Examkin

Tüm alıştırma soruları

2232 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 2021Soru →

Match each network access control scenario on the left with the corresponding pillar of the Authentication, Authorization, and Accounting (AAA) framework (or Identification) on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A user enters their account username into a system prompt prior to submitting credentials.
A server validates a user's password and one-time passcode (OTP) against a central database.
A security policy engine checks a user's role and grants read-only access to a specific database.
A gateway logs session start and end times, command history, and total byte counts for auditing.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Entering a username corresponds to Identification. Validating passwords and OTP codes corresponds to Authentication. Enforcing role-based access permissions corresponds to Authorization. Recording session duration and bandwidth consumption corresponds to Accounting.
Each phase of the access control workflow fulfills a distinct AAA pillar: Identification claims identity, Authentication verifies credentials, Authorization enforces permissions, and Accounting logs activity metrics.

Adım Adım Çözüm

1
Analyze the first scenario (entering a username).
Entering a username is the assertion of identity before verification, matching Identification.
Identification establishes who the user claims to be.
2
Analyze the second scenario (validating passwords and OTP codes).
Verifying secret credentials proves the identity claim, matching Authentication.
Authentication verifies proof of identity.
3
Analyze the third scenario (checking roles to grant database permissions).
Restricting access based on policies matches Authorization.
Authorization defines what actions an authenticated user is permitted to perform.
4
Analyze the fourth scenario (logging session duration and byte counts).
Recording usage metrics and session logs matches Accounting.
Accounting tracks resource usage and creates audit logs for oversight.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA) Framework
Soru 2022Soru →

A healthcare organization is replacing its legacy virtual private network (VPN) infrastructure with a Zero Trust Architecture (ZTA) to secure access to electronic health record (EHR) microservices hosted across hybrid cloud environments. Which of the following design decisions directly reflect core Zero Trust Architecture principles? (Select THREE.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Re-evaluating identity, device posture, and risk context continuously throughout active sessions rather than relying solely on initial authentication; Implementing microsegmentation and granular authorization policies that restrict access strictly to the explicit resources required for each request; Treating all network traffic as inherently untrusted regardless of whether it originates inside or outside the traditional corporate network boundary

Cevap

The core tenets of Zero Trust Architecture include continuous verification of context throughout active sessions, enforcement of least privilege via granular microsegmentation, and assuming breach by treating all internal and external network traffic as untrusted.
Zero Trust Architecture is anchored by three primary tenets: explicit verification (continuously validating identity, device posture, and context), least privilege access (restricting access to specific resources via microsegmentation), and assuming breach (treating all network traffic as untrusted regardless of origin). Together, these mechanisms eliminate implicit perimeter trust.

Adım Adım Çözüm

1
Analyze the core principles defined by Zero Trust Architecture (such as NIST SP 800-207).
Zero Trust relies on explicit verification, least privilege, and assuming breach regardless of physical or logical network position.
Traditional perimeter security relies on implicit trust within internal subnets, whereas Zero Trust removes implicit trust completely.
2
Evaluate each option against continuous verification, least privilege, and zero implicit perimeter trust.
Continuous re-evaluation of user/device risk, microsegmentation for granular access, and inspecting all network traffic regardless of origin reflect these principles.
These three practices ensure every access request is explicitly authorized using real-time context.
3
Identify misconfigurations and legacy assumptions in the remaining options.
Granting persistent network access after initial MFA and relying solely on firewall IP filters incorrectly depend on static network boundaries and implicit trust.
Static IP rules and one-time authentication fail to validate ongoing session security or application-layer context.

Anahtar Kavram

Zero Trust Architecture Principles (Explicit Verification, Least Privilege, Assume Breach)
Soru 2023Soru →

An enterprise organization is establishing a micro-segmented hybrid environment based on Zero Trust Architecture (ZTA) control plane and data plane principles. Match each logical Zero Trust component on the left with its correct operational responsibility on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Policy Engine (PE)
Policy Administrator (PA)
Policy Enforcement Point (PEP)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Policy Engine (PE) matches with evaluating contextual signals and determining access decisions; Policy Administrator (PA) matches with issuing dynamic credentials and signaling path setups; Policy Enforcement Point (PEP) matches with operating in the data plane to inspect traffic and enforce access boundaries.
Under NIST SP 800-207, Zero Trust architecture divides functions between the control plane and data plane. The Policy Engine evaluates trust inputs to decide access. The Policy Administrator communicates control decisions by managing credentials and signaling gateways. The Policy Enforcement Point sits on the data plane to enforce session bounds.

Adım Adım Çözüm

1
Analyze the core function of the Policy Engine (PE)
Identify that the Policy Engine is purely analytical and rule-based, responsible for evaluating trust signals to reach an access decision.
Control plane separation isolates decision logic within the Policy Engine component.
2
Analyze the core function of the Policy Administrator (PA)
Identify that the Policy Administrator acts on the Policy Engine decision by generating required short-lived tokens or keys and signaling the data plane.
The Policy Administrator serves as the control plane actuator between decision logic and physical gateway mechanisms.
3
Analyze the core function of the Policy Enforcement Point (PEP)
Identify that the Policy Enforcement Point directly handles payload traffic on the data plane to permit, restrict, or break session connections.
Data plane enforcement requires inline monitoring and access control mechanisms.

Anahtar Kavram

Logical Components of Zero Trust Architecture (Policy Engine, Policy Administrator, Policy Enforcement Point)
Tahmini Süre:2m 0s
Soru 2024Soru →

Match each cryptographic concept or algorithm on the left with its corresponding operational security objective on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Diffie-Hellman (DH)
HMAC
Elliptic Curve Cryptography (ECC)
AES-GCM

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Diffie-Hellman matches establishing a shared secret over an untrusted channel; HMAC matches verifying data integrity and authenticity using a hash and secret key; Elliptic Curve Cryptography matches providing RSA-equivalent security with smaller key sizes; AES-GCM matches delivering authenticated encryption providing confidentiality and integrity.
Each cryptographic concept correctly maps to its definition: Diffie-Hellman enables secure key exchange over untrusted channels; HMAC provides keyed hash authentication; ECC offers high-strength public key security with small key sizes; and AES-GCM provides authenticated symmetric encryption.

Adım Adım Çözüm

1
Identify key exchange mechanisms.
Diffie-Hellman is paired with secure key negotiation across insecure channels.
Diffie-Hellman enables key exchange without broadcasting the shared secret.
2
Analyze message authentication controls.
HMAC pairs with message authentication using secret keys and hashing.
HMAC incorporates a symmetric key into hashing for integrity and authenticity.
3
Evaluate lightweight asymmetric cryptography choices.
ECC pairs with high security, low computational overhead, and smaller key sizes.
ECC achieves equivalent RSA security with shorter keys.
4
Examine symmetric authenticated encryption modes.
AES-GCM pairs with authenticated encryption providing confidentiality and integrity simultaneously.
Galois/Counter Mode (GCM) combines counter mode encryption with Galois field authentication.

Anahtar Kavram

Cryptographic Concepts and Algorithms
Soru 2025Soru →

Match each enterprise AAA protocol mechanism or access control payload on the left with its corresponding functional role and operational process on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

RADIUS payload containing Acct-Status-Type = Stop and Acct-Input-Octets = 4194304
TACACS+ packet authorization phase sending AUTHOR_REQUEST for command 'configure terminal'
SAML 2.0 Response payload containing a digitally signed Assertion issued by an Identity Provider (IdP)
IEEE 802.1X EAP-TLS handshake exchanging X.509 client and server certificates

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

RADIUS payload with Acct-Status-Type pairs with Resource Usage & Session Metric Logging (Accounting). TACACS+ AUTHOR_REQUEST pairs with Per-Command Privilege Scoping & Execution Filtering (Authorization). SAML 2.0 Assertion pairs with Federated Identity Verification & Assertion Delivery (Authentication). IEEE 802.1X EAP-TLS handshake pairs with Mutual Cryptographic Identity Verification (Authentication).
The correct pairings evaluate the specific AAA functional domain of each enterprise protocol packet. RADIUS accounting attributes collect metric logs for session auditing. TACACS+ decouples authorization to inspect per-command execution rights. SAML assertions transmit federated identity authentication results across web domains. EAP-TLS enforces mutual authentication using digital certificate handshakes.

