CompTIA SecurityX (CAS-005) Practice Questions with Explanations

Correct answer: C

Watermarking is the best choice for embedding a covert sign of ownership in a document without adding identifying attributes. Watermarks are imperceptible marks embedded within the document itself that prove ownership and are resistant to removal. Steganography hides data but doesn't specifically establish ownership; e-signatures add visible/identifying attributes; cryptography encrypts content but doesn't embed ownership markers.

Why the other options are wrong:

• A. Steganography hides information but is not specifically designed for ownership protection and doesn't inherently prove copyright.
• B. E-signatures add visible identifying attributes to documents, which contradicts the covert requirement.
• D. Cryptography protects content confidentiality but does not embed ownership signs within documents.

Correct answer: A

Federation is the ideal approach for unifying application access between merged companies without immediately merging authentication stores. Federation allows each company to maintain its own authentication system while establishing trust relationships that enable cross-company access. RADIUS and TACACS+ are authentication protocols that don't address federation needs; MFA adds another authentication factor but doesn't solve the unified access problem; ABAC is an authorization model that requires a unified identity source.

Why the other options are wrong:

• B. RADIUS is an authentication protocol for network access, not designed for federating authentication between separate organizations.
• C. TACACS+ is primarily for centralized device access control and does not address cross-company application access federation.
• D. MFA adds authentication factors but does not solve the fundamental issue of enabling access without merging authentication stores.
• E. ABAC is an authorization approach requiring knowledge of user attributes, but presupposes identity resolution which federation solves.

Correct answer: C

Separation of duties is a fundamental access control principle that prevents any single individual from having complete control over a critical transaction or process. By implementing policies and systems with separation of duties, the organization ensures that developers cannot unilaterally deploy artifacts to production-this requires approval and execution by different roles. This directly addresses the stated objective of preventing direct production deployments by developers.

Why the other options are wrong:

• A. Least privilege access is important but doesn't specifically prevent developers from deploying to production if they have any production access.
• B. Security awareness training improves security culture but doesn't enforce technical controls preventing direct deployments.
• D. Job rotation reduces insider threat risk over time but doesn't prevent current deployment capabilities.
• E. Mandatory vacations may help detect fraudulent activities but don't prevent unauthorized deployments.
• F. Quarterly access reviews are detective controls that occur too infrequently to prevent unauthorized deployments.

Correct answer: B

Supply chain visibility is the primary reason boards request third-party management programs. Organizations depend on external vendors and suppliers, creating supply chain risks from security breaches, compromised dependencies, and vendor failures. A comprehensive third-party management program provides visibility into these risks. Risk transference involves insurance or contracts but doesn't explain the need for a management program; support availability is operational rather than strategic; vulnerability management is internal security, not third-party focused.

Why the other options are wrong:

• A. Risk transference through insurance is an outcome, not the primary driver for establishing a third-party management program.
• C. Support availability concerns vendor responsiveness but is not the strategic board- level driver for third-party management.
• D. Vulnerability management is an internal security practice, not the primary reason for third-party program establishment.

Correct answer: A

A machine-learning-based data security service is specifically designed to discover sensitive data across cloud storage, monitor changes in real-time, and identify suspicious activity patterns through behavioral analysis. It provides comprehensive protection for thousands of independent resources by automatically learning what constitutes normal versus anomalous behavior in a large-scale cloud environment.

Why the other options are wrong:

• B. File integrity monitoring focuses on detecting unauthorized changes to known files but lacks data discovery and suspicious activity identification capabilities needed for thousands of independent resources.
• C. Cloud configuration assessment addresses compliance and configuration issues but does not specialize in discovering sensitive data or identifying suspicious activity patterns.
• D. Automated data classification organizes data but does not provide monitoring of changes or detection of suspicious activity.

Correct answer: D

A local historian is purpose-built software that collects, stores, and manages time-series data from industrial devices like PLCs. Historians are designed specifically for aggregating sensor and equipment data for analysis, trending, visualization, and predictive maintenance in industrial environments. This is the standard approach in OT/ICS systems.

Why the other options are wrong:

• A. External drives are portable storage media, not systems designed for continuous data aggregation and analysis.
• B. Cloud storage could eventually receive aggregated data but is not the immediate destination from PLCs; data is typically aggregated locally first.
• C. A system aggregator is not a standard industrial component; the historian fulfills this role in OT environments.

