CompTIA Security+ Practice Test.

Answer: B
Non-repudiation combines integrity and authentication (typically via digital signatures) so the sender cannot deny having sent the message. Confidentiality only protects against disclosure, availability ensures access to systems/data, and obfuscation merely hides data's meaning without providing proof of origin or authorship.

Answer: C
Defense in depth layers multiple independent controls so that failure of one does not expose the whole environment. Security through obscurity relies on secrecy rather than layered controls, least functionality is about disabling unneeded services/ports, and fail-open design intentionally permits access on failure, which is the opposite of this scenario.

Answer: A
Separation of duties splits critical tasks between multiple people to prevent a single person from committing fraud unilaterally. Job rotation and mandatory vacation are detective controls that expose fraud over time by moving people between roles or forcing absence, and least privilege limits the access a single account has rather than dividing a process across roles.

Answer: A
Phishing uses a fraudulent message, typically email, that impersonates a trusted entity to trick the victim into entering credentials on a fake site. Pretexting involves a fabricated scenario used in a direct social engineering conversation rather than a spoofed website, tailgating is physically following someone through a secured door, and a watering hole attack compromises a legitimate site the victim is expected to visit rather than sending a direct impersonation email.

Answer: A
Concatenating unvalidated user input directly into a SQL statement lets an attacker alter the query's logic, which is the definition of SQL injection; the fix is parameterized queries or prepared statements. Cross-site scripting injects script into pages viewed by other users, buffer overflow involves writing past allocated memory bounds, and a race condition exploits timing between concurrent operations, none of which describes unsafely built SQL strings.

Answer: B
High-volume queries to random-looking subdomains are a classic indicator of DNS tunneling used by malware to exfiltrate data or receive commands from a command-and-control server, since DNS is often allowed outbound even when other channels are restricted. DHCP renewal, software updates, and CDN lookups do not generate high-volume randomized subdomain queries to a single unfamiliar domain.

Answer: A
Privilege escalation is gaining higher-level permissions than originally granted, exactly as described. Lateral movement and pivoting involve moving to other hosts or network segments rather than escalating rights on the same machine, and footprinting is early reconnaissance performed before any access is gained.

Answer: A
Double extortion combines encryption with data theft and the threat of public leak, adding a second layer of pressure beyond just withholding decryption. Typosquatting involves registering misspelled domain names, credential stuffing reuses breached credentials at scale, and business email compromise is a targeted social-engineering fraud scheme, none of which match the encrypt-plus-leak-threat pattern described.

Answer: A
A zero-day is a vulnerability that is unknown to the vendor or unpatched, meaning defenders have had zero days to prepare a fix. It is not a known-exploited vulnerability unless active exploitation is confirmed, it is not a false positive since the flaw is real, and a compensating control is a mitigation technique, not a category of vulnerability.

Answer: D
An evil twin is a rogue access point impersonating a legitimate SSID to lure victims into connecting so traffic can be intercepted. Bluejacking targets Bluetooth devices with unsolicited messages, ARP poisoning manipulates layer-2 address tables on an existing network rather than impersonating an SSID, and a deauthentication flood alone only disconnects clients without impersonating the network.

Answer: A
A signed rules-of-engagement agreement defining scope and boundaries is the hallmark of authorized penetration testing, regardless of whether the tester has prior system knowledge (white-box) or not (black-box). An advanced persistent threat is an unauthorized, often nation-state-affiliated long-term intrusion; hacktivism is unauthorized activity motivated by ideology; and insider threat activity originates from a trusted person acting outside authorized bounds.

Answer: A
Hardening is the process of reducing a system's attack surface by disabling unnecessary services, closing unused ports, and removing default accounts. Fuzzing is a testing technique that feeds malformed input to find bugs, threat hunting is proactively searching for signs of compromise, and steganography hides data within other files, none of which describe reducing exposed attack surface.

Answer: A
Segmentation with a controlled boundary isolates sensitive OT/ICS systems from the general corporate network while permitting tightly controlled, monitored data flow across a well-defined chokepoint. A flat network provides no isolation, a full mesh VPN would multiply direct paths between all systems rather than restrict them, and removing firewalls between zones eliminates the very boundary the scenario requires.

Answer: A
Zero trust assumes no implicit trust for any user, device, or service regardless of network location, requiring continuous verification of every request, which matches the gateway enforcing authentication/authorization on every call. An implicit trust model is the opposite, assuming internal traffic is safe; perimeter-only security relies solely on a network edge boundary; and an air-gapped network is physically isolated with no connectivity at all, which does not match a cloud API gateway design.

Answer: A
Tokenization substitutes sensitive data with a non-sensitive token that has no exploitable value outside the secure vault that maps it back to the original, which is exactly the recurring-billing scenario described. Unsalted hashing is not reversible so it cannot be mapped back for legitimate reuse, display-only masking still leaves the real number stored elsewhere, and encrypting the whole database still stores the actual card number, just protected differently, rather than replacing it with a token.

Answer: A
Planning for failover to a secondary site with minimal data loss and downtime is core to resilience and recovery architecture, encompassing high availability, replication, and disaster recovery. Data classification concerns labeling data sensitivity, least privilege concerns access rights scoping, and vulnerability scanning identifies weaknesses rather than ensuring continued operation after an outage.

Answer: A
An HSM is a dedicated, tamper-resistant hardware device built to generate, store, and manage cryptographic keys securely, isolating key material from general-purpose servers. A load balancer distributes traffic across servers, a jump server is a hardened intermediary for administrative access, and a proxy server relays and can filter client requests, none of which are purpose-built for cryptographic key custody.

Answer: A
Determining whether an alert represents a true positive versus benign activity is part of the detection and analysis phase, which occurs before any response action is taken. Eradication removes confirmed malicious artifacts after an incident is validated, lessons learned occurs after the incident closes, and containment limits spread only after malicious activity has been confirmed, all of which come after the triage step described.

Answer: C
Isolating an infected host to stop lateral spread while preserving evidence is the definition of containment. Preparation happens before an incident occurs and involves building capability and plans, post-incident reporting occurs after the incident is resolved, and identification is simply recognizing that an incident occurred, which is distinct from actively isolating the host.

Answer: D
The order of volatility for digital forensics begins with the most transient data (CPU registers/cache), followed by RAM, then local disk storage, and finally offline backups or archival media, which persist the longest. The other options reverse or scramble this sequence, which would risk losing the most fragile evidence before it is captured, violating proper forensic procedure.

Answer: A
Chain of custody is the chronological documentation showing who collected, handled, and analyzed evidence, ensuring its integrity and admissibility. Data minimization limits the amount of personal data collected/retained, a legal hold suspends normal data destruction when litigation is anticipated, and non-repudiation proves the origin of a message rather than tracking evidence handling.

Answer: A
Correlating login timestamps and geolocation across systems to flag physically implausible travel between logins is a classic SIEM use case for impossible travel detection, useful for spotting compromised credentials. DLP inspects data content for policy violations, static application security testing analyzes source code for flaws before runtime, and vulnerability scanning identifies unpatched weaknesses, none of which involve correlating authentication geolocation and timing.

Answer: A
An IPS sits inline with traffic and can actively block or drop packets matching malicious signatures or behavior, unlike a passive IDS which only alerts without intervening. A vulnerability scanner assesses systems for weaknesses rather than inspecting live traffic, and a plain packet sniffer captures traffic for analysis but has no enforcement capability.

Answer: A
NAC solutions perform posture assessment, checking device compliance such as patch level and antivirus status, before granting or restricting network access, exactly matching the scenario. A stateless packet filter only inspects header fields without evaluating device health, a CDN caches and distributes content rather than gating network admission, and a spam filter screens email content and is unrelated to device posture checks.

Answer: A
Risk-based prioritization weighs exploitability, exposure (e.g., internet-facing), and business context alongside a base severity score to decide what to remediate first, rather than relying on severity alone. Alphabetical patching ignores risk entirely, ignoring anything below a fixed CVSS threshold discards context like active exploitation, and waiting for an audit finding is reactive rather than a structured prioritization method.

Answer: A
Audit logs capture who accessed which records and when, and periodic review of those logs allows detection of unauthorized or unnecessary access after the fact. Full-disk encryption protects data at rest from offline theft but doesn't record who viewed live records, rate limiting only throttles authentication attempts, and time synchronization ensures accurate timestamps but by itself does not detect inappropriate access.

Answer: A
A risk appetite or tolerance statement formally documents the level of risk an organization's leadership is willing to accept, guiding decisions about which risks require further mitigation. An incident response playbook details technical response steps, a network diagram documents topology, and a change management ticket records a specific proposed change, none of which capture organizational risk tolerance.

Answer: A
Requiring questionnaires and independent audit evidence (such as a SOC 2 report) before onboarding a vendor is core to third-party/vendor risk management, assessing supply chain risk before granting access or trust. Business continuity planning addresses maintaining operations during disruptions, change management governs internal system modifications, and asset inventory management tracks organizational assets, none of which describe vetting an external vendor's security posture.

Answer: A
Change management formalizes the review, approval, testing, and rollback planning required before implementing changes to reduce the risk of unintended outages or security gaps. Data classification labels information by sensitivity, penetration testing simulates attacks to find weaknesses, and onboarding covers bringing new employees or systems into the organization, none of which describe the structured change-approval workflow described.

Answer: A
Identifying which regional or national laws (such as GDPR for EU residents) govern data handling based on data subject location is a matter of regulatory and jurisdictional compliance. A business impact analysis assesses the operational effect of disruptions, vulnerability scanning cadence concerns technical testing frequency, and awareness training frequency concerns employee education scheduling, none of which relate to determining applicable data protection law.

Answer: D
RTO defines the maximum acceptable duration of downtime after a disruption before unacceptable business impact occurs, directly informing decisions about redundancy and failover investment. MTBF measures average time between failures of a component, ALE estimates yearly expected monetary loss from a risk, and SLE estimates the monetary loss from a single occurrence of a risk event, none of which define an acceptable downtime duration.

Answer: A
Defining data owners, custodians, and classification labels as part of formal policy is data governance, a component of security program management and oversight. Cryptographic key exchange concerns securely establishing shared keys between parties, wireless network configuration concerns radio-based network setup, and malware analysis examines malicious code behavior, none of which involve assigning organizational data roles and classification policy.

Answer: A
Reconciling differing national encryption export laws before deploying a feature across jurisdictions is a legal and regulatory compliance consideration tied to where the company operates. Physical security controls address facility protections, endpoint detection and response concerns host-based threat monitoring, and password complexity policy governs authentication requirements, none of which relate to cross-border legal restrictions on cryptography.

Answer: B
Virtual machine escape is the breach of the isolation boundary a hypervisor is supposed to enforce, letting guest code execute at the hypervisor layer and reach other guests, which is the most severe class of virtualization vulnerability. Resource reuse is the closest distractor because it also results in one tenant obtaining another tenant's data, but it does so passively through recycled memory or storage that was not sanitized before reallocation, with no compromise of the hypervisor. VM sprawl is an operational management problem that increases attack surface but does not itself cross the isolation boundary.

Answer: C
A credentialed scan authenticates to the target and enumerates installed packages, patch levels, and local configuration directly, which reveals the host level findings that an unauthenticated scan can only infer from exposed services. Option D is the most tempting because widening the port range genuinely does find more listening services, but it still only observes the host from the outside, so missing local patches and registry settings that expose no network service remain invisible. Changing frequency or scan origin affects timeliness and network reachability, not the depth of inspection.

Answer: B
SAML carries signed authentication assertions and attributes from an identity provider to a service provider, which is the standard pattern for federated browser based single sign-on. OAuth is an authorization framework that issues scoped access tokens so an application can act on a resource on the user's behalf without handling the user's credentials. Option C is the classic trap because it names the correct two standards but assigns each to the other's job. LDAP is a directory access protocol rather than a federation standard, and RADIUS and TACACS plus serve network and device administration authentication.

Answer: A
Attribute based access control evaluates policies over attributes of the subject, the object, the action, and the environment, so conditions such as department, record sensitivity, time, and device posture combine in a single policy without multiplying identities. Option B is the most tempting because adding roles is the natural incremental fix and role based control is far more widely deployed, but that is exactly the role explosion the stem describes as the problem, since each new attribute combination requires another role. Discretionary control puts the decision with individual owners, and mandatory control applies fixed clearance labels that cannot express device or time conditions.

Answer: B
Degaussing works by disrupting a magnetic field and therefore has no effect on solid state media, which store data as electrical charge in flash cells. For a self encrypting drive that must be returned intact, cryptographic erase, which destroys the media encryption key so all remaining ciphertext is unrecoverable, is both effective and non destructive. Option D is the most tempting because it sounds appropriately rigorous and destruction is genuinely the strongest sanitization method, but shredding is incompatible with the stated requirement to return the drives to the lessor. Deleting a partition table removes only the map to the data, leaving the data itself intact.

Answer: C
A compensating control is deployed when the primary or required control cannot be implemented on a system; it provides a comparable level of protection by other means. Here MFA is the required control, the legacy controller cannot support it, and network restriction plus a monitored jump host substitutes for it. Detective is the most tempting distractor because the scenario does mention enhanced session logging, but logging is only one part of the response and it merely records events after they occur. The classification question asks about the VLAN and jump host restriction, which actively prevents unauthorized reachability rather than discovering misuse afterward, so detective does not describe the control being asked about.

Answer: A
A deterrent control discourages a threat actor from attempting an action by raising the perceived cost or likelihood of being caught, without physically blocking the action. Signage warning of surveillance and prosecution is the classic example. Preventive is the tempting wrong choice because signage is placed at the perimeter alongside preventive measures such as fences, but a preventive control physically or logically stops the act from occurring; a sign cannot stop anyone who chooses to ignore it, which the stem states explicitly. Detective would describe the cameras themselves, not the notice about them.

Answer: A
Mean time to repair measures how long restoration takes, so anything that removes delay from the repair process, such as having spares on hand, reduces it directly. Mean time between failures describes the reliability of the hardware itself and is improved by better components or reduced load, not by parts logistics. Option C is the most tempting because a recovery time objective is also a duration and the two are frequently confused, but it is a business target that leadership sets for acceptable downtime, whereas mean time to repair is an observed measurement of actual repair performance; the target does not change simply because spares are stocked.

Answer: C
Writing beyond the end of a fixed length buffer overwrites adjacent stack memory, including saved return addresses, which is what allows arbitrary code execution; validating and bounding the length before the copy removes the root cause. Option B is tempting because both are input handling failures and candidates group them together, but a parameterized query defends against an interpreter parsing attacker data as commands, and there is no query or interpreter here. Compiler and platform defenses such as stack canaries, address space layout randomization, and non executable stacks raise the difficulty of exploitation but do not fix the missing length check itself.

Answer: D
A time of check to time of use flaw arises when a program validates a resource and then acts on it as a separate, non atomic step, allowing an attacker to substitute the resource in the window between the two. The fix is to bind the check and the use to the same resource handle rather than re-resolving the name. Directory traversal is the most tempting distractor because the exploit also ends with access to a file outside the intended scope, but traversal succeeds because the path itself was never sanitized; here the path was checked correctly and passed validation, and the defect is purely the timing gap between validation and use.

Answer: D
Directive controls guide or mandate behavior through policy, standards, and procedures; enforcement depends on personnel compliance rather than on a technical mechanism. A written standard on credential handling is directive. Preventive is the most tempting answer because the intent of the standard is to prevent hardcoded secrets, but intent does not determine the control type. A preventive control would be a pre-commit hook or repository scanner that actually blocks the commit. The stem states the standard relies on people and later audits, which is precisely the distinction between directing behavior and preventing it.

Answer: B
Key stretching intentionally makes password hashing expensive so that an attacker who steals the password store must spend far more time per candidate guess, cutting offline cracking throughput by orders of magnitude. Option A is the most tempting distractor because it describes a real and valuable property of the scheme described, but that property is delivered by the unique random value, the salt, and not by the iteration count; salting defeats precomputed tables and stops identical passwords from sharing a digest, while iteration count is what raises the per guess cost. Options C and D misstate hashing entirely: hashing is one way, so the plaintext cannot be recovered or decrypted, which is the point of storing a digest rather than the password.

Answer: A
OCSP lets a client ask the certificate authority for the real time status of a single certificate, returning good, revoked, or unknown, which avoids the bandwidth and staleness problems of a bulk list. A certificate revocation list is the strongest distractor because it also answers the revocation question, but a CRL is exactly the large periodically published list the stem rules out; between publication intervals it can be stale. A certificate signing request is what an applicant submits to obtain a certificate and has nothing to do with revocation status.

Answer: C
A wildcard certificate is issued for a name such as an asterisk followed by the domain, so it validates any single level subdomain of that domain and can be deployed across many hosts under one issuance and renewal cycle. A self signed certificate is the most tempting alternative because it is free and easy to issue internally, but it still has to be created and distributed per host and, more importantly, is not chained to a trusted authority, so clients raise warnings unless the certificate is manually trusted everywhere. An extended validation certificate changes the identity vetting level, not the number of hostnames covered.

Answer: D
Key escrow stores a copy of the encryption or recovery key with a trusted third party or internal custodian so the organization retains lawful access to its own data when the primary key holder is unavailable. A trusted platform module is the most tempting distractor because TPMs are genuinely part of most full disk encryption deployments, but a TPM seals the key to that specific machine and to its boot state, which makes recovery harder rather than easier when the user cannot authenticate. Longer keys and forward secrecy improve cryptographic strength but do nothing to restore organizational access.

Answer: B
Steganography conceals data inside another file, commonly an image or audio file, so that the carrier appears entirely normal and the existence of the hidden message is not apparent. That is exactly what the slightly oversized photographs with embedded design data describe. Data masking is the most tempting wrong answer because it is also an obfuscation technique, but masking replaces sensitive values with fictitious ones so the data can be used safely in a lower trust environment; it hides the value, not the existence of a second payload. Salting adds random input to a hash and does not conceal anything inside a file.

Answer: C
The policy enforcement point sits in the data plane, receives the decision, and allows, denies, or terminates the session. The policy engine is the strongest distractor because it is the component that actually makes the decision, and candidates frequently conflate deciding with enforcing; the stem separates the two roles deliberately and asks for the one in the traffic path. The policy administrator is the control plane element that communicates the engine's decision and establishes or tears down the connection, but it is not itself the in line enforcement device.

Answer: B
A digital signature is produced by encrypting a hash of the content with the signer's private key, and anyone holding the signer's public key can verify it, which proves both integrity and origin. Option C is the classic trap because it names the right two keys but reverses their roles; signing with a public key would let anyone forge a signature, since public keys are by definition distributed openly. Option D fails because a symmetric key shipped with the installer would be available to any attacker who downloads it, so it could not prove origin and would provide no non repudiation.

Answer: D
Perfect forward secrecy uses ephemeral key exchange so that each session's symmetric key is derived from short lived values that are discarded afterward and never recoverable from the long term certificate key. Compromising the server key later therefore does not unlock previously captured sessions. Option B is the most tempting choice because a longer key does make direct factoring harder, but it does nothing about the stated threat: if the long term key is eventually compromised by any means, every session that used it for key transport can still be decrypted regardless of its length. Pinning and mutual TLS address impersonation and authentication, not retrospective decryption.

