Scenario practice questions

A security analyst needs to verify that a downloaded file has not been tampered with. The publisher provides a SHA-256 hash. Which property of the hash function is being relied upon?

Trap 1: Avalanche effect

The avalanche effect refers to a small change in input causing a drastic change in output. While important for hash functions, it is not the property directly relied upon for integrity verification using a provided hash.

Trap 2: Collision resistance

Collision resistance ensures that it is hard to find any two different inputs that hash to the same value. However, in this scenario, the attacker is given the original hash and must find a different file with that hash, which is second pre-image resistance. Collision resistance is a stronger property but not specifically required.

Trap 3: Pre-image resistance

Pre-image resistance ensures that given a hash, it is hard to find any input that produces it. However, in this scenario, the analyst already has the original file's hash and is comparing computed hash to that. Pre-image resistance is about reversing the hash, not about finding a different input with the same hash. Second pre-image resistance is the correct property.

A
Avalanche effect
Why wrong: The avalanche effect refers to a small change in input causing a drastic change in output. While important for hash functions, it is not the property directly relied upon for integrity verification using a provided hash.
B
Collision resistance
Why wrong: Collision resistance ensures that it is hard to find any two different inputs that hash to the same value. However, in this scenario, the attacker is given the original hash and must find a different file with that hash, which is second pre-image resistance. Collision resistance is a stronger property but not specifically required.
C
Second pre-image resistance
Second pre-image resistance is correct. Given the provided SHA-256 hash of the original file, the property ensures that an attacker cannot find a different file that produces the same hash, thus verifying integrity.
D
Pre-image resistance
Why wrong: Pre-image resistance ensures that given a hash, it is hard to find any input that produces it. However, in this scenario, the analyst already has the original file's hash and is comparing computed hash to that. Pre-image resistance is about reversing the hash, not about finding a different input with the same hash. Second pre-image resistance is the correct property.

Question 2easymultiple choice

A system administrator needs to implement a control that ensures users can only access files necessary for their job functions. Which principle is being applied?

Trap 1: Need-to-know

Need-to-know restricts access to information required for a specific task, but least privilege is broader.

Trap 2: Separation of duties

Separation of duties divides critical tasks among multiple people, not about minimum access.

Trap 3: Job rotation

Job rotation moves employees across roles to reduce fraud risk, not about access levels.

A
Need-to-know
Why wrong: Need-to-know restricts access to information required for a specific task, but least privilege is broader.
B
Separation of duties
Why wrong: Separation of duties divides critical tasks among multiple people, not about minimum access.
C
Job rotation
Why wrong: Job rotation moves employees across roles to reduce fraud risk, not about access levels.
D
Least privilege
Least privilege ensures users have only the permissions necessary to perform their job.

Question 3easymultiple choice

A company is migrating its on-premises applications to a public cloud. Which security control is MOST important to implement to protect data in transit?

Trap 1: Enable server-side encryption for cloud storage.

Protects data at rest, not in transit.

Trap 2: Implement data classification labels.

Data classification helps with handling but does not protect data in transit.

Trap 3: Use IPsec VPNs for all cloud connections.

IPsec is one option but not always necessary; TLS is more common for web traffic.

A
Enable server-side encryption for cloud storage.
Why wrong: Protects data at rest, not in transit.
B
Implement data classification labels.
Why wrong: Data classification helps with handling but does not protect data in transit.
C
Use IPsec VPNs for all cloud connections.
Why wrong: IPsec is one option but not always necessary; TLS is more common for web traffic.
D
Ensure all data transmissions use TLS 1.2 or higher.
TLS encrypts data in transit and is widely supported.

Question 4mediummultiple choice

A company uses a SIEM to detect anomalies. An alert indicates a user logged in from two geographically distant locations within 5 minutes. What is the most likely indication?

Trap 1: Insider threat

An insider would normally not need to log in from two distant locations rapidly.

Trap 2: Time synchronization issue

Time sync issues would affect timestamps but not produce logins from different locations.

Trap 3: Misconfigured VPN

A misconfigured VPN might cause multiple logins but not typically from geographically distant locations.

