Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
Myles, a security professional at an organization, provided laptops for all the employees to carry out the business processes from remote locations. While installing necessary applications required for the business, Myles has also installed antivirus software on each laptop following the company's policy to detect and protect the machines from external malicious events over the Internet.
Identify the PCI-DSS requirement followed by Myles in the above scenario.
The correct answer is C, as it identifies the PCI-DSS requirement followed by Myles in the above scenario. PCI-DSS is a set of standards that aims to protect cardholder data and ensure secure payment transactions. PCI-DSS has 12 requirements that cover various aspects of security such as network configuration, data encryption, access control, vulnerability management, monitoring, and testing. PCI-DSS requirement no 5.1 states that ''Protect all systems against malware and regularly update anti-virus software or programs''. In the above scenario, Myles followed this requirement by installing antivirus software on each laptop to detect and protect the machines from external malicious events over the Internet. Option A is incorrect, as it does not identify the PCI-DSS requirement followed by Myles in the above scenario. PCI-DSS requirement no 1.3.2 states that ''Do not allow unauthorized outbound traffic from the cardholder data environment to the Internet''. In the above scenario, Myles did not follow this requirement, as there was no mention of outbound traffic or cardholder data environment. Option B is incorrect, as it does not identify the PCI-DSS requirement followed by Myles in the above scenario. PCI-DSS requirement no 1.3.5 states that ''Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment''. In the above scenario, Myles did not follow this requirement, as there was no mention of inbound or outbound traffic or cardholder data environment. Option D is incorrect, as it does not identify the PCI-DSS requirement followed by Myles in the above scenario. PCI-DSS requirement no 1.3.1 states that ''Implement a firewall configuration that restricts connections between publicly accessible servers and any system component storing cardholder data''. In the above scenario, Myles did not follow this requirement, as there was no mention of firewall configuration or publicly accessible servers or system components storing cardholder data.
A large multinational corporation is In the process of upgrading its network infrastructure to enhance security and protect sensitive dat
a. As part of the upgrade, the IT team is considering implementing stateful multilayer inspection firewalls and application-level gateway firewalls.
How do stateful multilayer inspection firewalls differ from application-level gateway firewalls in terms of their packet filtering capabilities and the layers of the OSI model they inspect?
These firewalls operate by tracking the state and context of active connections, maintaining session information such as IP addresses and port numbers. They inspect packets at multiple layers of the OSI model, including the network, transport, and session layers.
Session Information Tracking:
Stateful inspection maintains a state table that keeps track of all active connections passing through the firewall, ensuring that only legitimate packets part of an established session are allowed.
Application-Level Gateway Firewalls:
Also known as proxy firewalls, these operate at the application layer of the OSI model. They filter traffic by examining the content of the packets, making decisions based on the application data, and enforcing security policies at the application level.
Control Over Applications:
Application-level gateway firewalls provide granular control over input, output, and access to applications or services. They can enforce application-specific policies, perform deep packet inspection, and block malicious traffic at the application layer.
By understanding the distinct functionalities and capabilities of stateful multilayer inspection firewalls and application-level gateway firewalls, organizations can better secure their network infrastructure.
An attacker with malicious intent used SYN flooding technique to disrupt the network and gain advantage over the network to bypass the Firewall. You are working with a security architect to design security standards and plan for your organization. The network traffic was captured by the SOC team and was provided to you to perform a detailed analysis. Study the Synflood.pcapng file and determine the source IP address.
Note: Synflood.pcapng file is present in the Documents folder of Attacker-1 machine.
20.20.10.19 is the source IP address of the SYN flooding attack in the above scenario. SYN flooding is a type of denial-of-service (DoS) attack that exploits the TCP (Transmission Control Protocol) three-way handshake process to disrupt the network and gain advantage over the network to bypass the firewall. SYN flooding sends a large number of SYN packets with spoofed source IP addresses to a target server, causing it to allocate resources and wait for the corresponding ACK packets that never arrive. This exhausts the server's resources and prevents it from accepting legitimate requests . To determine the source IP address of the SYN flooding attack, one has to follow these steps:
Navigate to the Documents folder of Attacker-1 machine.
Double-click on Synflood.pcapng file to open it with Wireshark.
Click on Statistics menu and select Conversations option.
Click on TCP tab and sort the list by Bytes column in descending order.
Observe the IP address that has sent the most bytes to 20.20.10.26 (target server).
The IP address that has sent the most bytes to 20.20.10.26 is 20.20.10.19 , which is the source IP address of the SYN flooding attack.
Malachi, a security professional, implemented a firewall in his organization to trace incoming and outgoing traffic. He deployed a firewall that works at the session layer of the OSI model and monitors the TCP handshake between hosts to determine whether a requested session is legitimate.
Identify the firewall technology implemented by Malachi in the above scenario.
Desmond, a forensic officer, was investigating a compromised machine involved in various online attacks. For this purpose. Desmond employed a forensic tool to extract and analyze computer-based evidence to retrieve information related to websites accessed from the victim machine. Identify the computer-created evidence retrieved by Desmond in this scenario.
Cookies are the computer-created evidence retrieved by Desmond in this scenario. Cookies are small files that are stored on a user's computer by a web browser when the user visits a website. Cookies can contain information such as user preferences, login details, browsing history, or tracking data. Cookies can be used to extract and analyze computer-based evidence to retrieve information related to websites accessed from the victim machine2. Reference: Cookies
161 questions covering all exam domains, starting from $20
Exam domains verified against: Official Eccouncil 212-82 exam guide, last checked September 2026.
Candidates learn to identify threat sources, threat actors, and malware types alongside common vulnerabilities. The section covers security attacks including hacking methodologies, network-level attacks, application and OS-level attacks, social engineering, wireless network attacks, IoT and cloud attacks, and cryptographic attacks.
This domain addresses foundational security concepts and network security principles. It also covers identification, authentication, and authorization including access control models and identity and access management systems.
Candidates explore administrative controls such as regulatory frameworks, compliance programs, and security policies. Technical controls cover firewalls, IDS/IPS, VPNs, proxies, and load balancing, while physical controls address workplace security and environmental measures. Assessment techniques include vulnerability scanning, penetration testing, and threat hunting.
This domain includes secure application design, software security standards, and development practices. Virtualization and cloud computing fundamentals cover OS virtualization security and cloud security best practices.
Candidates study wireless network fundamentals, encryption mechanisms, and authentication methods. Mobile device security covers management concepts, enterprise policies, and security guidelines. IoT and OT security addresses device communication models and security in IoT and operational technology environments.
This domain covers cryptographic techniques and algorithms, hash functions, and PKI concepts. Data security controls include backup, retention, destruction, and data loss prevention measures.
Candidates learn network troubleshooting techniques and tools for diagnosing basic connectivity issues. Network traffic monitoring includes identifying baseline signatures and suspicious activity. Log monitoring and analysis covers Windows and Linux systems plus log management tools.
Sample question from this domain above: Q3
This domain includes incident response procedures and the role of first responders. Computer forensics covers evidence handling, investigation phases, and data acquisition. Business continuity and disaster recovery planning are included alongside risk management frameworks and processes.
Sample question from this domain above: Q5
Common questions about the exam itself
