100 Free SecurityX CAS-005 Practice Questions and Answers
100 questions for the SecurityX CAS-005 exam, each answer explained. Watch it here, try the questions yourself, or read the transcript.
Questions in this video
Tap an answer to see why it is right or wrong. Tap it again to reset.
Question 1 Play from 00:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Fuzzing feeds malformed input to expose software bugs and says little about unseen leakage across a boundary.
Right, B is the answer.
Why B is right
The team is hunting for hidden or indirect paths that move data past the separation controls unseen. Covert channel analysis exists to uncover exactly those unintended pathways, which makes it the right fit for judging a segmentation tool.
Not this one. Try another answer.
Why C is wrong
Studying protocol structure explains how traffic is formatted but does not search for concealed ways around the controls.
Not this one. Try another answer.
Why D is wrong
Statistical models flag unusual behavior in observed traffic, which differs from discovering hidden bypass routes in a design.
Question 2 Play from 01:43
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Collector placement decides what gets captured, not how each record is marked with its origin.
Not this one. Try another answer.
Why B is wrong
Constant monitoring keeps data flowing but gives no way to separate it by branch.
Not this one. Try another answer.
Why C is wrong
Pooling logs in one place still needs tags before records can be split by office.
Right, D is the answer.
Why D is right
The records must carry information about where they originated so that analysts can sort and filter by branch. Attaching that metadata to each record is what data labeling means, and it works even while all the telemetry is stored together.
Question 3 Play from 03:16
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Skipping ahead leaves the current risk without any check on whether the controls worked.
Not this one. Try another answer.
Why B is wrong
A threat model update can come later, but measuring leftover exposure comes first.
Right, C is the answer.
Why C is right
After controls go in, some exposure always remains. The team has to measure what is left, the residual risk, to judge whether it falls within what the organization will accept or whether more action is needed.
Not this one. Try another answer.
Why D is wrong
Mitigation here lowered likelihood, so the size of the impact is not what gets recalculated next.
Question 4 Play from 04:53
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Compliance may benefit from training, but it does not explain a sudden focus on newer attack styles.
Not this one. Try another answer.
Why B is wrong
Reliance on support bots is not what makes phishing messages more convincing.
Not this one. Try another answer.
Why C is wrong
Comparing model outputs is unrelated to the growth of deceptive messages.
Right, D is the answer.
Why D is right
Tools that generate text and media automatically make it far easier for attackers to craft believable, personalized lures at scale. That rising quality of attacks is the reason organizations step up awareness training.
Question 5 Play from 06:32
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A threat intelligence platform supplies information about outside adversaries and does not guard data leaving the company.
Right, B is the answer.
Why B is right
Access controls decide who may open the data, but they do not stop a permitted user from sending it somewhere it should not go. A data loss prevention system inspects and blocks sensitive content as it leaves, which covers that gap.
Not this one. Try another answer.
Why C is wrong
A scanner finds weaknesses in systems but does nothing to halt data movement.
Not this one. Try another answer.
Why D is wrong
A SIEM collects and correlates events for analysts and does not itself block sensitive content from leaving.
Question 6 Play from 08:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Cloud storage might receive data later, but controller values are normally gathered on site first.
Not this one. Try another answer.
Why B is wrong
A portable disk is not built for continuous collection and analysis of live process data.
Not this one. Try another answer.
Why C is wrong
That is not a standard component in industrial settings, where the historian does this work.
Right, D is the answer.
Why D is right
In industrial networks, a historian is the standard system that collects and stores time-series values from controllers on site. It feeds trending, dashboards and predictive maintenance, so the readings normally go there first.
Question 7 Play from 09:36
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A random pick is not a defensible method and ignores most of what the supplier sells.
Right, B is the answer.
Why B is right
Each product can have its own weaknesses, settings and update habits. Assessing every product separately avoids lumping everything into one vendor-wide score and uncovers risks a single review would miss.
Not this one. Try another answer.
Why C is wrong
An audit report can inform the work but it does not define how the assessment itself is structured.
Not this one. Try another answer.
Why D is wrong
Looking at the largest product alone leaves the others unexamined.
Question 8 Play from 11:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Central storage gathers records but does not set out what responders should do.
Not this one. Try another answer.
Why B is wrong
Endpoint detection finds threats but does not shape the response workflow.
Right, C is the answer.
Why C is right
Playbooks are written, step-by-step procedures for each kind of incident. They bring repeatable, consistent handling across different platforms without buying anything new, so they raise the effectiveness of the process itself.
Not this one. Try another answer.
Why D is wrong
Collectors pull in data and do not improve how the response is carried out.
Question 9 Play from 12:33
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Recovery happens last, after the threat has been contained and removed.
Not this one. Try another answer.
Why B is wrong
This term is too broad to name a specific phase, and the plan calls for containment at this point.
Not this one. Try another answer.
Why C is wrong
Removing the threat comes after it has been stopped from spreading.
Right, D is the answer.
Why D is right
Once the threat has been identified, the priority is to stop it from spreading by isolating affected systems. Containment therefore follows identification, and cleanup and restoration come only afterward.
Question 10 Play from 13:59
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Degaussing is unreliable on flash storage and can damage the hardware.
Not this one. Try another answer.
Why B is wrong
This takes a long time and is unnecessary when key destruction is available.
Not this one. Try another answer.
Why C is wrong
Overwriting is unreliable on flash because wear leveling and spare areas can retain old data.
Right, D is the answer.
Why D is right
When a drive is fully encrypted, destroying the keys makes everything on it unreadable at once. This avoids the unreliability of overwriting flash storage, where spare and remapped areas can retain data.
Show all 100 questionsShow fewer questions
Question 11 Play from 15:31
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Watching underground forums reveals chatter but does not examine this attack as it unfolds.
Not this one. Try another answer.
Why B is wrong
This is a format for sharing threat intelligence, not a way to study an attack in progress.
Right, C is the answer.
Why C is right
A high-interaction honeypot looks like a genuine production system and keeps the attacker engaged while recording tools, steps and methods. That gives rich detail on a live, sophisticated campaign that the other options cannot match.
Not this one. Try another answer.
Why D is wrong
Behavior analytics spots unusual user activity but gives little insight into an attacker's methods.
Question 12 Play from 17:11
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Dynamic scanning tests live applications, not the source files in the pipeline.
Not this one. Try another answer.
Why B is wrong
Composition analysis inspects third-party libraries, not mistakes in the team's own code.
Not this one. Try another answer.
Why C is wrong
This protects an application while it runs and is not a source-level check.
Right, D is the answer.
Why D is right
Static analysis reads the source code without running it, so it can flag coding errors and flaws early in the pipeline. The other choices either look at dependencies or at running software.
Question 13 Play from 18:40
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Hunting for a key leaves the malware and its changes in place.
Not this one. Try another answer.
Why B is wrong
Previous versions may already have been altered by the attack, and malware traces could remain.
Not this one. Try another answer.
Why C is wrong
Paying is discouraged, offers no assurance the system is clean, and funds criminals.
Right, D is the answer.
Why D is right
Rebuilding from a known-good baseline snapshot removes the malware and anything it changed, leaving a trustworthy system. Restoring individual files or dealing with the criminals leaves doubts about hidden remnants.
Question 14 Play from 20:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Signing proves who published the code and that it is unchanged but does not conceal its logic.
Right, B is the answer.
Why B is right
Producing many differently compiled variants of the program makes reverse engineering far harder, because no two copies expose the logic the same way. The other options do not hide how the code works.
Not this one. Try another answer.
Why C is wrong
This tidies the program but leaves the working logic fully visible.
Not this one. Try another answer.
Why D is wrong
Stripping symbols takes away some labels, yet the compiled logic can still be studied.
Question 15 Play from 21:43
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This is an intrusion detection engine, not a tool for applying configurations.
Not this one. Try another answer.
Why B is wrong
A CASB enforces policy between users and cloud services and does not push settings onto new machines.
Not this one. Try another answer.
Why C is wrong
A configuration database records what exists but does not apply a baseline on its own.
Right, D is the answer.
Why D is right
A configuration management and automation tool can express the security baseline as code and apply it to each machine as it is created, giving consistent results with no manual steps.
Question 16 Play from 23:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A memorandum of understanding is a loose statement of intent and does not fix remediation deadlines.
Not this one. Try another answer.
Why B is wrong
An information security agreement covers security requirements but is not the usual tool for due dates.
Not this one. Try another answer.
Why C is wrong
A master services agreement gives general contract terms and not specific timelines for fixes.
Right, D is the answer.
Why D is right
A service level agreement spells out response and resolution times for each priority, so it is the instrument that sets due dates for fixing the most serious findings.
Question 17 Play from 24:23
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
DNSSEC protects DNS responses and is not part of verifying email senders.
Right, B is one of the answers.
Why B is right
Receiving servers judge sender legitimacy using the SPF, DKIM and DMARC records published in DNS. Keeping those aligned with the current signing setup restores trust so messages reach inboxes.
Not this one. Try another answer.
Why C is wrong
MX records point to the receiving mail servers and do not prove who sent a message.
Not this one. Try another answer.
Why D is wrong
The start of authority record holds zone administration data and plays no part in email authentication.
Right, E is one of the answers.
Why E is right
Receiving servers judge sender legitimacy using the SPF, DKIM and DMARC records published in DNS. Keeping those aligned with the current signing setup restores trust so messages reach inboxes.
Not this one. Try another answer.
Why F is wrong
A subject alternative name lives inside a certificate and is not a DNS record for mail authentication.
Right, G is one of the answers.
Why G is right
Receiving servers judge sender legitimacy using the SPF, DKIM and DMARC records published in DNS. Keeping those aligned with the current signing setup restores trust so messages reach inboxes.
Not this one. Try another answer.
Why H is wrong
SASE is a network and security architecture, unrelated to these DNS records.
Question 18 Play from 26:28
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Limiting access controls who connects but leaves the same services exposed.
Not this one. Try another answer.
Why B is wrong
Secure Boot protects the startup process and does not shrink the set of exposed services.
Not this one. Try another answer.
Why C is wrong
This is one piece of reducing exposure rather than the comprehensive first step.
Right, D is the answer.
Why D is right
Attack surface reduction is the broad first step of finding and turning off unneeded services, ports and features. The other items are narrower or deal with different problems.
Question 19 Play from 27:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This only avoids keeping history on the device and does not hide traffic from the network.
Not this one. Try another answer.
Why B is wrong
This protocol authenticates devices to a network and does not conceal browsing.
Not this one. Try another answer.
Why C is wrong
Geofencing limits access by location and does not protect browsing privacy.
Right, D is the answer.
Why D is right
Encrypting DNS lookups inside HTTPS hides which sites a user is resolving from anyone watching the network. Private browsing only clears local history and leaves the network traffic visible.
Question 20 Play from 29:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Retention only controls how long data is kept and does not make alerts inaccurate.
Not this one. Try another answer.
Why B is wrong
Large indexes slow queries but do not cause false alerts.
Not this one. Try another answer.
Why C is wrong
Too little compute leads to lag or missed events rather than only false positives.
Right, D is the answer.
Why D is right
If incoming records are not parsed properly, the SIEM cannot normalize fields or match them to detection rules, which produces wrong alerts. The other issues affect speed or storage rather than alert accuracy.
Question 21 Play from 30:44
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This wraps data keys inside other keys for easier management and does not allow computing on ciphertext.
Not this one. Try another answer.
Why B is wrong
Simultaneous authentication of equals is a password-based handshake, unrelated to computing on encrypted data.
Right, C is the answer.
Why C is right
Homomorphic encryption lets a processor compute on data that stays encrypted, so useful results appear without the plaintext ever being exposed. None of the other options allow working on ciphertext this way.
Not this one. Try another answer.
Why D is wrong
Authenticated encryption protects secrecy and integrity but the data must be decrypted before it can be used.
Question 22 Play from 32:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A CVE is just an identifier for a known flaw and carries no severity rating.
Not this one. Try another answer.
Why B is wrong
CPE is a naming scheme for products and says nothing about how serious a flaw is.
Right, C is the answer.
Why C is right
CVSS gives each vulnerability a numeric severity rating based on how exploitable it is and how much damage it could do. Sorting by that score lets the team address the riskiest issues first.
Not this one. Try another answer.
Why D is wrong
CCE assigns identifiers to configuration settings and does not rank vulnerabilities.
Question 23 Play from 33:44
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Biometrics prove who the person is and say nothing about the state of the device.
Not this one. Try another answer.
Why B is wrong
Single sign-on centralizes who may enter but does not examine device health.
Not this one. Try another answer.
Why C is wrong
Isolating outside devices is segmentation and does not attest to device integrity.
Right, D is the answer.
Why D is right
Device attestation means checking that a device itself is in a trusted state. Profiling its patch level and whether it has been jailbroken does that, and the result can feed the access decision.
Question 24 Play from 35:24
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This is a protocol for exchanging threat intelligence and not a modeling method.
Right, B is the answer.
Why B is right
STRIDE sorts threats into six kinds: impersonation, data modification, deniability, leaks, service disruption and privilege gain. Staying available maps to the service disruption kind, and limiting who sees data maps to the leak and privilege kinds.
Not this one. Try another answer.
Why C is wrong
ATT&CK catalogs observed adversary behavior and is not a design-time threat modeling framework.
Not this one. Try another answer.
Why D is wrong
CAPEC lists attack patterns and does not give a structured way to model a system's threats.
Question 25 Play from 37:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Detonation shows what a sample does but not who deployed it in each case.
Not this one. Try another answer.
Why B is wrong
Indicators such as addresses and hashes are easily reused or shared by different actors.
Not this one. Try another answer.
Why C is wrong
Stylometry studies coding habits, which may be unavailable or unreliable in shared samples.
Right, D is the answer.
Why D is right
Tactics, techniques and procedures describe how an actor habitually operates, which is far more distinctive than a single artifact. Matching them across incidents is the strongest sign of a shared adversary.
Question 26 Play from 38:36
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Packet encryption works on traffic in transit, not on database records.
Not this one. Try another answer.
Why B is wrong
Boot sector protection is a system-level measure and unrelated to database records.
Not this one. Try another answer.
Why C is wrong
File encryption covers whole files and not individual fields inside a database.
Right, D is the answer.
Why D is right
Record-level encryption, also called field or cell encryption, protects specific sensitive columns or fields inside a database while leaving other data usable. That is its typical purpose.
Question 27 Play from 40:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A honeypot lures attackers to gather intelligence and does not systematically test defenses against listed techniques.
Not this one. Try another answer.
Why B is wrong
Sandboxes safely run samples for analysis and do not test the organization's defenses.
Not this one. Try another answer.
Why C is wrong
A tabletop is a talk-through of decisions and does not exercise technical detection.
Right, D is the answer.
Why D is right
A penetration test actively simulates adversary techniques under control, so it shows whether detection and prevention actually work against those behaviors. The alternatives are discussion, analysis or deception tools.
Question 28 Play from 41:36
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Lightweight designs target speed on small devices and are not the reason for post-quantum work.
Not this one. Try another answer.
Why B is wrong
Encrypting large volumes with public-key methods is impractical and is not the aim.
Right, C is the answer.
Why C is right
Quantum computers with enough power could break today's public-key schemes, so data that must stay secret for years is at risk. Moving to algorithms built to resist quantum attacks guards against that future decryption.
Not this one. Try another answer.
Why D is wrong
Key stretching strengthens passwords and has nothing to do with quantum resistance.
Question 29 Play from 43:10
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A hardware security module guards cryptographic keys and has no bearing on memory execution rules.
Not this one. Try another answer.
Why B is wrong
A trusted platform module stores keys and attests to state, not enforcing page permissions.
Right, C is the answer.
Why C is right
The mprotect call marks memory pages as non-executable, but the processor must support and enforce that marking through the no-execute capability. Without it, injected code could still run from data areas.
Not this one. Try another answer.
Why D is wrong
Secure boot checks startup components and does not control runtime memory execution.
Question 30 Play from 44:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A password policy change is an administrative decision, not something SOAR automates for analysts.
Not this one. Try another answer.
Why B is wrong
Context-based restrictions are access policy work and not routine task automation.
Right, C is the answer.
Why C is right
Automatically adding threat intelligence context to alerts is a core SOAR function. It saves analysts from looking things up by hand and speeds up triage.
Not this one. Try another answer.
Why D is wrong
Static analysis of malware is a specialist analysis task, not routine administration relief.
Question 31 Play from 46:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Ghidra disassembles binaries and is not meant for reading file metadata.
Not this one. Try another answer.
Why B is wrong
OllyDbg is a debugger for running programs and does not extract metadata.
Not this one. Try another answer.
Why C is wrong
Volatility analyzes memory captures, not document and image metadata.
Right, D is the answer.
Why D is right
ExifTool is built to read and edit embedded metadata in images and documents. The other tools are for debugging, memory forensics or disassembly, not for pulling out metadata.
Question 32 Play from 47:34
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A flaw needing local access is far harder to use remotely, so it ranks lower.
Not this one. Try another answer.
Why B is wrong
Internal systems are harder to reach from outside and come after exposed ones.
Right, C is the answer.
Why C is right
Systems exposed to the internet are the easiest for outsiders to reach, and flaws that are already being exploited in the wild pose immediate danger. The combination of the two should come first.
Not this one. Try another answer.
Why D is wrong
Low risk and no exploitation makes these a lower priority than actively targeted systems.
Question 33 Play from 49:13
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
CVSS is built from three groups: Base for intrinsic traits, Temporal for factors that change over time, and Environmental for the organization's own context. The other items are individual metrics inside those groups.
Not this one. Try another answer.
Why B is wrong
This is one metric inside the Base group, not a group by itself.
Right, C is one of the answers.
Why C is right
CVSS is built from three groups: Base for intrinsic traits, Temporal for factors that change over time, and Environmental for the organization's own context. The other items are individual metrics inside those groups.
Not this one. Try another answer.
Why D is wrong
This is one of the impact metrics, not a metric group.
Not this one. Try another answer.
Why E is wrong
Impact is a collection of metrics inside the Base group rather than a separate group.
Right, F is one of the answers.
Why F is right
CVSS is built from three groups: Base for intrinsic traits, Temporal for factors that change over time, and Environmental for the organization's own context. The other items are individual metrics inside those groups.
Not this one. Try another answer.
Why G is wrong
This is an impact metric, not a metric group.
Not this one. Try another answer.
Why H is wrong
This is an impact metric, not a metric group.
Question 34 Play from 50:55
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Methodologies are not one of the four core vertices.
Not this one. Try another answer.
Why B is wrong
Phase is a meta-feature about the attack stage and not a core vertex.
Right, C is the answer.
Why C is right
The model has four core vertices: adversary, capability, infrastructure and victim. With three identified, the missing one is the adversary's capability, meaning the tools and techniques used.
Not this one. Try another answer.
Why D is wrong
Knowledge is not a vertex of the model.
Question 35 Play from 52:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Application control limits what may run but does not prove where an update came from.
Right, B is the answer.
Why B is right
Code signing attaches a digital signature, so recipients can verify who published the update and that nothing changed after signing. The alternatives do not prove origin and authorization.
Not this one. Try another answer.
Why C is wrong
Encryption hides contents but does not show who issued the update.
Not this one. Try another answer.
Why D is wrong
Integrity monitoring spots changes but cannot verify the publisher or authorization.
Question 36 Play from 53:38
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This is a memory defense and unrelated to protecting payment data.
Not this one. Try another answer.
Why B is wrong
Token-based sign-in handles user access and does not protect stored payment details.
Not this one. Try another answer.
Why C is wrong
Storing the actual encrypted card data keeps actual payment information in the system, which is less desirable.
Right, D is the answer.
Why D is right
Tokenization swaps card data for tokens that are worthless if stolen, and an HSM securely handles the mapping. The application can still run recurring charges without storing the sensitive values.
Not this one. Try another answer.
Why E is wrong
These are memory execution controls and do not address payment data.
Question 37 Play from 55:25
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Quantum computers do not enable instant capture, and the worry is future decryption of recorded data.
Right, B is the answer.
Why B is right
A sufficiently powerful quantum computer could factor the large numbers that today's public-key algorithms depend on, which would break them. That threat is what drives the move to new algorithms.
Not this one. Try another answer.
Why C is wrong
Zero trust does not require homomorphic encryption.
Not this one. Try another answer.
Why D is wrong
Forward secrecy is a desirable property and is not the reason for new algorithms.
Question 38 Play from 56:57
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Users need the public key to verify, and sharing private keys would destroy security.
Not this one. Try another answer.
Why B is wrong
Escrow deposits keys with a third party and does not prove software authenticity.
Not this one. Try another answer.
Why C is wrong
This stops a signer from denying their action but does not help users verify the software.
Right, D is the answer.
Why D is right
With code signing, the developer signs the program with a private key and users verify it with the matching public key. That confirms the origin and shows the code was not tampered with.
Question 39 Play from 58:19
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
These are proof techniques and are not by themselves a quantum-resistant encryption method.
Not this one. Try another answer.
Why B is wrong
An authenticated symmetric mode is not designed as a long-term quantum-resistant solution.
Not this one. Try another answer.
Why C is wrong
Elliptic curve schemes can be broken by Shor's algorithm on a quantum computer.
Right, D is the answer.
Why D is right
Lattice-based schemes depend on math problems that remain hard even for quantum machines, and they underpin the post-quantum standards. The other options are vulnerable or are not designed for this purpose.
Question 40 Play from 59:42
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A configuration database stores asset records and cannot orchestrate or automate.
Not this one. Try another answer.
Why B is wrong
XCCDF is a format for configuration checklists, not a platform for linking tools.
Not this one. Try another answer.
Why C is wrong
A workload protection platform secures cloud workloads and does not tie existing tools together.
Right, D is the answer.
Why D is right
SOAR platforms connect separate security tools, automate workflows and coordinate actions, which removes manual handoffs and shortens response time.
Question 41 Play from 1:01:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Smoke tests only confirm the basics work and do not stress resources.
Not this one. Try another answer.
Why B is wrong
A canary release tests changes on a small slice of live users, whereas load testing catches memory problems before production.
Right, C is the answer.
Why C is right
Load testing recreates peak demand and keeps the system under heavy use, which exposes memory leaks and resource exhaustion before release. The other techniques do not push the system the same way.
Not this one. Try another answer.
Why D is wrong
Regression tests confirm old features still work but do not reveal leaks under heavy demand.
Question 42 Play from 1:02:38
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Vulnerability management is an internal practice and not the reason for a vendor program.
Not this one. Try another answer.
Why B is wrong
Support responsiveness is an operational matter, not a board-level driver for this program.
Not this one. Try another answer.
Why C is wrong
Transferring risk through insurance or contracts is an outcome, not the reason a program is needed.
Right, D is the answer.
Why D is right
Companies depend on many outside suppliers, and their weaknesses become the company's own. A vendor management program gives the board visibility into the supply chain and the risks it carries.
Question 43 Play from 1:04:03
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Machine learning describes analysis methods, not a way to hide the data from the analyst.
Not this one. Try another answer.
Why B is wrong
A data lake is only a large repository and does not conceal data during analysis.
Not this one. Try another answer.
Why C is wrong
Public-key encryption protects data but it must be decrypted before analysis, exposing it.
Right, D is the answer.
Why D is right
Homomorphic encryption allows computation directly on ciphertext, so insights can be produced while the raw records stay hidden from the processor. None of the others provide that property.
Question 44 Play from 1:05:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A central firewall helps the perimeter but does not give internal separation between the tiers.
Not this one. Try another answer.
Why B is wrong
SASE governs user-to-resource access and not server-to-server traffic between tiers.
Not this one. Try another answer.
Why C is wrong
A VPN handles remote access and does not separate the tiers internally.
Right, D is the answer.
Why D is right
Microsegmentation applies fine-grained rules so each tier only exchanges the traffic it needs. That limits lateral movement inside the environment, which is the main hardening aim here.
Question 45 Play from 1:07:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
EDR watches endpoints for attacks in progress and does not systematically produce an indicator list from samples.
Right, B is the answer.
Why B is right
Running samples inside an isolated sandbox lets analysts watch the file, network and registry activity, which yields concrete indicators such as addresses, domains and hashes to hunt for.
Not this one. Try another answer.
Why C is wrong
Simulators model behavior and do not run live malware to reveal genuine indicators.
Not this one. Try another answer.
Why D is wrong
Antivirus matches known signatures and does not create new, detailed indicators.
Question 46 Play from 1:08:33
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Poisoning corrupts training data, which input cleaning at query time cannot undo.
Not this one. Try another answer.
Why B is wrong
Explainability is a transparency issue and not solved by sanitizing input.
Right, C is the answer.
Why C is right
Prompt injection works by slipping hostile instructions into the text a model receives. Sanitizing inputs removes or blocks those instructions before they can steer the model.
Not this one. Try another answer.
Why D is wrong
Inversion recovers training data from outputs, which sanitizing inputs does not prevent.
Question 47 Play from 1:09:53
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Webhooks can push notifications but are not the main way to maintain an indicator list from a feed.
Not this one. Try another answer.
Why B is wrong
This is an action taken after detection, not a source of indicator data.
Right, C is the answer.
Why C is right
A threat feed API supplies fresh indicators from intelligence sources on a continuing basis, so the mail server can ingest them and block matching messages without manual updates.
Not this one. Try another answer.
Why D is wrong
A runbook records procedures and does not fetch or update indicators.
Not this one. Try another answer.
Why E is wrong
A log analyzer reads existing logs and does not supply indicator updates.
Not this one. Try another answer.
Why F is wrong
A scheduled task can trigger updates but does not provide the indicator data itself.
Question 48 Play from 1:11:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Tabletops prepare response teams and do not build basic competence in all staff.
Not this one. Try another answer.
Why B is wrong
Simulated attacks test staff and go beyond building basic awareness.
Not this one. Try another answer.
Why C is wrong
Crisis management handles incidents after they occur rather than preparing employees.
Right, D is the answer.
Why D is right
A security awareness program delivers regular communications and basic training to every employee, which is exactly what the provider recommended against phishing.
Question 49 Play from 1:13:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Spear phishing is a targeted message, usually email, rather than a call using a cloned voice.
Not this one. Try another answer.
Why B is wrong
Smishing is delivered by text message and not by a phone call.
Not this one. Try another answer.
Why C is wrong
This is about software that creates exploits and does not involve voice impersonation.
Right, D is the answer.
Why D is right
Artificial intelligence can clone a voice so a caller sounds like the actual executive. That synthetic impersonation is a deepfake attack.
Question 50 Play from 1:14:29
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Selecting samples belongs to carrying out the audit, not to preparing for it.
Right, B is the answer.
Why B is right
An internal assessment lets the firm find and fix obvious gaps, confirm documentation and understand its current controls, so the external audit goes smoothly.
Not this one. Try another answer.
Why C is wrong
Lessons learned come after the audit is finished.
Not this one. Try another answer.
Why D is wrong
Evidence gathering takes place during the audit rather than before choosing an auditor.
Question 51 Play from 1:15:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Total cost of ownership looks at lifetime spending and does not measure failure likelihood.
Not this one. Try another answer.
Why B is wrong
A master services agreement is a contract document unrelated to predicting failures.
Not this one. Try another answer.
Why C is wrong
Mean time to repair measures recovery speed, not how likely a failure is.
Not this one. Try another answer.
Why D is wrong
Single loss expectancy estimates cost per incident and depends on criticality, which the plan ignores.
Right, E is the answer.
Why E is right
Mean time between failures indicates how often a system is expected to fail, so it ranks servers by failure likelihood. The other terms describe repair speed, cost or contracts.
Question 52 Play from 1:17:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Magnetic erasure is not reliable on every drive type and is less certain than destruction.
Right, B is the answer.
Why B is right
Physically shredding the media destroys it so that data cannot be recovered. Clearing, purging and degaussing are sanitization methods that leave the drive intact and are less certain.
Not this one. Try another answer.
Why C is wrong
Overwriting leaves the drive in one piece and may not be enough for very sensitive data.
Not this one. Try another answer.
Why D is wrong
Purging sanitizes the media but leaves it intact and open to forensic attempts.
Question 53 Play from 1:18:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
California's law grants privacy rights but lacks the same explicit right to be forgotten.
Not this one. Try another answer.
Why B is wrong
DORA deals with digital operational resilience for financial firms, not erasure rights.
Right, C is the answer.
Why C is right
The GDPR contains the right to erasure, often called the right to be forgotten, which lets people ask organizations to delete their personal data.
Not this one. Try another answer.
Why D is wrong
COPPA protects children's privacy online and does not create a general right to be forgotten.
Question 54 Play from 1:20:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Purchasing new software goes against the instruction to use existing resources.
Not this one. Try another answer.
Why B is wrong
Relocating logs does not automate reporting or connect the products.
Not this one. Try another answer.
Why C is wrong
This would require heavy restructuring and does not fix the lack of communication.
Right, D is the answer.
Why D is right
Connecting the products through their APIs lets data flow into one place with existing tools and no major rebuild, which meets the automation goal.
Question 55 Play from 1:21:49
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This is a Windows feature and does not exist on UNIX.
Right, B is one of the answers.
Why B is right
Cron is the standard built-in scheduler for recurring jobs, and Bash is the default shell for scripting the commands. Together they automate the work without installing anything.
Not this one. Try another answer.
Why C is wrong
Python may not be installed by default and may need to be added.
Not this one. Try another answer.
Why D is wrong
PowerShell is mainly a Windows tool and is not a standard default on UNIX.
Not this one. Try another answer.
Why E is wrong
Ansible must be installed and configured separately.
Right, F is one of the answers.
Why F is right
Cron is the standard built-in scheduler for recurring jobs, and Bash is the default shell for scripting the commands. Together they automate the work without installing anything.
Question 56 Play from 1:23:13
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A business impact analysis estimates consequences of disruption and is not a simulation.
Not this one. Try another answer.
Why B is wrong
Lessons learned reviews an incident that already happened.
Not this one. Try another answer.
Why C is wrong
A walk-through is a more passive review of documents and not an interactive simulation.
Right, D is the answer.
Why D is right
A tabletop exercise is a guided, discussion-based simulation in which participants talk through a hypothetical incident, which reveals gaps and prepares people without touching live systems.
Question 57 Play from 1:24:40
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This needs authentication servers and certificates, too much overhead for a tiny shop.
Not this one. Try another answer.
Why B is wrong
This also requires a RADIUS server and certificate infrastructure.
Not this one. Try another answer.
Why C is wrong
TKIP is outdated and no longer considered secure.
Right, D is the answer.
Why D is right
WPA3-Personal gives strong modern protection with a shared passphrase and no extra servers, so it suits a small site that wants little administration. The enterprise options need a RADIUS server and certificates.
Question 58 Play from 1:26:18
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Proprietary reports lack the standard, community-built structure ATT&CK offers.
Right, B is the answer.
Why B is right
MITRE ATT&CK is a standardized knowledge base of observed adversary tactics and techniques, which is the right basis for planning defenses against common behavior.
Not this one. Try another answer.
Why C is wrong
Open-source research collects information but is not a standard catalog of techniques.
Not this one. Try another answer.
Why D is wrong
This is a deceptive technique and does not help plan defenses.
Not this one. Try another answer.
Why E is wrong
The Diamond Model examines individual intrusions and is not a broad catalog of techniques.
Question 59 Play from 1:27:53
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Risk appetite and tolerance set how much exposure the business will accept, which frames which assets and failures matter most and how risks will be prioritized.
Not this one. Try another answer.
Why B is wrong
These concern outside vendors and are not central to identifying critical assets and failure points.
Not this one. Try another answer.
Why C is wrong
Remediation comes after risks are identified and assessed.
Not this one. Try another answer.
Why D is wrong
Acceptance criteria are an output of assessment, not a starting point for identifying assets.
Question 60 Play from 1:29:24
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A signature does not mean the code is safe, since malicious code can be signed too.
Not this one. Try another answer.
Why B is wrong
Signing is separate from digital rights management.
Right, C is one of the answers.
Why C is right
A digital signature shows who published the code and also proves that it has not changed since it was signed. It does not hide content or guarantee the code is harmless.
Not this one. Try another answer.
Why D is wrong
Signing authenticates the publisher, not the recipient.
Not this one. Try another answer.
Why E is wrong
Signing offers authenticity and integrity and does not keep content secret.
Right, F is one of the answers.
Why F is right
A digital signature shows who published the code and also proves that it has not changed since it was signed. It does not hide content or guarantee the code is harmless.
Question 61 Play from 1:31:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A communication plan covers who gets notified and not the technical response steps.
Not this one. Try another answer.
Why B is wrong
Lessons learned is a post-incident review rather than a forward-looking step-by-step guide.
Not this one. Try another answer.
Why C is wrong
Root cause analysis explains why something happened and gives no procedure for the future.
Right, D is the answer.
Why D is right
A runbook lays out step-by-step actions for handling a particular type of incident, so the team can respond the same way every time. The other items look backward or cover other topics.
Question 62 Play from 1:32:20
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Attestation is not one of the standard services that PKI provides for messages.
Not this one. Try another answer.
Why B is wrong
Receipts belong to messaging systems and are not a PKI function.
Not this one. Try another answer.
Why C is wrong
Secrecy relies on encryption and is not the capability asked about for signed approvals.
Right, D is the answer.
Why D is right
A signature created with a private key ties a message to its sender, so the sender cannot later deny it. This non-repudiation makes approvals accountable, while the other items are not core PKI services for messages.
Question 63 Play from 1:33:47
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
TLS encrypts the connection and does not sign individual messages.
Not this one. Try another answer.
Why B is wrong
DMARC enforces policy based on SPF and DKIM but does not do the signing.
Right, C is the answer.
Why C is right
DKIM signs outgoing mail with the organization's private key and publishes the public key in DNS so receivers can verify it. SPF lists sending servers, DMARC sets policy, and TLS only protects transport.
Not this one. Try another answer.
Why D is wrong
SPF validates the sending server's address and does not involve signing with a private key.
Question 64 Play from 1:35:20
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A TPM manages keys and platform integrity and does not stop return-oriented attacks.
Not this one. Try another answer.
Why B is wrong
A hardware security module handles cryptographic operations, not exploit mitigation in application memory.
Right, C is the answer.
Why C is right
Return-oriented attacks depend on knowing where code fragments sit in memory. Address space layout randomization changes those locations on each run, making reliable chaining very difficult.
Not this one. Try another answer.
Why D is wrong
An IDS only detects attacks and does not block this exploitation technique.
Question 65 Play from 1:36:45
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Network management covers day-to-day network operations and not the approval of changes.
Right, B is the answer.
Why B is right
Change management is the disciplined process in which modifications are documented, approved, tested and executed in a controlled way, which keeps approved alterations safe.
Not this one. Try another answer.
Why C is wrong
Risk management is broader and does not itself manage how approved changes are executed.
Not this one. Try another answer.
Why D is wrong
Configuration management records settings and does not govern how changes are planned and executed.
Question 66 Play from 1:38:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Non-repudiation shows who sent something and not whether it was changed.
Not this one. Try another answer.
Why B is wrong
Availability is about having access when needed.
Not this one. Try another answer.
Why C is wrong
Confidentiality prevents unauthorized disclosure.
Right, D is the answer.
Why D is right
Integrity means data has not been altered, and it is usually checked with hashes or message authentication codes. The other properties address secrecy, access or proof of origin.
Question 67 Play from 1:39:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Text codes can still be spammed and give no active confirmation.
Not this one. Try another answer.
Why B is wrong
Email codes share the same spam weakness.
Not this one. Try another answer.
Why C is wrong
Hardware keys improve strength but do not restrict the volume or timing of requests.
Right, D is the answer.
Why D is right
A prompt that requires the person to actively respond, rather than simply tapping approve on a push, stops attackers from succeeding by spamming requests. The user has to deliberately confirm each attempt.
Question 68 Play from 1:41:02
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
More interoperability reduces lock-in and is not a risk of it.
Not this one. Try another answer.
Why B is wrong
Using multiple clouds is a way to reduce lock-in.
Right, C is one of the answers.
Why C is right
With few alternatives, a locked-in customer is exposed to the vendor changing its products or terms and to a decline in service quality. The remaining statements describe benefits or ways of avoiding lock-in.
Not this one. Try another answer.
Why D is wrong
Easy data movement is the opposite of lock-in.
Right, E is one of the answers.
Why E is right
With few alternatives, a locked-in customer is exposed to the vendor changing its products or terms and to a decline in service quality. The remaining statements describe benefits or ways of avoiding lock-in.
Not this one. Try another answer.
Why F is wrong
No guarantee exists under lock-in, and service levels are actually at risk.
Question 69 Play from 1:42:40
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Sharing private keys breaks the fundamental rule of PKI.
Right, B is the answer.
Why B is right
In mutual authentication both sides hold their own key pair and certificate, and each verifies the other's public key. No secrets are shared, which is the PKI principle.
Not this one. Try another answer.
Why C is wrong
Shared secrets are not how PKI works, which relies on key pairs.
Not this one. Try another answer.
Why D is wrong
Forward secrecy protects session keys and does not provide mutual authentication.
Not this one. Try another answer.
Why E is wrong
A common key would make the two parties indistinguishable, defeating mutual authentication.
Question 70 Play from 1:44:16
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
ISO 27001 is a management system standard focused on processes, not technical configuration guidance.
Not this one. Try another answer.
Why B is wrong
The NIST framework is a high-level risk approach and not specific firewall configuration advice.
Right, C is the answer.
Why C is right
The CIS Controls give specific, prioritized safeguards, including guidance on network perimeter defenses and firewall configuration. The other options are broader frameworks or standards.
Not this one. Try another answer.
Why D is wrong
ATT&CK describes adversary behavior rather than configuration best practices.
Question 71 Play from 1:45:47
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Savings may follow but they are not the benefit that fixes scaling.
Right, B is the answer.
Why B is right
Serverless platforms allocate and release resources automatically as demand changes, which solves the scaling problem without manual work. The other benefits do not target scaling.
Not this one. Try another answer.
Why C is wrong
Reduced patching is a side benefit that does not address scaling.
Not this one. Try another answer.
Why D is wrong
Geographic redundancy is a separate concern from scaling.
Question 72 Play from 1:47:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Rotation swaps keys on a schedule and does not make password storage stronger.
Not this one. Try another answer.
Why B is wrong
Escrow keeps backup copies of keys and is not a password hardening technique.
Not this one. Try another answer.
Why C is wrong
Splitting divides a key into shares and does not strengthen password hashing.
Right, D is the answer.
Why D is right
Key stretching makes password hashing deliberately costly through repeated iterations or memory use, which makes brute-force guessing much harder without replacing the module.
Not this one. Try another answer.
Why E is wrong
Encrypting keys protects the keys themselves and does not improve password hashing.
Question 73 Play from 1:48:42
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Stickers reveal tampering but do not stop a determined actor from copying data.
Right, B is the answer.
Why B is right
If the executives carry clean, sanitized devices and reach company data only through a virtual desktop, nothing valuable is stored on the laptops, so seizure or copying yields little.
Not this one. Try another answer.
Why C is wrong
Encrypted drives help if a laptop is lost but do not stop seizure and forensic attempts.
Not this one. Try another answer.
Why D is wrong
Measured boot detects firmware changes but does not prevent data theft.
Question 74 Play from 1:50:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
DNS filtering cannot selectively allow the legitimate links and risks disrupting the workflow.
Not this one. Try another answer.
Why B is wrong
Blanket blocking would stop legitimate purchase links and disrupt business.
Not this one. Try another answer.
Why C is wrong
Training alone gives no technical protection against sophisticated or zero-day attacks.
Right, D is the answer.
Why D is right
Browser isolation opens links in a separate protected environment, so staff can still reach legitimate requests while malicious content never touches their machines. Blocking or filtering would interrupt orders.
Question 75 Play from 1:51:50
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Social engineering is a general threat and not the regulatory concern of automated lending.
Not this one. Try another answer.
Why B is wrong
Credential theft is a general risk and not specific to regulation of automated decisions.
Right, C is the answer.
Why C is right
Regulators expect lenders to be able to explain how automated decisions are reached and to show they are fair. A model that cannot be explained is therefore the main regulatory concern.
Not this one. Try another answer.
Why D is wrong
Prompt injection concerns language models and is not the core issue for rate decisions.
Question 76 Play from 1:53:21
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A mapping tool finds hosts and does not resolve duplicates across interfaces.
Not this one. Try another answer.
Why B is wrong
Discovery identifies devices but does not merge findings across interfaces.
Not this one. Try another answer.
Why C is wrong
SCAP scanning alone does not give each machine a unique identity to merge results.
Right, D is the answer.
Why D is right
An agent runs on the machine itself and reports under one host identity, so the same flaw is not counted once per network card. Network-based scans see each interface as a separate target.
Question 77 Play from 1:54:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
ITIL is a service management framework and not a tool for tracking project roles.
Right, B is the answer.
Why B is right
A RACI matrix records who is responsible, accountable, consulted and informed for each task or phase, so it is the standard way to track roles and duties.
Not this one. Try another answer.
Why C is wrong
A recall tree is a notification list and not a way to track project roles.
Not this one. Try another answer.
Why D is wrong
A CMDB tracks assets and their relationships rather than who is responsible for tasks.
Question 78 Play from 1:56:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Reconnaissance collects information about the environment and does not test control resilience.
Not this one. Try another answer.
Why B is wrong
Reliability factors describe uptime and not how controls resist attackers.
Right, C is the answer.
Why C is right
Adversary emulation recreates the specific tactics and techniques of actual threat actors in a controlled way, so it shows whether the controls would hold against them.
Not this one. Try another answer.
Why D is wrong
A honeypot passively detects attackers and does not test the organization's controls.
Question 79 Play from 1:57:41
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Alignment with best practice is broader than what receiving indicators provides.
Right, B is the answer.
Why B is right
Indicators shared by peers describe attacks already hitting similar organizations. Receiving them lets the SOC detect those known attacks if they reach the company.
Not this one. Try another answer.
Why C is wrong
Playbook upkeep is a separate matter from receiving intelligence.
Not this one. Try another answer.
Why D is wrong
Shared indicators support detection of known attacks rather than proactive prevention.
Question 80 Play from 1:59:22
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
These add device-level security but local data could still be extracted from a stolen laptop.
Not this one. Try another answer.
Why B is wrong
These are access controls that do not protect data stored on a stolen device.
Right, C is the answer.
Why C is right
If work happens inside a hosted desktop with multifactor sign-in, no sensitive data is stored on the laptop, so losing it does not expose anything.
Not this one. Try another answer.
Why D is wrong
These are reactive steps that do not prevent exposure from a stolen device.
Question 81 Play from 2:01:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A right of first refusal is a contractual option and not the reason boards request reports.
Not this one. Try another answer.
Why B is wrong
An NDA is a contract and not the board's activity of reviewing reports.
Not this one. Try another answer.
Why C is wrong
Attestations are outside audit reports and differ from the company-specific reports described.
Right, D is the answer.
Why D is right
Before completing a merger, a board examines the other company's financial, legal, operational and security position through reports. That careful investigation is called due diligence.
Question 82 Play from 2:02:38
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Ransomware is delivered after a breach and does not explain how a rogue device got in.
Not this one. Try another answer.
Why B is wrong
Social engineering might play a part but does not directly explain a rogue device.
Not this one. Try another answer.
Why C is wrong
A buffer overflow is a coding flaw, not a vector for introducing rogue hardware.
Right, D is the answer.
Why D is right
A rogue device inside the infrastructure that quietly communicates with hostile servers points to something introduced through procurement, installation or a third party, which is a supply chain compromise.
Question 83 Play from 2:04:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
CAPEC lists attack patterns but is less complete than ATT&CK for analyzing adversary behavior.
Not this one. Try another answer.
Why B is wrong
D3FEND catalogs defensive techniques, not adversary behavior.
Not this one. Try another answer.
Why C is wrong
OWASP focuses on web application weaknesses, not adversary techniques.
Not this one. Try another answer.
Why D is wrong
COPPA is a children's privacy law and not a threat analysis framework.
Right, E is the answer.
Why E is right
MITRE ATT&CK is the main knowledge base for mapping adversary tactics, techniques and procedures, so analysts can connect observed activity to known behavior.
Question 84 Play from 2:05:49
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Encryption comes after the organization has worked out which data needs protecting.
Right, B is the answer.
Why B is right
Controls like encryption, hardening and DLP all depend on knowing which data is sensitive. Defining labeling standards creates the common classification scheme on which the later steps rely.
Not this one. Try another answer.
Why C is wrong
Hardening requires knowing where sensitive data lives, which depends on classification first.
Not this one. Try another answer.
Why D is wrong
A DLP policy needs defined categories and labels to know what to protect.
Question 85 Play from 2:07:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A software bill of materials lists components of software and does not inventory the organization's assets.
Not this one. Try another answer.
Why B is wrong
A SIEM correlates events and needs asset data from elsewhere to map vulnerabilities.
Not this one. Try another answer.
Why C is wrong
SASE is a network security architecture and does not provide asset inventory.
Right, D is the answer.
Why D is right
A configuration management database holds an authoritative inventory of assets and their relationships. With that inventory, vulnerabilities can be matched to the exact assets they affect.
Question 86 Play from 2:08:40
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Lift-and-shift keeps the existing design and responsibilities, so little work is saved.
Not this one. Try another answer.
Why B is wrong
Native tools still need integration and management, so they reduce scope less.
Not this one. Try another answer.
Why C is wrong
Microservices add service-to-service controls and do not shrink the security scope.
Right, D is the answer.
Why D is right
Serverless services pass most infrastructure, operating system and patching responsibility to the provider, which leaves the customer mainly with application-level security.
Question 87 Play from 2:10:10
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This protects stored passwords and does not limit who can reach encrypted material.
Not this one. Try another answer.
Why B is wrong
This strengthens sign-in but an individual could still decrypt the data.
Right, C is the answer.
Why C is right
Splitting a key among several people means no one individual can decrypt the material alone, so misuse would require collusion. The other measures only strengthen authentication or password handling.
Not this one. Try another answer.
Why D is wrong
This improves authentication but does not stop an authenticated user from accessing the material.
Not this one. Try another answer.
Why E is wrong
Simultaneous authentication of equals is a wireless handshake and not an insider control.
Question 88 Play from 2:11:45
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Frequent rotation does not stop ongoing guessing or deal with the location anomaly.
Not this one. Try another answer.
Why B is wrong
This removes the lockout protection and makes guessing easier.
Right, C is the answer.
Why C is right
Conditional access can refuse sign-in attempts from unexpected locations before they pile up failed attempts, which stops both the guessing and the lockouts.
Not this one. Try another answer.
Why D is wrong
Single sign-on does not address location-based guessing attempts.
Question 89 Play from 2:13:13
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Signing proves authenticity after the fact and does not stop vulnerable code from being deployed.
Not this one. Try another answer.
Why B is wrong
Sandboxing contains impact at runtime and does not prevent vulnerable releases.
Right, C is the answer.
Why C is right
Static analysis examines source code early, before it is built, so flaws are found and fixed prior to release. The other items do not prevent vulnerable code from shipping.
Not this one. Try another answer.
Why D is wrong
Regression testing checks old functionality and is not aimed at finding security flaws.
Question 90 Play from 2:14:42
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Reporting frameworks govern how events are communicated and not access request handling.
Not this one. Try another answer.
Why B is wrong
Security standards cover controls but not specifically access request handling.
Not this one. Try another answer.
Why C is wrong
Certification requirements vary and are not specifically tied to these requests.
Right, D is the answer.
Why D is right
Handling data subject access requests is an obligation under privacy laws such as GDPR and CCPA, so the officer is checking compliance with privacy regulations.
Not this one. Try another answer.
Why E is wrong
E-discovery concerns legal proceedings and not individuals' privacy rights.
Question 91 Play from 2:16:21
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SOAR is a response tool and does not prevent compromise.
Right, B is the answer.
Why B is right
SOAR platforms run prepared runbooks automatically, which shrinks the delay between detection and containment. That is the stated goal.
Not this one. Try another answer.
Why C is wrong
Reporting is not the main value of SOAR, which is automating response.
Not this one. Try another answer.
Why D is wrong
Correlation is an analytics function, while SOAR focuses on orchestration and automation.
Question 92 Play from 2:17:57
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Microsegmentation divides networks into zones and is not built for controlled transfer between classification levels.
Right, B is the answer.
Why B is right
A cross-domain solution moves data between classification levels while enforcing direction, inspecting content and filtering file types, which prevents spillage.
Not this one. Try another answer.
Why C is wrong
Integrity monitoring detects file changes but does not control flows between networks.
Not this one. Try another answer.
Why D is wrong
NAC governs who joins a network and does not filter content between classifications.
Question 93 Play from 2:19:33
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Interactive testing finds issues through runtime interaction and does not document composition.
Not this one. Try another answer.
Why B is wrong
Runtime inspection examines behavior and not a pre-build inventory.
Right, C is the answer.
Why C is right
Software composition analysis catalogs the libraries and components that make up an application. That inventory is exactly the evidence of what the application contains.
Not this one. Try another answer.
Why D is wrong
Static analysis looks for vulnerabilities in code rather than inventorying components.
Question 94 Play from 2:21:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A load balancer only spreads traffic across servers and does not manage API operations.
Not this one. Try another answer.
Why B is wrong
An identity provider authenticates users and issues tokens and does not serve information or run transactions.
Not this one. Try another answer.
Why C is wrong
A reverse proxy forwards and caches traffic but does not understand API operations.
Right, D is the answer.
Why D is right
A service that exposes REST operations to automated clients is an API, and a central gateway is the single entry point that authenticates clients, applies limits and routes each call to the right back-end service.
Question 95 Play from 2:22:45
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
RAID 10 provides redundancy but ransomware can encrypt all mirrored copies.
Right, B is the answer.
Why B is right
Immutable storage cannot be changed or deleted by ransomware, and regular immutable snapshots allow restoring recent clean data within the one-hour recovery point target.
Not this one. Try another answer.
Why C is wrong
This protects confidentiality and does not preserve recoverable data against ransomware.
Not this one. Try another answer.
Why D is wrong
Journaling gives redundancy but does not stop ransomware from encrypting the data.
Question 96 Play from 2:24:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This describes model extraction and not denial of service.
Not this one. Try another answer.
Why B is wrong
Unreliable output is an accuracy concern, not a denial of service.
Not this one. Try another answer.
Why C is wrong
This is too general and does not describe how service is denied.
Right, D is the answer.
Why D is right
Sending huge, computation-heavy inputs can exhaust a model's resources and make the service slow or unavailable. The other choices describe different risks such as unreliable answers or model extraction.
Question 97 Play from 2:25:43
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A revocation list is a downloaded list and not a protocol for instant checks.
Not this one. Try another answer.
Why B is wrong
HSTS forces HTTPS connections and does not check a certificate's status.
Not this one. Try another answer.
Why C is wrong
RSA is an algorithm for encryption and signatures and does not check validity.
Right, D is the answer.
Why D is right
OCSP lets software ask a responder, at the moment of the request, whether a certificate has been revoked. A revocation list is only a file, and the other options do not check validity.
Question 98 Play from 2:27:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Being open source is not by itself a security weakness.
Not this one. Try another answer.
Why B is wrong
DNP3 uses structured messages.
Right, C is the answer.
Why C is right
The original DNP3 specification has no built-in authentication, so a rogue device could send or alter commands. Secure authentication was added later as an extension.
Not this one. Try another answer.
Why D is wrong
DNP3 function codes are standardized in the specification.
Question 99 Play from 2:28:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SOAR automates response workflows and does not directly control which devices can reach data.
Right, B is the answer.
Why B is right
Conditional access can allow or block access depending on device status, location and risk, so unmanaged personal laptops can be denied or challenged before reaching confidential data.
Not this one. Try another answer.
Why C is wrong
Package monitoring tracks software dependencies and is unrelated to device-based access.
Not this one. Try another answer.
Why D is wrong
This is a certificate status mechanism and has no bearing on device-based access.
Not this one. Try another answer.
Why E is wrong
A CASB watches cloud application use but does not by itself block unmanaged devices from other systems.
Question 100 Play from 2:30:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The certificate authority issues certificates, but the identity check happens earlier at the RA.
Not this one. Try another answer.
Why B is wrong
An identity provider is part of federated sign-in and not the PKI enrollment process.
Not this one. Try another answer.
Why C is wrong
OCSP checks revocation status after issuance and is not part of enrollment.
Right, D is the answer.
Why D is right
The registration authority checks the requester's identity before anything goes to the certificate authority. A failed identity check is therefore rejected at the RA, before issuance is even considered.
Transcript
Play from 00:00 Question 1. A defense contractor is evaluating a cross-domain gateway that keeps two networks apart. The review team must find out how information could slip across the boundary without anyone noticing. Which technique fits this goal? Here are the options. Option A. Fuzz testing. Option B. Covert channel analysis. Option C. Protocol analysis. Option D. Anomaly spotting with machine learning statistics. Pause the video now if you want time to think about the answer.
The correct answer is B. Covert channel analysis. The team is hunting for hidden or indirect paths that move data past the separation controls unseen. Covert channel analysis exists to uncover exactly those unintended pathways, which makes it the right fit for judging a segmentation tool. Now, why are the other options incorrect? Option A is incorrect. Fuzzing feeds malformed input to expose software bugs and says little about unseen leakage across a boundary. Option C is incorrect. Studying protocol structure explains how traffic is formatted but does not search for concealed ways around the controls. Option D is incorrect. Statistical models flag unusual behavior in observed traffic, which differs from discovering hidden bypass routes in a design. Therefore, B, Covert channel analysis, is the correct answer.
Play from 01:43 Question 2. A multinational retailer collects telemetry from every laptop and user account. Analysts need to be able to tell which branch location each record came from. Which approach supports this need? Here are the options. Option A. Deciding where to install collectors. Option B. Always-on monitoring. Option C. Central log aggregation. Option D. Data labeling. Pause the video now if you want time to think about the answer.
The correct answer is D. Data labeling. The records must carry information about where they originated so that analysts can sort and filter by branch. Attaching that metadata to each record is what data labeling means, and it works even while all the telemetry is stored together. Now, why are the other options incorrect? Option A is incorrect. Collector placement decides what gets captured, not how each record is marked with its origin. Option B is incorrect. Constant monitoring keeps data flowing but gives no way to separate it by branch. Option C is incorrect. Pooling logs in one place still needs tags before records can be split by office. Therefore, D, Data labeling, is the correct answer.
Play from 03:16 Question 3. A bank has applied controls to cut the likelihood of a risk but could not remove it entirely. The risk team has finished the mitigation work. What is the logical next activity? Here are the options. Option A. Move on to the following entry in the risk register. Option B. Refresh the threat model. Option C. Evaluate what exposure remains after the controls. Option D. Work out the size of the impact again. Pause the video now if you want time to think about the answer.
The correct answer is C. Evaluate what exposure remains after the controls. After controls go in, some exposure always remains. The team has to measure what is left, the residual risk, to judge whether it falls within what the organization will accept or whether more action is needed. Now, why are the other options incorrect? Option A is incorrect. Skipping ahead leaves the current risk without any check on whether the controls worked. Option B is incorrect. A threat model update can come later, but measuring leftover exposure comes first. Option D is incorrect. Mitigation here lowered likelihood, so the size of the impact is not what gets recalculated next. Therefore, C, Evaluate what exposure remains after the controls, is the correct answer.
Show full transcriptShow less
Play from 04:53 Question 4. A hospital group is expanding staff training on convincing new phishing and social engineering attempts. What trend is most likely driving this decision? Here are the options. Option A. Meeting compliance duties that already exist. Option B. Staff trusting chatbots too heavily. Option C. Comparing outputs of AI models against each other. Option D. Generative AI making attacks more convincing. Pause the video now if you want time to think about the answer.
The correct answer is D. Generative AI making attacks more convincing. Tools that generate text and media automatically make it far easier for attackers to craft believable, personalized lures at scale. That rising quality of attacks is the reason organizations step up awareness training. Now, why are the other options incorrect? Option A is incorrect. Compliance may benefit from training, but it does not explain a sudden focus on newer attack styles. Option B is incorrect. Reliance on support bots is not what makes phishing messages more convincing. Option C is incorrect. Comparing model outputs is unrelated to the growth of deceptive messages. Therefore, D, Generative AI making attacks more convincing, is the correct answer.
Play from 06:32 Question 5. A clinic has locked down its patient portal so only authorized staff can sign in. Leadership still worries that records could leave the organization by mistake or on purpose. Which solution speaks to this worry? Here are the options. Option A. Threat intelligence platform. Option B. DLP. Option C. Vulnerability scanner. Option D. SIEM. Pause the video now if you want time to think about the answer.
The correct answer is B. DLP. Access controls decide who may open the data, but they do not stop a permitted user from sending it somewhere it should not go. A data loss prevention system inspects and blocks sensitive content as it leaves, which covers that gap. Now, why are the other options incorrect? Option A is incorrect. A threat intelligence platform supplies information about outside adversaries and does not guard data leaving the company. Option C is incorrect. A scanner finds weaknesses in systems but does nothing to halt data movement. Option D is incorrect. A SIEM collects and correlates events for analysts and does not itself block sensitive content from leaving. Therefore, B, DLP, is the correct answer.
Play from 08:08 Question 6. A packaging plant wants to pull readings from its controllers into one place for dashboards and for forecasting equipment failures. Where should the controllers' tag values most likely be sent? Here are the options. Option A. Public cloud object storage. Option B. A portable external disk. Option C. A general system aggregator. Option D. Local historian. Pause the video now if you want time to think about the answer.
The correct answer is D. Local historian. In industrial networks, a historian is the standard system that collects and stores time-series values from controllers on site. It feeds trending, dashboards and predictive maintenance, so the readings normally go there first. Now, why are the other options incorrect? Option A is incorrect. Cloud storage might receive data later, but controller values are normally gathered on site first. Option B is incorrect. A portable disk is not built for continuous collection and analysis of live process data. Option C is incorrect. That is not a standard component in industrial settings, where the historian does this work. Therefore, D, Local historian, is the correct answer.
Play from 09:36 Question 7. A bank relies on a critical supplier that sells several different products. How should the bank carry out the risk assessment for this supplier? Here are the options. Option A. By examining one product picked at random. Option B. By evaluating each product on its own. Option C. By relying on the supplier's outside audit report. Option D. By reviewing only the supplier's biggest product. Pause the video now if you want time to think about the answer.
The correct answer is B. By evaluating each product on its own. Each product can have its own weaknesses, settings and update habits. Assessing every product separately avoids lumping everything into one vendor-wide score and uncovers risks a single review would miss. Now, why are the other options incorrect? Option A is incorrect. A random pick is not a defensible method and ignores most of what the supplier sells. Option C is incorrect. An audit report can inform the work but it does not define how the assessment itself is structured. Option D is incorrect. Looking at the largest product alone leaves the others unexamined. Therefore, B, By evaluating each product on its own, is the correct answer.
Play from 11:07 Question 8. A company runs Windows, Linux and cloud workloads and wants its incident response to work more consistently on all of them. The team must achieve this with the tools already in place. What should the engineer rely on? Here are the options. Option A. Central log storage. Option B. Endpoint detection. Option C. Playbooks. Option D. Event collectors. Pause the video now if you want time to think about the answer.
The correct answer is C. Playbooks. Playbooks are written, step-by-step procedures for each kind of incident. They bring repeatable, consistent handling across different platforms without buying anything new, so they raise the effectiveness of the process itself. Now, why are the other options incorrect? Option A is incorrect. Central storage gathers records but does not set out what responders should do. Option B is incorrect. Endpoint detection finds threats but does not shape the response workflow. Option D is incorrect. Collectors pull in data and do not improve how the response is carried out. Therefore, C, Playbooks, is the correct answer.
Play from 12:33 Question 9. An employee in the finance team opened a questionable attachment, and several workstations soon stopped responding. The SOC has now pinned down the malicious file and where it came from. According to the incident response plan, what comes next? Here are the options. Option A. Recovery. Option B. Response. Option C. Remediation. Option D. Containment. Pause the video now if you want time to think about the answer.
The correct answer is D. Containment. Once the threat has been identified, the priority is to stop it from spreading by isolating affected systems. Containment therefore follows identification, and cleanup and restoration come only afterward. Now, why are the other options incorrect? Option A is incorrect. Recovery happens last, after the threat has been contained and removed. Option B is incorrect. This term is too broad to name a specific phase, and the plan calls for containment at this point. Option C is incorrect. Removing the threat comes after it has been stopped from spreading. Therefore, D, Containment, is the correct answer.
Play from 13:59 Question 10. A university plans to hand encrypted solid-state drives from one department to another. What is the most secure way to make sure no data can be recovered from them? Here are the options. Option A. Passing a strong magnet over the drive. Option B. Filling every cell with random bytes. Option C. Running a utility that overwrites the contents several times. Option D. Securely destroying the drive's encryption keys. Pause the video now if you want time to think about the answer.
The correct answer is D. Securely destroying the drive's encryption keys. When a drive is fully encrypted, destroying the keys makes everything on it unreadable at once. This avoids the unreliability of overwriting flash storage, where spare and remapped areas can retain data. Now, why are the other options incorrect? Option A is incorrect. Degaussing is unreliable on flash storage and can damage the hardware. Option B is incorrect. This takes a long time and is unnecessary when key destruction is available. Option C is incorrect. Overwriting is unreliable on flash because wear leveling and spare areas can retain old data. Therefore, D, Securely destroying the drive's encryption keys, is the correct answer.
Play from 15:31 Question 11. An online store hosted entirely in the cloud is being hit by a skilled, ongoing attack. The security team wants to watch the attacker closely and learn exactly how the intruder works. Which technique is the best choice? Here are the options. Option A. Dark web monitoring. Option B. STIX. Option C. High-interaction honeypots. Option D. User behavior analytics. Pause the video now if you want time to think about the answer.
The correct answer is C. High-interaction honeypots. A high-interaction honeypot looks like a genuine production system and keeps the attacker engaged while recording tools, steps and methods. That gives rich detail on a live, sophisticated campaign that the other options cannot match. Now, why are the other options incorrect? Option A is incorrect. Watching underground forums reveals chatter but does not examine this attack as it unfolds. Option B is incorrect. This is a format for sharing threat intelligence, not a way to study an attack in progress. Option D is incorrect. Behavior analytics spots unusual user activity but gives little insight into an attacker's methods. Therefore, C, High-interaction honeypots, is the correct answer.
Play from 17:11 Question 12. A team is adding code checks to a delivery pipeline for a customer portal. The DevSecOps group must catch coding mistakes in the source before it is built. Which practice is the most relevant? Here are the options. Option A. Scanning the running website for weaknesses. Option B. Software composition analysis. Option C. Runtime application self-protection. Option D. SAST. Pause the video now if you want time to think about the answer.
The correct answer is D. SAST. Static analysis reads the source code without running it, so it can flag coding errors and flaws early in the pipeline. The other choices either look at dependencies or at running software. Now, why are the other options incorrect? Option A is incorrect. Dynamic scanning tests live applications, not the source files in the pipeline. Option B is incorrect. Composition analysis inspects third-party libraries, not mistakes in the team's own code. Option C is incorrect. This protects an application while it runs and is not a source-level check. Therefore, D, SAST, is the correct answer.
Play from 18:40 Question 13. A server at a manufacturer was cut off from the network after a ransomware infection. Which approach gives the safest recovery? Here are the options. Option A. Look for the decryption key and restore files if it turns up. Option B. Use file version history to bring back earlier copies. Option C. Get approval to pay and use the attacker's key. Option D. Roll the machine back to its approved baseline image. Pause the video now if you want time to think about the answer.
The correct answer is D. Roll the machine back to its approved baseline image. Rebuilding from a known-good baseline snapshot removes the malware and anything it changed, leaving a trustworthy system. Restoring individual files or dealing with the criminals leaves doubts about hidden remnants. Now, why are the other options incorrect? Option A is incorrect. Hunting for a key leaves the malware and its changes in place. Option B is incorrect. Previous versions may already have been altered by the attack, and malware traces could remain. Option C is incorrect. Paying is discouraged, offers no assurance the system is clean, and funds criminals. Therefore, D, Roll the machine back to its approved baseline image, is the correct answer.
Play from 20:12 Question 14. A game studio wants to frustrate rivals who try to reverse engineer how its shipped software works, including reusing an analysis of one build against another build. Which technique helps most? Here are the options. Option A. Signing the code. Option B. Diversifying binaries. Option C. Deleting unused code. Option D. Removing debug symbols. Pause the video now if you want time to think about the answer.
The correct answer is B. Diversifying binaries. Producing many differently compiled variants of the program makes reverse engineering far harder, because no two copies expose the logic the same way. The other options do not hide how the code works. Now, why are the other options incorrect? Option A is incorrect. Signing proves who published the code and that it is unchanged but does not conceal its logic. Option C is incorrect. This tidies the program but leaves the working logic fully visible. Option D is incorrect. Stripping symbols takes away some labels, yet the compiled logic can still be studied. Therefore, B, Diversifying binaries, is the correct answer.
Play from 21:43 Question 15. A cloud team wants every new virtual machine to start from the same approved security settings, applied automatically at creation. Which technology should they deploy? Here are the options. Option A. Snort. Option B. CASB. Option C. CMDB. Option D. Ansible. Pause the video now if you want time to think about the answer.
The correct answer is D. Ansible. A configuration management and automation tool can express the security baseline as code and apply it to each machine as it is created, giving consistent results with no manual steps. Now, why are the other options incorrect? Option A is incorrect. This is an intrusion detection engine, not a tool for applying configurations. Option B is incorrect. A CASB enforces policy between users and cloud services and does not push settings onto new machines. Option C is incorrect. A configuration database records what exists but does not apply a baseline on its own. Therefore, D, Ansible, is the correct answer.
Play from 23:06 Question 16. A security team opens tickets to follow remediation work. Which document sets the deadlines for fixing high and critical findings? Here are the options. Option A. MOU. Option B. ISA. Option C. MSA. Option D. SLA. Pause the video now if you want time to think about the answer.
The correct answer is D. SLA. A service level agreement spells out response and resolution times for each priority, so it is the instrument that sets due dates for fixing the most serious findings. Now, why are the other options incorrect? Option A is incorrect. A memorandum of understanding is a loose statement of intent and does not fix remediation deadlines. Option B is incorrect. An information security agreement covers security requirements but is not the usual tool for due dates. Option C is incorrect. A master services agreement gives general contract terms and not specific timelines for fixes. Therefore, D, SLA, is the correct answer.
Play from 24:23 Question 17. Newsletters from a retailer's marketing team keep landing in recipients' junk folders. Investigators find the mail server's certificates were replaced but the related DNS entries were never refreshed. Which three items should be updated? (Choose three.) Here are the options. Option A. DNSSEC. Option B. DKIM. Option C. MX. Option D. SOA. Option E. DMARC. Option F. SAN. Option G. SPF. Option H. SASE. Pause the video now if you want time to think about the answer.
The correct answers are B. DKIM, and E. DMARC, and G. SPF. Receiving servers judge sender legitimacy using the SPF, DKIM and DMARC records published in DNS. Keeping those aligned with the current signing setup restores trust so messages reach inboxes. Now, why are the other options incorrect? Option A is incorrect. DNSSEC protects DNS responses and is not part of verifying email senders. Option C is incorrect. MX records point to the receiving mail servers and do not prove who sent a message. Option D is incorrect. The start of authority record holds zone administration data and plays no part in email authentication. Option F is incorrect. A subject alternative name lives inside a certificate and is not a DNS record for mail authentication. Option H is incorrect. SASE is a network and security architecture, unrelated to these DNS records. Therefore, B and E and G are the correct answers.
Play from 26:28 Question 18. An architect has been told to expose as few network services as possible so that attackers have little to reach. What should be done first? Here are the options. Option A. Restrict who can reach the systems. Option B. Turn on Secure Boot. Option C. Shut down outside integrations. Option D. Carry out attack surface reduction. Pause the video now if you want time to think about the answer.
The correct answer is D. Carry out attack surface reduction. Attack surface reduction is the broad first step of finding and turning off unneeded services, ports and features. The other items are narrower or deal with different problems. Now, why are the other options incorrect? Option A is incorrect. Limiting access controls who connects but leaves the same services exposed. Option B is incorrect. Secure Boot protects the startup process and does not shrink the set of exposed services. Option C is incorrect. This is one piece of reducing exposure rather than the comprehensive first step. Therefore, D, Carry out attack surface reduction, is the correct answer.
Play from 27:52 Question 19. A consultant frequently travels to countries where internet use is closely watched. What is the best way to keep the sites they visit private from network observers? Here are the options. Option A. Private browsing mode. Option B. EAP-TLS. Option C. Geofencing. Option D. DOH. Pause the video now if you want time to think about the answer.
The correct answer is D. DOH. Encrypting DNS lookups inside HTTPS hides which sites a user is resolving from anyone watching the network. Private browsing only clears local history and leaves the network traffic visible. Now, why are the other options incorrect? Option A is incorrect. This only avoids keeping history on the device and does not hide traffic from the network. Option B is incorrect. This protocol authenticates devices to a network and does not conceal browsing. Option C is incorrect. Geofencing limits access by location and does not protect browsing privacy. Therefore, D, DOH, is the correct answer.
Play from 29:17 Question 20. Authentication logs are reaching the SIEM through a working collector, yet every alert the SIEM raises turns out to be false. What is the most likely cause? Here are the options. Option A. Retention settings are wrong. Option B. The indexes have grown too large. Option C. The SIEM lacks enough computing power. Option D. Incoming records are being parsed improperly. Pause the video now if you want time to think about the answer.
The correct answer is D. Incoming records are being parsed improperly. If incoming records are not parsed properly, the SIEM cannot normalize fields or match them to detection rules, which produces wrong alerts. The other issues affect speed or storage rather than alert accuracy. Now, why are the other options incorrect? Option A is incorrect. Retention only controls how long data is kept and does not make alerts inaccurate. Option B is incorrect. Large indexes slow queries but do not cause false alerts. Option C is incorrect. Too little compute leads to lag or missed events rather than only false positives. Therefore, D, Incoming records are being parsed improperly, is the correct answer.
Play from 30:44 Question 21. A cloud analytics provider needs to run calculations on customers' information while holding no decryption key at all. Which cryptographic capability makes this possible? Here are the options. Option A. Envelope encryption. Option B. SAE. Option C. Homomorphic encryption. Option D. AEAD. Pause the video now if you want time to think about the answer.
The correct answer is C. Homomorphic encryption. Homomorphic encryption lets a processor compute on data that stays encrypted, so useful results appear without the plaintext ever being exposed. None of the other options allow working on ciphertext this way. Now, why are the other options incorrect? Option A is incorrect. This wraps data keys inside other keys for easier management and does not allow computing on ciphertext. Option B is incorrect. Simultaneous authentication of equals is a password-based handshake, unrelated to computing on encrypted data. Option D is incorrect. Authenticated encryption protects secrecy and integrity but the data must be decrypted before it can be used. Therefore, C, Homomorphic encryption, is the correct answer.
Play from 32:15 Question 22. After a large scan, an administrator is facing thousands of findings and must decide which weaknesses get fixed first. Which standard provides a severity score to guide that order? Here are the options. Option A. CVE. Option B. CPE. Option C. CVSS. Option D. CCE. Pause the video now if you want time to think about the answer.
The correct answer is C. CVSS. CVSS gives each vulnerability a numeric severity rating based on how exploitable it is and how much damage it could do. Sorting by that score lets the team address the riskiest issues first. Now, why are the other options incorrect? Option A is incorrect. A CVE is just an identifier for a known flaw and carries no severity rating. Option B is incorrect. CPE is a naming scheme for products and says nothing about how serious a flaw is. Option D is incorrect. CCE assigns identifiers to configuration settings and does not rank vulnerabilities. Therefore, C, CVSS, is the correct answer.
Play from 33:44 Question 23. A company wants phones and tablets to prove their health before gaining access, as part of the sign-in and authorization flow. Which measure meets that requirement? Here are the options. Option A. Biometric multifactor prompts at each access attempt. Option B. Central sign-on for every application. Option C. A boundary that isolates all devices outside the office network. Option D. Checking each device's patch state and whether it has been jailbroken. Pause the video now if you want time to think about the answer.
The correct answer is D. Checking each device's patch state and whether it has been jailbroken. Device attestation means checking that a device itself is in a trusted state. Profiling its patch level and whether it has been jailbroken does that, and the result can feed the access decision. Now, why are the other options incorrect? Option A is incorrect. Biometrics prove who the person is and say nothing about the state of the device. Option B is incorrect. Single sign-on centralizes who may enter but does not examine device health. Option C is incorrect. Isolating outside devices is segmentation and does not attest to device integrity. Therefore, D, Checking each device's patch state and whether it has been jailbroken, is the correct answer.
Play from 35:24 Question 24. A bank is threat modeling a critical in-house payments platform. The CISO insists it must stay up 99.999 percent of the time and that users can see only the data they are cleared for. Which framework speaks to both concerns? Here are the options. Option A. TAXII. Option B. STRIDE. Option C. ATT&CK. Option D. CAPEC. Pause the video now if you want time to think about the answer.
The correct answer is B. STRIDE. STRIDE sorts threats into six kinds: impersonation, data modification, deniability, leaks, service disruption and privilege gain. Staying available maps to the service disruption kind, and limiting who sees data maps to the leak and privilege kinds. Now, why are the other options incorrect? Option A is incorrect. This is a protocol for exchanging threat intelligence and not a modeling method. Option C is incorrect. ATT&CK catalogs observed adversary behavior and is not a design-time threat modeling framework. Option D is incorrect. CAPEC lists attack patterns and does not give a structured way to model a system's threats. Therefore, B, STRIDE, is the correct answer.
Play from 37:06 Question 25. Several insurance companies were hit by what looks like the same intrusion and decide to pool what they know. What should they compare to best judge whether one actor is behind all of it? Here are the options. Option A. Malware detonation. Option B. Extracting indicators of compromise. Option C. Code stylometry. Option D. Looking for common TTPs. Pause the video now if you want time to think about the answer.
The correct answer is D. Looking for common TTPs. Tactics, techniques and procedures describe how an actor habitually operates, which is far more distinctive than a single artifact. Matching them across incidents is the strongest sign of a shared adversary. Now, why are the other options incorrect? Option A is incorrect. Detonation shows what a sample does but not who deployed it in each case. Option B is incorrect. Indicators such as addresses and hashes are easily reused or shared by different actors. Option C is incorrect. Stylometry studies coding habits, which may be unavailable or unreliable in shared samples. Therefore, D, Looking for common TTPs, is the correct answer.
Play from 38:36 Question 26. A data architect proposes encrypting data at the record level inside a customer database. What is this approach typically used for? Here are the options. Option A. Encrypting each network packet. Option B. Locking the disk's boot sector. Option C. Protecting separate files. Option D. Protecting database fields. Pause the video now if you want time to think about the answer.
The correct answer is D. Protecting database fields. Record-level encryption, also called field or cell encryption, protects specific sensitive columns or fields inside a database while leaving other data usable. That is its typical purpose. Now, why are the other options incorrect? Option A is incorrect. Packet encryption works on traffic in transit, not on database records. Option B is incorrect. Boot sector protection is a system-level measure and unrelated to database records. Option C is incorrect. File encryption covers whole files and not individual fields inside a database. Therefore, D, Protecting database fields, is the correct answer.
Play from 40:00 Question 27. A regional retailer wants to check, in a hands-on way, whether its tools can detect or block specific techniques that advanced persistent threat groups use, as listed in the MITRE ATT&CK matrix. What should it use? Here are the options. Option A. Honeypot. Option B. Sandbox detonation. Option C. Tabletop exercise. Option D. Penetration test. Pause the video now if you want time to think about the answer.
The correct answer is D. Penetration test. A penetration test actively simulates adversary techniques under control, so it shows whether detection and prevention actually work against those behaviors. The alternatives are discussion, analysis or deception tools. Now, why are the other options incorrect? Option A is incorrect. A honeypot lures attackers to gather intelligence and does not systematically test defenses against listed techniques. Option B is incorrect. Sandboxes safely run samples for analysis and do not test the organization's defenses. Option C is incorrect. A tabletop is a talk-through of decisions and does not exercise technical detection. Therefore, D, Penetration test, is the correct answer.
Play from 41:36 Question 28. Why should an organization begin preparing for post-quantum cryptography now? Here are the options. Option A. To get faster encryption through lightweight algorithms. Option B. To use public-key methods for bulk data. Option C. To keep data safe from being decrypted as computing power grows. Option D. To gain longer keys through key stretching. Pause the video now if you want time to think about the answer.
The correct answer is C. To keep data safe from being decrypted as computing power grows. Quantum computers with enough power could break today's public-key schemes, so data that must stay secret for years is at risk. Moving to algorithms built to resist quantum attacks guards against that future decryption. Now, why are the other options incorrect? Option A is incorrect. Lightweight designs target speed on small devices and are not the reason for post-quantum work. Option B is incorrect. Encrypting large volumes with public-key methods is impractical and is not the aim. Option D is incorrect. Key stretching strengthens passwords and has nothing to do with quantum resistance. Therefore, C, To keep data safe from being decrypted as computing power grows, is the correct answer.
Play from 43:10 Question 29. Developers are patching an application that attackers abused by changing memory protections, and they are adding calls to mprotect() in several places. Which hardware feature must be enabled so those calls can block similar attacks? Here are the options. Option A. HSM. Option B. TPM. Option C. NX bit. Option D. Secure boot. Pause the video now if you want time to think about the answer.
The correct answer is C. NX bit. The mprotect call marks memory pages as non-executable, but the processor must support and enforce that marking through the no-execute capability. Without it, injected code could still run from data areas. Now, why are the other options incorrect? Option A is incorrect. A hardware security module guards cryptographic keys and has no bearing on memory execution rules. Option B is incorrect. A trusted platform module stores keys and attests to state, not enforcing page permissions. Option D is incorrect. Secure boot checks startup components and does not control runtime memory execution. Therefore, C, NX bit, is the correct answer.
Play from 44:39 Question 30. A SOC lead wants to use SOAR to cut down on repetitive administrative work for analysts. Which action best serves that goal? Here are the options. Option A. Adjusting the company's password rules. Option B. Limiting access based on context across the estate. Option C. Enriching alerts using threat intelligence feeds. Option D. Analyzing suspicious files by reading their code. Pause the video now if you want time to think about the answer.
The correct answer is C. Enriching alerts using threat intelligence feeds. Automatically adding threat intelligence context to alerts is a core SOAR function. It saves analysts from looking things up by hand and speeds up triage. Now, why are the other options incorrect? Option A is incorrect. A password policy change is an administrative decision, not something SOAR automates for analysts. Option B is incorrect. Context-based restrictions are access policy work and not routine task automation. Option D is incorrect. Static analysis of malware is a specialist analysis task, not routine administration relief. Therefore, C, Enriching alerts using threat intelligence feeds, is the correct answer.
Play from 46:14 Question 31. A researcher must review every picture and document published on a company's public website for hidden details such as author names and locations. Which tool is best for examining that file metadata? Here are the options. Option A. Ghidra. Option B. OllyDbg. Option C. Volatility. Option D. ExifTool. Pause the video now if you want time to think about the answer.
The correct answer is D. ExifTool. ExifTool is built to read and edit embedded metadata in images and documents. The other tools are for debugging, memory forensics or disassembly, not for pulling out metadata. Now, why are the other options incorrect? Option A is incorrect. Ghidra disassembles binaries and is not meant for reading file metadata. Option B is incorrect. OllyDbg is a debugger for running programs and does not extract metadata. Option C is incorrect. Volatility analyzes memory captures, not document and image metadata. Therefore, D, ExifTool, is the correct answer.
Play from 47:34 Question 32. A manufacturer is building a threat model to find weaknesses across its infrastructure. Which group of systems deserves attention first? Here are the options. Option A. Internet-facing systems with a high score that need local access to exploit. Option B. Internal systems with serious, actively exploited flaws. Option C. Internet-facing systems with known exploited flaws. Option D. Internet-facing systems with a low score and no known exploits. Pause the video now if you want time to think about the answer.
The correct answer is C. Internet-facing systems with known exploited flaws. Systems exposed to the internet are the easiest for outsiders to reach, and flaws that are already being exploited in the wild pose immediate danger. The combination of the two should come first. Now, why are the other options incorrect? Option A is incorrect. A flaw needing local access is far harder to use remotely, so it ranks lower. Option B is incorrect. Internal systems are harder to reach from outside and come after exposed ones. Option D is incorrect. Low risk and no exploitation makes these a lower priority than actively targeted systems. Therefore, C, Internet-facing systems with known exploited flaws, is the correct answer.
Play from 49:13 Question 33. An analyst is turning a penetration tester's findings into CVSS scores to rank the fixes. Which three metric groups go into the overall score? (Choose three.) Here are the options. Option A. Environmental. Option B. Attack vector. Option C. Base. Option D. Confidentiality. Option E. Impact. Option F. Temporal. Option G. Availability. Option H. Integrity. Pause the video now if you want time to think about the answer.
The correct answers are A. Environmental, and C. Base, and F. Temporal. CVSS is built from three groups: Base for intrinsic traits, Temporal for factors that change over time, and Environmental for the organization's own context. The other items are individual metrics inside those groups. Now, why are the other options incorrect? Option B is incorrect. This is one metric inside the Base group, not a group by itself. Option D is incorrect. This is one of the impact metrics, not a metric group. Option E is incorrect. Impact is a collection of metrics inside the Base group rather than a separate group. Option G is incorrect. This is an impact metric, not a metric group. Option H is incorrect. This is an impact metric, not a metric group. Therefore, A and C and F are the correct answers.
Play from 50:55 Question 34. An analyst applying the Diamond Model of Intrusion Analysis has named the adversary, the infrastructure used and the victim. Which remaining core element must be recorded to complete the model? Here are the options. Option A. Methodologies. Option B. Phase. Option C. Capabilities. Option D. Knowledge. Pause the video now if you want time to think about the answer.
The correct answer is C. Capabilities. The model has four core vertices: adversary, capability, infrastructure and victim. With three identified, the missing one is the adversary's capability, meaning the tools and techniques used. Now, why are the other options incorrect? Option A is incorrect. Methodologies are not one of the four core vertices. Option B is incorrect. Phase is a meta-feature about the attack stage and not a core vertex. Option D is incorrect. Knowledge is not a vertex of the model. Therefore, C, Capabilities, is the correct answer.
Play from 52:15 Question 35. A software company ships regular updates worldwide. It wants customers to be able to confirm that each update truly comes from the company and was not altered along the way. Which solution does that? Here are the options. Option A. Application control. Option B. Code signing. Option C. Envelope encryption. Option D. File integrity monitoring. Pause the video now if you want time to think about the answer.
The correct answer is B. Code signing. Code signing attaches a digital signature, so recipients can verify who published the update and that nothing changed after signing. The alternatives do not prove origin and authorization. Now, why are the other options incorrect? Option A is incorrect. Application control limits what may run but does not prove where an update came from. Option C is incorrect. Encryption hides contents but does not show who issued the update. Option D is incorrect. Integrity monitoring spots changes but cannot verify the publisher or authorization. Therefore, B, Code signing, is the correct answer.
Play from 53:38 Question 36. A streaming service is designing its billing system. Subscribers' saved payment methods must be reusable for monthly charges without the application holding the actual card numbers. What is the most appropriate design? Here are the options. Option A. ASLR. Option B. Authenticating application users with tokens. Option C. Self-encrypting drives plus field encryption. Option D. Tokens issued and protected by an HSM. Option E. NX and XN memory protection to limit retention. Pause the video now if you want time to think about the answer.
The correct answer is D. Tokens issued and protected by an HSM. Tokenization swaps card data for tokens that are worthless if stolen, and an HSM securely handles the mapping. The application can still run recurring charges without storing the sensitive values. Now, why are the other options incorrect? Option A is incorrect. This is a memory defense and unrelated to protecting payment data. Option B is incorrect. Token-based sign-in handles user access and does not protect stored payment details. Option C is incorrect. Storing the actual encrypted card data keeps actual payment information in the system, which is less desirable. Option E is incorrect. These are memory execution controls and do not address payment data. Therefore, D, Tokens issued and protected by an HSM, is the correct answer.
Play from 55:25 Question 37. Governments and large firms are rolling out new encryption algorithms because of progress in quantum computing. What is the main reason? Here are the options. Option A. Quantum machines will let criminals capture network traffic instantly. Option B. Algorithms built on large prime numbers will become breakable. Option C. Zero trust designs will demand homomorphic encryption. Option D. Forward secrecy will stop firewalls from inspecting traffic. Pause the video now if you want time to think about the answer.
The correct answer is B. Algorithms built on large prime numbers will become breakable. A sufficiently powerful quantum computer could factor the large numbers that today's public-key algorithms depend on, which would break them. That threat is what drives the move to new algorithms. Now, why are the other options incorrect? Option A is incorrect. Quantum computers do not enable instant capture, and the worry is future decryption of recorded data. Option C is incorrect. Zero trust does not require homomorphic encryption. Option D is incorrect. Forward secrecy is a desirable property and is not the reason for new algorithms. Therefore, B, Algorithms built on large prime numbers will become breakable, is the correct answer.
Play from 56:57 Question 38. A developer wants people installing its application to be able to check that it is genuine. What is the best way to meet that objective? Here are the options. Option A. Private keys. Option B. Key escrow. Option C. Non-repudiation. Option D. Code signing. Pause the video now if you want time to think about the answer.
The correct answer is D. Code signing. With code signing, the developer signs the program with a private key and users verify it with the matching public key. That confirms the origin and shows the code was not tampered with. Now, why are the other options incorrect? Option A is incorrect. Users need the public key to verify, and sharing private keys would destroy security. Option B is incorrect. Escrow deposits keys with a third party and does not prove software authenticity. Option C is incorrect. This stops a signer from denying their action but does not help users verify the software. Therefore, D, Code signing, is the correct answer.
Play from 58:19 Question 39. A defense agency wants an encryption technique that will stand up best to attacks from future quantum computers. Which is the strongest choice? Here are the options. Option A. Zero-knowledge proofs. Option B. AEAD. Option C. Elliptic curve. Option D. Lattice-based. Pause the video now if you want time to think about the answer.
The correct answer is D. Lattice-based. Lattice-based schemes depend on math problems that remain hard even for quantum machines, and they underpin the post-quantum standards. The other options are vulnerable or are not designed for this purpose. Now, why are the other options incorrect? Option A is incorrect. These are proof techniques and are not by themselves a quantum-resistant encryption method. Option B is incorrect. An authenticated symmetric mode is not designed as a long-term quantum-resistant solution. Option C is incorrect. Elliptic curve schemes can be broken by Shor's algorithm on a quantum computer. Therefore, D, Lattice-based, is the correct answer.
Play from 59:42 Question 40. A company already runs an IDS, a firewall and a DLP product, and the administrator wants these tools to work together so incidents are handled faster. What should be used? Here are the options. Option A. CMDB. Option B. XCCDF. Option C. CWPP. Option D. SOAR. Pause the video now if you want time to think about the answer.
The correct answer is D. SOAR. SOAR platforms connect separate security tools, automate workflows and coordinate actions, which removes manual handoffs and shortens response time. Now, why are the other options incorrect? Option A is incorrect. A configuration database stores asset records and cannot orchestrate or automate. Option B is incorrect. XCCDF is a format for configuration checklists, not a platform for linking tools. Option C is incorrect. A workload protection platform secures cloud workloads and does not tie existing tools together. Therefore, D, SOAR, is the correct answer.
Play from 1:01:08 Question 41. A small change to a memory handling routine caused a leak at a busy video platform. During the evening peak, several web servers ran out of memory and the site went down. Which testing technique would most efficiently prevent a repeat? Here are the options. Option A. Smoke. Option B. Canary. Option C. Load. Option D. Regression. Pause the video now if you want time to think about the answer.
The correct answer is C. Load. Load testing recreates peak demand and keeps the system under heavy use, which exposes memory leaks and resource exhaustion before release. The other techniques do not push the system the same way. Now, why are the other options incorrect? Option A is incorrect. Smoke tests only confirm the basics work and do not stress resources. Option B is incorrect. A canary release tests changes on a small slice of live users, whereas load testing catches memory problems before production. Option D is incorrect. Regression tests confirm old features still work but do not reveal leaks under heavy demand. Therefore, C, Load, is the correct answer.
Play from 1:02:38 Question 42. A company's board has told the CISO to set up a vendor risk management program. What is the underlying reason for that request? Here are the options. Option A. Vulnerability management. Option B. Better support availability. Option C. Transferring risk. Option D. Supply chain visibility. Pause the video now if you want time to think about the answer.
The correct answer is D. Supply chain visibility. Companies depend on many outside suppliers, and their weaknesses become the company's own. A vendor management program gives the board visibility into the supply chain and the risks it carries. Now, why are the other options incorrect? Option A is incorrect. Vulnerability management is an internal practice and not the reason for a vendor program. Option B is incorrect. Support responsiveness is an operational matter, not a board-level driver for this program. Option C is incorrect. Transferring risk through insurance or contracts is an outcome, not the reason a program is needed. Therefore, D, Supply chain visibility, is the correct answer.
Play from 1:04:03 Question 43. An analytics firm offers a service that processes clients' information and returns insights, yet its staff can never view the underlying records. What technology is the firm using? Here are the options. Option A. Machine learning. Option B. A data lake. Option C. Asymmetric key encryption. Option D. Homomorphic encryption. Pause the video now if you want time to think about the answer.
The correct answer is D. Homomorphic encryption. Homomorphic encryption allows computation directly on ciphertext, so insights can be produced while the raw records stay hidden from the processor. None of the others provide that property. Now, why are the other options incorrect? Option A is incorrect. Machine learning describes analysis methods, not a way to hide the data from the analyst. Option B is incorrect. A data lake is only a large repository and does not conceal data during analysis. Option C is incorrect. Public-key encryption protects data but it must be decrypted before analysis, exposing it. Therefore, D, Homomorphic encryption, is the correct answer.
Play from 1:05:30 Question 44. An online retailer runs separate web, application and database layers and wants to harden how those layers talk to each other. What is the best solution? Here are the options. Option A. Making a firewall the core of the network. Option B. Using SASE to limit user connections to servers. Option C. Adding a VPN to keep remote sites away from server VLANs. Option D. Applying microsegmentation to the server VLANs. Pause the video now if you want time to think about the answer.
The correct answer is D. Applying microsegmentation to the server VLANs. Microsegmentation applies fine-grained rules so each tier only exchanges the traffic it needs. That limits lateral movement inside the environment, which is the main hardening aim here. Now, why are the other options incorrect? Option A is incorrect. A central firewall helps the perimeter but does not give internal separation between the tiers. Option B is incorrect. SASE governs user-to-resource access and not server-to-server traffic between tiers. Option C is incorrect. A VPN handles remote access and does not separate the tiers internally. Therefore, D, Applying microsegmentation to the server VLANs, is the correct answer.
Play from 1:07:04 Question 45. A security team hears that malware is attacking firms in its sector. It wants to build a thorough set of indicators of compromise so it can check its own systems. What should it use to produce the list? Here are the options. Option A. EDR. Option B. Sandbox detonation. Option C. Simulators. Option D. Antivirus. Pause the video now if you want time to think about the answer.
The correct answer is B. Sandbox detonation. Running samples inside an isolated sandbox lets analysts watch the file, network and registry activity, which yields concrete indicators such as addresses, domains and hashes to hunt for. Now, why are the other options incorrect? Option A is incorrect. EDR watches endpoints for attacks in progress and does not systematically produce an indicator list from samples. Option C is incorrect. Simulators model behavior and do not run live malware to reveal genuine indicators. Option D is incorrect. Antivirus matches known signatures and does not create new, detailed indicators. Therefore, B, Sandbox detonation, is the correct answer.
Play from 1:08:33 Question 46. Which AI risk is most effectively reduced by cleaning and validating user input before it reaches the model? Here are the options. Option A. Data poisoning. Option B. A model that cannot be explained. Option C. Prompt injection. Option D. Model inversion. Pause the video now if you want time to think about the answer.
The correct answer is C. Prompt injection. Prompt injection works by slipping hostile instructions into the text a model receives. Sanitizing inputs removes or blocks those instructions before they can steer the model. Now, why are the other options incorrect? Option A is incorrect. Poisoning corrupts training data, which input cleaning at query time cannot undo. Option B is incorrect. Explainability is a transparency issue and not solved by sanitizing input. Option D is incorrect. Inversion recovers training data from outputs, which sanitizing inputs does not prevent. Therefore, C, Prompt injection, is the correct answer.
Play from 1:09:53 Question 47. An architect wants the company's mail gateway to keep a current list of known-bad indicators and drop matching messages automatically. What will the architect most likely need? Here are the options. Option A. Webhooks. Option B. Code that deletes messages from inboxes. Option C. Threat feed API. Option D. Security runbook. Option E. Log analyzer. Option F. Scheduled task. Pause the video now if you want time to think about the answer.
The correct answer is C. Threat feed API. A threat feed API supplies fresh indicators from intelligence sources on a continuing basis, so the mail server can ingest them and block matching messages without manual updates. Now, why are the other options incorrect? Option A is incorrect. Webhooks can push notifications but are not the main way to maintain an indicator list from a feed. Option B is incorrect. This is an action taken after detection, not a source of indicator data. Option D is incorrect. A runbook records procedures and does not fetch or update indicators. Option E is incorrect. A log analyzer reads existing logs and does not supply indicator updates. Option F is incorrect. A scheduled task can trigger updates but does not provide the indicator data itself. Therefore, C, Threat feed API, is the correct answer.
Play from 1:11:39 Question 48. A cloud provider warns a customer about a surge in phishing and recommends sending staff announcements and building basic security know-how. Which solution best matches that advice? Here are the options. Option A. Running tabletop exercises. Option B. Staging simulated attacks. Option C. Strengthening crisis management. Option D. Setting up a security awareness program. Pause the video now if you want time to think about the answer.
The correct answer is D. Setting up a security awareness program. A security awareness program delivers regular communications and basic training to every employee, which is exactly what the provider recommended against phishing. Now, why are the other options incorrect? Option A is incorrect. Tabletops prepare response teams and do not build basic competence in all staff. Option B is incorrect. Simulated attacks test staff and go beyond building basic awareness. Option C is incorrect. Crisis management handles incidents after they occur rather than preparing employees. Therefore, D, Setting up a security awareness program, is the correct answer.
Play from 1:13:07 Question 49. A company's finance chief gets a call from a person who sounds just like the CEO, claiming to be stuck abroad and urgently needing money wired. Something feels off. What type of attack is this? Here are the options. Option A. Spear phishing. Option B. Smishing. Option C. Automated exploit generation. Option D. Deepfake. Pause the video now if you want time to think about the answer.
The correct answer is D. Deepfake. Artificial intelligence can clone a voice so a caller sounds like the actual executive. That synthetic impersonation is a deepfake attack. Now, why are the other options incorrect? Option A is incorrect. Spear phishing is a targeted message, usually email, rather than a call using a cloned voice. Option B is incorrect. Smishing is delivered by text message and not by a phone call. Option C is incorrect. This is about software that creates exploits and does not involve voice impersonation. Therefore, D, Deepfake, is the correct answer.
Play from 1:14:29 Question 50. Customer contracts require a software firm's applications to be assessed by an outside auditor for vulnerabilities. What should the firm do before engaging the outside auditor? Here are the options. Option A. Choose the samples to be tested. Option B. Do an in-house readiness assessment. Option C. Record what was learned from the audit. Option D. Collect the evidence for the audit. Pause the video now if you want time to think about the answer.
The correct answer is B. Do an in-house readiness assessment. An internal assessment lets the firm find and fix obvious gaps, confirm documentation and understand its current controls, so the external audit goes smoothly. Now, why are the other options incorrect? Option A is incorrect. Selecting samples belongs to carrying out the audit, not to preparing for it. Option C is incorrect. Lessons learned come after the audit is finished. Option D is incorrect. Evidence gathering takes place during the audit rather than before choosing an auditor. Therefore, B, Do an in-house readiness assessment, is the correct answer.
Play from 1:15:54 Question 51. A utility has a large fleet of aging servers and must decide the order of replacement. The decision will rest on how likely each machine is to fail, regardless of how important its application is. Which measure should be used? Here are the options. Option A. TCO. Option B. MSA. Option C. MTTR. Option D. SLE. Option E. MTBF. Pause the video now if you want time to think about the answer.
The correct answer is E. MTBF. Mean time between failures indicates how often a system is expected to fail, so it ranks servers by failure likelihood. The other terms describe repair speed, cost or contracts. Now, why are the other options incorrect? Option A is incorrect. Total cost of ownership looks at lifetime spending and does not measure failure likelihood. Option B is incorrect. A master services agreement is a contract document unrelated to predicting failures. Option C is incorrect. Mean time to repair measures recovery speed, not how likely a failure is. Option D is incorrect. Single loss expectancy estimates cost per incident and depends on criticality, which the plan ignores. Therefore, E, MTBF, is the correct answer.
Play from 1:17:30 Question 52. A hospital is retiring aging servers and disks that stored patient records. Which disposal method gives the strongest assurance that nothing can leak? Here are the options. Option A. Degaussing. Option B. Shredding. Option C. Clearing. Option D. Purging. Pause the video now if you want time to think about the answer.
The correct answer is B. Shredding. Physically shredding the media destroys it so that data cannot be recovered. Clearing, purging and degaussing are sanitization methods that leave the drive intact and are less certain. Now, why are the other options incorrect? Option A is incorrect. Magnetic erasure is not reliable on every drive type and is less certain than destruction. Option C is incorrect. Overwriting leaves the drive in one piece and may not be enough for very sensitive data. Option D is incorrect. Purging sanitizes the media but leaves it intact and open to forensic attempts. Therefore, B, Shredding, is the correct answer.
Play from 1:18:52 Question 53. A newspaper wants a process so people can ask for inaccurate personal information to be traced and removed from its published articles, under the legal right of erasure. Which regulation is it addressing? Here are the options. Option A. CCPA. Option B. DORA. Option C. GDPR. Option D. COPPA. Pause the video now if you want time to think about the answer.
The correct answer is C. GDPR. The GDPR contains the right to erasure, often called the right to be forgotten, which lets people ask organizations to delete their personal data. Now, why are the other options incorrect? Option A is incorrect. California's law grants privacy rights but lacks the same explicit right to be forgotten. Option B is incorrect. DORA deals with digital operational resilience for financial firms, not erasure rights. Option D is incorrect. COPPA protects children's privacy online and does not create a general right to be forgotten. Therefore, C, GDPR, is the correct answer.
Play from 1:20:15 Question 54. An administrator must automate reports from several security products that cannot talk to each other, using only resources the company already owns. What is the best approach? Here are the options. Option A. Buying ready-made aggregation software. Option B. Moving usage logs to on-premises storage. Option C. Merging application back-end stores into one relational database. Option D. Setting up an API integration to pull the data together. Pause the video now if you want time to think about the answer.
The correct answer is D. Setting up an API integration to pull the data together. Connecting the products through their APIs lets data flow into one place with existing tools and no major rebuild, which meets the automation goal. Now, why are the other options incorrect? Option A is incorrect. Purchasing new software goes against the instruction to use existing resources. Option B is incorrect. Relocating logs does not automate reporting or connect the products. Option C is incorrect. This would require heavy restructuring and does not fix the lack of communication. Therefore, D, Setting up an API integration to pull the data together, is the correct answer.
Play from 1:21:49 Question 55. An engineer needs to run commands every day on a UNIX server and can only use what comes installed by default. Which two tools should be used? (Choose two.) Here are the options. Option A. Task Scheduler. Option B. Bash. Option C. Python. Option D. PowerShell. Option E. Ansible. Option F. Cron. Pause the video now if you want time to think about the answer.
The correct answers are B. Bash, and F. Cron. Cron is the standard built-in scheduler for recurring jobs, and Bash is the default shell for scripting the commands. Together they automate the work without installing anything. Now, why are the other options incorrect? Option A is incorrect. This is a Windows feature and does not exist on UNIX. Option C is incorrect. Python may not be installed by default and may need to be added. Option D is incorrect. PowerShell is mainly a Windows tool and is not a standard default on UNIX. Option E is incorrect. Ansible must be installed and configured separately. Therefore, B and F are the correct answers.
Play from 1:23:13 Question 56. A manufacturer brings in an outside consultant to lead a simulated cyber incident so that gaps are uncovered and stakeholders know their roles. What is this activity called? Here are the options. Option A. Business impact analysis. Option B. Lessons learned. Option C. Walk-through review. Option D. Tabletop exercise. Pause the video now if you want time to think about the answer.
The correct answer is D. Tabletop exercise. A tabletop exercise is a guided, discussion-based simulation in which participants talk through a hypothetical incident, which reveals gaps and prepares people without touching live systems. Now, why are the other options incorrect? Option A is incorrect. A business impact analysis estimates consequences of disruption and is not a simulation. Option B is incorrect. Lessons learned reviews an incident that already happened. Option C is incorrect. A walk-through is a more passive review of documents and not an interactive simulation. Therefore, D, Tabletop exercise, is the correct answer.
Play from 1:24:40 Question 57. A consultant is advising a small shop with one wireless access point, one network name and no guest access. The shop is in a busy area and wants minimal administration. Which wireless security setup should be recommended? Here are the options. Option A. WPA3-Enterprise. Option B. WPA2-Enterprise. Option C. WPA2-TKIP. Option D. WPA3-Personal. Pause the video now if you want time to think about the answer.
The correct answer is D. WPA3-Personal. WPA3-Personal gives strong modern protection with a shared passphrase and no extra servers, so it suits a small site that wants little administration. The enterprise options need a RADIUS server and certificates. Now, why are the other options incorrect? Option A is incorrect. This needs authentication servers and certificates, too much overhead for a tiny shop. Option B is incorrect. This also requires a RADIUS server and certificate infrastructure. Option C is incorrect. TKIP is outdated and no longer considered secure. Therefore, D, WPA3-Personal, is the correct answer.
Play from 1:26:18 Question 58. A senior architect wants to shape the company's defenses around the standard catalog of tactics and techniques that adversaries are commonly seen using. What would best support this? Here are the options. Option A. Closed-source intelligence reporting. Option B. MITRE ATT&CK. Option C. OSINT analysis. Option D. Generating deepfakes. Option E. The Diamond Model. Pause the video now if you want time to think about the answer.
The correct answer is B. MITRE ATT&CK. MITRE ATT&CK is a standardized knowledge base of observed adversary tactics and techniques, which is the right basis for planning defenses against common behavior. Now, why are the other options incorrect? Option A is incorrect. Proprietary reports lack the standard, community-built structure ATT&CK offers. Option C is incorrect. Open-source research collects information but is not a standard catalog of techniques. Option D is incorrect. This is a deceptive technique and does not help plan defenses. Option E is incorrect. The Diamond Model examines individual intrusions and is not a broad catalog of techniques. Therefore, B, MITRE ATT&CK, is the correct answer.
Play from 1:27:53 Question 59. A compliance manager is preparing a risk identification effort and wants business leaders to discuss the critical assets, key processes and likely points of failure. Which topic is most relevant for those discussions? Here are the options. Option A. Appetite and tolerance for risk. Option B. Subprocessor risks. Option C. Remediation strategies. Option D. Risk acceptance criteria. Pause the video now if you want time to think about the answer.
The correct answer is A. Appetite and tolerance for risk. Risk appetite and tolerance set how much exposure the business will accept, which frames which assets and failures matter most and how risks will be prioritized. Now, why are the other options incorrect? Option B is incorrect. These concern outside vendors and are not central to identifying critical assets and failure points. Option C is incorrect. Remediation comes after risks are identified and assessed. Option D is incorrect. Acceptance criteria are an output of assessment, not a starting point for identifying assets. Therefore, A, Appetite and tolerance for risk, is the correct answer.
Play from 1:29:24 Question 60. Why do organizations favor software that has been digitally signed? (Choose two.) Here are the options. Option A. It guarantees the code contains no malware. Option B. It makes the code work with DRM systems. Option C. It confirms the code has not changed. Option D. It proves who the recipient is. Option E. It adds secrecy to the code. Option F. It assures where the code came from. Pause the video now if you want time to think about the answer.
The correct answers are C. It confirms the code has not changed, and F. It assures where the code came from. A digital signature shows who published the code and also proves that it has not changed since it was signed. It does not hide content or guarantee the code is harmless. Now, why are the other options incorrect? Option A is incorrect. A signature does not mean the code is safe, since malicious code can be signed too. Option B is incorrect. Signing is separate from digital rights management. Option D is incorrect. Signing authenticates the publisher, not the recipient. Option E is incorrect. Signing offers authenticity and integrity and does not keep content secret. Therefore, C and F are the correct answers.
Play from 1:31:00 Question 61. Following a major outage, a SOC analyst is asked to produce a guide that the whole team can follow whenever a similar event happens again. Which document should be written? Here are the options. Option A. Communication plan. Option B. Lessons learned. Option C. Root cause analysis. Option D. Runbook. Pause the video now if you want time to think about the answer.
The correct answer is D. Runbook. A runbook lays out step-by-step actions for handling a particular type of incident, so the team can respond the same way every time. The other items look backward or cover other topics. Now, why are the other options incorrect? Option A is incorrect. A communication plan covers who gets notified and not the technical response steps. Option B is incorrect. Lessons learned is a post-incident review rather than a forward-looking step-by-step guide. Option C is incorrect. Root cause analysis explains why something happened and gives no procedure for the future. Therefore, D, Runbook, is the correct answer.
Play from 1:32:20 Question 62. A company wants digitally signed approvals to support its change management process. Which capability does PKI offer for such messages? Here are the options. Option A. Attestation. Option B. Delivery receipts. Option C. Confidentiality. Option D. Non-repudiation. Pause the video now if you want time to think about the answer.
The correct answer is D. Non-repudiation. A signature created with a private key ties a message to its sender, so the sender cannot later deny it. This non-repudiation makes approvals accountable, while the other items are not core PKI services for messages. Now, why are the other options incorrect? Option A is incorrect. Attestation is not one of the standard services that PKI provides for messages. Option B is incorrect. Receipts belong to messaging systems and are not a PKI function. Option C is incorrect. Secrecy relies on encryption and is not the capability asked about for signed approvals. Therefore, D, Non-repudiation, is the correct answer.
Play from 1:33:47 Question 63. A mail administrator wants outgoing messages to carry a cryptographic signature made with the company's private key, so recipients can check them against a published public key. What should be configured? Here are the options. Option A. TLS. Option B. DMARC. Option C. DKIM. Option D. SPF. Pause the video now if you want time to think about the answer.
The correct answer is C. DKIM. DKIM signs outgoing mail with the organization's private key and publishes the public key in DNS so receivers can verify it. SPF lists sending servers, DMARC sets policy, and TLS only protects transport. Now, why are the other options incorrect? Option A is incorrect. TLS encrypts the connection and does not sign individual messages. Option B is incorrect. DMARC enforces policy based on SPF and DKIM but does not do the signing. Option D is incorrect. SPF validates the sending server's address and does not involve signing with a private key. Therefore, C, DKIM, is the correct answer.
Play from 1:35:20 Question 64. An online bank worries about attackers chaining existing code fragments in its web servers, a technique called return-oriented programming. Which defense should be enabled on the servers? Here are the options. Option A. TPM. Option B. HSM. Option C. ASLR. Option D. IDS. Pause the video now if you want time to think about the answer.
The correct answer is C. ASLR. Return-oriented attacks depend on knowing where code fragments sit in memory. Address space layout randomization changes those locations on each run, making reliable chaining very difficult. Now, why are the other options incorrect? Option A is incorrect. A TPM manages keys and platform integrity and does not stop return-oriented attacks. Option B is incorrect. A hardware security module handles cryptographic operations, not exploit mitigation in application memory. Option D is incorrect. An IDS only detects attacks and does not block this exploitation technique. Therefore, C, ASLR, is the correct answer.
Play from 1:36:45 Question 65. A company rolling out a new data protection platform wants to be sure that approved alterations to its systems are carefully planned, reviewed and carried out. Which process provides this? Here are the options. Option A. Network management. Option B. Change management. Option C. Risk management. Option D. Configuration management. Pause the video now if you want time to think about the answer.
The correct answer is B. Change management. Change management is the disciplined process in which modifications are documented, approved, tested and executed in a controlled way, which keeps approved alterations safe. Now, why are the other options incorrect? Option A is incorrect. Network management covers day-to-day network operations and not the approval of changes. Option C is incorrect. Risk management is broader and does not itself manage how approved changes are executed. Option D is incorrect. Configuration management records settings and does not govern how changes are planned and executed. Therefore, B, Change management, is the correct answer.
Play from 1:38:12 Question 66. A payments team needs to be sure an instruction arrives exactly as the sender wrote it. Which security property covers this? Here are the options. Option A. Non-repudiation alone. Option B. Availability. Option C. Confidentiality. Option D. Integrity. Pause the video now if you want time to think about the answer.
The correct answer is D. Integrity. Integrity means data has not been altered, and it is usually checked with hashes or message authentication codes. The other properties address secrecy, access or proof of origin. Now, why are the other options incorrect? Option A is incorrect. Non-repudiation shows who sent something and not whether it was changed. Option B is incorrect. Availability is about having access when needed. Option C is incorrect. Confidentiality prevents unauthorized disclosure. Therefore, D, Integrity, is the correct answer.
Play from 1:39:26 Question 67. Staff are reporting a flood of late-night MFA approval pushes they did not trigger, and the team suspects an attacker is hoping someone taps accept just to make them stop. Which change would best limit this? Here are the options. Option A. Switching to text message codes. Option B. Sending one-time codes by email. Option C. Issuing FIDO2 hardware keys. Option D. Switching to prompt-driven MFA that needs a deliberate response. Pause the video now if you want time to think about the answer.
The correct answer is D. Switching to prompt-driven MFA that needs a deliberate response. A prompt that requires the person to actively respond, rather than simply tapping approve on a push, stops attackers from succeeding by spamming requests. The user has to deliberately confirm each attempt. Now, why are the other options incorrect? Option A is incorrect. Text codes can still be spammed and give no active confirmation. Option B is incorrect. Email codes share the same spam weakness. Option C is incorrect. Hardware keys improve strength but do not restrict the volume or timing of requests. Therefore, D, Switching to prompt-driven MFA that needs a deliberate response, is the correct answer.
Play from 1:41:02 Question 68. What are two risks that come with vendor lock-in? (Choose two.) Here are the options. Option A. The customer gets interoperability with many platforms. Option B. The customer can spread workloads over several clouds. Option C. The vendor's service quality may decline for the customer. Option D. The customer can easily move its data. Option E. The vendor may alter what it offers. Option F. The customer is guaranteed adequate service. Pause the video now if you want time to think about the answer.
The correct answers are C. The vendor's service quality may decline for the customer, and E. The vendor may alter what it offers. With few alternatives, a locked-in customer is exposed to the vendor changing its products or terms and to a decline in service quality. The remaining statements describe benefits or ways of avoiding lock-in. Now, why are the other options incorrect? Option A is incorrect. More interoperability reduces lock-in and is not a risk of it. Option B is incorrect. Using multiple clouds is a way to reduce lock-in. Option D is incorrect. Easy data movement is the opposite of lock-in. Option F is incorrect. No guarantee exists under lock-in, and service levels are actually at risk. Therefore, C and E are the correct answers.
Play from 1:42:40 Question 69. A company is deploying PKI and needs two systems to verify each other's identity. What should be implemented for this mutual authentication? Here are the options. Option A. A private key shared by both sides. Option B. Each side holds the other's public key. Option C. A secret shared between both ends. Option D. Forward secrecy on both ends. Option E. A single public key used by both. Pause the video now if you want time to think about the answer.
The correct answer is B. Each side holds the other's public key. In mutual authentication both sides hold their own key pair and certificate, and each verifies the other's public key. No secrets are shared, which is the PKI principle. Now, why are the other options incorrect? Option A is incorrect. Sharing private keys breaks the fundamental rule of PKI. Option C is incorrect. Shared secrets are not how PKI works, which relies on key pairs. Option D is incorrect. Forward secrecy protects session keys and does not provide mutual authentication. Option E is incorrect. A common key would make the two parties indistinguishable, defeating mutual authentication. Therefore, B, Each side holds the other's public key, is the correct answer.
Play from 1:44:16 Question 70. Which source offers prescriptive best practices that a team can use to check the configuration of its perimeter firewalls? Here are the options. Option A. ISO 27001. Option B. NIST CSF. Option C. CIS controls. Option D. MITRE ATT&CK. Pause the video now if you want time to think about the answer.
The correct answer is C. CIS controls. The CIS Controls give specific, prioritized safeguards, including guidance on network perimeter defenses and firewall configuration. The other options are broader frameworks or standards. Now, why are the other options incorrect? Option A is incorrect. ISO 27001 is a management system standard focused on processes, not technical configuration guidance. Option B is incorrect. The NIST framework is a high-level risk approach and not specific firewall configuration advice. Option D is incorrect. ATT&CK describes adversary behavior rather than configuration best practices. Therefore, C, CIS controls, is the correct answer.
Play from 1:45:47 Question 71. An on-premises web application struggles whenever traffic spikes, and the team wants to move it to a serverless design. Which cloud benefit should they take advantage of? Here are the options. Option A. Lower hosting costs. Option B. Automatic provisioning of resources. Option C. Not having to patch. Option D. Hosting spread across regions. Pause the video now if you want time to think about the answer.
The correct answer is B. Automatic provisioning of resources. Serverless platforms allocate and release resources automatically as demand changes, which solves the scaling problem without manual work. The other benefits do not target scaling. Now, why are the other options incorrect? Option A is incorrect. Savings may follow but they are not the benefit that fixes scaling. Option C is incorrect. Reduced patching is a side benefit that does not address scaling. Option D is incorrect. Geographic redundancy is a separate concern from scaling. Therefore, B, Automatic provisioning of resources, is the correct answer.
Play from 1:47:07 Question 72. A developer wants stronger protection for stored passwords in a web application while keeping the existing cryptographic module in place. Which technique fits best? Here are the options. Option A. Key rotation. Option B. Key escrow. Option C. Key splitting. Option D. Key stretching. Option E. Key encryption. Pause the video now if you want time to think about the answer.
The correct answer is D. Key stretching. Key stretching makes password hashing deliberately costly through repeated iterations or memory use, which makes brute-force guessing much harder without replacing the module. Now, why are the other options incorrect? Option A is incorrect. Rotation swaps keys on a schedule and does not make password storage stronger. Option B is incorrect. Escrow keeps backup copies of keys and is not a password hardening technique. Option C is incorrect. Splitting divides a key into shares and does not strengthen password hashing. Option E is incorrect. Encrypting keys protects the keys themselves and does not improve password hashing. Therefore, D, Key stretching, is the correct answer.
Play from 1:48:42 Question 73. A company's executives will visit a country suspected of copying intellectual property from visitors' laptops. What is the best way to protect the company's data on the trip? Here are the options. Option A. Putting tamper-evident stickers over the laptop screws. Option B. Using clean loaner devices that connect to a virtual desktop. Option C. Using drives that encrypt themselves. Option D. Reporting firmware changes with measured boot. Pause the video now if you want time to think about the answer.
The correct answer is B. Using clean loaner devices that connect to a virtual desktop. If the executives carry clean, sanitized devices and reach company data only through a virtual desktop, nothing valuable is stored on the laptops, so seizure or copying yields little. Now, why are the other options incorrect? Option A is incorrect. Stickers reveal tampering but do not stop a determined actor from copying data. Option C is incorrect. Encrypted drives help if a laptop is lost but do not stop seizure and forensic attempts. Option D is incorrect. Measured boot detects firmware changes but does not prevent data theft. Therefore, B, Using clean loaner devices that connect to a virtual desktop, is the correct answer.
Play from 1:50:17 Question 74. Purchasing staff will now receive emails containing links to order requests, and the company wants to protect that process without slowing down orders. What is the best option? Here are the options. Option A. Filtering by DNS. Option B. Blocking every link that could be malicious. Option C. Training staff on awareness. Option D. Isolating browsing in a remote container. Pause the video now if you want time to think about the answer.
The correct answer is D. Isolating browsing in a remote container. Browser isolation opens links in a separate protected environment, so staff can still reach legitimate requests while malicious content never touches their machines. Blocking or filtering would interrupt orders. Now, why are the other options incorrect? Option A is incorrect. DNS filtering cannot selectively allow the legitimate links and risks disrupting the workflow. Option B is incorrect. Blanket blocking would stop legitimate purchase links and disrupt business. Option C is incorrect. Training alone gives no technical protection against sophisticated or zero-day attacks. Therefore, D, Isolating browsing in a remote container, is the correct answer.
Play from 1:51:50 Question 75. A lender plans to let an AI system set interest rates for customers with no human in the loop. What should worry it most from a regulatory standpoint? Here are the options. Option A. Susceptibility to social engineering. Option B. Stolen credentials. Option C. Whether the model's decisions can be explained. Option D. Prompt injection. Pause the video now if you want time to think about the answer.
The correct answer is C. Whether the model's decisions can be explained. Regulators expect lenders to be able to explain how automated decisions are reached and to show they are fair. A model that cannot be explained is therefore the main regulatory concern. Now, why are the other options incorrect? Option A is incorrect. Social engineering is a general threat and not the regulatory concern of automated lending. Option B is incorrect. Credential theft is a general risk and not specific to regulation of automated decisions. Option D is incorrect. Prompt injection concerns language models and is not the core issue for rate decisions. Therefore, C, Whether the model's decisions can be explained, is the correct answer.
Play from 1:53:21 Question 76. A scan of Linux servers with several network cards each reports the same flaw once per card, inflating the total. What should the engineer do to remove the duplicates and tie findings to one host? Here are the options. Option A. Run a network mapping scan. Option B. Run a discovery scan. Option C. A SCAP-based scanner. Option D. Install an agent on the hosts. Pause the video now if you want time to think about the answer.
The correct answer is D. Install an agent on the hosts. An agent runs on the machine itself and reports under one host identity, so the same flaw is not counted once per network card. Network-based scans see each interface as a separate target. Now, why are the other options incorrect? Option A is incorrect. A mapping tool finds hosts and does not resolve duplicates across interfaces. Option B is incorrect. Discovery identifies devices but does not merge findings across interfaces. Option C is incorrect. SCAP scanning alone does not give each machine a unique identity to merge results. Therefore, D, Install an agent on the hosts, is the correct answer.
Play from 1:54:52 Question 77. A project manager is preparing a software rollout and has listed every role involved at each stage. Which tool should be used to keep track of who does what? Here are the options. Option A. ITIL. Option B. RACI matrix. Option C. Recall tree. Option D. CMDB. Pause the video now if you want time to think about the answer.
The correct answer is B. RACI matrix. A RACI matrix records who is responsible, accountable, consulted and informed for each task or phase, so it is the standard way to track roles and duties. Now, why are the other options incorrect? Option A is incorrect. ITIL is a service management framework and not a tool for tracking project roles. Option C is incorrect. A recall tree is a notification list and not a way to track project roles. Option D is incorrect. A CMDB tracks assets and their relationships rather than who is responsible for tasks. Therefore, B, RACI matrix, is the correct answer.
Play from 1:56:15 Question 78. After meeting with its industry sharing group, a company wants to find out how well its security controls stand up against a handful of sophisticated threat actors. What will let the security team do this? Here are the options. Option A. Internal reconnaissance. Option B. Reliability factors. Option C. Adversary emulation. Option D. Setting up a honeypot. Pause the video now if you want time to think about the answer.
The correct answer is C. Adversary emulation. Adversary emulation recreates the specific tactics and techniques of actual threat actors in a controlled way, so it shows whether the controls would hold against them. Now, why are the other options incorrect? Option A is incorrect. Reconnaissance collects information about the environment and does not test control resilience. Option B is incorrect. Reliability factors describe uptime and not how controls resist attackers. Option D is incorrect. A honeypot passively detects attackers and does not test the organization's controls. Therefore, C, Adversary emulation, is the correct answer.
Play from 1:57:41 Question 79. A CISO asks whether the SOC receives indicators of compromise from the industry's information sharing group. What is the most probable reason for asking? Here are the options. Option A. So the CISO can confirm the SOC follows common industry norms. Option B. To confirm the SOC can spot known attacks hitting similar organizations. Option C. To confirm SOC orchestration playbooks are current. Option D. To check the SOC is stopping potential attacks ahead of time. Pause the video now if you want time to think about the answer.
The correct answer is B. To confirm the SOC can spot known attacks hitting similar organizations. Indicators shared by peers describe attacks already hitting similar organizations. Receiving them lets the SOC detect those known attacks if they reach the company. Now, why are the other options incorrect? Option A is incorrect. Alignment with best practice is broader than what receiving indicators provides. Option C is incorrect. Playbook upkeep is a separate matter from receiving intelligence. Option D is incorrect. Shared indicators support detection of known attacks rather than proactive prevention. Therefore, B, To confirm the SOC can spot known attacks hitting similar organizations, is the correct answer.
Play from 1:59:22 Question 80. An engineer must make sure sensitive company information stays safe if an employee's laptop is stolen. Which action best addresses this? Here are the options. Option A. Enrolling devices in MDM and demanding better passwords. Option B. Restricting access by IP address and using single sign-on. Option C. Moving all company data to a hosted desktop service with multifactor authentication. Option D. Updating mobile reporting policies and watching for breaches. Pause the video now if you want time to think about the answer.
The correct answer is C. Moving all company data to a hosted desktop service with multifactor authentication. If work happens inside a hosted desktop with multifactor sign-in, no sensitive data is stored on the laptop, so losing it does not expose anything. Now, why are the other options incorrect? Option A is incorrect. These add device-level security but local data could still be extracted from a stolen laptop. Option B is incorrect. These are access controls that do not protect data stored on a stolen device. Option D is incorrect. These are reactive steps that do not prevent exposure from a stolen device. Therefore, C, Moving all company data to a hosted desktop service with multifactor authentication, is the correct answer.
Play from 2:01:06 Question 81. A manufacturer is being acquired, and the systems administrator is asked to prepare specific reports for the buyer's board of directors. What is the board most likely doing? Here are the options. Option A. Looking into a right of first refusal. Option B. Requiring a signed non-disclosure agreement. Option C. Obtaining third-party attestations. Option D. Exercising due diligence. Pause the video now if you want time to think about the answer.
The correct answer is D. Exercising due diligence. Before completing a merger, a board examines the other company's financial, legal, operational and security position through reports. That careful investigation is called due diligence. Now, why are the other options incorrect? Option A is incorrect. A right of first refusal is a contractual option and not the reason boards request reports. Option B is incorrect. An NDA is a contract and not the board's activity of reviewing reports. Option C is incorrect. Attestations are outside audit reports and differ from the company-specific reports described. Therefore, D, Exercising due diligence, is the correct answer.
Play from 2:02:38 Question 82. For months, a network has seen a low but steady trickle of intrusion attempts. An analyst then discovers that data is being sent out to hostile servers, all of it from an unauthorized network device. Which attack vector is most likely in use? Here are the options. Option A. Ransomware. Option B. Social engineering. Option C. Buffer overflow. Option D. Supply chain. Pause the video now if you want time to think about the answer.
The correct answer is D. Supply chain. A rogue device inside the infrastructure that quietly communicates with hostile servers points to something introduced through procurement, installation or a third party, which is a supply chain compromise. Now, why are the other options incorrect? Option A is incorrect. Ransomware is delivered after a breach and does not explain how a rogue device got in. Option B is incorrect. Social engineering might play a part but does not directly explain a rogue device. Option C is incorrect. A buffer overflow is a coding flaw, not a vector for introducing rogue hardware. Therefore, D, Supply chain, is the correct answer.
Play from 2:04:07 Question 83. Alerts keep matching the SOC's playbook scenarios, and the analysts now want to study the tactics and techniques of the likely adversary. Which resource helps most? Here are the options. Option A. CAPEC. Option B. D3FEND. Option C. OWASP. Option D. COPPA. Option E. ATT&CK. Pause the video now if you want time to think about the answer.
The correct answer is E. ATT&CK. MITRE ATT&CK is the main knowledge base for mapping adversary tactics, techniques and procedures, so analysts can connect observed activity to known behavior. Now, why are the other options incorrect? Option A is incorrect. CAPEC lists attack patterns but is less complete than ATT&CK for analyzing adversary behavior. Option B is incorrect. D3FEND catalogs defensive techniques, not adversary behavior. Option C is incorrect. OWASP focuses on web application weaknesses, not adversary techniques. Option D is incorrect. COPPA is a children's privacy law and not a threat analysis framework. Therefore, E, ATT&CK, is the correct answer.
Play from 2:05:49 Question 84. Confidential documents have leaked from a company, so it is starting a program to protect its data and prevent a repeat. What should it do first? Here are the options. Option A. Roll out encryption. Option B. Create data labeling standards. Option C. Harden the storage systems. Option D. Put a DLP policy in place. Pause the video now if you want time to think about the answer.
The correct answer is B. Create data labeling standards. Controls like encryption, hardening and DLP all depend on knowing which data is sensitive. Defining labeling standards creates the common classification scheme on which the later steps rely. Now, why are the other options incorrect? Option A is incorrect. Encryption comes after the organization has worked out which data needs protecting. Option C is incorrect. Hardening requires knowing where sensitive data lives, which depends on classification first. Option D is incorrect. A DLP policy needs defined categories and labels to know what to protect. Therefore, B, Create data labeling standards, is the correct answer.
Play from 2:07:17 Question 85. A firm wants a platform that tells it which of its systems are exposed whenever a new vulnerability is announced. Which component is the best foundation? Here are the options. Option A. SBoM. Option B. SIEM. Option C. SASE. Option D. CMDB. Pause the video now if you want time to think about the answer.
The correct answer is D. CMDB. A configuration management database holds an authoritative inventory of assets and their relationships. With that inventory, vulnerabilities can be matched to the exact assets they affect. Now, why are the other options incorrect? Option A is incorrect. A software bill of materials lists components of software and does not inventory the organization's assets. Option B is incorrect. A SIEM correlates events and needs asset data from elsewhere to map vulnerabilities. Option C is incorrect. SASE is a network security architecture and does not provide asset inventory. Therefore, D, CMDB, is the correct answer.
Play from 2:08:40 Question 86. A company intends to move all its on-site applications to a public cloud and wants to minimize the amount of security work it will own afterward. What is the best approach? Here are the options. Option A. Moving everything as-is in a lift-and-shift. Option B. Adopting security tools native to the cloud. Option C. Breaking applications into microservices. Option D. Using serverless cloud services. Pause the video now if you want time to think about the answer.
The correct answer is D. Using serverless cloud services. Serverless services pass most infrastructure, operating system and patching responsibility to the provider, which leaves the customer mainly with application-level security. Now, why are the other options incorrect? Option A is incorrect. Lift-and-shift keeps the existing design and responsibilities, so little work is saved. Option B is incorrect. Native tools still need integration and management, so they reduce scope less. Option C is incorrect. Microservices add service-to-service controls and do not shrink the security scope. Therefore, D, Using serverless cloud services, is the correct answer.
Play from 2:10:10 Question 87. A defense supplier worries that a single employee with legitimate access could misuse encrypted material. Which technique best addresses this insider risk? Here are the options. Option A. Salted password hashes. Option B. Federating accounts with hardware tokens. Option C. Key splitting. Option D. Single sign-on with MFA. Option E. SAE. Pause the video now if you want time to think about the answer.
The correct answer is C. Key splitting. Splitting a key among several people means no one individual can decrypt the material alone, so misuse would require collusion. The other measures only strengthen authentication or password handling. Now, why are the other options incorrect? Option A is incorrect. This protects stored passwords and does not limit who can reach encrypted material. Option B is incorrect. This strengthens sign-in but an individual could still decrypt the data. Option D is incorrect. This improves authentication but does not stop an authenticated user from accessing the material. Option E is incorrect. Simultaneous authentication of equals is a wireless handshake and not an insider control. Therefore, C, Key splitting, is the correct answer.
Play from 2:11:45 Question 88. A user keeps getting locked out, and the IT team sees password-guessing attempts coming from countries where the company has no presence. Which solution would best deal with this? Here are the options. Option A. Requiring password changes every 60 days. Option B. Removing the limit on failed sign-ins. Option C. Applying conditional access to user accounts. Option D. Rolling out single sign-on everywhere. Pause the video now if you want time to think about the answer.
The correct answer is C. Applying conditional access to user accounts. Conditional access can refuse sign-in attempts from unexpected locations before they pile up failed attempts, which stops both the guessing and the lockouts. Now, why are the other options incorrect? Option A is incorrect. Frequent rotation does not stop ongoing guessing or deal with the location anomaly. Option B is incorrect. This removes the lockout protection and makes guessing easier. Option D is incorrect. Single sign-on does not address location-based guessing attempts. Therefore, C, Applying conditional access to user accounts, is the correct answer.
Play from 2:13:13 Question 89. A company that just bought a software-as-a-service business finds a gap analysis showing no security checks across its development lifecycle, leading to several vulnerable releases. Which tool best lowers the chance of vulnerable code reaching production? Here are the options. Option A. Code signing. Option B. Sandboxing. Option C. SAST. Option D. Regression testing. Pause the video now if you want time to think about the answer.
The correct answer is C. SAST. Static analysis examines source code early, before it is built, so flaws are found and fixed prior to release. The other items do not prevent vulnerable code from shipping. Now, why are the other options incorrect? Option A is incorrect. Signing proves authenticity after the fact and does not stop vulnerable code from being deployed. Option B is incorrect. Sandboxing contains impact at runtime and does not prevent vulnerable releases. Option D is incorrect. Regression testing checks old functionality and is not aimed at finding security flaws. Therefore, C, SAST, is the correct answer.
Play from 2:14:42 Question 90. Before adopting an outside vendor's service, a security officer asks the vendor to show that it can handle requests from individuals for their personal data. Which compliance area is the officer trying to satisfy? Here are the options. Option A. Reporting frameworks. Option B. Information security standards. Option C. Certification requirements. Option D. Privacy regulations. Option E. E-discovery requirements. Pause the video now if you want time to think about the answer.
The correct answer is D. Privacy regulations. Handling data subject access requests is an obligation under privacy laws such as GDPR and CCPA, so the officer is checking compliance with privacy regulations. Now, why are the other options incorrect? Option A is incorrect. Reporting frameworks govern how events are communicated and not access request handling. Option B is incorrect. Security standards cover controls but not specifically access request handling. Option C is incorrect. Certification requirements vary and are not specifically tied to these requests. Option E is incorrect. E-discovery concerns legal proceedings and not individuals' privacy rights. Therefore, D, Privacy regulations, is the correct answer.
Play from 2:16:21 Question 91. An after-action review of a breach shows a long delay between spotting a compromised account and containing it. The engineer proposes SOAR. What is the engineer's aim? Here are the options. Option A. To stop accounts from ever being compromised. Option B. To build runbooks that automate future responses. Option C. To produce more reports for the SOC. Option D. To correlate logs using machine learning. Pause the video now if you want time to think about the answer.
The correct answer is B. To build runbooks that automate future responses. SOAR platforms run prepared runbooks automatically, which shrinks the delay between detection and containment. That is the stated goal. Now, why are the other options incorrect? Option A is incorrect. SOAR is a response tool and does not prevent compromise. Option C is incorrect. Reporting is not the main value of SOAR, which is automating response. Option D is incorrect. Correlation is an analytics function, while SOAR focuses on orchestration and automation. Therefore, B, To build runbooks that automate future responses, is the correct answer.
Play from 2:17:57 Question 92. A government agency is linking a highly classified network to a less classified one. Data must flow only from the higher side to the lower side with no spillage, and only approved file types and content may pass. Which technology fits? Here are the options. Option A. Microsegmentation. Option B. Cross-domain solution. Option C. File integrity monitoring. Option D. Network access control. Pause the video now if you want time to think about the answer.
The correct answer is B. Cross-domain solution. A cross-domain solution moves data between classification levels while enforcing direction, inspecting content and filtering file types, which prevents spillage. Now, why are the other options incorrect? Option A is incorrect. Microsegmentation divides networks into zones and is not built for controlled transfer between classification levels. Option C is incorrect. Integrity monitoring detects file changes but does not control flows between networks. Option D is incorrect. NAC governs who joins a network and does not filter content between classifications. Therefore, B, Cross-domain solution, is the correct answer.
Play from 2:19:33 Question 93. During an audit, a product owner has to show a complete inventory of the code and modules that make up the application deployed in production, taken before it is built. Which practice supplies that evidence? Here are the options. Option A. IAST. Option B. Inspecting the application while it runs. Option C. Software composition analysis. Option D. SAST. Pause the video now if you want time to think about the answer.
The correct answer is C. Software composition analysis. Software composition analysis catalogs the libraries and components that make up an application. That inventory is exactly the evidence of what the application contains. Now, why are the other options incorrect? Option A is incorrect. Interactive testing finds issues through runtime interaction and does not document composition. Option B is incorrect. Runtime inspection examines behavior and not a pre-build inventory. Option D is incorrect. Static analysis looks for vulnerabilities in code rather than inventorying components. Therefore, C, Software composition analysis, is the correct answer.
Play from 2:21:06 Question 94. A team is building a new internet-facing service that accepts standard REST calls and either returns information or processes business transactions for automated clients. What should they build? Here are the options. Option A. A load balancer. Option B. An identity provider. Option C. A reverse proxy. Option D. One central gateway for API calls. Pause the video now if you want time to think about the answer.
The correct answer is D. One central gateway for API calls. A service that exposes REST operations to automated clients is an API, and a central gateway is the single entry point that authenticates clients, applies limits and routes each call to the right back-end service. Now, why are the other options incorrect? Option A is incorrect. A load balancer only spreads traffic across servers and does not manage API operations. Option B is incorrect. An identity provider authenticates users and issues tokens and does not serve information or run transactions. Option C is incorrect. A reverse proxy forwards and caches traffic but does not understand API operations. Therefore, D, One central gateway for API calls, is the correct answer.
Play from 2:22:45 Question 95. A CISO is worried about ransomware. After an attack, the business needs its data to stay intact and must lose no more than an hour of data. Which storage strategy meets both needs? Here are the options. Option A. RAID 10. Option B. Immutable storage. Option C. Disk encryption on every drive. Option D. Remote journaling. Pause the video now if you want time to think about the answer.
The correct answer is B. Immutable storage. Immutable storage cannot be changed or deleted by ransomware, and regular immutable snapshots allow restoring recent clean data within the one-hour recovery point target. Now, why are the other options incorrect? Option A is incorrect. RAID 10 provides redundancy but ransomware can encrypt all mirrored copies. Option C is incorrect. This protects confidentiality and does not preserve recoverable data against ransomware. Option D is incorrect. Journaling gives redundancy but does not stop ransomware from encrypting the data. Therefore, B, Immutable storage, is the correct answer.
Play from 2:24:17 Question 96. Which scenario best illustrates a denial-of-service attack against an AI model? Here are the options. Option A. Studying the model's responses to uncover how it is built. Option B. Answers from the model that cannot be trusted. Option C. Someone targeting an AI service's API in some way. Option D. Users submitting very large, computation-heavy inputs. Pause the video now if you want time to think about the answer.
The correct answer is D. Users submitting very large, computation-heavy inputs. Sending huge, computation-heavy inputs can exhaust a model's resources and make the service slow or unavailable. The other choices describe different risks such as unreliable answers or model extraction. Now, why are the other options incorrect? Option A is incorrect. This describes model extraction and not denial of service. Option B is incorrect. Unreliable output is an accuracy concern, not a denial of service. Option C is incorrect. This is too general and does not describe how service is denied. Therefore, D, Users submitting very large, computation-heavy inputs, is the correct answer.
Play from 2:25:43 Question 97. A developer is writing code that must check whether a remote party's certificate is still valid, using a protocol that queries its status. Which should be implemented? Here are the options. Option A. CRL. Option B. HSTS. Option C. RSA. Option D. OCSP. Pause the video now if you want time to think about the answer.
The correct answer is D. OCSP. OCSP lets software ask a responder, at the moment of the request, whether a certificate has been revoked. A revocation list is only a file, and the other options do not check validity. Now, why are the other options incorrect? Option A is incorrect. A revocation list is a downloaded list and not a protocol for instant checks. Option B is incorrect. HSTS forces HTTPS connections and does not check a certificate's status. Option C is incorrect. RSA is an algorithm for encryption and signatures and does not check validity. Therefore, D, OCSP, is the correct answer.
Play from 2:27:06 Question 98. Which weakness is a known security concern with the DNP3 protocol used in utilities? Here are the options. Option A. Its source code is freely available. Option B. Messages are free-form and need extra support. Option C. There is no authentication built in. Option D. Function code meanings differ with no common standard. Pause the video now if you want time to think about the answer.
The correct answer is C. There is no authentication built in. The original DNP3 specification has no built-in authentication, so a rogue device could send or alter commands. Secure authentication was added later as an extension. Now, why are the other options incorrect? Option A is incorrect. Being open source is not by itself a security weakness. Option B is incorrect. DNP3 uses structured messages. Option D is incorrect. DNP3 function codes are standardized in the specification. Therefore, C, There is no authentication built in, is the correct answer.
Play from 2:28:30 Question 99. An administrator discovers that an employee is opening highly confidential files from a personal laptop and must make sure only trusted devices and contexts can reach that data. Which capability best handles this? Here are the options. Option A. SOAR. Option B. Conditional access. Option C. Package monitoring. Option D. OCSP stapling. Option E. CASB. Pause the video now if you want time to think about the answer.
The correct answer is B. Conditional access. Conditional access can allow or block access depending on device status, location and risk, so unmanaged personal laptops can be denied or challenged before reaching confidential data. Now, why are the other options incorrect? Option A is incorrect. SOAR automates response workflows and does not directly control which devices can reach data. Option C is incorrect. Package monitoring tracks software dependencies and is unrelated to device-based access. Option D is incorrect. This is a certificate status mechanism and has no bearing on device-based access. Option E is incorrect. A CASB watches cloud application use but does not by itself block unmanaged devices from other systems. Therefore, B, Conditional access, is the correct answer.
Play from 2:30:15 Question 100. A certificate request was refused because the applicant's identity could not be verified. At which step of the PKI enrollment process did the refusal take place? Here are the options. Option A. CA. Option B. IdP. Option C. OCSP. Option D. RA. Pause the video now if you want time to think about the answer.
The correct answer is D. RA. The registration authority checks the requester's identity before anything goes to the certificate authority. A failed identity check is therefore rejected at the RA, before issuance is even considered. Now, why are the other options incorrect? Option A is incorrect. The certificate authority issues certificates, but the identity check happens earlier at the RA. Option B is incorrect. An identity provider is part of federated sign-in and not the PKI enrollment process. Option C is incorrect. OCSP checks revocation status after issuance and is not part of enrollment. Therefore, D, RA, is the correct answer.