A
Insider threat
Why wrong: An insider would normally not need to log in from two distant locations rapidly.
B
Time synchronization issue
Why wrong: Time sync issues would affect timestamps but not produce logins from different locations.
C
Credential theft and reuse
This is a classic sign of stolen credentials being used by an attacker.
D
Misconfigured VPN
Why wrong: A misconfigured VPN might cause multiple logins but not typically from geographically distant locations.

Question 5hardmultiple choice

A cloud security team is using Cloud Security Posture Management (CSPM) to identify misconfigurations. Which of the following scenarios is MOST likely to be detected by CSPM?

Trap 1: An application running on a cloud VM has a memory leak causing…

CSPM focuses on configuration, not application performance issues.

Trap 2: A cloud-based database is experiencing slow query response times

Performance issues are not typically within CSPM scope.

Trap 3: An employee's credentials were used from an unusual geographic…

This is an anomaly detection typically handled by UEBA or SIEM, not CSPM.

A
An application running on a cloud VM has a memory leak causing performance degradation
Why wrong: CSPM focuses on configuration, not application performance issues.
B
A cloud storage bucket is configured with public read access
Publicly accessible buckets are a common misconfiguration detected by CSPM.
C
A cloud-based database is experiencing slow query response times
Why wrong: Performance issues are not typically within CSPM scope.
D
An employee's credentials were used from an unusual geographic location
Why wrong: This is an anomaly detection typically handled by UEBA or SIEM, not CSPM.

Question 6easymultiple choice

A company wants to ensure that data transmitted between its two branch offices remains confidential. Which cryptographic goal is primarily being addressed?

Trap 1: Availability

Availability ensures systems are accessible, not confidentiality.

Trap 2: Non-repudiation

Non-repudiation prevents denial of actions, not confidentiality.

Trap 3: Integrity

Integrity ensures data has not been altered, not confidentiality.

A
Availability
Why wrong: Availability ensures systems are accessible, not confidentiality.
B
Non-repudiation
Why wrong: Non-repudiation prevents denial of actions, not confidentiality.
C
Integrity
Why wrong: Integrity ensures data has not been altered, not confidentiality.
D
Confidentiality
Confidentiality is the goal of keeping data secret, achieved via encryption.

Question 7easymultiple choice

A help desk technician needs to reset a user's password but should not be able to modify other user attributes. Which access control principle should be applied to enforce this restriction?

Trap 1: Need-to-know

Need-to-know limits access to data, not actions; it is not the best fit for restricting operational permissions.

Trap 2: Separation of duties

Separation of duties involves dividing responsibilities among multiple people to prevent fraud, not restricting a single user's permissions.

Trap 3: Mandatory access control

MAC uses sensitivity labels and clearance levels; it is not designed for granular administrative task restrictions.

A
Need-to-know
Why wrong: Need-to-know limits access to data, not actions; it is not the best fit for restricting operational permissions.
B
Least privilege
Least privilege grants only the minimal permissions required to perform a job, which directly applies to restricting the technician to password reset only.
C
Separation of duties
Why wrong: Separation of duties involves dividing responsibilities among multiple people to prevent fraud, not restricting a single user's permissions.
D
Mandatory access control
Why wrong: MAC uses sensitivity labels and clearance levels; it is not designed for granular administrative task restrictions.

Question 8mediummultiple choice

A user reports they can now access files in a shared drive that were previously denied. Upon investigation, the IT team discovers the user was added to a new group that has read/write permissions to the drive. This situation is best described as:

Trap 1: Separation of duties violation

Separation of duties prevents a single person from performing conflicting actions; there is no conflict mentioned.

Trap 2: Inconsistent access control list

An inconsistent ACL might allow unintended access, but the root cause here is group membership change, not ACL inconsistency.

Trap 3: Role explosion

Role explosion refers to an excessive number of roles, not a single user gaining access through group addition.