Correct answer: D

Configuring IPS and WAF with signatures best mitigates the risk of the vulnerable deprecated runtime while maintaining service availability during the one-month transition. These defensive tools can detect and block exploit attempts targeting known vulnerabilities in the runtime engine without requiring the application to go offline or the runtime to be uninstalled.

Why the other options are wrong:

• A. Shutting down a public-facing banking application is not acceptable and defeats the purpose of finding a compensating control.
• B. Uninstalling the runtime engine would break the application, interrupting critical banking services.
• C. Blocking traffic on the affected port would disable the application entirely, causing service interruption.

Correct answer: A

Hardening the camera configuration is the primary security recommendation. This involves changing default usernames and passwords, closing unnecessary ports, disabling insecure protocols, and applying security best practices specific to the camera device. While the camera is already on the IoT subnet, hardening addresses the root causes of the vulnerabilities discovered in the scan and is essential for secure operation.

Why the other options are wrong:

• B. Sending logs to SIEM is monitoring, not remediation, and does not fix the underlying security issues.
• C. Encrypting the video stream is good practice but doesn't address the open ports and default credentials discovered.
• D. Isolation alone doesn't remedy the vulnerabilities; the device must still be hardened to operate securely within the segment.

Correct answer: B

Testing exercises are a critical component of disaster recovery plans because they validate that the plan actually works in practice, identify gaps, and ensure personnel understand their roles during a recovery event. While redundancy is important for system design and autoscaling for operations, testing exercises are the specific element that belongs in the disaster recovery plan documentation and validation process.

Why the other options are wrong:

• A. Redundancy is a system design principle, not a component of the disaster recovery plan itself.
• C. Autoscaling is an operational control for handling load, not a disaster recovery planning element.
• D. Using competitor locations for recovery is neither practical nor appropriate; recovery sites should be the organization's own facilities or contracted services.

Correct answer: B

A response playbook provides documented, step-by-step procedures for handling specific security incidents, including consistent messaging templates for communication with clients. It ensures all stakeholders deliver aligned, accurate information during an active incident response.

Why the other options are wrong:

• A. A communication plan is broader and typically covers overall communication strategy rather than providing specific, consistent messages for active incident response.
• C. A disaster recovery procedure focuses on systems restoration and business continuity, not on client communication during security incidents.
• D. An automated runbook addresses technical remediation steps but does not provide consistent client communication messaging.

Correct answer: C

User and Entity Behavior Analytics (UEBA) detects anomalous behavior patterns that signature-based detection would miss, including zero-day attacks and novel attack techniques. When signature-based detection fails to catch Indicators of Compromise, UEBA's behavioral approach can identify suspicious activities by detecting deviations from normal patterns, making it the most appropriate solution to address missed IoCs.

Why the other options are wrong:

• A. FIM (File Integrity Monitoring) tracks file changes but doesn't detect behavioral anomalies or novel attack patterns that signatures miss.
• B. SASE (Secure Access Service Edge) is a network architecture framework, not a detection mechanism for missed indicators of compromise.
• D. CSPM (Cloud Security Posture Management) focuses on cloud infrastructure configuration compliance, not behavior-based detection of attacks.
• E. EAP (Extensible Authentication Protocol) is an authentication framework, unrelated to detecting missed indicators of compromise.

Correct answer: A

DoH (DNS over HTTPS) encrypts DNS queries end-to-end, preventing monitoring of which websites an executive visits. This protects browsing history from ISPs, network administrators, and surveillance in countries with internet monitoring. Unlike private browsing mode which only clears local history, DoH actively prevents the DNS queries themselves from being observed during transmission.

Why the other options are wrong:

• B. EAP-TLS is an authentication protocol for network access, not for protecting browsing history or DNS queries.
• C. Geofencing is a location-based technology used for restricting access based on geographic boundaries, not for protecting browsing privacy.
• D. Private browsing mode only clears local history on the device but does not prevent DNS queries and network traffic from being monitored by network administrators.

Correct answer: A

Static application security testing (SAST) analyzes source code before compilation to identify vulnerabilities early in the development lifecycle, preventing vulnerable code from being built and deployed to production. SAST directly addresses the gap of missing security controls throughout the SDLC and reduces the risk of vulnerable releases at the earliest possible stage.

