Free CompTIA SecurityX (CAS-005) Practice Exam (2026)

Your score by topic

Get a free SecurityX study plan on WhatsApp See CompTIA SecurityX Training with pass guarantee

Review answers Only my mistakes Retake

Question 1Security Engineering⚑ Flag

Several Linux servers recently joined to Active Directory at Corriveau Foods intermittently fail Kerberos authentication with a 'clock skew too great' error, while Windows hosts work normally. What should the administrator do?

APoint the Linux hosts at the domain's NTP time source BDelete and recreate the AD computer accounts for each Linux host CRegister new SPNs for each Linux server hostname DSwitch the Linux hosts to LDAP simple binds

Correct answer: A. Point the Linux hosts at the domain's NTP time source
Kerberos rejects tickets when client and KDC clocks differ by more than the allowed tolerance, which defaults to five minutes in Active Directory. Recreating computer accounts or SPNs fixes identity problems, not time problems.

Question 2Security Architecture⚑ Flag

Ardent Payments' load balancer uses TCP port checks to decide whether web nodes are healthy. Last week a node's database connection pool failed, and it returned HTTP 500 errors to a third of users for an hour while still passing checks. What is the BEST design change?

AAdd a second load balancer in an active-passive pair for redundancy BSwitch the load balancing algorithm from round robin to least connections CUse an HTTP health check against an endpoint that tests key dependencies DIncrease the TCP health check frequency from 30 seconds to 5 seconds

Correct answer: C. Use an HTTP health check against an endpoint that tests key dependencies
An application-layer health check that exercises critical dependencies, such as the database, lets the load balancer remove nodes that accept connections but cannot serve requests. Faster TCP checks would still pass because the port stayed open.

Question 3Security Operations⚑ Flag

A SIEM rule at Norhaven Group alerts on administrator logins from unusual countries. Most alerts trace to the company's own cloud VPN egress points in other regions. The SOC wants fewer false positives while still catching real foreign logins. What is the BEST improvement?

AChange the rule to alert only after ten foreign logins by the same account BRemove geolocation from the rule and alert on every administrator login CSuppress all administrator login alerts during normal business hours DEnrich login events with the known VPN egress ranges and identity context

Correct answer: D. Enrich login events with the known VPN egress ranges and identity context
Enriching events with VPN egress ranges lets the rule tell company infrastructure apart from real foreign sources, which removes the false positives without blinding the rule. A count threshold cuts noise but would miss an attacker who needs only one or two logins.

Question 4Governance, Risk & Compliance⚑ Flag

A board wants a framework that aligns IT with enterprise goals, separates governance from management, and defines objectives and metrics for IT performance. Which framework BEST fits this need?

AISO 22301 BNIST SP 800-115 CITIL DCOBIT

Correct answer: D. COBIT
COBIT is an IT governance and management framework that links IT objectives to enterprise goals and clearly separates governance from management. ITIL focuses on IT service management practices, not board-level governance.

Question 5Security Engineering⚑ Flag

After domain controllers at Ashgrove Credit Union began requiring LDAP signing, a legacy HR application that binds on port 389 with simple authentication stopped syncing users. What is the MOST secure way to restore the integration?

AMove the HR application to a Kerberos-only subnet BConfigure the application to use LDAPS on port 636 or StartTLS CTurn off the LDAP signing requirement on the domain controllers DAllow anonymous binds from the HR application server's IP

Correct answer: B. Configure the application to use LDAPS on port 636 or StartTLS
Simple binds over cleartext LDAP send credentials unprotected, so the fix is to wrap the session in TLS using LDAPS or StartTLS. Turning off the signing requirement would reopen the exposure the change was meant to close.

Question 6Security Architecture⚑ Flag

Saltmarsh Media routes its site through a CDN with an integrated WAF. A penetration test found the origin servers' public IP addresses in old DNS records and sent attacks straight to the origin, bypassing the WAF. Which action BEST fixes the design flaw?

AEnable DNSSEC on the domain to protect the public records BAccept origin traffic only from the CDN, using mutual TLS CChange the origin servers' public IP addresses to new ones DAdd a second WAF rule set with stricter injection signatures

Correct answer: B. Accept origin traffic only from the CDN, using mutual TLS
The origin must refuse any traffic that did not pass through the CDN, for example by allowing only CDN source ranges and requiring a client certificate. Changing IP addresses only hides the origin until the new address leaks again.

Question 7Security Operations⚑ Flag

An analyst at Garrow Pharma notices that one workstation sends thousands of DNS TXT queries per hour with long, random-looking subdomains to a single domain. Other hosts send a few dozen. Which analytic would BEST detect this pattern across the fleet?

AAlert on any DNS query that uses UDP port 53 instead of TCP port 53 BAlert when any host queries a domain registered in a foreign country CAlert when DNS responses take longer than the average resolver latency DCompare per-host query volume and subdomain entropy against a baseline

Correct answer: D. Compare per-host query volume and subdomain entropy against a baseline
DNS tunneling shows high query volume and long, high-entropy subdomains, so per-host baselines of volume and entropy expose it. Registration country is a weak signal with many false positives and says nothing about the tunneling behavior itself.

Question 8Governance, Risk & Compliance⚑ Flag

An audit finds that 30% of production Linux servers differ from the approved hardened baseline, and no one can explain the changes. Which practice MOST directly prevents this from recurring?

AQuarterly vulnerability scans of every server BRebuilding servers yearly from the original image CDrift detection tied to approved change records DAdding more reviewers to the change advisory board

Correct answer: C. Drift detection tied to approved change records
Continuous configuration monitoring compares systems to the baseline and flags any change that lacks an approved change record. Vulnerability scans find known weaknesses but do not reconcile configuration changes against authorized changes.

Question 9Security Engineering⚑ Flag

Rydell Manufacturing moved user certificate issuance to a new intermediate CA under the same root. Users with new certificates now fail VPN certificate authentication, while users with older certificates connect normally. What is the MOST likely cause?

AThe OCSP stapling cache on the VPN gateway has filled up BThe new intermediate CA is missing from the VPN trust chain CThe new user certificates were issued with too short a key length DThe root CA certificate has expired on the VPN gateway

Correct answer: B. The new intermediate CA is missing from the VPN trust chain
Only certificates from the new intermediate fail, which points to the gateway being unable to build a chain from those certificates to the trusted root. An expired root would break all users, including those with older certificates.

Question 10Security Architecture⚑ Flag

A trading firm requires zero data loss if its primary data center fails and must also survive a regional disaster. The chosen DR region is 1,800 km away, and synchronous writes over that distance would exceed latency limits. Which design BEST meets the requirements?

ASynchronous replication to the DR region with write caching enabled BAsynchronous replication directly from the primary to the DR region CSynchronous copy to a nearby site plus async copy to the far region DNightly full backups shipped to the DR region with hourly log backups

Correct answer: C. Synchronous copy to a nearby site plus async copy to the far region
Synchronous replication to a site within metro distance gives zero data loss for a data center failure without long-distance latency, and asynchronous replication to the remote region adds regional disaster protection. Direct asynchronous replication cannot guarantee zero data loss because acknowledged writes may not yet have reached the DR copy.

Question 11Security Operations⚑ Flag

Pembroke Mining has 40 remote sites with limited bandwidth that drops several times a week. Logs from these sites are often missing in the central SIEM after outages. What is the BEST architectural fix?

ADeploy local log collectors that filter, compress and buffer events before forwarding BSend all logs from each site directly to the central SIEM over UDP syslog in real time CReduce log retention at the central SIEM to free capacity for remote sites DHave site staff export logs to removable media and ship them monthly

Correct answer: A. Deploy local log collectors that filter, compress and buffer events before forwarding
Local collectors store events during outages and forward them when links return, while filtering and compression reduce bandwidth needs. Direct UDP syslog is the opposite of what is needed, since UDP has no delivery guarantee and drops data when the link fails.

Question 12Security Engineering⚑ Flag

Penrose Bank is adding facial recognition to its mobile app login. The fraud team is worried that criminals will hold printed photos or replay videos of customers in front of the camera. Which control BEST addresses this concern?

ARequiring a stronger password alongside face login BPresentation attack detection with liveness checks CLowering the false rejection rate threshold DStoring face templates in a central database

Correct answer: B. Presentation attack detection with liveness checks
Liveness or presentation attack detection checks for signs of a real, present person, such as depth, motion or skin texture, and rejects photos and replays. Lowering the false rejection threshold makes matching more lenient and would make spoofing easier.

Question 13Governance, Risk & Compliance⚑ Flag

A procurement team receives a critical vendor's SOC 2 Type I report dated last month. The CISO says the report is not sufficient on its own. What is the BEST reason?

AIt shows design at a point, not operation over time BIt covers only financial reporting controls CIt is a self-assessment written by the vendor DIt cannot include the availability criterion

Correct answer: A. It shows design at a point, not operation over time
A Type I report evaluates whether controls are suitably designed at a single date, while a Type II report tests operating effectiveness over a period, usually 6 to 12 months. Financial reporting controls are the subject of SOC 1, and SOC reports are issued by independent CPA firms, not the vendor.

Question 14Security Architecture⚑ Flag

A user at Kestrel Bank signed in with MFA at 9:00 and received tokens valid for eight hours. At 10:30 the EDR platform flagged her laptop as compromised, but she kept accessing SaaS apps until her tokens expired. Which zero trust capability is missing?

ALonger EDR telemetry retention for incident investigations BStronger MFA at the initial sign-in using hardware tokens CContinuous evaluation that revokes sessions on new risk signals DNetwork microsegmentation of the laptop's office VLAN

Correct answer: C. Continuous evaluation that revokes sessions on new risk signals
Zero trust calls for continuous verification, so device risk signals from EDR should feed the policy engine and trigger session or token revocation as soon as posture changes. Stronger initial MFA does nothing about a device that becomes compromised after sign-in.

Question 15Security Engineering⚑ Flag

Tamsin Analytics automated monthly rotation of a database password stored in its secrets manager. On rotation day, application servers that cache the credential at startup fail until they are restarted. Which change BEST prevents the outage while keeping rotation?

ALengthen the rotation interval from monthly to yearly BHard-code a fallback password in the application config CRestart every application server immediately after rotation DRotate with two valid credentials and an overlap period

Correct answer: D. Rotate with two valid credentials and an overlap period
Alternating between two credentials keeps the old one valid until all clients have picked up the new one, so cached values do not cause failures. Restarting every server after each rotation causes its own downtime and does not scale.

Question 16Security Operations⚑ Flag

The SOC at Weston Financial receives over 4,000 low-severity alerts a day and misses real attacks that appear as several small signals on one host. Which approach BEST improves prioritization?

ARaise every rule's severity to high so analysts treat all alerts as urgent BHire additional tier-one analysts to work through the full alert queue CDisable all low-severity rules so analysts can focus only on medium and higher alerts DUse risk-based alerting that sums risk scores per entity and alerts at a threshold

Correct answer: D. Use risk-based alerting that sums risk scores per entity and alerts at a threshold
Risk-based alerting adds up weak signals for each user or host and only raises an alert when the combined risk crosses a threshold, so related small events surface together. Disabling low-severity rules cuts volume but throws away the very signals that reveal multi-step attacks.

Question 17Security Architecture⚑ Flag

A university is moving its campus network to an SDN design in which a central controller programs all switches. The risk committee asks which new design concern deserves the MOST attention compared with the old distributed network. What should the architect identify?

AThe controller is a high-value target that needs hardening and HA BVLAN tagging on the data plane is no longer supported by switches CSpanning tree loops become far more likely across the campus core DData plane switches can no longer forward traffic at full line rate

Correct answer: A. The controller is a high-value target that needs hardening and HA
Centralizing control means compromise or failure of the controller affects the whole network, so it needs strong authentication on its northbound and southbound interfaces, RBAC and a redundant cluster. SDN does not remove line-rate forwarding or VLAN support, since the data plane still uses switch hardware.

Question 18Governance, Risk & Compliance⚑ Flag

A merchant outsources card processing to a service provider that stores cardholder data on its behalf. To meet its PCI DSS obligation to monitor the provider's compliance, what should the merchant obtain each year?

AAn SAQ A completed by the provider for the merchant BThe provider's current Attestation of Compliance CThe raw output of the provider's internal pen test DA copy of the provider's ISO 27001 certificate

Correct answer: B. The provider's current Attestation of Compliance
The Attestation of Compliance is the formal PCI DSS evidence that a service provider has been assessed, and merchants review it annually as part of monitoring service providers. An ISO 27001 certificate shows a management system exists but does not confirm PCI DSS compliance.

Question 19Security Engineering⚑ Flag

Engineers at Marchetti Logistics run a shared Kubernetes cluster. Security wants to stop any workload from being deployed if it runs as privileged, mounts the host file system, or uses an image that is not signed by the internal build pipeline. Which control BEST enforces this at deployment time?

AA nightly report of running pods sent to the platform team BA runtime EDR agent on each worker node CNetwork policies that isolate each namespace DAn admission controller enforcing policy on every deployment

Correct answer: D. An admission controller enforcing policy on every deployment
An admission controller evaluates each request before the object is created, so non-compliant pods are rejected rather than detected later. Network policies control traffic between pods but do not inspect privilege settings or image signatures.

Question 20Security Operations⚑ Flag

A penetration test at Ashcombe Travel finds SQL injection in a search feature that builds queries by joining user input into strings. Which remediation BEST removes the weakness?

AFilter out single quotes and the word SELECT from all user input BAdd a WAF rule that blocks common SQL injection patterns CUse parameterized queries so input is always treated as data DMove the query into a stored procedure that still concatenates input

Correct answer: C. Use parameterized queries so input is always treated as data
Parameterized queries keep the SQL structure separate from user data, so input can never change the query logic. A WAF is the tempting choice and helps as defense in depth, but it relies on patterns that attackers can often evade, leaving the flaw in the code.

Question 21Security Architecture⚑ Flag

A manufacturer must apply zero trust access to a legacy internal web app that supports only basic authentication and cannot be modified. Remote and on-site users must be verified with MFA and device posture before reaching it. Which design is MOST appropriate?

AFront the app with an identity-aware proxy acting as the PEP BAdd a WAF in front of the app with geolocation blocking rules CRewrite the app's login page to call the corporate IdP directly DExpose the app through a site-to-site VPN for all remote locations

Correct answer: A. Front the app with an identity-aware proxy acting as the PEP
An identity-aware proxy can act as the policy enforcement point, checking identity, MFA and posture with the policy engine before forwarding requests to an app that cannot change. Rewriting the login page is ruled out because the application cannot be modified.

Question 22Security Engineering⚑ Flag

Ketterly Insurance deployed application allow listing with a rule that permits any executable in each user's AppData folder. A red team still ran its own tools on several laptops. What is the BEST fix?

ASwitch the allow listing policy to audit mode BIncrease antivirus scanning frequency for everything under AppData CReplace the user-writable path rule with publisher or hash rules DAdd more file paths to the allow list for business apps

Correct answer: C. Replace the user-writable path rule with publisher or hash rules
Users can write files to AppData, so a path rule there lets anyone drop and run any tool. Publisher or hash rules tie approval to the code itself rather than to a writable location.

Question 23Governance, Risk & Compliance⚑ Flag

Internal audit finds that most risk register entries list the security team as owner, including risks for sales and HR systems. Treatment decisions have stalled for months. What change BEST addresses this?

AAssign each risk to the accountable business leader BMove all entries into the IT department's register CReplace the register with an annual risk heat map DRaise each risk's inherent rating to force action

Correct answer: A. Assign each risk to the accountable business leader
Risk owners should be the business leaders who own the affected process or asset and have authority to fund and approve treatment. Inflating ratings distorts the register and still leaves no one with the authority to decide.

Question 24Security Engineering⚑ Flag

After a BIOS firmware update was pushed to 300 laptops at Delacroix Partners, every laptop booted to the BitLocker recovery screen. The drives use TPM-only protection. What should the team do before the next firmware rollout?

AClear the TPM after each update so the PCR values reset BSuspend BitLocker before updating so the key is resealed CTurn off the TPM in the firmware settings while the update runs DSwitch the drives from XTS-AES to AES-CBC encryption

Correct answer: B. Suspend BitLocker before updating so the key is resealed
BitLocker seals its key to TPM PCR measurements, and a firmware change alters those values, so the TPM refuses to release the key. Suspending protection lets the system reboot and reseal to the new measurements, while clearing the TPM would destroy the sealed key.

Question 25Security Architecture⚑ Flag

Rook Commerce runs 120 microservices on Kubernetes. Auditors require encryption of all service-to-service traffic and policies that allow only specific services to call each other based on workload identity rather than IP address. Which design BEST meets this?

AA service mesh with workload certificates and mTLS authorization BIPsec tunnels between every pair of worker nodes in the cluster CTLS termination at the ingress controller for all external traffic DKubernetes network policies based on namespaces and pod IP ranges

Correct answer: A. A service mesh with workload certificates and mTLS authorization
A service mesh gives each workload a cryptographic identity, encrypts east-west traffic with mutual TLS and authorizes calls by service identity. Network policies filter traffic at layers 3 and 4 but do not encrypt it or authenticate workloads cryptographically.

Question 26Security Operations⚑ Flag

A secure code review of a legacy C utility at Brannock Systems finds that it reads user input with gets() into a fixed-size buffer. What is the BEST remediation?

AWrap the call in an exception handler that restarts the program BIncrease the buffer size so normal user input never fills it CReplace the call with fgets() using the buffer's size as the limit DCompile the program with debugging symbols for easier crash analysis

Correct answer: C. Replace the call with fgets() using the buffer's size as the limit
gets() has no way to limit input length, so replacing it with a bounded function like fgets() that respects the buffer size removes the overflow. A larger buffer only raises the bar, since input can still exceed any fixed size.

Question 27Governance, Risk & Compliance⚑ Flag

The board wants top cyber risks expressed as probable annual loss ranges in dollars instead of red, amber, and green ratings. Which approach BEST meets this request?

AA CVSS base score ranking of findings BA FAIR analysis with Monte Carlo simulation CA maturity assessment against CMMI levels DA weighted qualitative heat map

Correct answer: B. A FAIR analysis with Monte Carlo simulation
FAIR is a quantitative model that estimates loss event frequency and magnitude, and Monte Carlo simulation produces ranges of probable annual loss in dollars. CVSS rates technical severity of vulnerabilities and does not express business loss.

Question 28Security Engineering⚑ Flag

Rosamund Hospital is retiring 2,000 laptops with self-encrypting SSDs and needs to sanitize them quickly so they can be resold. Which method is MOST efficient while still making the data unrecoverable?

AA three-pass overwrite with random data across every sector of each drive BQuick format followed by a new OS installation CDegaussing each SSD with an industrial degausser DCryptographic erase that destroys the media encryption key

Correct answer: D. Cryptographic erase that destroys the media encryption key
A self-encrypting drive stores all data encrypted under a media key, so destroying that key renders the data unreadable in seconds. Degaussing has no effect on flash memory, and multi-pass overwrites are slow and unreliable on SSDs because of wear leveling.

Question 29Security Architecture⚑ Flag

Build logs at Halcyon Games show that an internal package name was resolved from the public package registry, where someone had published a package with the same name and a higher version number. Which control BEST prevents this?

AResolve internal names only from a scoped private registry BRequire developers to sign all commits with GPG keys CScan the public registry weekly for packages with similar names DRun SAST on the internal package source before every release

Correct answer: A. Resolve internal names only from a scoped private registry
Dependency confusion occurs when a resolver prefers a public package over an internal one with the same name, so internal names must be scoped or pinned to a private registry with public fallback disabled. Commit signing proves who wrote internal code but does not control where the build fetches packages.

Question 30Security Operations⚑ Flag

Corriden Health has just acquired a regional clinic chain with poor documentation. Leadership wants to know which internet-facing systems the clinics expose before integrating networks. What is the BEST approach?

AReview the clinics' firewall change tickets from the last twelve months BUse external attack surface discovery from DNS, certificate logs and IP ranges CRun an internal credentialed scan of the clinics' known and documented server inventory DAsk the clinic staff to fill out a spreadsheet listing their public systems

Correct answer: B. Use external attack surface discovery from DNS, certificate logs and IP ranges
External discovery that uses DNS records, certificate transparency logs and registered IP ranges finds assets the clinics may not know they own. An internal scan of the known inventory is tempting, but it only covers what is already documented, which is the gap in this case.

Question 31Security Engineering⚑ Flag

Following a ransomware incident at Brookvale Logistics, the EDR console showed accurate alerts for every stage of the attack, but no process was stopped. The agents were healthy and tamper protection was on. What is the MOST likely gap?

AThe EDR policy was set to detect-only mode BThe agents lacked kernel-level telemetry CThe SIEM did not forward the alerts to the SOC DThe endpoints were missing operating system patches

Correct answer: A. The EDR policy was set to detect-only mode
Accurate alerts with no blocking point to a policy in detect-only or audit mode, which records activity but does not act on it. Missing telemetry would have produced weak or missing alerts, which was not the case.

Question 32Security Architecture⚑ Flag

A software vendor wants its deployment systems to verify that every artifact was built by the official pipeline from a specific reviewed commit, not just that it carries a company signature. Which practice BEST provides this?

APublish SHA-256 checksums for each artifact on the download page BRequire multifactor authentication for all developer repository access CProduce an SBOM for each artifact listing all bundled dependencies DGenerate signed build provenance attestations and verify them at deploy

Correct answer: D. Generate signed build provenance attestations and verify them at deploy
Signed provenance, as described in frameworks such as SLSA, records which builder, source repository and commit produced an artifact, and deployment policy can verify those claims. An SBOM lists the components inside an artifact but does not prove how or where it was built.

Question 33Governance, Risk & Compliance⚑ Flag

A factory runs a legacy controller that cannot be patched until a line upgrade in two years. Network isolation and monitoring bring the residual risk within tolerance. What should the security manager do next?

ARecord a formal risk acceptance with an expiry date BReplace the controller now regardless of cost CClose the risk in the register since controls exist DMove the controller to a vendor to transfer the risk

Correct answer: A. Record a formal risk acceptance with an expiry date
When residual risk is within tolerance, the right step is a documented acceptance signed by the risk owner, with a review or expiry date tied to the upgrade. Closing the risk is wrong because the risk still exists and must stay visible and reviewed.

Question 34Security Engineering⚑ Flag

A penetration test at Galloway Hosting found that baseboard management controller interfaces on its servers were reachable from the general corporate network with default credentials. Which action BEST reduces this attack surface?

AUpdate each server's BIOS and host OS to the latest available versions BAllow BMC access only during business hours CIsolate BMC interfaces on a dedicated management network DDisable the host operating system firewall on each server

Correct answer: C. Isolate BMC interfaces on a dedicated management network
BMCs give full hardware control even when the host is off, so they belong on a separate management network reachable only by administrators, with default credentials changed. Host OS updates do not address an exposed controller that runs its own firmware.

Question 35Security Operations⚑ Flag

A document management platform at Vellum Legal parses untrusted PDF files from clients. The parser is large legacy code with a history of memory corruption bugs, and a rewrite will take a year. Which architectural mitigation BEST limits the impact of a future exploit?

ARun the parser in a separate low-privilege sandboxed process with restricted access BScan every uploaded PDF with an updated antivirus engine before it reaches the parser CRequire clients to upload PDFs only through an encrypted TLS connection DStore parsed output in a separate database with encryption at rest enabled

Correct answer: A. Run the parser in a separate low-privilege sandboxed process with restricted access
Sandboxing confines the parser so that a successful memory corruption exploit has few privileges and limited access to the rest of the system. Antivirus scanning helps against known malicious files but will not stop a new exploit against an unknown parser bug.

Question 36Security Architecture⚑ Flag

Engineers at Verdant Energy provision cloud resources with Terraform. Several recent deployments created security groups open to 0.0.0.0/0 on management ports before anyone noticed. The team wants to stop these before the resources exist. Which control is MOST effective?

ARequire a manual change advisory board review for each deploy BEnable flow logs on every VPC to record management traffic CRun CSPM scans hourly and alert on any open security groups DEvaluate Terraform plans with policy as code as a CI gate

Correct answer: D. Evaluate Terraform plans with policy as code as a CI gate
Policy-as-code checks on the Terraform plan in CI block noncompliant changes before they are applied, which moves detection ahead of deployment. CSPM is a valuable backstop but only detects the misconfiguration after the resource is already live.

Question 37Security Engineering⚑ Flag

A company issues Android phones to field staff. Security finds that several users installed APKs from websites, and one of them carried spyware. Which MDM control BEST prevents this?

AEncrypt device storage with a hardware-backed key BBlock unknown sources and allow only a managed app store CRequire a longer screen lock PIN and biometric unlock on all devices DEnable remote wipe for lost or stolen devices

Correct answer: B. Block unknown sources and allow only a managed app store
Blocking unknown sources stops sideloading, and a managed app store limits installs to vetted apps. Screen lock and encryption protect a lost device but do nothing to stop a user from installing a malicious app.

Question 38Governance, Risk & Compliance⚑ Flag

A US clinic plans to store electronic protected health information in a third-party cloud backup service. Under HIPAA, what is REQUIRED before any ePHI is uploaded?

AWritten patient consent for each record BFormal HHS approval of the cloud provider CA signed business associate agreement DA SOC 1 Type II report from the provider

Correct answer: C. A signed business associate agreement
A cloud provider that stores ePHI is a business associate, and HIPAA requires a business associate agreement before it handles that data. HHS does not pre-approve providers, and a SOC 1 report addresses financial reporting controls rather than HIPAA obligations.

Question 39Security Operations⚑ Flag

What does the Exploit Prediction Scoring System (EPSS) estimate for a given CVE?

AThe technical severity of the flaw if it is successfully exploited BThe probability that the flaw will be exploited in the wild within the next 30 days CWhether a government agency has confirmed exploitation in the wild DThe financial loss an organization should expect from the flaw

Correct answer: B. The probability that the flaw will be exploited in the wild within the next 30 days
EPSS is a data-driven model that gives the probability of exploitation activity for a CVE over the next 30 days. Technical severity is what CVSS measures, and confirmed exploitation is what the KEV catalog tracks.

Question 40Security Architecture⚑ Flag

Redfield Legal's DLP relies on regular expressions and keyword matching. It produces many false positives on routine documents and misses sensitive merger memos that contain no obvious patterns. Which change BEST improves accuracy?

ABlock all outbound email attachments larger than five megabytes BMove all merger documents to an encrypted network file share CAdd more keywords and tighter regular expressions to every DLP rule DLabel documents at creation and have DLP policies act on the labels

Correct answer: D. Label documents at creation and have DLP policies act on the labels
Persistent classification labels stored in document metadata let DLP enforce policy based on the owner's classification rather than guessing from content patterns. Adding more patterns cannot catch sensitive documents that have no distinctive patterns and tends to increase false positives.

Question 41Security Engineering⚑ Flag

Oakmere Bank has thousands of static SSH public keys spread across Linux servers, and nobody can tell which keys belong to departed staff. The security engineer wants access that expires automatically and can be tied to the identity provider. What should the engineer implement?

ARotate every user's SSH key pair once a year BShort-lived SSH certificates issued by an internal SSH CA after SSO login CLarger RSA key sizes for all existing SSH keys DPassword authentication on SSH with complexity rules

Correct answer: B. Short-lived SSH certificates issued by an internal SSH CA after SSO login
An SSH certificate authority issues certificates that expire after hours, tied to an SSO login, so access ends automatically and no long-lived keys pile up. Larger keys strengthen cryptography but do nothing about orphaned keys belonging to departed staff.

Question 42Governance, Risk & Compliance⚑ Flag

At a publicly traded company, one developer can write code, approve it, and deploy changes to the general ledger application. External auditors cite this as a SOX ITGC deficiency. Which remediation BEST addresses the finding?

ARun static code analysis on every commit BEncrypt the general ledger database at rest CRequire an independent approver for deploys DIncrease the frequency of ledger backups

Correct answer: C. Require an independent approver for deploys
The deficiency is a lack of segregation of duties in change management, so an independent approval before production deployment is the fix. Static analysis improves code quality but still lets one person push unauthorized changes into a financial system.

Question 43Security Operations⚑ Flag

Hollis Aviation's SOC receives an ISAC report marked TLP:AMBER+STRICT. A SOC manager wants to forward it to a managed service provider that monitors Hollis's network. Under TLP 2.0, what is allowed?

AThe report may be shared only within Hollis's own organization BThe report may be published freely because AMBER allows public release CThe report may be shared with the provider because it serves Hollis as a client DThe report may be shared with any member of the wider aviation community

Correct answer: A. The report may be shared only within Hollis's own organization
TLP:AMBER+STRICT limits sharing to the recipient's own organization. Plain TLP:AMBER would allow sharing with clients on a need-to-know basis, which is the tempting choice, but the STRICT qualifier removes that permission.

Question 44Security Architecture⚑ Flag

A SaaS provider must honor tenant deletion requests within 30 days, but tenant data is spread across databases, caches and immutable backups retained for a year. Which design BEST makes deletion effective across all copies?

AOverwrite the tenant's database rows with zeros before deleting them BShorten the backup retention period for all tenants to 30 days CStore each tenant's data in a separate cloud region by default DUse a per-tenant encryption key and destroy that key on deletion

Correct answer: D. Use a per-tenant encryption key and destroy that key on deletion
Crypto-shredding encrypts each tenant's data with a unique key, so destroying the key renders every copy unreadable, including immutable backups. Overwriting database rows does not reach the backups or caches.

Question 45Security Engineering⚑ Flag

A nuclear power facility must send sensor readings from its safety network to an enterprise monitoring system. Regulators require a physical guarantee that no data or commands can flow back into the safety network. Which control meets this requirement?

AA unidirectional gateway, often called a data diode BA next-generation firewall with outbound-only rules CAn IPsec tunnel with mutual certificate authentication DA jump server with session recording

Correct answer: A. A unidirectional gateway, often called a data diode
A data diode enforces one-way flow in hardware, so return traffic is physically impossible. A firewall enforces direction through software and configuration, which can be misconfigured or exploited.

Question 46Security Engineering⚑ Flag

Cobalt Mining wants an inventory of all devices on its control network. A previous active network scan caused two older PLCs to fault and halt a conveyor. Which approach is MOST appropriate?

AAn authenticated scan with credentials for every PLC BA ping sweep limited to the control network subnet CPassive monitoring of traffic from a SPAN port or network tap DRunning the same active scan faster during the overnight shift

Correct answer: C. Passive monitoring of traffic from a SPAN port or network tap
Passive monitoring identifies devices and protocols by observing traffic and sends nothing to fragile controllers. Any active scan, even at night or with credentials, can still crash legacy PLCs that cannot handle unexpected packets.

Question 47Security Architecture⚑ Flag

A retailer's analytics team must join customer records from its loyalty, web and store systems, but analysts must not see real email addresses. The join key must be consistent across systems and resist dictionary attacks using known emails. Which technique BEST fits?

AMasking each email to show only the domain portion BPlain SHA-256 hash of each email address CRandom tokens generated separately in each system DHMAC of each email using a secret key held in a vault

Correct answer: D. HMAC of each email using a secret key held in a vault
A keyed HMAC is deterministic, so the same email produces the same pseudonym in every system, and attackers without the secret key cannot hash a list of known emails to reverse it. A plain unsalted hash is also consistent but can be reversed by hashing candidate email addresses.

Question 48Security Operations⚑ Flag

A threat hunter at Dunmore Energy collects the list of autostart entries from 12,000 endpoints. She wants to find rare persistence mechanisms that may be malicious. Which technique BEST fits?

ASorting the entries alphabetically and reviewing the first hundred results BComparing each entry against a list of known malware hashes only CDeleting all entries not signed by Microsoft and watching for complaints DStacking the entries and reviewing those that appear on only a few hosts

Correct answer: D. Stacking the entries and reviewing those that appear on only a few hosts
Stacking, or frequency analysis, counts how often each entry appears, and items on very few hosts are strong leads for investigation. Hash matching only finds already known malware, so it misses custom or new persistence.

Question 49Governance, Risk & Compliance⚑ Flag

A retailer shares California website visitors' data with ad partners for cross-context behavioral advertising. Many visitors' browsers send a Global Privacy Control signal. Under the CCPA as amended by the CPRA, how must the retailer treat the signal?

AHonor it only after the visitor logs in to confirm BTreat it as a valid opt-out of sale or sharing CTreat it as a request to delete all visitor data DIgnore it unless the visitor also emails a request

Correct answer: B. Treat it as a valid opt-out of sale or sharing
CCPA regulations require businesses to honor opt-out preference signals such as GPC as a valid request to opt out of the sale or sharing of personal information. Requiring a login or extra steps is not permitted, and the signal is an opt-out, not a deletion request.

Question 50Security Engineering⚑ Flag

Attackers keep sending invoices that appear to come from the exact email domain of Brightline Supply. SPF and DKIM are configured, but the DMARC record is set to p=none, and reports show all legitimate senders now pass alignment. What should the email security engineer do NEXT?

AAdd a second DKIM key with a shorter key length BDisable DMARC aggregate reports to cut noise CMove the DMARC policy to quarantine, then to reject DRemove the SPF record to reduce false positives

Correct answer: C. Move the DMARC policy to quarantine, then to reject
With legitimate senders passing alignment, the domain can safely move from monitoring to enforcement, first quarantine and then reject, so receivers block spoofed mail. Removing SPF or weakening DKIM would make spoofing easier, not harder.

Question 51Security Architecture⚑ Flag

Which role is accountable for assigning a classification level to a dataset and approving who may access it?

AData processor BDatabase administrator CData custodian DData owner

Correct answer: D. Data owner
The data owner, usually a business leader, is accountable for classifying data and approving access. The custodian implements and maintains the controls the owner specifies, such as backups and permissions, but does not decide the classification.

Question 52Security Operations⚑ Flag

Aldine Bank's firewall began blocking connections to a major CDN after a commercial threat feed listed several shared CDN addresses as malicious months ago. Business services broke. What practice BEST prevents this problem?

ABlock indicators only after an analyst manually checks each one BMove all feed indicators into alert-only mode permanently CScore indicators by confidence, age them out, and check them against allowlists DStop using commercial feeds and rely only on internal detections

Correct answer: C. Score indicators by confidence, age them out, and check them against allowlists
IP indicators lose value quickly and can point to shared infrastructure, so confidence scoring, expiry and allowlist checks keep blocking accurate. Manual review of every indicator sounds safe, but it does not scale and still misses the decay problem as indicators age.

Question 53Governance, Risk & Compliance⚑ Flag

A marketing analytics team asks for customers' full dates of birth so it can segment campaigns by age group. Which response BEST applies the principle of data minimization?

AShare full birth dates for a 90-day trial only BShare an age band field derived from birth dates CShare full birth dates encrypted with the team's key DShare full birth dates with names removed

Correct answer: B. Share an age band field derived from birth dates
Minimization means providing only the data needed for the purpose, and an age band meets the segmentation need without exposing exact birth dates. Removing names is tempting, but full birth dates combined with other fields can still re-identify people and exceed the stated need.

Question 54Security Engineering⚑ Flag

An engineer runs this PowerShell fragment: Get-ADUser -Filter 'Enabled -eq $true' -Properties LastLogonDate | Where-Object { $_.LastLogonDate -lt (Get-Date).AddDays(-90) }. What does it return?

AAccounts whose passwords expire within 90 days BAccounts created during the last 90 days CEnabled accounts with no logon in the last 90 days DDisabled accounts that were deactivated more than 90 days ago

Correct answer: C. Enabled accounts with no logon in the last 90 days
The filter selects enabled users, and the Where-Object clause keeps those whose last logon is older than 90 days, which identifies stale accounts to review or disable. Password age would use a different property, such as PasswordLastSet.

Question 55Security Architecture⚑ Flag

A nightly batch service at Orion Freight must call an internal inventory API with no user involved. The architect wants OAuth 2.0 access tokens scoped to that service. Which grant type is MOST appropriate?

AClient credentials BDevice authorization grant CImplicit grant DAuthorization code with PKCE

Correct answer: A. Client credentials
The client credentials grant is designed for machine-to-machine calls where the client acts on its own behalf, authenticating with a secret, certificate or signed assertion. Authorization code with PKCE requires a user to sign in interactively, which a nightly batch job cannot do.

Question 56Security Operations⚑ Flag

EDR at Tolland Insurance shows a PowerShell process beaconing to an unknown host, but no malicious file exists on disk. The IR team needs to see the injected code and decrypted configuration. Which analysis is MOST valuable?

AA review of the firewall logs for the last 90 days BA memory capture analyzed with a memory forensics framework CA full antivirus scan of the host with updated signatures DA forensic image of the hard drive analyzed for deleted files

Correct answer: B. A memory capture analyzed with a memory forensics framework
Fileless malware lives in memory, so a memory capture can reveal injected code, decrypted strings, process trees and live network connections. A disk image is the tempting choice, but there is no file on disk to recover in this case.

