Practice Test #2

Network segmentation is the architectural practice of dividing networks into separate zones (VLANs/subnets) and controlling traffic between them using network devices and policies. While segmentation can limit access to a legacy host, the scenario describes a host-based firewall rule on the system itself, not a redesign of network boundaries or inter-segment controls.

Transfer of risk means shifting financial or operational impact to another party, such as through cyber insurance, outsourcing, or contractual agreements. A host-based firewall allowlist does not transfer responsibility or impact; it directly reduces the likelihood of unauthorized access. Therefore, it is risk mitigation, not risk transfer.

SNMP traps are asynchronous alert messages sent from managed devices to an SNMP manager to report events (e.g., interface down, high CPU). They provide monitoring and visibility but do not enforce access control. Allowing connections only from specific internal IP addresses is an access restriction, not an SNMP-based alerting mechanism.

This is incorrect because the first rule permits DNS from any source to any destination on port 53, which already allows all outbound DNS. The second rule then denies DNS from 10.50.10.25, which is the opposite of the requirement. Additionally, due to top-down processing, the initial broad permit would match first and the deny would never effectively restrict traffic as intended.

This is incorrect because it reverses the meaning of the destination. It permits traffic from any source to destination 10.50.10.25 on port 53, which would be relevant for inbound DNS to an internal DNS server, not outbound DNS originating from that host. The subsequent deny blocks all DNS to any destination, which would still not correctly allow 10.50.10.25 to query external DNS.

This is incorrect because, like option A, it begins with a broad permit allowing DNS from any source to any destination on port 53, which defeats the goal of limiting outbound DNS. The deny rule also targets traffic destined to 10.50.10.25, not sourced from it, so it does not implement “only this internal host may originate DNS.”

Subject role is an identity and access management concept used to determine authorization (e.g., RBAC/ABAC). While roles influence policy decisions, they are typically evaluated in the control plane (policy decision logic) rather than the data plane (traffic enforcement and segmentation). Roles can feed enforcement rules, but “subject role” itself is not a data-plane implementation element.

Adaptive identity refers to risk-based or context-aware authentication/authorization (device posture, location, behavior, step-up MFA). This is strongly associated with identity systems and policy decision processes (control plane). The data plane may enforce the resulting decision, but adaptive identity is not primarily about how traffic is segmented or routed; it’s about how trust is evaluated before allowing access.

Threat scope reduction is a desired outcome of Zero Trust (limiting blast radius and lateral movement). However, it is not a specific data-plane component to evaluate. The analyst would instead assess the mechanisms that achieve scope reduction—such as secured zones, microsegmentation, and enforcement points—rather than the abstract goal itself.

A perimeter network (DMZ) is a segmented network placed between the internet and the internal network, typically used to host public-facing services. While it improves segmentation, it does not by itself provide the most secure method for administrative access or minimize boundary traffic. You would still need a controlled admin entry point (like a bastion) to avoid opening management access broadly.

A WAF (Web Application Firewall) protects web applications by filtering and monitoring HTTP/HTTPS traffic, mitigating attacks like SQL injection and XSS. It is not designed to provide administrative access to internal resources or reduce management-plane exposure. Even with a WAF, you would still need a secure remote administration approach for non-web internal systems.

Single sign-on (SSO) centralizes authentication and can improve security with stronger identity controls and reduced password sprawl. However, SSO does not inherently minimize the network traffic allowed through a security boundary or reduce exposed ports/services. It addresses who can authenticate, not how many firewall openings are required for administrative connectivity.

Packet captures (PCAPs) are detailed network traffic recordings used for troubleshooting, threat hunting, and forensic analysis (e.g., reconstructing sessions, identifying C2 traffic). They are not appropriate for quarterly board reporting because they are highly technical, large in volume, and not summarized into business-relevant metrics like incident counts and trends.

Vulnerability scans identify missing patches, misconfigurations, and known CVEs to measure exposure and support remediation prioritization. While scan results can feed metrics (e.g., critical vulnerabilities over time), they do not directly answer “number of incidents that impacted the organization.” Incidents are realized events; vulnerabilities are potential weaknesses.

Metadata is data about data (timestamps, source, tags, severity labels, asset identifiers). Incident metadata can be used to build reports, but metadata alone is not a reporting or visualization tool. The board needs a consumable presentation format; metadata still requires aggregation and visualization to become an executive report.

Permissions assignment (authorization) determines what an authenticated user can access (least privilege, RBAC, ACLs). It does not prevent an attacker from successfully logging in as a user if the attacker has the user’s credentials. While proper permissions can limit damage after compromise, it does not address the core issue in the scenario: unauthorized authentication from suspicious IP addresses.

Access management is a broad term covering identity lifecycle, provisioning/deprovisioning, SSO, and policy enforcement. While it can include MFA, the option is too generic compared to the direct, specific control needed here. The question asks what to implement to prevent this type of attack (credential-based unauthorized logins) from succeeding; MFA is the precise mechanism that blocks password-only authentication.

Password complexity increases resistance to brute-force guessing, but it does not stop common real-world credential compromise methods such as phishing, keylogging, database leaks, or credential stuffing. Attackers logging in from suspicious IPs typically indicates they already have valid credentials. Complexity rules also often lead to predictable patterns and reuse. MFA is the stronger, targeted mitigation for this scenario.

Processor is the role/entity that performs processing activities on data (collecting, transforming, analyzing, or storing) typically on behalf of the data owner/controller. In many privacy frameworks, processors are often third parties (e.g., SaaS analytics vendors) acting under contract. The customer is not processing their own record here; they are the person the data is about.

Custodian is usually IT/infrastructure/security operations that implements and maintains the controls that protect data (encryption, access controls, backups, patching, logging). In the scenario, the infrastructure team securing data in transit and at rest fits custodian responsibilities. The customer is not responsible for safeguarding the organization’s stored data, so they are not the custodian.

Owner is the role accountable for the data set: classification, defining handling requirements, approving access, and ensuring compliance with policy. In many organizations, a business unit like Marketing is the data owner for customer marketing data. Although customers may have legal rights over their personal data, in Security+ role terminology they are not the organizational data owner.

Gathering IoCs (hashes, domains, IPs, file paths, registry keys) is part of incident investigation and detection engineering, primarily during identification and analysis. RCA may use IoCs as evidence, but collecting IoCs is not the main reason RCA is performed. RCA focuses on underlying causes and control failures, not just observable indicators.

Discovering which systems are affected is scoping, a key incident response activity during identification/analysis and containment planning. RCA can leverage scoping results, but scoping answers “what is impacted,” while RCA answers “why it happened” and “what must change to prevent recurrence.” Therefore this is not the best reason for RCA.

Eradicating malware is a tactical incident response phase (eradication and recovery). While RCA findings can guide eradication (e.g., remove persistence mechanisms, close initial access vector), the purpose of RCA is broader than cleanup. You can eradicate malware and still be vulnerable to the same attack if the root cause remains unaddressed.

SPF (Sender Policy Framework) is an email authentication mechanism that helps prevent sender address spoofing by publishing authorized sending hosts in DNS. It is used to improve email trust and reduce phishing/spam. SPF does not provide file/data integrity checks or change tracking for stored data, so it does not meet the requirement to monitor and detect changes in an environment.

A GPO (Group Policy Object) is used in Windows environments to centrally enforce configuration settings (password policies, security options, software restrictions, firewall rules, etc.). While GPO can harden systems and reduce unauthorized changes by limiting permissions, it does not inherently perform integrity checking or provide continuous monitoring/alerting when files or configurations change.

NAC (Network Access Control) enforces security posture before allowing devices onto a network (e.g., checking AV status, patch levels, certificates, device compliance). NAC is about controlling and segmenting network access, not monitoring the integrity of data at rest. It may reduce risk by limiting who can connect, but it does not provide checks to track changes to files/data.