Security Concepts (20%)

200-201 · 60 questions

• A university security team inventories laptop software by logging in remotely and looking around the host. Laptops that stay off campus for weeks never appear in those results. What deployment gap explains the missing laptops?
• At a SaaS company, a SQL injection reaches the billing application even though the network firewall allows only HTTPS to that host. Which deployment would see the injection in the request?
• At a retailer, the team encrypts card files at rest and also stores a separate hash of each file. What is that separate hash for?
• At a hospital, a shared clinic PC still shows the previous patient's full chart when the next clinician sits down. Nothing in the chart was rewritten, and the chart system answers normally. Which CIA pillar failed?
• At a bank, a wire file arrives with a hash that no longer matches the hash the sender published, and the transfer service is still accepting files. Which CIA pillar failed?
• At a manufacturer, the plant historian is powered on, yet operators cannot open it during the shift because the service refuses connections. Which CIA pillar failed?
• At a retailer, one store server is mining while it exchanges traffic only with a second store server. That east-west conversation stays on the store LAN and never crosses the internet firewall. Which deployment can still observe that pair?
• An agency SOC is comparing products that keep logs searchable, correlate events into alerts, or execute response steps. Which description is the SIEM?
• At a SaaS company, the cloud console records who called the storage API, and a guest agent shows a process reading files inside a workload. Which record shows who changed a bucket policy?
• At a hotel, classic antivirus quarantines a file whose hash sits on a known-bad list and stays silent when a trusted admin tool starts behaving like a stealer. What is that classic product doing?
• A manufacturer threat report names a criminal group, the malware family that group sends, and the servers that group rents, and it lists the plant public website as a targeted asset. Which element is the threat actor?
• Analysts at an MSSP want a stored playbook to enrich an alert, open a ticket, and block an address without a person clicking each step. Which platform runs that playbook?
• At a logistics hub, a documented set of steps disables a stolen account and notifies the warehouse lead, and a tool executes those steps without an analyst typing each one. Which term names that arrangement?
• A university researcher disassembles a malware sample to learn how one function decrypts the sample configuration. Which term names that work?
• At a bank, a container that handled one payment was gone before the nightly host scan, and its overlay traffic never appeared on the physical switch. What visibility problem does that show?
• A criminal crew is known to send password-reset lures to a bank's staff, and no such lure has arrived today. What is that crew in this description?
• An MSSP decorates customer alerts with a feed of adversary addresses and malware hashes. Which term names that feed and the way it is being used?
• At a bank, no alert has fired, yet an analyst searches authentication logs for a rare remote tool that recently compromised a peer institution. Which term names that search?
• At a hospital, a suspicious email attachment is opened inside a disposable virtual machine so the analyst can watch the files it creates and the connections it makes. Which term names that work?
• At a hotel, one team reads an external report about a campaign while another team searches hotel logs for the behavior described in that report. Which team is threat hunting?
• At a manufacturer, an internet-facing historian still runs a service the vendor no longer fixes, and nobody has attacked that service this week. What is that unfixed service?
• At an agency, the team interviews system owners, lists weaknesses, and rates those weaknesses before anyone buys a tool. What is that activity called?
• At a hospital, the perimeter firewall blocked a network scan, yet ransomware still started from a phishing attachment opened on a ward PC. What does defense in depth say about that outcome?
• At a bank, the edge firewall, the mail filter, the endpoint agent, and the offline backups are all in place so one miss is not the whole loss. Which principle does that arrangement illustrate?
• A retailer compares the last hour of DNS query volume at one store with the previous hour at that same store, rather than with one fixed count. Which term names that comparison?
• Before a SaaS company builds a new billing feature, the team lists ways an attacker could tamper with the payment call. Which term names that design-time work?
• At a bank, dependency checks and secret checks run in the build pipeline and block the deploy whenever a check fails. What term names that practice?
• At an agency, a file carries a sensitivity label, and the system refuses a copy onto a lower label even after the file owner requests the copy. Which access model enforces the refusal?
• At a bank, tellers cannot grant one another wire-transfer rights, and only a central policy tied to the job grants those rights. Which access-model family is in use?
• A retailer tracks two flaws that share one severity label. One is reachable on the card-processing network, and the other sits on a lab PC that stores no payment data. What should change how the team ranks these two findings?
• At a hospital, the clinical VLAN is cut off from guest Wi-Fi. The same unpatched device is still flawed, yet it is much harder to reach from that guest network. What changed?
• At a university, a student signs in with a correct password, the payroll portal still refuses that account, and the identity system records the refusal. Which missing piece of this access sequence is authorization?
• At a university, a public proof-of-concept script gains a shell on an unpatched lab server. What is that script?
• At a SaaS company, the identity system records who connected, the source they used, and the API they called, and it writes that record only after the call has already been allowed. Which AAA function is that record?
• At an agency, the owner of a project folder adds a coworker to the folder, and no central office changes a sensitivity label. Which access model allows that owner decision?
• At a bank, the teller job name is not enough to open a drawer: policy also requires the matching branch attribute, a managed device, and business hours. Which access model is this?
• At a hospital, two clinicians share one role, yet only the clinician who is on the hospital network and also holds a privileged attribute may export records. Why is role-based access alone the wrong description of this rule?
• A planner at a logistics hub wants to purchase a single security product whose brochure calls that product the entire defense-in-depth strategy. What should the security lead say is the accurate correction?
• A retailer stacks three identical firewalls in a row on the path to the internet, and every firewall allows the same outbound port that a known malware family uses. Which statement best explains why this is a weak reading of defense in depth?
• At a hotel, front-desk accounts can open the reservation system during the scheduled shift and are refused when those same accounts try again at midnight. Which access model explains the refusal?
• At a manufacturer, the plant firewall permits a host to reach a port only when the packet matches an if-then list, and the decision does not consult a user role. Which access model is this?
• At a retailer, cashiers receive the register role and nothing beyond it, and moving someone to supervisor replaces that role instead of editing dozens of separate permissions. Which access model is this?
• At a SaaS company, a flaw in a shared library lets an attacker change data outside the vulnerable component. Which CVSS v3.1 base metric names that escape?
• At a retailer, a store-portal flaw does nothing until a clerk clicks a link in a message. Which CVSS v3.1 base metric records that a person must act before the flaw can run?
• At an MSSP, public exploit code appears for a bug whose published CVSS v3.1 base score has not changed. Which metric family is the one that moves with that new code?
• A university lab host that usually makes short DNS lookups starts a long run of queries with high-entropy names. What should the analyst suspect?
• At a bank, one write-up says a bug can be triggered from the internet, and another says the same bug can be triggered only from a local login on the host. Which CVSS v3.1 base metric changed?
• At a university, one bug can be exploited only by an already-logged-in admin, and another bug on the same kind of host needs no account at all. Which CVSS v3.1 metric differs between them?
• At a manufacturer, a bug works only when a rare timing window is hit. Which CVSS v3.1 metric does that rare condition raise?
• At a logistics hub, the label printer normally has a flat small-flow profile and suddenly matches the file server's outbound pattern. Which host should the analyst pull first?
• After closing, a retailer store PC that usually talks only to two payment hosts starts a large steady flow to a new address. What does that traffic profile suggest?
• A hotel has no file hash for a new tool. The front-desk PC starts a process that has never run there and opens a rare outbound port. Which detection fits this lead?
• An agency threat feed publishes a known-bad hash for a loader already seen in the sector. Which detection should the SOC write first for that hash?
• An MSSP customer complains that a new month-end upload tripped a volume alert, and the follow-up found no malware. What tradeoff should the analyst explain to the customer?
• At a bank, a network sensor stores the TLS handshake and the endpoint addresses but cannot read the file that was transferred. Which visibility challenge does that record show?
• A SaaS company can inspect its guest operating systems in the provider cloud but has no access to the hypervisor logs the provider keeps. What visibility gap does that boundary describe?
• At a hotel, a server has no agent, the only clue is a firewall allow, and the process that ran is unknown. Which visibility gap does that leave?
• At a manufacturer, grouped logs show every workstation querying the same internal DNS address. One workstation also opens TCP port 445 to many plant servers. Which set of tuples is the compromise lead?
• At a bank, two recorded flows use the same source IP address and the same destination IP address. One flow is TCP to port 443 and the other is TCP to port 22. Which 5-tuple field separates the two flows?
• Hospital connection logs show many lines that share one source address, use varying destinations, destination port 443, and TCP, while other sources appear once. How does the 5-tuple isolate the host to inspect?