Examkin

Tüm alıştırma soruları

2232 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 2061Soru →

A security analyst is selecting scanning techniques for various operational scenarios across an enterprise network. Match each vulnerability assessment technique to its corresponding characteristic or primary use case.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Credentialed Vulnerability Scan
Non-Credentialed Vulnerability Scan
Passive Vulnerability Assessment
Intrusive Vulnerability Scan

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Credentialed Vulnerability Scan matches with inspecting local OS patch levels and host configurations accurately with low false positives. Non-Credentialed Vulnerability Scan matches with identifying exposed services from an unauthenticated attacker's perspective. Passive Vulnerability Assessment matches with monitoring traffic via SPAN/mirror ports without sending probes. Intrusive Vulnerability Scan matches with simulating exploitation scripts with risk of system instability.
Each scanning technique is paired with its defining operational mechanism: credentialed scans use host logins to inspect software registries with high precision; non-credentialed scans simulate external network reconnaissance; passive scanning observes existing traffic via port mirrors; and intrusive scanning runs active verification checks that carry potential instability risks.

Adım Adım Çözüm

1
Analyze internal host configuration scanning needs
Identified Credentialed Vulnerability Scan as requiring local system access to inspect patch levels and registry entries directly.
Authenticating to target systems provides precise inventory and patch data with low false-positive rates.
2
Evaluate external threat posture assessment requirements
Identified Non-Credentialed Vulnerability Scan as probing network ports externally without authenticating.
Simulates an outside adversary analyzing public banner responses and exposed network listeners.
3
Examine operational constraints for sensitive or legacy infrastructure
Identified Passive Vulnerability Assessment as monitoring existing network traffic non-disruptively.
Listening to network traffic avoiding target interaction prevents service interruptions on sensitive systems.
4
Distinguish between vulnerability discovery and active verification risk
Identified Intrusive Vulnerability Scan as executing active checks that verify vulnerabilities by attempting benign exploitation.
Active verification confirms vulnerability impact but poses risk of service crashes.

Anahtar Kavram

Selecting appropriate vulnerability scanning methodologies based on authentication, network impact, and operational risk boundaries.
Soru 2062Soru →

A Security Operations Center (SOC) analyst detects an active exfiltration attempt where an unauthorized external IP address is utilizing a compromised cloud API key to download sensitive data. Place the following incident response playbook actions in the correct sequential order from FIRST to LAST.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: First, revoke the compromised API key and block the malicious external IP address (Containment). Second, perform a forensic analysis of cloud audit logs to identify accessed resources (Analysis). Third, eliminate residual attacker access mechanisms and restore secure configurations (Eradication & Recovery). Fourth, conduct a post-incident lessons learned session (Post-Incident Activity).
The correct order follows the standard incident response process: initial Containment (revoking keys/blocking IPs to stop active loss), followed by Analysis (scoping exfiltrated files and attack footprint), Eradication & Recovery (removing persistence mechanisms and restoring secure configurations), and concluding with Post-Incident Activity (lessons learned and playbook updates).

Adım Adım Çözüm

1
Implement Containment Controls
Ongoing data exfiltration is immediately halted, preventing additional loss.
Containment must occur first during an active exfiltration event to limit organizational damage.
2
Conduct Forensic Investigation and Analysis
The full scope of exfiltrated data and affected cloud infrastructure is identified.
Analyzing logs immediately post-containment ensures all compromised assets are accounted for.
3
Execute Eradication and System Recovery
Attacker persistence is removed and systems are safely restored to a baseline operational state.
Eradication removes root causes while recovery validates secure operational resumption.
4
Complete Post-Incident Review (Lessons Learned)
Documentation is finalized and IR playbooks/SOC detection logic are updated.
Lessons learned occur after operational restoration to ensure continuous security enhancement.

Anahtar Kavram

Incident Response Lifecycle Sequencing (NIST SP 800-61 / ISO 27035)
Tahmini Süre:1m 30s
Soru 2063Soru →

A network administrator is setting up a new secure web server and needs to obtain an X.509 digital certificate from an enterprise Certificate Authority (CA). Which of the following actions should the administrator perform first on the server?

