Examkin

Tüm alıştırma soruları

2232 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 2041Soru →

Match each organizational security measure to its corresponding functional control type according to CompTIA Security+ standards.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Restoring corrupted system configurations from a known clean backup following a malware incident
Publishing an enterprise acceptable use policy that defines mandatory employee security responsibilities
Configuring a network firewall rule to block unauthorized inbound connection attempts
Deploying a network intrusion detection system (NIDS) to identify anomalous traffic and generate alerts

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Restoring from backups matches Corrective Control; Publishing acceptable use policy matches Directive Control; Configuring firewall rules matches Preventive Control; Deploying NIDS alerts matches Detective Control.
Each security control implementation aligns directly with standard CompTIA Security+ functional control classifications: restoring from backups fixes damage after an incident (Corrective), policies set required conduct rules (Directive), firewalls actively block threats before entry (Preventive), and intrusion detection systems discover and alert on suspicious activity (Detective).

Adım Adım Çözüm

1
Analyze the operational goal of restoring system configurations from backups after an attack.
Identified as a corrective action designed to reverse impact and restore operational capability.
Corrective controls focus on mitigation and recovery after a security incident has taken place.
2
Evaluate the administrative nature of publishing an acceptable use policy.
Identified as a policy-driven directive establishing mandatory rules and expectations.
Directive controls prescribe required behavior and compliance regulations across an organization.
3
Examine the technical enforcement of a firewall rule blocking unauthorized inbound traffic.
Identified as a preventive measure designed to stop unauthorized actions before they happen.
Preventive controls proactively block security breaches or policy violations from occurring.
4
Determine the role of a network intrusion detection system generating alerts.
Identified as a detective measure focused on observing and signaling active or historical anomalies.
Detective controls discover and flag unauthorized or unexpected activities during or post-execution.

Anahtar Kavram

Functional Types of Security Controls
Soru 2042Soru →

During an active security monitoring shift, an analyst discovers anomalous command-and-control (C2) beacons originating from an internal human-machine interface (HMI) jump host connected to a critical industrial control network segment. The incident response playbook mandates immediate action to prevent further lateral movement without shutting down the physical system. Which of the following actions should the analyst perform FIRST according to standard incident response frameworks?

Cevabı ve açıklamayı göster

Cevap: Isolate the compromised jump host from the network by disabling its active network adapter interfaces.

Cevap

Isolate the compromised jump host from the network by disabling its active network adapter interfaces.
Isolating the compromised host by disabling its network interfaces immediately restricts the attacker's ability to communicate with command-and-control servers or pivot to adjacent industrial control systems. This aligns with the containment phase of standard NIST/ISO incident response playbooks.

Adım Adım Çözüm

1
Identify the current phase of the Incident Response lifecycle based on the scenario context.
An active compromise and C2 beaconing are confirmed, placing the immediate priority in the Containment phase.
Containment limits the scope and impact of an active incident before attempting root-cause removal or host recovery.
2
Evaluate containment actions against operational constraints.
Disabling network interfaces stops external C2 traffic and internal lateral movement while keeping system RAM intact for volatile evidence preservation.
Network isolation meets containment goals without violating the order of volatility or requiring immediate host power-down.

Anahtar Kavram

Incident Response Lifecycle - Containment Phase
Soru 2043Soru →

A security technician needs to verify that a downloaded software installation package has not been modified or corrupted during transit. Which of the following cryptographic mechanisms should the technician use to check the file's integrity?

Cevabı ve açıklamayı göster

Cevap: Cryptographic hash function

Cevap

Cryptographic hash function
A cryptographic hash function converts arbitrary input data into a unique, fixed-length string (digest). By calculating the hash of the downloaded package and comparing it to the published hash value, the technician can verify whether the file was altered or corrupted during transit.

Adım Adım Çözüm

1
Identify the primary security requirement
The scenario requires verifying that a file has not been altered or corrupted in transit (ensuring data integrity).
Data integrity controls ensure that data remains authentic and unmodified.
2
Match the requirement to the correct cryptographic concept
Cryptographic hash functions (such as SHA-256) produce a unique fixed-length output digest for a given input file.
Any modification to the source file results in a drastically different hash digest, allowing simple verification.

