Security+ PBQ practice: read the exhibit, make the call

Review the zero trust access log entry:

Which statement BEST explains the outcome?

• AThe MFA challenge failed, so the enforcement point blocked
  The log shows MFA=passed. The denial was not caused by the authentication challenge.
• BThe enforcement point decided on its own to deny access
  The enforcement point applies the verdict from the policy decision point. It does not make the decision on its own.
• CDevice posture failed the policy evaluated before access
  Correct. MFA passed, but the unmanaged device failed posture, and the policy denied access on that basis.
• DThe HR portal rejected the user's credentials directly
  The request never reached the portal. The log shows it was denied at PEP-07 before any application sign-in.

Review the TLS client debug output:

What is the MOST significant security risk?

• AThe certificate chain is incomplete
  The output shows chain=valid. The trust path is complete.
• BThe hostname does not match the SAN
  The output shows hostname=match. There is no name mismatch.
• CA revoked certificate could be accepted
  Correct. The CRL could not be fetched and the soft-fail policy allowed the connection, so revocation was never actually checked.
• DThe certificate has already expired
  The output shows validity dates=OK. The certificate is within its validity period.

Review the EDR events on a file server:

No unknown executables were written to disk. Which conclusion is BEST?

• ALiving-off-the-land activity preparing ransomware
  Correct. Native binaries were abused to download a payload, run encoded commands and destroy recovery points, which is typical pre-ransomware living off the land.
• BRoutine backup maintenance by administrators
  Administrators do not normally delete every shadow copy and the backup catalog at 1 a.m. after an encoded script.
• CA worm propagating through open file shares
  Worms self-propagate between hosts; these events show hands-on commands on one server with native tools.
• DBloatware installed by the server vendor
  Bloatware is unwanted preinstalled software and would not issue commands to delete recovery data.

Review the log:

Every attempt used the password Winter2026!. Which attack is this?

• ABrute force
  Brute force tries many passwords against one account; here one password is tried against many accounts.
• BCredential replay
  Credential replay reuses a captured credential or token for a specific account, not guesses across users.
• CDictionary attack on one user
  A dictionary attack on one user tries many words against that account; these attempts span many users.
• DPassword spraying
  Correct. A single common password tried against many different usernames is password spraying.

Review the DNS log from one workstation:

Which conclusion is MOST likely?

• ADNS cache poisoning of the internal resolver
  Cache poisoning plants false answers for real names; here the queried names themselves are random.
• BA user mistyping popular website names
  People mistype real brand names, not hundreds of random ten-character strings per hour.
• CMalware using a domain generation algorithm
  Correct. Hundreds of random names failing until one resolves is the typical footprint of DGA-based command and control.
• DA misconfigured DNS forwarder on the host
  A misconfigured forwarder would fail real domains, not produce random strings that no one would type.

Review the API log for user id 2231:

Accounts 2232 to 2234 belong to other customers. Which issue does this BEST indicate?

• AHorizontal privilege escalation
  Correct. A normal customer reached other customers' data at the same privilege level by changing the object ID.
• BVertical privilege escalation
  Vertical escalation means gaining higher rights, such as admin; this user only reached peers' data.
• CCross-site request forgery
  CSRF uses another user's browser; this user is making the requests directly.
• DReplay of a captured token
  The user presents their own valid session; the flaw is the missing ownership check.

Review the container deployment settings:

Which risk is the MOST serious?

• AThe container will use too much CPU on the node
  CPU use is controlled by resource limits, which these settings do not address. Host takeover is the far greater risk.
• BThe image will be pulled from an untrusted registry
  Nothing in these settings refers to the image source, so registry trust cannot be judged from them.
• CA compromised container could take over the host
  Correct. Root in a privileged container with the host filesystem mounted read-write can easily escape to the host.
• DThe service will be unreachable from other pods
  hostNetwork does not make the service unreachable. It removes network isolation, which adds to the escape risk.

Review the perimeter firewall rules. The web server 172.16.10.5 sits in the screened subnet and the database 10.1.5.20 sits on the internal network:

Which change BEST reduces risk without breaking the application?

• AChange Rule 1 to allow TCP 80 only
  Moving to plain HTTP weakens web security and leaves the database exposure untouched.
• BLimit Rule 2's source to 172.16.10.5
  Correct. Restricting the source to the web server keeps the application working and blocks direct internet access to SQL.
• CMove Rule 3 to the top of the list
  Placing the deny-all rule first would block all traffic, including the legitimate web service.
• DDelete Rule 1 and keep Rule 2 as is
  Removing Rule 1 takes the website offline and leaves the database exposed.

Review the backup design for an order database:

Which change BEST meets the RPO?

• AMove the full backup from weekly to nightly
  Nightly full backups still leave up to 24 hours of orders unprotected.
• BSwitch the daily incrementals to differentials
  Differentials change what a restore needs, not how often data is captured, so the gap stays at 24 hours.
• CReplicate the weekly full backup to a new region
  Another copy of the weekly full backup adds location resilience, not a better recovery point.
• DAdd transaction log shipping every 15 minutes
  Correct. Shipping the transaction log every 15 minutes limits data loss to the RPO.

A DLP console shows:

Which change BEST prevents this from recurring?

• AChange that rule's action from monitor to block
  Correct. Blocking stops the upload instead of just recording it.
• BLower the SSN match threshold from 412 to 50
  The rule already matched; a threshold change does not stop the upload.
• CAdd personal-drive.example to the DLP allow list
  Allow-listing the site would permit exactly the behavior to prevent.
• DEmail mrivera's manager a weekly DLP summary
  A summary is after the fact and still lets the data leave.

An incident response trainer lists these steps:

Which order is correct?

• AC, E, B, D, A
  Containment must come before eradication to stop the spread first.
• BB, C, E, D, A
  You cannot contain an incident before detecting and analyzing it.
• CC, B, E, D, A
  Correct. Detection, containment, eradication, recovery, then lessons learned.
• DC, B, D, E, A
  Recovery before eradication risks restoring systems that are still compromised.

A workstation baseline requires:

Which two findings need remediation? (Choose TWO.)

• ADomain Admins is in local Administrators
  Domain Admins membership is the normal domain default and the baseline does not prohibit it.
• BThe firewall is on for all profiles
  An enabled firewall on all profiles meets the baseline.
• CBitLocker is off on the system drive
  Correct. The baseline requires full-disk encryption.
• Djdoe is in the local Administrators group
  Correct. A standard user with local admin rights breaks the baseline.