Cevabı ve açıklamayı göster

Cevap: Generate a private key and create a Certificate Signing Request (CSR)

Cevap

The administrator must first generate a key pair and create a Certificate Signing Request (CSR) on the web server.
Generating a private key and creating a Certificate Signing Request (CSR) is the first standard step in obtaining an SSL/TLS certificate. The CSR contains the server's public key along with identifying information (such as domain name and organization) which is sent to the Certificate Authority for validation and signing.

Adım Adım Çözüm

1
Identify the initial phase of PKI certificate enrollment.
The server needs to generate an asymmetric key pair (public and private keys).
The private key stays securely on the server, while the public key must be packaged for the Certificate Authority.
2
Package the public key with identifying details.
A Certificate Signing Request (CSR) is generated.
The CSR includes identity information (such as Common Name/SAN) and the public key, which the CA signs to produce the digital certificate.

Anahtar Kavram

PKI Certificate Request Workflow
Soru 2064Soru →

A software development team is building an automated third-party API webhook receiver to process incoming transaction status updates. The security specification requires that the receiver must verify both the data integrity and origin authenticity of each incoming payload using a shared secret key, while avoiding the processing overhead associated with public key cryptography. Which cryptographic mechanism should the team implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Hash-based Message Authentication Code (HMAC)

Cevap

The team should implement Hash-based Message Authentication Code (HMAC) to fulfill the integrity and origin authenticity requirements using a shared secret key.
Hash-based Message Authentication Code (HMAC) combines a symmetric shared secret key with a cryptographic hash function (such as SHA-256) to ensure both message integrity and sender origin authenticity. Because HMAC relies on symmetric shared secrets rather than public key infrastructure, it provides fast processing speeds suitable for high-throughput API webhooks.

Adım Adım Çözüm

1
Analyze the operational requirements provided in the scenario.
Identified the need to verify data integrity and origin authenticity using a symmetric shared secret key without public key encryption overhead.
The system requires an efficient, low-overhead cryptographic method tailored for symmetric sender authentication.
2
Evaluate candidate cryptographic mechanisms against the identified constraints.
Hash-based Message Authentication Code (HMAC) uses a symmetric key combined with a hash function (e.g., SHA-256), satisfying both integrity and origin authenticity requirements at high speed.
Only a secret-keyed hash mechanism delivers symmetric origin verification and payload integrity without asymmetric computational costs.

Anahtar Kavram

Hash-based Message Authentication Code (HMAC)
Soru 2065Soru →

A Security Operations Center (SOC) analyst is investigating an alert and reviews the following web application access log entries ingested by the SIEM:

192.168.1.50 - - [27/Jul/2026:14:10:02 +0000] "GET /products.php?id=1 HTTP/1.1" 200 4520
192.168.1.50 - - [27/Jul/2026:14:10:15 +0000] "GET /products.php?id=1%27%20OR%20%271%27%3D%271 HTTP/1.1" 200 18450
192.168.1.50 - - [27/Jul/2026:14:10:22 +0000] "GET /products.php?id=1%20UNION%20SELECT%20username,password%20FROM%20users HTTP/1.1" 200 32100
192.168.1.50 - - [27/Jul/2026:14:11:05 +0000] "POST /admin/login.php HTTP/1.1" 302 412

Based on the log analysis, which of the following best identifies the type of attack occurring and the most effective preventive control?

Cevabı ve açıklamayı göster

Cevap: SQL injection attack attempting database schema extraction; mitigate by implementing parameterized queries and input sanitization.

Cevap

SQL injection attack attempting database schema extraction; mitigate by implementing parameterized queries and input sanitization.
The correct response accurately identifies SQL injection based on the presence of SQL syntax (`OR '1'='1'` and `UNION SELECT`) in the URL request parameters, and pairs it with prepared statements (parameterized queries), which are the standard primary defense against SQL injection.

Adım Adım Çözüm

1
Analyze URL parameter patterns in the web log entries
Identified URL-encoded SQL syntax elements: `%27%20OR%20%271%27%3D%271` translates to `' OR '1'='1`, and `%20UNION%20SELECT%20username,password%20FROM%20users` indicates database enumeration.
URL parameters containing database query commands are signature indicators of SQL injection (SQLi).
2
Evaluate server response codes and response sizes
HTTP 200 status codes with response sizes growing from 4,520 bytes to 32,100 bytes demonstrate successful execution and extraction of database content.
SIEM log analysis relies on combining request payloads with HTTP status codes and response length anomalies to confirm successful exploitation.
3
Select the appropriate primary security control
Parameterized queries (prepared statements) ensure that user input is treated strictly as parameter data rather than executable SQL code.
Prepared statements directly address the root vulnerability in application source code.

Anahtar Kavram

Web Server Log Analysis and SQL Injection Correlation
Soru 2066Soru →

A security analyst conducts a scheduled vulnerability assessment against an internal database cluster. The network scanner reports multiple critical operating system patch vulnerabilities on the target servers based on exposed service banners. Upon further inspection, the system administrator notes that the enterprise patch management policy uses Linux vendor backporting, which patches vulnerabilities without incrementing the reported software release version string. Which of the following scanning approaches should the analyst implement to obtain accurate patch compliance results and eliminate these false positives?

Cevabı ve açıklamayı göster

Cevap: Execute a credentialed scan using local administrative credentials or a host-based agent.

Cevap

Execute a credentialed scan using local administrative credentials or a host-based agent.
The correct answer advocates for executing a credentialed scan using local credentials or a host-based agent. Non-credentialed vulnerability scans inspect services remotely by banner grabbing, which reports generic version numbers. Linux enterprise vendors regularly backport security patches into existing version builds without incrementing the primary release version. Credentialed scans log into the target host to query local package manager databases and patch files directly, accurately verifying patch status and resolving banner-based false positives.

Adım Adım Çözüm

1
Analyze the cause of the false positive scanner report.
Uncredentialed network scans rely on banner grabbing (version strings exposed over ports), which fails to recognize backported patches that maintain original version strings.
Linux distribution vendors frequently backport security fixes into older package version strings to preserve application stability.
2
Evaluate scanning methodologies to access internal host patch inventories.
Credentialed scanning (or agent-based scanning) authenticates directly to the target system host.
Authenticating allows the scanner to query local package management databases (e.g., rpm or dpkg) and verify specific patch build numbers directly.
3
Select the optimal scanning approach to resolve banner-based false positives.
Credentialed host scanning provides precise visibility into internal system state and eliminates false positive patch alerts caused by vendor backporting.
This direct inspection ensures audit compliance while reducing unnecessary remediation overhead.

Anahtar Kavram

Credentialed vs. Uncredentialed Vulnerability Scanning and Banner Grabbing Limitation
Soru 2067Soru →

A senior security architect is updating an enterprise security standard to enforce modern cryptographic controls across cloud, archive, hardware, and transport systems. Match each operational cryptographic requirement on the left to the corresponding technical concept or mechanism on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Performing mathematical calculations directly on encrypted datasets hosted in a multi-tenant cloud analytics platform without decrypting the data
Protecting long-term sensitive archive data against harvest-now-decrypt-later eavesdropping intended for future decryption by quantum computers
Securely encapsulating symmetric Data Encryption Keys (DEKs) for safe export and inter-facility transfer using a hardware root of trust key
Concealing covert maintenance commands within the least significant bits of image files transmitted over unencrypted monitoring feeds

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Homomorphic encryption pairs with performing calculations on encrypted data; Post-quantum cryptography pairs with defending against future quantum decryption of archived data; HSM key wrapping pairs with encapsulating Data Encryption Keys for transfer using a hardware root of trust; Steganography pairs with concealing commands inside the least significant bits of image files.
Each requirement strictly maps to its specialized cryptographic control: Homomorphic encryption allows cloud compute on encrypted data without decryption; Post-quantum cryptography mitigates future quantum decryption risks against intercepted archives; HSM key wrapping protects keys in transit by encrypting DEKs with KEKs managed by hardware; Steganography hides payload content within image files.

Adım Adım Çözüm

1
Analyze the requirement for processing encrypted cloud data without decryption.
Identify that Homomorphic Encryption enables mathematical operations directly on ciphertext while preserving privacy from the host.
Traditional symmetric and asymmetric ciphers require plaintext exposure in memory to perform arithmetic operations.
2
Analyze the threat vector of adversaries capturing encrypted archives today to decrypt them when quantum computing matures.
Identify Post-quantum cryptography (quantum-resistant algorithms) as the control designed to withstand quantum cryptanalytic attacks like Shor's algorithm.
Standard RSA and ECC asymmetric algorithms are vulnerable to quantum factoring, requiring new mathematical primitives.
3
Examine the process of exporting symmetric encryption keys safely using dedicated crypto hardware.
Match HSM key wrapping as the practice of encrypting session keys or DEKs with a master Key Encryption Key residing within an HSM enclave.
Plaintext key transport exposes secrets in memory; key wrapping guarantees keys remain encrypted during transit across boundaries.
4
Evaluate the technique of hiding data inside image files using least significant bit alteration.
Match this obfuscation method to Steganography.
Steganography focuses on hiding the existence of a message rather than rendering message contents unreadable.