A
Separation of duties violation
Why wrong: Separation of duties prevents a single person from performing conflicting actions; there is no conflict mentioned.
B
Inconsistent access control list
Why wrong: An inconsistent ACL might allow unintended access, but the root cause here is group membership change, not ACL inconsistency.
C
Role explosion
Why wrong: Role explosion refers to an excessive number of roles, not a single user gaining access through group addition.
D
Privilege creep
The user gained additional permissions through group membership, which is a classic example of privilege creep.

Open the full VLAN trunking answer →

Question 9hardmultiple choice

During a penetration test, the tester captures traffic on a switch port that is part of a VLAN other than the native VLAN. The tester is able to receive traffic destined for the management VLAN. What configuration flaw is exploited?

Trap 1: Spanning tree protocol is enabled

STP prevents loops, not VLAN hopping.

Trap 2: Port security is not enabled

Port security limits MAC addresses, not VLAN hopping.

Trap 3: DHCP snooping is disabled

DHCP snooping prevents rogue DHCP, not VLAN hopping.

A
Spanning tree protocol is enabled
Why wrong: STP prevents loops, not VLAN hopping.
B
Trunk port misconfiguration with native VLAN mismatch
If the native VLAN on trunk matches management VLAN, frames can be double-tagged to hop VLANs.
C
Port security is not enabled
Why wrong: Port security limits MAC addresses, not VLAN hopping.
D
DHCP snooping is disabled
Why wrong: DHCP snooping prevents rogue DHCP, not VLAN hopping.
E
VLAN trunking protocol (VTP) is set to transparent mode
Why wrong: VTP mode does not affect VLAN hopping.

Question 10hardmultiple choice

A company has a policy requiring segregation of duties (SoD) for financial transactions. Which scenario represents a violation of this principle?

Trap 1: The system administrator performs backups, and the security officer…

Different roles performing independent tasks.

Trap 2: Two managers must each approve any expenditure over $10,000

This is a control, not a violation.

Trap 3: The purchasing manager creates purchase orders, and the accounts…

Duties are properly separated.

A
The system administrator performs backups, and the security officer reviews audit logs
Why wrong: Different roles performing independent tasks.
B
The finance officer approves invoices and also reconciles the bank statements
This combines authorization with verification, a SoD violation.
C
Two managers must each approve any expenditure over $10,000
Why wrong: This is a control, not a violation.
D
The purchasing manager creates purchase orders, and the accounts payable clerk processes payments
Why wrong: Duties are properly separated.

Question 11easymultiple choice

Refer to the exhibit. A security analyst notices that multiple internal hosts are using the same inside global IP address but different port numbers. Which technology is being used?

Exhibit

Router# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
tcp 203.0.113.10:80   192.168.1.10:80    198.51.100.20:80   198.51.100.20:80
tcp 203.0.113.10:443  192.168.1.10:443   198.51.100.20:443  198.51.100.20:443
tcp 203.0.113.11:80   192.168.1.11:80    198.51.100.30:80   198.51.100.30:80

Trap 1: Dynamic NAT

Dynamic NAT uses a pool of public IPs.

Trap 2: Static NAT

Static NAT maps one private IP to one public IP.

Trap 3: Port forwarding

Port forwarding is used to allow external access to internal services.

A
Dynamic NAT
Why wrong: Dynamic NAT uses a pool of public IPs.
B
Static NAT
Why wrong: Static NAT maps one private IP to one public IP.
C
PAT (Port Address Translation)
PAT allows many internal hosts to share a single public IP by differentiating via port numbers.
D
Port forwarding
Why wrong: Port forwarding is used to allow external access to internal services.

Question 12hardmultiple choice

An analyst reviews a Windows security log. Given the event, what is the MOST likely cause of the lockout?

Exhibit

Refer to the exhibit.
Security event log excerpt:
Event ID: 4625 (Account logon failure)
Account Name: jdoe
Failure Reason: Account locked out
Logon Type: 10 (RemoteInteractive)
Source Network Address: 10.0.1.100
Workstation: WS-102
Timestamp: 2023-06-15 14:23:45

Trap 1: The user's password was changed and they are using the old password

This would show incorrect password, but lockout implies multiple attempts; the logon type still indicates remote.

Trap 2: The user's cached credentials are expired

Cached credential expiration does not generate a lockout event.

Trap 3: The user entered the wrong password at the physical console

Physical logon shows Logon Type 2, not 10.

A
The user's password was changed and they are using the old password
Why wrong: This would show incorrect password, but lockout implies multiple attempts; the logon type still indicates remote.
B
The user's cached credentials are expired
Why wrong: Cached credential expiration does not generate a lockout event.
C
A remote attacker is attempting to brute-force the user's password via RDP
Logon Type 10 (RemoteInteractive) is RDP, and a lockout indicates multiple failed attempts.
D
The user entered the wrong password at the physical console
Why wrong: Physical logon shows Logon Type 2, not 10.

Question 13hardmultiple choice

During a penetration test, an attacker was able to bypass input validation and execute commands on a web server. The server runs a PHP application. Which of the following is the MOST likely root cause?

Trap 1: The application uses unsanitized input in SQL queries.

SQL injection leads to database access, not command execution.

Trap 2: The application reflects user input in HTTP responses without…

XSS vulnerability, but does not directly execute commands on server.

Trap 3: The application uses hidden form fields to store session tokens.

CSRF vulnerability, not command execution.

A
The application uses unsanitized input in SQL queries.
Why wrong: SQL injection leads to database access, not command execution.
B
The application reflects user input in HTTP responses without escaping.
Why wrong: XSS vulnerability, but does not directly execute commands on server.
C
The application passes user input to a shell command via exec() or system() functions.
Command injection allows arbitrary command execution on the server.
D
The application uses hidden form fields to store session tokens.
Why wrong: CSRF vulnerability, not command execution.

Question 14hardmultiple choice

Refer to the exhibit. A security analyst reviews these iptables rules and expects SSH access to be blocked, but it is still allowed. What is the MOST likely reason?

Network Topology

Trap 1: The DROP rule does not apply to SSH.

The rule specifically targets port 22 (SSH).

Trap 2: The DROP rule is misconfigured with wrong source.

Source is 0.0.0.0/0, which matches all.

Trap 3: The default policy allows traffic, overriding the DROP rule.

Default policy only applies if no rule matches.

A
The DROP rule does not apply to SSH.
Why wrong: The rule specifically targets port 22 (SSH).
B
The DROP rule is misconfigured with wrong source.
Why wrong: Source is 0.0.0.0/0, which matches all.
C
The ACCEPT rule matches before the DROP rule.
iptables processes rules in order; the first match wins.
D
The default policy allows traffic, overriding the DROP rule.
Why wrong: Default policy only applies if no rule matches.

Question 15easymultiple choice

A system administrator needs to assign permissions to a new employee who will be performing database backups. The employee should only be able to execute the backup command but not read or modify the data. Which access control principle should be applied?

Trap 1: Need to know

Need to know applies to information access, not command execution.

Trap 2: Separation of duties

Separation of duties splits critical tasks among multiple people, not relevant here.

Trap 3: Defense in depth

Defense in depth is a layered security approach, not a permission assignment principle.

A
Need to know
Why wrong: Need to know applies to information access, not command execution.
B
Least privilege
Least privilege grants only the permissions required to perform the job.
C
Separation of duties
Why wrong: Separation of duties splits critical tasks among multiple people, not relevant here.
D
Defense in depth
Why wrong: Defense in depth is a layered security approach, not a permission assignment principle.

Question 16mediummulti select

A company is conducting a disaster recovery test. Which TWO types of tests involve minimal risk to production operations?

Trap 1: Simulation test

Simulations may involve some system interaction and moderate risk.

Trap 2: Parallel test

Parallel tests run DR systems alongside production, which can still pose some risk.

Trap 3: Full interruption test

This test involves actual failover and carries the highest risk.

A
Tabletop exercise
A discussion-based exercise with no actual system changes.
B
Simulation test
Why wrong: Simulations may involve some system interaction and moderate risk.
C
Parallel test
Why wrong: Parallel tests run DR systems alongside production, which can still pose some risk.
D
Walkthrough
A step-by-step review of the plan without actual execution.
E
Full interruption test
Why wrong: This test involves actual failover and carries the highest risk.