Adım Adım Çözüm

1
Analyze the RADIUS Acct-Status-Type payload.
Identified as an Accounting mechanism tracking data transfer volume (octets) and session state.
RADIUS uses Accounting-Request messages (such as Start, Stop, and Interim-Update) to log metrics for auditing and billing.
2
Analyze the TACACS+ AUTHOR_REQUEST payload.
Identified as an Authorization mechanism evaluating individual CLI commands.
TACACS+ decouples AAA, allowing granular authorization queries for specific administrative commands prior to execution.
3
Analyze the SAML 2.0 Response payload.
Identified as a Federated Authentication mechanism using IdP assertions.
SAML assertions communicate user authentication state across domain boundaries from an IdP to a SP.
4
Analyze the IEEE 802.1X EAP-TLS handshake.
Identified as a Mutual Authentication protocol based on dual X.509 certificate validation.
EAP-TLS requires both client and server certificates, satisfying mutual authentication demands at Network Access Control endpoints.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA) Protocol Functional Separation
Tahmini Süre:3m 0s
Soru 2026Soru →

A security engineer needs to ensure that software updates distributed to client workstations cannot be denied by the vendor and that their authenticity and integrity can be verified upon download. Which of the following cryptographic techniques directly provides non-repudiation?

Cevabı ve açıklamayı göster

Cevap: Digital signing using asymmetric cryptography

Cevap

Digital signing using asymmetric cryptography
Digital signing utilizes asymmetric cryptography where a sender signs a message digest with their private key. Anyone with access to the public key can verify the signature, proving that the content originated from the private key owner and was not altered, thereby establishing non-repudiation.

Adım Adım Çözüm

1
Identify the primary security requirement from the scenario
The requirement is non-repudiation and origin verification for distributed software updates.
Non-repudiation prevents an entity from denying the creation or authorship of data.
2
Evaluate cryptographic mechanisms against non-repudiation criteria
Digital signatures encrypt a hash digest of the update file using the vendor's private key.
Because only the private key owner can generate the signature, verification with the corresponding public key proves authenticity and prevents denial.

Anahtar Kavram

Digital Signatures and Non-Repudiation
Soru 2027Soru →

A network administrator is reviewing access management logs on a remote access VPN gateway. The logs indicate that after a user successfully presents a valid username, password, and time-based one-time password (TOTP), the gateway queries an LDAP directory to check the user's assigned group memberships and determine which specific internal subnets the user is permitted to reach. Which pillar of the AAA framework is being executed during this group membership evaluation?

Cevabı ve açıklamayı göster

Cevap: Authorization

Cevap

Authorization is the pillar of the AAA framework executed when evaluating group membership to grant or restrict access to network resources.
Authorization is responsible for determining permissions and enforcing access policies for an authenticated identity. Checking group membership to grant access to specific subnets directly fulfills the authorization pillar.

Adım Adım Çözüm

1
Analyze the action described in the scenario
The system validates group memberships to determine permitted subnets after identity credentials have already been verified.
Separating identity verification from permission assignment is fundamental to understanding AAA.
2
Map the specific technical action to AAA pillars
Credential presentation (username/password/TOTP) = Authentication; Policy check for resource rights (subnet permissions) = Authorization; Log generation/session tracking = Accounting.
Authorization explicitly defines the rights, privileges, and boundaries granted to a verified identity.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA) Functional Boundaries
Tahmini Süre:1m 15s
Soru 2028Soru →

An organization installs highly visible warning signs along the perimeter fence of a secure facility stating that trespassers will be prosecuted. Which of the following security control types is best demonstrated by this measure?

Cevabı ve açıklamayı göster

Cevap: Deterrent control

Cevap

Deterrent control
Deterrent controls aim to discourage potential threat actors from attempting an attack by broadcasting warnings or a visible security presence prior to any unauthorized action.

Adım Adım Çözüm

1
Identify the primary objective of the implemented control.
The control consists of visible warning signs placed prior to any intrusion attempt.
Evaluating when and how the control acts determines its functional classification.
2
Map the objective to CompTIA Security+ functional control types.
Controls intended to dissuade adversaries from attempting an attack are classified as deterrent controls.
Warning signs act as a psychological barrier rather than an active physical block or detection mechanism.

Anahtar Kavram

Functional Security Control Types (Deterrent Controls)
Tahmini Süre:45s
Soru 2029Soru →

An aerospace engineering firm hosts sensitive CAD schematics on an internal server. Previously, any workstation connected to the internal corporate LAN was implicitly trusted and allowed access to the repository after a single initial morning domain login. To align this environment with Zero Trust Architecture (ZTA) principles, which strategy should the security team implement?

Cevabı ve açıklamayı göster

Cevap: Enforce explicit authentication and contextual authorization for every access request to the schematics repository, regardless of the user's network location.

Cevap

Enforce explicit authentication and contextual authorization for every access request to the schematics repository, regardless of the user's network location.
Zero Trust Architecture mandates that no network, user, or device is inherently trusted based on physical location or network placement. Enforcing continuous verification through explicit authentication and contextual authorization for every request directly fulfills ZTA principles.

Adım Adım Çözüm

1
Identify the weakness in the legacy security model described in the scenario.
The current model relies on implicit trust granted to devices simply because they are connected to the internal corporate LAN.
Perimeter-focused security assumes internal traffic is trustworthy, leaving internal data vulnerable if an attacker gains access to the corporate network.
2
Apply core Zero Trust Architecture principles to address the architectural limitation.
Transition to explicit verification and continuous authorization for every request.
Zero Trust operates on the principle of 'never trust, always verify,' requiring identity, device stance, and environmental context to be continuously validated regardless of network location.

Anahtar Kavram

Zero Trust Architecture Principles - Explicit Verification and Continuous Assessment
Soru 2030Soru →

A security infrastructure team is establishing proactive defense capabilities across an enterprise environment. Match each disruption or deception technology on the left with the scenario that best illustrates its primary operational objective on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Low-interaction honeypot
High-interaction honeypot
DNS sinkhole
Honeytoken

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Low-interaction honeypot matches with emulating basic network service banners; High-interaction honeypot matches with capturing complex zero-day exploitation within a fully operational OS; DNS sinkhole matches with intercepting outbound malicious domain queries; Honeytoken matches with embedding decoy cloud API keys into source code repositories.
Each deception and disruption technology aligns with its core functionality: low-interaction honeypots emulate basic services for low-overhead scanning alerts; high-interaction honeypots run complete operating systems for detailed behavioral analysis; DNS sinkholes block external attacker communication by altering DNS responses; honeytokens serve as decoy credentials to detect unauthorized repository exposure.

Adım Adım Çözüm

1
Analyze resource usage and emulation depth for decoy systems.
Low-interaction honeypots provide basic service responses with minimal overhead, while high-interaction honeypots provide full OS environments for detailed threat research.
Differentiating between low-interaction and high-interaction environments relies on evaluating system resource requirements versus intelligence depth.
2
Identify network disruption controls targeting traffic redirection.
DNS sinkholing manipulates domain resolution to prevent compromised endpoints from contacting external C2 infrastructure.
DNS sinkholes function specifically at the name resolution layer to disrupt malicious communication channels.
3
Evaluate data-centric decoy mechanisms.
Honeytokens consist of fake credentials or data artifacts placed within legitimate systems to detect unauthorized data access.
Decoy keys placed in repositories represent non-functional credential artifacts designed purely for alerting.

Anahtar Kavram

Deception and Disruption Technologies
Soru 2031Soru →

Match each operational enterprise security scenario on the left with the corresponding Authentication, Authorization, or Accounting (AAA) functional mechanism on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

An enterprise user submits a password and hardware security key response to an identity provider (IdP) to establish a trusted session.
A microservices gateway inspects embedded scope claims within a bearer token to determine if an API client can execute a database write operation.
A remote access gateway transmits session connection timestamps, disconnect codes, and total megabytes transferred to a central RADIUS server.
A privileged access management (PAM) system records administrative sudo commands, process IDs, and file modification details to an audit repository.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The user credential submission matches Authentication (verifying claimed identity); the API gateway token scope check matches Authorization (evaluating access rights); transmitting session timestamps and bandwidth metrics matches Accounting (measuring resource consumption); and logging privileged commands matches Accounting (logging actions for auditability and non-repudiation).
Each security scenario corresponds directly to its functional AAA pillar: validating user credentials (passwords/keys) establishes identity (Authentication); evaluating token scopes determines permission boundaries for API write calls (Authorization); recording connection metrics tracks resource utilization (Session Accounting); and logging administrative command execution creates a verifiable trail for non-repudiation (Activity Accounting).

