Examkin

Tüm alıştırma soruları

2232 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 2001Soru →

An enterprise web portal requires remote employees to enter a username and a dynamic one-time password (OTP) generated by an authenticator application to prove who they are before entering the network. Which pillar of the AAA framework is directly performed during this credential verification step?

Cevabı ve açıklamayı göster

Cevap: Authentication

Cevap

Authentication is the AAA pillar responsible for validating a user's claimed identity via credentials such as a username and dynamic OTP.
Authentication is the process of verifying a user's claimed identity using one or more factors, such as passwords, OTPs, or biometrics.

Adım Adım Çözüm

1
Identify the primary security action described in the scenario
The user presents a username and dynamic OTP code to prove their identity to the system.
Submitting credentials to validate who a user claims to be is the core objective of identity verification.
2
Map the action to the corresponding pillar of the AAA model
Proving identity with credentials maps directly to Authentication.
Authentication focuses on identity verification, distinct from granting privileges (Authorization) or logging session details (Accounting).

Anahtar Kavram

Authentication in the AAA framework establishes and validates the identity of a user or process using credentials before access is granted.
Soru 2002Soru →

An organization is transitioning from a traditional boundary firewall model to a Zero Trust Architecture (ZTA). An administrator is configuring access rules for internal workstations connected directly to the corporate office local area network. Which of the following statements best reflects a fundamental Zero Trust principle that should guide this configuration?

Cevabı ve açıklamayı göster

Cevap: Every access request must be explicitly authenticated and authorized regardless of whether it originates from inside or outside the network perimeter.

Cevap

Every access request must be explicitly authenticated and authorized regardless of whether it originates from inside or outside the network perimeter.
The defining core principle of Zero Trust Architecture is 'never trust, always verify'. This requires every user, device, and request to be explicitly authenticated and authorized using contextual data regardless of network location.

Adım Adım Çözüm

1
Identify the core tenet of Zero Trust Architecture (ZTA).
ZTA relies on the philosophy of 'never trust, always verify'.
Traditional perimeter defenses treat internal network traffic as inherently trustworthy, whereas Zero Trust eliminates implicit trust.
2
Evaluate the requirement for explicit verification.
All incoming connections, whether from internal corporate LANs or external networks, require continuous identity, context, and posture validation.
This prevents lateral movement in the event of an internal network breach.

Anahtar Kavram

Explicit Verification in Zero Trust Architecture
Soru 2003Soru →

A security administrator is categorizing system events and operational functions into the core pillars of the Authentication, Authorization, and Accounting (AAA) framework. Match each operational scenario on the left to the corresponding AAA pillar on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

An employee presents a smart card and enters a secret PIN to prove their claimed identity to a system.
An access control system checks security group policies to determine if a user can modify a restricted cloud folder.
A network gateway records session login timestamps, active connection duration, and total bandwidth consumed.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Presenting a smart card and PIN matches Authentication; evaluating cloud folder permissions matches Authorization; recording session timestamps and bandwidth consumption matches Accounting.
Authentication verifies identity via credentials (smart card and PIN). Authorization determines resource access boundaries and user permissions (cloud folder modification checks). Accounting tracks, measures, and audits user sessions and resource usage (timestamps, session length, and bandwidth consumption).

Adım Adım Çözüm

1
Analyze the first scenario regarding smart card and PIN submission.
Classify this action as identity verification.
Authentication is responsible for verifying the claimed identity of a user or system using provided credentials.
2
Analyze the second scenario regarding security group policy checks for folder modification.
Classify this action as privilege enforcement.
Authorization determines what specific actions, privileges, or resources an authenticated user is permitted to access.
3
Analyze the third scenario regarding logging login timestamps, session length, and data volume.
Classify this action as auditing and metrics tracking.
Accounting measures resource utilization and logs session activities for accountability and auditing purposes.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA)
Soru 2004Soru →

Match each core Zero Trust Architecture (ZTA) principle to its corresponding operational description.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Explicit Validation
Continuous Verification
Assume Breach

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Explicit Validation pairs with always authenticating and authorizing based on all available data points before granting entry. Continuous Verification pairs with constantly evaluating session security posture throughout an active connection. Assume Breach pairs with operating under the premise that internal networks contain hostile actors and using microsegmentation to minimize blast radius.
Each Zero Trust principle aligns directly with its operational intent: Explicit Validation mandates verifying all available data points prior to access; Continuous Verification monitors active sessions dynamically over time; and Assume Breach designs controls under the premise that internal networks are inherently untrusted.

Adım Adım Çözüm

1
Identify the core objective of Explicit Validation.
Recognize that explicit validation demands validating identity, context, and permissions on every request prior to granting access.
Explicit validation eliminates implicit trust based on network location or past authorization.
2
Identify the core objective of Continuous Verification.
Recognize that trust must be dynamic and continuously re-assessed throughout the lifecycle of an active session.
Initial authentication is insufficient if device state or user context changes after access is established.
3
Identify the core objective of Assume Breach.
Recognize that defense strategy must assume adversaries already possess internal access, requiring microsegmentation and end-to-end encryption.
Assuming breach minimizes lateral movement and reduces the potential blast radius of security incidents.

Anahtar Kavram

Zero Trust Architecture Principles
Soru 2005Soru →

A security architect is reviewing an organization's microservice API gateway architecture. The gateway successfully validates JSON Web Tokens (JWTs) issued by a central Identity Provider to confirm user identity upon initial request. However, once validated, the gateway forwards all traffic to backend microservices using a shared system service account with unrestricted permissions, and backend service logs only record the gateway's IP address. Which of the following correctly identifies the AAA pillars that are currently deficient in the backend microservice architecture and the necessary control implementation?

Cevabı ve açıklamayı göster

Cevap: Authorization and Accounting are deficient; backend microservices must evaluate individual user claims/roles for access permissions and log specific user session identifiers for each request.

Cevap

Authorization and Accounting are deficient; backend microservices must evaluate individual user claims/roles for access permissions and log specific user session identifiers for each request.
The correct option correctly identifies that while Authentication is successfully performed by validating JWTs at the gateway, Authorization is missing because microservices execute requests under a shared unrestricted account without checking user permissions. Furthermore, Accounting is missing because logging only the gateway IP address prevents attributing specific actions to individual user accounts.

Adım Adım Çözüm

1
Analyze the existing controls described in the scenario against the AAA framework.
Authentication (identity verification) is handled properly at the API gateway via JWT signature validation.
The system accurately identifies who the user is using token validation.
2
Evaluate the permissions granted to requests arriving at backend microservices.
Requests execute with an unrestricted shared service account regardless of user roles, indicating an Authorization failure.
Authorization dictates what an authenticated user is permitted to do; granting blanket administrative access fails the principle of least privilege.
3
Evaluate audit trails and logging mechanisms.
Logs only record the API gateway IP address, indicating an Accounting failure.
Accounting requires tracking individual user actions and resource usage for auditability and non-repudiation.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA) separation in distributed architectures
Tahmini Süre:2m 0s
Soru 2006Soru →

A hospital network requires attending physicians to electronically sign controlled substance prescriptions. The security engineering team mandates the use of asymmetric key digital signatures on hardware security tokens rather than hash-based message authentication codes (HMACs) utilizing a shared key between the hospital system and the pharmacy portal. Which of the following primary security concepts explains why asymmetric digital signatures are required for this deployment?

Cevabı ve açıklamayı göster

Cevap: Non-repudiation, because the private key is uniquely held by the individual physician, preventing them from denying that they issued the prescription.

Cevap

Non-repudiation, because the private key is uniquely held by the individual physician, preventing them from denying that they issued the prescription.
Asymmetric digital signatures provide non-repudiation because the signing key (private key) is uniquely held by a single individual. Unlike symmetric HMAC mechanisms where multiple endpoints share the same key and either could generate a valid message authentication code, asymmetric signatures cryptographically bind the action to one specific key holder.

Adım Adım Çözüm

1
Analyze the difference between symmetric HMAC and asymmetric digital signatures regarding key ownership.
HMAC relies on a secret key shared between parties, whereas asymmetric signing utilizes a private key known only to the signer.
When a shared secret is used, either party possessing the key could generate the authentication tag, preventing single-party proof of origin.
2
Identify the specific security principle that prevents an originator from disowning an action.
Non-repudiation ensures that an individual cannot deny the authenticity of their signature or transaction.
Because the private key resides exclusively on the physician's hardware token, a valid signature serves as undeniable proof of authorship.

