Free ISC2 Systems Security Certified Practitioner (SSCP) Sample Questions

Correct answers: A, E — Blocking unauthorized network access with a firewall; Protecting data confidentiality with encryption

• A. Correct. A firewall blocks unauthorized traffic before it reaches the application or network, actively stopping unauthorized access. This is a preventative control designed to prevent malicious or unwanted access attempts in advance.
• B. Incorrect. An IDS is a detective control because it identifies and alerts on suspicious activity after it occurs or as it is happening. It does not primarily stop traffic from entering the environment.
• C. Incorrect. Antivirus scanning is primarily a detective control because it identifies malware that has already entered the system. While some antivirus tools can block known threats, scanning itself is about detection, not prevention.
• D. Incorrect. Security cameras are a detective control because they observe and record activity for later review. They do not prevent physical intrusion from occurring.
• E. Correct. Encryption protects data confidentiality by preventing unauthorized parties from reading sensitive data. It is a preventative control because it reduces the impact of unauthorized access to data.
• F. Incorrect. Restoring systems from backup tapes after failure is a corrective or recovery control because it helps return systems to normal after an incident. It does not prevent the incident from occurring.

Correct answer: B — Role-based training tailored to specific job functions and risks.

• A. Incorrect. While password policies are important, they are a technical or administrative control, not a core element of a security awareness and training program, which focuses on user education and behavior change rather than policy enforcement.
• B. Correct. Role-based training ensures that employees receive relevant education tailored to their specific job functions, access levels, and associated risks. This tailoring improves relevance, retention, and practical application, making it a fundamental component of an effective awareness program.
• C. Incorrect. Penetration testing is a technical security assessment activity, not a training or awareness component. Publicly releasing results is also inappropriate as it could expose vulnerabilities and is not a standard practice for awareness programs.
• D. Incorrect. Advanced threat detection systems are technical safeguards used for monitoring and incident detection. They are not part of a security awareness and training program, which focuses on educating users and changing behavior.

Correct answer: B — Security policy

• A. Incorrect. A firewall is a technical security control, as it is a hardware or software solution that enforces network access rules between networks. It is not classified as an administrative control.
• B. Correct. A security policy is an administrative control because it defines rules, procedures, and guidelines for security, focusing on human behavior and management direction. Administrative controls include policies, standards, procedures, and training.
• C. Incorrect. A mantrap is a physical security control, designed as a physical barrier to control and monitor access between two areas. It restricts unauthorized entry rather than defining security behavior.
• D. Incorrect. A surveillance camera is a physical/deterrent control used to monitor and record activity in a specific area. It does not fall under administrative controls, which are management-oriented.

Correct answer: A — Disable the account and review the offboarding process.

• A. Correct. The immediate priority is to disable the account to prevent unauthorized access. After that, reviewing the offboarding process helps identify why the account remained active and prevents future occurrences.
• B. Incorrect. Updating the offboarding policy is a valuable follow-up action, but it does not address the immediate security risk posed by the still-active account. The account must be disabled first.
• C. Incorrect. Contacting the supervisor may provide context but does not mitigate the ongoing access risk. The account should be disabled immediately before any further investigation.
• D. Incorrect. Auditing all accounts is a good proactive measure for broader remediation, but it is not the immediate action needed for the discovered active account. The first step is to disable the terminated user's account.

Correct answer: B — Ensure adherence to legal, regulatory, and organizational mandates for keeping records available.

• A. Incorrect. While minimizing storage costs can be a secondary benefit, it is not the primary purpose of data retention policies. Retention policies focus on how long data must be kept and when it can be disposed of, based on compliance requirements rather than cost alone.
• B. Correct. Data retention policies are primarily designed to ensure that records are kept for the required period to satisfy legal, regulatory, contractual, and organizational obligations. They also define when data can be securely disposed of once those requirements are met.
• C. Incorrect. Replicating critical data to offsite locations is a disaster recovery and backup function, not the main purpose of retention policies. Retention addresses how long data must be preserved, not where it is stored for resilience.
• D. Incorrect. Categorizing information by confidentiality and business value is part of data classification, not retention. Classification helps determine handling requirements, while retention defines the lifecycle and required preservation period of the data.

