CompTIA CySA+ CS0-003 System And Network Architecture Concepts In Security Operations Practice Test

 

Objective 1.1 • 40 original questions

This CompTIA CySA+ CS0-003 practice test focuses on objective 1.1: system and network architecture concepts in security operations. All questions are original ExamSnap scenarios aligned to the official CS0-003 objective set; they are not copied from live CompTIA exam content. Review every option explanation to understand why a choice fits or does not fit the scenario. For broader exam preparation, review the CompTIA CySA+ CS0-003 Exam Dumps page.

Instructions: Select the best answer unless the question explicitly says Select TWO or Select THREE. Review the explanation and option review after answering.

Question 1

City Power Utilities is updating its security operations standard for a segmented industrial environment. Which option most directly helps the team correlate logs from several systems whose timestamps currently disagree? Assume no additional product-specific features are available beyond the concepts listed.

1. Process analysis
2. Single sign-on (SSO)
3. Public key infrastructure (PKI)
4. Time synchronization
5. Windows Registry review

Correct answer: D

Why: Consistent time sources let analysts correlate events across systems and preserve reliable timelines. It directly fits this scenario because the requirement is to correlate logs from several systems whose timestamps currently disagree.

Option review:

A: Process analysis identifies running programs, parent-child relationships, and anomalous execution behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correlate logs from several systems whose timestamps currently disagree.

B: SSO lets a user authenticate once to an identity provider and access multiple integrated applications. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correlate logs from several systems whose timestamps currently disagree.

C: PKI uses certificates, certificate authorities, and public/private keys to establish identity and trust. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correlate logs from several systems whose timestamps currently disagree.

D: Consistent time sources let analysts correlate events across systems and preserve reliable timelines. It directly fits this scenario because the requirement is to correlate logs from several systems whose timestamps currently disagree.

E: The Windows Registry stores system and application configuration that can reveal persistence or unauthorized changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correlate logs from several systems whose timestamps currently disagree.

Learning point: Use Time synchronization when the key requirement is to correlate logs from several systems whose timestamps currently disagree.

Question 2

For a newly acquired subsidiary, a security consultant must satisfy all three needs: increase useful event detail without changing the application logic; secure lightweight application workloads that share the host kernel; and control highly privileged administrator credentials and sessions. Select THREE. The organization wants a vendor-neutral approach that can be explained during audit review.

1. Public key infrastructure (PKI)
2. Privileged access management (PAM)
3. Cloud access security broker (CASB)
4. Logging levels
5. Container security

Correct answers: B, D, E

Why: PAM protects and governs administrative accounts through vaulting, approval, session control, rotation, and monitoring. It directly fits this scenario because the requirement is to control highly privileged administrator credentials and sessions. Logging verbosity controls how much diagnostic and security detail a system records. It directly fits this scenario because the requirement is to increase useful event detail without changing the application logic. Containers share a host kernel and require image, runtime, registry, secret, and orchestration controls. It directly fits this scenario because the requirement is to secure lightweight application workloads that share the host kernel.

Option review:

A: PKI uses certificates, certificate authorities, and public/private keys to establish identity and trust. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to increase useful event detail without changing the application logic; secure lightweight application workloads that share the host kernel; control highly privileged administrator credentials and sessions.

B: PAM protects and governs administrative accounts through vaulting, approval, session control, rotation, and monitoring. It directly fits this scenario because the requirement is to control highly privileged administrator credentials and sessions.

C: A CASB provides visibility and policy enforcement for use of cloud services, including data and access controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to increase useful event detail without changing the application logic; secure lightweight application workloads that share the host kernel; control highly privileged administrator credentials and sessions.

D: Logging verbosity controls how much diagnostic and security detail a system records. It directly fits this scenario because the requirement is to increase useful event detail without changing the application logic.

E: Containers share a host kernel and require image, runtime, registry, secret, and orchestration controls. It directly fits this scenario because the requirement is to secure lightweight application workloads that share the host kernel.

Learning point: Use Logging levels, Container security, Privileged access management (PAM) when the key requirement is to increase useful event detail without changing the application logic; secure lightweight application workloads that share the host kernel; control highly privileged administrator credentials and sessions.

Question 3

In a regional distribution network, a security engineer must investigate suspicious Windows configuration and persistence changes. Which approach is MOST appropriate? Base the decision on the primary security requirement, not on implementation convenience.

1. Windows Registry review
2. PII and cardholder-data handling
3. Software-defined networking (SDN)
4. Privileged access management (PAM)
5. Serverless security model

Correct answer: A

Why: The Windows Registry stores system and application configuration that can reveal persistence or unauthorized changes. It directly fits this scenario because the requirement is to investigate suspicious Windows configuration and persistence changes.

Option review:

A: The Windows Registry stores system and application configuration that can reveal persistence or unauthorized changes. It directly fits this scenario because the requirement is to investigate suspicious Windows configuration and persistence changes.

B: PII and cardholder data require classification, access control, monitoring, and handling aligned with policy and applicable obligations. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to investigate suspicious Windows configuration and persistence changes.

C: SDN separates centralized control logic from data-plane forwarding, enabling programmable network policy. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to investigate suspicious Windows configuration and persistence changes.

D: PAM protects and governs administrative accounts through vaulting, approval, session control, rotation, and monitoring. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to investigate suspicious Windows configuration and persistence changes.

E: Serverless computing shifts operating-system management to the provider while leaving code, identity, data, and configuration responsibilities with the customer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to investigate suspicious Windows configuration and persistence changes.

Learning point: Use Windows Registry review when the key requirement is to investigate suspicious Windows configuration and persistence changes.

Question 4

A review at Alpine Ski House finds a gap: the team cannot reliably reduce unnecessary services and risky default settings. Which option best closes that gap? The environment follows least privilege and preserves evidence where incident handling is involved.

1. Container security
2. Secure access service edge (SASE)
3. System hardening
4. Network segmentation
5. Virtualization controls

Correct answer: C

Why: Hardening reduces attack surface by disabling unnecessary services, tightening configuration, and applying secure baselines. It directly fits this scenario because the requirement is to reduce unnecessary services and risky default settings.

Option review:

A: Containers share a host kernel and require image, runtime, registry, secret, and orchestration controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce unnecessary services and risky default settings.

B: SASE combines wide-area connectivity with cloud-delivered security services and policy enforcement. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce unnecessary services and risky default settings.

C: Hardening reduces attack surface by disabling unnecessary services, tightening configuration, and applying secure baselines. It directly fits this scenario because the requirement is to reduce unnecessary services and risky default settings.

D: Segmentation limits lateral movement and reduces blast radius by separating systems into controlled network zones. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce unnecessary services and risky default settings.

E: Virtualization isolates workloads through hypervisors and virtual hardware while introducing management-plane and VM escape considerations. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce unnecessary services and risky default settings.

Learning point: Use System hardening when the key requirement is to reduce unnecessary services and risky default settings.

Question 5

a systems security analyst at Coho Winery is comparing several approaches. The deciding requirement is to locate a service setting that controls security-relevant behavior. Which option should be chosen? Use the choice that most directly addresses the stated evidence rather than a broader control.

1. Zero trust
2. Process analysis
3. Public key infrastructure (PKI)
4. Federation
5. Configuration file review

Correct answer: E

Why: Configuration files often hold service, authentication, logging, and application settings on Linux and other platforms. It directly fits this scenario because the requirement is to locate a service setting that controls security-relevant behavior.

Option review:

A: Zero trust continuously evaluates identity, device, context, and policy instead of assuming trust based on network location. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to locate a service setting that controls security-relevant behavior.

B: Process analysis identifies running programs, parent-child relationships, and anomalous execution behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to locate a service setting that controls security-relevant behavior.

C: PKI uses certificates, certificate authorities, and public/private keys to establish identity and trust. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to locate a service setting that controls security-relevant behavior.

D: Federation establishes trust between separate identity domains so identities can be accepted across organizational boundaries. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to locate a service setting that controls security-relevant behavior.

E: Configuration files often hold service, authentication, logging, and application settings on Linux and other platforms. It directly fits this scenario because the requirement is to locate a service setting that controls security-relevant behavior.

Learning point: Use Configuration file review when the key requirement is to locate a service setting that controls security-relevant behavior.

Question 6

While supporting a manufacturing plant, an incident responder is asked to determine whether an unexpected executable is currently running. Which concept or tool is the clearest match? The team wants the most defensible analyst action before expanding the investigation.

1. Process analysis
2. Single sign-on (SSO)
3. Windows Registry review
4. Cloud access security broker (CASB)
5. Privileged access management (PAM)

Correct answer: A

Why: Process analysis identifies running programs, parent-child relationships, and anomalous execution behavior. It directly fits this scenario because the requirement is to determine whether an unexpected executable is currently running.

Option review:

A: Process analysis identifies running programs, parent-child relationships, and anomalous execution behavior. It directly fits this scenario because the requirement is to determine whether an unexpected executable is currently running.

B: SSO lets a user authenticate once to an identity provider and access multiple integrated applications. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to determine whether an unexpected executable is currently running.

C: The Windows Registry stores system and application configuration that can reveal persistence or unauthorized changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to determine whether an unexpected executable is currently running.

D: A CASB provides visibility and policy enforcement for use of cloud services, including data and access controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to determine whether an unexpected executable is currently running.

E: PAM protects and governs administrative accounts through vaulting, approval, session control, rotation, and monitoring. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to determine whether an unexpected executable is currently running.

Learning point: Use Process analysis when the key requirement is to determine whether an unexpected executable is currently running.

Question 7

A new security procedure at Fourth Coffee must enable analysts to account for platform-specific security behavior at the hardware layer. Which option is the BEST choice? Select based on the scenario’s decisive constraint, not on which technology is newest.

1. Privileged access management (PAM)
2. Configuration file review
3. Cloud access security broker (CASB)
4. Hardware architecture awareness
5. Process analysis

Correct answer: D

Why: Hardware architecture affects firmware, CPU capabilities, trusted modules, and the way low-level attacks or controls behave. It directly fits this scenario because the requirement is to account for platform-specific security behavior at the hardware layer.

Option review:

A: PAM protects and governs administrative accounts through vaulting, approval, session control, rotation, and monitoring. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to account for platform-specific security behavior at the hardware layer.

B: Configuration files often hold service, authentication, logging, and application settings on Linux and other platforms. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to account for platform-specific security behavior at the hardware layer.

C: A CASB provides visibility and policy enforcement for use of cloud services, including data and access controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to account for platform-specific security behavior at the hardware layer.

D: Hardware architecture affects firmware, CPU capabilities, trusted modules, and the way low-level attacks or controls behave. It directly fits this scenario because the requirement is to account for platform-specific security behavior at the hardware layer.

E: Process analysis identifies running programs, parent-child relationships, and anomalous execution behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to account for platform-specific security behavior at the hardware layer.

Learning point: Use Hardware architecture awareness when the key requirement is to account for platform-specific security behavior at the hardware layer.

Question 8

The primary objective for Consolidated Messenger is to secure event-driven functions without managing the underlying servers. Which selection best satisfies that objective in a customer-facing messaging service? Assume the activity is authorized and must follow normal enterprise change control.

1. Process analysis
2. Secure access service edge (SASE)
3. Virtualization controls
4. Serverless security model
5. Zero trust

Correct answer: D

Why: Serverless computing shifts operating-system management to the provider while leaving code, identity, data, and configuration responsibilities with the customer. It directly fits this scenario because the requirement is to secure event-driven functions without managing the underlying servers.

Option review:

A: Process analysis identifies running programs, parent-child relationships, and anomalous execution behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to secure event-driven functions without managing the underlying servers.

B: SASE combines wide-area connectivity with cloud-delivered security services and policy enforcement. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to secure event-driven functions without managing the underlying servers.

C: Virtualization isolates workloads through hypervisors and virtual hardware while introducing management-plane and VM escape considerations. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to secure event-driven functions without managing the underlying servers.

D: Serverless computing shifts operating-system management to the provider while leaving code, identity, data, and configuration responsibilities with the customer. It directly fits this scenario because the requirement is to secure event-driven functions without managing the underlying servers.

E: Zero trust continuously evaluates identity, device, context, and policy instead of assuming trust based on network location. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to secure event-driven functions without managing the underlying servers.

Learning point: Use Serverless security model when the key requirement is to secure event-driven functions without managing the underlying servers.

Question 9

Adventure Works is designing a combined control. It must separate several full guest operating systems on shared physical hardware, and establish certificate-based trust for users, devices, or services. Which TWO options are most appropriate? Assume no additional product-specific features are available beyond the concepts listed.

1. Privileged access management (PAM)
2. Virtualization controls
3. Public key infrastructure (PKI)
4. SSL/TLS inspection
5. Zero trust

Correct answers: B, C

Why: Virtualization isolates workloads through hypervisors and virtual hardware while introducing management-plane and VM escape considerations. It directly fits this scenario because the requirement is to separate several full guest operating systems on shared physical hardware. PKI uses certificates, certificate authorities, and public/private keys to establish identity and trust. It directly fits this scenario because the requirement is to establish certificate-based trust for users, devices, or services.

Option review:

A: PAM protects and governs administrative accounts through vaulting, approval, session control, rotation, and monitoring. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to separate several full guest operating systems on shared physical hardware; establish certificate-based trust for users, devices, or services.

B: Virtualization isolates workloads through hypervisors and virtual hardware while introducing management-plane and VM escape considerations. It directly fits this scenario because the requirement is to separate several full guest operating systems on shared physical hardware.

C: PKI uses certificates, certificate authorities, and public/private keys to establish identity and trust. It directly fits this scenario because the requirement is to establish certificate-based trust for users, devices, or services.

D: Encrypted-traffic inspection decrypts permitted TLS sessions at a control point so security tools can examine otherwise hidden content. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to separate several full guest operating systems on shared physical hardware; establish certificate-based trust for users, devices, or services.

E: Zero trust continuously evaluates identity, device, context, and policy instead of assuming trust based on network location. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to separate several full guest operating systems on shared physical hardware; establish certificate-based trust for users, devices, or services.

Learning point: Use Virtualization controls, Public key infrastructure (PKI) when the key requirement is to separate several full guest operating systems on shared physical hardware; establish certificate-based trust for users, devices, or services.

Question 10

During an investigation at Wide World Importers, the immediate requirement is to secure lightweight application workloads that share the host kernel. What should an incident coordinator select? The organization wants a vendor-neutral approach that can be explained during audit review.

1. Hardware architecture awareness
2. Software-defined networking (SDN)
3. Zero trust
4. Container security
5. Multifactor authentication (MFA)

Correct answer: D

Why: Containers share a host kernel and require image, runtime, registry, secret, and orchestration controls. It directly fits this scenario because the requirement is to secure lightweight application workloads that share the host kernel.

Option review:

A: Hardware architecture affects firmware, CPU capabilities, trusted modules, and the way low-level attacks or controls behave. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to secure lightweight application workloads that share the host kernel.

B: SDN separates centralized control logic from data-plane forwarding, enabling programmable network policy. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to secure lightweight application workloads that share the host kernel.

C: Zero trust continuously evaluates identity, device, context, and policy instead of assuming trust based on network location. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to secure lightweight application workloads that share the host kernel.

D: Containers share a host kernel and require image, runtime, registry, secret, and orchestration controls. It directly fits this scenario because the requirement is to secure lightweight application workloads that share the host kernel.

E: MFA requires more than one authentication factor and reduces risk from stolen passwords. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to secure lightweight application workloads that share the host kernel.

Learning point: Use Container security when the key requirement is to secure lightweight application workloads that share the host kernel.

Question 11

At Datum Fabrication, a security architect has two simultaneous requirements: limit lateral movement between user, server, and sensitive network zones, and prevent sensitive information from leaving through unauthorized channels. Which TWO options should be selected? Base the decision on the primary security requirement, not on implementation convenience.

1. Network segmentation
2. Cloud access security broker (CASB)
3. Configuration file review
4. Serverless security model
5. Data loss prevention (DLP)

Correct answers: A, E

Why: Segmentation limits lateral movement and reduces blast radius by separating systems into controlled network zones. It directly fits this scenario because the requirement is to limit lateral movement between user, server, and sensitive network zones. DLP identifies sensitive information and can monitor or block risky movement across endpoints, networks, and cloud services. It directly fits this scenario because the requirement is to prevent sensitive information from leaving through unauthorized channels.

Option review:

A: Segmentation limits lateral movement and reduces blast radius by separating systems into controlled network zones. It directly fits this scenario because the requirement is to limit lateral movement between user, server, and sensitive network zones.

B: A CASB provides visibility and policy enforcement for use of cloud services, including data and access controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to limit lateral movement between user, server, and sensitive network zones; prevent sensitive information from leaving through unauthorized channels.

C: Configuration files often hold service, authentication, logging, and application settings on Linux and other platforms. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to limit lateral movement between user, server, and sensitive network zones; prevent sensitive information from leaving through unauthorized channels.

D: Serverless computing shifts operating-system management to the provider while leaving code, identity, data, and configuration responsibilities with the customer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to limit lateral movement between user, server, and sensitive network zones; prevent sensitive information from leaving through unauthorized channels.

E: DLP identifies sensitive information and can monitor or block risky movement across endpoints, networks, and cloud services. It directly fits this scenario because the requirement is to prevent sensitive information from leaving through unauthorized channels.

Learning point: Use Network segmentation, Data loss prevention (DLP) when the key requirement is to limit lateral movement between user, server, and sensitive network zones; prevent sensitive information from leaving through unauthorized channels.

Question 12

A ticket at Tailspin Toys asks a SOC lead to require explicit verification for each access decision even from internal networks. Which choice addresses the requirement most directly? The environment follows least privilege and preserves evidence where incident handling is involved.

1. Hardware architecture awareness
2. Configuration file review
3. Software-defined networking (SDN)
4. Windows Registry review
5. Zero trust

Correct answer: E

Why: Zero trust continuously evaluates identity, device, context, and policy instead of assuming trust based on network location. It directly fits this scenario because the requirement is to require explicit verification for each access decision even from internal networks.

Option review:

A: Hardware architecture affects firmware, CPU capabilities, trusted modules, and the way low-level attacks or controls behave. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to require explicit verification for each access decision even from internal networks.

B: Configuration files often hold service, authentication, logging, and application settings on Linux and other platforms. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to require explicit verification for each access decision even from internal networks.

C: SDN separates centralized control logic from data-plane forwarding, enabling programmable network policy. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to require explicit verification for each access decision even from internal networks.

D: The Windows Registry stores system and application configuration that can reveal persistence or unauthorized changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to require explicit verification for each access decision even from internal networks.

E: Zero trust continuously evaluates identity, device, context, and policy instead of assuming trust based on network location. It directly fits this scenario because the requirement is to require explicit verification for each access decision even from internal networks.

Learning point: Use Zero trust when the key requirement is to require explicit verification for each access decision even from internal networks.

Question 13

In a restricted research segment, a malware analyst must combine remote connectivity with cloud-delivered security controls. Which approach is MOST appropriate? Use the choice that most directly addresses the stated evidence rather than a broader control.

1. SSL/TLS inspection
2. Secure access service edge (SASE)
3. Network segmentation
4. Hardware architecture awareness
5. Serverless security model

Correct answer: B

Why: SASE combines wide-area connectivity with cloud-delivered security services and policy enforcement. It directly fits this scenario because the requirement is to combine remote connectivity with cloud-delivered security controls.

Option review:

A: Encrypted-traffic inspection decrypts permitted TLS sessions at a control point so security tools can examine otherwise hidden content. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to combine remote connectivity with cloud-delivered security controls.

B: SASE combines wide-area connectivity with cloud-delivered security services and policy enforcement. It directly fits this scenario because the requirement is to combine remote connectivity with cloud-delivered security controls.

C: Segmentation limits lateral movement and reduces blast radius by separating systems into controlled network zones. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to combine remote connectivity with cloud-delivered security controls.

D: Hardware architecture affects firmware, CPU capabilities, trusted modules, and the way low-level attacks or controls behave. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to combine remote connectivity with cloud-delivered security controls.

E: Serverless computing shifts operating-system management to the provider while leaving code, identity, data, and configuration responsibilities with the customer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to combine remote connectivity with cloud-delivered security controls.

Learning point: Use Secure access service edge (SASE) when the key requirement is to combine remote connectivity with cloud-delivered security controls.

Question 14

During a security review, a SOC analyst must address two separate needs: centrally program network behavior instead of configuring every forwarding device separately, and increase useful event detail without changing the application logic. Select TWO. The team wants the most defensible analyst action before expanding the investigation.

1. Configuration file review
2. Software-defined networking (SDN)
3. Data loss prevention (DLP)
4. Single sign-on (SSO)
5. Logging levels

Correct answers: B, E

Why: SDN separates centralized control logic from data-plane forwarding, enabling programmable network policy. It directly fits this scenario because the requirement is to centrally program network behavior instead of configuring every forwarding device separately. Logging verbosity controls how much diagnostic and security detail a system records. It directly fits this scenario because the requirement is to increase useful event detail without changing the application logic.

Option review:

A: Configuration files often hold service, authentication, logging, and application settings on Linux and other platforms. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to centrally program network behavior instead of configuring every forwarding device separately; increase useful event detail without changing the application logic.

B: SDN separates centralized control logic from data-plane forwarding, enabling programmable network policy. It directly fits this scenario because the requirement is to centrally program network behavior instead of configuring every forwarding device separately.

C: DLP identifies sensitive information and can monitor or block risky movement across endpoints, networks, and cloud services. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to centrally program network behavior instead of configuring every forwarding device separately; increase useful event detail without changing the application logic.

D: SSO lets a user authenticate once to an identity provider and access multiple integrated applications. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to centrally program network behavior instead of configuring every forwarding device separately; increase useful event detail without changing the application logic.

E: Logging verbosity controls how much diagnostic and security detail a system records. It directly fits this scenario because the requirement is to increase useful event detail without changing the application logic.

Learning point: Use Software-defined networking (SDN), Logging levels when the key requirement is to centrally program network behavior instead of configuring every forwarding device separately; increase useful event detail without changing the application logic.

Question 15

At Woodgrove Bank, a threat hunter has two simultaneous requirements: reduce account takeover risk when a password is compromised, and investigate suspicious Windows configuration and persistence changes. Which TWO options should be selected? Select based on the scenario’s decisive constraint, not on which technology is newest.

1. Multifactor authentication (MFA)
2. Time synchronization
3. Software-defined networking (SDN)
4. Windows Registry review
5. SSL/TLS inspection

Correct answers: A, D

Why: MFA requires more than one authentication factor and reduces risk from stolen passwords. It directly fits this scenario because the requirement is to reduce account takeover risk when a password is compromised. The Windows Registry stores system and application configuration that can reveal persistence or unauthorized changes. It directly fits this scenario because the requirement is to investigate suspicious Windows configuration and persistence changes.

Option review:

A: MFA requires more than one authentication factor and reduces risk from stolen passwords. It directly fits this scenario because the requirement is to reduce account takeover risk when a password is compromised.

B: Consistent time sources let analysts correlate events across systems and preserve reliable timelines. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce account takeover risk when a password is compromised; investigate suspicious Windows configuration and persistence changes.

C: SDN separates centralized control logic from data-plane forwarding, enabling programmable network policy. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce account takeover risk when a password is compromised; investigate suspicious Windows configuration and persistence changes.

D: The Windows Registry stores system and application configuration that can reveal persistence or unauthorized changes. It directly fits this scenario because the requirement is to investigate suspicious Windows configuration and persistence changes.

E: Encrypted-traffic inspection decrypts permitted TLS sessions at a control point so security tools can examine otherwise hidden content. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce account takeover risk when a password is compromised; investigate suspicious Windows configuration and persistence changes.

Learning point: Use Multifactor authentication (MFA), Windows Registry review when the key requirement is to reduce account takeover risk when a password is compromised; investigate suspicious Windows configuration and persistence changes.

Question 16

For a regulated customer-data environment, the team must accomplish both of these goals: reduce repeated sign-ins across many enterprise applications, and reduce unnecessary services and risky default settings. Which TWO choices together provide the best match? Assume the activity is authorized and must follow normal enterprise change control.

1. System hardening
2. Windows Registry review
3. Container security
4. Configuration file review
5. Single sign-on (SSO)

Correct answers: A, E

Why: Hardening reduces attack surface by disabling unnecessary services, tightening configuration, and applying secure baselines. It directly fits this scenario because the requirement is to reduce unnecessary services and risky default settings. SSO lets a user authenticate once to an identity provider and access multiple integrated applications. It directly fits this scenario because the requirement is to reduce repeated sign-ins across many enterprise applications.

Option review:

A: Hardening reduces attack surface by disabling unnecessary services, tightening configuration, and applying secure baselines. It directly fits this scenario because the requirement is to reduce unnecessary services and risky default settings.

B: The Windows Registry stores system and application configuration that can reveal persistence or unauthorized changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce repeated sign-ins across many enterprise applications; reduce unnecessary services and risky default settings.

C: Containers share a host kernel and require image, runtime, registry, secret, and orchestration controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce repeated sign-ins across many enterprise applications; reduce unnecessary services and risky default settings.

D: Configuration files often hold service, authentication, logging, and application settings on Linux and other platforms. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce repeated sign-ins across many enterprise applications; reduce unnecessary services and risky default settings.

E: SSO lets a user authenticate once to an identity provider and access multiple integrated applications. It directly fits this scenario because the requirement is to reduce repeated sign-ins across many enterprise applications.

Learning point: Use Single sign-on (SSO), System hardening when the key requirement is to reduce repeated sign-ins across many enterprise applications; reduce unnecessary services and risky default settings.

Question 17

A new security procedure at Contoso Health must enable analysts to allow identities from a partner organization to access a trusted application. Which option is the BEST choice? Assume no additional product-specific features are available beyond the concepts listed.

1. SSL/TLS inspection
2. Virtualization controls
3. Federation
4. Process analysis
5. Public key infrastructure (PKI)

Correct answer: C

Why: Federation establishes trust between separate identity domains so identities can be accepted across organizational boundaries. It directly fits this scenario because the requirement is to allow identities from a partner organization to access a trusted application.

Option review:

A: Encrypted-traffic inspection decrypts permitted TLS sessions at a control point so security tools can examine otherwise hidden content. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to allow identities from a partner organization to access a trusted application.

B: Virtualization isolates workloads through hypervisors and virtual hardware while introducing management-plane and VM escape considerations. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to allow identities from a partner organization to access a trusted application.

C: Federation establishes trust between separate identity domains so identities can be accepted across organizational boundaries. It directly fits this scenario because the requirement is to allow identities from a partner organization to access a trusted application.

D: Process analysis identifies running programs, parent-child relationships, and anomalous execution behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to allow identities from a partner organization to access a trusted application.

E: PKI uses certificates, certificate authorities, and public/private keys to establish identity and trust. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to allow identities from a partner organization to access a trusted application.

Learning point: Use Federation when the key requirement is to allow identities from a partner organization to access a trusted application.

Question 18

During a security review, a security operations engineer must address two separate needs: control highly privileged administrator credentials and sessions, and determine whether an unexpected executable is currently running. Select TWO. The organization wants a vendor-neutral approach that can be explained during audit review.

1. Logging levels
2. Process analysis
3. Privileged access management (PAM)
4. Container security
5. Software-defined networking (SDN)

Correct answers: B, C

Why: Process analysis identifies running programs, parent-child relationships, and anomalous execution behavior. It directly fits this scenario because the requirement is to determine whether an unexpected executable is currently running. PAM protects and governs administrative accounts through vaulting, approval, session control, rotation, and monitoring. It directly fits this scenario because the requirement is to control highly privileged administrator credentials and sessions.

Option review:

A: Logging verbosity controls how much diagnostic and security detail a system records. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to control highly privileged administrator credentials and sessions; determine whether an unexpected executable is currently running.

B: Process analysis identifies running programs, parent-child relationships, and anomalous execution behavior. It directly fits this scenario because the requirement is to determine whether an unexpected executable is currently running.

C: PAM protects and governs administrative accounts through vaulting, approval, session control, rotation, and monitoring. It directly fits this scenario because the requirement is to control highly privileged administrator credentials and sessions.

D: Containers share a host kernel and require image, runtime, registry, secret, and orchestration controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to control highly privileged administrator credentials and sessions; determine whether an unexpected executable is currently running.

E: SDN separates centralized control logic from data-plane forwarding, enabling programmable network policy. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to control highly privileged administrator credentials and sessions; determine whether an unexpected executable is currently running.

Learning point: Use Privileged access management (PAM), Process analysis when the key requirement is to control highly privileged administrator credentials and sessions; determine whether an unexpected executable is currently running.

Question 19

At Lucerne Publishing, a detection engineer has two simultaneous requirements: remove reusable passwords from the normal sign-in flow, and account for platform-specific security behavior at the hardware layer. Which TWO options should be selected? Base the decision on the primary security requirement, not on implementation convenience.

1. Hardware architecture awareness
2. System hardening
3. Software-defined networking (SDN)
4. Container security
5. Passwordless authentication

Correct answers: A, E

Why: Hardware architecture affects firmware, CPU capabilities, trusted modules, and the way low-level attacks or controls behave. It directly fits this scenario because the requirement is to account for platform-specific security behavior at the hardware layer. Passwordless methods use cryptographic authenticators, biometrics, or security keys rather than reusable passwords. It directly fits this scenario because the requirement is to remove reusable passwords from the normal sign-in flow.

Option review:

A: Hardware architecture affects firmware, CPU capabilities, trusted modules, and the way low-level attacks or controls behave. It directly fits this scenario because the requirement is to account for platform-specific security behavior at the hardware layer.

B: Hardening reduces attack surface by disabling unnecessary services, tightening configuration, and applying secure baselines. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to remove reusable passwords from the normal sign-in flow; account for platform-specific security behavior at the hardware layer.

C: SDN separates centralized control logic from data-plane forwarding, enabling programmable network policy. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to remove reusable passwords from the normal sign-in flow; account for platform-specific security behavior at the hardware layer.

D: Containers share a host kernel and require image, runtime, registry, secret, and orchestration controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to remove reusable passwords from the normal sign-in flow; account for platform-specific security behavior at the hardware layer.

E: Passwordless methods use cryptographic authenticators, biometrics, or security keys rather than reusable passwords. It directly fits this scenario because the requirement is to remove reusable passwords from the normal sign-in flow.

Learning point: Use Passwordless authentication, Hardware architecture awareness when the key requirement is to remove reusable passwords from the normal sign-in flow; account for platform-specific security behavior at the hardware layer.

Question 20

During an investigation at Fabrikam Finance, the immediate requirement is to monitor and enforce policy across sanctioned and unsanctioned cloud services. What should a vulnerability analyst select? The environment follows least privilege and preserves evidence where incident handling is involved.

1. Container security
2. Passwordless authentication
3. Serverless security model
4. Cloud access security broker (CASB)
5. Privileged access management (PAM)

Correct answer: D

Why: A CASB provides visibility and policy enforcement for use of cloud services, including data and access controls. It directly fits this scenario because the requirement is to monitor and enforce policy across sanctioned and unsanctioned cloud services.

Option review:

A: Containers share a host kernel and require image, runtime, registry, secret, and orchestration controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to monitor and enforce policy across sanctioned and unsanctioned cloud services.

B: Passwordless methods use cryptographic authenticators, biometrics, or security keys rather than reusable passwords. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to monitor and enforce policy across sanctioned and unsanctioned cloud services.

C: Serverless computing shifts operating-system management to the provider while leaving code, identity, data, and configuration responsibilities with the customer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to monitor and enforce policy across sanctioned and unsanctioned cloud services.

D: A CASB provides visibility and policy enforcement for use of cloud services, including data and access controls. It directly fits this scenario because the requirement is to monitor and enforce policy across sanctioned and unsanctioned cloud services.

E: PAM protects and governs administrative accounts through vaulting, approval, session control, rotation, and monitoring. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to monitor and enforce policy across sanctioned and unsanctioned cloud services.

Learning point: Use Cloud access security broker (CASB) when the key requirement is to monitor and enforce policy across sanctioned and unsanctioned cloud services.

Question 21

City Power Utilities is designing a combined control. It must establish certificate-based trust for users, devices, or services, and separate several full guest operating systems on shared physical hardware. Which TWO options are most appropriate? Use the choice that most directly addresses the stated evidence rather than a broader control.

1. Multifactor authentication (MFA)
2. Container security
3. Software-defined networking (SDN)
4. Public key infrastructure (PKI)
5. Virtualization controls

Correct answers: D, E

Why: PKI uses certificates, certificate authorities, and public/private keys to establish identity and trust. It directly fits this scenario because the requirement is to establish certificate-based trust for users, devices, or services. Virtualization isolates workloads through hypervisors and virtual hardware while introducing management-plane and VM escape considerations. It directly fits this scenario because the requirement is to separate several full guest operating systems on shared physical hardware.

Option review:

A: MFA requires more than one authentication factor and reduces risk from stolen passwords. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to establish certificate-based trust for users, devices, or services; separate several full guest operating systems on shared physical hardware.

B: Containers share a host kernel and require image, runtime, registry, secret, and orchestration controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to establish certificate-based trust for users, devices, or services; separate several full guest operating systems on shared physical hardware.

C: SDN separates centralized control logic from data-plane forwarding, enabling programmable network policy. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to establish certificate-based trust for users, devices, or services; separate several full guest operating systems on shared physical hardware.

D: PKI uses certificates, certificate authorities, and public/private keys to establish identity and trust. It directly fits this scenario because the requirement is to establish certificate-based trust for users, devices, or services.

E: Virtualization isolates workloads through hypervisors and virtual hardware while introducing management-plane and VM escape considerations. It directly fits this scenario because the requirement is to separate several full guest operating systems on shared physical hardware.

Learning point: Use Public key infrastructure (PKI), Virtualization controls when the key requirement is to establish certificate-based trust for users, devices, or services; separate several full guest operating systems on shared physical hardware.

Question 22

A ticket at A. Datum Logistics asks a security consultant to inspect authorized encrypted web traffic for threats while preserving policy controls. Which choice addresses the requirement most directly? The team wants the most defensible analyst action before expanding the investigation.

1. SSL/TLS inspection
2. Privileged access management (PAM)
3. Single sign-on (SSO)
4. Time synchronization
5. Virtualization controls

Correct answer: A

Why: Encrypted-traffic inspection decrypts permitted TLS sessions at a control point so security tools can examine otherwise hidden content. It directly fits this scenario because the requirement is to inspect authorized encrypted web traffic for threats while preserving policy controls.

Option review:

A: Encrypted-traffic inspection decrypts permitted TLS sessions at a control point so security tools can examine otherwise hidden content. It directly fits this scenario because the requirement is to inspect authorized encrypted web traffic for threats while preserving policy controls.

B: PAM protects and governs administrative accounts through vaulting, approval, session control, rotation, and monitoring. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to inspect authorized encrypted web traffic for threats while preserving policy controls.

C: SSO lets a user authenticate once to an identity provider and access multiple integrated applications. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to inspect authorized encrypted web traffic for threats while preserving policy controls.

D: Consistent time sources let analysts correlate events across systems and preserve reliable timelines. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to inspect authorized encrypted web traffic for threats while preserving policy controls.

E: Virtualization isolates workloads through hypervisors and virtual hardware while introducing management-plane and VM escape considerations. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to inspect authorized encrypted web traffic for threats while preserving policy controls.

Learning point: Use SSL/TLS inspection when the key requirement is to inspect authorized encrypted web traffic for threats while preserving policy controls.

Question 23

In a regional distribution network, a security engineer must prevent sensitive information from leaving through unauthorized channels. Which approach is MOST appropriate? Select based on the scenario’s decisive constraint, not on which technology is newest.

1. Time synchronization
2. Zero trust
3. Data loss prevention (DLP)
4. Federation
5. SSL/TLS inspection

Correct answer: C

Why: DLP identifies sensitive information and can monitor or block risky movement across endpoints, networks, and cloud services. It directly fits this scenario because the requirement is to prevent sensitive information from leaving through unauthorized channels.

Option review:

A: Consistent time sources let analysts correlate events across systems and preserve reliable timelines. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent sensitive information from leaving through unauthorized channels.

B: Zero trust continuously evaluates identity, device, context, and policy instead of assuming trust based on network location. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent sensitive information from leaving through unauthorized channels.

C: DLP identifies sensitive information and can monitor or block risky movement across endpoints, networks, and cloud services. It directly fits this scenario because the requirement is to prevent sensitive information from leaving through unauthorized channels.

D: Federation establishes trust between separate identity domains so identities can be accepted across organizational boundaries. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent sensitive information from leaving through unauthorized channels.

E: Encrypted-traffic inspection decrypts permitted TLS sessions at a control point so security tools can examine otherwise hidden content. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent sensitive information from leaving through unauthorized channels.

Learning point: Use Data loss prevention (DLP) when the key requirement is to prevent sensitive information from leaving through unauthorized channels.

Question 24

A review at Alpine Ski House finds a gap: the team cannot reliably apply stricter handling to personal or payment-card information. Which option best closes that gap? Assume the activity is authorized and must follow normal enterprise change control.

1. PII and cardholder-data handling
2. Public key infrastructure (PKI)
3. Serverless security model
4. Windows Registry review
5. Single sign-on (SSO)

Correct answer: A

Why: PII and cardholder data require classification, access control, monitoring, and handling aligned with policy and applicable obligations. It directly fits this scenario because the requirement is to apply stricter handling to personal or payment-card information.

Option review:

A: PII and cardholder data require classification, access control, monitoring, and handling aligned with policy and applicable obligations. It directly fits this scenario because the requirement is to apply stricter handling to personal or payment-card information.

B: PKI uses certificates, certificate authorities, and public/private keys to establish identity and trust. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to apply stricter handling to personal or payment-card information.

C: Serverless computing shifts operating-system management to the provider while leaving code, identity, data, and configuration responsibilities with the customer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to apply stricter handling to personal or payment-card information.

D: The Windows Registry stores system and application configuration that can reveal persistence or unauthorized changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to apply stricter handling to personal or payment-card information.

E: SSO lets a user authenticate once to an identity provider and access multiple integrated applications. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to apply stricter handling to personal or payment-card information.

Learning point: Use PII and cardholder-data handling when the key requirement is to apply stricter handling to personal or payment-card information.

Question 25

Coho Winery is designing a combined control. It must correlate logs from several systems whose timestamps currently disagree, and combine remote connectivity with cloud-delivered security controls. Which TWO options are most appropriate? Assume no additional product-specific features are available beyond the concepts listed.

1. Secure access service edge (SASE)
2. Zero trust
3. Container security
4. Time synchronization
5. Process analysis

Correct answers: A, D

Why: SASE combines wide-area connectivity with cloud-delivered security services and policy enforcement. It directly fits this scenario because the requirement is to combine remote connectivity with cloud-delivered security controls. Consistent time sources let analysts correlate events across systems and preserve reliable timelines. It directly fits this scenario because the requirement is to correlate logs from several systems whose timestamps currently disagree.

Option review:

A: SASE combines wide-area connectivity with cloud-delivered security services and policy enforcement. It directly fits this scenario because the requirement is to combine remote connectivity with cloud-delivered security controls.

B: Zero trust continuously evaluates identity, device, context, and policy instead of assuming trust based on network location. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correlate logs from several systems whose timestamps currently disagree; combine remote connectivity with cloud-delivered security controls.

C: Containers share a host kernel and require image, runtime, registry, secret, and orchestration controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correlate logs from several systems whose timestamps currently disagree; combine remote connectivity with cloud-delivered security controls.

D: Consistent time sources let analysts correlate events across systems and preserve reliable timelines. It directly fits this scenario because the requirement is to correlate logs from several systems whose timestamps currently disagree.

E: Process analysis identifies running programs, parent-child relationships, and anomalous execution behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to correlate logs from several systems whose timestamps currently disagree; combine remote connectivity with cloud-delivered security controls.

Learning point: Use Time synchronization, Secure access service edge (SASE) when the key requirement is to correlate logs from several systems whose timestamps currently disagree; combine remote connectivity with cloud-delivered security controls.

Question 26

While supporting a manufacturing plant, an incident responder is asked to increase useful event detail without changing the application logic. Which concept or tool is the clearest match? The organization wants a vendor-neutral approach that can be explained during audit review.

1. Cloud access security broker (CASB)
2. Container security
3. Network segmentation
4. Logging levels
5. Serverless security model

Correct answer: D

Why: Logging verbosity controls how much diagnostic and security detail a system records. It directly fits this scenario because the requirement is to increase useful event detail without changing the application logic.

Option review:

A: A CASB provides visibility and policy enforcement for use of cloud services, including data and access controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to increase useful event detail without changing the application logic.

B: Containers share a host kernel and require image, runtime, registry, secret, and orchestration controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to increase useful event detail without changing the application logic.

C: Segmentation limits lateral movement and reduces blast radius by separating systems into controlled network zones. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to increase useful event detail without changing the application logic.

D: Logging verbosity controls how much diagnostic and security detail a system records. It directly fits this scenario because the requirement is to increase useful event detail without changing the application logic.

E: Serverless computing shifts operating-system management to the provider while leaving code, identity, data, and configuration responsibilities with the customer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to increase useful event detail without changing the application logic.

Learning point: Use Logging levels when the key requirement is to increase useful event detail without changing the application logic.

Question 27

A new security procedure at Fourth Coffee must enable analysts to investigate suspicious Windows configuration and persistence changes. Which option is the BEST choice? Base the decision on the primary security requirement, not on implementation convenience.

1. Windows Registry review
2. Serverless security model
3. Logging levels
4. Federation
5. SSL/TLS inspection

Correct answer: A

Why: The Windows Registry stores system and application configuration that can reveal persistence or unauthorized changes. It directly fits this scenario because the requirement is to investigate suspicious Windows configuration and persistence changes.

Option review:

A: The Windows Registry stores system and application configuration that can reveal persistence or unauthorized changes. It directly fits this scenario because the requirement is to investigate suspicious Windows configuration and persistence changes.

B: Serverless computing shifts operating-system management to the provider while leaving code, identity, data, and configuration responsibilities with the customer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to investigate suspicious Windows configuration and persistence changes.

C: Logging verbosity controls how much diagnostic and security detail a system records. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to investigate suspicious Windows configuration and persistence changes.

D: Federation establishes trust between separate identity domains so identities can be accepted across organizational boundaries. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to investigate suspicious Windows configuration and persistence changes.

E: Encrypted-traffic inspection decrypts permitted TLS sessions at a control point so security tools can examine otherwise hidden content. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to investigate suspicious Windows configuration and persistence changes.

Learning point: Use Windows Registry review when the key requirement is to investigate suspicious Windows configuration and persistence changes.

Question 28

The primary objective for Consolidated Messenger is to reduce unnecessary services and risky default settings. Which selection best satisfies that objective in a customer-facing messaging service? The environment follows least privilege and preserves evidence where incident handling is involved.

1. Process analysis
2. Secure access service edge (SASE)
3. Virtualization controls
4. System hardening
5. Zero trust

Correct answer: D

Why: Hardening reduces attack surface by disabling unnecessary services, tightening configuration, and applying secure baselines. It directly fits this scenario because the requirement is to reduce unnecessary services and risky default settings.

Option review:

A: Process analysis identifies running programs, parent-child relationships, and anomalous execution behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce unnecessary services and risky default settings.

B: SASE combines wide-area connectivity with cloud-delivered security services and policy enforcement. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce unnecessary services and risky default settings.

C: Virtualization isolates workloads through hypervisors and virtual hardware while introducing management-plane and VM escape considerations. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce unnecessary services and risky default settings.

D: Hardening reduces attack surface by disabling unnecessary services, tightening configuration, and applying secure baselines. It directly fits this scenario because the requirement is to reduce unnecessary services and risky default settings.

E: Zero trust continuously evaluates identity, device, context, and policy instead of assuming trust based on network location. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce unnecessary services and risky default settings.

Learning point: Use System hardening when the key requirement is to reduce unnecessary services and risky default settings.

Question 29

At Adventure Works, a blue-team analyst needs to locate a service setting that controls security-relevant behavior. Which option is the BEST fit for a hybrid-cloud workload? Use the choice that most directly addresses the stated evidence rather than a broader control.

1. Time synchronization
2. Configuration file review
3. Container security
4. Hardware architecture awareness
5. Software-defined networking (SDN)

Correct answer: B

Why: Configuration files often hold service, authentication, logging, and application settings on Linux and other platforms. It directly fits this scenario because the requirement is to locate a service setting that controls security-relevant behavior.

Option review:

A: Consistent time sources let analysts correlate events across systems and preserve reliable timelines. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to locate a service setting that controls security-relevant behavior.

B: Configuration files often hold service, authentication, logging, and application settings on Linux and other platforms. It directly fits this scenario because the requirement is to locate a service setting that controls security-relevant behavior.

C: Containers share a host kernel and require image, runtime, registry, secret, and orchestration controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to locate a service setting that controls security-relevant behavior.

D: Hardware architecture affects firmware, CPU capabilities, trusted modules, and the way low-level attacks or controls behave. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to locate a service setting that controls security-relevant behavior.

E: SDN separates centralized control logic from data-plane forwarding, enabling programmable network policy. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to locate a service setting that controls security-relevant behavior.

Learning point: Use Configuration file review when the key requirement is to locate a service setting that controls security-relevant behavior.

Question 30

During an investigation at Wide World Importers, the immediate requirement is to determine whether an unexpected executable is currently running. What should an incident coordinator select? The team wants the most defensible analyst action before expanding the investigation.

1. Software-defined networking (SDN)
2. Single sign-on (SSO)
3. Process analysis
4. PII and cardholder-data handling
5. Windows Registry review

Correct answer: C

Why: Process analysis identifies running programs, parent-child relationships, and anomalous execution behavior. It directly fits this scenario because the requirement is to determine whether an unexpected executable is currently running.

Option review:

A: SDN separates centralized control logic from data-plane forwarding, enabling programmable network policy. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to determine whether an unexpected executable is currently running.

B: SSO lets a user authenticate once to an identity provider and access multiple integrated applications. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to determine whether an unexpected executable is currently running.

C: Process analysis identifies running programs, parent-child relationships, and anomalous execution behavior. It directly fits this scenario because the requirement is to determine whether an unexpected executable is currently running.

D: PII and cardholder data require classification, access control, monitoring, and handling aligned with policy and applicable obligations. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to determine whether an unexpected executable is currently running.

E: The Windows Registry stores system and application configuration that can reveal persistence or unauthorized changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to determine whether an unexpected executable is currently running.

Learning point: Use Process analysis when the key requirement is to determine whether an unexpected executable is currently running.

Question 31

Datum Fabrication is updating its security operations standard for a mixed Windows and Linux estate. Which option most directly helps the team account for platform-specific security behavior at the hardware layer? Select based on the scenario’s decisive constraint, not on which technology is newest.

1. Hardware architecture awareness
2. Single sign-on (SSO)
3. Multifactor authentication (MFA)
4. Zero trust
5. Windows Registry review

Correct answer: A

Why: Hardware architecture affects firmware, CPU capabilities, trusted modules, and the way low-level attacks or controls behave. It directly fits this scenario because the requirement is to account for platform-specific security behavior at the hardware layer.

Option review:

A: Hardware architecture affects firmware, CPU capabilities, trusted modules, and the way low-level attacks or controls behave. It directly fits this scenario because the requirement is to account for platform-specific security behavior at the hardware layer.

B: SSO lets a user authenticate once to an identity provider and access multiple integrated applications. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to account for platform-specific security behavior at the hardware layer.

C: MFA requires more than one authentication factor and reduces risk from stolen passwords. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to account for platform-specific security behavior at the hardware layer.

D: Zero trust continuously evaluates identity, device, context, and policy instead of assuming trust based on network location. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to account for platform-specific security behavior at the hardware layer.

E: The Windows Registry stores system and application configuration that can reveal persistence or unauthorized changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to account for platform-specific security behavior at the hardware layer.

Learning point: Use Hardware architecture awareness when the key requirement is to account for platform-specific security behavior at the hardware layer.

Question 32

For an e-commerce platform, the team must accomplish both of these goals: secure event-driven functions without managing the underlying servers, and monitor and enforce policy across sanctioned and unsanctioned cloud services. Which TWO choices together provide the best match? Assume the activity is authorized and must follow normal enterprise change control.

1. Virtualization controls
2. Serverless security model
3. Windows Registry review
4. Cloud access security broker (CASB)
5. Network segmentation

Correct answers: B, D

Why: Serverless computing shifts operating-system management to the provider while leaving code, identity, data, and configuration responsibilities with the customer. It directly fits this scenario because the requirement is to secure event-driven functions without managing the underlying servers. A CASB provides visibility and policy enforcement for use of cloud services, including data and access controls. It directly fits this scenario because the requirement is to monitor and enforce policy across sanctioned and unsanctioned cloud services.

Option review:

A: Virtualization isolates workloads through hypervisors and virtual hardware while introducing management-plane and VM escape considerations. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to secure event-driven functions without managing the underlying servers; monitor and enforce policy across sanctioned and unsanctioned cloud services.

B: Serverless computing shifts operating-system management to the provider while leaving code, identity, data, and configuration responsibilities with the customer. It directly fits this scenario because the requirement is to secure event-driven functions without managing the underlying servers.

C: The Windows Registry stores system and application configuration that can reveal persistence or unauthorized changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to secure event-driven functions without managing the underlying servers; monitor and enforce policy across sanctioned and unsanctioned cloud services.

D: A CASB provides visibility and policy enforcement for use of cloud services, including data and access controls. It directly fits this scenario because the requirement is to monitor and enforce policy across sanctioned and unsanctioned cloud services.

E: Segmentation limits lateral movement and reduces blast radius by separating systems into controlled network zones. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to secure event-driven functions without managing the underlying servers; monitor and enforce policy across sanctioned and unsanctioned cloud services.

Learning point: Use Serverless security model, Cloud access security broker (CASB) when the key requirement is to secure event-driven functions without managing the underlying servers; monitor and enforce policy across sanctioned and unsanctioned cloud services.

Question 33

Case CS0003-T01-Q033 concerns a newly merged subsidiary. a SIEM case opened after a baseline deviation. The one outcome that matters for this decision is to separate several full guest operating systems on shared physical hardware; and establish certificate-based trust for users, devices, or services. Which option most directly meets that requirement?

1. Passwordless authentication
2. Virtualization controls
3. Configuration file review
4. Public key infrastructure (PKI)
5. Windows Registry review

Correct answers: B, D

Why: Virtualization isolates workloads through hypervisors and virtual hardware while introducing management-plane and VM escape considerations. It directly fits this scenario because the requirement is to separate several full guest operating systems on shared physical hardware. PKI uses certificates, certificate authorities, and public/private keys to establish identity and trust. It directly fits this scenario because the requirement is to establish certificate-based trust for users, devices, or services.

Option review:

A: Passwordless methods use cryptographic authenticators, biometrics, or security keys rather than reusable passwords. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to separate several full guest operating systems on shared physical hardware; establish certificate-based trust for users, devices, or services.

B: Virtualization isolates workloads through hypervisors and virtual hardware while introducing management-plane and VM escape considerations. It directly fits this scenario because the requirement is to separate several full guest operating systems on shared physical hardware.

C: Configuration files often hold service, authentication, logging, and application settings on Linux and other platforms. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to separate several full guest operating systems on shared physical hardware; establish certificate-based trust for users, devices, or services.

D: PKI uses certificates, certificate authorities, and public/private keys to establish identity and trust. It directly fits this scenario because the requirement is to establish certificate-based trust for users, devices, or services.

E: The Windows Registry stores system and application configuration that can reveal persistence or unauthorized changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to separate several full guest operating systems on shared physical hardware; establish certificate-based trust for users, devices, or services.

Learning point: Use Virtualization controls, Public key infrastructure (PKI) when the key requirement is to separate several full guest operating systems on shared physical hardware; establish certificate-based trust for users, devices, or services.

Question 34

During a security review, a SOC analyst must address two separate needs: secure lightweight application workloads that share the host kernel, and inspect authorized encrypted web traffic for threats while preserving policy controls. Select TWO. The organization wants a vendor-neutral approach that can be explained during audit review.

1. SSL/TLS inspection
2. Container security
3. Data loss prevention (DLP)
4. Network segmentation
5. Virtualization controls

Correct answers: A, B

Why: Encrypted-traffic inspection decrypts permitted TLS sessions at a control point so security tools can examine otherwise hidden content. It directly fits this scenario because the requirement is to inspect authorized encrypted web traffic for threats while preserving policy controls. Containers share a host kernel and require image, runtime, registry, secret, and orchestration controls. It directly fits this scenario because the requirement is to secure lightweight application workloads that share the host kernel.

Option review:

A: Encrypted-traffic inspection decrypts permitted TLS sessions at a control point so security tools can examine otherwise hidden content. It directly fits this scenario because the requirement is to inspect authorized encrypted web traffic for threats while preserving policy controls.

B: Containers share a host kernel and require image, runtime, registry, secret, and orchestration controls. It directly fits this scenario because the requirement is to secure lightweight application workloads that share the host kernel.

C: DLP identifies sensitive information and can monitor or block risky movement across endpoints, networks, and cloud services. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to secure lightweight application workloads that share the host kernel; inspect authorized encrypted web traffic for threats while preserving policy controls.

D: Segmentation limits lateral movement and reduces blast radius by separating systems into controlled network zones. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to secure lightweight application workloads that share the host kernel; inspect authorized encrypted web traffic for threats while preserving policy controls.

E: Virtualization isolates workloads through hypervisors and virtual hardware while introducing management-plane and VM escape considerations. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to secure lightweight application workloads that share the host kernel; inspect authorized encrypted web traffic for threats while preserving policy controls.

Learning point: Use Container security, SSL/TLS inspection when the key requirement is to secure lightweight application workloads that share the host kernel; inspect authorized encrypted web traffic for threats while preserving policy controls.

Question 35

a threat hunter at Woodgrove Bank is comparing several approaches. The deciding requirement is to limit lateral movement between user, server, and sensitive network zones. Which option should be chosen? Base the decision on the primary security requirement, not on implementation convenience.

1. Single sign-on (SSO)
2. Serverless security model
3. Network segmentation
4. Public key infrastructure (PKI)
5. PII and cardholder-data handling

Correct answer: C

Why: Segmentation limits lateral movement and reduces blast radius by separating systems into controlled network zones. It directly fits this scenario because the requirement is to limit lateral movement between user, server, and sensitive network zones.

Option review:

A: SSO lets a user authenticate once to an identity provider and access multiple integrated applications. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to limit lateral movement between user, server, and sensitive network zones.

B: Serverless computing shifts operating-system management to the provider while leaving code, identity, data, and configuration responsibilities with the customer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to limit lateral movement between user, server, and sensitive network zones.

C: Segmentation limits lateral movement and reduces blast radius by separating systems into controlled network zones. It directly fits this scenario because the requirement is to limit lateral movement between user, server, and sensitive network zones.

D: PKI uses certificates, certificate authorities, and public/private keys to establish identity and trust. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to limit lateral movement between user, server, and sensitive network zones.

E: PII and cardholder data require classification, access control, monitoring, and handling aligned with policy and applicable obligations. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to limit lateral movement between user, server, and sensitive network zones.

Learning point: Use Network segmentation when the key requirement is to limit lateral movement between user, server, and sensitive network zones.

Question 36

While supporting a regulated customer-data environment, a risk analyst is asked to require explicit verification for each access decision even from internal networks. Which concept or tool is the clearest match? The environment follows least privilege and preserves evidence where incident handling is involved.

1. Zero trust
2. Passwordless authentication
3. Serverless security model
4. Windows Registry review
5. Single sign-on (SSO)

Correct answer: A

Why: Zero trust continuously evaluates identity, device, context, and policy instead of assuming trust based on network location. It directly fits this scenario because the requirement is to require explicit verification for each access decision even from internal networks.

Option review:

A: Zero trust continuously evaluates identity, device, context, and policy instead of assuming trust based on network location. It directly fits this scenario because the requirement is to require explicit verification for each access decision even from internal networks.

B: Passwordless methods use cryptographic authenticators, biometrics, or security keys rather than reusable passwords. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to require explicit verification for each access decision even from internal networks.

C: Serverless computing shifts operating-system management to the provider while leaving code, identity, data, and configuration responsibilities with the customer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to require explicit verification for each access decision even from internal networks.

D: The Windows Registry stores system and application configuration that can reveal persistence or unauthorized changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to require explicit verification for each access decision even from internal networks.

E: SSO lets a user authenticate once to an identity provider and access multiple integrated applications. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to require explicit verification for each access decision even from internal networks.

Learning point: Use Zero trust when the key requirement is to require explicit verification for each access decision even from internal networks.

Question 37

A new security procedure at Contoso Health must enable analysts to combine remote connectivity with cloud-delivered security controls. Which option is the BEST choice? Use the choice that most directly addresses the stated evidence rather than a broader control.

1. Passwordless authentication
2. Secure access service edge (SASE)
3. Hardware architecture awareness
4. Multifactor authentication (MFA)
5. Windows Registry review

Correct answer: B

Why: SASE combines wide-area connectivity with cloud-delivered security services and policy enforcement. It directly fits this scenario because the requirement is to combine remote connectivity with cloud-delivered security controls.

Option review:

A: Passwordless methods use cryptographic authenticators, biometrics, or security keys rather than reusable passwords. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to combine remote connectivity with cloud-delivered security controls.

B: SASE combines wide-area connectivity with cloud-delivered security services and policy enforcement. It directly fits this scenario because the requirement is to combine remote connectivity with cloud-delivered security controls.

C: Hardware architecture affects firmware, CPU capabilities, trusted modules, and the way low-level attacks or controls behave. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to combine remote connectivity with cloud-delivered security controls.

D: MFA requires more than one authentication factor and reduces risk from stolen passwords. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to combine remote connectivity with cloud-delivered security controls.

E: The Windows Registry stores system and application configuration that can reveal persistence or unauthorized changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to combine remote connectivity with cloud-delivered security controls.

Learning point: Use Secure access service edge (SASE) when the key requirement is to combine remote connectivity with cloud-delivered security controls.

Question 38

The primary objective for Blue Yonder Airlines is to centrally program network behavior instead of configuring every forwarding device separately. Which selection best satisfies that objective in an airline operations network? The team wants the most defensible analyst action before expanding the investigation.

1. Software-defined networking (SDN)
2. Virtualization controls
3. Federation
4. Public key infrastructure (PKI)
5. Time synchronization

Correct answer: A

Why: SDN separates centralized control logic from data-plane forwarding, enabling programmable network policy. It directly fits this scenario because the requirement is to centrally program network behavior instead of configuring every forwarding device separately.

Option review:

A: SDN separates centralized control logic from data-plane forwarding, enabling programmable network policy. It directly fits this scenario because the requirement is to centrally program network behavior instead of configuring every forwarding device separately.

B: Virtualization isolates workloads through hypervisors and virtual hardware while introducing management-plane and VM escape considerations. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to centrally program network behavior instead of configuring every forwarding device separately.

C: Federation establishes trust between separate identity domains so identities can be accepted across organizational boundaries. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to centrally program network behavior instead of configuring every forwarding device separately.

D: PKI uses certificates, certificate authorities, and public/private keys to establish identity and trust. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to centrally program network behavior instead of configuring every forwarding device separately.

E: Consistent time sources let analysts correlate events across systems and preserve reliable timelines. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to centrally program network behavior instead of configuring every forwarding device separately.

Learning point: Use Software-defined networking (SDN) when the key requirement is to centrally program network behavior instead of configuring every forwarding device separately.

Question 39

At Lucerne Publishing, a detection engineer needs to reduce account takeover risk when a password is compromised. Which option is the BEST fit for a remote-work environment? Select based on the scenario’s decisive constraint, not on which technology is newest.

1. Federation
2. Windows Registry review
3. Cloud access security broker (CASB)
4. Process analysis
5. Multifactor authentication (MFA)

Correct answer: E

Why: MFA requires more than one authentication factor and reduces risk from stolen passwords. It directly fits this scenario because the requirement is to reduce account takeover risk when a password is compromised.

Option review:

A: Federation establishes trust between separate identity domains so identities can be accepted across organizational boundaries. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce account takeover risk when a password is compromised.

B: The Windows Registry stores system and application configuration that can reveal persistence or unauthorized changes. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce account takeover risk when a password is compromised.

C: A CASB provides visibility and policy enforcement for use of cloud services, including data and access controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce account takeover risk when a password is compromised.

D: Process analysis identifies running programs, parent-child relationships, and anomalous execution behavior. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce account takeover risk when a password is compromised.

E: MFA requires more than one authentication factor and reduces risk from stolen passwords. It directly fits this scenario because the requirement is to reduce account takeover risk when a password is compromised.

Learning point: Use Multifactor authentication (MFA) when the key requirement is to reduce account takeover risk when a password is compromised.

Question 40

For a regulated payment segment, the team is working from this evidence: a correlation rule fired during a maintenance-free period. They specifically need to reduce repeated sign-ins across many enterprise applications; and reduce unnecessary services and risky default settings. Ignore broader controls that do not address that requirement directly. Which choice fits best?

1. Single sign-on (SSO)
2. System hardening
3. Privileged access management (PAM)
4. Public key infrastructure (PKI)
5. Zero trust

Correct answers: A, B

Why: SSO lets a user authenticate once to an identity provider and access multiple integrated applications. It directly fits this scenario because the requirement is to reduce repeated sign-ins across many enterprise applications. Hardening reduces attack surface by disabling unnecessary services, tightening configuration, and applying secure baselines. It directly fits this scenario because the requirement is to reduce unnecessary services and risky default settings.

Option review:

A: SSO lets a user authenticate once to an identity provider and access multiple integrated applications. It directly fits this scenario because the requirement is to reduce repeated sign-ins across many enterprise applications.

B: Hardening reduces attack surface by disabling unnecessary services, tightening configuration, and applying secure baselines. It directly fits this scenario because the requirement is to reduce unnecessary services and risky default settings.

C: PAM protects and governs administrative accounts through vaulting, approval, session control, rotation, and monitoring. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce repeated sign-ins across many enterprise applications; reduce unnecessary services and risky default settings.

D: PKI uses certificates, certificate authorities, and public/private keys to establish identity and trust. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce repeated sign-ins across many enterprise applications; reduce unnecessary services and risky default settings.

E: Zero trust continuously evaluates identity, device, context, and policy instead of assuming trust based on network location. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce repeated sign-ins across many enterprise applications; reduce unnecessary services and risky default settings.

Learning point: Use Single sign-on (SSO), System hardening when the key requirement is to reduce repeated sign-ins across many enterprise applications; reduce unnecessary services and risky default settings.