Q1. A financial services firm is implementing a new security policy requiring all employees to use multi-factor authentication (MFA) for accessing customer data repositories. The IT security team needs to deploy a solution that supports time-based one-time passwords (TOTP) and push notifications via a mobile app. Which of the following authentication methods BEST meets these requirements?
-
Passwordless authentication using FIDO2 security keys
-
SMS-based one-time passwords (OTP)
-
Authenticator app with TOTP and push notifications ✓ Correct
-
RADIUS authentication with EAP-TLS certificates
Why: Authenticator apps like Google Authenticator or Microsoft Authenticator support both TOTP generation and push notifications, fulfilling the firm's requirements. FIDO2 keys offer passwordless authentication but may not inherently support push notifications in all configurations. SMS-based OTPs are vulnerable to SIM swapping attacks and do not use mobile apps for generation. RADIUS with EAP-TLS is a certificate-based authentication method, not directly related to TOTP or push notifications.
Q2. A remote employee reports that they are unable to access internal company resources, including the company intranet and file shares, when connected to their home Wi-Fi network. They can, however, access public websites. The IT department has confirmed that the VPN client software is installed and configured correctly. Which of the following is the MOST likely security control preventing access?
-
Intrusion Detection System (IDS)
-
Firewall with strict ingress filtering ✓ Correct
-
Endpoint encryption software
-
Data Loss Prevention (DLP) solution
Why: A firewall with strict ingress filtering on the internal network would block traffic originating from the VPN client if it doesn't meet specific criteria, even if the VPN connection itself is established. This prevents unauthorized access to internal resources. An IDS detects malicious activity but doesn't inherently block access. Endpoint encryption protects data at rest, not network access. A DLP solution focuses on preventing sensitive data exfiltration, not inbound access control.
Q3. An organization is developing a new internal web application that will handle sensitive employee data. To protect this data from common web vulnerabilities, the development team is advised to implement security best practices during the coding phase. Which of the following is a critical security consideration to prevent Cross-Site Scripting (XSS) attacks?
-
Implementing robust input validation and output encoding ✓ Correct
-
Using strong, unique passwords for all database accounts
-
Regularly updating the web server's operating system
-
Enabling HTTP Strict Transport Security (HSTS)
Why: Input validation ensures that data submitted by users is of the expected type and format, while output encoding prevents malicious scripts from being executed in the user's browser, directly mitigating XSS. Strong database passwords and OS updates are important security measures but do not directly prevent XSS. HSTS enforces HTTPS connections, which protects data in transit but doesn't prevent script injection into legitimate pages.
Q4. A company's IT security policy mandates that all newly provisioned workstations must have specific security configurations applied before they are deployed to end-users. This includes disabling unnecessary ports, enabling full-disk encryption, and installing a specific endpoint security suite. Which of the following processes BEST ensures these configurations are consistently applied?
-
Manual configuration by the IT support team
-
Automated deployment using a configuration management tool ✓ Correct
-
User self-configuration after receiving the workstation
-
Applying security patches after initial deployment
Why: Configuration management tools (like SCCM, Ansible, or Intune) allow for the automated and consistent application of predefined security settings across multiple devices, ensuring compliance with the policy. Manual configuration is prone to human error and inconsistency. User self-configuration is insecure and unreliable for mandatory settings. Applying patches after deployment is necessary but doesn't address the initial baseline configuration requirements.
Q5. A security analyst is reviewing logs from a critical server and notices a pattern of repeated failed login attempts from an unknown IP address, followed by a successful login from a different IP address shortly after. This activity is highly suspicious and suggests a potential account compromise. What type of attack is MOST likely being depicted?
-
Denial of Service (DoS)
-
Man-in-the-Middle (MitM)
-
Brute Force Attack ✓ Correct
-
SQL Injection
Why: Repeated failed login attempts are characteristic of a brute force attack, where an attacker tries numerous username and password combinations to gain unauthorized access. A successful login following these attempts strongly suggests the attack was successful. DoS attacks aim to overwhelm a server, not gain access. MitM attacks intercept communications. SQL injection targets databases through malicious SQL queries, not login attempts.
Q6. A small startup company is concerned about protecting its intellectual property, which is stored on a shared network drive. They want to implement a system that automatically encrypts files when they are saved and decrypts them only when authorized users access them. Which type of security control would BEST achieve this goal?
-
Network Access Control (NAC)
-
Endpoint Detection and Response (EDR)
-
File-Level Encryption ✓ Correct
-
Web Application Firewall (WAF)
Why: File-level encryption directly addresses the requirement by encrypting individual files as they are saved, ensuring confidentiality even if the storage medium is compromised or accessed inappropriately. NAC controls network access. EDR focuses on detecting and responding to threats on endpoints. A WAF protects web applications from attacks, not general file storage.
Q7. A company is undergoing a security audit and needs to demonstrate that its sensitive data is adequately protected against unauthorized disclosure. The audit requires evidence of data-at-rest protection measures. Which of the following technologies provides the MOST direct and effective protection for data stored on a company laptop's hard drive?
-
Network Intrusion Prevention System (NIPS)
-
Secure Sockets Layer (SSL) / Transport Layer Security (TLS) encryption
-
Virtual Private Network (VPN)
-
Full Disk Encryption (FDE) ✓ Correct
Why: Full Disk Encryption encrypts the entire contents of the hard drive, making the data unreadable without the correct decryption key or password, which directly protects data at rest on the laptop. NIPS protects the network perimeter from intrusions. SSL/TLS encrypts data in transit over networks. VPNs create secure tunnels for network communication but do not inherently encrypt the data stored on the laptop's disk.
Q8. A financial services company handles sensitive client data and is subject to strict regulatory compliance. The IT security team is tasked with implementing a new security control to prevent unauthorized access to customer records stored on company servers. The control must ensure that only authorized personnel can view and modify these records, maintain an audit trail of all access attempts, and be easily integrated with existing identity management systems. Which of the following security controls would BEST meet these requirements?
-
Implementing a firewall with advanced intrusion detection and prevention capabilities.
-
Deploying a full-disk encryption solution on all client workstations.
-
Enforcing multi-factor authentication (MFA) for all server access and implementing role-based access control (RBAC) on the data. ✓ Correct
-
Conducting regular vulnerability scans and penetration testing of the network infrastructure.
Why: RBAC ensures that users only have access to the data and functions necessary for their roles, directly addressing the need to limit access to sensitive customer records. MFA adds a critical layer of security by requiring multiple forms of verification, significantly reducing the risk of unauthorized access even if credentials are compromised. Implementing a firewall (distractor A) is important for network security but doesn't directly control access to specific data on servers. Full-disk encryption (distractor B) protects data if a device is lost or stolen, but it doesn't govern access to data while the system is operational. Regular vulnerability scans and penetration testing (distractor D) are essential for identifying weaknesses but are not themselves access control mechanisms.
Q9. A company issues Android smartphones to field technicians who frequently connect to public Wi-Fi at customer sites. The security team wants to ensure that if a device is lost, all corporate email and cached files can be removed without physically recovering the device, and that data at rest is unreadable. Which combination of controls BEST meets these requirements?
-
Enforce full-device encryption and enable remote wipe through the MDM console ✓ Correct
-
Require a 4-digit PIN and enable location tracking through the MDM console
-
Install a mobile antivirus app and disable Bluetooth on all devices
-
Configure a VPN profile and require biometric unlock on each device
Why: Full-device encryption makes data at rest unreadable if the device is lost, and remote wipe via MDM removes corporate data without physical access—directly satisfying both stated requirements. A PIN plus location tracking helps locate a device but does not guarantee data is encrypted or removable, and location tracking is not a wipe. Antivirus and disabling Bluetooth address malware and pairing threats, not data-at-rest protection or remote data removal. A VPN and biometric unlock protect data in transit and local access but neither encrypts stored data as required nor provides a remote wipe capability.
Q10. An IT administrator is decommissioning ten SSDs that contained regulated healthcare data. Company policy requires that the drives be reused in other systems afterward, and the data must be rendered unrecoverable in a manner appropriate to the storage technology. Which method is the BEST choice?
-
Use the drive manufacturer's ATA Secure Erase utility ✓ Correct
-
Perform a 7-pass DoD overwrite of every sector
-
Degauss each drive with a certified degausser
-
Physically shred the drives in an approved shredder
Why: ATA Secure Erase issues a firmware-level command designed for SSDs that clears all cells, including wear-leveled and over-provisioned areas, and leaves the drive intact for reuse. Multi-pass overwrite methods were designed for magnetic media and are ineffective and unnecessary on SSDs because wear-leveling prevents reliable sector targeting. Degaussing only affects magnetic fields and does nothing to flash memory, leaving SSD data intact. Physical shredding destroys the data but violates the requirement that the drives be reused.