I85PREP
⌘ K
SEC-CISI Diploma study materials
SEC-CISI Diploma study resources

SEC-CISI Diploma practice questions

One question at a time. Build your SEC-CISI Diploma understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Unverified domain - source does not enumerate content domains

Under the UK Computer Misuse Act 1990, which offence is committed by a person who causes a computer to perform a function with intent to secure unauthorised access to program or data, knowing that the access is unauthorised?

  1. Section 3ZA - unauthorised acts causing serious damage
  2. Section 3 - unauthorised acts with intent to impair operation
  3. Section 2 - unauthorised access with intent to commit further offences
  4. Section 1 - unauthorised access offence Correct answer.

Explanation

Section 1 of the Computer Misuse Act 1990 is the basic hacking offence: causing a computer to perform a function to secure unauthorised access, with the requisite knowledge. The other sections add aggravating intent (further offences or impairment) or thresholds of serious damage, so they require more than simple unauthorised access.

Question 2Unverified domain - source does not enumerate content domains

In digital forensics, which principle best describes the requirement to preserve evidential integrity when seizing a running computer system?

  1. Files should be deleted to protect third-party personal data
  2. Volatile data should be captured before powering down, with actions logged Correct answer.
  3. The system should be shut down immediately to freeze volatile memory
  4. A write-blocker should be used for live systems to prevent disk writes

Explanation

Best practice is to capture volatile data such as RAM and network connections before shutdown, because that evidence disappears when power is removed, and to record every action in a contemporaneous log. This preserves both the volatile and persistent evidence while maintaining an auditable chain of custody.

Question 3Unverified domain - source does not enumerate content domains

Which statement correctly distinguishes a vulnerability assessment from a penetration test?

  1. A penetration test is always automated, while a vulnerability assessment is always manual
  2. A vulnerability assessment requires legal authorisation, whereas a penetration test does not
  3. A vulnerability assessment identifies and prioritises weaknesses, while a penetration test exploits them to demonstrate impact Correct answer.
  4. A penetration test only scans for missing patches, while a vulnerability assessment performs exploitation

Explanation

A vulnerability assessment is broadly about identifying and prioritising known weaknesses, often through scanning and configuration review. A penetration test goes further by attempting controlled exploitation to show real business impact and validate whether vulnerabilities are exploitable.

Question 4Unverified domain - source does not enumerate content domains

During an authorised penetration test, you discover a critical SQL injection flaw that could allow full database exfiltration in a production system. What is the most appropriate immediate action?

  1. Post the finding to a public bug bounty board for validation
  2. Notify the client contact per the agreed escalation procedure without further exploitation Correct answer.
  3. Exploit the flaw fully to extract sample customer records for the report
  4. Wait until the final report is delivered to disclose the finding

Explanation

The agreed rules of engagement normally require prompt escalation of critical findings that pose immediate risk, so the client can mitigate before exploitation causes harm. Extracting real customer records or delaying disclosure increases risk and may breach scope and data protection obligations.

Question 5Unverified domain - source does not enumerate content domains

Which HTTP response header is designed to instruct browsers to enforce HTTPS for future requests to a site?

  1. Referrer-Policy
  2. Strict-Transport-Security Correct answer.
  3. X-Frame-Options
  4. Content-Security-Policy

Explanation

Strict-Transport-Security implements HTTP Strict Transport Security, telling browsers to use HTTPS for the specified period and optionally for subdomains. It defends against protocol downgrade and cookie-hijacking attacks by preventing plaintext requests.

Question 6Unverified domain - source does not enumerate content domains

A security analyst is reviewing firewall logs and sees repeated inbound connection attempts to TCP port 3389 from a single external IP address. Which interpretation is most reasonable?

  1. The attacker has already achieved domain administrator access
  2. The host is being scanned or targeted for Remote Desktop exposure Correct answer.
  3. The traffic is normal NTP synchronisation
  4. The attacker is performing a DNS amplification attack

Explanation

TCP 3389 is the default Remote Desktop Protocol port, so repeated inbound attempts from one external address suggest scanning or brute-force targeting of exposed RDP. It does not by itself prove successful compromise, and the other options describe unrelated protocols or unsupported conclusions.

Question 7Unverified domain - source does not enumerate content domains

In the context of incident response, what is the primary purpose of the containment phase?

  1. To determine the root cause of the incident
  2. To limit the spread and impact of the incident while preserving evidence Correct answer.
  3. To restore normal operations to the affected systems
  4. To conduct lessons-learned activities after recovery

Explanation

Containment aims to stop an incident from spreading and to limit damage, while taking care not to destroy evidence needed for investigation. Root cause analysis, recovery, and lessons learned occur in later phases of the incident response lifecycle.

Question 8Unverified domain - source does not enumerate content domains

Which of the following best describes the purpose of a DMZ in network architecture?

  1. To provide a physically isolated air-gapped environment for backups
  2. To segment internet-facing services from the internal network to reduce exposure Correct answer.
  3. To encrypt all internal traffic between endpoints
  4. To replace the need for a firewall at the network perimeter

Explanation

A DMZ is a segmented network zone that hosts externally accessible services, limiting the impact if those services are compromised. It does not remove the need for perimeter firewalls and does not by itself encrypt internal traffic or provide air-gapped isolation.

Question 9Unverified domain - source does not enumerate content domains

An organisation wants to reduce the risk of credential-stuffing attacks against its customer portal. Which control most directly mitigates this threat?

  1. Requiring users to change passwords every 30 days
  2. Implementing rate limiting and breached-password detection with multi-factor authentication Correct answer.
  3. Enforcing a maximum password length of eight characters
  4. Storing password hashes using unsalted MD5

Explanation

Credential stuffing relies on reused passwords from other breaches, so detecting breached or reused credentials and adding MFA blocks unauthorised logins even when a password is known. Rate limiting also reduces automated attempt volume. Weak hashing and forced frequent rotation do not address the core threat.

Question 10Unverified domain - source does not enumerate content domains

In risk management terminology, what does the term 'residual risk' mean?

  1. The risk introduced by implementing a new control
  2. The risk that remains after controls have been applied Correct answer.
  3. The total risk before any controls are considered
  4. The risk accepted by a third-party supplier

Explanation

Residual risk is the exposure that remains once existing or planned controls have been applied to an identified risk. It is compared against the organisation's risk appetite to decide whether further treatment is required.

Question 11Unverified domain - source does not enumerate content domains

A company's web application accepts user-supplied URLs and fetches them to generate previews. An attacker submits an internal metadata endpoint URL and receives its response. Which vulnerability class does this illustrate?

  1. Cross-site scripting
  2. Insecure deserialization
  3. SQL injection
  4. Server-side request forgery Correct answer.

Explanation

Server-side request forgery occurs when an application fetches a user-controlled URL, allowing the attacker to reach internal services such as cloud metadata endpoints. The server makes the request on the attacker's behalf, bypassing network restrictions.

Question 12Unverified domain - source does not enumerate content domains

Which cryptographic property is provided by a digital signature but not by a message authentication code (MAC)?

  1. Integrity of the message contents
  2. Protection against replay of the message
  3. Confidentiality of the message contents
  4. Non-repudiation through public verifiability Correct answer.

Explanation

A digital signature uses asymmetric keys, so anyone with the public key can verify it, providing non-repudiation. A MAC uses a shared secret, so both parties could have produced it, and neither provides confidentiality or replay protection on its own.

Question 13Unverified domain - source does not enumerate content domains

What is the main security benefit of using a salted password hashing scheme such as bcrypt or Argon2?

  1. It allows passwords to be recovered if the user forgets them
  2. It encrypts the password so administrators cannot read it
  3. It makes precomputed rainbow-table attacks impractical and slows brute force Correct answer.
  4. It guarantees the password will never be cracked

Explanation

Unique salts ensure identical passwords produce different hashes, defeating precomputed tables, while deliberately slow, memory-hard algorithms increase the cost of brute-force guessing. No hashing scheme makes cracking impossible or allows password recovery.

Question 14Unverified domain - source does not enumerate content domains

A security team observes anomalous outbound DNS queries with long, high-entropy subdomains to a single domain at regular intervals. Which technique is most likely being used?

  1. DNS tunnelling for data exfiltration Correct answer.
  2. Cross-site request forgery
  3. Kerberoasting against Active Directory
  4. ARP spoofing on the local segment

Explanation

Long, encoded subdomain labels sent repeatedly to one domain are characteristic of DNS tunnelling, where data is smuggled in query names. The pattern reflects exfiltration or command-and-control over a protocol that is often allowed through egress filtering.

Question 15Unverified domain - source does not enumerate content domains

Which access control model assigns permissions based on a user's job role rather than individual identity?

  1. Role-based access control Correct answer.
  2. Rule-based access control
  3. Discretionary access control
  4. Mandatory access control

Explanation

Role-based access control grants permissions to roles, and users inherit permissions by being assigned to a role. This simplifies administration because access changes when a user's role changes rather than requiring per-user permission edits.

Question 16Unverified domain - source does not enumerate content domains

An organisation is adopting a zero trust architecture. Which principle is most central to this approach?

  1. Trusting all traffic that originates inside the corporate network
  2. Relying solely on perimeter firewalls for access control
  3. Granting permanent broad access to reduce authentication friction
  4. Verifying every request explicitly regardless of network location Correct answer.

Explanation

Zero trust rejects implicit trust based on network location and requires explicit verification of every access request using identity, device, and context signals. Access should be least-privilege and continuously evaluated rather than assumed from being on the internal network.

Question 17Unverified domain - source does not enumerate content domains

In a Security Information and Event Management (SIEM) system, what is the role of log correlation rules?

  1. To encrypt logs in transit to the SIEM
  2. To link related events across sources into a single meaningful alert Correct answer.
  3. To compress log storage by discarding low-severity events
  4. To automatically patch vulnerable endpoints

Explanation

Correlation rules combine events from multiple sources, such as a failed-login burst followed by a successful login, into one alert that represents a meaningful pattern. This reduces noise and helps analysts detect multi-stage activity that single events would not reveal.

Question 18Unverified domain - source does not enumerate content domains

Which of the following is the strongest example of defence in depth for protecting a database server?

  1. Using only a host-based antivirus product
  2. Layered controls including network segmentation, patching, least-privilege accounts, and encryption Correct answer.
  3. A single very strong perimeter firewall rule
  4. Relying on an annual penetration test alone

Explanation

Defence in depth combines independent, overlapping controls so that failure of one does not expose the asset entirely. Segmentation, patching, least privilege, and encryption each reduce different attack paths, unlike a single control.

Question 19Unverified domain - source does not enumerate content domains

During a forensic investigation, why is a cryptographic hash of a disk image recorded at acquisition?

  1. To convert the image into a bootable virtual machine
  2. To compress the image for faster transfer
  3. To demonstrate that the image has not been altered since acquisition Correct answer.
  4. To encrypt the image against unauthorised access

Explanation

A hash taken at acquisition and recomputed later proves the image is bit-for-bit identical to the source, supporting evidential integrity. It is a verification mechanism, not a compression, encryption, or conversion technique.

Question 20Unverified domain - source does not enumerate content domains

Which of the following best describes the purpose of a security policy exception (waiver) process?

  1. To allow a documented, time-bound deviation from policy with risk acceptance Correct answer.
  2. To bypass change management for urgent deployments
  3. To permanently exempt senior managers from all security controls
  4. To transfer legal liability for a breach to the vendor

Explanation

An exception process records a justified deviation from policy, the associated risk, an approver, and an expiry or review date. This keeps risk visible and accountable rather than creating permanent or undocumented gaps.

Question 21Unverified domain - source does not enumerate content domains

A penetration tester is asked to test a cloud-hosted application. Which document most clearly defines the permitted targets, techniques, and timing of the test?

  1. The disaster recovery plan
  2. The rules of engagement Correct answer.
  3. The privacy notice
  4. The service level agreement

Explanation

Rules of engagement specify in-scope systems, allowed techniques, testing windows, escalation contacts, and constraints for an authorised test. They provide the legal and operational boundaries the tester must follow.

Question 22Unverified domain - source does not enumerate content domains

Which attack technique involves an adversary sending crafted requests to a web application to trick the server into making requests with the victim's authenticated session, bypassing the need to steal credentials?

  1. Directory traversal
  2. SQL injection
  3. Session fixation
  4. Cross-site request forgery Correct answer.

Explanation

Cross-site request forgery exploits a victim's active authenticated session by causing their browser to send a state-changing request the attacker crafted. The server sees a valid session cookie and performs the action, so no credential theft is required.

Question 23Unverified domain - source does not enumerate content domains

An organisation stores backups on immutable object storage with versioning enabled. Which threat does this most directly mitigate?

  1. Ransomware encrypting or deleting backup data Correct answer.
  2. Insider theft of physical laptops
  3. Man-in-the-middle attacks on internal traffic
  4. Phishing of user credentials

Explanation

Immutable, versioned backups cannot be altered or deleted within the retention window, so ransomware that compromises administrative credentials cannot destroy recovery points. This directly supports recovery from destructive attacks.

Question 24Unverified domain - source does not enumerate content domains

Which of the following is the most reliable indicator that a web server has been compromised through a web shell?

  1. Unexpected server-side scripts in the web root making outbound connections Correct answer.
  2. A scheduled operating system patch installation
  3. Periodic log rotation completing successfully
  4. A routine increase in legitimate user logins

Explanation

A web shell is typically a script placed in the web root that accepts commands and often makes outbound connections to attacker infrastructure. Unexpected scripts with network activity are a strong compromise indicator, unlike normal patching, logins, or log rotation.

Question 25Unverified domain - source does not enumerate content domains

What is the primary security rationale for applying the principle of least privilege to service accounts?

  1. It allows service accounts to share passwords securely
  2. It removes the need for logging service account activity
  3. It improves application performance by reducing permission checks
  4. It limits the damage an attacker can cause if the account is compromised Correct answer.

Explanation

Least privilege ensures a service account has only the permissions required for its function, so compromise or misuse cannot reach unrelated resources. This reduces blast radius and supports accountability.

Question 26Unverified domain - source does not enumerate content domains

In an incident response programme, which activity belongs to the post-incident review rather than to containment or eradication?

  1. Documenting lessons learned and updating detection rules and playbooks Correct answer.
  2. Isolating an affected host from the production network segment
  3. Removing the malicious binary and restoring the host from a clean image
  4. Resetting credentials for all accounts that touched the compromised host

Explanation

The post-incident phase is where the team captures what happened, why controls failed, and what must change, producing lessons learned and updated playbooks or detection content. Isolation, credential resets and malware removal are active handling steps that occur before the review closes the case.

Question 27Unverified domain - source does not enumerate content domains

An attacker sends an email that appears to come from the finance director and asks a clerk to approve an urgent payment to a new supplier. Which category of social engineering does this best illustrate?

  1. Business email compromise Correct answer.
  2. Tailgating
  3. Watering hole attack
  4. Shoulder surfing

Explanation

Business email compromise impersonates or hijacks a trusted executive or supplier account to authorise fraudulent payments or data disclosure. The other techniques rely on physical proximity or compromise of a website visited by the target group, neither of which is described here.

Question 28Unverified domain - source does not enumerate content domains

Which control best mitigates the risk of an attacker using stolen session cookies to impersonate an authenticated user?

  1. Disabling HTTPS on internal applications to reduce processing overhead
  2. Increasing the minimum password length for all users
  3. Storing session identifiers in local storage without any expiry
  4. Binding session tokens to client attributes and enforcing short session lifetimes Correct answer.

Explanation

Binding tokens to attributes such as the client address or a device fingerprint and keeping lifetimes short limits the usefulness of a stolen cookie. Password length does not protect an already-issued session, and removing transport encryption or allowing indefinite tokens increases exposure.

Question 29Unverified domain - source does not enumerate content domains

Under the GDPR, which role is responsible for determining the purposes and means of processing personal data?

  1. The data controller Correct answer.
  2. The data subject
  3. The supervisory authority
  4. The data processor

Explanation

The controller decides why and how personal data is processed and carries the primary accountability for lawfulness. Processors act on the controller's instructions, subjects are the individuals concerned, and supervisory authorities regulate and enforce.

Question 30Unverified domain - source does not enumerate content domains

What is the primary purpose of a change management process from a security standpoint?

  1. To eliminate the need for testing before deployment
  2. To transfer all change risk to the external supplier
  3. To guarantee that every change improves system performance
  4. To ensure changes are assessed, approved and recorded so that security impact is understood and reversible Correct answer.

Explanation

Change management ensures modifications are reviewed for risk, authorised, documented and recoverable, which reduces the chance of introducing weaknesses or outages. It does not promise performance gains, remove supplier accountability, or replace testing.

Question 31Unverified domain - source does not enumerate content domains

Which hashing approach is most appropriate for storing user passwords?

  1. Base64 encoding of the password before storage
  2. A memory-hard, salted password hashing function such as Argon2id Correct answer.
  3. A reversible encryption function with a key stored beside the database
  4. A fast general-purpose hash such as SHA-256 applied once

Explanation

Password storage requires a deliberately slow, salted, memory-hard function so that offline guessing is expensive, and Argon2id is designed for this purpose. Fast hashes, reversible encryption with co-located keys, and encoding all fail to resist cracking.

Question 32Unverified domain - source does not enumerate content domains

In a public key infrastructure, what is the role of a certificate revocation list?

  1. To store the audit logs of the certificate authority
  2. To reissue expired certificates automatically to all subscribers
  3. To list certificates that must no longer be trusted before their expiry date Correct answer.
  4. To publish the private keys of revoked users for recovery

Explanation

A revocation list identifies certificates that the issuing authority has invalidated early, for example after key compromise, so relying parties can reject them. It never distributes private keys, and it neither reissues certificates nor serves as an audit store.

Question 33Unverified domain - source does not enumerate content domains

An organisation wants to detect a compromised server that is beaconing to an external command-and-control host over HTTPS. Which detection approach is most likely to succeed?

  1. Verifying that the server's operating system licence is current
  2. Analysing outbound connection metadata for regular intervals, unusual destinations and consistent payload sizes Correct answer.
  3. Reviewing the server's disk utilisation trends over the past quarter
  4. Checking that the server's antivirus signatures were updated yesterday

Explanation

Encrypted beaconing hides content but not the pattern: periodic connections, rare destinations and stable transfer sizes are visible in flow and proxy metadata. Disk, signature and licence checks do not reveal command-and-control traffic.

Question 34Unverified domain - source does not enumerate content domains

A web application stores uploaded files under a directory that is directly reachable by URL and executes any file with a .php extension. Which remediation most directly removes the risk of remote code execution?

  1. Storing uploads outside the web root and serving them through a handler that never executes them Correct answer.
  2. Adding a content security policy header to the upload form
  3. Renaming uploaded files to random strings while keeping the .php extension
  4. Increasing the maximum permitted upload size

Explanation

The root cause is that attacker-controlled content is both web-reachable and executable. Moving files outside the web root and serving them inertly removes execution capability regardless of filename. Random names and headers do not stop execution, and size limits are unrelated.

Question 35Unverified domain - source does not enumerate content domains

Which practice most effectively reduces the risk of a successful supply chain compromise through a third-party software library?

  1. Trusting any library that is popular on public repositories
  2. Relying solely on the vendor's marketing claims about security
  3. Maintaining a software bill of materials and pinning verified versions with integrity checks Correct answer.
  4. Allowing developers to pull the latest version at build time without review

Explanation

A software bill of materials gives visibility of components, while version pinning and integrity verification prevent silent substitution or unexpected updates. Popularity, unpinned latest versions and vendor claims are not evidence of trustworthiness.

Question 36Unverified domain - source does not enumerate content domains

A security operations team wants to reduce alert fatigue without losing coverage. Which approach best achieves this?

  1. Routing every alert directly to the executive team
  2. Tuning detections with context and enrichment, and risk-based prioritisation of alerts Correct answer.
  3. Disabling all rules that generate more than one alert per day
  4. Increasing the retention period of raw logs only

Explanation

Effective tuning removes false positives using asset criticality, identity context and threat intelligence, so analysts focus on alerts that matter. Blanket rule disabling loses coverage, escalation to executives is not triage, and longer retention alone does not reduce noise.

Question 37Unverified domain - source does not enumerate content domains

Which statement best describes the security value of network segmentation in a flat enterprise network?

  1. It removes the need for authentication between systems
  2. It encrypts all traffic automatically without configuration
  3. It limits lateral movement by restricting which systems can communicate with each other Correct answer.
  4. It guarantees that no host can ever be compromised

Explanation

Segmentation constrains reachability so that a compromise in one zone cannot spread freely to others. It does not replace authentication, does not provide encryption by itself, and cannot guarantee that no host will be breached.

Question 38Unverified domain - source does not enumerate content domains

A developer proposes storing API keys in a mobile application's source code to simplify deployment. Which response is most appropriate?

  1. Approve it because the code is compiled and therefore unreadable
  2. Approve it if the repository is set to private
  3. Reject it and move secrets to a server-side secret manager with short-lived credentials Correct answer.
  4. Approve it if the keys are Base64 encoded

Explanation

Anything shipped to a client can be extracted, so secrets must not reside in client code; server-side secret management with short-lived tokens limits exposure. Compilation, private repositories and encoding offer no real protection.

Question 39Unverified domain - source does not enumerate content domains

Which indicator most strongly suggests that a phishing email is attempting to spoof a trusted brand?

  1. The message was delivered on a weekday morning
  2. The message uses a display name matching the brand while the envelope sender domain is unrelated Correct answer.
  3. The message is written in the recipient's local language
  4. The message contains the company's postal address in the footer

Explanation

A mismatch between the friendly display name and the actual sending domain is a classic spoofing signal, especially when combined with failed authentication results. Timing, footer details and language are not reliable indicators of spoofing.

Question 40Unverified domain - source does not enumerate content domains

What does a risk treatment option of 'transfer' typically involve in a corporate security programme?

  1. Purchasing cyber insurance or contracting liability to a third party Correct answer.
  2. Eliminating the activity that creates the risk entirely
  3. Accepting the risk and taking no further action
  4. Applying additional technical controls to reduce likelihood

Explanation

Transfer shifts the financial consequence of a risk to another party, commonly through insurance or contractual arrangements. Acceptance, avoidance and mitigation are distinct treatment options with different effects.

Question 41Unverified domain - source does not enumerate content domains

A database administrator needs read-only access to production for a one-hour troubleshooting session. Which approach best applies least privilege and just-in-time access?

  1. Granting full administrative rights in case more access is needed
  2. Sharing a colleague's existing administrative credentials
  3. Issuing a time-bound, scoped role that expires after the session and is logged Correct answer.
  4. Granting permanent read-only access to the whole production estate

Explanation

A time-limited role scoped to the required data grants only what the task needs and records the activity. Permanent broad access, credential sharing and over-provisioning all violate least privilege and reduce accountability.

Question 42Unverified domain - source does not enumerate content domains

Which control most directly mitigates the risk of a successful brute-force attack against an internet-facing login service?

  1. Removing the password field in favour of a static PIN
  2. Increasing the session timeout to eight hours
  3. Publishing the login page on an obscure URL only
  4. Adding a CAPTCHA and progressive account lockout with rate limiting Correct answer.

Explanation

Rate limiting, lockout with backoff and challenge mechanisms raise the cost of automated guessing. Longer sessions, weaker static secrets and URL obscurity do not impede automated attempts.

Question 43Unverified domain - source does not enumerate content domains

A cloud storage bucket is reported as publicly readable. Which combination of actions best reflects a sound response?

  1. Delete the bucket immediately without preserving evidence
  2. Rotate the bucket name and leave permissions unchanged
  3. Restrict public access, enable access logging, review what was exposed and notify per policy Correct answer.
  4. Ignore it because the data is stored in the cloud and therefore managed by the provider

Explanation

Containment means removing public access first, then establishing scope through logs and access records, and following notification obligations. Providers operate the platform but not the customer's configuration, and destroying evidence or renaming the bucket does not fix permissions.

Question 44Unverified domain - source does not enumerate content domains

Which statement best explains why an organisation should maintain an asset inventory for security purposes?

  1. It enables identification of unpatched, unknown or unauthorised devices that require protection Correct answer.
  2. It guarantees compliance with every regulatory framework
  3. It removes the need to patch systems because inventory records their location
  4. It replaces the need for vulnerability scanning

Explanation

You cannot protect what you have not identified; an accurate inventory exposes shadow IT, unsupported systems and missing patches. It does not itself patch, guarantee compliance, or substitute for scanning.

Question 45Unverified domain - source does not enumerate content domains

A team is designing logging for a high-value application. Which design choice best supports later forensic use of the logs?

  1. Logging only successful authentication events
  2. Centralising logs with synchronised timestamps, integrity protection and restricted write access Correct answer.
  3. Storing logs only on the local disk of the application server
  4. Overwriting log files daily to conserve disk space

Explanation

Forensic value depends on trustworthy, time-correlated records that an attacker cannot easily alter or erase. Centralisation, time synchronisation, integrity controls and access restriction provide that; local-only, rapidly overwritten or incomplete logs do not.

Question 46Unverified domain - source does not enumerate content domains

An organisation uses a bring-your-own-device policy for staff laptops. Which control best addresses the risk of corporate data residing on unmanaged personal devices?

  1. Requiring staff to promise verbally that they will not copy data
  2. Applying containerisation with selective wipe and conditional access based on device compliance Correct answer.
  3. Allowing any device that has a personal firewall enabled
  4. Disabling multi-factor authentication to simplify access from personal devices

Explanation

Work profile containerisation separates corporate data, selective wipe removes it without touching personal content, and conditional access enforces device health. Verbal commitments, minimal firewall checks and weakened authentication do not control data on personal endpoints.

Question 47Unverified domain - source does not enumerate content domains

Which is the most significant limitation of relying solely on signature-based antivirus for endpoint protection?

  1. It consumes too much network bandwidth during installation
  2. It requires the endpoint to be powered off to update
  3. It only works on servers and never on workstations
  4. It cannot detect previously unseen or heavily obfuscated malware that lacks a known signature Correct answer.

Explanation

Signature matching depends on prior knowledge of malicious code, so novel, polymorphic or fileless threats can evade it. Behavioural analytics and heuristics are needed to complement signatures. Bandwidth, update mechanics and platform scope are not the core limitation.

Question 48Unverified domain - source does not enumerate content domains

A penetration tester discovers that an internal application accepts a user-supplied identifier and returns another customer's records when the value is changed. Which weakness class and primary remediation pair is correct?

  1. Race condition; add a CAPTCHA to the form
  2. SQL injection; hide the identifier in the interface
  3. Cross-site scripting; add output encoding only
  4. Insecure direct object reference; enforce server-side authorisation checks on every object access Correct answer.

Explanation

Changing an identifier to reach another user's data is an access control failure, often called insecure direct object reference. The fix is server-side authorisation that verifies the requester is entitled to the specific object, not merely hiding values or encoding output.

Question 49Unverified domain - source does not enumerate content domains

An organisation wants to demonstrate that a critical control is operating effectively throughout the year, not just at a point in time. Which evidence approach is strongest?

  1. A vendor datasheet describing the product's capabilities
  2. Continuous control monitoring with sampled evidence and exception tracking over the period Correct answer.
  3. A verbal assurance from the system owner
  4. A one-off screenshot of the configuration taken during the audit week

Explanation

Operating effectiveness over a period requires evidence collected across that period, including samples and documented exceptions. A single screenshot, an assurance statement or a datasheet shows design or momentary state rather than sustained operation.

Question 50Unverified domain - source does not enumerate content domains

During a tabletop exercise, participants realise that the incident response plan names a contact who left the company a year ago. Which underlying programme weakness does this most directly reveal?

  1. Weak cryptographic algorithms in the backup system
  2. Absence of a maintained and tested plan with current contact and role information Correct answer.
  3. Inadequate physical access control at the data centre
  4. Insufficient network segmentation between zones

Explanation

Stale contact data shows the plan has not been reviewed or exercised against current staffing, which is a plan maintenance and testing failure. Segmentation, cryptography and physical controls are unrelated to out-of-date escalation details.