Anahtar Kavram

Cryptographic Primitives and Advanced Operational Controls
Soru 2068Soru →

During an enterprise infrastructure hardening project, a security architect is tasked with selecting controls that are classified as technical controls and function specifically in a preventive capacity. Which of the following security measures meet both of these criteria? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: An inline Intrusion Prevention System (IPS) configured to inspect network traffic and automatically drop packets matching malicious signatures; An automated host-based firewall rule that blocks incoming connections on unapproved network ports

Cevap

The controls that are both technical and preventive are the inline Intrusion Prevention System (IPS) configured to drop malicious packets and the automated host-based firewall rule blocking unapproved ports.
Both the inline Intrusion Prevention System (IPS) and the host-based firewall rule are technical controls because they are implemented directly in software/hardware systems. Furthermore, both act preventively by actively blocking or dropping unauthorized and malicious network traffic before access to target assets is achieved.

Adım Adım Çözüm

1
Identify the primary security control category requested
Technical controls rely on technology, hardware, or software mechanisms (e.g., firewalls, IPS, ACLs, encryption).
Categorization differentiates technological enforcement from administrative policies or physical barriers.
2
Identify the functional control type requested
Preventive controls proactively block or impede unwanted or malicious actions from occurring.
Functional classification evaluates the operational goal of the control during an attack lifecycle.
3
Evaluate each option against both criteria (Technical + Preventive)
The inline IPS drops malicious traffic automatically (Technical + Preventive). Host-based firewall rules block unapproved connections automatically (Technical + Preventive). The SIEM system logs and alerts (Technical + Detective). The written password policy sets administrative rules (Managerial/Directive + Preventive).
Dual-axis classification requires satisfying both the category (how it is implemented) and type (what operational function it performs).

Anahtar Kavram

Security Control Categories (Technical, Managerial, Operational, Physical) and Functional Types (Preventive, Detective, Corrective, Deterrent, Compensating, Directive)
Soru 2069Soru →

An enterprise cloud engineering team is migrating a legacy microservices architecture to align with NIST SP 800-207 Zero Trust Architecture (ZTA) principles. The modern architecture spans hybrid cloud environments and supports both remote and on-premise users. Which of the following technical design choices directly reflect core Zero Trust Architecture principles? (Select THREE)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Evaluating subject identity, device posture, and context dynamically to re-evaluate trust and access rights continuously throughout every session; Establishing microsegmentation boundaries around resources and enforcing mutual TLS (mTLS) for explicit cryptographic validation of all inter-service communications; Applying granular, least-privilege authorization policies tailored specifically to the individual request and target resource sensitivity

Cevap

The core Zero Trust principles are implemented by continuously re-evaluating trust throughout every active session, enforcing microsegmentation with explicit per-request cryptographic validation (such as mTLS), and applying strict least-privilege authorization policies per resource request.
Zero Trust Architecture operates on three key pillars: explicit validation, continuous verification, and least privilege access. Dynamically evaluating identity and context continuously across active sessions ensures posture changes revoke access immediately. Implementing microsegmentation and mTLS guarantees explicit cryptographic validation for every microservice request without relying on perimeter location. Applying granular least-privilege access ensures subjects only access the specific assets required for their authorized task.

Adım Adım Çözüm

1
Identify the foundational tenets of Zero Trust Architecture according to NIST SP 800-207
Zero Trust tenets specify that all communication is secured regardless of network location, access is granted per session with least privilege, and access is evaluated dynamically using continuous context.
ZTA removes implicit trust from internal networks and shifts security enforcement to granular policy evaluation.
2
Evaluate each offered technical design choice against ZTA tenets
Dynamic continuous evaluation, inter-service mTLS microsegmentation, and granular least-privilege access align directly with ZTA principles. Network perimeter trust and delegating resource authorization to perimeter firewalls violate ZTA.
Zero Trust requires explicit validation and continuous policy enforcement directly protecting each asset.

Anahtar Kavram

Zero Trust Architecture Core Tenets (NIST SP 800-207)
Soru 2070Soru →

A security analyst receives a high-priority alert from a perimeter Network Intrusion Detection System (NIDS) indicating anomalous, high-frequency outbound HTTPS connections from an internal host to an unrated external IP address. Place the operational monitoring and initial response steps in the correct chronological order from alert reception to formal escalation.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological order begins with validating raw network telemetry and packet captures to rule out false positives, followed by correlating network activity with host-level SIEM logs to verify compromise. Once verified, network isolation controls are applied to contain the threat, and finally, gathered IoCs are documented and escalated to the Incident Response team.
The triage workflow follows a logical progression: packet validation (confirming the network anomaly), host correlation (verifying execution and impact), endpoint containment (mitigating active threat risk), and incident escalation (handing over complete IoC artifacts).

Adım Adım Çözüm

1
Inspect packet captures and NIDS telemetry associated with the alert.
Alert authenticity is confirmed and false positive possibilities are eliminated.
Initial triage must always verify that an alert reflects genuine anomalous behavior before initiating invasive containment actions.
2
Correlate network alerts with host process logs and EDR events in the SIEM.
Scope of host execution and impact is determined.
Network monitoring alerts provide transport-layer visibility, but host correlation is required to assess whether malicious execution took place.
3
Initiate network containment by isolating the endpoint.
Active outbound C2 sessions and potential lateral movement vectors are severed.
Containment limits damage once threat activity or active compromise is verified.
4
Compile forensic findings and escalate the incident ticket.
Incident response personnel receive complete contextual data for remediation.
Escalation occurs after immediate containment and initial documentation are finalized.

Anahtar Kavram

Network Security Monitoring Triage and Incident Containment Lifecycle
Soru 2071Soru →

A security operations team wants to detect unauthorized lateral movement and Kerberoasting attacks within their Active Directory domain without modifying host configurations or deploying dedicated virtual servers. The team creates a fake domain account configured with a Service Principal Name (SPN) and monitors domain controller logs for any Ticket Granting Service (TGS) request targeting this account. Which of the following deception technologies has the team deployed?

Cevabı ve açıklamayı göster

Cevap: Honeytoken

Cevap

Honeytoken
The implementation of a fake Active Directory account with a Service Principal Name specifically designed to trigger alerts upon access represents a honeytoken. Honeytokens are decoy credentials, files, or database records placed within production environments to lure attackers and trigger high-confidence alerts when queried or compromised.

Adım Adım Çözüm

1
Analyze the scenario details and requirements.
The team injected a fake credential asset (a decoy SPN) into Active Directory to alert when queried by adversaries.
Identifying the type of decoy asset helps distinguish between host-level decoys and data-level decoys.
2
Evaluate the mechanism against deception technology classifications.
Decoy data items such as fake database records, fake credentials, or fake SPNs are classified as honeytokens.
Honeytokens monitor unauthorized access to non-production data assets placed directly within existing systems.
3
Differentiate from honeypots, sinkholes, and preventive security controls.
No virtual server or service emulation is deployed (ruling out honeypots), and no network traffic filtering occurs (ruling out sinkholes and firewalls).
Honeypots require dedicated host or service emulation, whereas honeytokens are lightweight data artifacts.

Anahtar Kavram

Deception Technologies - Honeytokens
Soru 2072Soru →

A security administrator is reviewing identity management definitions for new security operations team members. Match each access control phase of the AAA framework on the left with its corresponding operational security scenario on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Identification
Authentication
Authorization
Accounting

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Identification matches entering a unique username to claim identity; Authentication matches validating a password and TOTP code to prove identity; Authorization matches evaluating security policies to grant network subnet access; Accounting matches collecting log entries detailing session times and bandwidth usage.
Each phase of the access control model serves a distinct security role: Identification claims identity via an identifier (username); Authentication verifies that claim using credentials (password + TOTP); Authorization enforces access permissions (firewall rules); and Accounting logs resource usage and activity (SIEM/RADIUS session logs).

Adım Adım Çözüm

1
Distinguish between Identification and Authentication
Entering a username simply claims identity (Identification), while verifying credentials like passwords and TOTP codes proves that identity (Authentication).
Identification must precede authentication in the identity lifecycle.
2
Define Authorization controls
Evaluating firewall security policies to permit or restrict access to specific network resources aligns directly with enforcing access permissions (Authorization).
Authorization dictates what an authenticated entity is permitted to do.
3
Identify Accounting functions
Collecting session start/stop times, command histories, and bandwidth logs on a SIEM or RADIUS server fulfills auditing and tracking requirements (Accounting).
Accounting creates non-repudiable audit logs of user activity.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA) Framework
Soru 2073Soru →

Following a compliance audit, an enterprise security team identifies that a legacy industrial control server hosting critical operational technology cannot support endpoint detection and response (EDR) agents or full-disk encryption due to system resource constraints. To satisfy the security standard without taking the legacy system offline, the team installs a dedicated inline micro-segmentation appliance with access control lists restricted strictly to authorized jump boxes. Which of the following best classifies the security control category and functional type of this newly deployed appliance?

Cevabı ve açıklamayı göster

Cevap: Technical category and compensating control type

Cevap

Technical category and compensating control type
The correct response identifies the appliance as a technical control because it relies on network hardware and automated rule logic, and as a compensating control because it provides alternative protection when the primary required security controls (EDR and encryption) cannot be implemented.

Adım Adım Çözüm

1
Determine the security control category based on execution mechanism.
Because an inline micro-segmentation hardware appliance enforcement tool is system-implemented technology, it falls under the Technical control category.
Technical controls (also known as logical controls) use hardware, software, or firmware mechanisms.
2
Determine the functional type based on the strategic objective in the scenario.
The control was implemented to satisfy a security mandatory standard (EDR/encryption) when the primary solution could not be supported by legacy hardware, making it a Compensating control type.
Compensating controls provide an alternative measure that achieves equivalent security protection when primary security controls are unfeasible.

Anahtar Kavram

Dual-axis classification of security control categories and functional types
Soru 2074Soru →

An enterprise security team plans to modify central authentication controls to enforce hardware-based multi-factor authentication across production subnets. To ensure operational continuity and minimize security risks, the team must follow the organization's formal change management process. Place the following change management steps in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with submitting a formal change request and security impact assessment, obtaining Change Advisory Board approval, conducting staging tests and rollback verification, executing the change during an authorized maintenance window, and concluding with post-implementation verification and CMDB updating.
Standard change management follows a structured lifecycle to control risk: documentation and impact assessment, formal approval by the Change Advisory Board, non-production staging and backout plan testing, scheduled production execution, and post-implementation auditing with baseline configuration updates.

Adım Adım Çözüm

1
Identify the initial phase of formal change governance.
The change request and security impact assessment are drafted and submitted first.
A formal proposal detailing the scope, potential security vulnerabilities, and affected systems is mandatory before governance bodies can evaluate the risk.
2
Determine the required governance review and approval stage.
The change request is submitted to the Change Advisory Board (CAB) for approval.
The CAB must evaluate organizational impact, resource availability, and scheduling conflicts prior to technical execution.
3
Determine the pre-implementation risk mitigation stage.
The policy change is validated in a staging environment and the rollback procedure is tested.
Testing in non-production validates functionality and ensures a safe fallback mechanism exists before modifying production systems.
4
Identify the production implementation step.
The deployment is executed during the scheduled maintenance window.
Implementing changes during designated low-impact windows minimizes disruption to live operational business services.
5
Identify the final closure and baseline updating phase.
Post-implementation security testing is conducted and the CMDB baseline is updated.
Verifying production stability ensures security requirements are met, while updating the CMDB records the new operational baseline for compliance and auditing.

Anahtar Kavram

Change Management Lifecycle and Security Control Implementation
Soru 2075Soru →

A system administrator is preparing to obtain a new TLS certificate for an internal server from the enterprise Certificate Authority (CA). Which of the following tasks must be completed on the server during the initial certificate request workflow? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Generate a asymmetric key pair consisting of a private key and a public key; Create a Certificate Signing Request (CSR) containing the server's public key and identity details

Cevap

The server administrator must generate an asymmetric key pair on the server and create a Certificate Signing Request (CSR) containing the public key to send to the CA.
To obtain a signed digital certificate from a CA, the requesting server must first generate its own asymmetric key pair (private and public key) and then bundle the public key along with server identity attributes into a Certificate Signing Request (CSR) submitted to the CA.

Adım Adım Çözüm

1
Generate Key Pair
Creation of the server's private key and matching public key.
The server needs a private key for decryption/signing and a public key to distribute via the signed certificate.
2
Create Certificate Signing Request (CSR)
A formatted request file containing the public key and server identity attributes.
The CA requires the CSR to verify requested identity attributes and sign the public key to issue an X.509 certificate.

Anahtar Kavram

PKI Certificate Enrollment and CSR Generation Workflow
Soru 2076Soru →

A security analyst is hardening an internal web application's authentication module. An audit reveals two major vulnerabilities: session identifiers are predictable due to weak random seed generation, and user passwords stored in the database are susceptible to rapid offline dictionary and GPU-accelerated rainbow table attacks. Which of the following cryptographic techniques should the security analyst implement to mitigate both vulnerabilities? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Utilize key stretching algorithms such as Argon2 or PBKDF2 combined with unique per-user salts for credential storage.; Generate session identifiers using a Cryptographically Secure Pseudorandom Number Generator (CSPRNG).

Cevap

The analyst should implement key stretching algorithms (such as Argon2 or PBKDF2) with unique per-user salts for credential storage, and use a Cryptographically Secure Pseudorandom Number Generator (CSPRNG) for session token generation.
To secure session tokens against prediction, a Cryptographically Secure Pseudorandom Number Generator (CSPRNG) must be used to ensure high entropy. To protect stored credentials against offline GPU cracking and rainbow tables, key stretching algorithms like Argon2 or PBKDF2 are required because they introduce artificial computational delay and memory requirements while incorporating unique salts per user.

Adım Adım Çözüm

1
Analyze the session token predictability vulnerability.
Identify that session tokens require high entropy and cryptographic unpredictability.
Standard pseudo-random number generators use deterministic algorithms that allow attackers to guess session keys if the seed is discovered.
2
Select the appropriate mechanism for session token generation.
Implement a Cryptographically Secure Pseudorandom Number Generator (CSPRNG).
CSPRNGs are specifically designed to produce output that is statistically indistinguishable from true random numbers.
3
Analyze the password storage cracking vulnerability.
Identify that plain hashing is vulnerable to fast GPU cracking and precomputed rainbow tables.
High-throughput hash functions like standard SHA-256 can be computed billions of times per second on GPU arrays.
4
Select the appropriate mechanism for secure password storage.
Enforce key stretching (Argon2 or PBKDF2) along with salting.
Salting neutralizes rainbow tables by making every hash unique, while key stretching intentionally slows down computation to thwart brute-force cracking.

Anahtar Kavram

Cryptographic Key Stretching, Salting, and CSPRNG Randomness
Soru 2077Soru →

An organization's infrastructure team plans to enable HTTP/3 (QUIC) across all enterprise edge load balancers to reduce web application latency. Because HTTP/3 utilizes UDP port 443 instead of traditional TCP port 443, the team must perform a security impact analysis before presenting the proposal to the Change Advisory Board (CAB). Which of the following represents the primary security impact that must be evaluated during this change management step?

Cevabı ve açıklamayı göster

Cevap: Existing deep packet inspection and network intrusion prevention rules tuned for TCP port 443 traffic may fail to inspect application-layer payloads.

Cevap

Existing deep packet inspection and network intrusion prevention rules tuned for TCP port 443 traffic may fail to inspect application-layer payloads.
Conducting a security impact analysis prior to change implementation requires assessing how infrastructure changes affect existing security controls. HTTP/3 (QUIC) uses UDP port 443 rather than TCP port 443. If network firewalls, web application firewalls, or intrusion prevention systems (IPS) are configured only to inspect TCP traffic on port 443, switching transport to UDP will result in uninspected traffic and a loss of security visibility.

Adım Adım Çözüm

1
Identify the technical change proposed in the scenario
Transitioning web application traffic transport from TCP port 443 (HTTP/1.1 and HTTP/2) to UDP port 443 (HTTP/3 via QUIC).
Security impact assessments require analyzing how changes alter technical data paths and network behaviors.
2
Analyze how existing security controls interact with the new protocol
Existing perimeter firewalls, IPS devices, and network monitoring tools configured specifically for TCP streams will not automatically inspect UDP streams on port 443.
Security visibility can be severely compromised if network monitoring tools are not reconfigured or updated to support QUIC inspection.
3
Select the choice that correctly identifies this security vulnerability impact
The option highlighting potential inspection failures for network security devices tuned only for TCP port 443.
Proper change control requires uncovering unexpected security blind spots before deployment.

Anahtar Kavram

Security Impact Analysis in Change Management
Tahmini Süre:1m 30s
Soru 2078Soru →

An enterprise network administrator is configuring centralized access management for core network hardware using a TACACS+ server. To align with the Authentication, Authorization, and Accounting (AAA) framework, which of the following configurations specifically satisfy the Authorization and Accounting pillars? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Restricting specific CLI commands an authenticated administrator can execute based on their assigned role; Recording timestamped entries of executed administrative commands to a centralized audit server

Cevap

The correct configurations are restricting specific CLI commands an authenticated administrator can execute based on their assigned role, and recording timestamped entries of executed administrative commands to a centralized audit server.
Authorization defines the specific permissions and executable commands allowed for an authenticated role. Accounting captures timestamped records of user activity to maintain an accurate audit log.

Adım Adım Çözüm

1
Identify the core requirements of Authorization and Accounting within AAA.
Authorization specifies permitted privileges and actions, while Accounting records and audits user actions during a session.
Distinguishing between identity verification, permission granting, and logging is essential for accurate classification.
2
Evaluate command restriction controls.
Restricting executable CLI commands by role explicitly determines allowed actions, directly fulfilling Authorization.
Authorization answers what actions an authenticated user is allowed to perform.
3
Evaluate logging controls.
Logging timestamped command executions creates an audit trail of user activity, directly fulfilling Accounting.
Accounting tracks user actions for accountability and auditing purposes.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA)
Soru 2079Soru →

A security administrator is tasked with updating the data protection mechanism for a customer relationship management (CRM) database storing high-volume customer records at rest. The enterprise security policy requires that all stored data be encrypted using a high-speed algorithm that provides confidentiality with low computational overhead. Which of the following cryptographic algorithms should the administrator implement to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: Advanced Encryption Standard (AES)

Cevap

Advanced Encryption Standard (AES)
The Advanced Encryption Standard (AES) is a symmetric block cipher that provides strong data confidentiality with high throughput and low computational cost, making it the ideal choice for bulk database encryption at rest.

Adım Adım Çözüm

1
Analyze the operational requirement
Identified the requirement for bulk data-at-rest encryption offering high performance and minimal CPU overhead.
Databases containing millions of records require symmetric ciphers due to their processing efficiency.
2
Evaluate cryptographic algorithm categories
Selected symmetric key cryptography over asymmetric cryptography and key exchange protocols.
Symmetric encryption uses a single shared secret key, operating significantly faster than asymmetric key math.
3
Select the specific compliant algorithm
Advanced Encryption Standard (AES) fulfills all requirements.
AES is the standard symmetric block cipher for high-speed, robust data-at-rest confidentiality.

Anahtar Kavram

Symmetric vs. Asymmetric Cryptography for Bulk Data Encryption
Soru 2080Soru →

During an incident response post-mortem, security analysts observed that an automated containment workflow inadvertently isolated a core database server following a low-fidelity intrusion alert. To maintain rapid automated response capabilities for routine systems while protecting vital infrastructure from self-inflicted service disruptions, which implementation modification should be applied to the playbook design?

Cevabı ve açıklamayı göster

Cevap: Add conditional logic to evaluate host criticality tags and divert high-impact system containment actions to a human-in-the-loop approval step.

Cevap

Add conditional logic to evaluate host criticality tags and divert high-impact system containment actions to a human-in-the-loop approval step.
Adding conditional evaluation of asset criticality tags allows SOAR playbooks to handle routine, low-risk systems fully automatically while routing high-value target alerts through a human-in-the-loop approval step. This prevents automated security tools from unintentionally disrupting critical services during false-positive alerts.

Adım Adım Çözüm

1
Identify the operational risk in the current automation workflow.
Unconditioned automated isolation playbooks can trigger false positives on critical assets, causing unintended business disruption.
Automated actions executed without contextual metadata lack awareness of host business impact.
2
Determine appropriate workflow guardrails for security orchestration.
Incorporate conditional branching based on asset tags, requiring Human-in-the-Loop (HITL) approval for critical assets while allowing fully automated isolation for non-critical endpoints.
This balances rapid automated response for standard endpoints with operational risk mitigation for key infrastructure.

Anahtar Kavram

SOAR Playbook Conditional Logic and Human-in-the-Loop (HITL) Integration
ÖncekiSayfa 104 / 112Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin