
Defense in depth
Why it fails: Defence in depth layers multiple independent controls so one failure does not expose the system; it does not describe restricting a single person's combined duties. It is tempting because layered controls are a genuine audit concern, but the scenario describes one individual holding two conflicting transaction rights, which is separation of duties.
C
Least privilege
Why it fails: Least privilege grants only the minimum access needed for a role, but the employee legitimately holds both approval and receiving rights, so no excess permission exists. The violation is that these two conflicting duties reside in one person, which separation of duties prevents by splitting them across different individuals.
D
Need-to-know
Why it fails: Need-to-know limits access to information strictly required for a task; it governs data exposure, not the combination of transaction authorities. It is tempting because both concepts restrict access, but the purchase-order scenario concerns conflicting duties held by one employee, which separation of duties addresses.

Question 12easymultiple choice

A security analyst is implementing controls to prevent unauthorized disclosure of sensitive information. Which element of the CIA triad is being addressed?

Trap 1: Non-repudiation

Non-repudiation proves that a party performed an action, typically through digital signatures or audit logs, so it addresses deniability rather than disclosure. It is tempting because it is often listed alongside the CIA triad in security frameworks, and non-repudiation would be correct if the scenario required proving who sent or approved a transaction.

Trap 2: Integrity

Integrity guards data against unauthorised modification, so it addresses tampering, not disclosure. It is tempting because integrity controls such as hashing and digital signatures are frequently deployed alongside confidentiality measures, and integrity would be the correct answer if the scenario described altered or corrupted records rather than exposed ones.

Trap 3: Availability

Availability ensures data and services remain accessible to authorised users, so it addresses disruption, not disclosure. It is tempting because availability controls such as redundancy and backups are commonly implemented in the same programmes as confidentiality controls, and availability would be correct if the scenario described denial of service or downtime rather than exposure.

A
Non-repudiation
Why it fails: Non-repudiation proves that a party performed an action, typically through digital signatures or audit logs, so it addresses deniability rather than disclosure. It is tempting because it is often listed alongside the CIA triad in security frameworks, and non-repudiation would be correct if the scenario required proving who sent or approved a transaction.
B
Integrity
Why it fails: Integrity guards data against unauthorised modification, so it addresses tampering, not disclosure. It is tempting because integrity controls such as hashing and digital signatures are frequently deployed alongside confidentiality measures, and integrity would be the correct answer if the scenario described altered or corrupted records rather than exposed ones.
C
Availability
Why it fails: Availability ensures data and services remain accessible to authorised users, so it addresses disruption, not disclosure. It is tempting because availability controls such as redundancy and backups are commonly implemented in the same programmes as confidentiality controls, and availability would be correct if the scenario described denial of service or downtime rather than exposure.
D
Confidentiality
Confidentiality directly addresses preventing unauthorised disclosure, which is the exact control objective stated in the stem. Encryption, access controls and data classification enforce confidentiality by restricting data access to authorised parties only. Integrity would concern unauthorised modification, and availability would concern timely access, neither of which matches the disclosure constraint.

Question 13mediummultiple choice

A government agency uses a multi-level security system with mandatory access control (MAC). A user with Secret clearance attempts to write data to a file classified as Confidential. Under the Bell-LaPadula model, which rule applies and what is the outcome?

Trap 1: The simple security property (no read up) denies the operation

The simple security property governs reading, not writing; the write-down attempt is controlled by the *-property, which denies it. It tempts because the simple security property is the best-known Bell-LaPadula rule, and would be correct if the user were attempting to read a file above their clearance.

Trap 2: The *-property allows the operation because the user is writing down

The *-property (no write down) forbids writing to a lower classification, so the operation is denied, not allowed. It tempts because the *-property genuinely governs write operations, and would be correct if the user were writing up to a level at or above their clearance.

Trap 3: The simple security property allows the operation because the…

The simple security property restricts reads, not writes, and clearance level does not authorise writing down to a lower classification. It tempts because higher clearance intuitively permits more access, and would be correct if the user were reading a Confidential file, which no-read-up allows.

A
The simple security property (no read up) denies the operation
Why it fails: The simple security property governs reading, not writing; the write-down attempt is controlled by the *-property, which denies it. It tempts because the simple security property is the best-known Bell-LaPadula rule, and would be correct if the user were attempting to read a file above their clearance.
B
The *-property allows the operation because the user is writing down
Why it fails: The *-property (no write down) forbids writing to a lower classification, so the operation is denied, not allowed. It tempts because the *-property genuinely governs write operations, and would be correct if the user were writing up to a level at or above their clearance.
C
The simple security property allows the operation because the user's clearance is higher
Why it fails: The simple security property restricts reads, not writes, and clearance level does not authorise writing down to a lower classification. It tempts because higher clearance intuitively permits more access, and would be correct if the user were reading a Confidential file, which no-read-up allows.
D
The *-property (no write down) denies the operation
The Bell-LaPadula model's \*-property (star property) specifically enforces "no write down", a critical rule for maintaining confidentiality. This property dictates that a subject cannot write to an object with a lower security classification. Here, the user with Secret clearance attempts to write to a Confidential file. As Secret is a higher classification than Confidential, this operation is a write-down, which the \*-property consequently denies to prevent information flow to lower levels.

Question 14hardmultiple choice

An organization uses a layered security approach: perimeter fencing, access badge readers at building entrances, biometric scanners in server rooms, and cable locks on laptops. This strategy best exemplifies which access control concept?

Trap 1: Need-to-know

Need-to-know limits data access to those whose duties require it. The stem instead layers fencing, badges, biometrics and cable locks so one failure does not expose assets, which is defence in depth; need-to-know would restrict which records each employee may view.

Trap 2: Least privilege

Least privilege limits each user's rights to the minimum needed for their role; it concerns authorisation scope, not stacking physical barriers. Layered fencing, badges, biometrics and cable locks demonstrate defence in depth, where each control compensates if another fails. Least privilege would be correct when scoping an account's permissions to only its required resources.

Trap 3: Separation of duties

Separation of duties splits a critical task across multiple people so no single person completes it alone; it concerns workflow division, not concentric physical barriers. The scenario illustrates defence in depth, where independent controls at successive layers each mitigate failure of the others. Separation of duties would be correct when, for example, one person raises a payment and another approves it.

A
Need-to-know
Why it fails: Need-to-know limits data access to those whose duties require it. The stem instead layers fencing, badges, biometrics and cable locks so one failure does not expose assets, which is defence in depth; need-to-know would restrict which records each employee may view.
B
Defense in depth
Layering fencing, badge readers, biometrics and cable locks creates successive independent barriers, so defeating one control still leaves others. This matches defence in depth, which the stem's layered approach exemplifies, rather than single-mechanism concepts such as least privilege or separation of duties.
C
Least privilege
Why it fails: Least privilege limits each user's rights to the minimum needed for their role; it concerns authorisation scope, not stacking physical barriers. Layered fencing, badges, biometrics and cable locks demonstrate defence in depth, where each control compensates if another fails. Least privilege would be correct when scoping an account's permissions to only its required resources.
D
Separation of duties
Why it fails: Separation of duties splits a critical task across multiple people so no single person completes it alone; it concerns workflow division, not concentric physical barriers. The scenario illustrates defence in depth, where independent controls at successive layers each mitigate failure of the others. Separation of duties would be correct when, for example, one person raises a payment and another approves it.

Question 15mediummultiple choice

An organization wants to allow external users to securely access internal web applications. Which network security device is specifically designed to inspect HTTP/HTTPS traffic and block malicious requests?

Trap 1: Stateful firewall

A stateful firewall tracks connection state but still decides on Layer 3/4 header and session information, not HTTP/HTTPS content, so it cannot block malicious requests inside encrypted or application-layer traffic. It is tempting because it is a firewall, and it would be correct for controlling established TCP sessions by port and state.

Trap 2: Intrusion Detection System (IDS)

An IDS passively copies traffic and raises alerts; it does not sit inline to block malicious HTTP/HTTPS requests, so it cannot enforce the stated requirement. It is tempting because signature-based detection genuinely inspects application payloads, and an IDS is the correct choice when the goal is monitoring and alerting rather than prevention.

Trap 3: Packet filtering firewall

A packet-filtering firewall evaluates only headers such as source/destination IP, port and protocol, so it cannot inspect HTTP/HTTPS payloads or identify malicious requests. It is tempting because it does filter traffic, and it would be correct where simple ACL-style permit/deny rules on addresses and ports suffice.

A
Stateful firewall
Why it fails: A stateful firewall tracks connection state but still decides on Layer 3/4 header and session information, not HTTP/HTTPS content, so it cannot block malicious requests inside encrypted or application-layer traffic. It is tempting because it is a firewall, and it would be correct for controlling established TCP sessions by port and state.
B
Web Application Firewall (WAF)
A Web Application Firewall operates at Layer 7, inspecting HTTP/HTTPS request content against rule sets to block SQL injection, cross-site scripting and similar exploits. This directly satisfies the stem's requirement to inspect web traffic and block malicious requests, unlike packet-filtering firewalls that cannot parse application payloads.
C
Intrusion Detection System (IDS)
Why it fails: An IDS passively copies traffic and raises alerts; it does not sit inline to block malicious HTTP/HTTPS requests, so it cannot enforce the stated requirement. It is tempting because signature-based detection genuinely inspects application payloads, and an IDS is the correct choice when the goal is monitoring and alerting rather than prevention.
D
Packet filtering firewall
Why it fails: A packet-filtering firewall evaluates only headers such as source/destination IP, port and protocol, so it cannot inspect HTTP/HTTPS payloads or identify malicious requests. It is tempting because it does filter traffic, and it would be correct where simple ACL-style permit/deny rules on addresses and ports suffice.

Question 16easymultiple choice

A system administrator must grant a help desk technician the ability to reset user passwords but not change user roles. Which security principle does this scenario enforce?

Trap 1: Accountability

Accountability is the principle that actions are traceable to an identity through logging and audit, which password reset permissions do not enforce. It is tempting because help desk roles are audited, but least privilege is the principle that grants only the reset capability while withholding role-change rights.

Trap 2: Need-to-know

Need-to-know governs access to specific data based on relevance to a task, not which actions a role may perform. It is tempting because help desk staff access user accounts, but the scenario restricts permitted operations, which is least privilege, not data relevance.

Trap 3: Non-repudiation

Non-repudiation proves a party performed an action, typically via digital signatures or audit logs, so it cannot address restricting a technician's permissions. It is tempting because logging password resets supports accountability, but the scenario enforces least privilege by limiting the technician to password resets only.

A
Accountability
Why it fails: Accountability is the principle that actions are traceable to an identity through logging and audit, which password reset permissions do not enforce. It is tempting because help desk roles are audited, but least privilege is the principle that grants only the reset capability while withholding role-change rights.
B
Principle of least privilege
Granting only password-reset rights, while withholding role-assignment permissions, enforces least privilege: each identity receives the minimum access needed for its tasks. Microsoft Entra ID supports this through scoped administrative roles such as Password Administrator, which cannot modify role memberships, satisfying the stem's constraint that role changes remain blocked.
C
Need-to-know
Why it fails: Need-to-know governs access to specific data based on relevance to a task, not which actions a role may perform. It is tempting because help desk staff access user accounts, but the scenario restricts permitted operations, which is least privilege, not data relevance.
D
Non-repudiation
Why it fails: Non-repudiation proves a party performed an action, typically via digital signatures or audit logs, so it cannot address restricting a technician's permissions. It is tempting because logging password resets supports accountability, but the scenario enforces least privilege by limiting the technician to password resets only.

Question 17mediummulti select

A security policy requires that data classified as 'Confidential' must be encrypted both at rest and in transit. Which TWO of the following are likely data handling requirements for 'Confidential' data? (Select TWO)

Trap 1: Data may be posted on the public website

Posting Confidential data on a public website directly contradicts the required at-rest and in-transit encryption, since public web content is openly readable and typically served over plain HTTP. It is tempting because publishing to a website is a legitimate handling method for data classified as Public, where no encryption or access restriction is mandated.

Trap 2: Data can be shared with any vendor without a contract

Sharing with any vendor without a contract breaches the confidentiality requirement, since encryption at rest and in transit cannot be enforced or verified across an uncontrolled third party. It is tempting because low-sensitivity classifications, such as Public, permit unrestricted disclosure; vendor contracts and encryption clauses belong to Confidential and Restricted handling instead.

Trap 3: Data must be deleted after 30 days regardless of business need

A 30-day deletion mandate is a retention control, not an encryption control, so it cannot satisfy the stem's at-rest and in-transit encryption requirement. It tempts because retention limits genuinely reduce exposure of confidential data, and would be correct if the policy instead demanded minimisation or automatic purge schedules.

A
Data may be posted on the public website
Why it fails: Posting Confidential data on a public website directly contradicts the required at-rest and in-transit encryption, since public web content is openly readable and typically served over plain HTTP. It is tempting because publishing to a website is a legitimate handling method for data classified as Public, where no encryption or access restriction is mandated.
B
Access to data must be restricted to authorized personnel only
Confidential data demands need-to-know handling, so restricting access to authorised personnel only enforces least privilege and prevents unauthorised disclosure. This complements the encryption mandate by controlling who may reach the data at all, satisfying the policy's confidentiality requirement beyond cryptographic protection alone.
C
Data can be shared with any vendor without a contract
Why it fails: Sharing with any vendor without a contract breaches the confidentiality requirement, since encryption at rest and in transit cannot be enforced or verified across an uncontrolled third party. It is tempting because low-sensitivity classifications, such as Public, permit unrestricted disclosure; vendor contracts and encryption clauses belong to Confidential and Restricted handling instead.
D
Data must be encrypted when stored on servers
Encryption at rest directly implements the policy's explicit requirement that Confidential data be encrypted when stored. Storing ciphertext on servers ensures that even if media or backups are compromised, the data remains unreadable, satisfying the at-rest half of the stated encryption mandate.
E
Data must be deleted after 30 days regardless of business need
Why it fails: A 30-day deletion mandate is a retention control, not an encryption control, so it cannot satisfy the stem's at-rest and in-transit encryption requirement. It tempts because retention limits genuinely reduce exposure of confidential data, and would be correct if the policy instead demanded minimisation or automatic purge schedules.

Question 18mediummultiple choice

A security analyst discovers that a user's account has been used to access sensitive data outside of normal business hours from an unfamiliar IP address. The user claims they were not logged in at that time. Which security operations process should be initiated first?

Trap 1: Perform a forensic analysis of the user's workstation

Forensic analysis of the workstation presumes the compromise originated there, yet the unfamiliar IP indicates external access; imaging the endpoint first delays containment while the attacker retains access. It is tempting because forensics preserves evidence, and it would be correct after triage confirms endpoint involvement rather than an external session.

Trap 2: Reset the user's password and enforce multi-factor authentication

Resetting the password and enforcing multi-factor authentication is containment, which should follow triage and evidence preservation; doing it first may lock out the attacker but also destroys session artefacts and alerts them. It is tempting because credential reset is a standard remediation, and it would be correct once the incident is confirmed as account compromise.

Trap 3: Disable the user account immediately

Disabling the account destroys volatile evidence such as active sessions, tokens and attacker persistence, and does not determine whether the activity was malicious; containment follows triage, not precedes it. It is tempting because account lockout is a familiar immediate response, and it would be right once compromise is confirmed and evidence preserved.

A
Perform a forensic analysis of the user's workstation
Why it fails: Forensic analysis of the workstation presumes the compromise originated there, yet the unfamiliar IP indicates external access; imaging the endpoint first delays containment while the attacker retains access. It is tempting because forensics preserves evidence, and it would be correct after triage confirms endpoint involvement rather than an external session.
B
Reset the user's password and enforce multi-factor authentication
Why it fails: Resetting the password and enforcing multi-factor authentication is containment, which should follow triage and evidence preservation; doing it first may lock out the attacker but also destroys session artefacts and alerts them. It is tempting because credential reset is a standard remediation, and it would be correct once the incident is confirmed as account compromise.
C
Disable the user account immediately
Why it fails: Disabling the account destroys volatile evidence such as active sessions, tokens and attacker persistence, and does not determine whether the activity was malicious; containment follows triage, not precedes it. It is tempting because account lockout is a familiar immediate response, and it would be right once compromise is confirmed and evidence preserved.
D
Initiate the incident response process
Anomalous access from an unfamiliar IP outside business hours, with the user denying it, indicates possible credential compromise. Initiating incident response first enables containment, evidence preservation and scoping before any account remediation, satisfying the need to handle a suspected security incident systematically.

Question 19hardmultiple choice

During a tabletop exercise for a data center outage, the IT manager realizes that the disaster recovery plan does not specify how to failover the database cluster. The primary data center fails completely. The standby site has a replica of the database, but the application team cannot promote it because they lack the necessary privileges. What is the most likely cause of this gap?

Trap 1: The standby site's network connectivity was not tested

Network connectivity determines whether the standby replica is reachable, not whether operators hold promotion rights. The stem's failure is an authorisation gap: the runbook omits the credential or role needed to promote the replica. Connectivity testing would be the correct focus if the standby were unreachable or the failover timed out during the exercise.

Trap 2: The database replication configuration was incorrect

Replication configuration governs whether data copies correctly to the standby, not whether the team can promote it. The replica exists and is presumably current; the blocker is missing privileges. Verifying replication settings would be the right step if the standby held stale or absent data, which the stem does not describe.

Trap 3: The database failover procedure was not documented

Documentation gaps cause knowledge loss, not missing database privileges; the team knows the failover intent but cannot execute it. The cause is that failover account permissions were never provisioned at the standby site. Documenting procedures would be the fix where staff lack the knowledge, not the rights.

A
The standby site's network connectivity was not tested
Why it fails: Network connectivity determines whether the standby replica is reachable, not whether operators hold promotion rights. The stem's failure is an authorisation gap: the runbook omits the credential or role needed to promote the replica. Connectivity testing would be the correct focus if the standby were unreachable or the failover timed out during the exercise.
B
The database replication configuration was incorrect
Why it fails: Replication configuration governs whether data copies correctly to the standby, not whether the team can promote it. The replica exists and is presumably current; the blocker is missing privileges. Verifying replication settings would be the right step if the standby held stale or absent data, which the stem does not describe.
C
The database failover procedure was not documented
Why it fails: Documentation gaps cause knowledge loss, not missing database privileges; the team knows the failover intent but cannot execute it. The cause is that failover account permissions were never provisioned at the standby site. Documenting procedures would be the fix where staff lack the knowledge, not the rights.
D
The DR plan did not include role-based access for failover operations
Failover stalled because the application team lacked privileges to promote the replica, so the DR plan omitted the role-based access assignments needed for that operation. Documenting those permissions satisfies the stem's requirement that failover steps be executable during a primary-site outage.

Question 20hardmultiple choice

A security analyst is reviewing logs and finds that a user accessed files outside of their department. The user claims it was necessary for a project. Which principle should the analyst use to assess whether this was appropriate?

Trap 1: Accountability

Accountability establishes that actions are attributable to an identity, but it does not by itself judge whether cross-department access was warranted. Accountability is the right principle when attributing activity, such as confirming which account performed an action.

Trap 2: Separation of duties

Separation of duties prevents one person holding conflicting responsibilities, typically splitting sensitive tasks across roles. It does not assess whether a single user's file access was justified, which is the question here; it applies when designing approval or transaction workflows.

Trap 3: Least privilege

Least privilege governs what access a user should hold, but the stem asks which principle evaluates whether an action taken was justified and traceable. Least privilege is the correct lens when designing or reviewing role permissions and entitlements.

A
Need to know
Need to know limits access to data strictly required for a task, regardless of rank. The analyst must judge whether the project genuinely required those files, so this principle directly tests whether the access was appropriate rather than merely permitted.
B
Accountability
Why it fails: Accountability establishes that actions are attributable to an identity, but it does not by itself judge whether cross-department access was warranted. Accountability is the right principle when attributing activity, such as confirming which account performed an action.
C
Separation of duties
Why it fails: Separation of duties prevents one person holding conflicting responsibilities, typically splitting sensitive tasks across roles. It does not assess whether a single user's file access was justified, which is the question here; it applies when designing approval or transaction workflows.
D
Least privilege
Why it fails: Least privilege governs what access a user should hold, but the stem asks which principle evaluates whether an action taken was justified and traceable. Least privilege is the correct lens when designing or reviewing role permissions and entitlements.