"A" is correct

Unlike traditional SIEM platforms, SOAR solutions can also be used for threat and vulnerability management, security incident response, and security operations automation.

Example of products:

Log collection (SolarWinds Security Event Manager) -----> SIEM (IBM QRadar) -----> SOAR (IBM Resilient)

See also: https://www.ekransystem.com/en/blog/mac-vs-dac

B is correct, MAC is considered the strictest level of access controll where information is classified in levels and users are given certain levels.

With DAC the permissions are tied to an object and they are set by the owner.

See also: https://www.ciscopress.com/articles/article.asp?p=2783637

Answer A is correct

Correct answer is C

Virtual address space allows for process isolation and makes sure processes can't access each others memory (easily). So this should be considered a secuirty measure. And it's also build in on OS level so that why C is correct. Answer D is wat a application will get when it's using virtual address space but it's not a definition of the principle.

See also: https://en.wikipedia.org/wiki/Virtual_address_space

You could argue that A, B and C are all violated (but that would be very nitpicky). But principle of least privileges would surely be the right answer here.

=> A is correct

See also: See also: https://www.ciscopress.com/articles/article.asp?p=2783637

B could be considered correct but in the attack kill chain the mallware is used to get access to the system. The command and Control server is then used to get "hand on the keyboard" and from there start performing actions. So answer D is the correct answer.

See also: https://en.wikipedia.org/wiki/Kill_chain#Attack_phases_and_countermeasures

Answer D is correct

Deep packet operates on layer 7 while statefull operates on layer 4 so A and C are incorrect as the methodes don't work on the same layer. B is incorrect because statefull doesn't do anything with contents.

The study guide lists the following as evastion techniques against IDS and IPS devices: Fragmentation, low bandwidth attacks, address spoofing/proxying, pattern change evasion, and encryption.

5-Tuple: The tuple (source IP address, source port, destination IP address, destination port, transport protocol).

source: https://www.ietf.org/rfc/rfc6146.txt

So D, E are right answer

Exploit = network is compromised

"[...] exploit means to take advantage of a vulnerability [...] an exploit refers to a tool, typically in the form of source or binary code."

So by taking advantage of the vulnerability the network is compromised.

Vulnerability - lack of an access list

"A vulnerability is any weakness (known or unknown) in a system, process, or other entity that could lead to its security being compromised by a threat."

So not having an ACL could be considered an vulnerability which is then compromised by the threat.

Risk Assessment - configuration review

"risk constitutes a specific vulnerability matched to a specific threat"

So risk assessment work to check for vulenrabilities so doing configuration review matches this.

Threat - leakage of confidential information

"A threat is any action that could disrupt, harm, destroy, or otherwise adversely affect an information system."

This will negativly affect the information system, none of the other options does this so this should be the threat.