Question 57Security Engineering⚑ Flag

During a code review, a security engineer finds requests.get(api_url, headers=auth, verify=False) in a Python script that calls an internal billing API. What is the main risk?

AIt skips TLS certificate checks, enabling interception BThe request is sent over plain HTTP without encryption CThe authorization header is excluded from the request DThe script silently ignores HTTP error codes returned by the API

Correct answer: A. It skips TLS certificate checks, enabling interception
Setting verify=False tells the library to accept any certificate, so an attacker in the path could impersonate the API and capture the credentials. The connection is still encrypted, which is why this flaw is easy to miss.

Question 58Governance, Risk & Compliance⚑ Flag

A SaaS company keeps all application logs that contain user IP addresses forever because storage is cheap. Privacy counsel warns that this conflicts with GDPR. What should the company implement?

AOffline archiving of all logs older than one year BA privacy notice that discloses indefinite storage CA purpose-based retention schedule with auto-deletion DEncryption of all logs with a rotating master key

Correct answer: C. A purpose-based retention schedule with auto-deletion
GDPR's storage limitation principle requires keeping personal data no longer than needed for its purpose, so a defined schedule with automated deletion fixes the issue. Encryption protects confidentiality but does not stop the company from keeping personal data longer than justified.

Question 59Security Architecture⚑ Flag

Sign-in logs at Maple Ridge show successful password spray logins to mailboxes even though a conditional access policy requires MFA for all users. Every successful login used IMAP or SMTP with basic authentication. Which change BEST closes the gap?

AIncrease the account lockout threshold for failed sign-ins BRequire MFA registration for all users within seven days CEnable a banned password list for common seasonal passwords DBlock legacy authentication protocols with conditional access

Correct answer: D. Block legacy authentication protocols with conditional access
Legacy protocols using basic authentication cannot perform interactive MFA, so they bypass MFA policies and must be blocked through conditional access or disabled. A banned password list helps against spraying but does not close the path that skips MFA entirely.

Question 60Security Engineering⚑ Flag

Container scans at Tollgate Media show each production image has more than 300 known vulnerabilities, most in OS packages the applications never use. Rebuilds happen weekly. Which change would reduce the vulnerability count the MOST with the least ongoing effort?

ARun the containers with a read-only root file system BScan the images daily instead of weekly CSuppress all findings rated medium or lower DRebuild from minimal or distroless base images in the pipeline

Correct answer: D. Rebuild from minimal or distroless base images in the pipeline
Minimal or distroless base images remove unused packages, which eliminates most findings at the source, and the pipeline keeps it automatic. A read-only file system is a good hardening step, but it does not remove the vulnerable packages from the image.

Question 61Security Operations⚑ Flag

Legal counsel at Barrow Chemicals expects that evidence from an insider theft case may be used in court. Which practice BEST supports the integrity and admissibility of the collected disk images?

AHash each image at acquisition and keep a documented chain of custody BLet the analyst work directly on the original drives to save time CCompress the images with a password so outsiders cannot open them DStore the images on the same file server as normal case documents

Correct answer: A. Hash each image at acquisition and keep a documented chain of custody
Hashing at acquisition proves the image has not changed, and a chain of custody records who handled the evidence and when. A password-protected archive limits access but does not prove integrity or show who handled the evidence.

Question 62Security Architecture⚑ Flag

A defense contractor is rolling out passkeys and must ensure that only FIPS-validated hardware security keys from approved vendors can be registered, not synced software passkeys. Which capability should the IdP enforce at registration?

AUser verification with a biometric or PIN on each sign-in BAttestation checked against an approved AAGUID allowlist CDiscoverable credentials stored on the authenticator itself DOrigin binding of each WebAuthn credential to the IdP domain

Correct answer: B. Attestation checked against an approved AAGUID allowlist
WebAuthn attestation lets the authenticator prove its make and model, identified by its AAGUID and backed by a vendor certificate chain, so the IdP can accept only approved hardware. Origin binding protects every passkey against phishing but does not tell the IdP what kind of authenticator created it.

Question 63Governance, Risk & Compliance⚑ Flag

A team wants to model every way an attacker could reach the goal of stealing a code-signing key, using AND and OR branches with an estimated cost on each path. Which technique is this?

ADREAD risk scoring BCyber kill chain mapping CSTRIDE per element DAttack tree analysis

Correct answer: D. Attack tree analysis
An attack tree places the attacker's goal at the root and breaks it into AND and OR sub-goals that can carry cost, skill or likelihood values. STRIDE per element classifies threats against each system component but does not decompose a single goal into paths.

Question 64Security Engineering⚑ Flag

Jessop Financial's SOAR platform blocks malicious IPs by calling the perimeter firewall's API. The integration currently uses a firewall super-admin account. What is the BEST change?

AStore the super-admin password in the SOAR's local config BHave analysts copy blocks into the firewall manually CUse an API token scoped only to the block list object DKeep the super-admin account but rotate its password every 30 days

Correct answer: C. Use an API token scoped only to the block list object
A token limited to the block list follows least privilege, so a compromised SOAR platform cannot change other firewall rules. Rotating the super-admin password shortens exposure but leaves the integration with full control of the firewall.

Question 65Security Operations⚑ Flag

Investigators at Selwyn Telecom confirm a stealthy intruder with access to several servers. There is no sign of current data theft, and the team believes it has not yet found every foothold. Leadership asks how to contain the threat. Which approach is BEST?

ALeave the intruder in place indefinitely to collect intelligence on its methods BScope fully while monitoring closely, then contain all footholds in one coordinated action CAnnounce the intrusion to all staff so everyone can watch for suspicious activity DImmediately block each compromised server as soon as it is found during scoping

Correct answer: B. Scope fully while monitoring closely, then contain all footholds in one coordinated action
When there is no active data loss, scoping fully and then removing all footholds at once keeps the intruder from noticing early and moving to hidden access. Blocking each host as it is found is tempting, but it warns the intruder and often leads to repeated reinfection.

Question 66Security Architecture⚑ Flag

A law firm uses a sanctioned cloud file-sharing service. It must find sensitive files already stored there and detect public sharing links, including activity from unmanaged personal devices that never touch corporate networks. Which CASB deployment BEST fits?

ALog-based CASB that parses firewall and proxy logs BForward proxy CASB using an agent on managed laptops CAPI-based CASB connected directly to the SaaS tenant DReverse proxy CASB with SSO redirection for web logins

Correct answer: C. API-based CASB connected directly to the SaaS tenant
An API-based CASB connects to the SaaS provider out of band, so it can scan data at rest and review sharing settings regardless of the user's device or network. A forward proxy sees only traffic from managed devices routed through it and cannot scan files already stored.

Question 67Security Engineering⚑ Flag

Wexford Networks wants its routers to refuse to run firmware that was modified in transit or by an insider with physical access. Which design feature provides this protection?

AA hardware root of trust that checks firmware signatures at boot BA firmware update server reachable only over HTTPS CA SHA-256 checksum published next to each image on the vendor download page DEncrypting firmware images with a shared AES key

Correct answer: A. A hardware root of trust that checks firmware signatures at boot
An immutable root of trust in hardware verifies the firmware signature before running it, so tampered images fail no matter how they were delivered. A published checksum depends on someone checking it manually and does not stop a modified image from booting.

Question 68Governance, Risk & Compliance⚑ Flag

An application security team is designing a new API and wants a catalog of known attack patterns against software, such as parameter tampering and injection, to guide design reviews. Which resource is MOST appropriate?

ANIST National Vulnerability Database BMITRE CAPEC CMITRE D3FEND DMITRE ATT&CK Enterprise

Correct answer: B. MITRE CAPEC
CAPEC catalogs common attack patterns against applications and software, which suits design-time threat modeling. ATT&CK is tempting but focuses on observed adversary tactics and techniques within enterprise environments, largely during and after intrusion.

Question 69Security Engineering⚑ Flag

On a Monday morning, internal web apps at Thornbury College begin failing certificate validation. The issuing CAs are online and healthy. Investigation shows that the CRL published by the offline root CA passed its next update time over the weekend. What should the PKI team do?

ASign and publish a fresh root CRL, then schedule it before expiry BReissue every server and client certificate from the issuing CAs CDisable revocation checking on all clients permanently DReplace the root CA with a new root and a new hierarchy

Correct answer: A. Sign and publish a fresh root CRL, then schedule it before expiry
Clients treat an expired CRL as unusable, so chain validation fails at the revocation check for the issuing CA certificates. Signing a new CRL with the offline root fixes the issue, and a renewal calendar prevents a repeat, while reissuing leaf certificates does not help because the chain still depends on the root CRL.

Question 70Security Architecture⚑ Flag

A review of Juniper Travel's serverless application found that all 80 functions share one execution role with read and write access to every table and bucket in the account. One function processes untrusted file uploads. Which change BEST reduces risk?

AIncrease function timeouts so uploads are scanned completely BEnable a WAF on the API gateway in front of the upload function CGive each function its own role scoped to the resources it needs DPlace all functions inside a private VPC with no internet access

Correct answer: C. Give each function its own role scoped to the resources it needs
Per-function least-privilege roles mean a compromised upload function can reach only the resources it actually uses, limiting blast radius. A WAF may filter some malicious requests but leaves every function with access to all data if one is compromised.

Question 71Security Operations⚑ Flag

Cloud audit logs at Merrow Analytics show an access key belonging to a CI service account making API calls from an unknown IP address. What should the responder do FIRST?

ADelete the service account entirely, including its history and attached policies BDeactivate the access key and review audit logs for every action it performed CWait for the next scheduled key rotation to replace the exposed access key DOpen a support case with the cloud provider and take no action until they reply

Correct answer: B. Deactivate the access key and review audit logs for every action it performed
Deactivating the key stops further misuse right away, and the audit logs show what the attacker did with it. Deleting the account also stops access, but it can remove context needed for the investigation and break the pipeline without identifying the damage.

Question 72Governance, Risk & Compliance⚑ Flag

A fraud detection model retrains weekly on transactions labeled through customer feedback. Analysts notice a coordinated group submitting false not-fraud labels. Which control BEST manages this risk?

AEncrypt the model weights while in storage BRate limit calls to the model's inference API CAdd a prompt filter on the model's inputs DVet label provenance and screen for anomalies

Correct answer: D. Vet label provenance and screen for anomalies
This is a data poisoning risk, so the control must protect training data integrity through source validation, outlier detection and review before retraining. Rate limiting the inference API protects the running model from abuse but does nothing about corrupted training labels.

Question 73Security Engineering⚑ Flag

Linden Storage encrypts 4 PB of objects using envelope encryption, where each object has its own data key wrapped by a master key in a KMS. Compliance requires annual master key rotation. What is the MOST efficient way to comply?

ARotate the master key and rewrap the data keys BDecrypt and re-encrypt all 4 PB with new data keys CReplace AES-256 with AES-128 to speed re-encryption DRotate only the data keys and keep the same master key

Correct answer: A. Rotate the master key and rewrap the data keys
In envelope encryption, rotating the key-encryption key only requires rewrapping the small data keys, not touching the bulk data. Re-encrypting 4 PB is costly and is not needed to meet a master key rotation requirement.

Question 74Security Architecture⚑ Flag

A company runs workloads on VMs and containers across its data center and two clouds. It needs to detect and block a container that suddenly launches an unexpected shell process or modifies its file system at runtime. Which solution category BEST fits?

ACloud security posture management BCloud workload protection platform CCloud access security broker DSecurity information and event management

Correct answer: B. Cloud workload protection platform
A CWPP protects running workloads across hybrid environments with capabilities such as runtime behavior monitoring, process allowlisting and container drift prevention. A SIEM can collect and correlate alerts but needs a runtime sensor to detect and block the process in the first place.

Question 75Security Operations⚑ Flag

Fairleigh Foods is ready to restore servers from backup after a ransomware attack. Which step is MOST important before reconnecting the restored systems to production?

ARestore the newest backup available to minimize lost data for the business units BBring all servers online at once so dependent services start in the right order CRestore domain controllers last so that user accounts are recreated from scratch DConfirm that the backups predate the compromise and validate them in an isolated network

Correct answer: D. Confirm that the backups predate the compromise and validate them in an isolated network
Attackers often sit in an environment before deploying ransomware, so backups must predate the intrusion and be checked in isolation before going live. Restoring the newest backup is tempting for data loss reasons, but it may bring back the attacker's persistence.

Question 76Security Engineering⚑ Flag

An auditor at Merriton Bank warns that an attacker recording TLS 1.2 traffic today could decrypt all of it later if the server's RSA private key is ever stolen. The servers currently use RSA key exchange. Which change BEST addresses this?

AIncrease the RSA key to 4096 bits BMove the RSA private key into a hardware security module CShorten the server certificate validity DRequire ECDHE key exchange cipher suites

Correct answer: D. Require ECDHE key exchange cipher suites
Ephemeral ECDHE creates a unique session key for each connection and discards it afterward, so a later key theft cannot decrypt recorded sessions. An HSM makes theft harder, but with RSA key exchange a stolen or misused key would still unlock all recorded traffic.

Question 77Security Architecture⚑ Flag

Analytics jobs running in one cloud provider need to read data from a storage service in another provider. Today, a long-lived service account key file from the second provider is kept in a secrets manager. Which design BEST improves security?

AFederate workload identities to get short-lived access tokens BStore the key file in an HSM instead of the secrets manager CRestrict the service account key to the analytics jobs' IP range DRotate the service account key file automatically every 30 days

Correct answer: A. Federate workload identities to get short-lived access tokens
Workload identity federation lets a workload exchange a token from its own provider for short-lived credentials in the other cloud, removing long-lived keys entirely. Rotation shortens the exposure window but still leaves a static secret that can be stolen and reused.

Question 78Governance, Risk & Compliance⚑ Flag

A lender plans to use a machine learning model to approve loans. Regulators require the lender to give every declined applicant the specific reasons for the decision. Which governance requirement is MOST important before deployment?

AThe model must run in a private cloud region BTraining data must be encrypted while at rest CDecisions must be explainable and documented DThe model must reach the highest possible accuracy

Correct answer: C. Decisions must be explainable and documented
Adverse action rules require specific reasons, so the model must be explainable, with documentation such as model cards and feature attributions. High accuracy alone does not help if the lender cannot explain why an individual was declined.

Question 79Security Engineering⚑ Flag

Arlowe Fintech runs a fraud model on sensitive transaction data in a public cloud. It needs the data protected while being processed, including from the provider's administrators, and it needs near-native performance. Which approach BEST fits?

AConfidential computing with hardware-based enclaves BFully homomorphic encryption of all inputs CStorage encryption at rest using customer-managed KMS keys DTLS 1.3 between every microservice

Correct answer: A. Confidential computing with hardware-based enclaves
Hardware enclaves keep data encrypted in memory and isolated from the host OS and hypervisor while running at close to native speed. Homomorphic encryption also protects data in use, but its heavy performance cost makes it impractical for near-native workloads.

