212-82 Sample Questions & Answers

This practice mitigates username enumeration (or user enumeration). If an application responds differently to an invalid username ('User not found') versus an invalid password ('Incorrect password'), an attacker can use this difference to build a list of valid usernames. By providing a generic error message ('Invalid username or password') in all failure cases, the application prevents attackers from discovering valid user accounts.

This statement is false. According to the shared responsibility model for IaaS, the cloud provider is responsible for the security of the cloud (i.e., the physical infrastructure, virtualization layer). The customer is responsible for security in the cloud, which includes securing and patching the guest operating systems, applications, and data they deploy on the infrastructure.

A Threat Intelligence Platform (TIP) aggregates, correlates, and analyzes threat data from multiple sources. Modern TIPs can integrate with other security tools like firewalls and SIEMs to automate defensive actions, such as automatically creating firewall rules to block newly identified malicious IP addresses. A honeypot is a decoy system. A load balancer distributes traffic. A vulnerability scanner identifies potential weaknesses but does not typically automate firewall rule creation in this manner.

Given that the IoT devices do not support enterprise authentication, using WPA2 or WPA3-Personal with a very strong, complex preshared key is the best available encryption option. To add another layer of security, the network should be on a separate, isolated VLAN, and MAC address filtering should be enabled to only allow the specific medical devices to connect. While MAC filtering can be spoofed, it provides a deterrent and is a valid part of a defense-in-depth strategy for limited-capability devices. Disabling SSID broadcast is a weak security measure (security by obscurity). WPA3-Enterprise is not supported by the devices.

The act of isolating compromised systems is part of the Containment phase. According to the NIST incident response lifecycle (Preparation -> Detection & Analysis -> Containment -> Eradication & Recovery -> Post-Incident Activity), the phase immediately following Containment is Eradication & Recovery. This is where the analyst would remove the malware, patch vulnerabilities, and restore the systems to normal operation.

A firewall is the correct answer. It is a network security device that monitors and filters incoming and outgoing network traffic based on an organization's previously established security policies. It acts as a barrier between a trusted internal network and untrusted external networks. Modern firewalls also perform Network Address Translation (NAT) to hide internal IP addresses.

This is a classic example of a phishing attack. Phishing is a social engineering attack where attackers send fraudulent communications (typically email) that appear to come from a reputable source to trick individuals into revealing sensitive information, such as login credentials or credit card numbers. Vishing is voice phishing (via phone), smishing is SMS phishing, and whaling is phishing that targets high-profile executives.

The default gateway (which is a router) is responsible for forwarding traffic between different subnets and to external networks like the internet. Since the user can ping the gateway's IP, it means local connectivity (Layer 2) on their subnet is working. The inability to reach anything beyond the local subnet points directly to a problem with the device that handles inter-subnet routing, which is the default gateway.

MDM with containerization is the best solution for BYOD security. Containerization creates a separate, encrypted, and managed 'container' on the device for all corporate apps and data. This allows the organization to enforce security policies (like PIN requirements, encryption) only within the container and perform a 'selective wipe' that removes only the corporate container, leaving personal data untouched. Full-device encryption protects all data but doesn't allow for selective wiping. A VPN secures data in transit but doesn't manage data at rest on the device.

Recovery Time Objective (RTO) is the maximum tolerable duration of an outage. In this case, the company can tolerate 4 hours of downtime, so the RTO is 4 hours. Recovery Point Objective (RPO) is the maximum amount of data loss that can be tolerated, measured in time. The company cannot lose more than 15 minutes of data, so the RPO is 15 minutes. This dictates that backups must occur at least every 15 minutes.