Practice Test #2

OCSP (Online Certificate Status Protocol) is a revocation-checking mechanism that lets a client query whether a certificate is still valid or has been revoked. It is useful for certificate status validation and can be optimized with OCSP stapling, but it does not allow one certificate to represent multiple domain names. Therefore, it does nothing to reduce the number of certificates needed for many hosted sites. Its purpose is certificate status checking, not certificate name consolidation.

A CRL (Certificate Revocation List) is a published list of certificates that a CA has revoked before their expiration dates. Clients or systems can consult the CRL to determine whether a certificate should no longer be trusted, but this is unrelated to how many domain names a certificate can cover. CRLs may affect revocation operations and trust decisions, but they do not help minimize certificate count. The question is about multi-domain coverage, which CRLs do not provide.

A Type 1 hypervisor (bare-metal) runs directly on hardware and hosts multiple virtual machines. Each VM includes its own full guest OS and its own kernel, which does not share the host kernel. While it provides strong isolation and is common in enterprise virtualization, it fails the “share the kernel” requirement described in the question.

A Type 2 hypervisor runs on top of a host operating system (hosted virtualization). Like Type 1, it runs full VMs with separate kernels per guest OS. It is typically used for desktop/lab scenarios (e.g., VirtualBox, VMware Workstation). It does not meet the requirement to share the host kernel and is generally heavier than containers.

Virtual Desktop Infrastructure (VDI) centralizes and delivers user desktop sessions (persistent or non-persistent) from a server environment to endpoints. It is focused on end-user computing, not isolating individual services on a single host. VDI may use VMs or session-based desktops, but it is not the best fit for “one service per environment” with a shared host kernel.

Emulation imitates hardware/CPU architectures or platforms in software (e.g., running ARM code on x86). It is useful for compatibility and testing but typically incurs significant performance overhead. Emulation does not inherently provide the container model of isolated environments sharing the host kernel; instead, it often abstracts hardware to run different OS/architectures.

An external drive is not a typical destination for PLC tag data aggregation. Tag data is high-volume, continuous, and time-sensitive; it needs reliable ingestion, timestamping, buffering, and query capabilities. External drives are more suited to manual backups or offline data transfer, not real-time collection for visualization and predictive maintenance. They also introduce integrity and availability risks in operational environments.

Cloud storage can store OT data, but it is usually not the first or most likely destination for raw PLC tag streams. OT networks are commonly segmented, and direct PLC-to-cloud paths are discouraged. Typically, data is collected locally (historian/gateway), then forwarded northbound through an OT DMZ to cloud services. Cloud storage alone also lacks historian-specific features like compression, quality flags, and high-rate time-series ingestion.

“System aggregator” is ambiguous and could refer to a SCADA server, IIoT gateway, or middleware that collects data from multiple PLCs. While aggregators can normalize protocols and forward data, the question asks for the most likely destination for tag data used for visualization and predictive maintenance. In OT architectures, that destination is usually a historian, which is purpose-built for storing and serving time-series tag history.

Monitoring for IoCs associated with C2 communications is network-relevant, but it is primarily signature/indicator-driven and depends on having known domains/IPs/JA3 hashes/URLs. Ransomware operators frequently rotate infrastructure, use legitimate services, or encrypt traffic, reducing IoC effectiveness. The question asks for network-level analysis to identify outbound traffic from infected machines in general, which is better served by flow/egress anomaly analysis.

Tuning alerts to identify changes to administrative groups targets identity and privilege escalation detection (e.g., attackers adding accounts to Domain Admins). While important in ransomware investigations, it is not network-level outbound traffic analysis. This action would help detect compromise and persistence, but it does not directly identify which hosts are generating suspicious egress traffic or potential exfiltration paths.

Performing binary hash comparisons is an endpoint/host-based technique used to identify known malicious files by comparing hashes against a database (e.g., EDR, threat intel). It can confirm infection on a device but does not satisfy the SOC’s request for network-level analysis of outbound traffic. Additionally, ransomware binaries may be polymorphic or packed, limiting hash-based detection.

A tabletop exercise is discussion-based and validates people/processes: decision-making, escalation paths, communications, and playbooks. While you can reference MITRE ATT&CK in a tabletop scenario, it does not execute the techniques in the environment, so it cannot truly verify whether EDR/SIEM detections trigger or whether preventive controls block the activity. It’s best for readiness and coordination, not technical TTP validation.

Sandbox detonation runs suspicious files in an isolated environment to observe behavior (processes, network calls, registry changes) and generate IOCs. This is useful for malware analysis and threat intel enrichment, but it does not validate enterprise-wide detection and prevention across identity, endpoints, and network under realistic conditions. It also focuses on samples rather than systematically exercising a set of ATT&CK techniques in production-like workflows.

A honeypot is a deception system intended to attract attackers and observe tactics, collect indicators, and provide early warning. However, it is not a structured method to test specific ATT&CK techniques on demand, nor does it comprehensively verify defensive coverage across the organization. Honeypots are opportunistic and limited to the interaction surface you expose, making them less suitable for systematic TTP verification.

Steganography is the practice of hiding arbitrary information inside another file so that the existence of the hidden data is concealed. Although it can technically hide ownership data, its primary purpose is covert communication rather than copyright marking or rights management. The question specifically asks about supporting copyright protections, which is the classic use case for watermarking. On certification exams, ownership and copyright language strongly indicates watermarking rather than steganography.

An e-signature is used to indicate approval, authenticity, or agreement and is generally associated with signer identity and document integrity. It is not covert and usually appears as an explicit signature block, certificate, or verifiable signing record. That means it does not meet the requirement to embed a hidden sign of ownership inside the document. It also supports authenticity and non-repudiation more than copyright marking.

Cryptography protects data through encryption, hashing, and related mechanisms that provide confidentiality, integrity, and authentication. It does not inherently place a persistent ownership marker inside the content for later copyright verification. Once data is decrypted, there is no embedded sign of ownership unless another technique such as watermarking is used. Therefore, cryptography alone is not the best choice for covert copyright protection of a document.

pcap refers to packet capture files/formats (e.g., tcpdump, Wireshark) used to record and analyze network traffic. It is passive/observational: it helps troubleshoot, detect attacks, and validate flows, but it does not enforce routing policies or steer traffic to destinations. It might seem related because it deals with packets, but it doesn’t control forwarding.

vmstat is a system utility that reports virtual memory, CPU, and process statistics on a host. It is used for performance monitoring and troubleshooting resource contention. It has no role in network routing, packet steering, or application-based traffic policies. It may appear in operations contexts but is unrelated to network policy routing.

DNSSEC (Domain Name System Security Extensions) provides integrity and authenticity for DNS responses using digital signatures, preventing spoofing/cache poisoning. It protects name resolution, not packet routing decisions based on application usage. While DNS influences where clients connect, DNSSEC does not implement traffic-type policies or steer packets through specific network paths.

A VPC (Virtual Private Cloud) is an isolated virtual network in a public cloud with subnets, route tables, security groups, and NACLs. While you can control routing and segmentation, VPC routing is typically destination/CIDR-based and not inherently application-aware policy steering. The question’s emphasis on application-based packet routing aligns more strongly with SDN.

Legal recourse may be discussed in post-incident activities, but it rarely reduces the likelihood of recurrence because attribution is difficult and prosecution is slow. It is more aligned with governance/legal follow-up than with immediate risk reduction. For exam purposes, lessons learned should prioritize actionable control improvements over punitive or external actions that don’t change the organization’s exposure.

Stakeholder notification is part of incident communications and regulatory response (often during containment/eradication/recovery and post-incident reporting). While important for compliance and transparency, it does not directly address why spear phishing succeeded or what will prevent the next ransomware event. This is more “manage the incident” than “reduce recurrence.”

Improving offline backup recovery speed enhances resilience and reduces downtime (RTO), but it does not reduce the probability of spear phishing or ransomware execution. It addresses impact, not likelihood. In lessons learned, it can be a secondary improvement area, but the question asks what most likely reduces the risk of reoccurrence.

Knowing which roles are targeted can help tailor training and protections, but it is less directly actionable than identifying the exact behaviors that failed and implementing compensating technical controls. Attackers often shift targets, and focusing only on “who” can miss systemic weaknesses. It’s useful context, but not as strong as D and E for preventing recurrence.

RADIUS provides centralized authentication, authorization, and accounting mainly for network access (e.g., VPN, 802.1X Wi-Fi, NAC). While it can proxy requests between realms, it is not the typical solution for unifying application access/SSO across two companies’ web and SaaS applications without merging identity stores.

TACACS+ is an AAA protocol primarily used for administrative access to network devices (routers, switches, firewalls). It offers granular command authorization and accounting, but it is not designed for federated application SSO between organizations. It would not address cross-company web application access in a merger scenario.

MFA improves authentication assurance by requiring additional factors (something you have/are/know). However, MFA does not create a trust relationship between two separate identity stores or enable cross-company SSO on its own. It can be layered onto a federated solution, but it is not the primary strategy requested.

ABAC (attribute-based access control) is an authorization approach that makes access decisions using attributes (user, resource, environment). It can help standardize authorization policies after a merger, but it does not solve the core need of authenticating users from separate identity stores across company boundaries. Federation is still required for cross-domain authentication/SSO.