Which of the following is a possible consequence of a VM escape?
A. Malicious instructions can be inserted into memory and give the attacker elevated permissions.
B. An attacker can access the hypervisor and compromise other VMs.
C. Unencrypted data can be read by a user who is in a separate environment.
D. Users can install software that is not on the manufacturer’s approved list.
Show Answer
Correct Answer: B
Explanation: A VM escape occurs when an attacker breaks out of the isolation of a virtual machine and interacts with the hypervisor. Because the hypervisor controls all VMs on the host, this can allow the attacker to compromise the hypervisor itself and potentially access or control other VMs running on the same system. The other options describe different security issues but not the defining consequence of a VM escape.
Question 184
Which of the following is the best security reason for closing service ports that are not needed?
A. To mitigate risks associated with unencrypted traffic
B. To eliminate false positives from a vulnerability scan
C. To reduce a system's attack surface
D. To improve a system's resource utilization
Show Answer
Correct Answer: C
Explanation: Closing unnecessary service ports removes potential entry points that attackers could exploit. Each open port represents an exposed service that may contain vulnerabilities, so reducing the number of open ports directly reduces the system’s overall attack surface, which is the primary security benefit.
Question 185
A penetration tester finds an unused Ethernet port during an on-site penetration test. Upon plugging a device into the unused port, the penetration tester notices that the machine is assigned an IP address, allowing the tester to enumerate the local network. Which of the following should an administrator implement in order to prevent this situation from happening in the future?
A. Port security
B. Transport Layer Security
C. Proxy server
D. Security zones
Show Answer
Correct Answer: A
Explanation: Port security on network switches prevents unauthorized devices from connecting to Ethernet ports by restricting allowed MAC addresses, limiting the number of devices per port, or disabling unused ports entirely. This would stop a tester from plugging into an unused port and automatically receiving an IP address and network access. The other options do not control physical switch port access.
Question 186
Which of the following best describe the benefits of a microservices architecture when compared to a monolithic architecture? (Choose two.)
A. Easier debugging of the system
B. Reduced cost of ownership of the system
C. Improved scalability of the system
D. Increased compartmentalization of the system
E. Stronger authentication of the system
F. Reduced complexity of the system
Show Answer
Correct Answer: C, D
Explanation: Microservices allow individual services to be scaled independently, which improves scalability compared to scaling an entire monolith (C). They also decompose an application into smaller, independently deployable services, increasing modularity and isolation between components—i.e., compartmentalization (D). Other options are not inherent benefits: debugging is often harder in distributed systems, costs can increase due to operational overhead, authentication is not inherently stronger, and overall system complexity is usually higher, not lower.
Question 187
An attacker submits a request containing unexpected characters in an attempt to gain unauthorized access to information within the underlying systems. Which of the following best describes this attack?
A. Side loading
B. Target of evaluation
C. Resource reuse
D. SQL injection
Show Answer
Correct Answer: D
Explanation: The scenario describes an attacker submitting unexpected or malicious characters in a request to manipulate how backend queries are processed in order to gain unauthorized access to data. This is characteristic of SQL injection, where specially crafted input alters SQL statements executed by the database.
Question 188
A security administrator observed the following in a web server log while investigating an incident:
"GET ../../../../etc/passwd"
Which of the following attacks did the security administrator most likely see?
A. Privilege escalation
B. Credential replay
C. Brute force
D. Directory traversal
Show Answer
Correct Answer: D
Explanation: The request uses ../ sequences to traverse out of the web server’s intended directory structure in an attempt to access /etc/passwd, a sensitive system file. This pattern is characteristic of a directory traversal attack, not privilege escalation, credential replay, or brute force.
Question 189
Which of the following is a compensating control for providing user access to a high-risk website?
A. Enabling threat prevention features on the firewall
B. Configuring a SIEM tool to capture all web traffic
C. Setting firewall rules to allow traffic from any port to that destination
D. Blocking that website on the endpoint protection software
Show Answer
Correct Answer: A
Explanation: A compensating control reduces risk when a primary control (such as blocking access) cannot be implemented. If users must access a high-risk website, enabling threat prevention features on the firewall (e.g., IPS, malware inspection, URL filtering) actively mitigates the additional risk by inspecting, detecting, and blocking malicious content. SIEM logging (B) is a detective control only, firewall rules allowing any port (C) increases risk, and endpoint blocking (D) is a preventive control that contradicts the requirement to provide access.
Question 190
Which of the following is the main consideration when a legacy system that is a critical part of a company's infrastructure cannot be replaced?
A. Resource provisioning
B. Cost
C. Single point of failure
D. Complexity
Show Answer
Correct Answer: C
Explanation: When a legacy system is mission‑critical and cannot be replaced, the primary concern is managing the risk that it represents a single point of failure. Such systems are often hard to patch, upgrade, or scale, so any outage, attack, or hardware failure could bring down essential business operations. Mitigating SPOF through redundancy, isolation, or failover planning becomes the key consideration over cost, resources, or complexity.
Question 191
Which of the following can be used to compromise a system that is running an RTOS?
A. Cross-site scripting
B. Memory injection
C. Replay attack
D. Ransomware
Show Answer
Correct Answer: B
Explanation: RTOS environments commonly run on embedded systems with limited isolation and memory protection, making them susceptible to attacks that manipulate or inject code/data directly into memory. Memory injection can compromise running real-time tasks and gain control of the system. Cross-site scripting targets web applications, replay attacks target authentication/communication protocols rather than the OS itself, and ransomware typically targets general-purpose operating systems with file systems and user interaction.
Question 192
A security analyst wants to better understand the behavior of users and devices in order to gain visibility into potential malicious activities. The analyst needs a control to detect when actions deviate from a common baseline. Which of the following should the analyst use?
A. Intrusion prevention system
B. Sandbox
C. Endpoint detection and response
D. Antivirus
Show Answer
Correct Answer: C
Explanation: The question focuses on understanding the behavior of users and devices and detecting when actions deviate from a normal baseline. Endpoint Detection and Response (EDR) tools are specifically designed to monitor endpoint activity, establish behavioral baselines, and identify anomalous or suspicious behavior on user devices. IPS primarily analyzes network traffic patterns, not detailed user or endpoint behavior, while sandboxing and antivirus are more limited and signature- or sample-focused.
$19
Get all 609 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.