Anahtar Kavram

Non-repudiation via Asymmetric Digital Signatures
Tahmini Süre:1m 30s
Soru 2007Soru →

Match each enterprise identity and access management scenario on the left with the corresponding core AAA phase or concept on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

An employee enters a User Principal Name (UPN) at a web portal login prompt prior to presenting any credentials.
An identity provider validates a user's FIDO2 WebAuthn asymmetric key signature and hardware token PIN during session initialization.
A security policy engine checks a user's SAML 2.0 role attributes and dynamic network risk score against an Access Control List (ACL) to grant microsegment access.
A central network service logs TACACS+ session start/stop timestamps, executed CLI commands, and total bytes transferred by an administrator.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Entering a User Principal Name maps to Identification. Validating FIDO2 signatures and PINs maps to Authentication. Evaluating SAML role attributes against ACLs maps to Authorization. Logging session timestamps and executed commands via TACACS+ maps to Accounting.
Each scenario represents a distinct stage in identity and access management: Identification is claiming an identity (entering a UPN); Authentication is proving that identity (validating FIDO2 keys and PINs); Authorization is determining allowable actions (checking SAML attributes against ACLs); and Accounting is recording session data and actions for audit logs (logging TACACS+ execution details).

Adım Adım Çözüm

1
Analyze the first scenario (entering UPN at a prompt).
The subject is claiming who they are without providing proof yet.
Claiming an identity before credential verification is the Identification phase.
2
Analyze the second scenario (validating FIDO2 key signatures and PINs).
The system is verifying the truth of the claimed identity using cryptographic keys and factors.
Proving identity using verification factors is the Authentication phase.
3
Analyze the third scenario (evaluating SAML roles and risk scores against ACLs).
The system is determining what permissions and privileges the authenticated user has.
Enforcing access policies and granting resource rights is the Authorization phase.
4
Analyze the fourth scenario (logging TACACS+ timestamps, commands, and bandwidth).
The system is tracking user activity and resource utilization for historical auditing.
Recording actions, resource usage, and session metrics is the Accounting phase.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA) Framework
Soru 2008Soru →

A security engineering team is establishing baseline controls for a cloud-native software delivery pipeline. Match each security implementation on the left with the primary security objective (CIA Triad pillar or Non-Repudiation) it provides on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Digitally signing container images using an asymmetric private key prior to registry deployment.
Encrypting database backups at rest using AES-256 encryption.
Deploying auto-scaling groups across multi-region redundant load balancers.
Generating SHA-256 cryptographic hashes for software release packages.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Digitally signing container images maps to Non-Repudiation; encrypting database backups at rest maps to Confidentiality; deploying multi-region auto-scaling load balancers maps to Availability; and generating SHA-256 hashes maps to Integrity.
Each security control aligns directly with a core security objective: Asymmetric digital signatures ensure Non-Repudiation because the signature uniquely proves origin identity. Encryption protects Confidentiality by preventing unauthorized disclosure. Redundant auto-scaling architectures maintain Availability by ensuring system resilience and uptime. Cryptographic hashing enforces Integrity by verifying that files have not suffered unauthorized tampering.

Adım Adım Çözüm

1
Analyze container image signing
Asymmetric digital signatures tie an action to a specific private key owner.
This guarantees origin authenticity and prevents the publisher from denying authorship (Non-Repudiation).
2
Analyze database backup encryption
AES-256 encryption obscures sensitive static data.
Restricting unauthorized viewing of data enforces secrecy (Confidentiality).
3
Analyze multi-region auto-scaling
Redundant infrastructure withstands regional failures and sudden load increases.
Ensuring continuous system uptime and responsiveness supports service accessibility (Availability).
4
Analyze SHA-256 package hashing
A cryptographic hash produces a unique digest that changes if data is modified.
Verifying that files remain unaltered during transmission ensures data accuracy (Integrity).

Anahtar Kavram

Mapping technical controls to the CIA Triad (Confidentiality, Integrity, Availability) and Non-Repudiation principles.
Soru 2009Soru →

A system administrator is reviewing log retention policies and system auditing controls to ensure compliance with AAA principles. Which of the following tasks specifically perform the Accounting function of AAA? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Tracking session duration and data bandwidth consumed by remote VPN users; Logging specific command-line entries executed by administrators during an active session

Cevap

Tracking session duration and data bandwidth consumed by remote VPN users, and logging specific command-line entries executed by administrators during an active session.
Accounting measures resource consumption and creates audit logs of actions performed during a session, such as bandwidth utilization, connection length, and commands executed.

Adım Adım Çözüm

1
Define the primary responsibility of the Accounting pillar in AAA.
Accounting provides logging, metric tracking, auditing, and non-repudiation for user and system activity.
AAA separates establishing identity (Authentication), determining permissions (Authorization), and recording activity (Accounting).
2
Evaluate each provided security activity against the Accounting function.
Tracking usage metrics and creating command audit logs record actual user activity. Credential verification is Authentication, and setting folder permissions is Authorization.
Only actions that collect metrics or record event logs fall under Accounting.

Anahtar Kavram

Accounting (Auditing, Logging, and Resource Tracking)
Soru 2010Soru →

A financial services firm is implementing Zero Trust Architecture (ZTA) principles to govern remote employee access to cloud-hosted databases and web services. A security engineer is establishing authorization policies at the gateway level. To align with the core Zero Trust tenets of continuous verification and explicit validation, which of the following mechanisms should the engineer enforce?

Cevabı ve açıklamayı göster

Cevap: Evaluating identity, device compliance posture, and contextual risk dynamically for every single access request regardless of user location or prior authentication

Cevap

Evaluating identity, device compliance posture, and contextual risk dynamically for every single access request regardless of user location or prior authentication
The correct answer aligns directly with Zero Trust Architecture (NIST SP 800-207) core principles. Under Zero Trust, no user, device, or network segment is implicitly trusted. Every individual request must be explicitly validated using identity, real-time device health posture, and context before granting access.

Adım Adım Çözüm

1
Identify the core requirement of Zero Trust Architecture (ZTA)
ZTA relies on the fundamental tenet: 'Never trust, always verify.'
Perimeter boundaries are no longer sufficient; all requests must be verified explicitly.
2
Analyze how continuous verification applies to access control enforcement
Access must be granted on a per-session, per-request basis by evaluating identity, device posture, location, and risk context.
Prior login status or network location cannot grant persistent implicitly trusted access.
3
Evaluate the choices against Zero Trust principles
The mechanism that continuously re-evaluates risk, identity, and device health per request correctly implements ZTA explicit validation.
This prevents lateral movement and addresses session hijack risks.

Anahtar Kavram

Continuous verification and explicit validation in Zero Trust Architecture
Soru 2011Soru →

An enterprise organization is updating security policies for employees accessing corporate SaaS applications. To align with Zero Trust Architecture principles, the security engineering team configures the identity provider to re-evaluate user identity, device health posture, and geolocation context for every single access request, rather than granting trusted access for the duration of the session after initial login. Which core Zero Trust Architecture principle is directly implemented by this configuration?

Cevabı ve açıklamayı göster

Cevap: Explicit verification

Cevap

Explicit verification is the core Zero Trust Architecture principle implemented, as it requires authenticating and authorizing every access attempt based on real-time contextual data points.
Explicit verification requires continuously authenticating and authorizing every access request based on all available data points (such as identity, device health, location, and service posture) rather than relying on persistent session trust.

Adım Adım Çözüm

1
Analyze the operational scenario requirements
The system forces continuous validation of identity, device health, and environmental context for each individual request instead of trusting an initial login session.
Identifying the system behavior isolates which architectural philosophy is being practiced.
2
Map the implementation behavior to Zero Trust tenets
Evaluating risk dynamically on every request aligns directly with the 'Verify explicitly' principle of Zero Trust.
Zero Trust operates under the premise that no session or network segment should be granted implicit or persistent trust.

Anahtar Kavram

Explicit Verification in Zero Trust Architecture
Soru 2012Soru →

A pharmaceutical research organization operates a platform where external laboratories submit clinical trial data files. To meet regulatory requirements, the security team must implement a mechanism ensuring that a submitting laboratory cannot later deny having submitted a specific file. Which of the following mechanisms best provides this non-repudiation capability?

Cevabı ve açıklamayı göster

Cevap: Asymmetric digital signatures generated using the submitting laboratory's private key

Cevap

Asymmetric digital signatures generated using the submitting laboratory's private key
Asymmetric digital signatures provide non-repudiation because they pair a unique private key (known only to the sender) with a public key. Signing a hash of the file with the private key cryptographically binds the sender's identity to the file payload.

Adım Adım Çözüm

1
Identify the core security requirement
The scenario specifically requires non-repudiation, which prevents an entity from denying the authenticity of their signature or transaction.
Regulatory compliance mandates proof of sender origin and file submission.
2
Evaluate cryptographic properties required for non-repudiation
Non-repudiation requires asymmetric cryptography where the signing key is private and unique to the sender.
Symmetric keys or plain hashes cannot uniquely bind a specific entity to a message because symmetric keys are shared and hashes carry no identity metadata.
3
Select the mechanism that guarantees origin authenticity and integrity
Asymmetric digital signatures combine cryptographic hashing with private key signing.
Only the holder of the private key could create the signature, and anyone with the corresponding public key can verify it.

Anahtar Kavram

Non-Repudiation vs. Integrity and Symmetric Authentication
Soru 2013Soru →

An enterprise security team is implementing NIST SP 800-207 Zero Trust Architecture (ZTA) principles across their hybrid cloud infrastructure. Match each core Zero Trust operational requirement to its corresponding technical implementation.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Continuous Explicit Verification
Microsegmentation Enforcement
Assume Breach Posture
Control and Data Plane Decoupling

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Continuous Explicit Verification matches with dynamically re-evaluating risk signals throughout active sessions; Microsegmentation Enforcement matches with isolating workloads to restrict lateral movement; Assume Breach Posture matches with encrypting internal traffic and treating internal subnets as untrusted; Control and Data Plane Decoupling matches with separating centralized policy decision logic from gatekeeper enforcement mechanisms.
Each Zero Trust principle directly aligns with specific architectural behaviors: Continuous Explicit Verification constantly reassesses session trust based on real-time context; Microsegmentation limits east-west lateral movement between workloads; Assuming Breach eliminates internal network trust and mandates universal encryption; and Decoupling Control/Data Planes separates policy decision logic from policy enforcement nodes.

Adım Adım Çözüm

1
Analyze the operational objective of Continuous Explicit Verification.
Identified that authentication/authorization must occur continually based on live signals rather than once at perimeter entry.
Zero Trust eliminates implicit session trust after initial authentication.
2
Analyze Microsegmentation Enforcement.
Mapped to workload-level isolation and limiting lateral movement.
Microsegmentation divides networks into tiny isolated zones around critical assets.
3
Analyze Assume Breach Posture.
Mapped to internal traffic distrust and universal encryption.
Assuming breach forces organizations to secure internal communications as if the network is compromised.
4
Analyze Control and Data Plane Decoupling.
Mapped to separating Policy Engine/Administrator functions from Policy Enforcement Points.
NIST SP 800-207 specifies logical separation between governance logic and traffic enforcement.

Anahtar Kavram

Zero Trust Architecture Core Tenets & NIST SP 800-207 Logical Architecture
Soru 2014Soru →

An enterprise security team deploys a centralized RADIUS server for remote VPN access. During a post-deployment audit, a security analyst reviews the access workflow: users validate their identity via multi-factor authentication, the RADIUS server returns Vendor-Specific Attributes (VSAs) specifying restricted network segments to the VPN gateway, and the gateway transmits session durations to a central SIEM. The analyst discovers that while identity validation succeeds, the RADIUS policy engine fails to evaluate user group memberships properly and instead attaches default attributes granting unrestricted network access across all enterprise subnets. Which pillar of the AAA framework is failing to function as intended?

Cevabı ve açıklamayı göster

Cevap: Authorization

Cevap

Authorization is failing because the RADIUS server fails to enforce role-based access control attributes and group policies after identity verification.
Authorization is the AAA pillar responsible for determining access rights, privilege levels, and resource restrictions based on verified identity and group policy. Because the server successfully verified user identities but failed to apply proper group filtering attributes (VSAs), the control failure occurs within authorization.

Adım Adım Çözüm

1
Evaluate the identity proofing phase of the scenario.
Authentication performed successfully because users verified their identity using multi-factor authentication.
Authentication is strictly responsible for verifying that an entity is who they claim to be.
2
Evaluate the auditing and monitoring phase of the scenario.
Accounting performed successfully because session duration metrics were captured and forwarded to the central SIEM.
Accounting tracks consumption metrics and session events for audit visibility.
3
Identify which AAA component controls post-login rights and network segment access.
Authorization failed because the RADIUS policy engine defaulted to granting unrestricted subnet access instead of applying role-specific Vendor-Specific Attributes (VSAs).
Authorization dictates what privileges, permissions, and network access boundaries an authenticated user receives.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA)
Soru 2015Soru →

A security administrator needs to ensure that sensitive company data stored on enterprise laptops remains confidential if a laptop is lost or stolen, and must also verify that system configuration files have not been modified. Which of the following cryptographic techniques should the administrator implement to fulfill these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Symmetric bulk encryption (such as AES-256) for data-at-rest protection; Cryptographic hashing algorithms (such as SHA-256) for integrity checking

Cevap

Symmetric bulk encryption (such as AES-256) to protect data confidentiality at rest, and cryptographic hashing algorithms (such as SHA-256) to verify configuration file integrity.
Symmetric bulk encryption (such as AES-256) is designed to efficiently protect data at rest on storage media against unauthorized access. Cryptographic hashing algorithms (such as SHA-256) produce unique digests used to verify data integrity by confirming files have not been modified.

Adım Adım Çözüm

1
Identify the cryptographic control required for data confidentiality at rest on stolen hardware.
Symmetric bulk encryption (e.g., AES-256) provides fast and effective encryption for local drives.
Symmetric ciphers use a single secret key for fast encryption and decryption of large volumes of data.
2
Identify the cryptographic control required for verifying configuration file integrity.
Cryptographic hashing algorithms (e.g., SHA-256) generate fixed-size hash values to detect tampering.
Any modification to a configuration file changes its resulting hash digest, indicating a failure of integrity.

Anahtar Kavram

Data-at-Rest Encryption and Hashing for Integrity
Tahmini Süre:1m 0s
Soru 2016Soru →

A network security gateway generates logs that record the start time, end time, and total volume of data transmitted during a user's remote connection session. Which pillar of the Authentication, Authorization, and Accounting (AAA) framework is directly provided by recording these metrics?

Cevabı ve açıklamayı göster

Cevap: Accounting

Cevap

Accounting
Logging connection start times, end times, and data transmission quantities is the core function of Accounting within the AAA framework, as it captures usage data for auditing and metrics.

Adım Adım Çözüm

1
Analyze the action described in the scenario.
The system records start times, end times, and data transmission volumes for user sessions.
Determining the purpose of recording these metrics helps identify the corresponding security concept.
2
Evaluate the pillars of the AAA framework.
Tracking resource consumption, session duration, and maintaining audit logs is defined as Accounting.
Authentication proves identity, Authorization determines permissions, and Accounting logs and audits user activity.

Anahtar Kavram

Accounting in the AAA Framework
Soru 2017Soru →

An enterprise legal technology organization is upgrading its electronic contract processing platform. The platform must implement controls to guarantee non-repudiation so that signers cannot plausibly deny their participation in executing an agreement. Which of the following technical mechanisms directly satisfy the requirement for non-repudiation? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Digitally signing document hashes using asymmetric private keys bound to individual signers; Validating identity using Public Key Infrastructure (PKI) digital certificates issued by a trusted Certificate Authority

Cevap

The mechanisms that directly support non-repudiation are digitally signing document hashes using asymmetric private keys bound to individual signers and validating identity using PKI digital certificates issued by a trusted Certificate Authority.
Non-repudiation provides assurance that the sender of data cannot deny sending it. This is achieved through asymmetric digital signatures, where only the individual possessing the unique private key can generate the signature, and PKI digital certificates, which officially bind that public/private key pair to an authenticated individual identity.

Adım Adım Çözüm

1
Analyze the core requirement
The requirement is non-repudiation, which ensures that an origin or author of data cannot deny having authored or sent the data.
Non-repudiation requires proof of identity linked to a unique cryptographic operation that only one entity could perform.
2
Evaluate cryptographic mechanisms
Asymmetric digital signatures combined with PKI certificates establish proof of origin linked to a specific verified identity.
Private keys are kept secret by the owner, and PKI certificates bind that identity to the matching public key.
3
Differentiate symmetric authentication and authorization controls
Symmetric HMAC keys and RBAC authorization policies do not provide non-repudiation.
Shared secret symmetric keys allow any key holder to create the hash digest, and authorization models govern access rights rather than cryptographic proof of origin.

Anahtar Kavram

Non-repudiation requires asymmetric cryptography and digital signatures anchored by PKI certificates, distinguishing it from integrity (hashing) and authorization controls.
Soru 2018Soru →

During a post-incident review at a logistics company, security analysts discovered that an administrator modified system event logs and disputed making any changes. The logging infrastructure maintained file integrity using standalone SHA-256 hashes stored alongside the logs, but because multiple staff members had write permissions to update those hash files, individual accountability could not be established. Which of the following solutions should the organization implement to achieve non-repudiation for log updates?

Cevabı ve açıklamayı göster

Cevap: Asymmetric digital signatures generated using individual private keys

Cevap

Asymmetric digital signatures generated using individual private keys
Digital signatures enforce non-repudiation by combining a cryptographic hash with asymmetric key pairs. Because the private key is strictly held by a single individual, any signature verified using that individual's public key conclusively proves origin and authenticity, preventing the sender from denying their action.

Adım Adım Çözüm

1
Analyze the problem requirement
The organization requires proof of origin for log entries so administrators cannot deny performing modifications.
Simple hashes prove integrity (data has not changed unintentionally), but do not prove identity (who generated or modified the data).
2
Evaluate cryptographic security services
Non-repudiation requires a mechanism tied uniquely to a single entity that cannot be forged by others sharing access.
Asymmetric cryptography pairs a private key (held exclusively by one user) with a public key (used by anyone to verify signatures).
3
Select the appropriate control
Digital signatures provide non-repudiation, integrity, and authentication simultaneously.
Because only the private key owner could have produced the signature, the signer cannot claim the log entry came from someone else.

Anahtar Kavram

Non-Repudiation vs. Integrity in the CIA Triad
Tahmini Süre:1m 0s
Soru 2019Soru →

An enterprise security engineer is auditing the AAA implementation of a newly deployed hybrid cloud access portal. The engineer needs to ensure that access governance controls are strictly categorized according to core AAA principles. Which of the following technical controls specifically perform the Authorization function within this framework? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Applying dynamic VLAN segment assignments and contextual network access rules based on validated security group attributes; Enforcing role-based resource permissions that restrict file system read and write privileges after identity validation

Cevap

The correct controls are applying dynamic VLAN segment assignments based on security groups and enforcing role-based resource permissions after identity validation.
Authorization is responsible for determining permissions and enforcing access boundaries once identity is established. Applying dynamic VLAN access rules based on user group entitlement and enforcing role-based read/write file permissions both explicitly grant or restrict resource access based on policies.

Adım Adım Çözüm

1
Analyze the AAA framework definitions
Authentication proves WHO a user is. Authorization defines WHAT a user can do. Accounting records WHAT a user did and WHEN.
Clear pillar separation is required to correctly map controls to AAA functions.
2
Evaluate the controls presented in the scenario
Dynamic VLAN/access rule assignments and role-based file system permissions directly regulate access to resources based on entitlements.
These controls determine permissions and privilege levels post-identification, which is the exact definition of authorization.
3
Differentiate authentication and accounting distractors
TOTP verification confirms identity (Authentication), while streaming session logs and metrics captures activity tracking data (Accounting).
Neither identity proofing nor log aggregation grants or restricts resource permissions.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA)
Soru 2020Soru →

A systems analyst is selecting an encryption method to protect large volumes of static data archived on enterprise storage arrays. The primary requirement is high-speed performance and minimal processing overhead during bulk encryption and decryption operations. Which of the following cryptographic approaches should the analyst implement?

Cevabı ve açıklamayı göster

Cevap: Symmetric encryption using the Advanced Encryption Standard (AES)

Cevap

The analyst should implement symmetric encryption using the Advanced Encryption Standard (AES).
Symmetric key encryption algorithms, such as AES, use the same secret key for both encryption and decryption operations. Due to their mathematical efficiency, symmetric ciphers process large blocks of data rapidly with low CPU usage, making them the standard choice for bulk data-at-rest encryption.

Adım Adım Çözüm

1
Identify the operational requirement from the scenario.
The requirement calls for encrypting large volumes of archived storage with high performance and low computational overhead.
Bulk storage encryption requires an algorithm capable of processing large streams of data without creating processing bottlenecks.
2
Compare algorithm categories for bulk data processing.
Symmetric ciphers use a single key and optimized substitution-permutation operations, making them significantly faster and less resource-intensive than asymmetric ciphers.
Asymmetric algorithms are designed primarily for key exchange, digital signatures, and small payloads due to their high computational cost.

Anahtar Kavram

Symmetric vs. Asymmetric Encryption Performance for Bulk Data
Tahmini Süre:45s
ÖncekiSayfa 101 / 112Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin