Security Operations practice questions

Answer: A) The app accepts only a server certificate or public key that matches a value built into the app, even if another trusted CA issues a valid certificate

Certificate pinning makes a client trust only specific certificates or public keys, so a fraudulent certificate is rejected even if a trusted CA issued it. HSTS, OCSP stapling and Certificate Transparency are related TLS protections that don't restrict which certificate the client accepts.

• APinning limits trust to specific certificates or keys and rejects all others. An on-path attacker with a certificate from a compromised or rogue CA is blocked. The tradeoff is that the app must be updated when the pinned certificate rotates, which is why Microsoft advises against static pinning of publicly trusted certificates.
• BThis describes HTTP Strict Transport Security (HSTS). HSTS forces HTTPS but doesn't limit which CA-issued certificate the client will accept.
• CThis describes OCSP stapling. It speeds up revocation checking, but a mis-issued certificate that hasn't been revoked would still be accepted.
• DThis describes Certificate Transparency. It helps detect mis-issued certificates after the fact but doesn't stop a client from accepting one during a connection.

Answer: A) Static application security testing (SAST) and dynamic application security testing (DAST)

• ASAST inspects source/bytecode for insecure patterns early in development; DAST exercises the deployed app (fuzzing inputs, probing endpoints) to find runtime and configuration flaws. They are complementary.
• BTabletop exercises are discussion-based continuity drills, not code analysis.
• CThose are infrastructure operations, not the SAST/DAST pair for application code.
• DThose are secure-coding defenses, not the two analysis/testing methodologies asked for.

Answer: A) Image the drive through a write blocker, hash both the source and the image, and log every handoff of the evidence

A forensically sound acquisition needs all three: write blocking to protect the original, hashes of the source and the image to prove integrity, and a documented chain of custody for admissibility. Each distractor leaves one of these out.

• AThe write blocker prevents changes to the original. Matching hashes of the source and the image prove the copy is exact and unchanged. A chain-of-custody log records every handler and transfer, which supports admissibility.
• BBooting the suspect OS changes timestamps, logs and other data. Copying folders also misses deleted files, slack space and unallocated space. Hashing the files afterward only proves the copies have not changed since then, not that the original was preserved.
• CA write blocker protects the source during acquisition, but it produces no verifiable proof that the image matches the original. Without hashes of both, the image cannot be shown to be bit-for-bit identical or unchanged later.
• DAcquisition and integrity checks are sound, but with no record of who handled or accessed the evidence, chain of custody is broken and admissibility can be challenged.

Answer: A) Endpoint DLP

• AEndpoint data loss prevention detects sensitive content and blocks unauthorized transfers.
• BA host firewall controls network traffic, not USB file copies.
• CFIM detects changes to protected files, not data leaving.
• DFDE protects data at rest, not copying to USB.

Answer: A) Federation

• AFederation establishes trust between organizations so one accepts identities authenticated by the other.
• BIdentity proofing verifies a person's identity before credentials are issued.
• CRBAC assigns permissions by job role; it doesn't describe cross-organization sign-in.
• DPassword vaulting stores privileged credentials securely; it isn't a trust arrangement.

Answer: A) Agentless

• AAgentless monitoring queries systems remotely, avoiding software installation on each host.
• BAgent-based monitoring requires software installed on each monitored host.
• CInline describes a device placed in the traffic path, such as an IPS; it isn't a collection method for servers.
• DAir-gapped systems have no network connection, so they can't be monitored remotely at all.

Answer: A) WPA2/WPA3-Enterprise with 802.1X/EAP and a RADIUS server

• AEnterprise mode uses 802.1X to pass EAP authentication to a RADIUS server (often backed by the directory), so each user has unique credentials, per-session keys, and can be individually revoked.
• BPersonal mode uses one PSK for everyone — no per-user identity, and rotating it means reconfiguring every device.
• CA captive portal doesn't encrypt the air link or provide 802.1X per-user key material.
• DWEP is broken and MAC filtering is trivially bypassed by spoofing.

Answer: A) Replace Telnet with SSH so the logon and the entire session are encrypted

The finding is about plaintext exposure, so the fix has to encrypt the management session. SSH replaces Telnet with an encrypted channel, while port changes, SNMPv2c, and stronger passwords leave the traffic readable.

• ACorrect. Telnet sends everything, including credentials, as unencrypted plaintext (TCP port 23). SSH (TCP port 22) provides an encrypted, authenticated channel for the same command-line administration, which directly fixes the sniffing risk.
• BIncorrect. Changing the port only hides the service from casual scans. The traffic is still plaintext, so a packet capture still shows the credentials.
• CIncorrect. SNMPv2c sends community strings in cleartext and is meant for monitoring and polling, not interactive command-line management.
• DIncorrect. Stronger passwords resist guessing, but Telnet still sends them in plaintext, so anyone sniffing the traffic can capture them.

Answer: A) Re-validate every submitted field in the application's server-side code

Attackers control client-side validation and can bypass it with tools such as intercepting proxies. Input must be validated on the server, which treats browser checks as a usability feature only.

• ACorrect. An intercepting proxy sends requests after the browser's scripts have run, so client-side checks are bypassed. Validation must be enforced in server code, which the attacker can't skip.
• BIncorrect. Obfuscation only makes the script harder to read. The attacker still controls the request sent to the server and can bypass the browser checks completely.
• CIncorrect. Stricter rules still run in the browser. Requests sent through a proxy never pass through them, so the weakness remains.
• DIncorrect. HTTPS protects data in transit, and disabling autocomplete limits stored values. Neither one checks the content of requests the attacker crafts and sends.

Answer: A) Enforce a policy that blocks macros in Office files from the internet, and detonate attachments in a sandbox

The strongest defense against macro-based email malware combines technical enforcement and analysis: block macros in internet-sourced Office files by policy, and detonate attachments in a sandbox before delivery. Controls that depend on user choice, allow listing, or signatures alone leave gaps.

• ACorrect. The policy blocks macros in files carrying Mark of the Web, such as email attachments, so users cannot simply click to enable them. Sandbox detonation of attachments before delivery catches malicious payloads before they reach the inbox.
• BIncorrect. Microsoft rates this setting as only partially protected because the user still makes the final decision. Persuading the user to click 'Enable content' is exactly the social-engineering step these attacks rely on.
• CIncorrect. Allow listing sender domains removes inspection for those messages. Partner accounts can be compromised or spoofed, so this opens a delivery path rather than closing one.
• DIncorrect. Signature scanning is useful but often misses new or obfuscated macro malware. Without macro blocking or behavioral detonation, unknown variants can still reach users and run.