Why the other options are wrong:

• B. Regression testing validates that existing functionality still works after changes but does not specifically identify or prevent security vulnerabilities.
• C. Code signing verifies code authenticity and integrity after deployment but does not prevent vulnerable code from being deployed in the first place.
• D. Sandboxing is a runtime containment mechanism that reduces impact but does not prevent vulnerable code from being released to production.

Correct answer: A

Attribute-based access control (ABAC) with data classification tagging is the most flexible and scalable approach. It allows mapping users (via SSO federation) to groups whose data classification attributes determine system access. This provides granular, dynamic access control based on data sensitivity with minimal system impact, as policies are enforced centrally rather than on each system individually.

Why the other options are wrong:

• B. RBAC based on HR system roles is inflexible for data classification requirements and requires manual role maintenance as data classification policies evolve.
• C. Network microsegmentation based on data types requires significant network infrastructure changes and does not scale well with SSO federation requirements.
• D. Per-system rule-based enforcement managed in LDAP creates significant administrative overhead and lacks centralized policy management across the organization.

Correct answer: B

The modified firmware on the controllers represents a persistence technique in the MITRE ATT&CK framework for ICS. The attacker has modified the firmware to maintain a presence on the systems that survives reboots and normal operations. The firmware mismatch detected during the secure boot process indicates the firmware has been altered from the official vendor version, which is a classic persistence mechanism in ICS environments where firmware modification provides long-term unauthorized access.

Why the other options are wrong:

• A. Evasion techniques are used to avoid detection, not to maintain persistent access.
• C. Collection techniques involve gathering data, not modifying system firmware for persistence.
• D. Lateral movement refers to moving between systems, not maintaining presence on a single controller through firmware modification.

Correct answer: C

The NX bit (No-Execute bit) is essential for mprotect() to function effectively against exploitation attacks. The mprotect() system call marks memory pages as non-executable or executable, but this protection requires NX bit hardware support to actually prevent code execution in non-executable regions. This defends against buffer overflow and code injection attacks. TPM is a security module unrelated to memory protection; secure boot validates firmware but not application memory; HSM manages cryptographic keys, not application memory execution.

Why the other options are wrong:

• A. TPM (Trusted Platform Module) manages cryptographic keys and attestation, not application memory protection.
• B. Secure boot validates firmware integrity during startup but does not enable runtime memory execution controls.
• D. HSM (Hardware Security Module) protects cryptographic keys but is unrelated to memory execution protection.

Correct answer: A

Embedded facility automation systems are constrained by available compute resources- they typically have limited CPU, memory, and storage to run security software, apply patches, or implement modern cryptographic controls. This hardware limitation is the fundamental reason preventing security upgrades, regardless of processor architecture or device capabilities.

Why the other options are wrong:

• B. Modern embedded systems may not use x86-64 processors, but they often have alternative architectures (ARM, etc.) that can support security upgrades; the issue is compute capacity, not processor type.
• C. EEPROM availability is not the limiting factor; most embedded devices have some form of persistent storage.
• D. Facility automation systems are definitely logic-bearing devices that execute code; this statement is factually incorrect.

Correct answer: C

NetFlow logs provide network-level visibility into traffic patterns and volume. Reviewing them for unexpected increases in egress traffic is the most direct network-level analysis method to identify infected machines communicating with external command-and-control servers or exfiltrating data, which are hallmarks of ransomware behavior.

Why the other options are wrong:

• A. Monitoring for IoCs (Indicators of Compromise) associated with C&C communications is appropriate but less specific to network-level analysis and may require endpoint data.
• B. Tuning alerts for changes to administrative groups addresses privilege escalation concerns but does not directly identify ransomware outbound traffic.
• D. Binary hash comparisons are endpoint-level analysis, not network-level analysis, and are better suited for identifying malware files rather than network communications.

Correct answer: B

The data owner is the role best qualified to classify systems and data. Data owners have the authority and responsibility for determining the sensitivity and classification of data assets in accordance with organizational policies and external requirements. They understand the business value and regulatory context of the data.

Why the other options are wrong:

• A. Systems administrators manage infrastructure but lack the authority to determine data classification.
• C. Data processors handle data on behalf of others but do not have classification authority.
• D. Data custodians maintain and protect data according to established classifications but don't create the classifications.
• E. Data stewards oversee data governance but the data owner holds the primary classification responsibility.

Correct answer: A

When an organization has a critical vendor providing multiple products, risk assessment should be performed at the individual product level. Each product may have different vulnerabilities, configurations, update cycles, and security postures. Assessing at the product level ensures comprehensive identification of risks rather than treating the vendor relationship as a monolithic entity. This granular approach enables targeted remediation strategies for each product.

Why the other options are wrong:

• B. Random product selection is not a systematic or defensible approach to risk assessment.
• C. While third-party audit reports may inform assessment, they do not describe the methodology of how assessment is performed.
• D. Choosing a major product ignores the security risks of other products and is not a comprehensive assessment approach.

Correct answer: A

Tokenization through an HSM (Hardware Security Module) is the most appropriate solution for handling recurring payment transactions. Tokenization replaces sensitive payment card data with non-sensitive tokens, ensuring that actual payment information is never stored in the application. The HSM provides secure generation and management of these tokens, meeting both security best practices and regulatory requirements for e- commerce payment processing.

Why the other options are wrong:

• B. Self-encrypting disks with field-level encryption stores actual payment data in encrypted form, which is not ideal compared to tokenization.
• C. NX/XN implementation relates to memory protection and does not address payment card data security.
• D. Token-based access controls user authentication but does not protect payment method data.
• E. Address space layout randomization is a memory protection technique unrelated to payment data security.

Correct answer: D

An advanced persistent threat financed by a nation- state The indicators point to a nation-state APT: coordinated activity across multiple companies, regular intervals suggesting long-term operations, and correlation with escalating hardware outages indicating sophisticated infrastructure targeting. Nation-states have the resources, coordination, and persistence to conduct multi-target campaigns with infrastructure attack capabilities.

Why the other options are wrong:

• A. Organized crime typically targets specific high-value victims for ransomware rather than coordinating across multiple companies at regular intervals.
• B. Politically motivated hacktivists lack the coordination and sophistication for infrastructure-level attacks on multiple entities.
• C. Disgruntled employees lack the ability to coordinate across multiple companies and access to external infrastructure for synchronized attacks.

Correct answer: B

Deploying an agent on multihomed Linux systems allows the vulnerability scanner to identify the actual host by its unique identifier rather than treating each NIC as a separate entity. Agents run on the host itself and can deduplicate vulnerabilities across multiple network interfaces, associating all findings with the single underlying host. This eliminates the false multiplication of vulnerability counts caused by scanning each NIC independently.

Why the other options are wrong:

• A. A SCAP scanner alone would not address the multihoming deduplication issue without additional host identification.
• C. A discovery scan identifies devices but does not deduplicate vulnerabilities found across multiple NICs.
• D. Nmap is a network discovery tool that would not resolve the deduplication problem of multihomed systems.

Correct answer: B

Bit-level disk duplication creates a forensic image of the entire disk at the binary level, preserving all data including deleted files, system artifacts, and baseline information. This comprehensive image allows the analyst to compare the current system state against known-good baselines and reconstruct what was modified to achieve persistence. It captures the exact state of the system for detailed forensic examination.

Why the other options are wrong:

• A. Side-channel analysis examines indirect information leaks (timing, power consumption) and is not applicable to detecting baseline modifications.
• C. Software composition analysis examines software components and dependencies, not whether system baselines have been modified.
• D. A SCAP scanner identifies compliance and vulnerability issues but does not provide the bit-level forensic data needed to determine if baselines were modified.

Correct answer: D

Using risk scenarios during risk analysis is most likely done to provide context to the relevancy of risk. Scenarios help stakeholders understand how risks could actually manifest in business situations, making the risks more tangible and relevant. This contextual understanding helps communicate why certain risks matter to the organization and their business objectives, rather than presenting abstract risk metrics.

Why the other options are wrong:

• A. While scenarios can relate to business objectives, the primary value of risk scenarios is establishing relevancy and context.
• B. Consistency is achieved through frameworks and methodologies, not specifically through scenarios.
• C. A comprehensive view comes from multiple analysis methods, not specifically from scenario-based approaches alone.

Correct answer: A

Non-repudiation is a core capability of PKI that prevents a sender from denying they created or sent a message. Digital signatures provide this by cryptographically binding the sender's identity to the message. In change management, non-repudiation ensures accountability when approvals and authorizations are digitally signed. While PKI can support confidentiality through encryption and certificates, the question asks what PKI provides specifically for messages in the change management context, making non- repudiation the most direct answer.

Why the other options are wrong:

• B. Confidentiality requires symmetric encryption, which is separate from PKI's core function of authentication and non-repudiation.
• C. Delivery receipts are a messaging feature unrelated to PKI capabilities.
• D. Attestation is not a standard PKI security service; PKI provides authentication, confidentiality, and non-repudiation.

Correct answer: B

Assigning labels to files and requiring formal access authorization by the data owner implements a mandatory access control (MAC) model that enforces classification levels matching security clearances. This approach ensures data protection at the appropriate level and maintains the principle that data owners must formally verify need-to-know before granting access, satisfying all stated requirements.

Why the other options are wrong:

• A. IP-based restrictions do not address clearance levels, data classification, or need-to- know verification.
• C. Attribute-based access allows authorized users to share files, which violates the requirement that data owners must verify need-to-know before access is granted.
• D. Role-based access does not directly enforce data classification levels or ensure that need-to-know is verified by the data owner on a per-access basis.

Correct answer: A

The Registration Authority (RA) is responsible for identity and subject validation before certificate requests are submitted to the Certificate Authority. The RA performs initial verification of the requestor's identity and eligibility, so if identity validation fails, the denial occurs at the RA step before the request ever reaches the CA for issuance.

Why the other options are wrong:

• B. OCSP is a protocol for checking revocation status after certificate issuance, not part of the initial enrollment validation process.
• C. While the CA issues certificates, the identity validation denial would have already occurred at the RA stage before reaching the CA.
• D. IdP (Identity Provider) is relevant to federated authentication scenarios, not the formal PKI enrollment and validation process described.

Correct answer: B

ExifTool is specifically designed to read, write, and manipulate metadata embedded in images and documents. It excels at extracting EXIF data, IPTC information, XMP metadata, and other file metadata across multiple formats. OllyDbg is a debugger for reverse engineering; Volatility analyzes memory dumps; Ghidra is a disassembler for binary analysis-none of these are appropriate for metadata evaluation.

Why the other options are wrong:

• A. OllyDbg is a debugger used for dynamic analysis and reverse engineering of binaries, not metadata extraction.
• C. Volatility is a memory forensics framework for analyzing RAM dumps, not file metadata.
• D. Ghidra is a static binary analysis and disassembly tool, not designed for extracting file metadata.

Correct answer: D

When encrypting emails, the system uses the recipient's public key certificate to encrypt the message. If the email address in the certificate does not match the recipient's actual email address, the encryption process will fail because the system cannot find or match the correct key. The external recipient can send encrypted emails because their own certificate correctly matches their address, but the internal user's system cannot find the correct certificate for the external recipient due to the address mismatch.

Why the other options are wrong:

• A. SSH keys and private key validity dates are not relevant to email encryption issues; email encryption uses X.509 certificates.
• B. An expired key pair would typically trigger a revocation or expiration error, not a generic encryption error; the issue would also affect the external recipient's outbound emails.
• C. OCSP and CRL implementation issues would affect certificate validation globally for both users, not just one direction of communication.

Correct answer: C

Shredding is the most effective method for protecting against data leakage from decommissioned hard drives. It physically destroys the storage media, making data recovery impossible. While purging, clearing, and degaussing are data sanitization techniques, shredding provides the highest assurance that sensitive data cannot be recovered, especially given the company's concern about data on old drives being leaked.

Why the other options are wrong:

• A. Purging removes data but doesn't physically destroy the media, leaving it vulnerable to forensic recovery.
• B. Clearing overwrites data but may not be thorough enough for highly sensitive information and leaves the drive intact.
• D. Degaussing uses magnetic fields to erase data but may not work on all drive types and is less reliable than physical destruction.

Correct answer: B

Automation of resource provisioning is the key benefit that directly addresses the engineer's scaling issues. Serverless architecture automatically scales resources up or down based on demand without manual intervention, eliminating the scaling problems experienced on premises. This automation is the fundamental advantage that makes serverless suitable for applications with variable workloads.

Why the other options are wrong:

• A. While cost savings may result from serverless, they are not the primary benefit for addressing scaling issues.
• C. Geo-redundant hosting is a separate concern not directly related to solving scaling problems.
• D. Eliminating patching needs is a secondary benefit of serverless and doesn't address the scaling challenge.

Correct answer: A

Email signatures provide non-repudiation, which is the assurance that the sender cannot deny having sent the message. A digital signature, created with the sender's private key and verifiable with their public key, cryptographically proves that a specific individual sent the message and that it hasn't been altered. This prevents the signer from later repudiating (denying) having sent the email.

Why the other options are wrong:

• B. Email signatures do not encrypt message body content; that requires separate encryption mechanisms.
• C. Code signing is a different application of digital signatures used for software authenticity, not email signatures.
• D. While sender authentication may be a benefit, non-repudiation is the primary security property provided.
• E. Chain of custody refers to evidence handling procedures unrelated to email signatures.

Correct answer: C

Before pinning an X.509 certificate to a device, the certificate must first be obtained through an out-of-band method to ensure its authenticity and prevent man-in-the-middle attacks during the pinning process itself. An out-of-band channel (separate from normal network communication) is essential to securely bootstrap trust in the certificate being pinned.

Why the other options are wrong:

• A. Using DER encoding is a technical detail of certificate format but is not a prerequisite that must happen first.
• B. Private keys should never be extracted from certificates or embedded in devices; certificate pinning uses the public certificate only.
• D. Comparing retrieved and embedded certificates is part of the pinning validation process that happens after the certificate is already pinned.

Correct answer: A

In a PaaS cloud model, the CRM company (the customer) retains responsibility for application-level security controls and compliance requirements. While the CSP provides infrastructure, the CRM company must ensure that its deployment meets regulatory requirements including configuration management, patch management, and lifecycle management of the application and its data. The customer cannot delegate compliance responsibility to the cloud provider.

Why the other options are wrong:

• B. The customer's customer does not have direct responsibility for the infrastructure requirements.
• C. The CSP provides infrastructure but the responsibility for meeting regulatory requirements specific to the customer's business rests with the CRM company.
• D. The regulatory body sets requirements but doesn't implement the controls needed to meet them.

Correct answer: B

The code shown is vulnerable to SQL injection because user input from Request('ItemID') is directly concatenated into the SQL query string without sanitization. Query parameterization (also called prepared statements) separates SQL code from data, preventing attackers from injecting malicious SQL commands. This is the industry- standard defense against SQL injection attacks.

Why the other options are wrong:

• A. Client-side processing cannot prevent SQL injection, which occurs at the database level.
• C. Data normalization organizes data structure but doesn't prevent SQL injection attacks.
• D. Escape character blocking is an outdated approach less effective than parameterization and can be bypassed.
• E. URL encoding protects data in transit but doesn't prevent SQL injection at the database layer.

Correct answer: B

Fuzz testing is the best approach to proactively uncover additional vulnerable code paths in a custom application. It involves sending random, malformed, or unexpected inputs to the component to trigger unexpected behavior and crashes, revealing vulnerabilities similar to the remote code execution already discovered. Fuzz testing is designed to find input-handling flaws and edge cases that could lead to exploitable conditions.

Why the other options are wrong:

• A. Exploitation frameworks are used to verify known vulnerabilities, not to discover new vulnerable paths in code.
• C. Software composition analysis finds known vulnerabilities in third-party dependencies, not in custom application code logic.
• D. Reverse engineering is time-intensive and less systematic than fuzz testing for discovering multiple vulnerability paths.
• E. HTTP intercepting proxies are useful for dynamic web application testing but are less effective at discovering code path vulnerabilities than fuzz testing.

Correct answer: A

Code signing allows users to verify that software is legitimate and hasn't been tampered with. The software developer signs the code with their private key, and users can verify the signature using the developer's public key. This ensures the software comes from the claimed source and provides proof of authenticity at installation time, directly meeting the stated objective.

Why the other options are wrong:

• B. Non-repudiation prevents the developer from denying they signed code but doesn't help users verify legitimacy.
• C. Key escrow involves storing cryptographic keys with a third party; it doesn't verify software authenticity.
• D. Private keys are used to create signatures but exposing private keys would compromise security; users need public keys.

Correct answer: E

Caching is the most appropriate solution because the entry pages contain static sponsor content pulled from a database. Caching this relatively unchanging content in memory or a content delivery network will dramatically reduce database queries and response times during peak load. Horizontal and vertical scalability would add resources but are expensive and unnecessary when the bottleneck is database access for static content; containerization aids deployment but doesn't improve response time; static code analysis finds vulnerabilities rather than addressing performance.

Why the other options are wrong:

• A. Horizontal scalability adds more servers but does not address the root cause of poor response time from database queries for static content.
• B. Vertical scalability adds resources to existing servers but is less cost-effective than caching static content.
• C. Containerization improves deployment and consistency but does not directly resolve database query performance issues.
• D. Static code analysis identifies code vulnerabilities, not performance bottlenecks or caching opportunities.

Correct answer: C

Require the developers to include exception handlers to accommodate out-of-bounds results. The log shows Transaction 5 resulted in a below-zero balance of -10, yet the technician discovered the inventory was never actually less than zero and the final inventory was 100 instead of 60. This indicates the system lacks proper exception handling for out-of-bounds results. When Transaction 5 attempted to subtract 40 from 50, it should have triggered an exception rather than allowing a negative inventory state. Without exception handlers to catch and prevent invalid operations (like inventory going negative), subsequent transactions may execute incorrectly or be rolled back, explaining why the final total (100) differs from the logged total (60). Implementing exception handlers would prevent invalid transactions from corrupting the inventory state.

Why the other options are wrong:

• A. Integer overflow would cause values to wrap around or behave unexpectedly in calculations, but the issue here is specifically that negative inventory was allowed when it shouldn't be, which is a validation and exception handling problem, not a memory safety problem.
• B. Race conditions involve multiple threads accessing shared data simultaneously causing inconsistent results, but this is described as a batch job (sequential processing) and the problem is that invalid states (negative inventory) are being accepted rather than concurrent access issues.
• D. Moving batch processing from client to server side does not address the root cause of allowing invalid inventory states (negative values) to occur; the core issue is lack of validation and exception handling in the business logic itself.

Correct answer: D

Biometric impersonation describes the risk of someone spoofing or mimicking biometric characteristics (such as facial features) to authenticate as another user. In facial recognition authentication, attackers could use deepfakes, masks, photos, or other techniques to impersonate legitimate users. This is the direct authentication security risk specific to facial recognition systems on mobile devices.

Why the other options are wrong:

• A. Data remanence refers to residual data remaining after deletion and is unrelated to facial recognition authentication risks.
• B. While deepfakes could be a technique used in biometric impersonation attacks, the broader term biometric impersonation better describes the risk category.
• C. Metadata scraping involves extracting metadata from files or systems and is not related to facial recognition authentication bypass.

Correct answer: C

Regular expressions are the correct configuration for a DLP system to identify and label documents containing specific data patterns like cardholder information (credit card numbers follow predictable formats). Regular expressions allow DLP systems to scan document content and match patterns such as 16-digit sequences typical of payment cards. This enables automatic labeling of previously unlabeled documents in the cloud repository.

Why the other options are wrong:

• A. Digital rights management controls access and usage permissions but does not identify or label data patterns.
• B. Network traffic decryption relates to monitoring communications, not identifying and labeling documents in a repository.
• D. Watermarking adds visible or invisible marks to documents but does not identify or automatically label sensitive content patterns.

Correct answer: A

Network segmentation is the best compensating control because it limits the attacker's ability to reach the vulnerable server and restricts lateral movement if exploitation occurs. By isolating the legacy server on a separate network segment with restricted access, the organization reduces the attack surface and containment blast radius while the underlying vulnerability remains unpatched during the application code modification period.

Why the other options are wrong:

• B. CASB (Cloud Access Security Broker) is designed for cloud application monitoring and is not relevant to a legacy on-premises web server.
• C. HIPS (Host-based Intrusion Prevention System) may detect some exploit attempts but cannot prevent a determined attacker with knowledge of the RCE vulnerability.
• D. UEBA (User and Entity Behavior Analytics) detects anomalous behavior after-the-fact but does not prevent exploitation of the RCE vulnerability.

Correct answer: B

File hashes are obtained from confiscated devices primarily to validate the integrity of files during forensic analysis. By comparing hashes at different points in time, forensic examiners can confirm that files have not been modified, corrupted, or tampered with during the investigation process. This is a critical component of maintaining the reliability of digital evidence.

Why the other options are wrong:

• A. Metadata tampering prevention is not the primary function of file hashes; hashes validate file content integrity, not metadata.
• C. While hashes are unique identifiers, this is incidental to their forensic purpose of integrity validation.
• D. Chain of custody is maintained through documentation and procedures, not by obtaining hashes.

Correct answer: B

A false negative occurs when a detection system fails to alert on a malicious event that actually occurred. In this case, an actual incident (unauthorized USB used to exfiltrate data from a shared account) happened but the system did not create an alert. This is a failure of detection controls-the incident was real but undetected by monitoring systems, making it a false negative.

Why the other options are wrong:

• A. False positive means alerting on benign activity; this was a confirmed malicious event.
• C. True positive means correctly detecting actual malicious activity with an alert; no alert was generated.
• D. True negative means correctly not alerting on benign activity; this event was confirmed malicious.

Correct answer: C

Subject Alternative Name (SAN) certificates allow a single certificate to secure multiple domain names, making it the most cost-effective solution for administrators managing certificates across many customer sites. A SAN certificate can cover primary domains and subdomains without requiring separate certificates for each, directly addressing the need to support multiple domains while minimizing certificate count.

Why the other options are wrong:

• A. OCSP is a protocol for checking certificate revocation status, not for managing multiple domain names in a single certificate.
• B. CRL (Certificate Revocation List) is a method for distributing revocation information, not for supporting multiple domains on one certificate.
• D. CA (Certificate Authority) is the issuing entity itself, not a certificate type or feature that supports multiple domains.

Correct answer: B

Restricting uploading activity to only authorized sites directly addresses the threat observed: unauthorized data transfer attempts to an unknown site. This control prevents the specific attack vector identified while allowing legitimate business operations to continue and is more effective than the other options for mitigating the targeted data exfiltration threat.

Why the other options are wrong:

• A. Preventing those users from accessing sensitive data would overreact and likely disrupt their legitimate work; it does not address the root control issue.
• C. Enabling packet captures is a detection and investigation mechanism but does not actively prevent the ongoing exfiltration attempts.
• D. Disabling logins after business hours may be overly restrictive and does not address the legitimate business need; it also does not prevent exfiltration if attacks occur during business hours.

Correct answer: B

When faced with an active crisis (fire at data center), the CIO should immediately engage both incident response and disaster recovery procedures. The correct approach is to review available incident response plans and activate the disaster recovery plan while leveraging existing IT leadership expertise from both companies. This balances the need for immediate action with practical reliance on personnel who understand both organizations' systems.

Why the other options are wrong:

• A. Determining whether plans have been tested is not the first priority during an active incident; immediate response is critical.
• C. Verifying availability of recovery sites and briefing leadership, while important, delays actual response actions during an emergency.
• D. Performing a BIA (Business Impact Analysis) is post-incident recovery work, not a first action during active crisis response.

Correct answer: A

SDN (Software-Defined Networking) uses centralized policies to route packets based on application type and usage patterns, allowing fine-grained control over traffic forwarding. This capability defines SDN's core function: using software policies to intelligently direct specific traffic types to appropriate destinations. Pcap captures packets; vmstat monitors system resources; DNSSEC secures DNS; VPC isolates network resources but doesn't provide application-aware routing policies.

Why the other options are wrong:

• B. Pcap is a packet capture tool for analyzing network traffic, not for routing or policy enforcement.
• C. Vmstat monitors system statistics and performance but has no role in packet routing or application-based policies.
• D. DNSSEC secures DNS queries and responses but does not route packets based on application usage.
• E. VPC provides network isolation but lacks the application-aware policy routing capability described.

Correct answer: A

A Phase 1 handshake failure in IPSec VPN indicates a mismatch in IKE (Internet Key Exchange) negotiation parameters. The most likely cause is that the IKE hashing algorithm uses different key lengths on each VPN device, preventing the two sides from establishing a common security association. Phase 1 is where IKE parameters must match exactly between peers.

Why the other options are wrong:

• B. Multiple cipher suites being allowed is typical and does not cause Phase 1 failures; negotiation selects one mutually supported suite.
• C. A matching Diffie-Hellman group, even if legacy, would not cause a handshake failure since both sides agree.
• D. IPSec Phase 1 handshake uses IKE protocol, not SSL/TLS, making this an incorrect parameter to check.