Answer: C
A gap analysis compares a desired or required control state against the current state and enumerates the differences so remediation can be prioritized, which is exactly the described sequence. A business impact analysis is the most tempting alternative because it also produces a prioritized output, but its subject is the operational and financial consequence of losing a process, expressed through metrics such as recovery objectives, not the presence or absence of framework controls. A quantitative risk assessment assigns monetary loss values to risks and likewise does not inventory control coverage.

Answer: B
Password spraying tries a very small number of common passwords across a very large number of accounts specifically so that no account accumulates enough failures to trip lockout, which matches the two attempts per account across 4,000 accounts. Credential stuffing is the closest distractor because it also targets many accounts, but stuffing replays username and password pairs harvested from a breach elsewhere, so each account would be tried with its own leaked password rather than the same two seasonal guesses. A brute force attack concentrates many guesses on one account and would rapidly trigger lockout, and a rainbow table attack is performed offline against stolen hashes, producing no authentication log entries at all.

Answer: C
A watering hole attack compromises a legitimate third party site that the intended victims are known to frequent, then serves malicious content from it, often filtered to the target organization's address range as described here. Typosquatting is the most tempting distractor because it also involves victims reaching a hostile site through the browser, but typosquatting depends on the victim mistyping a domain and landing on a lookalike; in this scenario the engineers reached the correct, legitimate site, which had itself been compromised. Business email compromise is ruled out explicitly, since no malicious email was involved.

Answer: C
Business email compromise targets an employee with financial authority using a message that appears to originate from a trusted executive, exploits authority and urgency, and seeks a fraudulent funds transfer rather than malware execution. Credential harvesting is the tempting wrong answer because both start with a deceptive email, but a harvesting attack drives the victim to a fake login page to capture a password; here there is no link or portal, and the requested action is the wire itself. Smishing is ruled out because the delivery channel is email rather than SMS.

Answer: D
Typosquatting registers a domain that is a plausible misspelling of a legitimate one and relies on user typing errors to deliver visitors to attacker infrastructure. DNS poisoning is the strongest distractor because its effect on the victim looks similar, sending users to a hostile site, but poisoning corrupts resolution for the correct domain name; here the retailer's real domain still resolves correctly and a separate lookalike domain was registered. Domain hijacking would mean the attacker seized control of the retailer's actual domain registration, which the stem does not describe.

Answer: B
A logic bomb is dormant code that executes its payload only when a defined condition is met, such as a date, an event, or, as here, the absence of a specific account. A trojan is the most tempting alternative because both hide malicious functionality inside otherwise legitimate software, but a trojan's defining trait is that it deceives the user into installing or running it by masquerading as something desirable; this code was placed directly into an application the developer was authorized to modify, and its defining trait is the trigger condition. A worm self propagates across hosts, which is absent here.

Answer: A
A rootkit operates at or below the operating system boundary and intercepts the calls that enumerate files, processes, and registry keys, so on host tools receive falsified results while an offline examination of the same disk sees the real contents. That asymmetry between live and offline analysis is the diagnostic clue. Option C is the tempting distractor because fileless malware also evades file scanning, but fileless malware leaves nothing on disk, whereas offline analysis here found malicious drivers and files present. An out of date signature database would fail equally in both live and offline scanning and would not explain the difference.

Answer: A
A downgrade attack manipulates protocol negotiation so the endpoints agree on a weaker algorithm or version than either was capable of using, which is why servers should refuse deprecated versions outright rather than negotiating them. A replay attack is the most tempting distractor because both require the attacker to sit on the traffic path, but replay captures valid data and retransmits it later to impersonate a legitimate action; nothing is retransmitted here, and the compromise comes from the weakened cipher agreement. A birthday attack targets hash collision probability and is unrelated to negotiation.

Answer: C
Directory traversal, also called path traversal, abuses unsanitized relative path input so that file access escapes the intended base directory and reaches arbitrary files on the host. Server side request forgery is the strongest distractor because it also makes the server fetch a resource the attacker names, but SSRF causes the server to issue a network request to an attacker chosen URL, typically to reach internal services; here the server is reading directly from its own file system by path. Cross site scripting and cross site request forgery both execute in the victim's browser and do not read server files.

Answer: D
Stored cross site scripting persists the payload in server side storage so it executes for every user who loads the affected content, without any interaction from the attacker after submission, which is why it is the most damaging variant. Reflected cross site scripting is the classic trap here because both execute script in a victim's browser, but reflected attacks require each victim to follow a crafted link that carries the payload in the request; no link delivery occurs in this scenario since the signature is served from the database to everyone. Cross site request forgery does not inject script at all; it induces the browser to submit a state changing request.

Answer: B
Reflection means the attacker spoofs the victim's address as the source so third party servers direct their replies to the victim; amplification means the reply is substantially larger than the request, multiplying the attacker's bandwidth. Both traits appear here. Option A is the tempting distractor because it is also a volumetric denial of service pattern, but a half open connection flood consumes connection state on the target through incomplete handshakes and does not involve third party reflectors or size amplification. Option D is wrong because nothing is being intercepted or altered; the resolvers are answering normally to a forged source address.

Answer: C
The defect exploited is that a bearer token remains valid regardless of who presents it or from where, so the defense is to shorten the token's usable window and tie it to context such as the originating client, causing a replayed token to fail validation. Multifactor authentication is the most tempting distractor because it is the reflexive answer to account takeover, but it is exercised only when a session is created; the attacker here never authenticates at all and instead inherits a session the legitimate user already established after completing every factor. Lockout thresholds and password hashing are likewise never reached, because no password is guessed, submitted, or cracked.

Answer: C
Shadow IT is technology procured and used by business units without the knowledge or approval of the IT and security functions, which places data outside sanctioned controls, monitoring, and contractual protections. The malicious insider option is the most tempting because the outcome, corporate data sitting in an uncontrolled external service, resembles exfiltration, but insider threat classification turns on intent; the marketing team is trying to do its job and has no intent to harm the organization. Treating it as malicious would also drive the wrong response, which is provisioning a sanctioned alternative and tightening procurement rather than pursuing an investigation.

Answer: D
An allow list permits only enumerated, approved software to execute and blocks everything else by default, so an unknown variant is stopped regardless of whether a signature exists. It is especially well suited to fixed function endpoints whose approved software set rarely changes, as described. Option A is the most tempting because faster updates feel like the direct fix, but signature based detection is inherently reactive and cannot match a variant no vendor has yet analyzed, which is exactly the failure mode stated. Detection in alert only mode does not block execution, and awareness training does not address malware that these fixed function workstations encounter outside of user email behavior.

Answer: C
Vishing is voice phishing: social engineering conducted over a telephone call, typically combining impersonation of a trusted internal function with manufactured urgency to extract credentials or one time codes. Smishing is the most tempting distractor because a text message does appear in the scenario, but the text is the legitimate multifactor code sent by the company's own system; the attacker's delivery channel and the deception both occur on the phone call. Shoulder surfing requires physical proximity to observe the screen or keypad, and tailgating is unauthorized physical entry behind an authorized person.

Answer: C
Bloatware is unnecessary preinstalled software shipped by a manufacturer that provides no value to the organization while consuming resources and adding unpatched, unsupported code to the attack surface, which is why removing it is part of a standard imaging and hardening baseline. Spyware is the tempting distractor because both are unwanted and both may be removed by the same tooling, but spyware is defined by covertly collecting and transmitting information about the user; the stem states explicitly that the software is not malicious. Ransomware encrypts data for extortion, which is not described.

Answer: C
Missing logs are themselves an indicator of compromise: adversaries frequently clear or truncate event records during the anti forensics stage, and an unexplained gap bounded by normal activity on both sides is a strong signal, which is why forwarding logs to a write protected central collector matters. Option B is the most tempting because rotation genuinely does create gaps in local files, but rotation is scheduled, recurring, and would produce comparable gaps at other times rather than a single unexplained window aligned with the intrusion. Option D inverts the reasoning, since a truly offline server would show a corresponding gap in network and infrastructure telemetry as well.

Answer: B
A fail-closed configuration denies traffic when the device cannot inspect it, which enforces the stated priority that uninspected transactions are never acceptable, at the cost of an outage during appliance failure. Option A is the most tempting because fail-open is the common default in many deployments and it protects the business from downtime, but it does exactly what leadership prohibited by allowing uninspected payments through. Option D is wrong because fail-closed does not create redundancy by itself; achieving both inspection and availability requires a separate high availability pair, not a change of failure mode.

Answer: D
A jump server, also called a bastion host, is a single hardened, monitored system that administrators authenticate to first and from which all administrative connections into a protected zone originate, collapsing the firewall rule set to one permitted source. A reverse proxy is the most tempting distractor because it is also an intermediary that other systems connect through, but a reverse proxy fronts published application services for external clients; it is not an interactive administrative pivot and does not provide the session logging and account controls the scenario requires. A network tap only copies traffic for monitoring and carries no sessions.

Answer: A
A reverse proxy accepts inbound connections on behalf of internal servers, terminates and inspects TLS, and conceals back end addressing, which is precisely the published application pattern described. A forward proxy is the most tempting distractor because both are called proxies and both inspect TLS, but a forward proxy serves internal clients making outbound requests and has no role in protecting inbound published services. A network tap is passive and cannot terminate connections, and host based firewalls filter per server without providing a single inspection point or hiding the servers.

Answer: C
A web application firewall parses HTTP requests and evaluates parameters, headers, and body content against rules describing valid application input, which is what catches injection and scripting payloads carried inside otherwise legitimate requests. Option B is the most tempting because a unified threat management appliance bundles many functions and feels like a superset, but its consolidated inspection is broad rather than application aware, and it does not model a specific application's expected parameters. Option D fails the requirement outright because detection in monitor only mode raises an alert without blocking the request, and option A operates below the application layer entirely.

Answer: B
A passive, out of band sensor receives a copy of traffic from a tap or mirror port, so production packets never traverse the sensor and its failure or overload cannot affect the link, at the cost of being able only to detect rather than block. Option C is the most tempting because a hardware bypass module does protect against total device failure, but the sensor is still inline in the packet path during normal operation, which adds latency and gives it the ability to interrupt traffic, both of which the requirements forbid. Option D likewise places the device in the path.

Answer: D
In an infrastructure service the customer is issued a virtual machine and owns everything from the guest operating system upward, including its patching. In a software service the customer receives only the application, so the provider owns the operating system, platform, and application maintenance while the customer retains responsibility for its data, identities, and access configuration. Option B is the most tempting because data ownership does remain with the firm in both models and candidates over extend that principle, but data ownership does not confer operating system access in a software service; the firm has no ability to patch a host it cannot reach.

Answer: A
Infrastructure as code expresses environment definitions as templates that can be peer reviewed, versioned, scanned before deployment, and applied identically everywhere, which eliminates the configuration drift and repeated misconfiguration described. Software defined networking is the most tempting distractor because it also brings programmability to infrastructure, but it addresses how network forwarding decisions are centralized and abstracted, not how full environment definitions are authored, reviewed, and reproduced. Containerization and serverless change the workload packaging and hosting model without themselves preventing drift in the surrounding configuration.

Answer: A
Containers share the host kernel and are separated by namespaces and control groups, so a kernel level compromise can affect every container on that host. Virtual machines each run their own kernel with separation enforced by the hypervisor, which is a stronger isolation boundary for this specific threat. Option D is the most tempting because reduced image size is a genuine container security advantage and candidates generalize it, but a minimal image reduces the software inventory inside the container without changing the fact that all containers depend on one shared kernel, which is the exact boundary the requirement concerns.

Answer: B
Operational technology commonly cannot be patched on the enterprise cycle because of vendor certification and process continuity constraints, so the recognized approach is to reduce exposure around the device: place it in a tightly restricted zone, permit only explicitly required flows, and monitor it closely. Option A is the tempting answer for candidates who treat patching as an absolute, but in a process control environment an unplanned halt can have safety consequences, and vendor certification loss can leave the utility unable to obtain support at all. Option C is inadequate because accepting risk without compensating controls leaves a known vulnerable system fully exposed.

Answer: D
Secure access service edge converges wide area connectivity with cloud delivered security services, applying identity and context aware policy at distributed points of presence so that branch and remote users receive equivalent enforcement without backhauling. Option C is the strongest distractor because software defined wide area networking is genuinely a component of this design, but on its own it optimizes and orchestrates transport selection; it does not by itself provide the secure web gateway, identity aware policy, and data loss inspection the requirement names. A VPN concentrator at headquarters reintroduces exactly the backhaul the company is eliminating.

Answer: B
Tunnel mode encapsulates the whole original packet, headers included, within a new packet whose outer addresses are the two gateways, which conceals internal addressing and suits gateway to gateway deployment. Option A is the most tempting because transport mode is genuinely used for IPSec and does encrypt the payload, but it preserves the original IP header in the clear, violating requirement one, and it is designed for host to host protection rather than gateway enforcement. Option D fails because Authentication Header provides integrity and authentication but no encryption, so encapsulation without Encapsulating Security Payload leaves the inner packet readable.

Answer: C
Geographic restriction, sometimes implemented as region pinning or geofencing, constrains where data may physically reside and where it may be replicated, which is the direct control for a residency obligation. Encryption is the most tempting distractor because it is the reflexive answer to any data protection requirement and it does protect confidentiality, but an encrypted copy replicated to another region is still stored in that region and still violates the residency constraint. Tokenization and masking alter the values rather than the location and likewise do not satisfy a requirement expressed in terms of physical placement.

Answer: B
A cold site supplies only the physical environment, so it is the cheapest option and carries the longest recovery time because hardware, software, and data must all be brought in and built before use. A warm site is the most tempting distractor because both are cheaper than a hot site and both require work before cutover, but a warm site already contains installed hardware and often periodically refreshed data, needing only current data restoration and start up. The stem states explicitly that no servers, software, or data are present, which excludes warm.

Answer: A
An uninterruptible power supply provides immediate, seamless transfer but has limited runtime, whereas a generator has effectively unlimited runtime but requires time to start and reach stable output. Together they cover both the instantaneous and the sustained requirement. Option D is the most tempting because it also pairs the two devices and sounds like sensible redundancy, but it inverts the sequence: if the battery only engaged after the generator failed to start, the load would already have dropped during the generator's start interval, defeating the requirement for uninterrupted power.

Answer: C
An air gap is physical isolation: no network path exists at all, so data crosses only by deliberate manual transfer, which is why it is reserved for the highest value assets such as offline signing keys. Logical segmentation is the most tempting distractor because it also separates systems and is far more common, but virtual local area networks and access lists still depend on a shared physical network and on the correct configuration of shared devices, so a misconfiguration or switch compromise can bridge the separation. An air gap has no such shared path to misconfigure.

Answer: D
A trade secret derives its value from secrecy itself and is protected by the owner's own confidentiality measures rather than by registration, which is what distinguishes it from other intellectual property. Regulated data is the most tempting distractor because it is also highly sensitive and heavily protected, but regulated data is classified that way because an external law or standard imposes handling requirements on it, such as payment card or health information; the manufacturing process in this scenario carries no such external mandate, and its protection obligation arises purely from the business's own interest in confidentiality.

Answer: D
DMARC builds on the other two mechanisms by publishing the domain owner's policy for handling messages that fail authentication and alignment, such as quarantine or reject, and by requesting aggregate and forensic reports back to the domain owner. Sender Policy Framework is the most tempting distractor because it is the record listing authorized sending servers, but the stem states that record already exists; SPF publishes who may send and produces a pass or fail result without telling the receiver what to do with a failure. DomainKeys Identified Mail supplies the signature, which the stem also states is already in place.

Answer: C
Data loss prevention inspects content in motion, at rest, and in use against classification rules and patterns, and can block or quarantine a transfer that would move regulated data outside policy across email, web, and removable media channels. A security information and event management platform is the most tempting alternative because it also sees a great deal of activity and can alert on it, but it correlates log records after the fact rather than inspecting message content in the transfer path, so it cannot stop the transfer. File integrity monitoring watches for changes to files, not for their egress.

Answer: B
File integrity monitoring records a cryptographic hash of each protected file and alerts when a recomputed hash no longer matches the baseline, which detects modification regardless of whether the replacement is recognized as malicious. Antivirus is the most tempting distractor because it is also a scanning control on the same host, but it detects files that match known malicious patterns; a custom backdoor built for one target will not match a signature, and the stem states the replaced binary continued to function normally. Encryption protects data if the disk is removed and does nothing about authorized changes made on a running system.

Answer: D
A false positive is a reported finding that does not actually exist, which describes the first server where the library and service are absent. A false negative is a real weakness the tool failed to report, which describes the second server that was compromised through an issue reported as clean. Option C is the classic trap because the two terms are easily transposed under time pressure; the reliable check is that the label always describes what the tool said, so a positive report that turns out to be untrue is a false positive, and silence that turns out to conceal a real issue is a false negative. False negatives are the more dangerous of the two because nothing prompts investigation.

Answer: A
When a finding cannot be remediated on the normal cycle, the correct response is a formally approved exception that documents the business justification, records the compensating controls, assigns an owner, and sets a review date so the acceptance does not become permanent by neglect. Option C is the most tempting because both involve a decision not to patch, but avoidance means ceasing the activity that creates the exposure entirely, and the stem states the system keeps running. Option B is wrong and dangerous, because the finding is described as confirmed; closing a real vulnerability as a false positive removes it from tracking without reducing the risk.

Answer: A
Validation closes the loop in vulnerability management: a rescan or equivalent verification confirms that the applied change actually removed the finding, since patches can fail to install, be rolled back, or require a restart that never happened. Option D is the most tempting because prioritization is a genuine and adjacent step in the same lifecycle, but it governs what to work on next rather than proving that completed work succeeded. Option B is incorrect because an exception is used when a finding will not be remediated, which is the opposite of the situation described.

Answer: C
Alert tuning refines a rule so it stops firing on a specifically identified benign condition while preserving detection of the same behavior in every other context, which restores analyst trust without creating a blind spot. Option D is the most tempting because it produces the same immediate relief from noise and analysts are already ignoring the alerts, but disabling the rule removes detection of genuinely malicious instances of that behavior, converting an alert fatigue problem into a coverage gap. Archiving the output has the same effect while hiding it, and retention changes affect storage of records rather than which conditions raise an alert.

Answer: B
Mandatory access control enforces a system wide policy of labels and clearances that individual users, including the owner of an object, cannot override, which is why it is used in classified environments. Discretionary access control is the direct opposite and is the most tempting distractor because it is the familiar model on ordinary file systems, where the owner sets permissions and may grant access to whomever they choose; the stem specifically forbids that, which rules it out. Role based control groups permissions by job function and does not use clearance comparison at all.

Answer: C
Just in time privileged access grants elevation only on an approved request and only for a limited period, after which entitlement is revoked automatically, which shrinks the window in which a compromised account carries administrative power from continuous to minutes. Option A is the most tempting because credential rotation is a real privileged access management practice and does limit the life of a stolen secret, but the engineers still hold standing membership between rotations, so a compromise at any moment still yields immediate administrative rights. Stronger passphrases and stricter policy on the accounts do not change the standing entitlement at all.

Answer: D
Multifactor authentication requires credentials drawn from different categories, namely something you know, something you have, and something you are. A password and a security answer are both knowledge, so presenting them together is multi step single factor authentication regardless of how many items are supplied. Option B is the most tempting because candidates equate more credentials with more factors, but the requirement is about category diversity rather than count; adding a fourth knowledge question would still not satisfy it, while adding one hardware token would.

Answer: A
Access attestation, also called recertification, requires an accountable reviewer to periodically confirm that each user's entitlements still match their current duties, and to revoke what no longer applies, which is the standard defense against privilege creep from internal transfers. Option D is the most tempting because identity proofing is a genuine and important identity lifecycle step, but it verifies who a person is at enrollment and never revisits what they may access afterward, so it cannot detect entitlements accumulated years later. Password rotation and federation change how credentials are managed, not what permissions an identity holds.

Answer: A
De-provisioning must disable authentication at the moment employment ends; data retrieval is accomplished by delegating the mailbox or exporting it administratively, which requires no active user account. Leaving the account enabled preserves exactly the access the termination was meant to remove. Option D is the most tempting because the abuse involved a logon and passwords feel like the relevant control, but the account's password was presumably valid and known to its legitimate owner, so no complexity rule would have prevented that person from using it; the defect is that a valid credential was still accepted after the person's authorization ended.

Answer: C
Content categorization applies a continuously updated vendor classification of sites into categories, so policy is written once against a category rather than against individual domains, and different rules can be bound to different user groups such as students and staff. Option A is the most tempting because address based blocking is a genuine perimeter technique and feels equivalent, but modern sites sit behind shared hosting and content delivery networks, so a single address may serve many unrelated sites, making address blocking both over broad and quickly stale. Rate limiting and certificate pinning address performance and impersonation, not site classification.

Answer: D
A DNS sinkhole intercepts resolution for known malicious domains, returns a controlled address so the malware never reaches its infrastructure, and records the internal client that asked, which simultaneously blocks the channel and identifies infected hosts. Option A is the most tempting because it also stops external resolution, but blanket blocking of outbound resolution breaks name resolution for every legitimate purpose unless internal resolvers are permitted, and it produces a generic denial rather than an attributable record of which host sought which malicious domain. Full packet capture provides evidence but blocks nothing.

Answer: A
Version 3 of the simple network management protocol introduces a user based security model with authentication and privacy, which is the only option that actually satisfies both the authentication and confidentiality requirement in the protocol itself. Option B is the most tempting because a long random community string does raise the guessing bar, but the string is still transmitted in the clear, so anyone able to observe the traffic simply reads it, and the retrieved data remains unencrypted. Option C reduces who can observe the traffic without meeting the stated requirement, and would at best be a compensating control rather than remediation.

Answer: B
Containerization creates a separate encrypted managed workspace on a personally owned device so corporate data and applications are governed independently and can be removed by a selective wipe that leaves personal content untouched. Option A is the most tempting because it certainly removes the corporate data, but a full wipe also destroys the employee's personal content on a device the company does not own, which the requirement explicitly forbids and which creates legal exposure. Option C solves the problem by abandoning the bring your own device model the scenario is built on, rather than by managing it.

Answer: D
WPA3 personal replaces the pre-shared key handshake with Simultaneous Authentication of Equals, a password authenticated key exchange in which each guess must be tested against the live network rather than offline, and which produces distinct session keys so knowing the passphrase does not let one client decrypt another's traffic. Option C is the most tempting because a longer passphrase genuinely does slow guessing, but it leaves the offline attack structurally possible and does nothing about passphrase holders decrypting each other's sessions. MAC filtering and hiding the network name are trivially defeated by observing existing traffic.

Answer: A
Static analysis reasons about code without running it and therefore cannot observe defects that emerge from runtime state, environment, configuration, or the interaction of components. Dynamic analysis, including fuzzing, drives the running application with malformed and unexpected input and detects crashes and memory faults as they actually occur. Option B is the most tempting because rule set differences are a real phenomenon and adding coverage sounds prudent, but every static analyzer shares the same fundamental blind spot: none of them execute the program, so a defect that only manifests at runtime remains invisible to all of them.

Answer: D
Code signing binds a digital signature from the publisher's private key to the binary, and an endpoint policy that requires a valid signature from a trusted publisher enforces both origin and integrity automatically at the moment of execution. Option C is the most tempting because a checksum does verify integrity, but a published checksum proves only that the bytes match a value someone posted; it carries no proof of origin, it can be replaced by an attacker who also controls the intranet page, and it depends on a manual comparison that no endpoint performs at runtime. Encrypted transport and share permissions protect the file in transit and at rest without validating it at execution.

Answer: C
A sandbox executes untrusted code in a controlled, instrumented, and network isolated environment, capturing file, registry, process, and network behavior while preventing any effect on production. Option D is the most tempting because using a spare machine feels like adequate separation, but the machine remains on the production network, so malware that scans or spreads laterally can reach production hosts, and not being domain joined does not restrict its network reachability. A reputation lookup is useful triage but reports only what is already known and yields no behavioral detail for a novel sample.

Answer: D
Threat hunting is proactive, hypothesis driven searching through existing telemetry for adversary behavior that automated detection has not flagged, and it deliberately begins without an alert or a declared incident. Option A is the most tempting for candidates who associate any deep investigation with incident response, but eradication is a phase that occurs after an incident has been confirmed and its purpose is to remove the adversary's presence, not to determine whether one exists. Vulnerability scanning enumerates weaknesses in systems rather than searching for evidence of an active adversary.

Answer: A
A legal hold suspends routine destruction of potentially relevant records once litigation is anticipated, and it overrides the ordinary retention schedule; failing to preserve those records constitutes spoliation and can result in court sanctions and adverse inference. Option D is the most tempting because both concepts concern evidence handling in a legal context, but chain of custody documents who possessed evidence after it was collected, whereas a legal hold governs whether the material continues to exist at all. Option B inverts the direction entirely, since a right to be forgotten request seeks deletion rather than preservation.

Answer: D
Single loss expectancy equals asset value multiplied by exposure factor, so 400,000 multiplied by 0.25 gives 100,000 dollars for one occurrence. Annualized loss expectancy equals single loss expectancy multiplied by the annualized rate of occurrence; once every four years is a rate of 0.25 per year, giving 25,000 dollars. Option C is the classic trap because it contains both correct figures but transposes them, which happens when a candidate multiplies rather than recognizing that a less than annual event rate must reduce the yearly figure below the single occurrence figure. A useful sanity check is that whenever an event occurs less than once a year, the annualized figure must be smaller than the single loss figure.

Answer: A
A risk register is the authoritative inventory of identified risks with owners, scoring, and treatment decisions, and a key risk indicator is a measurable signal chosen to show that a risk is approaching a threshold requiring action. Option B is the most tempting because a business impact analysis is also a formal risk related artifact produced by the same program, but its subject is the operational consequence of losing a business process and its outputs are recovery objectives rather than an inventory of risks with named owners and treatments. An incident response plan governs handling of events that have already occurred.

Answer: C
Transference shifts the financial consequence of a risk to a third party, most commonly through insurance or a contractual indemnity, while the underlying likelihood of the event is unchanged. Mitigation is the most tempting distractor because the firm did mitigate first and candidates read the whole scenario as one action, but the question asks about the treatment applied to the exposure remaining afterward, and buying a policy does not reduce the chance or the technical impact of a breach. Acceptance would mean absorbing the loss internally with no instrument in place, and avoidance would mean ceasing the activity that creates the exposure.

Answer: C
Avoidance eliminates a risk by ceasing the activity that creates it, which is exactly what retiring the feature and deleting the data accomplishes; the exposure does not merely shrink, it ends. Option D is the most tempting because deletion does reduce potential impact and candidates reach for mitigation whenever a protective action is taken, but mitigation implies the activity continues under reduced risk. Here the activity itself is discontinued, so no residual operational exposure remains to be managed. Acceptance is wrong because leadership took decisive action rather than absorbing the risk.

Answer: D
The recovery point objective expresses the maximum acceptable amount of data loss measured backward in time from the disruption, and it drives backup and replication frequency, which is precisely what the director described. Maximum tolerable downtime is the most tempting distractor because it is also expressed in units of time and is also set by business leadership, but it measures how long the service may be unavailable rather than how much data may be lost; a system can be restored very quickly and still fail the requirement if it comes back missing hours of transactions. Mean time between failures and mean time to repair describe reliability and repair duration, not data loss tolerance.

Answer: B
A memorandum of understanding documents mutual intent and general responsibilities between parties without the enforceability and detailed obligations of a contract, which matches a non binding statement of collaborative goals. A statement of work is the most tempting distractor because it also describes what parties will do, but it is precisely the opposite in character: it enumerates specific deliverables, schedules, and acceptance criteria under an existing contract. A service level agreement commits a provider to measurable performance levels, and a business partners agreement governs profit sharing and responsibilities between commercial partners.

Answer: C
A right-to-audit clause is the contractual provision that grants the customer authority to examine the vendor's controls, records, and facilities during the term, which is the only mechanism that converts an expectation of transparency into an enforceable entitlement. A non-disclosure agreement is the most tempting distractor because it also concerns access to the vendor's sensitive documentation, but it restricts what may be disclosed about information already shared; it grants no right to obtain anything. A service level agreement governs performance thresholds and remedies, not inspection rights.

Answer: D
A service level agreement defines measurable performance commitments such as availability and response times, together with the remedies or credits owed when they are not met. A master service agreement is the most tempting alternative because it is also a formal commercial contract that governs the same vendor relationship, but it establishes the overarching legal terms, liability, and payment framework under which individual engagements operate; the specific measurable performance thresholds and their penalties live in the service level agreement rather than in the master terms. A non-disclosure agreement concerns confidentiality only.

Answer: A
A non-disclosure agreement legally binds the receiving party to keep specified information confidential and to use it only for the agreed purpose, which is standard practice before sharing proprietary material during an evaluation. An acceptable use policy is the most tempting distractor because it also governs how information and systems may be used, but it applies internally to an organization's own users and their use of corporate resources; it has no force over an external supplier. A statement of work would describe deliverables for engaged work that has not yet been awarded here.

Answer: B
The controller determines the purposes and means of processing, and the processor acts only on the controller's documented instructions, which maps directly to the retailer setting purpose and retention and the analytics firm executing within those instructions. Option A is the standard trap because it names the correct pair of roles but reverses them; the reliable test is who decides why the data is processed, since that decision defines the controller regardless of which party performs more of the technical work. Option C misuses the term data subject, which refers to the individual whom the personal data describes.

Answer: C
The right to be forgotten, or right to erasure, entitles a data subject to have their personal data deleted where no overriding legal basis for retention exists, and honoring it in practice depends on a complete and current data inventory, since data the company cannot find is data it cannot delete. Option A is the most tempting because minimization is a closely related privacy principle that also reduces stored data, but it constrains what is collected and retained as a matter of policy and creates no obligation triggered by an individual's request. Data sovereignty concerns geographic location rather than deletion.

Answer: D
An unknown environment test withholds internal information so testers must perform their own discovery, which most closely simulates an external adversary but consumes engagement time on reconnaissance that a known environment test spends on depth of coverage. Option B is the most tempting because engagements frequently sit somewhere in the middle, but a partially known test provides some internal information such as a network range or a low privilege account; here the testers receive nothing beyond the company name. A self-assessment is performed by the organization on its own controls and is not an adversarial test at all.

Answer: A
Passive reconnaissance collects information from third party and public sources without touching the target, so it generates no traffic for the target's monitoring to record and cannot alert defenders. Option C is the most tempting because the information genuinely describes live production systems and candidates classify by what is learned rather than by how, but the active and passive distinction turns entirely on whether the tester interacts with the target; port scanning and service enumeration are active precisely because they generate observable traffic. Exploitation and lateral movement occur after access is obtained.

Answer: D
Due diligence is the investigative work of researching and verifying before a decision is made, such as assessing a supplier's controls prior to award. Due care is the ongoing exercise of reasonable prudence in operating and maintaining protections once the relationship exists. Option B is the standard trap because it names the correct pair and reverses them; a durable mnemonic is that diligence is the homework done first and care is the conduct sustained afterward. Attestation and acknowledgement are compliance mechanisms in which parties formally certify or confirm a state, not the standards of conduct the regulator is assessing.

Answer: C
Qualitative analysis ranks risks on descriptive scales using expert judgment and is the appropriate method when reliable frequency and loss data are unavailable, provided the report states that the output is a relative ordering influenced by participant subjectivity. Options A and B are tempting because monetary outputs appear more rigorous to executives, but running quantitative formulas over invented inputs produces figures whose apparent precision is unfounded and which are more likely to mislead a decision maker than a clearly labeled ranking. Option D is unacceptable because deferring the assessment leaves leadership with no risk information at all during the intervening months.

Answer: D
Click rate measures only failure. In a real campaign the decisive variable is how quickly someone alerts the security team, because the first report lets responders pull the message from other mailboxes, block the sender and destination, and hunt for compromised accounts before the campaign spreads. Option A is the most tempting because completion statistics are easy to gather and are commonly reported to leadership, but completing a module records attendance rather than behavior and does not indicate whether an employee would recognize or report a live lure. Option C describes an unrealistic behavior that would prevent employees from doing their jobs.

Answer: D
Comparing a cryptographic hash computed before and after transfer detects whether the file changed in transit, which is an integrity check. Hashing does not hide the file contents, so it provides no confidentiality, it does nothing to keep the transfer service reachable, and it plays no role in deciding which users are permitted to access the data.

Answer: B
Availability means authorized users can reach systems and data when they need them, and the outage denied clinicians exactly that access. Confidentiality concerns unauthorized disclosure, which is not described here, and integrity concerns unauthorized modification of the records themselves. Non-repudiation is about proving who performed an action, not about system uptime.

Answer: C
Bollards, fencing, and access-controlled vestibules are tangible barriers that restrict real-world entry, which is the definition of physical controls. Technical controls are implemented by systems such as firewalls or encryption, managerial controls are governance activities like risk assessments and policies, and operational controls are processes carried out by people, such as guard patrols or training programs.

Answer: D
A warning banner discourages misuse by telling would-be violators that they are watched and will face consequences, which is the purpose of a deterrent control. It does not actually detect anything by itself, it corrects nothing after an incident, and it is not standing in for another control that could not be implemented, so the detective, corrective, and compensating labels do not fit.

Answer: A
A compensating control provides alternative protection when the primary control, here routine patching, is not feasible. Network isolation reduces the exploitability of the unpatched device, achieving a similar risk reduction by different means. It is not corrective because no incident is being remediated, not detective because it identifies nothing, and not directive because it is a technical safeguard rather than an instruction to personnel.

Answer: A
Corrective controls restore systems to a secure state after an incident has occurred, and rebuilding a compromised kiosk from a trusted image is a classic example. Preventive controls act before an incident to stop it, deterrent controls discourage attackers from trying, and detective controls identify that something happened; none of those describe cleanup and restoration.

Answer: C
In zero trust architecture the policy engine sits in the control plane and makes the grant-or-deny decision for each request based on the signals it evaluates. The policy enforcement point sits in the data plane and carries out that decision by allowing or blocking the session, but it does not decide. An implicit trust zone is what zero trust seeks to shrink, and a forwarding node simply moves packets.

Answer: D
Zero trust removes the assumption that anything inside the network is safe, so each request is authenticated and authorized continuously using identity and device posture. Perimeter-focused defense in depth is the older model this design replaces, single sign-on addresses login convenience rather than trust decisions, and physical isolation is an air-gap technique unrelated to per-request evaluation.

Answer: A
A honeytoken is a piece of fake data, such as bogus credentials or an API key, that has no legitimate use, so any attempt to use it is a high-confidence signal of compromise. A honeypot is a decoy system, a honeynet is a network of such decoys, and a honeyfile is a decoy document that alerts when opened; none of those are a planted credential.

Answer: B
A honeypot is a decoy system designed to attract attackers so defenders can observe tools and techniques safely away from real assets. A jump server is a hardened administrative gateway used by legitimate staff, a honeyfile is a decoy document rather than a whole system, and a load balancer distributes traffic for availability; only the decoy server matches the described purpose.

Answer: C
A backout plan documents how to return to the last known-good state if a change goes wrong, which is exactly what the recorded restore commands provide. The maintenance window is the scheduled time for the work, stakeholder analysis identifies who is affected and must be informed, and a standard change template covers routine pre-approved changes rather than recovery steps.

Answer: D
Keeping diagrams, inventories, and configuration records current after each change is the documentation discipline of change management, and it is what lets future troubleshooting, audits, and incident response rely on accurate information. Impact analysis happens before approval, emergency approval covers urgent unplanned changes, and downtime notifications are communication tasks performed ahead of the work.

Answer: A
A certificate signing request bundles the public key with identifying information such as the domain name, and the CA signs it to produce the certificate. The private key must never leave the server, the root certificate is something the CA publishes rather than receives, and symmetric session keys are negotiated later during TLS handshakes, not during certificate issuance.

Answer: C
With OCSP stapling, the web server periodically obtains a time-stamped, CA-signed revocation status and attaches it to the TLS handshake, so clients get fresh proof without querying the CA themselves. Full CRL downloads are heavyweight and slow, pinning binds an app to specific keys but says nothing about revocation status, and a wildcard certificate only changes which names one certificate covers.

Answer: C
The root key anchors all trust, so it stays offline where it cannot be stolen through a network intrusion. Day-to-day issuance happens on intermediates, and if one is compromised it can be revoked and replaced while the root, and therefore the overall trust hierarchy, survives. The design actually lengthens the chain rather than shortening it, signing operations are still required, and revocation publishing remains necessary.

Answer: B
Symmetric algorithms such as AES encrypt large volumes of data very efficiently but require both parties to share a secret first, which is difficult over an untrusted network. Asymmetric techniques let strangers establish that shared secret securely, after which the fast symmetric cipher takes over. Modern hardware runs asymmetric ciphers fine, symmetric keys can still be stolen from endpoints, and no cipher choice provides availability.

Answer: A
A salt is a unique random value combined with each password before hashing, so identical passwords produce different digests. This defeats precomputed rainbow tables and prevents attackers from spotting shared passwords at a glance. Rotating algorithms would not differentiate two hashes created the same way, Base64 is reversible encoding rather than protection, and truncation would make matching hashes more likely, not less.

Answer: B
A digital signature is created with the signer's private key and verified with the public key, so a valid signature proves both that the file was not altered and that it came from the holder of that private key. This authenticity and non-repudiation is what blocks attackers from slipping counterfeit firmware into the supply chain. Signatures do not encrypt the payload, speed up installs, or provide rollback logic.

Answer: C
Key escrow stores copies of decryption keys with a trusted internal or third-party custodian so the organization can recover encrypted data when the original key holder is unavailable. Perfect forward secrecy deliberately makes past sessions unrecoverable, which is the opposite of what a records requirement demands, pinning ties clients to expected certificates, and steganography hides data rather than enabling authorized recovery.

Answer: D
Key stretching algorithms such as PBKDF2 and bcrypt apply the underlying function thousands of times, making each guess computationally expensive. Legitimate logins barely notice the delay, but an attacker attempting billions of offline guesses is slowed enormously. Hashes remain one-way, the iteration count has nothing to do with storage size, and deliberately causing collisions would weaken security rather than improve it.

Answer: A
Full-disk encryption protects data at rest, so a powered-off device or a removed drive yields only ciphertext. Once a legitimate user unlocks the disk and the system is running, files are transparently decrypted for every process in that session, so malware or an attacker using the logged-in account reads everything normally. The three powered-off theft scenarios are precisely what the technology defends against.

Answer: B
A hardware security module is purpose-built to generate, store, and use cryptographic keys inside a tamper-resistant boundary, offers formal FIPS validation, and is engineered for high-throughput signing by networked services. A software keystore leaves keys exposed to host compromise, a self-encrypting USB drive protects stored files rather than performing signing, and a password manager handles credentials, not CA key operations.

Answer: C
The Trusted Platform Module is a chip on the endpoint that stores keys and platform measurements, releasing disk encryption keys only when the boot chain matches the recorded state, which also defeats tampering with the boot process. A network HSM serves centralized enterprise keys rather than sealing per-laptop measurements, RADIUS authenticates network access, and the UEFI menu is firmware configuration, not key storage.

Answer: D
A gap analysis compares the current state of a security program against a desired state, such as a framework profile, and produces the list of missing or weak capabilities that drives the improvement roadmap. A penetration test exercises technical defenses through simulated attack, a vulnerability scan enumerates software flaws, and a business impact analysis measures the operational cost of losing specific processes.

Answer: A
The contractor proved their identity successfully, so authentication passed; the denial came from authorization, the step that decides what an authenticated identity is permitted to do, and finance resources were outside this contractor's permissions. Accounting records what users do for later review, and auditing examines those records, so neither of them blocks a live access attempt.

Answer: B
Long dwell time, bespoke tooling, patient targeting of intellectual property, and the absence of any financial demand are hallmarks of state-sponsored espionage, which is resourced for stealth rather than quick profit. Unskilled attackers lack custom implants, criminal groups monetize access quickly through ransom or fraud, and hacktivists announce themselves because publicity is the point.

Answer: C
An employee misusing legitimate access to take data is the textbook insider threat, and the combination of a grievance, off-hours bulk copying, and imminent departure is a recognized warning pattern. A supply chain compromise arrives through vendors or components, a watering hole poisons an external website the victim frequents, and shadow IT is unsanctioned tooling rather than deliberate data theft.

Answer: D
Defacement paired with public slogans and policy demands is characteristic of hacktivism, where the goal is drawing attention to a cause rather than making money or stealing secrets. There is no theft or extortion indicating financial motives, no competitor gathering trade secrets, and nothing tying the act to a disgruntled former insider with personal revenge in mind.

Answer: A
Profit-sharing rental of ransomware is the ransomware-as-a-service model operated by criminal enterprises, and stealing data before encryption to demand a second payment is double extortion. State actors pre-positioning avoid announcing themselves with ransom notes, an insider logic bomb is planted code triggered by conditions rather than rented tooling, and booter services flood targets instead of encrypting files.

Answer: B
Shadow IT is technology adopted without IT's knowledge or approval, and it creates risk because the data placed there receives none of the organization's controls, monitoring, or backup discipline. A watering hole is an attacker compromising a site the victims visit, typosquatting registers lookalike domains to catch mistyped traffic, and a birthday attack is a cryptographic collision technique, none of which describe unsanctioned SaaS use.

Answer: C
Replacing printed QR codes with malicious ones exploits the fact that users cannot read the encoded URL before scanning, steering them to a counterfeit payment page. Nothing here attacks the kiosk software itself, so brute force is wrong; no radio-based skimming of phones is described; and victims reach the fake site through the sticker's own link, not through poisoned name resolution.

Answer: D
Seeding tempting removable media and relying on human curiosity to get it connected is a baiting attack through the removable device vector, and the enticing payroll label is the lure. Deauthentication targets wireless sessions, on-path attacks intercept traffic between two parties already communicating, and server-side request forgery abuses a web application into making internal requests; none involve planted hardware.

Answer: A
When adversaries breach a supplier and ride its trusted access or update mechanism into many downstream victims at once, that is a supply chain attack, and managed service providers are prized targets precisely because of this multiplier. Cross-site scripting attacks a web application's users, weak wireless encryption exposes one site's airwaves, and a race condition is a timing flaw, none of which explain simultaneous compromise through a vendor channel.

Answer: B
Once a product passes end of support, the vendor stops shipping security fixes, so every vulnerability discovered afterward remains permanently exploitable on that system, which is why unsupported platforms demand isolation or other offsetting safeguards. Power draw, licensing fees, and training needs may be real operational concerns, but they are not security consequences of running the platform.

Answer: C
Removing direct internet exposure so the service is reachable only through an authenticated VPN or gateway, with multifactor authentication in front, eliminates the open target rather than merely inconveniencing attackers. Port changes are trivially defeated by scanners that fingerprint services, a banner has no technical effect on guessing, and a longer idle timeout actually keeps sessions open longer without addressing entry at all.

Answer: D
Impersonating an executive to redirect legitimate payments is business email compromise, and registering a visually confusable domain is a common way to make the fraudulent sender survive a glance. No self-propagating code is involved, so it is not a worm; nothing is injected into a database query; and deauthentication is a wireless denial technique unrelated to fraudulent payment instructions.

Answer: A
An attack delivered by voice call is vishing, and the invented help desk scenario is the pretext that makes the request seem legitimate; the real goal is capturing the one-time code to defeat multifactor authentication. Smishing arrives by text message rather than a call, tailgating is following someone through a controlled door, and dumpster diving recovers discarded documents, none of which happen over the phone.

Answer: B
Phishing delivered over SMS is smishing, and fake toll or delivery notices with urgent payment links are among its most common lures. Whaling is targeted email fraud against senior executives, an evil twin is a rogue wireless access point that mimics a legitimate network, and cross-site request forgery abuses an authenticated browser session, none of which involve fraudulent text messages.

Answer: C
Compromising a third-party site that the intended victims habitually visit, then serving malware to them there, is a watering hole attack, useful when the target's own perimeter is too hard to breach directly. Password spraying guesses common passwords across many accounts, domain hijacking steals control of a victim's own domain registration, and bluejacking pushes unsolicited Bluetooth messages, none of which involve poisoning a frequented site.

Answer: C
Registering domains that differ from a legitimate one by a common typing error, then hosting a credential-harvesting clone there, is typosquatting; the victims deliver themselves through ordinary mistakes. Server-side request forgery tricks a server into making internal requests, MAC cloning impersonates a device on a local network, and session fixation forces a victim onto a known session identifier, none of which depend on mistyped URLs.

Answer: A
Deliberately fabricating and amplifying false narratives through coordinated inauthentic accounts to manipulate perception or markets is a disinformation, or influence, campaign, an attack on trust rather than on systems. Pharming redirects users to fraudulent sites through DNS manipulation, credential harvesting collects logins, and jamming disrupts radio communications, none of which describe fabricated news spread by sock puppet accounts.

Answer: A
Isolating the affected system stops the encryption from spreading to other shares and hosts and preserves the state responders need for investigation, making containment the correct first move. Payment is never a first step, funds criminals, and guarantees nothing; renaming files does not decrypt them and destroys evidence; and rebooting can wipe volatile evidence while allowing persistence mechanisms to resume the attack.

Answer: C
Malicious code that lies dormant until a specific condition occurs, here the administrator's own termination, is a logic bomb, a technique repeatedly seen from insiders positioning revenge in advance. A cryptominer would consume compute continuously for profit rather than waiting, adware displays unwanted advertising, and a boot sector virus infects startup code, none of which are condition-triggered destruction.

Answer: D
Malware that embeds at kernel level and intercepts system calls to conceal its components from the running OS is a rootkit, which is exactly why it only became visible when the disk was examined from trusted external media. A macro virus lives in document macros, ransomware announces itself by encrypting data, and a browser hijacker manipulates web settings; none of them subvert the operating system's own view of itself.

Answer: A
Credentials falling immediately after each reset, with a tight link to activity on one specific machine, points to a keylogger capturing keystrokes at the source, so password strength and rotation cannot help until the endpoint is cleaned. Brute force cannot instantly crack long unique passwords, shoulder surfing does not scale to every reset within days, and a certificate problem would break connections rather than steal keystrokes.

Answer: B
Software that appears legitimate and functions normally while secretly delivering a hidden payload is a Trojan, and pirated installers are one of the most common carriers for bundled remote access tools. A worm spreads on its own without a user installing anything, bloatware is unwanted but disclosed vendor software preloaded on hardware, and a tracking cookie is a browser artifact incapable of granting remote control.

Answer: C
Self-replication across the network by directly exploiting a service vulnerability, requiring no user interaction, is the defining behavior of a worm, and the speed and breadth of spread reflect that autonomy. A Trojan requires a user to run a disguised program, spyware quietly collects information rather than propagating aggressively, and a logic bomb waits for a trigger condition instead of spreading at all.

Answer: A
Fileless malware executes in memory through trusted, built-in tools such as PowerShell and WMI, leaving no executable on disk for signature scanners to inspect, which is why behavioral telemetry like unusual parent-child process chains matters. Nothing here involves encrypting files, boot record infection is an on-disk persistence method this malware specifically avoids, and living-off-the-land techniques often run within the current user's privileges.

Answer: A
The quoted string is a SQL injection probe attempting to alter query logic, and parameterized queries defeat the entire class by keeping user input as data rather than executable query text, with input validation as defense in depth. Password length rules do not affect how input reaches the database, relocating the page only hides it briefly from casual scanning, and compression has no security effect whatsoever.

Answer: B
Attacker-supplied script that the application saves and later serves to every visitor is stored cross-site scripting, the most damaging XSS variant because one submission compromises all subsequent viewers, and output encoding with a content security policy is the core defense. Object-level authorization flaws expose records through predictable identifiers, an open relay abuses mail forwarding, and a weak key-exchange group is a cryptographic negotiation issue.

Answer: C
Cross-site request forgery abuses the browser's habit of sending session cookies with every request to a site, letting a third-party page perform state-changing actions as the victim; anti-forgery tokens and SameSite cookie attributes are the standard defenses. Reflected XSS requires injected script echoing back from the target site, DLL injection is a local process manipulation technique, and credential stuffing replays breached passwords at login pages.

Answer: D
Input overrunning a fixed-size buffer until it overwrites control data such as the saved return address is a buffer overflow, and controlling that address is the route to arbitrary code execution; mitigations include bounds checking, ASLR, and stack protections. XXE abuses XML parsers to read files or make requests, cross-site scripting targets browsers rather than native stack memory, and insecure direct object references expose data through guessable identifiers.

Answer: A
The encoded ../ sequences attempt to walk upward out of the application's intended directory to reach sensitive system files, the definition of directory traversal, and canonicalizing then validating file paths is the fix. A padding oracle attacks cryptographic error behavior, LDAP injection manipulates directory query filters, and ARP spoofing is a local-network layer 2 attack, none of which appear in a file parameter's path sequences.

Answer: B
When a program validates a resource and then uses it as two separate steps, an attacker who changes the resource in between exploits a time-of-check to time-of-use race condition; the fix is making validation and use atomic or operating on file handles rather than paths. Integer overflows corrupt arithmetic rather than timing, request forgery abuses browser sessions, and downgrade attacks weaken protocol negotiation, none of which involve winning a timing gap.

Answer: C
Moving from an unprivileged account to SYSTEM on the same machine is privilege escalation, and unquoted service paths are a classic local vector because Windows may execute an attacker's planted binary from a directory earlier in the path. Lateral movement means reaching additional hosts, denial of service would degrade the machine rather than empower the tester, and nothing describes stealing the credential database.

Answer: D
Reusing a captured legitimate transmission without understanding it is a replay attack, and it fails when each exchange must include something fresh, such as a rolling code, nonce, or timestamp that the receiver will not accept twice. Brute force guesses secrets rather than reusing captures, downgrade attacks force weaker protocol versions during negotiation, and birthday attacks find hash collisions, so their respective defenses do not address retransmission.

Answer: A
Spoofing the victim's address in requests to third-party servers reflects the responses onto the victim, and choosing a protocol whose replies dwarf the requests amplifies the volume, producing a reflected amplification DDoS. A SYN flood exhausts connection state with handshake packets rather than large third-party responses, domain hijacking steals a domain registration, and on-path downgrade tampers with a session rather than saturating a link.

Answer: C
Forged responses that trick a resolver into caching a wrong record poison the cache and silently redirect every user of that resolver; DNSSEC lets the resolver verify signatures on responses so forgeries are rejected. An evil twin attacks the wireless layer rather than name resolution, session hijacking steals established web sessions, and typosquatting depends on users mistyping, which these users did not.

Answer: C
Answering ARP queries with false address mappings redirects neighbors' traffic through the attacker's machine, establishing an on-path position for interception or tampering; dynamic ARP inspection and encryption blunt it. A rogue DHCP server would hand out configuration at lease time rather than answering ARP, MAC flooding forces a switch to broadcast rather than redirecting a gateway mapping, and a smurf attack is an ICMP flood.

Answer: D
Broadcasting a copy of a legitimate SSID at higher power lures clients onto attacker infrastructure, and the fake portal converts the position into harvested credentials; this is the evil twin attack. Bluesnarfing steals data over Bluetooth pairing weaknesses, NFC relay extends a contactless transaction between two locations, and wardriving is reconnaissance mapping of networks rather than impersonating one.

Answer: A
Spoofed deauthentication frames exploit the historical lack of authentication on 802.11 management traffic, forcibly disconnecting clients at will; protected management frames cryptographically sign this traffic so forged disconnect orders are ignored. Simple interference would not produce spoofed frames in a capture, WPS cracking targets onboarding PINs rather than live sessions, and MAC filtering neither stops sniffing nor authenticates management frames.

Answer: A
Windows authentication schemes that accept the hash itself allow pass-the-hash, where the stolen digest is replayed without cracking; randomizing each machine's local administrator password ensures a hash from one host opens no others, which is why centralized local-password management matters. Kerberoasting cracks service tickets offline, credential stuffing replays breached plaintext passwords, and rainbow tables reverse hashes, which this attacker never needed to do.

Answer: C
Trying one likely password across many accounts, slowly, inverts the classic guessing pattern specifically to stay under per-account lockout thresholds; this is password spraying, countered by banning common passwords, MFA, and detection that looks across accounts rather than within one. A dictionary attack hammers one account with many guesses, pass-the-ticket abuses stolen Kerberos tickets, and offline cracking happens against captured hashes, not live logins.

Answer: D
No traveler covers that distance in forty minutes, so the two sessions cannot both be the legitimate user from those locations, making impossible travel a high-value indicator of credential compromise even when the activity within each session looks routine. VPN load does not relocate logins across continents, device enrollment does not explain a foreign source address, and clock drift would distort timestamps uniformly rather than produce two coherent remote sessions.

Answer: A
Fixed-interval, low-volume callbacks to a single external endpoint, independent of user presence, are the signature of an implant polling its command-and-control server for tasking; responders should investigate the process making the connections and contain the host. Time sync uses NTP rather than HTTPS POSTs, print spoolers talk to local print infrastructure, and license checks typically occur at application launch rather than around the clock on an idle machine.

Answer: B
When no patch exists, virtual patching, meaning an intrusion prevention or web application firewall rule that recognizes and blocks the exploit traffic, reduces exposure immediately without touching the vulnerable code. Backups aid recovery after compromise but prevent nothing, renaming an account does not address a code execution flaw, and waiting for a quarterly cycle ignores confirmed active exploitation of an internet-facing system.

Answer: C
A VM escape breaks the isolation that multitenant clouds depend on: code that reaches the hypervisor sits beneath every guest on the host and can read or manipulate all of them, turning one tenant's compromise into everyone's problem. Licensing status is irrelevant to the flaw, the attack executes from inside a guest rather than requiring physical presence, and rebooting a guest does nothing to a compromised hypervisor.

Answer: D
Publicly readable storage that should be private is a misconfiguration, the leading cause of cloud data exposure, and continuous automated checks of settings against secure baselines catch such drift before attackers do. No software flaw is involved, so zero-day intelligence does not apply; firmware and boot integrity concern device startup; and injection defenses address application queries rather than storage permissions.

Answer: C
Jailbreaking strips the operating system's sandboxing, signature enforcement, and store vetting, so applications from anywhere can run with deep system access, exactly the conditions mobile malware needs, which is why device compliance checks commonly block jailbroken hardware from corporate resources. Bandwidth consumption is unrelated, messaging continues to work, and cameras are not disabled; the danger is the collapse of the platform's security model.

Answer: C
An API gateway fronts the microservice estate, applying authentication, authorization, rate limiting, and request logging uniformly at one enforcement point, so individual services stop reimplementing security controls inconsistently. A syslog collector aggregates logs after the fact without enforcing anything, a time-series database stores metrics, and an orchestrator's scheduler places workloads on nodes rather than mediating API traffic.

Answer: B
Default credentials are published in manuals and scanned for constantly, so internet-reachable devices still using them are effectively open to anyone; setting unique credentials and pulling the devices behind the firewall or onto a segmented network closes the immediate hole. Resolution upgrades change image quality only, accounting schedules have no security effect, and retaining more footage does nothing to stop unauthorized control of the devices.

Answer: C
In infrastructure-as-a-service, the provider secures the facilities, hardware, and hypervisor, while the customer owns everything inside the virtual machine, including operating system patching, middleware, and applications. Owning the physical servers does not extend the provider's duty into guest software, hypervisor vendors patch the hypervisor rather than tenant VMs, and instances are only immutable if the customer deliberately architects them that way.

Answer: D
Serverless shifts servers, operating systems, and runtimes to the provider, but customers still own what they deploy: the code itself, vulnerable third-party libraries, how secrets are stored and referenced, and the permissions granted to each function, where overly broad roles are a common failure. Physical hosts, hypervisors, runtime patching, and OS images are exactly the layers the provider absorbs in this model.

Answer: A
A site-to-site IPsec VPN builds an authenticated, encrypted tunnel between the data center gateway and the cloud network, giving confidentiality and integrity across untrusted internet paths, which is the standard hybrid connectivity pattern short of a dedicated circuit. Bare GRE provides encapsulation with no encryption, port forwarding merely exposes services, and relaying data through public FTP would transmit it with no protection at all.

Answer: C
A passive intrusion detection sensor examines a copy of traffic from a TAP or SPAN port and can alert on signatures without ever touching the forwarding path, so a false positive costs an alert rather than a dropped clinical session. Inline prevention and blocking WAF modes actively interfere with traffic, which violates the stated constraint, and rate limiting indiscriminately throttles volume rather than detecting attacks.

Answer: D
Credentials embedded in code persist in version history and spread with every clone, so the fix is storing them in a secrets manager that templates reference at deploy time, then rotating everything already exposed. Narrowing repository access still leaves secrets in history and backups, Base64 is trivially reversible encoding rather than protection, and splitting a password across files only inconveniences whoever reads both.

Answer: C
Because the entire environment exists as executable definitions, rebuilding it produces a faithful copy quickly and without manual reconstruction errors, which is a major resilience and recovery advantage of infrastructure as code. Templates still require security review since they can encode flaws at scale, drift remains possible when changes bypass the pipeline, and no provider waives hosting costs because definitions are automated.