Question 80Security Operations⚑ Flag

A sample from a phishing campaign at Lockhart Engineering shows no activity in the automated sandbox. Static analysis shows long sleep calls and checks for virtual machine artifacts. What is the BEST conclusion and next step?

AThe sample is likely corrupted and should be deleted from the evidence store BThe sample is likely sandbox-aware, so rerun it in a hardened setup and add static analysis CThe file is benign because the automated sandbox recorded no malicious behavior at all DThe sandbox is broken and should be replaced with a product from a different vendor

Correct answer: B. The sample is likely sandbox-aware, so rerun it in a hardened setup and add static analysis
Long sleeps and VM checks are classic evasion techniques, so a quiet sandbox run does not mean the file is safe. Running it in a more realistic environment with extended runtime and pairing that with static analysis gives a truer picture of its behavior.

Question 81Security Architecture⚑ Flag

A chemical plant runs PLCs that cannot be patched for a known flaw that lets any host on the control network send unauthenticated write commands. Replacement is three years away. Which compensating control is MOST effective?

AA layer 4 firewall rule that allows only the PLC protocol's TCP port BAn ICS-aware firewall allowing writes only from engineering stations CAn IDS on the control network that alerts on new PLC connections DAntivirus installed on all HMI and historian servers in the plant

Correct answer: B. An ICS-aware firewall allowing writes only from engineering stations
A protocol-aware industrial firewall can inspect commands such as Modbus or DNP3 function codes and allow write operations only from authorized engineering workstations. A layer 4 rule cannot distinguish reads from writes because both use the same port.

Question 82Security Engineering⚑ Flag

Ravensworth Agency stores diplomatic data that must stay confidential for 25 years and is worried that adversaries are recording traffic now to decrypt it later with quantum computers. Which change should it prioritize for TLS key exchange?

AUpgrading from SHA-256 to SHA-512 for hashing BIncreasing AES key size from 128 to 192 bits CHybrid key exchange combining ECDHE with ML-KEM DReplacing ECDSA certificates with ML-DSA certificates

Correct answer: C. Hybrid key exchange combining ECDHE with ML-KEM
Harvest now, decrypt later threatens key exchange, so adding ML-KEM, the NIST FIPS 203 key encapsulation standard, protects recorded sessions even if ECDHE is later broken. ML-DSA protects signatures, which matter for authentication at connection time but do not protect recorded traffic from later decryption.

Question 83Governance, Risk & Compliance⚑ Flag

An organization is aligning its program to NIST CSF 2.0. It wants cybersecurity supply chain risk management, roles and responsibilities, and risk strategy oversight grouped under a single function. Which function fits?

AIdentify BGovern CProtect DRecover

Correct answer: B. Govern
CSF 2.0 added the Govern function, which covers organizational context, risk management strategy, roles and cybersecurity supply chain risk management. Identify is tempting because supply chain risk sat there in CSF 1.1, but version 2.0 moved it to Govern.

Question 84Security Operations⚑ Flag

Kinross Utilities wants to detect lateral movement inside its server network with very few false positives. Which deception design BEST meets this goal?

AA network tap that mirrors all internal traffic to a packet capture appliance BA high-interaction honeypot on the internet edge that records attacker sessions CA sinkhole that redirects known malicious domains to an internal web server DDecoy hosts in internal server segments that no legitimate user or system needs

Correct answer: D. Decoy hosts in internal server segments that no legitimate user or system needs
Internal decoys have no business purpose, so any connection to them is suspicious and alerts are high fidelity. An internet-facing honeypot collects attacker data, but it sees constant scanning noise and says nothing about movement inside the network.

Question 85Security Architecture⚑ Flag

A refinery plans to save costs by connecting its safety instrumented system (SIS) to the same network and controllers as the basic process control system (BPCS) so operators can manage both from one HMI. What is the MOST important architectural concern?

AThe SIS must stay independent so a BPCS fault cannot defeat it BThe combined network will need higher-bandwidth switches and cabling COperators will need additional training on the unified HMI screens DThe historian will need much more storage for the combined tag count

Correct answer: A. The SIS must stay independent so a BPCS fault cannot defeat it
A safety instrumented system is designed as an independent layer of protection, so sharing networks or controllers with the process control system creates a common failure or attack path that could defeat both. Bandwidth and training are operational details that do not address loss of the safety layer.

Question 86Security Engineering⚑ Flag

Halloway Trading needs a record showing which manager approved each wire transfer, and an outside auditor must be able to verify it without being able to create approvals. Which mechanism meets this requirement?

ASHA-256 hashes stored with each approval BAES-GCM encryption of each approval record CDigital signatures using each manager's private key DAn HMAC tag using a secret key all managers share with the auditor

Correct answer: C. Digital signatures using each manager's private key
A digital signature is created with a private key only the manager holds and verified with the public key, which provides non-repudiation. An HMAC key shared with the auditor would let the auditor, or any manager, create valid tags, so it cannot prove who approved.

Question 87Governance, Risk & Compliance⚑ Flag

Several employees admit approving MFA push prompts they did not start after receiving dozens of them late at night. What is the BEST combined awareness and technical response?

AEnable number matching and teach users to report BLengthen passwords and retrain on passphrases CTeach users to approve prompts only in work hours DMove MFA to SMS codes and retrain on phishing

Correct answer: A. Enable number matching and teach users to report
Number matching stops blind approvals, and training users to report unexpected prompts turns them into an early warning that their password is compromised. Moving to SMS codes weakens MFA because SMS is exposed to SIM swapping and interception.

Question 88Security Operations⚑ Flag

During static analysis of a suspicious Windows binary, a defender sees that it imports VirtualAllocEx, WriteProcessMemory and CreateRemoteThread. What capability does this MOST likely indicate?

ACapturing keystrokes from the active window BCreating a scheduled task for persistence CEncrypting files on network shares for ransom DInjecting code into another running process

Correct answer: D. Injecting code into another running process
Allocating memory in another process, writing to it and starting a remote thread is the classic API pattern for process injection. Keystroke capture uses different APIs, such as keyboard hooks, so it is a plausible but incorrect reading of these imports.

Question 89Security Architecture⚑ Flag

Brightmoor Bank's online banking site was knocked offline twice this year by volumetric attacks exceeding 400 Gbps, far more than its 10 Gbps internet links can carry. The bank wants the site to stay reachable during future attacks. Which design BEST meets this goal?

AA cloud-based DDoS scrubbing service in front of the site BRate limiting on the web servers' host firewalls CAn IPS signature update on the perimeter sensor DLarger on-premises firewalls with higher throughput

Correct answer: A. A cloud-based DDoS scrubbing service in front of the site
Volumetric attacks fill the internet links before traffic reaches any on-premises device, so filtering must happen upstream in a scrubbing service with far more capacity. Bigger firewalls or host rate limiting sit behind the saturated links and cannot help.

Question 90Security Engineering⚑ Flag

Sterling Corp will issue a subordinate CA certificate to a partner so the partner can issue its own certificates within Sterling's PKI. Sterling must ensure the partner can only issue certificates for partner.example.com. Which certificate extension enforces this?

ABasic constraints path length BSubject alternative name CName constraints DKey usage

Correct answer: C. Name constraints
The name constraints extension in a CA certificate limits the namespaces that the CA and any CAs below it can certify. The path length setting in basic constraints limits how many CAs can sit below, not which names they can certify.