Adım Adım Çözüm

1
Analyze scenario 1 (credential validation at the IdP).
Identified as proof of identity (passwords and MFA tokens).
Authentication is strictly responsible for verifying that a subject is who they claim to be prior to granting access.
2
Analyze scenario 2 (evaluating bearer token scopes at an API gateway).
Identified as permission enforcement based on policy/scopes.
Authorization determines what an authenticated subject is allowed to perform on specific resources.
3
Analyze scenario 3 (transmitting session start/stop times and data volume).
Identified as resource utilization and session tracking metrics.
Accounting measures consumption metrics such as connection time, data throughput, and session state.
4
Analyze scenario 4 (recording executed sudo commands and file changes in a PAM system).
Identified as security audit logging and accountability enforcement.
Accounting captures event logs of user actions to ensure traceability, compliance auditing, and non-repudiation.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA)
Tahmini Süre:2m 0s
Soru 2032Soru →

A security analyst is setting up a Security Information and Event Management (SIEM) pipeline to process incoming telemetry from enterprise web application firewalls. Arrange the stages of the SIEM log processing workflow in the correct operational sequence, from initial data receipt to incident notification.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for the SIEM log processing workflow is Log Collection, Parsing, Data Normalization, Event Correlation, and Alerting and Incident Generation.
The standard SIEM data pipeline follows a strict dependency hierarchy: Data must first be gathered (Collection), converted from raw text into structured attributes (Parsing), mapped to a single standard schema (Normalization), evaluated for multi-source indicators of compromise (Correlation), and finally communicated to security analysts when thresholds are breached (Alerting).

Adım Adım Çözüm

1
Identify the initial ingestion mechanism
Log Collection is identified as position 1
Data must be transmitted from source devices and received by the SIEM before processing can begin.
2
Extract meaningful fields from the raw string payload
Parsing is identified as position 2
Unstructured log text must be split into readable key-value fields.
3
Standardize variable names and formats across heterogeneous sources
Data Normalization is identified as position 3
Different vendors use varying field labels; normalization creates a unified schema across all logs.
4
Compare normalized events across rule criteria and baselines
Event Correlation is identified as position 4
Correlation logic requires normalized data to associate events across multiple logs and devices.
5
Trigger SOC notification upon threat identification
Alerting and Incident Generation is identified as position 5
Alerting is the resulting action when correlation engine conditions are met.

Anahtar Kavram

SIEM Log Processing Pipeline Lifecycle
Tahmini Süre:1m 30s
Soru 2033Soru →

A financial services firm is modernizing its security architecture by transitioning from a traditional boundary defense model to a Zero Trust Architecture (ZTA). The security engineering team is defining foundational policy controls for both cloud workloads and remote workforce access. Which of the following architectural practices directly implement core Zero Trust Architecture principles? (Select THREE)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Dynamically re-evaluating access privileges using real-time contextual signals, such as device security posture, user location, and behavioral telemetry.; Implementing microsegmentation around workload boundaries under the operating assumption that internal network segments are inherently untrusted.; Enforcing explicit validation and strict least privilege access rules on a per-session and per-resource granular basis.

Cevap

The core practices implementing Zero Trust Architecture principles are continuous context-based dynamic re-evaluation, microsegmentation assuming internal network segments are untrusted, and explicit validation enforcing least privilege on a per-session/per-resource basis.
Zero Trust Architecture removes implicit trust from enterprise networks. Valid architectural implementations include: dynamically re-evaluating risk and access permissions using ongoing context (such as device state and user location), isolating environments via microsegmentation because internal networks are considered untrusted, and requiring explicit validation of identity and permissions based on least privilege for every individual resource session.

Adım Adım Çözüm

1
Analyze core Zero Trust Architecture (ZTA) tenets defined in framework standards like NIST SP 800-207.
Identified tenets: assume breach, never trust always verify, explicit validation, least privilege, and continuous monitoring/re-evaluation.
Establishing accurate baseline tenets is essential for distinguishing valid ZTA controls from legacy boundary assumptions.
2
Evaluate the option regarding dynamic real-time contextual signals.
Valid ZTA practice.
Continuous verification requires ongoing analysis of device compliance, user behavior, and environmental context throughout the session lifetime.
3
Evaluate the option regarding microsegmentation and internal network assumptions.
Valid ZTA practice.
ZTA operates under an 'assume breach' posture where internal assets receive no default network-level implicit trust.
4
Evaluate the option regarding explicit validation and per-resource least privilege.
Valid ZTA practice.
ZTA mandates enforcing explicit, granular authorization decisions for every individual access request.
5
Differentiate and reject distractors relying on perimeter location trust or static persistent authentication tokens.
Distractor options identified and excluded.
Location-based implicit trust and static post-MFA persistence represent legacy perimeter concepts incompatible with Zero Trust.

Anahtar Kavram

Zero Trust Architecture Principles (Assume Breach, Continuous Verification, Explicit Validation, Least Privilege)
Tahmini Süre:2m 0s
Soru 2034Soru →

A security architect is implementing NIST SP 800-207 Zero Trust Architecture (ZTA) logical components within an enterprise hybrid network. Match each Zero Trust logical component on the left with its correct operational responsibility on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Policy Engine (PE)
Policy Administrator (PA)
Policy Enforcement Point (PEP)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Policy Engine matches evaluating policy rules and rendering access decisions; Policy Administrator matches issuing control signals to open or close session connections; Policy Enforcement Point matches intercepting and enforcing access controls on data plane traffic.
In NIST SP 800-207 Zero Trust Architecture, responsibilities are split across control and data planes: the Policy Engine renders access decisions based on contextual risk and policy; the Policy Administrator handles control channel signaling to establish or break connections; and the Policy Enforcement Point acts as the data plane gatekeeper enforcing those decisions on live session traffic.

Adım Adım Çözüm

1
Identify the primary role of the Policy Engine (PE)
The Policy Engine acts as the decision-making authority within the Zero Trust control plane.
Under NIST SP 800-207, the Policy Engine uses trust algorithms and contextual input to determine whether access should be granted.
2
Identify the primary role of the Policy Administrator (PA)
The Policy Administrator manages session state and control plane commands.
Once the Policy Engine renders a decision, the Policy Administrator signals the underlying gateway or client components to open or close the connection.
3
Identify the primary role of the Policy Enforcement Point (PEP)
The Policy Enforcement Point functions as the data plane gateway.
The Policy Enforcement Point sits directly in the communication channel to monitor, allow, or drop connection traffic based on instructions from the Policy Administrator.

Anahtar Kavram

Zero Trust Control Plane vs. Data Plane Component Functions
Tahmini Süre:1m 30s
Soru 2035Soru →

A system administrator needs to update an operational system to resolve a software vulnerability. Which of the following actions should the administrator take FIRST as part of the formal change management process to evaluate potential security impacts?

Cevabı ve açıklamayı göster

Cevap: Test the update in a staging environment to evaluate functionality and security side effects.

Cevap

Test the update in a staging environment to evaluate functionality and security side effects.
Testing software updates in a non-production staging environment ensures that potential security flaws, instability, or system incompatibilities are identified and resolved before moving changes to live production systems.

Adım Adım Çözüm

1
Identify the primary requirement in change control procedures.
Recognize that proposed system modifications must be evaluated for security impacts prior to production release.
Controlled testing prevents unexpected security gaps or operational failures.
2
Select the initial step of assessing impact.
Conducting testing in a non-production staging environment provides empirical data on stability and security.
Staging mirrors production without exposing live systems to operational risk.

Anahtar Kavram

Evaluating security impacts in change management staging environments
Tahmini Süre:45s
Soru 2036Soru →

A lead security analyst is reviewing the cryptographic design for an enterprise file storage service. The system must encrypt multi-gigabyte data archives efficiently while ensuring data confidentiality, integrity, and origin authenticity. The engineering team proposes encrypting each entire backup file directly using RSA-4096 asymmetric encryption to achieve confidentiality and non-repudiation in a single operation. Which of the following architectural modifications should the security analyst require to meet both performance and security objectives?

Cevabı ve açıklamayı göster

Cevap: Transition to a hybrid encryption scheme utilizing AES-GCM for bulk file encryption and RSA to encrypt the symmetric data encryption key.

Cevap

The security analyst should require transitioning to a hybrid encryption scheme using AES-GCM for bulk payload encryption and RSA for symmetric key encapsulation.
Directly encrypting large files using asymmetric keys (like RSA or ECC) causes severe performance degradation and failure due to block size constraints. The industry standard solution for bulk data protection is hybrid encryption: a high-speed symmetric algorithm (such as AES-GCM) encrypts the bulk file payload using a randomly generated Data Encryption Key (DEK), and the asymmetric key (RSA) is used solely to encrypt the small DEK. Furthermore, AES-GCM provides Authenticated Encryption with Associated Data (AEAD), ensuring both confidentiality and integrity.

Adım Adım Çözüm

1
Analyze the performance bottleneck of asymmetric encryption on bulk data
Identified that RSA encryption applied directly to multi-gigabyte files introduces massive computational overhead and is practically infeasible due to key size limits.
Asymmetric encryption algorithms are mathematically intensive and restricted to encrypting small blocks of data (such as key material).
2
Evaluate symmetric cipher requirements for bulk encryption
Selected AES in Galois/Counter Mode (AES-GCM) to deliver fast symmetric encryption with built-in authenticated encryption (AEAD).
AES-GCM efficiently provides both data confidentiality and integrity verification within a single pass without needing separate signature overhead for bulk content.
3
Integrate asymmetric key management via hybrid encryption
Encapsulated the ephemeral symmetric Data Encryption Key (DEK) using the recipient's RSA public key.
Hybrid encryption achieves the high performance of symmetric ciphers alongside the key distribution advantages of asymmetric cryptography.

Anahtar Kavram

Hybrid Encryption and Authenticated Symmetric Modes
Soru 2037Soru →

A security operations team configures an isolated network segment containing multiple fully functional decoy servers and simulated industrial control system (ICS) devices. The environment allows attackers to execute commands, run scripts, and interact extensively with system operating systems so analysts can capture advanced tactics, techniques, and procedures (TTPs). Which of the following deception technologies has been implemented?

Cevabı ve açıklamayı göster

Cevap: High-interaction honeynet

Cevap

High-interaction honeynet
A high-interaction honeynet uses a network of decoy systems that emulate genuine operating systems and services. It provides a rich environment for attackers to interact with, enabling security teams to study complex attack sequences without risking real production networks.

Adım Adım Çözüm

1
Analyze the requirements in the scenario
The scenario describes a network of fully functional decoy servers allowing extensive attacker interaction to gather intelligence on adversary TTPs.
Deception technologies are categorized by their deployment scope (individual host vs. network segment) and interaction level (low vs. high).
2
Distinguish between deception types and production controls
Multiple decoy systems configured on an isolated network segment form a honeynet. Because full OS functionality and deep engagement are allowed, it is classified as high-interaction.
High-interaction honeynets allow adversaries to interact directly with OS services to capture post-compromise activity.

Anahtar Kavram

Deception and Disruption Technologies - Honeynets and Interaction Levels
Soru 2038Soru →

A network administrator is configuring a secure transport session to protect financial telemetry transmitted across an untrusted enterprise network. The session configuration requires high-speed symmetric data confidentiality as well as a key exchange mechanism that guarantees Perfect Forward Secrecy (PFS). Which TWO of the following cryptographic mechanisms should the administrator select to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Elliptic Curve Diffie-Hellman Ephemeral (ECDHE); Advanced Encryption Standard in Galois/Counter Mode (AES-GCM)

Cevap

Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) and Advanced Encryption Standard in Galois/Counter Mode (AES-GCM) must be selected.
To protect session data across an untrusted network with both high performance and forward secrecy, administrators pair a symmetric cipher for data payload confidentiality with an ephemeral key exchange protocol. Elliptic Curve Diffie-Hellman Ephemeral provides Perfect Forward Secrecy by establishing unique keying material for each session without relying on reusable private keys. Advanced Encryption Standard in Galois/Counter Mode provides authenticated symmetric bulk encryption, meeting both the performance and confidentiality objectives.

Adım Adım Çözüm

1
Identify the key exchange requirement
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) provides key exchange with Perfect Forward Secrecy (PFS) using short-lived ephemeral key pairs.
PFS ensures that compromising a long-term private key does not compromise past session keys.
2
Identify the bulk confidentiality requirement
Advanced Encryption Standard in Galois/Counter Mode (AES-GCM) provides fast symmetric encryption along with authenticated integrity checks.
Symmetric ciphers are computationally efficient and designed for high-throughput bulk data protection.

Anahtar Kavram

Combining symmetric encryption for bulk confidentiality with ephemeral key exchange for forward secrecy.
Soru 2039Soru →

A corporate employee working remotely authenticates successfully at the start of their shift using multi-factor authentication (MFA) from a compliant corporate laptop. Mid-day, a local policy check detects that the endpoint antivirus service was forcibly stopped and an unauthorized storage device was attached. Under Zero Trust Architecture (ZTA) principles, how should the access control system respond to this change in device posture?

Cevabı ve açıklamayı göster

Cevap: Dynamically re-evaluate security context and immediately revoke or restrict active application access privileges.

Cevap

Dynamically re-evaluate security context and immediately revoke or restrict active application access privileges.
Zero Trust Architecture enforces continuous verification and explicit validation. Under ZTA, access is never implicitly granted permanently based on initial authentication. When device posture changes (such as disabling security agents or introducing high-risk hardware), the policy engine must dynamically re-evaluate the risk score and instruct policy enforcement points to revoke or constrain active session access immediately.

Adım Adım Çözüm

1
Identify the core security event described in the enterprise scenario.
An authenticated endpoint underwent a negative change in security posture due to a disabled security service and unapproved hardware connection.
Understanding the trigger condition is essential to determine how access decisions must adapt.
2
Apply Zero Trust Architecture (ZTA) principles to the context evaluation.
Zero Trust assumes no implicit trust based on network location or past successful login, mandating explicit and continuous verification of context, identity, and device health.
Static initial authentication does not grant permanent access when operational risk parameters change.
3
Select the appropriate enforcement mechanism based on continuous inspection.
The architecture must dynamically adjust session state, revoking or step-down restricting access until compliance state is remediated.
Real-time context evaluation ensures access decisions react instantaneously to endpoint security degradation.

Anahtar Kavram

Continuous Verification and Dynamic Access Control in Zero Trust Architecture
Soru 2040Soru →

An enterprise security administrator is auditing network infrastructure logs to verify full implementation of the Authentication, Authorization, and Accounting (AAA) framework. Which of the following technical controls directly perform Accounting functions? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Logging connection start times, disconnect timestamps, and total bandwidth consumed by remote users.; Recording command-line interface (CLI) statements executed by network engineers during active SSH management sessions.

Cevap

The controls that satisfy the Accounting pillar are logging connection start times, disconnect timestamps, and bandwidth consumed, as well as recording command-line interface (CLI) statements executed by network engineers.
Accounting focuses on tracking resource utilization, user actions, and session data. Recording session timestamps, bandwidth, and specific commands executed on infrastructure devices creates an accountable audit trail.

Adım Adım Çözüm

1
Define the specific operational role of the Accounting pillar in AAA.
Accounting tracks user activity, session statistics, resource usage, and audit logs to ensure non-repudiation and oversight.
Categorizing the AAA pillars isolates tracking mechanisms from identity checks and access enforcement.
2
Analyze each proposed technical control against the Accounting definition.
Logging bandwidth/timestamps and recording executed CLI commands capture activity logs and metrics (Accounting). Validating credentials proves identity (Authentication), and applying VLAN filters restricts access rights (Authorization).
Only mechanisms that monitor, measure, and record active usage fulfill the Accounting objective.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA)
ÖncekiSayfa 102 / 112Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin