A security consultant is working with a client that wants to physically isolate its secure systems. Which of the following best describes this architecture?
A. SDN
B. Air gapped
C. Containerized
D. Highly available
Show Answer
Correct Answer: B
Explanation: An air-gapped architecture physically isolates systems or networks from other networks, especially unsecured ones, to prevent direct electronic communication and reduce the risk of unauthorized access or malware propagation. SDN is software-defined networking, containerization isolates applications rather than physically isolating systems, and high availability focuses on uptime, not physical separation.
Question 248
A security analyst has determined that a security breach would have a financial impact of $15,000 and is expected to occur twice within a three-year period. Which of the following is the ALE for this risk?
A. $7,500
B. $10,000
C. $15,000
D. $30,000
Show Answer
Correct Answer: B
Explanation: Annualized Loss Expectancy (ALE) = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO). The SLE is $15,000. The event is expected to occur twice in three years, so ARO = 2/3 ≈ 0.667 per year. ALE = $15,000 × 2/3 = $10,000 (approximately).
Question 249
Which of the following activities is the first stage in the incident response process?
A. Detection
B. Declaration
C. Containment
D. Verification
Show Answer
Correct Answer: A
Explanation: Among the options given, the incident response process begins with detection (often called identification in common frameworks). Preparation is typically the phase before detection, but it is not listed. Containment occurs after an incident has been detected and confirmed, while declaration and verification are not generally the first standard phase.
Question 250
The private key for a website was stolen, and a new certificate has been issued. Which of the following needs to be updated next?
A. SCEP
B. CRL
C. OCSP
D. CSR
Show Answer
Correct Answer: B
Explanation: If a website's private key is compromised, the associated certificate must be revoked even if a new certificate has already been issued. The revocation information must be published so clients know the old certificate is no longer trusted. Updating the Certificate Revocation List (CRL) is the required next step. SCEP is for certificate enrollment, OCSP is a protocol clients use to query revocation status rather than something typically 'updated' in this context, and the CSR would have been used before the new certificate was issued.
Question 251
An enterprise security team is researching a new security architecture to better protect the company’s networks and applications against the latest cyberthreats. The company has a fully remote workforce. The solution should be highly redundant and enable users to connect to a VPN with an integrated, software-based firewall. Which of the following solutions meets these requirements?
A. IPS
B. SIEM
C. SASE
D. CASB
Show Answer
Correct Answer: C
Explanation: SASE (Secure Access Service Edge) is designed for distributed and remote workforces by delivering networking and security as cloud-based services. It commonly includes secure remote access, Firewall-as-a-Service (FWaaS), SD-WAN, Zero Trust Network Access (ZTNA), and often CASB capabilities, providing high availability through cloud points of presence. IPS, SIEM, and CASB alone do not provide the integrated remote connectivity and firewall architecture described.
Question 252
Executives at a company are concerned about employees accessing systems and information about sensitive company projects unrelated to the employees’ normal job duties. Which of the following enterprise security capabilities will the security team most likely deploy to detect that activity?
A. UBA
B. EDR
C. NAC
D. DLP
Show Answer
Correct Answer: A
Explanation: User Behavior Analytics (UBA) is designed to establish baselines of normal user activity and detect anomalous behavior, such as employees accessing sensitive systems or project information unrelated to their typical job responsibilities. EDR focuses on endpoint threats, NAC controls network access, and DLP primarily monitors/prevents unauthorized data exfiltration rather than identifying unusual access patterns.
Question 253
A security engineer configured a remote access VPN. The remote access VPN allows end users to connect to the network by using an agent that is installed on the endpoint, which establishes an encrypted tunnel. Which of the following protocols did the engineer most likely implement?
A. GRE
B. IPSec
C. SD-WAN
D. EAP
Show Answer
Correct Answer: B
Explanation: IPSec is the standard protocol suite used to establish encrypted VPN tunnels for both remote-access and site-to-site VPNs. A remote-access VPN client (agent) installed on the endpoint commonly uses IPSec to create the encrypted tunnel. GRE provides tunneling but no encryption, SD-WAN is a WAN architecture rather than a VPN tunneling protocol, and EAP is an authentication framework, not the tunneling/encryption protocol.
Question 254
Which of the following tasks is typically included in the BIA process?
A. Estimating the recovery time of systems
B. Identifying the communication strategy
C. Evaluating the risk management plan
D. Establishing the backup and recovery procedures
E. Developing the incident response plan
Show Answer
Correct Answer: A
Explanation: A Business Impact Analysis (BIA) identifies critical business functions, assesses the impact of disruptions, and determines recovery requirements such as Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs). Estimating the recovery time of systems is therefore a typical BIA task. Communication strategies, backup procedures, incident response plans, and risk management plan evaluation are developed or managed in related continuity, disaster recovery, or risk management processes rather than the BIA itself.
Question 255
A systems administrator is concerned about vulnerabilities within cloud computing instances. Which of the following is most important for the administrator to consider when architecting a cloud computing environment?
A. SQL injection
B. TOC/TOU
C. VM escape
D. Tokenization
E. Password spraying
Show Answer
Correct Answer: C
Explanation: VM escape is the most important cloud-specific architectural vulnerability to consider because it targets the virtualization layer. If an attacker escapes a guest VM, they may compromise the hypervisor or other tenant VMs, breaking isolation that cloud computing relies on. The other options are either general application attacks (SQL injection, password spraying), a race condition (TOC/TOU), or a security control rather than a vulnerability (tokenization).
Question 256
An organization issued new laptops to all employees and wants to provide web filtering both in and out of the office without configuring additional access to the network. Which of the following types of web filtering should a systems administrator configure?
A. Agent-based
B. Centralized proxy
C. URL scanning
D. Content categorization
Show Answer
Correct Answer: A
Explanation: Agent-based web filtering installs a client on each endpoint to enforce web filtering policies regardless of whether the device is on the corporate network or off-site. This meets the requirement to provide filtering in and out of the office without requiring additional network access such as a VPN or proxy. A centralized proxy depends on routing traffic through a central service, while URL scanning and content categorization are filtering techniques rather than deployment models.
$19
Get all 609 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.