Anahtar Kavram

Cryptographic Hash Functions and Data Integrity
Soru 2044Soru →

Match each social engineering attack vector on the left with its correct scenario description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Spear Phishing
Vishing
Tailgating
Watering Hole

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Spear Phishing matches customized targeted emails, Vishing matches voice call scams, Tailgating matches unauthorized physical entry following an employee, and Watering Hole matches compromising a commonly visited website.
Each attack vector is matched to its core operational characteristic: Spear Phishing uses tailored targeted emails; Vishing relies on voice phone calls; Tailgating exploits physical proximity to enter secure doors; and Watering Hole attacks infect third-party sites trusted by a specific user group.

Adım Adım Çözüm

1
Identify the vector focused on tailored email messaging.
Spear Phishing connects to targeting specific individuals with customized email communications.
Unlike generic phishing, spear phishing relies on specific recon to craft personalized emails.
2
Identify the voice-based social engineering vector.
Vishing connects to conducting scams over voice phone calls.
Vishing is short for voice phishing.
3
Identify the physical access social engineering technique.
Tailgating connects to following an authorized employee into a secured facility.
Tailgating relies on courtesy or distraction to bypass access control portals physically.
4
Identify the web-based compromise vector.
Watering Hole connects to compromising a site frequently visited by a target demographic.
Watering hole attacks target the online resources trusted by specific target groups.

Anahtar Kavram

Social Engineering Attack Vectors and Manifestations
Soru 2045Soru →

A security architect is auditing the access management architecture of a microservices-based enterprise platform. The platform relies on a central Identity Provider (IdP), an API Gateway, fine-grained access policies, and a SIEM system. Which of the following technical mechanisms specifically fulfill the Authorization pillar of the AAA framework? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Evaluating JSON Web Token (JWT) scope claims at the API gateway to restrict microservice endpoint execution; Enforcing Role-Based Access Control (RBAC) matrix rules to restrict backend database query execution based on user permissions

Cevap

The controls that specifically fulfill the Authorization pillar are evaluating JWT scope claims at the API gateway and enforcing Role-Based Access Control (RBAC) matrix rules on backend queries.
Evaluating JWT scope claims at the API gateway and enforcing RBAC policies on backend database queries both represent Authorization controls. Authorization is the pillar of AAA responsible for determining what actions, endpoints, or data an authenticated subject is permitted to access based on privileges, scopes, or assigned roles.

Adım Adım Çözüm

1
Analyze each mechanism in the scenario against the three AAA pillars (Authentication, Authorization, Accounting).
Categorize identity verification as Authentication, permission/access determination as Authorization, and activity logging/auditing as Accounting.
AAA requires clear operational separation between proving identity, determining privileges, and tracking actions.
2
Identify the Authorization mechanisms.
Evaluating JWT scopes at the API gateway and enforcing RBAC matrix rules on backend queries both decide whether an already-identified principal is allowed to perform a specific action.
Authorization explicitly deals with rights, roles, scopes, and access permissions.
3
Differentiate and exclude non-Authorization controls.
Credential/TOTP verification is Authentication (who you are); SIEM telemetry streaming is Accounting (what you did).
Selecting non-authorization controls reflects misconceptions regarding AAA pillar definitions.

Anahtar Kavram

Authentication verifies identity, Authorization determines permissions and access rights, and Accounting logs actions and usage for auditability.
Soru 2046Soru →

An enterprise financial institution relies on a legacy mainframe system to process batch payments. A security compliance audit reveals that the mainframe application cannot natively support TLS 1.3 network transport encryption due to legacy protocol stack limitations. To satisfy data-in-transit security requirements without taking the system offline, the security engineering team deploys an inline hardware cryptographic proxy that intercepts outbound mainframe communications and encapsulates them inside an encrypted IPsec tunnel across the internal network. Which of the following best classifies the deployment of the hardware cryptographic proxy?

Cevabı ve açıklamayı göster

Cevap: Technical category and Compensating functional type

Cevap

Technical category and Compensating functional type
The deployment of an inline hardware cryptographic proxy is executed via automated hardware technology, placing it firmly within the Technical (Logical) control category. Functionally, because native TLS 1.3 application encryption (the baseline primary control) cannot be implemented due to legacy system limitations, the proxy serves as an alternative control to achieve equivalent data protection. Controls implemented to satisfy a security requirement when a primary control is unfeasible are classified as Compensating controls.

Adım Adım Çözüm

1
Determine the security control category
Identified as Technical category
The control consists of an inline hardware appliance executing cryptographic encapsulation routines autonomously, which falls under logical/technical mechanisms rather than human operations or administrative policies.
2
Determine the functional control type based on the operational context
Identified as Compensating functional type
The primary control requirement (native TLS 1.3 support on the legacy mainframe) is technically impossible to achieve without system replacement. Deploying an external hardware proxy satisfies the overarching security objective (protecting data in transit) as an explicit alternative mitigation.
3
Combine category and functional type classifications
Technical category + Compensating functional type
Synthesizing both dimensions yields a technical compensating control.

Anahtar Kavram

Security Control Categories and Functional Types
Soru 2047Soru →

A security team deploys automated log parsing software that continuously analyzes server event logs to identify and flag unauthorized login attempts as they occur. Which functional control type is best demonstrated by this measure?

Cevabı ve açıklamayı göster

Cevap: Detective control

Cevap

The measure is best classified as a Detective control.
The correct answer is the detective control because automated log parsing software functions to discover and report unauthorized activity, which aligns directly with the goal of detective controls under CompTIA Security+ framework definitions.

Adım Adım Çözüm

1
Analyze the primary function of the security control in the scenario.
The control scans server logs to spot and flag unauthorized login attempts as they happen.
Identifying the operational objective of a control determines its functional classification.
2
Map the security objective to CompTIA Security+ functional control types.
Controls designed to observe, log, analyze, and alert on security events are defined as detective controls.
Detective mechanisms focus on threat discovery and event identification rather than prevention, deterrence, or remediation.

Anahtar Kavram

Security Control Functional Types (Detective Controls)
Soru 2048Soru →

Match each cryptographic mechanism to its primary operational security objective.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Key Stretching
Password Salting
Perfect Forward Secrecy
Homomorphic Encryption

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Key Stretching matches with repeatedly executing an algorithm to increase computational cost and impede offline brute-force attempts. Password Salting matches with adding unique random bytes to credentials prior to hashing to prevent precomputed rainbow table attacks. Perfect Forward Secrecy matches with generating unique ephemeral session keys so that compromising a long-term key does not decrypt past sessions. Homomorphic Encryption matches with enabling mathematical processing directly on encrypted data without needing to decrypt it first.
Each cryptographic technique aligns with a distinct operational goal: Key stretching increases computational difficulty against offline cracking; Password salting defeats precomputed hash lookups; Perfect Forward Secrecy protects recorded historical traffic using ephemeral keys; Homomorphic encryption enables calculations on ciphertexts without exposing plaintext.

Adım Adım Çözüm

1
Identify the purpose of Key Stretching.
Key stretching algorithms (such as PBKDF2 or bcrypt) iterate a cryptographic hash function thousands of times to add execution overhead.
This directly increases computational cost for attackers performing offline brute-force attacks.
2
Identify the purpose of Password Salting.
Salting prepends or appends unique random bits to passwords before computing their digests.
This guarantees unique hash outputs for identical passwords, neutralizing precomputed rainbow table lookups.
3
Identify the purpose of Perfect Forward Secrecy.
Perfect Forward Secrecy uses ephemeral key exchange algorithms (like ECDHE) to generate distinct session keys for every communication session.
This ensures that compromise of a long-term private key does not compromise past encrypted sessions.
4
Identify the purpose of Homomorphic Encryption.
Homomorphic encryption allows third parties to compute operations directly on ciphertexts.
This enables secure data analysis in untrusted environments without decrypting data to plaintext.

Anahtar Kavram

Cryptographic Concepts and Algorithms
Soru 2049Soru →

A DevOps security architect is establishing an automated firmware distribution pipeline for remote edge devices operating on untrusted networks. The security baseline mandates a mechanism that guarantees payload data integrity, authenticates the vendor build system as the source, and provides non-repudiation so the authoring system cannot deny issuing a specific release. Which of the following cryptographic controls should the architect implement?

Cevabı ve açıklamayı göster

Cevap: Digital signatures created using the vendor build system's asymmetric private key over a SHA-256 digest

Cevap

Digital signatures created using the vendor build system's asymmetric private key over a SHA-256 digest
A digital signature is created by computing a cryptographic hash of the message (such as SHA-256) and encrypting that hash value using the sender's asymmetric private key. Recipients verify the signature using the corresponding public key. Because only the build server controls the private key, valid signatures provide proof of origin, data integrity, and non-repudiation.

Adım Adım Çözüm

1
Identify the required cryptographic properties from the scenario
The requirements explicitly call for data integrity, source authentication, and non-repudiation.
Non-repudiation requires a mechanism where only one specific entity possesses the private key used to sign the data.
2
Evaluate symmetric vs. asymmetric cryptographic mechanisms
Symmetric keys (such as AES-GCM or HMAC shared keys) are shared between sender and recipient, meaning recipient systems could forge payloads, which invalidates non-repudiation.
Asymmetric cryptography provides asymmetric key pairs (private/public), ensuring only the private key holder can create valid signatures.
3
Select the proper asymmetric implementation for firmware integrity and non-repudiation
Hashing the firmware with SHA-256 and encrypting the digest with the build server's private key forms a digital signature that edge devices verify using the public key.
This guarantees integrity (via SHA-256), source origin authentication, and non-repudiation (only the build server holds the private key).

Anahtar Kavram

Digital Signatures and Non-Repudiation
Tahmini Süre:2m 0s
Soru 2050Soru →

An enterprise security architect is standardizing cryptographic controls across a zero-trust network infrastructure. Match each security design requirement on the left with the most appropriate cryptographic mechanism or algorithm on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Negotiating a transient shared secret over an untrusted channel to provide Perfect Forward Secrecy (PFS) for TLS sessions
Providing simultaneous payload confidentiality, integrity verification, and origin authenticity in a single symmetric operation
Mitigating offline GPU-accelerated brute-force attacks against stored user credential hashes using configurable memory-hard work factors
Ensuring non-repudiation and origin verification for published software updates without encrypting the file binary itself

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

1. Negotiating a transient shared secret with PFS matches ECDHE; 2. Simultaneous confidentiality, integrity, and authenticity matches AES-GCM; 3. Mitigating GPU brute-force cracking of stored credentials matches Argon2id; 4. Non-repudiation for software updates without payload encryption matches ECDSA.
Each requirement directly aligns with the operational purpose of the corresponding cryptographic primitive: ECDHE for forward-secret key exchange, AES-GCM for authenticated symmetric encryption, Argon2id for memory-hard credential hashing, and ECDSA for asymmetric digital signatures.

Adım Adım Çözüm

1
Analyze key exchange requirements for session key forward secrecy.
Ephemeral Diffie-Hellman key exchanges (like ECDHE) generate temporary key pairs per session, guaranteeing Perfect Forward Secrecy.
Static asymmetric keys (like basic RSA or DH) do not satisfy PFS requirements because private key compromise exposes past traffic.
2
Evaluate cipher modes for combined confidentiality and integrity protection.
Galois/Counter Mode (GCM) is an AEAD mode combining AES block cipher encryption with Galois field authentication.
Standard block modes like CBC require a separate MAC algorithm (e.g., HMAC) to achieve authenticated encryption.
3
Determine password hashing mechanisms designed for high compute/memory cost.
Argon2id incorporates salt and deliberate CPU/memory overheads to neutralize parallelized cracking hardware.
Standard fast hash functions (SHA-256) are vulnerable to rapid GPU dictionary attacks when applied directly to passwords.
4
Identify asymmetric mechanisms providing non-repudiation for cleartext payloads.
Digital signatures (such as ECDSA) sign a digest of the payload using a private key, ensuring origin verification without requiring data encryption.
Public key encryption provides confidentiality rather than payload signing for unencrypted public distribution.

Anahtar Kavram

Cryptographic Concepts and Algorithms
Soru 2051Soru →

A security engineer is configuring cryptographic primitives for a high-throughput financial microservice architecture. The system must establish session keys over untrusted networks ensuring Perfect Forward Secrecy (PFS), while also supporting high-speed authenticated bulk data encryption for payload storage. Which of the following cryptographic mechanisms should the engineer implement to satisfy BOTH requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) key exchange; Advanced Encryption Standard in Galois/Counter Mode (AES-GCM)

Cevap

The engineer should select Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) key exchange for Perfect Forward Secrecy and Advanced Encryption Standard in Galois/Counter Mode (AES-GCM) for high-speed authenticated bulk data encryption.
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) generates temporary keys per session to ensure Perfect Forward Secrecy (PFS). Advanced Encryption Standard in Galois/Counter Mode (AES-GCM) is an authenticated symmetric encryption algorithm designed for high-performance bulk data confidentiality and integrity.

Adım Adım Çözüm

1
Analyze the requirement for Perfect Forward Secrecy (PFS) during session key negotiation.
Identify that ephemeral key exchange algorithms like ECDHE generate unique, disposable session keys that prevent past sessions from being decrypted if long-term private keys are compromised.
Static asymmetric methods like traditional RSA key exchange do not support ephemeral keying.
2
Analyze the requirement for high-speed authenticated bulk payload encryption.
Identify symmetric block ciphers operating in authenticated encryption modes, specifically AES-GCM, which offer hardware-accelerated confidentiality and built-in integrity checking.
Asymmetric encryption and digital signature algorithms are computationally intensive and unsuitable for bulk payload confidentiality.
3
Select the correct combination of cryptographic primitives based on operational requirements.
Choose ECDHE for session key establishment and AES-GCM for bulk payload protection.
These mechanisms satisfy both PFS and high-speed authenticated encryption needs directly.

Anahtar Kavram

Cryptographic Algorithms and Key Exchange Properties
Soru 2052Soru →

An enterprise security architecture team discovers that a legacy mainframe application processing sensitive financial transactions cannot support native transport layer encryption due to application stack limitations. To mitigate the risk of unauthorized data exposure across internal network segments without modifying legacy software, the team deploys an encrypted IPSec tunnel overlay between dedicated network gateway appliances. Which of the following best classifies both the control category and the functional control type of this IPSec tunnel implementation?

Cevabı ve açıklamayı göster

Cevap: Technical category and Compensating functional type

Cevap

Technical category and Compensating functional type
The implementation utilizes network devices and cryptographic algorithms (Technical category) to provide an alternative mitigation path when the baseline security requirement cannot be directly integrated into the legacy software (Compensating functional type).

Adım Adım Çözüm

1
Analyze the underlying mechanism to determine the control category.
The control is realized using network hardware, specialized appliances, and cryptographic protocols (IPSec), placing it firmly in the Technical category.
Technical controls (also called logical controls) use hardware, software, or firmware mechanisms to execute security protections.
2
Analyze the deployment rationale to determine the functional control type.
The IPSec overlay is implemented specifically because the legacy application cannot support the primary requirement of native transport layer encryption, designating it as a Compensating control type.
Compensating controls are alternative security measures put in place to achieve the intent of a primary security standard when the primary control is technically unfeasible or prohibitive to implement.

Anahtar Kavram

Dual-Axis Security Control Classification (Categories vs. Functional Types)
Soru 2053Soru →

A security administrator is evaluating enterprise security controls to classify them by control category. Which of the following security measures are classified as technical controls? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Implementing full-disk encryption on corporate laptops using AES-256; Configuring firewall access control lists (ACLs) to block unauthorized network traffic

Cevap

Implementing full-disk encryption on corporate laptops using AES-256 and configuring firewall access control lists (ACLs) to block unauthorized network traffic are technical controls.
Full-disk encryption and firewall access control lists (ACLs) are both technical controls because they are implemented through computer hardware, software, or firmware mechanisms. Full-disk encryption uses software/hardware cryptographic algorithms to protect data at rest, while firewall ACLs use automated network software logic to filter incoming and outgoing network traffic.

Adım Adım Çözüm

1
Define technical security controls based on CompTIA Security+ standards.
Technical controls are security controls that are executed and enforced by computer hardware, software, or automated system logic.
Distinguishing technical controls from operational, managerial, and physical controls requires determining whether technological systems automate the enforcement.
2
Analyze each option provided in the scenario.
Full-disk encryption and firewall access control lists rely on system software and network hardware logic. Security awareness training relies on human behavior/policies, and security guards rely on physical personnel.
Evaluating each item isolates the measures implemented via computer technology.

Anahtar Kavram

Technical Security Control Categories
Soru 2054Soru →

An employee at a corporate office scans their access badge to open a secured entrance door. Immediately after, an unidentified individual without a badge walks inside right behind the employee before the door closes. Which of the following social engineering attacks is best demonstrated in this scenario?

Cevabı ve açıklamayı göster

Cevap: Tailgating

Cevap

Tailgating
The scenario describes tailgating (also called piggybacking), which takes place when an unauthorized person gains physical entrance into a restricted area by closely following an authorized employee who opened the door.

Adım Adım Çözüm

1
Analyze the entry method described in the scenario
An unauthorized individual gains access into a secured facility by following immediately behind an authenticated worker.
Identifying the method of access separates physical facility vectors from digital network attack vectors.
2
Match the behavior to standard social engineering attack definitions
Following an authorized person through a secure portal without credentials defines tailgating (or piggybacking).
Tailgating relies on human courtesy or social norms to bypass physical authentication barriers.

Anahtar Kavram

Tailgating physical social engineering attack
Tahmini Süre:45s
Soru 2055Soru →

A security administrator is configuring disk-level encryption for an enterprise storage network containing high-volume database files. The encryption solution must provide data confidentiality for bulk data while maintaining fast processing speeds and low performance overhead. Which of the following cryptographic approaches is best suited for this task?

Cevabı ve açıklamayı göster

Cevap: Symmetric encryption algorithm

Cevap

Symmetric encryption algorithm
Symmetric encryption algorithms use a single secret key for both encryption and decryption operations. Their low mathematical complexity yields very high execution speed, making symmetric encryption the standard approach for bulk data-at-rest protection.

Adım Adım Çözüm

1
Identify the primary requirement in the scenario
The system requires high-speed bulk data confidentiality at rest with low computational overhead.
Bulk storage encryption must process massive amounts of data without causing throughput bottlenecks.
2
Evaluate the algorithm categories against performance requirements
Symmetric algorithms (such as AES) perform encryption and decryption rapidly using a single key, making them ideal for bulk data.
Asymmetric encryption is computationally heavy, hashing is non-reversible, and Diffie-Hellman is a key exchange method rather than a data encryption algorithm.

Anahtar Kavram

Symmetric vs. Asymmetric Encryption Use Cases
Tahmini Süre:45s
Soru 2056Soru →

During an ongoing incident, a security analyst discovers that an internal web application service account was compromised and is actively attempting unauthorized Kerberoasting attacks to extract Active Directory ticket-granting service hashes. According to standard NIST incident response frameworks, which of the following actions should the incident response team perform FIRST during the containment phase?

Cevabı ve açıklamayı göster

Cevap: Disable the compromised service account and isolate the host hosting the web application from the internal network.

Cevap

Disable the compromised service account and isolate the host hosting the web application from the internal network.
The correct response prioritizes immediate containment by disabling the compromised credentials and isolating the compromised host from the network. In the NIST incident response lifecycle, containment must occur before eradication or recovery to prevent the adversary from expanding their breach footprint across the domain.

Adım Adım Çözüm

1
Identify the phase of the incident response lifecycle required by the scenario.
The scenario requires an immediate action in the Containment phase of the NIST incident response framework.
Containment focuses on limiting the scope and impact of an active breach to prevent lateral movement and further unauthorized access.
2
Evaluate potential containment mechanisms for credential abuse and host compromise.
Disabling the affected service account revokes access, and isolating the host isolates the attack source.
Combining account disablement and host network isolation stops both credential-based lateral movement and host-based communications.
3
Distinguish containment actions from eradication, recovery, or detective controls.
Re-imaging belongs to eradication/recovery, passive monitoring is detective, and log purging destroys forensic evidence.
Proper IR playbooks require stopping the breach (containment) before conducting full cleanup (eradication) or restoration (recovery).

Anahtar Kavram

Incident Response Containment Phase Execution
Soru 2057Soru →

An enterprise security administrator is deploying a high-volume public web service that requires TLS mutual authentication (mTLS) for client devices and automated certificate lifecycle management. The administrator must ensure that client certificate status checks are optimized for minimal latency without exposing the internal Certificate Authority (CA) to external query floods, while also establishing an automated, secure enrollment mechanism for enterprise endpoint certificates. Which of the following technical controls and configurations should the administrator implement to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure Online Certificate Status Protocol (OCSP) stapling on the web server to append cached, digitally signed CA revocation responses to client TLS handshakes.; Implement Automated Certificate Management Environment (ACME) with standardized challenge protocols to automate certificate request and issuance for enterprise endpoints.

Cevap

The administrator should configure OCSP stapling on the web server to optimize revocation checks without exposing the CA, and deploy the Automated Certificate Management Environment (ACME) protocol to automate endpoint certificate enrollment.
Enabling OCSP stapling delegates the burden of fetching digitally signed revocation status to the web server itself, which appends the OCSP response into the TLS handshake, reducing latency and shielding the CA from direct client queries. Utilizing ACME automates key pair creation, challenge verification, CSR submission, and certificate installation across endpoints securely.

Adım Adım Çözüm

1
Evaluate revocation checking optimization requirements.
Identify that OCSP stapling caches signed revocation status directly on the web server, eliminating client-to-CA query latency and protecting internal CA infrastructure from external traffic spikes.
Direct CRL downloads or direct OCSP querying by clients introduce performance bottlenecks and privacy issues.
2
Evaluate automated certificate lifecycle management options.
Identify ACME as the standard open protocol for automated domain validation, key issuance, and certificate renewal.
Manual CSR processing and centralized private key distribution violate PKI key security principles and scalability standards.

Anahtar Kavram

PKI Certificate Lifecycle Automation and Revocation Optimization
Soru 2058Soru →

An organization is evaluating its security architecture following a comprehensive risk assessment. Match each enterprise security measure to its correct dual-axis classification (Category and Functional Type) according to CompTIA Security+ standards.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Mandatory annual security awareness training enforcing mandatory employee compliance with acceptable use policies
An automated endpoint script that isolates a compromised workstation from the subnet upon detecting command-and-control beaconing
A biometric access-controlled mantrap entry system protecting the perimeter of a primary data center
A segmented jump server with heightened logging deployed temporarily for administrative access while legacy servers undergo MFA retrofitting

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

1. Annual awareness training maps to Managerial Category / Directive Type. 2. Automated host isolation script maps to Technical Category / Corrective Type. 3. Biometric mantrap system maps to Physical Category / Preventive Type. 4. Segmented jump server fallback maps to Technical Category / Compensating Type.
Each security control is accurately categorized by implementation method (Managerial, Technical, Physical) and functional purpose (Directive, Corrective, Preventive, Compensating). Policy sign-offs direct behavior (Managerial/Directive); host isolation mitigates ongoing attack damage (Technical/Corrective); physical mantraps prevent unauthorized entry (Physical/Preventive); and jump boxes act as substitute technical measures for legacy systems (Technical/Compensating).

Adım Adım Çözüm

1
Analyze the primary category (Managerial, Operational, Technical, Physical) for each mechanism based on its underlying operational domain.
Training/policy is Managerial; automated endpoint script is Technical; mantrap facility hardware is Physical; jump server infrastructure is Technical.
Control categories are determined by how the control is implemented—via policy/governance, physical assets, human operations, or system logic.
2
Determine the functional goal (Preventive, Deterrent, Detective, Corrective, Compensating, Directive) for each mechanism.
Training directs compliance (Directive); isolation remediates active threat impact (Corrective); mantraps block unauthorized access (Preventive); jump server replaces missing native controls (Compensating).
Functional types define the operational intent relative to security incidents (before, during, after, or in place of primary controls).
3
Pair each implementation with its corresponding dual-axis category and functional type classification.
All four pairings are established cleanly based on CompTIA Security+ SY0-701 standard taxonomy definitions.
Correct mapping requires aligning both the category axis and functional type axis simultaneously.

Anahtar Kavram

Security Control Categories and Functional Types
Soru 2059Soru →

An organization is modernizing its security controls by adopting Zero Trust Architecture (ZTA) principles across its enterprise environment. Match each core Zero Trust principle on the left with its corresponding operational description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Implicit Trust Elimination
Microsegmentation
Continuous Verification
Least Privilege Access

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Implicit Trust Elimination pairs with treating all network locations as untrusted; Microsegmentation pairs with isolating network workloads into granular enclaves; Continuous Verification pairs with dynamically re-evaluating context throughout an active session; Least Privilege Access pairs with granting permissions strictly on a per-resource and per-request basis.
Each Zero Trust principle correctly aligns with its operational definition: Implicit Trust Elimination treats all network environments as untrusted; Microsegmentation isolates workloads into granular enclaves; Continuous Verification continuously evaluates risk across the session lifetime; Least Privilege Access restricts privileges strictly to required resources per transaction.

Adım Adım Çözüm

1
Evaluate 'Implicit Trust Elimination'
Matches treating all network zones as untrusted boundaries requiring explicit validation.
Zero Trust discards the concept of a trusted internal network segment.
2
Evaluate 'Microsegmentation'
Matches isolating workloads into granular enclaves to prevent lateral movement.
Partitioning resources creates strict micro-perimeters around individual applications or assets.
3
Evaluate 'Continuous Verification'
Matches dynamically re-evaluating identity and risk throughout an active connection.
Zero Trust requires real-time monitoring of user and device state beyond initial authentication.
4
Evaluate 'Least Privilege Access'
Matches granting rights strictly on a per-resource and per-request basis.
Access is scoped strictly to what is necessary for the specific requested operation.

Anahtar Kavram

Zero Trust Architecture Core Tenets
Tahmini Süre:1m 30s
Soru 2060Soru →

A security operations team is refining its enterprise assessment strategy for a network containing sensitive database servers and production workstations. The team wants to achieve accurate discovery of missing operating system patches and local software vulnerabilities while minimizing service disruption and network bandwidth strain. Which of the following scan configuration strategies should the team implement? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Execute credentialed network scans during scheduled maintenance windows to accurately identify missing host-level updates.; Deploy host-based vulnerability agents to perform local vulnerability checks without generating high volumes of network assessment traffic.

Cevap

The security team should execute credentialed scans during scheduled maintenance windows and deploy host-based vulnerability agents for continuous local monitoring.
Executing credentialed scans during maintenance windows provides deep visibility into local patch levels while avoiding disruption to active production services. Deploying host-based agents allows continuous assessment of endpoint vulnerabilities without generating massive network traffic from network-based probes.

Adım Adım Çözüm

1
Analyze requirement for accurate missing patch detection without service disruption.
Identified credentialed scanning during maintenance windows as a low-risk, high-accuracy approach.
Credentialed access allows the scanner to log into hosts directly and read exact system configurations without performing aggressive network probing.
2
Analyze requirement for minimal network bandwidth strain.
Identified host-based vulnerability agents as an effective solution.
Agents execute assessments locally using internal host resources and report results centrally, eliminating large network probes across subnets.

Anahtar Kavram

Vulnerability Scan Configurations and Agent Deployment
ÖncekiSayfa 103 / 112Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin