Examkin

Tüm alıştırma soruları

378 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 241Soru →

A security defense team is implementing active deception and disruption controls across an enterprise environment to improve threat detection and mitigation. Match each deception or disruption technology on the left with its corresponding operational security objective on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

DNS Sinkhole
Honeyfile
Honeytoken
Low-Interaction Honeypot

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

DNS Sinkhole matches with C2 domain lookup interception; Honeyfile matches with decoy file auditing; Honeytoken matches with fake credentials or API key detection; Low-Interaction Honeypot matches with simulated service basic protocol response.
Each technology is paired correctly based on its core implementation: DNS sinkholes redirect malicious DNS queries; honeyfiles act as audited decoy documents; honeytokens serve as fake digital credentials/keys; and low-interaction honeypots emulate basic network services to capture initial probes.

Adım Adım Çözüm

1
Analyze DNS disruption techniques.
Identify that DNS Sinkholing specifically targets outbound malicious DNS queries to isolate or monitor botnet/C2 communications.
DNS sinkholes alter resolution paths to prevent compromised hosts from reaching external threat infrastructure.
2
Differentiate between decoy files, tokens, and honeypot interaction levels.
Honeyfiles correspond to file objects, honeytokens correspond to specific data/credentials, and low-interaction honeypots correspond to emulated network daemons.
Each deception technology operates at a distinct layer (filesystem, credential/data level, or protocol service level).
3
Map each item to its operational mechanism.
Establish the 4 correct pairings.
Correct alignment demonstrates understanding of active defense components within CompTIA Security+ framework.

Anahtar Kavram

Deception and Disruption Technologies
Soru 242Soru →

A security analyst is reviewing modern cryptographic primitives and key management practices for an enterprise application architecture. Match each cryptographic technique on the left with its primary security objective or operational implementation on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Ephemeral Diffie-Hellman (ECDHE)
Key Stretching (PBKDF2)
Authenticated Encryption (AES-GCM)
Salted Hashing (SHA-256 with unique salt)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Ephemeral Diffie-Hellman matches with generating temporary session keys for perfect forward secrecy. Key Stretching matches with applying thousands of iterative hashing loops to slow down offline brute-force cracking. Authenticated Encryption matches with simultaneously providing confidentiality and integrity verification. Salted Hashing matches with neutralizing precomputed rainbow table lookup attacks.
Each cryptographic primitive directly fulfills its stated security goal: Ephemeral Diffie-Hellman provides forward secrecy through disposable session keys; Key Stretching delays offline password cracking via iteration counts; AES-GCM delivers both confidentiality and tamper detection; and Salting eliminates precomputed hash lookup tables.

Adım Adım Çözüm

1
Analyze key exchange mechanism requirements for session key protection.
Identify Ephemeral Diffie-Hellman (ECDHE) as the mechanism providing perfect forward secrecy through temporary key generation.
Ephemeral keys are discarded after session closure, preventing retrospective decryption.
2
Evaluate password resistance algorithms against offline dictionary attacks.
Map Key Stretching (PBKDF2) to iterative computational delay function.
Slowing down compute time per guess mitigates high-speed automated password cracking.
3
Examine symmetric cipher modes combining dual security functions.
Associate AES-GCM with Authenticated Encryption with Associated Data (AEAD).
AES-GCM encrypts data while generating an authentication tag to prevent tampering.
4
Identify anti-precomputation controls for stored password databases.
Match unique cryptographic salt added to hash inputs with rainbow table defense.
Salting forces attackers to recompute hashes individually for each targeted account.

Anahtar Kavram

Cryptographic Concepts and Algorithms
Soru 243Soru →

A security architect is mapping newly implemented security controls across an enterprise network against CompTIA Security+ control categories (Technical, Managerial, Operational, Physical) and functional control types (Preventive, Deterrent, Detective, Corrective, Compensating, Directive). Match each enterprise security measure on the left to its corresponding dual-axis classification on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

An automated Network Access Control (NAC) policy engine that evaluates device health and blocks non-compliant endpoints from associating with production subnets.
A corporate governance policy mandating that all employees complete anti-phishing training and sign an acceptable use agreement upon onboarding.
A dual-custody biometric mantrap vestibule that physically isolates individuals between two interlocking doors at a data center entrance.
An out-of-band Network Intrusion Detection System (NIDS) analyzing mirrored core switch traffic to generate security warnings upon identifying signature anomalies.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Automated NAC dynamic blocking corresponds to Technical / Preventive; Mandatory onboarding policies and agreements correspond to Managerial / Directive; Biometric mantrap vestibules correspond to Physical / Preventive; Out-of-band NIDS monitoring corresponds to Technical / Detective.
Each control measure accurately aligns across both axes: Automated NAC health checks use technological mechanisms to block non-compliant endpoints (Technical / Preventive). Corporate onboarding policies and acceptable use agreements set rules for human behavior through management governance (Managerial / Directive). Biometric mantrap vestibules physically stop unauthorized individuals from entering facility spaces (Physical / Preventive). Out-of-band NIDS sensors use monitoring software to inspect mirrored network traffic and alert on security anomalies without inline blocking (Technical / Detective).

Adım Adım Çözüm

1
Determine the primary category for each mechanism based on how it is implemented.
NAC health checking and out-of-band NIDS monitoring rely on hardware/software systems (Technical). Training mandates and acceptable use agreements stem from management oversight and policy frameworks (Managerial). Mantraps rely on physical structures and access barriers (Physical).
Control categories differentiate whether controls are implemented via technology, administrative management, operational procedures, or physical security boundaries.
2
Determine the functional type for each mechanism based on its operational objective during an event.
Blocking non-compliant endpoints and physically stopping tailgating/unauthorized access prevent security incidents before occurrence (Preventive). Mandating behavior directs human actions to comply with organizational expectations (Directive). Identifying anomalous traffic and triggering alerts discovers active or past events (Detective).
Functional types define the specific role a security control plays in the timeline of a threat or security event.
3
Synthesize category and functional type classifications into pair assignments.
Match NAC to Technical / Preventive, onboarding mandates to Managerial / Directive, mantrap to Physical / Preventive, and out-of-band NIDS to Technical / Detective.
Combining category and type provides a complete security control classification.

Anahtar Kavram

Dual-Axis Security Control Categorization (Category vs. Functional Type)
Soru 244Soru →

An enterprise security team is selecting appropriate vulnerability assessment methodologies for distinct operational requirements across the enterprise environment. Match each vulnerability assessment approach on the left with the operational use case on the right that best represents its application.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Credentialed Vulnerability Scanning
Non-Credentialed Vulnerability Scanning
Passive Vulnerability Monitoring
Agent-Based Vulnerability Assessment

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Credentialed Scanning matches authenticated administrative system inspection; Non-Credentialed Scanning matches unauthenticated network service discovery; Passive Monitoring matches non-intrusive SPAN port traffic analysis; Agent-Based Assessment matches continuous endpoint monitoring independent of network location.
Each vulnerability assessment method fulfills a specific operational requirement based on access privileges, network placement, and traffic tolerance. Credentialed scanning provides in-depth host visibility through authentication; non-credentialed scanning measures unauthenticated perimeter exposure; passive monitoring provides zero-impact traffic observation via SPAN/TAP; and agent-based scanning provides continuous host inspection for off-network endpoints.

Adım Adım Çözüm

1
Analyze the access perspective of Credentialed vs. Non-Credentialed scanning.
Credentialed scanning accesses internal OS parameters via login credentials to reduce false positives, matching right_1. Non-credentialed scanning examines exposed network ports without credentials, matching right_2.
Authenticating directly allows scanners to query internal package managers and registries directly, whereas unauthenticated scans only see externally exposed services.
2
Evaluate the traffic impact of Passive Vulnerability Monitoring.
Passive monitoring observes mirrored traffic (SPAN/TAP) without generating probe traffic, matching right_3.
Sensitive industrial control systems or operational technology environments require zero active probe traffic to prevent service disruption.
3
Examine the operational scope of Agent-Based Vulnerability Assessment.
Local agents collect local system data continuously and report back when connected, matching right_4.
Mobile or remote laptops frequently move off-premise, making active network scans ineffective compared to host-installed software agents.

Anahtar Kavram

Vulnerability Scanning Methodologies and Operational Scenarios
Soru 245Soru →

Match each security governance document type on the left with its corresponding operational characteristic on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Security Policy
Security Standard
Security Baseline
Security Guideline

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Security Policy matches with the high-level mandatory directive; Security Standard matches with the mandatory course of action defining technical specifications; Security Baseline matches with the minimum required security configuration state; Security Guideline matches with the discretionary recommendation.
In security governance frameworks, policies set high-level executive direction. Standards provide compulsory technical rules. Baselines define the minimum required operational configurations across hardware or software assets. Guidelines provide flexible, non-binding recommendations.

Adım Adım Çözüm

1
Identify top-level managerial intent documents
Map Security Policy to high-level mandatory executive management directives.
Policies represent high-level organizational intentions set by leadership.
2
Distinguish between mandatory technical requirements, configuration thresholds, and discretionary suggestions
Standards are mandatory technical rules; baselines establish minimum configuration states; guidelines are non-mandatory advice.
Governance documents strictly differentiate between required compliance rules (standards/baselines) and optional suggestions (guidelines).

Anahtar Kavram

Security Governance Document Hierarchy and Enforceability
Tahmini Süre:45s
Soru 246Soru →

An organization is updating its enterprise access management architecture to align with security frameworks. Match each operational capability on the left to the corresponding pillar or sub-component of the Authentication, Authorization, and Accounting (AAA) framework on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Validating user identity claims using a smart card PIN and biometric scanner upon initial workstation sign-in.
Evaluating security group memberships to grant read-only access to specific financial database tables.
Logging session timestamps, bandwidth usage, and administrative CLI command histories to a central SIEM server.
Requesting additional verification factors dynamically when a user attempts access from an unrecognized IP address.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Validating user identity via smart card PIN and biometrics maps to Primary Authentication; evaluating group permissions for database access maps to Authorization; logging timestamps, bandwidth, and command histories maps to Accounting; dynamically prompting for extra factors based on location risk maps to Adaptive (Risk-Based) Authentication.
Each item directly aligns with a specific component of the AAA framework. Validating identity via smart card and biometrics is Primary Authentication. Granting or restricting resource access according to permissions is Authorization. Recording session data and command history for forensic audit trail purposes is Accounting. Adjusting authentication steps based on contextual risk indicators (like unfamiliar IP addresses) is Adaptive Authentication.

Adım Adım Çözüm

1
Identify the primary function of each scenario item.
Categorize each operational capability according to whether it verifies identity (Authentication), determines privileges (Authorization), or records usage/activity (Accounting).
AAA establishes clear boundaries between verifying who a user is, controlling what they can do, and tracking what they did.
2
Differentiate baseline authentication from dynamic authentication.
Standard multi-factor verification at logon corresponds to Primary Authentication, while contextual step-up verification triggered by anomalous conditions corresponds to Adaptive Authentication.
Adaptive authentication alters identity verification requirements depending on risk signals like unknown network locations.
3
Confirm permission and logging assignments.
Database access rights align with Authorization, and SIEM command/session logs align with Accounting.
Access rights define permissions (authorization), and historical logs provide accountability and auditability (accounting).

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA) Framework
Soru 247Soru →

A security analyst must assign the appropriate scanning methodology to four distinct security assessment requirements within an enterprise organization. Match each security assessment requirement with the most appropriate vulnerability scanning methodology.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Evaluating external network perimeter exposure to internet-facing probes without utilizing system privileges.
Auditing local software inventory, patch levels, and internal registry configurations with minimal network bandwidth usage.
Testing network defensive security control responses by intentionally attempting known exploit payloads against dedicated sandbox targets.
Verifying operating system hardening configurations against established CIS benchmark standards using valid administrative domain accounts.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

External perimeter evaluation matches External non-credentialed network scan; Local inventory audit with low bandwidth matches Host-based agent assessment; Active payload testing matches Intrusive vulnerability scan; CIS benchmark hardening audit matches Credentialed compliance scan.
Each vulnerability scanning approach targets specific assessment goals: external unauthenticated scans measure public exposure, host agents gather local patch data with minimal network footprint, intrusive scans test active exploitability, and credentialed compliance scans verify configuration baselines against security standards.

Adım Adım Çözüm

1
Analyze the requirement for perimeter exposure without system privileges.
Identify that testing from outside without privileges requires an external non-credentialed network scan.
Non-credentialed external scans simulate an unauthenticated remote attacker evaluating the public attack surface.
2
Analyze the requirement for internal registry and patch auditing with minimal network bandwidth usage.
Identify that host-based agents collect configuration and patch data locally without sending network probes.
Agent-based scanning executes directly on the host operating system, reducing network traffic and capturing data on disconnected endpoints.
3
Analyze the requirement for testing defensive controls with exploit payloads.
Identify that active exploit attempts characterize intrusive vulnerability scanning.
Intrusive scans go beyond identification by attempting to verify exploitability, which can impact target stability.
4
Analyze the requirement for checking CIS hardening baselines using domain accounts.
Identify that credentialed compliance scans use elevated accounts to check security baseline settings.
Reading deep system configurations and registry settings requires administrative privileges.

