A system administrator configures user accounts so each employee only has the rights required to perform their job functions. Which endpoint configuration concept is being implemented?

A manufacturing plant uses several PLCs (Programmable Logic Controllers) connected to a SCADA network. To protect these systems, the security team implements strict network segmentation and unidirectional gateways to control data flow. What is the main goal of using unidirectional gateways?

An organization allows employees to use personal smartphones for work, but requires installation of a management app that enforces encryption and security policies. Which deployment model is this?

A mobile administrator enables password locks on all company iPhones. The administrator explains that this automatically triggers “Data Protection” encryption for apps that use the feature. What type of security measure is being implemented?

An IT technician disables unused USB ports, removes unnecessary software, and applies full-disk encryption to company laptops. Which security goal do these actions best support?

A security analyst detects a Wi-Fi network named “CompanyGuest-FreeWiFi” broadcasting near headquarters. Employees report slow connections and redirected logins. Which threat is most likely occurring?

A system administrator is configuring HTTPS for a company website. During a vulnerability scan, the tool reports that the web server supports TLS 1.0 and SSL 3.0. Which action should the administrator take to secure the site?

A company’s mail server has been flagged for sending spam. The security analyst finds that the organization has no SPF or DKIM records in DNS. Which of the following should be implemented to prevent this issue in the future?

An organization wants to ensure that sensitive emails are encrypted and digitally signed so recipients can verify their authenticity. Which technology should the administrator deploy?

A security engineer is tasked with securing the company’s internal DNS from being used for data exfiltration and spoofing attacks. Which of the following solutions provides validation of DNS responses?

A developer rushes to meet a software release deadline and skips thorough input validation. Shortly after release, attackers exploit the application by injecting SQL commands into input fields. Which secure coding practice could have prevented this attack?

An organization experiences an increase in phishing and Business Email Compromise (BEC) attempts. The CISO decides to implement a centralized control point that filters emails, scans attachments, and sanitizes links before delivery. Which security tool is being deployed?

A company currently uses FTP for file transfers, but management wants to protect data confidentiality without changing the overall workflow. Which protocol should replace FTP?

A security analyst is the first to respond after a user reports unusual network activity. The analyst collects evidence, isolates the affected system, and notifies management. At which stage of the incident response process is the analyst currently operating?

During a forensic investigation, a technician creates a bit-by-bit copy of a hard drive and calculates a hash value for the original and the copy. What is the purpose of hashing in this scenario?

A SOC team receives a flood of alerts from the organization’s SIEM. After analysis, they discover most alerts are false positives caused by normal network behavior. Which of the following should the team do to improve detection accuracy?

An analyst investigating a ransomware attack uses Windows Event Logs, IDS alerts, and NetFlow data to trace the attacker’s movement within the network. Which concept is being demonstrated here?

A company receives a court order to preserve digital evidence related to a data breach. The security team is instructed not to modify, overwrite, or delete any related data. Which principle is being applied?

A SOC analyst discovers an unusual PowerShell process running from memory on several workstations. The malware uses legitimate Windows tools to execute malicious code and maintain persistence via registry entries. Which type of malware is this most likely describing?

An attacker gains access to a Windows domain controller and extracts Kerberos tickets to authenticate to other systems without knowing user passwords. Which type of attack has occurred?

A security engineer notices that multiple compromised systems across the internet are sending massive amounts of SYN requests to the organization’s web server, causing resource exhaustion. Which attack is being observed?

A company’s wireless intrusion detection system reports an SSID that matches the corporate Wi-Fi name but originates from a different MAC address. Employees who connect report credential theft. Which type of attack is this?

What is spyware??

Why is it important to change the default password on devices such as wireless access points and routers?

___________ is the European Union (EU) standard for handling data that affects companies doing business in the EU.