Correct answer: B — Agree to a coordinated disclosure timeline, allowing the maintainers reasonable time to fix the flaw.

• A. Incorrect. The (ISC)² Code of Ethics emphasizes protecting society and acting responsibly. Immediate public disclosure without coordination can lead to exploitation before a patch is available, violating the principle of minimizing harm and acting honorably.
• B. Correct. The (ISC)² Code of Ethics promotes acting in the best interest of the public and the profession. Coordinated disclosure gives the maintainers reasonable time to develop a patch, reducing risk to users while maintaining transparency and responsibility. This approach balances public safety with ethical disclosure practices.
• C. Incorrect. Keeping the vulnerability secret indefinitely violates the principle of providing diligent and competent service. It fails to protect the public, as users remain unaware and no remediation is pursued, while attackers may still discover and exploit the flaw.
• D. Incorrect. Selling vulnerability information to a third-party broker prioritizes profit over public welfare and can increase the risk of exploitation. This is inconsistent with the (ISC)² Code of Ethics, which requires professionals to act in the interest of society and avoid actions that could harm others.

Correct answers: A, B, D, F — Submitting a Request for Change (RFC) for review.; Performing a security impact analysis on changes.; Conducting a post-implementation review of changes.; Obtaining approval from the change authority.

• A. Submitting a Request for Change (RFC) for review initiates the formal change management process, documenting the proposed change for evaluation, tracking, and approval. It is a critical first step that ensures proper oversight.
• B. Performing a security impact analysis identifies risks, dependencies, and potential effects on confidentiality, integrity, and availability. This supports informed decision-making before approval or implementation.
• C. Implementing changes directly without review bypasses governance, risk assessment, and approval, increasing the likelihood of outages, vulnerabilities, or compliance issues. Change management exists to prevent unapproved changes.
• D. Conducting a post-implementation review verifies that the change achieved the intended result, identifies any unexpected issues, and helps improve future changes. It validates the effectiveness of the process.
• E. Notifying only the IT department is insufficient; communication should reach all impacted stakeholders, including security, operations, business owners, and end users, to ensure transparency and accountability.
• F. Obtaining approval from the change authority is a mandatory control that ensures the change is reviewed, authorized, and aligned with business and security requirements before implementation.

Correct answer: A — Use digital signatures to verify report integrity.

• A. Correct. Digital signatures provide integrity verification by ensuring the report has not been altered after signing. They also authenticate the signer, making unauthorized modifications detectable. If the content changes, signature verification fails, helping prevent undetected unauthorized modification.
• B. Incorrect. Encryption protects confidentiality by preventing unauthorized reading of the report, but it does not detect or prevent modifications to the data. An encrypted file can still be changed if the attacker has access, and encryption alone would not reveal tampering as effectively as a digital signature.
• C. Incorrect. Access controls restrict who can edit the report, but they do not provide cryptographic assurance that the report has not been modified. If permissions are bypassed or a privileged user changes the file, access controls alone may not detect the alteration.
• D. Incorrect. Firewalls are designed to control network traffic and help prevent unauthorized network access, but they do not protect the integrity of a report after it has been generated. They are not a mechanism for detecting or preventing content tampering in a document.

Correct answer: A — Provide lockers at the lab entrance to store personal devices before entry.

• A. Correct. Providing lockers at the lab entrance is a preventive physical control that directly enforces the policy by requiring employees to store personal devices before entering. This reduces the risk of unauthorized devices being brought into the sensitive area.
• B. Incorrect. Posting warning signs is an administrative/deterrent control, not a physical barrier. It relies on awareness and compliance but does not physically prevent devices from entering the lab.
• C. Incorrect. Configuring Wi-Fi to block MAC addresses is a technical control that only affects network connectivity, not physical presence. Personal devices can still be carried into the lab even if they cannot connect to the network.
• D. Incorrect. Issuing written warnings is a reactive administrative control that addresses violations after they occur. It does not prevent devices from entering the lab in the first place.

Correct answer: A — Extensions may require excessive data permissions

• A. Correct. Third-party extensions often request broad permissions to access sensitive data such as mail, files, or contacts, which can exceed what is necessary for their stated purpose. Excessive permissions create the highest risk because a malicious or compromised add-in can exfiltrate data or abuse the trusted context within the productivity suite.
• B. Incorrect. While licensing costs may be a financial or operational consideration, they are not a security concern. The question asks specifically about the most critical security risk, and cost does not directly affect confidentiality, integrity, or availability.
• C. Incorrect. User experience degradation is a usability issue, not a security risk. Security evaluation should focus on data protection, access control, and the potential for misuse of privileged data, not interface performance.
• D. Incorrect. While outdated extensions can pose security risks, the need for frequent manual updates is primarily an operational or maintenance issue. The most critical concern remains the permissions and data access granted to extensions at installation time.

Correct answers: A, B, C, E — Just-in-time elevation of privileges; Password vaulting for privileged accounts; Recording and monitoring of sessions; Automatic discovery of privileged accounts

• A. Correct. Just-in-time elevation of privileges is a PAM best practice that grants temporary elevated access only when needed, reducing the risk of standing privileges being exploited.
• B. Correct. Password vaulting for privileged accounts is a core PAM practice that securely stores, rotates, and controls access to privileged credentials, preventing hardcoding or sharing of passwords.
• C. Correct. Recording and monitoring of sessions is a PAM best practice that provides audit trails and accountability for actions taken with privileged access.
• D. Incorrect. Role-based access control (RBAC) across applications is a general access control mechanism, not a PAM-specific best practice, though it can complement PAM.
• E. Correct. Automatic discovery of privileged accounts is a PAM best practice that helps identify and manage all accounts with elevated permissions across the environment.
• F. Incorrect. Single sign-on (SSO) to all corporate resources is an identity and access management (IAM) practice, not a PAM-specific best practice, though it can integrate with PAM solutions.

Correct answer: C — Create a user account and assign predefined roles that map to required resources

• A. Incorrect. Creating a single user account with default group memberships does not ensure the principle of least privilege and may grant access that is too broad or insufficient for the contractor's role. Default groups often include broad permissions not tailored to specific needs.
• B. Incorrect. Manually assigning individual permissions is difficult to manage, error-prone, and does not scale well. It also increases the risk of privilege creep and misconfiguration.
• C. Correct. Creating a user account and assigning it to predefined roles aligns with role-based access control (RBAC) and the principle of least privilege. This standardizes access, simplifies administration, and supports identity lifecycle management.
• D. Incorrect. Granting temporary administrative privileges exceeds what is normally needed for a contractor and violates least privilege. Administrative access should be limited, monitored, and used only when absolutely necessary, not as a default onboarding method.

Correct answer: B — Generate a device-specific private key within the TPM and use it with a certificate for EAP-TLS authentication, binding the device to the network identity.

• A. Incorrect. Storing a password in the TPM and releasing it on each login is insecure; passwords should not be stored in plaintext and the TPM is designed for cryptographic key protection, not password vaulting. This method does not securely bind device identity to network authentication.
• B. Correct. The TPM can securely generate and protect a device-specific private key. Using this key with a certificate for EAP-TLS authentication provides strong mutual authentication and directly binds the device's hardware identity to the network identity, ensuring the device presenting credentials is the expected one.
• C. Incorrect. PCR values are measurements of system integrity used for attestation, not standalone authentication factors. Sending them to a RADIUS server does not directly authenticate the device to the network; authentication typically relies on certificates and private keys, not integrity measurements alone.
• D. Incorrect. While configuring the TPM as a virtual smart card with a PIN is a valid TPM-based authentication method, it involves user interaction and is more about user-plus-device authentication. The question focuses on binding device identity to network authentication, making the direct TPM-backed certificate approach in option B the most precise and effective method.

Correct answers: C, D — Risk mitigation; Risk transfer

• A. Incorrect. Risk acceptance means acknowledging the risk and choosing to retain it without additional controls. The organization is actively implementing a secondary data center and purchasing insurance, so it is not accepting the risk.
• B. Incorrect. Risk avoidance involves eliminating the risk entirely by not engaging in the activity. Opening a secondary data center does not eliminate the risk; it reduces impact, which is mitigation.
• C. Correct. Risk mitigation involves reducing the likelihood or impact of a risk. The secondary data center reduces the operational impact of a natural disaster on the primary data center.
• D. Correct. Risk transfer shifts the financial consequences to a third party. Purchasing insurance transfers the financial impact of the natural disaster to the insurer.
• E. Incorrect. Risk ignorance is not a valid risk treatment strategy. The organization is actively managing the risk, not ignoring it.

Correct answer: B — A heatmap correlating time buckets with the volume of malicious traffic from the source.

• A. A pie chart shows proportional distribution at a single point in time but does not capture the attack's progression or volume trends over the three-hour period, making it unsuitable for illustrating timeline and impact.
• B. A heatmap effectively correlates time intervals with traffic volume, visually illustrating the surge, duration, and intensity of the attack over the three-hour window, making it ideal for depicting the timeline and impact.
• C. A real-time dashboard widget is designed for current operational awareness and lacks historical context, making it ineffective for post-incident analysis of the attack timeline.
• D. A static table of packet headers provides detailed forensic data but is poor for quickly discerning trends, timelines, or overall impact, as it lacks visual aggregation.

Correct answer: A — Install local log collectors at each branch, forwarding compressed logs hourly to the SIEM.

• A. Correct. Installing local log collectors at each branch reduces WAN usage by aggregating, filtering, and compressing logs before forwarding them centrally. Hourly forwarding balances bandwidth constraints with near real-time analysis, as logs are still sent frequently enough for timely monitoring.
• B. Incorrect. Sending all syslog traffic directly over the internet can overwhelm bandwidth, especially with high log volumes. It also does not account for Windows servers, which typically require agents rather than native syslog, and may expose log data to interception if not properly protected.
• C. Incorrect. Keeping logs only on devices delays centralized visibility and weakens near real-time monitoring and alerting. It also increases the risk of log loss if a device fails or is compromised before logs are transferred.
• D. Incorrect. While a cloud-based log service with agents can centralize logs, it does not inherently address bandwidth constraints as effectively as local branch collectors. Continuous agent sending may still consume significant bandwidth, and it introduces management overhead and potential latency.

Correct answer: A — Duty of care

• A. Correct. Duty of care is the legal obligation to take reasonable steps to prevent foreseeable harm. By failing to enforce its own password-sharing policy, the company may have breached this duty, potentially leading to liability for the data leak.
• B. Incorrect. Respondeat superior holds employers liable for employees' actions within the scope of employment. The employee's unauthorized password sharing was against policy, so it falls outside the scope, making this principle inapplicable.
• C. Incorrect. Contributory negligence is a defense that reduces a plaintiff's claim when the plaintiff's own negligence contributed to the harm. It does not create liability for the company; rather, it could be used by a third party against the company to reduce damages.
• D. Incorrect. Vicarious liability holds an employer liable for an employee's authorized actions. Since the password sharing was unauthorized and violated policy, this principle does not apply.

Correct answer: E — Correlating scan data with current threat intelligence

• A. Confirming vulnerability existence via manual testing is a validation step, but it does not inherently involve correlating scan data with threat intelligence. While it helps reduce false positives, it focuses on verification rather than enrichment with external threat context.
• B. Installing patches is a remediation activity that occurs after analysis and prioritization. It is not part of the correlation process, which is an analytical step that combines scan data with threat intelligence to inform prioritization.
• C. Analyzing business impact is part of risk assessment and prioritization, but it does not involve correlating technical scan data with threat intelligence. It assesses potential damage rather than leveraging external threat context.
• D. Producing a detailed report for the change advisory board is a governance and change-management activity that may follow correlation, but it is not the act of correlating scan data with threat intelligence itself.
• E. Correlating scan data with threat intelligence sources is the key activity that enriches vulnerability findings with external context, such as known exploitation, attacker trends, and exploit availability. This directly supports prioritization by identifying which vulnerabilities are most relevant to the current threat landscape.
• F. Creating a remediation ticket is a workflow and tracking activity that follows assessment and prioritization. It helps assign ownership but does not describe the correlation of scan data with threat intelligence.

Correct answer: B — A write blocker to prevent any modifications to the source drive.

• A. Incorrect. A standard file-copying tool does not perform a bit-for-bit forensic image, so it may miss deleted files, slack space, and unallocated areas. Additionally, such tools can alter metadata or write to the source drive, compromising evidence integrity.
• B. Correct. A write blocker (hardware or software) prevents any write operations to the source drive during acquisition, ensuring the original evidence remains unaltered. This is a fundamental forensic best practice for maintaining integrity.
• C. Incorrect. Encryption protects data confidentiality but does not prevent modifications to the source drive during imaging. It cannot stop the operating system or examiner from accidentally writing to the drive, so it does not ensure integrity.
• D. Incorrect. A hardware duplicator can create a copy, but without a write blocker, the source drive may still be modified during the process. The primary requirement for integrity is write protection, which a duplicator alone does not guarantee.

Correct answer: C — Remove all malware and any backdoors or persistence mechanisms.

• A. Incorrect. Restoring encrypted files from a clean backup is part of the recovery phase, not eradication. Eradication focuses on removing the threat, not restoring data. Restoring data alone does not ensure the ransomware and any associated persistence mechanisms are removed.
• B. Incorrect. Reformatting and reinstalling operating systems can be an effective remediation action in severe cases, but it is not the most critical step in eradication. The critical requirement is to remove all malicious code and persistence mechanisms, which may be achieved through multiple methods. Reformatting does not guarantee removal of all persistence if not done thoroughly, and it is a more drastic measure than typically necessary.
• C. Correct. The most critical step in eradication is removing all malware, backdoors, and persistence mechanisms to ensure the threat actor cannot regain access or re-infect the system. This aligns with the NIST incident response framework, which emphasizes eliminating artifacts of the incident before recovery.
• D. Incorrect. Updating endpoint detection signatures improves future prevention and detection, but it does not eradicate the current infection. This action is part of the lessons learned or preparation phase, not the eradication phase. Best practices require removing the active threat from affected systems first.

Correct answer: B — The maximum time allowed to restore a system after a disaster to avoid unacceptable impact.

• A. Incorrect. This describes Recovery Point Objective (RPO), which is the maximum tolerable period of data loss measured in time. RPO defines how far back in time data must be restored, not how quickly a system must be recovered.
• B. Correct. RTO is the maximum acceptable amount of time a system or service can be down after a disruption before the impact becomes unacceptable. It defines the target time to restore operations and avoid unacceptable impact on business.
• C. Incorrect. This also describes Recovery Point Objective (RPO), which focuses on the last recoverable point in time for data. It does not define how long recovery should take.
• D. Incorrect. This describes a threshold for declaring a disaster or a maximum outage tolerance, which relates to business continuity planning but is not the standard definition of RTO. RTO is specifically about the time to restore operations.

Correct answer: B — Verifies the integrity and domain of the email message.

• A. Incorrect. DKIM does not encrypt email content; it is designed for authentication and integrity verification, not confidentiality. Encryption of email content is typically handled by protocols like S/MIME or PGP.
• B. Correct. DKIM uses a digital signature to verify that the message was authorized by the domain owner and that the content was not altered in transit. This verifies the integrity and domain of the email message, helping to prevent spoofing.
• C. Incorrect. While DKIM helps prevent spoofing, it does not check the sender's IP address. IP address verification is more closely associated with SPF (Sender Policy Framework).
• D. Incorrect. DKIM does not encrypt SMTP traffic between email servers. Encryption of SMTP traffic is typically handled by TLS (Transport Layer Security).

Correct answers: C, D — Proprietary research findings and trade secrets.; Personal data of data subjects under GDPR.

• A. Incorrect. Public financial reports are intended for open distribution and accessible to anyone, so confidentiality is not a primary concern. Encryption is unnecessary for such public data.
• B. Incorrect. Daily work schedules and staff attendance logs are typically internal but not highly sensitive. While some protection may be applied, they generally do not require strong encryption for confidentiality.
• C. Correct. Proprietary research findings and trade secrets are highly sensitive and valuable. Encryption is commonly used to protect their confidentiality, as unauthorized disclosure could cause competitive harm or financial loss.
• D. Correct. Personal data of data subjects under GDPR is legally protected and requires appropriate technical measures. Encryption is a key measure to ensure confidentiality and compliance with data protection regulations.

Correct answer: D — An immutable audit trail logging all approval actions, modifications, and timestamps.

• A. Digital signatures provide non-repudiation for individual approvals by linking the signer's identity to the document. However, they do not by themselves create a complete, immutable record of all actions, modifications, and timestamps, making them insufficient for a comprehensive archival record.
• B. A trusted timestamp authority records the exact time an action occurred, which supports temporal evidence but does not prove the identity of the approver or capture the full history of approval actions and changes.
• C. Encrypting the document with AES-256 protects confidentiality during transmission or storage, but it does not provide integrity, non-repudiation, or an audit trail of approval actions.
• D. An immutable audit trail logs all approval actions, modifications, and timestamps in a tamper-evident manner. This provides the most comprehensive record for accountability and long-term archival integrity, making it the best control for preserving an archival record of approval actions.
• E. A SHA-256 hash verifies that a document has not been altered after a specific point, but it does not identify who approved the document or maintain a chronological history of actions.

Correct answers: A, C, E — Schedule automated key rotation to periodically replace keys and limit exposure from compromise.; Protect high-value private keys in a FIPS 140-2 validated hardware security module (HSM).; Formally decommission and securely destroy unused cryptographic keys to prevent unauthorized data access.

• A. Correct. Automated key rotation is a best practice that limits the exposure window if a key is compromised. Regularly replacing keys reduces the risk of long-term misuse and is a standard key management control.
• B. Incorrect. Storing private keys in an encrypted file on a shared network location increases the attack surface and risk of unauthorized access. Private keys should be stored securely, such as in an HSM or with restricted access controls.
• C. Correct. Using a FIPS 140-2 validated HSM provides tamper-resistant hardware protection for high-value private keys. HSMs are designed for secure key generation, storage, and cryptographic operations, making this a strong best practice.
• D. Incorrect. Key revocation is a critical PKI control that allows revoking compromised or untrusted keys. Disabling revocation would create security risks and undermine trust in the PKI, as compromised keys remain valid.
• E. Correct. Properly decommissioning and securely destroying unused cryptographic keys reduces the attack surface and prevents unauthorized decryption of encrypted data. This is an essential part of the cryptographic key lifecycle.
• F. Incorrect. Using a single symmetric key across all applications creates a single point of failure and increases the blast radius if the key is compromised. Best practice is to use unique, scoped keys for different systems and data sets.

Correct answer: B — UDP

• A. Incorrect. TCP is a connection-oriented Transport layer protocol that establishes a session before data transfer and provides reliability through acknowledgments, retransmissions, sequencing, and flow control, which adds overhead and latency.
• B. Correct. UDP (User Datagram Protocol) is a connectionless Transport layer protocol designed for fast, low-overhead delivery. It does not provide error recovery, retransmission, or flow control, making it suitable for time-sensitive applications where low latency is prioritized over reliability.
• C. Incorrect. IP (Internet Protocol) operates at the Internet layer (Network layer) of the TCP/IP model, not the Transport layer. It handles addressing and routing of packets but does not provide transport services such as connection management or port-based communication.
• D. Incorrect. ICMP (Internet Control Message Protocol) is a Network layer protocol used for diagnostic and control purposes (e.g., ping and error reporting). It is not a Transport layer protocol and does not offer connectionless data delivery for general applications.

Correct answer: A — Define a content detection rule using regular expressions to match credit card number formats like 16-digit sequences, and apply a block action.

• A. Correct. Regular expressions (regex) provide precise pattern matching for structured data like credit card numbers, which follow predictable formats (e.g., 16-digit sequences). Pairing regex detection with a block action effectively prevents such data from leaving the network via email.
• B. Incorrect. Document fingerprinting is designed to detect exact or near-exact matches of entire documents or forms, not individual data elements like credit card numbers embedded in arbitrary email text.
• C. Incorrect. Statistical analysis monitors volume or behavioral anomalies, which may indicate exfiltration, but it does not inspect content for specific sensitive data patterns like credit card numbers.
• D. Incorrect. While ML classifiers can identify contextual patterns, credit card numbers are best detected with deterministic pattern matching (regex) for accuracy and reliability. ML is less precise for well-defined structured data.

Correct answer: A — An IDS monitors traffic and generates alerts, while an IPS can also automatically block malicious traffic.

• A. Correct. An IDS passively monitors network traffic and generates alerts when suspicious activity is detected, but does not take action. An IPS, however, is deployed inline and can automatically block or mitigate malicious traffic in real-time.
• B. Incorrect. This reverses the typical deployment models. An IDS is usually placed out-of-band as a passive sensor, while an IPS is deployed inline to actively prevent attacks.
• C. Incorrect. Both IDS and IPS can use a combination of signature-based, anomaly-based, and other detection methods. Neither is limited to a single technique.
• D. Incorrect. IDS and IPS are not defined by whether they protect against external versus internal threats. Both can detect and respond to malicious activity from either source.

Correct answer: A — Replace the hard-coded credentials with a Public Key Infrastructure (PKI) using device-specific certificates for authentication.

• A. Correct. Replacing hard-coded credentials with PKI-based device certificates eliminates static secrets, providing each device with a unique identity. This is a stronger and more scalable approach for IoT authentication and reduces the risk of credential compromise.
• B. Incorrect. Encrypting communications with IPsec protects credentials in transit, but does not address the underlying problem of hard-coded credentials stored on the device. The credentials remain vulnerable if the device is compromised or if secrets are extracted locally.
• C. Incorrect. Multi-factor authentication adds a security layer but does not resolve the issue of hard-coded embedded credentials. It is often difficult to implement on IoT devices, and the fixed secret remains a vulnerability.
• D. Incorrect. Automated password rotation may reduce exposure for ordinary accounts, but hard-coded credentials are typically embedded in firmware or configuration and cannot be easily rotated. The proper remediation is to eliminate the hard-coded secret entirely.

Correct answer: A — Install a NAC agent on each student laptop that evaluates compliance and sends results to a policy server, with RADIUS used to enforce access decisions.

• A. Correct. Network Access Control (NAC) agents evaluate endpoint compliance (e.g., patch levels, antivirus status) and relay results to a policy server, which then enforces access decisions via RADIUS. This is a robust and automated method for ensuring compliance before granting network access, providing real enforcement based on device health rather than relying on user confirmation.
• B. Incorrect. A VPN concentrator is designed for secure remote access, not for endpoint posture assessment in a NAC implementation. Deep packet inspection cannot reliably verify patch levels or antivirus status on a host; it is more suited for content inspection rather than compliance checks.
• C. Incorrect. MAC address filtering is a static and easily spoofed method. It does not verify actual compliance (e.g., patch levels or antivirus status) and is not scalable or secure for dynamic environments like a university network. It assumes devices are compliant without validation.
• D. Incorrect. A captive web portal relies on user self-reporting, which is not trustworthy for ensuring compliance. Users may lie or be unaware of their device's status, making this method ineffective for enforcing security policies. It does not provide real device posture validation or enforce access based on verified security state.

Correct answer: B — Placing the firewall inline in the virtual switch via a bridge or traffic steering

• A. Incorrect. Installing the virtual firewall as a guest VM with dedicated virtual NICs in promiscuous mode allows it to see traffic but does not reliably place it in the traffic path. Promiscuous mode may allow visibility, but it does not enforce inline inspection unless traffic is explicitly steered through the firewall. This method does not guarantee all traffic is inspected or controlled.
• B. Correct. Placing the firewall inline in the virtual switch via a bridge or traffic steering positions it directly in the path of both east-west and north-south VM traffic. This ensures all traffic must pass through the firewall for inspection and enforcement of security policies, making it the most effective method for traffic inspection and control.
• C. Incorrect. Configuring the virtual firewall in passive mode using a SPAN port on the virtual switch allows monitoring and detection but does not enforce security policies or inspect traffic in real-time. Since the requirement is to inspect and control traffic, passive mode is insufficient; inline enforcement is needed.
• D. Incorrect. Routing all VM traffic through a physical firewall via default gateway settings may work for north-south traffic but is less efficient for same-host east-west traffic, which can bypass the physical network entirely. This approach introduces latency and does not leverage the benefits of a virtual firewall placed inline within the host.

Correct answer: D — Community

• A. Incorrect. A public cloud is owned and operated by a third-party provider and delivers services to the general public or large industry groups. It does not specifically cater to organizations with shared concerns; it is a multi-tenant environment open to anyone.
• B. Incorrect. A private cloud is dedicated to a single organization and is not shared with other entities, even if they have shared concerns. It focuses on exclusive use and control by one organization.
• C. Incorrect. A hybrid cloud combines two or more distinct cloud deployment models (e.g., public and private) to allow data and application portability. It does not inherently imply sharing among multiple organizations with shared concerns; it is an architectural composition rather than a model for shared governance.
• D. Correct. A community cloud is a deployment model where the infrastructure is shared by several organizations that have common concerns, such as mission, security requirements, policy, or compliance considerations. It is designed to meet the specific needs of a group with aligned objectives.

Correct answer: A — Host-based intrusion detection system (HIDS)

• A. Correct. A Host-based Intrusion Detection System (HIDS) monitors and analyzes system activity, logs, and events on an endpoint to detect signs of malicious behavior or policy violations. It does not take automated actions but alerts administrators, making it a detective control.
• B. Incorrect. A Host-based Intrusion Prevention System (HIPS) also monitors host activity, but its primary function is to actively prevent or block detected threats in real time. It is a preventive control, not solely a detective one.
• C. Incorrect. A host-based firewall controls incoming and outgoing network traffic based on rules, focusing on traffic filtering rather than analyzing system activity for malicious behavior. It does not monitor host-level activity beyond network traffic.
• D. Incorrect. Application whitelisting allows only pre-approved applications to execute, blocking unauthorized software. It is a preventive control and does not monitor or analyze system activity for ongoing threats.

Correct answer: B — Real-time endpoint monitoring and analysis for threats

• A. Incorrect. Blocking all incoming network traffic at the perimeter is a firewall or network-based security function, not an EDR capability. EDR focuses on monitoring and responding to threats on endpoints, not on perimeter traffic filtering.
• B. Correct. EDR solutions provide real-time monitoring, detection, and analysis of endpoint activity to identify threats and support response actions. They collect endpoint telemetry and help security teams investigate and contain malicious behavior.
• C. Incorrect. Encrypting sensitive data on endpoints is a data protection function (e.g., full-disk encryption), not the primary purpose of EDR. EDR is centered on threat detection and response.
• D. Incorrect. Managing user access controls and authentication is handled by IAM solutions (e.g., MFA, SSO), not EDR. EDR monitors endpoint behavior for signs of compromise rather than managing identities.

Correct answer: B — Mobile Application Management (MAM) with application-level policies

• A. Incorrect. Mobile Device Management (MDM) with full device encryption manages the entire device, including personal data, which is often undesirable for BYOD scenarios. While it provides device-wide encryption, it does not offer application-level isolation or a virtualized environment for specific applications.
• B. Correct. Mobile Application Management (MAM) with application-level policies enables organizations to manage and secure specific corporate applications and their data on a user's personal device without controlling the entire device. It provides application-level isolation, policy enforcement, and aligns with secure virtual/containerized app environments, making it the best choice for operating and maintaining secure virtual environments on personal devices.
• C. Incorrect. Virtual Desktop Infrastructure (VDI) with thin client access delivers a full remote desktop from a centralized server, but it does not address application-level management on a user's personal device. It is more suited for centralized desktop virtualization rather than managing individual applications on mobile or personal devices.
• D. Incorrect. Containerization using a Type 2 hypervisor is not a typical approach for mobile device application isolation. Type 2 hypervisors run on top of a host operating system and are used for virtual machines, not for application containers. This option mixes technologies inaccurately and is not the best answer for secure virtual environments on personal devices.