Anahtar Kavram

Vulnerability Scanning Methodologies and Assessment Configurations
Soru 248Soru →

An enterprise security governance team is restructuring organizational documentation to ensure clear operational authority and compliance across all business units. Match each security governance document type on the left with its correct legal and operational description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Acceptable Use Policy (AUP)
Data Classification Standard
Server Security Baseline
Remote Work Security Guideline

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Acceptable Use Policy matches the high-level mandatory directive; Data Classification Standard matches the mandatory schema for categorizing assets; Server Security Baseline matches the mandatory minimum configuration threshold; Remote Work Security Guideline matches the discretionary best practices recommendations.
In security governance hierarchies, Policies (such as an Acceptable Use Policy) represent senior management's mandatory high-level directives. Standards (such as a Data Classification Standard) provide mandatory, specific rules and schemas supporting policy execution. Baselines (such as a Server Security Baseline) define the minimum required operational configurations needed to establish a consistent security floor. Guidelines (such as Remote Work Security Guidelines) offer discretionary, non-mandatory advice and best practices for operational flexibility.

Adım Adım Çözüm

1
Analyze document authority levels
Identify high-level mandatory directives vs specific mandatory technical specifications vs baseline thresholds vs discretionary advice.
Governance frameworks depend on distinguishing mandatory policy/standard/baseline elements from advisory guidance.
2
Map policies and standards to their definitions
Link the Acceptable Use Policy to overall behavioral directives and Data Classification Standard to compulsory labeling schemas.
Policies set top-level rules while standards define compulsory technical requirements.
3
Map baselines and guidelines to operational implementations
Link Server Security Baseline to minimum system configuration settings and Remote Work Security Guideline to discretionary advisory practices.
Baselines establish mandatory minimum security floors, whereas guidelines provide non-binding recommendations.

Anahtar Kavram

Information Security Policy and Governance Hierarchy Document Types
Soru 249Soru →

Match each social engineering attack vector on the left with its corresponding operational incident scenario description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Tailgating
Watering Hole Attack
Smishing
Shoulder Surfing

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Tailgating matches unbadged physical entry by following authorized personnel; Watering Hole Attack matches compromising a trusted, frequently visited website; Smishing matches deceptive SMS text messages containing malicious links; Shoulder Surfing matches direct visual observation of screens or keyboard inputs.
Each attack vector correctly maps to its distinct channel and method of execution: tailgating exploits physical access doors, watering hole attacks compromise frequented web destinations, smishing relies on mobile SMS delivery, and shoulder surfing uses line-of-sight observation.

Adım Adım Çözüm

1
Analyze the physical access vector
Identify that gaining entry behind an authorized person without badge authorization defines Tailgating.
Tailgating relies on physical proximity and courtesy or distraction at access control points.
2
Analyze the web-based targeted vector
Identify that infecting a specific third-party portal routinely visited by personnel defines a Watering Hole Attack.
Watering hole attacks leverage the implicit trust users place in industry-specific sites.
3
Analyze the mobile cellular and visual observation vectors
Identify cellular text message phishing as Smishing, and covert visual monitoring of user screens as Shoulder Surfing.
Smishing is specific to SMS communication protocols, while shoulder surfing leverages direct line of sight in physical spaces.

Anahtar Kavram

Social Engineering Attack Vectors and Methods
Soru 250Soru →

An enterprise security architect is reviewing access control operations across different corporate infrastructure components. Match each operational scenario on the left with its corresponding Authentication, Authorization, or Accounting (AAA) functional role on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A RADIUS server validates an employee's EAP-TLS digital certificate to verify identity before granting entry to the corporate network.
A firewall engine checks security group rules to grant or block an authenticated user's access to the production database subnet.
A TACACS+ server records the exact CLI commands executed by a network administrator during a switch maintenance window.
A gateway logging engine tracks session duration, bandwidth utilization, and IP addresses for remote access VPN connections.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

EAP-TLS certificate validation matches Authentication; checking firewall rules for subnet access matches Authorization; logging specific switch CLI commands matches Accounting (Action Auditing); tracking VPN bandwidth and session duration matches Accounting (Resource Tracking).
Authentication verifies identity through credentials such as digital certificates. Authorization enforces policies that determine what actions an authenticated entity can perform. Accounting logs both explicit administrative actions for auditability and general session metrics for resource tracking.

Adım Adım Çözüm

1
Identify scenarios that verify identity credentials.
Scenario 1 proves identity via certificate verification, which corresponds to Authentication.
Authentication is strictly concerned with establishing and verifying identity.
2
Identify scenarios that enforce access permissions or policies.
Scenario 2 checks rule sets to allow or deny network transport paths, which corresponds to Authorization.
Authorization evaluates permissions after identity has been established.
3
Differentiate between action auditing and resource tracking within Accounting scenarios.
Scenario 3 logs specific executed commands (Action Auditing), while Scenario 4 captures metrics like bandwidth and connection time (Resource Tracking).
Accounting encompasses both non-repudiable activity auditing and quantitative resource consumption logging.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA) functional pillars
Soru 251Soru →

A security manager is updating an enterprise third-party risk management framework to enhance vendor oversight and supply chain resilience. Match each third-party governance control or evaluation artifact to its primary operational purpose.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

SOC 2 Type II Report
Software Bill of Materials (SBOM)
Right-to-Audit Clause
Hardware Root of Trust Verification

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

SOC 2 Type II Report matches operational effectiveness evaluation over a period; Software Bill of Materials (SBOM) matches inventory visibility into code dependencies; Right-to-Audit Clause matches contractual authority to inspect vendor facilities and systems; Hardware Root of Trust Verification matches validating component integrity against supply chain tampering.
Each mechanism aligns directly with its primary role in vendor and supply chain risk oversight: SOC 2 Type II provides historical control effectiveness attestation; SBOM delivers code dependency transparency; Right-to-Audit provisions grant legal access for direct inspections; and Hardware Root of Trust verification mitigates physical supply chain tampering.

Adım Adım Çözüm

1
Analyze third-party audit reports
Identify SOC 2 Type II as an attestation report that assesses control effectiveness over time.
SOC 2 Type I evaluates design at a point in time, whereas Type II tests operational effectiveness over a specified testing window.
2
Evaluate software supply chain visibility tools
Identify SBOM as the machine-readable inventory of software components.
Managing software supply chain risk requires visibility into underlying software dependencies.
3
Examine legal contractual mechanisms
Associate the Right-to-Audit clause with formal permission to inspect third-party controls and facilities.
Without an explicit audit provision in the contract, vendors are not obligated to grant access for on-site or technical inspections.
4
Assess hardware supply chain integrity mechanisms
Link Hardware Root of Trust Verification with checking physical hardware integrity.
Cryptographic chips and root-of-trust measurements ensure devices have not suffered interdiction or unauthorized component swaps.

Anahtar Kavram

Third-Party Risk Management and Supply Chain Oversight
Soru 252Soru →

Match each cryptographic primitive or mechanism to its primary operational security function in an enterprise environment.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Ephemeral Diffie-Hellman (ECDHE)
Hash-based Message Authentication Code (HMAC)
Cryptographic Salt with PBKDF2
Cipher Block Chaining (CBC) Mode

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Ephemeral Diffie-Hellman matches providing perfect forward secrecy; HMAC matches message integrity and authenticating origin; Cryptographic Salt with PBKDF2 matches protecting password stores against rainbow tables; Cipher Block Chaining Mode matches block-level sequential data confidentiality.
Ephemeral Diffie-Hellman provides key exchange with forward secrecy; HMAC ensures keyed message integrity and authentication; Salting prevents precomputed hash lookup attacks on credentials; CBC mode encrypts data blocks in sequence using feedback from previous blocks.

Adım Adım Çözüm

1
Analyze Ephemeral Diffie-Hellman (ECDHE)
Identified requirement for session key isolation and forward secrecy.
Ephemeral key exchanges produce unique keys per session that do not depend on long-term private keys.
2
Analyze Hash-based Message Authentication Code (HMAC)
Identified requirement for message integrity combined with authentication using a shared secret.
Standard hashing only provides integrity; HMAC adds a secret key to provide origin verification.
3
Analyze Cryptographic Salt with PBKDF2
Identified requirement for password hashing defense against precomputed tables.
Salting adds random data per user password to defeat rainbow table lookups.
4
Analyze Cipher Block Chaining (CBC) Mode
Identified requirement for block cipher confidentiality via chaining.
CBC mode uses XOR operations with preceding blocks to randomize ciphertexts of repeating plaintext.

Anahtar Kavram

Cryptographic Primitives and Operational Security Functions
Soru 253Soru →

A Chief Information Security Officer (CISO) is restructuring the enterprise security documentation hierarchy to streamline compliance and operational governance across cloud and on-premises environments. Match each security governance document type to its corresponding operational characteristic.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Organizational Security Policy
Technical Security Standard
System Security Baseline
Security Guideline

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Organizational Security Policy matches high-level executive directives; Technical Security Standard matches mandatory technical rules; System Security Baseline matches minimum compulsory initial configurations; Security Guideline matches discretionary advice.
Security governance frameworks establish a clear hierarchy: policies reflect executive leadership directives and scope; standards define specific mandatory technologies and rules; baselines set the minimum compulsory security state for systems; guidelines offer discretionary best practice recommendations.

Adım Adım Çözüm

1
Analyze governance documentation hierarchy levels by enforceability and scope.
Identified policies and standards as mandatory high/medium level directives, baselines as minimum configuration requirements, and guidelines as non-mandatory advice.
Security governance relies on separating mandatory directives from discretionary guidance.
2
Map Organizational Security Policy to executive directives.
Policy aligns with high-level executive mandates that set organizational rules and security intent.
Policies are overarching governance frameworks set by leadership.
3
Differentiate between mandatory standards/baselines and non-mandatory guidelines.
Standards dictate mandatory technical specifications, baselines define minimum deployment configurations, and guidelines offer optional suggestions.
Standards and baselines are strictly compulsory, while guidelines provide operational flexibility.

Anahtar Kavram

Security Policy and Governance Documentation Hierarchy
Soru 254Soru →

An enterprise security engineer is auditing identity lifecycle management and access control workflows across the organization. Match each operational access activity on the left with its corresponding identity management or AAA (Authentication, Authorization, and Accounting) component on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A remote worker enters their user principal name (UPN) into a VPN client login window to claim an identity.
An Identity Provider verifies a user's identity by validating a FIDO2 hardware security key challenge-response.
A network access server checks an Active Directory group membership policy to assign dynamic VLAN permissions to a connected device.
A centralized SIEM ingests RADIUS session logs containing connection start times, total bytes transferred, and disconnect reasons.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Entering a UPN maps to Identification; validating FIDO2 credentials maps to Authentication; enforcing dynamic VLAN access rights maps to Authorization; and recording connection metrics and duration maps to Accounting.
Each operational scenario directly aligns with a specific phase in identity and access governance: entering a UPN claims an identity (Identification); verifying FIDO2 credentials proves the claim (Authentication); evaluating group policies to set network privileges grants access boundaries (Authorization); and recording session metrics to SIEM maintains an audit log (Accounting).

Adım Adım Çözüm

1
Analyze the first scenario (entering UPN).
Providing a username or UPN asserts a claim of identity without proof.
Identification is the process of presenting an identity claim to a system.
2
Analyze the second scenario (FIDO2 hardware key validation).
Cryptographically verifying the claim proves identity authentic state.
Authentication is the verification step that tests presented credentials.
3
Analyze the third scenario (group membership policy for dynamic VLAN assignment).
Determining privileges and applying access restrictions based on policy.
Authorization determines what rights, permissions, and resources an authenticated identity can access.
4
Analyze the fourth scenario (logging RADIUS connection start/end metrics).
Recording resource consumption and session duration for auditability.
Accounting monitors, tracks, and logs user activity and resource usage.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA) Framework and Identification
Soru 255Soru →

Match each security evaluation term on the left with its primary operational purpose or definition on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Internal Audit
External Audit
Attestation Engagement
Vulnerability Assessment

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Internal Audit matches with internal employee evaluations; External Audit matches with independent third-party evaluations; Attestation Engagement matches with formal independent practitioner opinions on assertions; Vulnerability Assessment matches with automated scanning for security weaknesses.
Each evaluation type directly matches its core operational purpose: Internal audits assess controls from within, external audits offer independent validation, attestations provide formal practitioner opinions on management assertions, and vulnerability assessments identify technical weaknesses through scanning.

Adım Adım Çözüm

1
Identify internal audit characteristics
Matched Internal Audit to evaluation performed by an organization's own employees.
Internal audits provide internal assurance for executive management.
2
Identify external audit characteristics
Matched External Audit to independent third-party evaluations.
Independence is required for third-party objective verification.
3
Identify attestation characteristics
Matched Attestation Engagement to independent practitioner issuing a written report on management assertions.
Attestations (like SOC reports) formally report on specific security claims.
4
Identify vulnerability assessment characteristics
Matched Vulnerability Assessment to automated scanning for known security weaknesses.
Vulnerability scans systematically detect flaws without exploiting them.

Anahtar Kavram

Security Audit and Assessment Types
Soru 256Soru →

Match each security audit, assessment, or attestation type on the left with its primary operational purpose or defining characteristic on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

SOC 1 Type II Report
SOC 2 Type I Report
SOC 3 Report
External Penetration Test Attestation

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

SOC 1 Type II Report pairs with evaluating ICFR controls over a specified period. SOC 2 Type I Report pairs with assessing control design against Trust Services Criteria at a specific point in time. SOC 3 Report pairs with providing a publicly distributable summary for general audiences. External Penetration Test Attestation pairs with delivering offensive technical validation through active vulnerability exploitation.
SOC 1 reports focus on financial reporting controls (ICFR), with Type II testing effectiveness over time. SOC 2 Type I focuses on security control design at a single point in time. SOC 3 reports are high-level, public summaries of SOC 2 criteria. External penetration test attestations represent hands-on, offensive security exercises that validate defensive controls against actual exploit attempts.

Adım Adım Çözüm

1
Differentiate financial audits (SOC 1) from security criteria audits (SOC 2 and SOC 3)
Identified that SOC 1 focuses specifically on controls impacting financial reporting, while SOC 2 and SOC 3 address Trust Services Criteria such as security and availability.
SOC 1 reports are mandated when a service organization's activities directly influence client financial statements.
2
Distinguish between Type I and Type II attestation scopes
Determined that Type I assesses control design at a specific point in time, whereas Type II tests control operating effectiveness over a defined duration.
Type I provides immediate snapshot baseline assurance, while Type II proves operational consistency over time.
3
Separate public reporting from technical assessment attestations
Matched SOC 3 to public executive summaries and Penetration Testing to active offensive security assessments.
SOC 3 enables broad marketing and customer confidence without exposing internal architecture, whereas penetration testing validates defensive control efficacy through simulated exploits.

Anahtar Kavram

Distinction between SOC report categories (SOC 1 vs SOC 2 vs SOC 3), report types (Type I vs Type II), and offensive security attestations.
Soru 257Soru →

Match each social engineering incident scenario on the left with the specific social engineering attack vector utilized on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

An attacker leaves malware-laden USB flash drives scattered around an enterprise facility parking lot, relying on curiosity to prompt employees to plug them into networked workstations.
An adversary compromises a legitimate third-party industry news portal frequently visited by an enterprise's defense research team to infect visiting users.
An attacker contacts a system administrator while pretending to be an external compliance auditor and invents an urgent regulatory story to request privileged user access logs.
An adversary intercepts a scheduled physical delivery of server hardware by convincing the logistics driver to deliver the shipment to a secondary unauthorized warehouse.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Baiting corresponds to leaving malware-laden drives in parking lots; Watering Hole Attack corresponds to compromising industry news sites visited by targets; Pretexting corresponds to inventing an auditor persona to obtain logs; Diversion Theft corresponds to re-routing physical shipments.
Each attack vector relies on distinct physical or psychological mechanisms: baiting uses physical curiosity lures; watering hole attacks exploit trust in common third-party websites; pretexting builds a false authoritative scenario to extract data; and diversion theft manipulates logistics to intercept physical equipment.

Adım Adım Çözüm

1
Analyze the first scenario involving physical media placed in parking lots to exploit victim curiosity.
Identify this as Baiting because it promises a lure (curiosity/free media) to deliver malicious payloads.
Baiting specifically leverages physical or digital enticement to convince victims to compromise security.
2
Analyze the second scenario involving a compromised third-party website regularly visited by target personnel.
Identify this as a Watering Hole Attack.
Watering hole attacks profile target web habits and infect a trusted watering hole site.
3
Analyze the third scenario where an attacker creates a false persona and fake urgency to extract information.
Identify this as Pretexting.
Pretexting requires constructing a believable role and scenario (the pretext) to trick a target into providing data or access.
4
Analyze the fourth scenario where physical shipments are rerouted during transit.
Identify this as Diversion Theft.
Diversion theft specifically targets transport, courier, or delivery supply chains to intercept physical assets.

Anahtar Kavram

Social Engineering Attack Vectors and Methods
Soru 258Soru →

Match each Business Impact Analysis (BIA) and business continuity metric on the left to its corresponding operational definition on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Recovery Time Objective (RTO)
Recovery Point Objective (RPO)
Mean Time Between Failures (MTBF)
Mean Time to Repair (MTTR)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Recovery Time Objective matches the targeted maximum duration of system downtime. Recovery Point Objective matches the maximum acceptable time period of data loss. Mean Time Between Failures matches the statistical average operational time before breaking down. Mean Time to Repair matches the average time required to diagnose, fix, and restore a component.
Each business continuity term is accurately paired with its primary metric definition: Recovery Time Objective defines maximum allowed service disruption time; Recovery Point Objective defines allowable data loss age; Mean Time Between Failures measures operational lifespan between breakdowns; and Mean Time to Repair measures mean resolution duration.

Adım Adım Çözüm

1
Differentiate downtime metrics from data loss metrics.
Recovery Time Objective (RTO) governs acceptable downtime duration, whereas Recovery Point Objective (RPO) governs tolerable data loss back-time.
RTO focuses on service restoration timing, while RPO determines necessary backup frequency to limit lost transactions.
2
Differentiate failure frequency metrics from service restoration metrics.
Mean Time Between Failures (MTBF) measures continuous uptime reliability, whereas Mean Time to Repair (MTTR) measures mean duration of maintenance.
MTBF quantifies how often failures occur over time, while MTTR quantifies how quickly repairs are completed.

Anahtar Kavram

Business Impact Analysis Operational Metrics (RTO, RPO, MTBF, MTTR)
Tahmini Süre:1m 0s
Soru 259Soru →

An organization is updating its third-party risk management policies and vendor contract templates. Match each agreement or documentation type to its primary purpose in vendor oversight.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Service Level Agreement (SLA)
Interconnection Security Agreement (ISA)
Non-Disclosure Agreement (NDA)
Memorandum of Understanding (MOU)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Service Level Agreement (SLA) matches with quantifiable performance targets and uptime guarantees; Interconnection Security Agreement (ISA) matches with technical and security requirements for connecting separate networks; Non-Disclosure Agreement (NDA) matches with legally binding protection of sensitive data and trade secrets; Memorandum of Understanding (MOU) matches with documenting mutual intent and shared responsibilities prior to formal contracting.
Each agreement serves a distinct governance function in third-party risk management: SLAs define measurable performance and uptime metrics; ISAs define technical controls for connecting networks; NDAs protect confidential information; and MOUs establish mutual goals and high-level intentions before formal technical or business contracting.

Adım Adım Çözüm

1
Identify operational performance and uptime metric requirements.
Map Service Level Agreement (SLA) to quantifiable performance targets and uptime guarantees.
SLAs focus primarily on operational metrics, availability guarantees, and penalties for non-performance.
2
Identify technical data transmission and network connection rules.
Map Interconnection Security Agreement (ISA) to technical security controls for linking separate networks.
ISAs govern the technical security posture, protocols, and interface controls required when two external networks interconnect.
3
Identify legal protections for proprietary and confidential information.
Map Non-Disclosure Agreement (NDA) to binding protections for sensitive business information and trade secrets.
NDAs restrict vendor disclosure of sensitive data shared during engagement.
4
Identify non-binding high-level partner framework documents.
Map Memorandum of Understanding (MOU) to mutual intent and shared responsibilities prior to formal contracting.
MOUs express general mutual alignment and understanding of roles before definitive contracts or technical connections are finalized.

Anahtar Kavram

Third-Party Agreement and Documentation Types in Risk Management
Soru 260Soru →

A security engineer is updating enterprise cryptographic standards across various operational systems. Match each cryptographic algorithm or mechanism on the left to its primary operational security capability on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Galois/Counter Mode (AES-GCM)
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)
Password-Based Key Derivation Function 2 (PBKDF2)
Hash-based Message Authentication Code (SHA-256 HMAC)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Galois/Counter Mode (AES-GCM) pairs with authenticated encryption for bulk data confidentiality and integrity; Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) pairs with temporary session key negotiation for perfect forward secrecy; Password-Based Key Derivation Function 2 (PBKDF2) pairs with salting and repeated iterations for password cracking mitigation; SHA-256 HMAC pairs with secret-key hashing for origin authentication and payload integrity.
Each cryptographic primitive aligns strictly with its defined operational role: AES-GCM performs authenticated bulk encryption, ECDHE manages ephemeral key exchange for perfect forward secrecy, PBKDF2 performs key stretching to secure stored passwords, and SHA-256 HMAC provides keyed integrity and origin verification.

Adım Adım Çözüm

1
Evaluate Galois/Counter Mode (AES-GCM)
Identified as an authenticated encryption cipher mode.
GCM mode pairs symmetric encryption with built-in authentication tag generation to achieve confidentiality and integrity simultaneously.
2
Evaluate Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)
Identified as an ephemeral key exchange protocol.
The ephemeral nature of ECDHE key generation ensures independent session keys, establishing perfect forward secrecy.
3
Evaluate Password-Based Key Derivation Function 2 (PBKDF2)
Identified as a password hashing and key stretching function.
PBKDF2 introduces salt and thousands of pseudorandom iterations to slow down dictionary and brute-force cracking attempts on stored credentials.
4
Evaluate SHA-256 HMAC
Identified as a keyed message authentication mechanism.
HMAC combines a shared secret key with the SHA-256 hash function to confirm message integrity and authenticate sender origin.

Anahtar Kavram

Cryptographic Primitives and Operational Capabilities
Tahmini Süre:1m 30s
ÖncekiSayfa 13 / 19Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin