You're triaging alerts for Northgate Retail's e-commerce platform. The SIEM has surfaced a burst of activity around the customer-lookup endpoint on the public web server (10.10.2.15), followed shortly after by unusual outbound traffic from an internal workstation. Review the log excerpt, flag the entries that are part of the attack pattern, then identify the attack type and the compromised host ("Patient Zero").

SIEM LOG EXCERPT — click a row to flag it as part of the attack

TimeSourceDestinationEvent
What attack pattern do these log entries show?
The repeated requests to the same endpoint with payloads like ' OR '1'='1 and UNION SELECT are classic SQL injection probing — the attacker is testing whether user input is sanitized before reaching the database query.
Which host is "Patient Zero" — the internal machine showing signs of compromise?
10.20.4.15 begins an outbound connection to an unfamiliar external IP on a non-standard port shortly after the injection attempts succeed — that pattern (unexpected outbound beaconing right after an exploit attempt) is the signature of a freshly compromised host reaching out to a C2 server.
0/0points
Northgate Retail is redesigning its perimeter after the incident above. Drag each server into the zone where it belongs. Remember: anything the public internet talks to directly sits in the DMZ, screened by a firewall on both sides; anything holding sensitive data or used only by internal staff belongs in the Internal / Trusted zone, reachable only through the DMZ, never directly from the internet.

DRAG EACH SERVER INTO THE CORRECT ZONE

DMZ (public-facing, screened)
INTERNAL / TRUSTED (staff & sensitive data)
0/0placed correctly
Check each card below for why it belongs where it does.
Northgate's incident is now confirmed. Drag the response actions below into the correct chronological order, following the NIST incident response lifecycle: Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity.

DRAG TO REORDER — TOP OF LIST HAPPENS FIRST

0/0steps in correct position
Northgate is also tightening identity and device management. For each scenario below, choose the protocol or policy that fits — the details in the description (what's being proven, to whom, and how) point to a specific answer.

PART A — MATCH THE AUTHENTICATION PROTOCOL

PART B — CHOOSE THE MDM RESPONSE

0/0correct
These are practice simulations modeled on the interaction styles described in CompTIA's official PBQ overview (drag-and-drop, log review, ordered sequencing, matching) — not official CompTIA items or pulled from the real exam bank. Scenarios build on the same fictional company across tabs so the whole suite reads as one continuous incident, start to finish.