Tüm alıştırma soruları

378 soru

Soru 281Soru

A security engineer is updating the organization's cryptographic policy to cover emerging operational scenarios including IoT deployments, cloud analytics, secure password storage, and covert communication detection. Match each cryptographic concept on the left with its primary operational characteristic or security use case on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Key Stretching
Homomorphic Encryption
Lightweight Cryptography
Steganography

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Key Stretching matches with intentionally increasing CPU/memory costs to slow down brute-force attacks; Homomorphic Encryption matches with executing computations directly on ciphertext without decryption; Lightweight Cryptography matches with optimizing ciphers for resource-constrained IoT devices; Steganography matches with concealing secret data within innocuous carrier files.
Key Stretching intentionally adds computational cost to mitigate password cracking; Homomorphic Encryption enables computations on ciphertext without prior decryption; Lightweight Cryptography reduces hardware and power requirements for IoT devices; Steganography hides payloads inside innocent carrier files.

Adım Adım Çözüm

1
Analyze the operational objective of Key Stretching.
Identify that functions like PBKDF2 or bcrypt introduce computational delay (work factor) during key generation or hashing to thwart offline dictionary attacks.
Slowing down hash calculations directly mitigates rapid brute-forcing.
2
Analyze Homomorphic Encryption capabilities.
Recognize that it preserves confidentiality during data processing by enabling mathematical operations directly on encrypted values.
This secures data-in-use during cloud analytics.
3
Analyze Lightweight Cryptography constraints.
Identify that algorithms such as ASCON or PRESENT are tailored specifically for small silicon footprints and microcontrollers with low memory and power availability.
Standard ciphers like AES-256 can be too resource-intensive for small embedded hardware.
4
Analyze Steganography features.
Determine that steganography hides data within cover media (e.g., LSB insertion in images) to prevent observation of the transmission.
Unlike standard encryption which makes data unreadable, steganography hides the presence of the data altogether.

Anahtar Kavram

Cryptographic Concepts and Specialized Implementation Paradigms
Tahmini Süre:1m 30s
Soru 282Soru

An enterprise security team is auditing organizational controls against the CompTIA Security+ framework. Match each implemented security control on the left to its corresponding dual-axis classification (Control Category / Functional Type) on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Deploying an inline Web Application Firewall (WAF) to drop malicious HTTP payloads
Conducting enterprise risk assessments and updating corporate information security policies
Executing automated script tasks to re-image compromised endpoints and restore configurations from known good baselines
Installing biometric retina scanners on access doors leading into data center facilities

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The controls are correctly matched as follows: Inline Web Application Firewall matches Technical / Preventive; Enterprise risk assessments and security policy updates match Managerial / Directive; Automated endpoint re-imaging scripts match Technical / Corrective; Biometric retina scanners on facility doors match Physical / Preventive.
Each security mechanism aligns with its specific framework classification: Technical controls utilize hardware/software technologies, Managerial controls establish administrative policies and risk frameworks, and Physical controls protect facilities and tangible assets. Functionally, Preventive controls impede security events, Directive controls specify mandatory actions, and Corrective controls repair damage or restore functionality.

Adım Adım Çözüm

1
Determine the primary control category (Technical, Managerial, Operational, Physical) for each item.
Inline WAF and endpoint restoration scripts use technology (Technical); policies and risk assessments use administration/governance (Managerial); retina scanners on physical doors protect tangible property (Physical).
Control categories reflect how a control is implemented within an environment.
2
Determine the functional control type (Preventive, Deterrent, Detective, Corrective, Compensating, Directive) for each item based on its operational purpose.
Inline WAF blocks traffic before entry (Preventive); policies establish required behaviors (Directive); re-imaging scripts repair compromised systems (Corrective); retina scanners stop physical entry (Preventive).
Functional types describe what goal the control accomplishes in response to security risk.
3
Combine category and functional type to form dual-axis pairs and match to right-hand items.
All left items map uniquely to their corresponding dual-axis right-side designations.
Proper classification requires accurate pairing of implementation axis and functional goal.

Anahtar Kavram

Security Control Categories and Types
Soru 283Soru

An enterprise chief information security officer (CISO) is aligning the organization's global compliance baseline against sector-specific legal mandates and privacy extension standards. Match each compliance framework or regulation to its primary operational mandate.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

FISMA (Federal Information Security Modernization Act)
DORA (Digital Operational Resilience Act)
ISO/IEC 27701
NYDFS Cybersecurity Regulation (23 NYCRR 500)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

FISMA pairs with federal agency/contractor FIPS 199 categorization and continuous monitoring; DORA pairs with EU financial entity ICT risk management and operational resilience testing; ISO/IEC 27701 pairs with the PIMS extension to ISO/IEC 27001; NYDFS 23 NYCRR 500 pairs with state financial institution CISO designation and 72-hour incident notification mandates.
Each regulatory framework is correctly paired to its governing scope: FISMA regulates federal agencies and contractor system authorizations using FIPS/NIST standards; DORA enforces operational resilience across EU financial entities; ISO/IEC 27701 provides PIMS privacy governance as an extension to ISO/IEC 27001; and NYDFS 23 NYCRR 500 mandates designated security leadership and mandatory 72-hour event reporting for New York financial services.

Adım Adım Çözüm

1
Analyze federal versus international and state regulatory jurisdictions
FISMA applies specifically to U.S. federal government information systems and contractors, requiring NIST and FIPS compliance.
Regulatory applicability is defined by entity type and geographic jurisdiction.
2
Identify operational resilience standards within financial sectors
DORA enforces digital operational resilience across EU financial institutions, whereas NYDFS 23 NYCRR 500 mandates specific administrative controls (such as a designated CISO and 72-hour reporting) for New York financial entities.
Sector-specific financial regulations introduce targeted requirements beyond broad privacy laws.
3
Differentiate privacy certification standards from security baseline standards
ISO/IEC 27701 specifies the requirements for a Privacy Information Management System (PIMS) as an explicit extension to ISO/IEC 27001.
ISO standards use add-on modules to extend security control frameworks into privacy governance.

Anahtar Kavram

Regulatory Framework Mapping and Compliance Mandates
Soru 284Soru

Match each vulnerability scanning methodology with its corresponding operational description and primary enterprise use case.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Credentialed Network Scan
Non-Credentialed Network Scan
Passive Network Assessment
Agent-Based Vulnerability Scan

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Credentialed Network Scan pairs with host authentication and administrative auditing; Non-Credentialed Network Scan pairs with unauthenticated port/banner probing; Passive Network Assessment pairs with traffic mirror/TAP monitoring; Agent-Based Vulnerability Scan pairs with persistent local service execution for off-network endpoints.
The pairings correctly match each scanning approach with its distinct operation: Credentialed scans require host logins to audit internal configurations; Non-Credentialed scans assess external visibility without credentials; Passive assessments mirror traffic without sending packets; and Agent-based scans use local host software for continuous oversight of mobile assets.

Adım Adım Çözüm

1
Identify authentication requirement levels for network-based scans.
Match credentialed scanning to administrative login probing and non-credentialed scanning to unauthenticated perimeter surface probing.
Authentication determines whether the scanner can inspect internal host state or only externally visible network behavior.
2
Evaluate traffic generation impact (active active vs passive listening).
Match passive network assessment to non-intrusive traffic monitoring via SPAN or TAP ports.
Passive monitoring observes existing packet flows without sending probes into the network.
3
Differentiate network-centric assessment from host-resident telemetry collection.
Match agent-based scanning to local persistent software services capable of auditing disconnected or roaming hosts.
Agents execute locally on the target operating system, removing reliance on active network scanning connections.

Anahtar Kavram

Vulnerability Assessment Methodologies and Scan Configuration Types
Soru 285Soru

A security administrator is updating the enterprise baseline controls for data protection across various infrastructure layers. Match each cryptographic mechanism on the left with its primary operational security function on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)
Hash-based Message Authentication Code (HMAC)
Password-Based Key Derivation Function 2 (PBKDF2)
ChaCha20-Poly1305

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

ECDHE pairs with establishing ephemeral keys for perfect forward secrecy; HMAC pairs with combining a secret key and hash for message authentication and integrity; PBKDF2 pairs with key stretching user passwords to resist offline brute-force attacks; ChaCha20-Poly1305 pairs with low-overhead authenticated bulk encryption for constrained hardware.
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) provides perfect forward secrecy by generating temporary session keys. Hash-based Message Authentication Code (HMAC) verifies message integrity and source authenticity by combining a secret key with a hash function. Password-Based Key Derivation Function 2 (PBKDF2) performs key stretching by hashing passwords over thousands of iterations to slow offline cracking. ChaCha20-Poly1305 is a high-speed AEAD stream cipher optimized for mobile and embedded devices.

Adım Adım Çözüm

1
Analyze ECDHE capabilities
Identify that ephemeral key exchange mechanisms guarantee perfect forward secrecy during transport layer negotiations.
Temporary keys ensure compromise of long-term keys does not decrypt past sessions.
2
Analyze HMAC capabilities
Identify that combining secret key material with hashing yields authentication and integrity verification.
Standard cryptographic hashes provide integrity, but adding a secret key (HMAC) adds sender authenticity.
3
Analyze PBKDF2 capabilities
Identify that password-based key derivation functions implement key stretching.
Repeated iteration adds artificial computation time, making brute-force cracking prohibitively slow.
4
Analyze ChaCha20-Poly1305 capabilities
Identify stream cipher AEAD suitable for resource-constrained platforms.
ChaCha20 is designed to run efficiently in software on systems lacking hardware AES acceleration.

Anahtar Kavram

Cryptographic Primitives and Functional Applications
Soru 286Soru

An enterprise risk manager is conducting a gap analysis across global business units to establish baseline legal and contractual compliance controls. Match each regulatory or industry framework to its primary operational scope and data protection mandate.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

General Data Protection Regulation (GDPR)
Health Insurance Portability and Accountability Act (HIPAA)
Payment Card Industry Data Security Standard (PCI-DSS)
Sarbanes-Oxley Act (SOX)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

General Data Protection Regulation (GDPR) matches the extraterritorial law governing personal data for EU residents; Health Insurance Portability and Accountability Act (HIPAA) matches the protection of Protected Health Information (PHI) for covered entities; Payment Card Industry Data Security Standard (PCI-DSS) matches the contractual baseline for processing Primary Account Numbers (PAN); Sarbanes-Oxley Act (SOX) matches internal financial reporting and auditing controls for US public companies.
Each framework targets a distinct compliance domain: GDPR covers EU personal data privacy regardless of processor location; HIPAA mandates PHI protection for healthcare entities; PCI-DSS sets contractual requirements for credit card data (PAN); and SOX governs corporate financial record integrity and reporting.

Adım Adım Çözüm

1
Analyze data classifications and jurisdictional boundaries for each framework.
Identified PHI, PAN/CHD, corporate financial telemetry, and EU resident personal data.
Regulatory compliance requirements are categorized primarily by data type and legal jurisdiction.
2
Map legal mandates versus industry contractual standards.
PCI-DSS is identified as an industry contractual baseline, while GDPR, HIPAA, and SOX are statutory legislative mandates.
Differentiating statutory requirements from contractual obligations prevents misapplication of penalty frameworks during audit assessments.
3
Align each mandate with its exact functional definition.
GDPR correlates to EU personal data, HIPAA to PHI, PCI-DSS to cardholder data, and SOX to internal financial controls.
Demonstrates comprehensive knowledge of regulatory scope and compliance governance.

Anahtar Kavram

Regulatory Scope and Legal Data Classifications
Soru 287Soru

Match each enterprise data governance role on the left with its primary responsibility on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Data Owner
Data Custodian
Data Protection Officer (DPO)
Data Processor

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Data Owner pairs with defining classification and access policies; Data Custodian pairs with implementing technical safeguards and backups; Data Protection Officer (DPO) pairs with overseeing privacy compliance and regulatory liaison; Data Processor pairs with processing data on behalf of a controller.
Each role corresponds strictly to CompTIA Security+ data governance principles: Data Owners govern classification and usage rules; Data Custodians manage practical technical controls and infrastructure; Data Protection Officers ensure legal compliance and regulatory reporting; and Data Processors handle data on behalf of controllers.

Adım Adım Çözüm

1
Identify the role holding strategic business accountability for data governance.
Connect Data Owner to defining data classification, access rights, and retention rules.
The data owner has legal and organizational authority over how data assets are categorized and retained.
2
Identify the operational role responsible for technical implementation.
Connect Data Custodian to managing technical safeguards, system administration, and data backups.
Custodians execute technical controls in support of the policies established by data owners.
3
Distinguish independent regulatory oversight from delegated data processing operations.
Connect DPO to privacy compliance oversight and Data Processor to processing data strictly under controller instructions.
Data protection frameworks explicitly separate regulatory compliance oversight (DPO) from third-party operational processing (Processor).

Anahtar Kavram

Data Governance Roles and Responsibilities
Tahmini Süre:1m 0s
Soru 288Soru

Match each vulnerability assessment methodology with its most appropriate enterprise operational deployment scenario.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Credentialed Vulnerability Scanning
Non-Credentialed Vulnerability Scanning
Agent-Based Scanning
Passive Network Assessment

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Credentialed Vulnerability Scanning pairs with internal configuration and patch auditing; Non-Credentialed Vulnerability Scanning pairs with perimeter external attacker perspective evaluation; Agent-Based Scanning pairs with continuous visibility for remote and transient endpoints; Passive Network Assessment pairs with traffic monitoring for sensitive OT/SCADA systems.
Credentialed vulnerability scanning delivers accurate internal patch and software configuration details using privilege-based access. Non-credentialed scanning replicates external threat actor visibility by testing open ports and services without user credentials. Agent-based scanning ensures continuous host monitoring regardless of endpoint network attachment. Passive network assessment monitors network packet streams safely without generating active traffic that could disrupt sensitive OT hardware.

Adım Adım Çözüm

1
Analyze Credentialed Scanning requirements
Requires authentication to query host OS internals and software inventory.
Allows deep host inspection with low false positives.
2
Analyze Non-Credentialed Scanning capabilities
Probes exposed services over the network without logging in.
Simulates external adversary visibility.
3
Analyze Agent-Based Scanning advantages
Executes audits directly on local endpoint hardware.
Provides coverage for mobile devices that do not regularly attach to the local network.
4
Analyze Passive Assessment constraints
Listens to packet flows on span/mirror ports without transmitting probes.
Prevents system disruption on fragile industrial control systems.

Anahtar Kavram

Vulnerability Assessment Methodologies and Use Cases
Soru 289Soru

An enterprise energy grid operator is restructuring its security governance documentation hierarchy. Match each governance document type on the left with its corresponding operational and enforcement characteristic on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Security Policy
Security Standard
Security Baseline
Security Guideline

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Security Policy matches the high-level executive mandate; Security Standard matches the compulsory technical requirement; Security Baseline matches the minimum required configuration benchmark; Security Guideline matches the discretionary recommendation.
In formal security governance, documents are categorized by scope and enforcement authority. Security Policies set executive intent and broad goals. Security Standards define mandatory requirements and mandatory technical specs. Security Baselines define the minimum required hardening state for systems prior to production release. Security Guidelines provide voluntary advice and best practices for staff.

Adım Adım Çözüm

1
Identify the authority and enforcement level of a Security Policy.
Recognize that policies set high-level executive direction and scope.
Policies are broad governance directives created by management to outline security vision and roles.
2
Distinguish between mandatory technical requirements (Standards) and minimum operational configurations (Baselines).
Standards enforce specific mandatory tools/protocols, whereas Baselines define the minimum secure baseline configuration.
Standards mandate specific requirements enterprise-wide, while baselines represent a concrete minimum secure starting state.
3
Differentiate discretionary documentation (Guidelines) from mandatory controls.
Identify Guidelines as voluntary recommendations.
Guidelines provide flexiblity and suggestions rather than strict compliance obligations.

Anahtar Kavram

Security Governance Documentation Hierarchy and Enforcement Levels
Soru 290Soru

Match each social engineering attack vector to its corresponding real-world enterprise incident scenario.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Whaling
Pretexting
Shoulder surfing
Diversion theft

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Whaling matches the CEO wire transfer targeting scenario; Pretexting matches the fake recruiter phone call scenario; Shoulder surfing matches the visual observation of credential entry scenario; Diversion theft matches the rerouted physical hardware delivery scenario.
Whaling explicitly targets C-level executives (such as a Chief Executive Officer). Pretexting involves creating a believable false story or role (such as a recruiter) to manipulate the victim. Shoulder surfing relies on visually spying on credential entries or confidential displays. Diversion theft manipulates delivery routes or physical couriers to misdirect incoming or outgoing physical goods.

Adım Adım Çözüm

1
Analyze each social engineering attack term and identify its primary operating characteristic.
Whaling targets senior executives; Pretexting uses constructed narratives; Shoulder surfing uses direct visual observation; Diversion theft manipulates physical delivery logistics.
Distinguishing between target roles, media, and physical mechanisms allows accurate classification.
2
Map each term to the enterprise scenario that exhibits its specific behavioral indicator.
Whaling pairs with the CEO email; Pretexting pairs with the recruiter phone scenario; Shoulder surfing pairs with optical passcode viewing; Diversion theft pairs with altered courier paperwork.
Matching each vector to its distinct attack indicator ensures precise threat identification.

Anahtar Kavram

Social Engineering Attacks and Vectors
Soru 291Soru

An enterprise cloud security architect is defining business continuity parameters for a mission-critical billing microservice following a Business Impact Analysis (BIA). Match each continuity metric on the left with its precise operational boundary definition on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Recovery Point Objective (RPO)
Recovery Time Objective (RTO)
Maximum Tolerable Downtime (MTD)
Work Recovery Time (WRT)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Recovery Point Objective (RPO) matches the maximum acceptable age of unrecovered data; Recovery Time Objective (RTO) matches the targeted duration allocated to restore system functionality; Maximum Tolerable Downtime (MTD) matches the absolute maximum elapsed time a service can remain offline before fatal harm; and Work Recovery Time (WRT) matches the timeframe needed for post-restoration testing and data verification.
Each business continuity term describes a distinct timeline element in BIA planning. Recovery Point Objective defines allowable data loss span; Recovery Time Objective defines system restoration speed goals; Maximum Tolerable Downtime sets the non-negotiable total outage ceiling; and Work Recovery Time represents the testing phase necessary after technical restoration.

Adım Adım Çözüm

1
Analyze the data loss constraint parameter.
Identify Recovery Point Objective (RPO) as the metric defining tolerable data loss measured back from the point of failure.
RPO quantifies backup frequency requirements to prevent exceeding data loss tolerances.
2
Analyze the technical recovery speed parameter.
Identify Recovery Time Objective (RTO) as the metric establishing technical system recovery limits.
RTO focuses strictly on infrastructure failover and server/application boot times.
3
Analyze the total business tolerance parameter.
Identify Maximum Tolerable Downtime (MTD) as the overarching ceiling for cumulative operational disruption (MTDRTO+WRTMTD \ge RTO + WRT).
Exceeding MTD results in catastrophic business failure or unrecoverable loss.
4
Analyze the validation and business readiness parameter.
Identify Work Recovery Time (WRT) as the buffer between technical system restoration and full business operation.
WRT guarantees systems are fully tested and synchronized before live user traffic resumes.

Anahtar Kavram

Business Impact Analysis (BIA) Metrics: RPO, RTO, MTD, and WRT relationships
Soru 292Soru

Match each regulatory compliance framework or legal mandate on the left with its primary data governance scope and organizational requirement on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Sarbanes-Oxley Act (SOX)
Health Insurance Portability and Accountability Act (HIPAA)
Payment Card Industry Data Security Standard (PCI-DSS)
General Data Protection Regulation (GDPR)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Sarbanes-Oxley Act (SOX) matches internal financial and accounting controls; HIPAA matches administrative, physical, and technical safeguards for ePHI; PCI-DSS matches operational security controls for processing cardholder data (CHD); GDPR matches data privacy rights and regulations concerning the processing of personal data.
Each mandate addresses distinct legal and regulatory objectives: SOX ensures financial statement integrity; HIPAA secures protected health information (ePHI); PCI-DSS safeguards credit card numbers and authentication data (CHD); GDPR safeguards individual data privacy rights across the European Union.

Adım Adım Çözüm

1
Identify the primary domain governed by Sarbanes-Oxley Act (SOX).
SOX focuses on corporate accounting and financial reporting transparency.
SOX was passed to safeguard investors from corporate financial fraud.
2
Identify the protected data class for HIPAA.
HIPAA protects Electronic Protected Health Information (ePHI).
HIPAA mandates specific security controls for healthcare organizations and business associates handling health records.
3
Determine the governing scope of PCI-DSS.
PCI-DSS governs credit card holder data (CHD).
It is a private industry standard enforced by credit card brands to secure merchant processing environments.
4
Map GDPR to its data governance framework.
GDPR protects personal data privacy rights for individuals within the EU.
GDPR establishes explicit requirements such as data minimization, consent, rights to erasure, and breach notification obligations.

Anahtar Kavram

Regulatory Compliance and Legal Requirements Management
Soru 293Soru

Match each data privacy and protection technique on the left with its corresponding operational implementation on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Tokenization
Data Masking
Anonymization
Hashing

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Tokenization pairs with replacing data with non-sensitive surrogates in a vault; Data Masking pairs with concealing specific fields or characters; Anonymization pairs with irreversibly removing identification capabilities; Hashing pairs with converting text into a fixed-length string via a one-way function.
Each data control accurately aligns with its standard industry definition: Tokenization uses surrogate values backed by a vault, Data Masking restricts visible characters, Anonymization permanently removes PII linking capabilities, and Hashing uses a one-way mathematical function.

Adım Adım Çözüm

1
Analyze the definition of Tokenization.
Identified that tokenization relies on surrogate tokens and a mapping vault.
Tokenization replaces sensitive data with non-sensitive placeholders without using encryption keys on the target data.
2
Analyze the definition of Data Masking.
Identified that data masking hides specific characters in output or views.
Masking obscures portions of sensitive fields to prevent unauthorized viewing while maintaining data layout.
3
Analyze the definition of Anonymization.
Identified that anonymization removes identification irreversibly.
Anonymization prevents data re-identification under regulatory standards like GDPR.
4
Analyze the definition of Hashing.
Identified that hashing creates a fixed-length string through a one-way function.
Hashing is a deterministic, non-reversible cryptographic operation used primarily for integrity verification.

Anahtar Kavram

Data Protection Techniques and Privacy Enhancing Technologies
Soru 294Soru

Match each vulnerability assessment methodology with its corresponding operational characteristic or execution behavior.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Credentialed Vulnerability Scan
Non-Credentialed Vulnerability Scan
Passive Vulnerability Assessment
Intrusive Vulnerability Assessment

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Credentialed Vulnerability Scan pairs with administrative privilege inspection; Non-Credentialed Vulnerability Scan pairs with unauthenticated network probing; Passive Vulnerability Assessment pairs with continuous packet monitoring without probe generation; Intrusive Vulnerability Assessment pairs with exploitation payloads that risk service interruption.
Each vulnerability scanning methodology is accurately paired with its core operational mechanics: credentialed scans use privileged access for deep internal host inspection, non-credentialed scans evaluate external attack surface exposure, passive assessments listen silently to packet streams, and intrusive assessments run exploit vectors that carry risk of service disruption.

Adım Adım Çözüm

1
Analyze access level requirements for host-level visibility vs. boundary exposure.
Identified that credentialed scans require administrative accounts for internal inspection, while non-credentialed scans inspect external exposure without logons.
Vulnerability scanners operate differently depending on whether authentication tokens are provided.
2
Distinguish between active probing methods and silent traffic observation.
Matched passive vulnerability assessment to network packet monitoring because passive techniques generate zero synthetic traffic probes.
Passive monitoring is critical for sensitive operational technology environments where active probes might crash endpoints.
3
Evaluate potential system operational impact during assessment activities.
Matched intrusive vulnerability assessment to exploitation attempt behaviors that carry downtime risks.
Intrusive scans test actual exploit paths rather than simply checking banner signatures, creating potential instability.

Anahtar Kavram

Vulnerability Assessment Methodologies and Scanner Configurations
Soru 295Soru

An autonomous vehicle fleet management enterprise is restructuring its security management oversight framework following an external compliance review. Match each security governance document type on the left with its corresponding organizational function and enforcement authority on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Acceptable Use Policy
Technical Security Standard
System Security Baseline
Operational Security Guideline

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Acceptable Use Policy matches mandatory high-level administrative directive defining legal boundaries for using assets; Technical Security Standard matches mandatory requirement specifying uniform technology selections and protocols; System Security Baseline matches mandatory minimum hardened configuration build required prior to production deployment; Operational Security Guideline matches discretionary recommendations providing flexibility.
Each item correctly aligns with its precise position in the governance documentation hierarchy: policies set compulsory behavioral rules, standards dictate uniform technical controls, baselines set mandatory minimum deployment configurations, and guidelines provide non-mandatory advice.

Adım Adım Çözüm

1
Evaluate the administrative weight and audience of high-level policy documentation.
Identify Acceptable Use Policies as mandatory organizational directives focused on user behavior and asset usage.
Policies sit at the top of the governance hierarchy and establish enforceable behavioral boundaries.
2
Differentiate between enterprise-wide technical rules and platform-specific initial configurations.
Categorize Technical Security Standards as compulsory technology specifications and System Security Baselines as minimum hardened deployment builds.
Standards specify mandated technologies or protocols, whereas baselines define the mandatory starting security state for individual operating platforms.
3
Distinguish mandatory compliance artifacts from advisory documentation.
Associate Operational Security Guidelines with discretionary advice.
Guidelines differ from policies, standards, and baselines because they are not compulsory and permit operational discretion.

Anahtar Kavram

Security Governance Documentation Hierarchy
Soru 296Soru

Match each social engineering attack vector on the left to the real-world enterprise incident scenario on the right that best illustrates it.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Watering Hole Attack
Typosquatting
Vishing
Tailgating

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Watering Hole Attack matches the compromise of a frequently visited industry news portal; Typosquatting matches registering visually similar domain names; Vishing matches placing fraudulent phone calls to accounting personnel; Tailgating matches entering restricted facilities by following authorized employees closely.
Watering hole attacks target specific websites frequented by an intended victim demographic; typosquatting leverages domain name misspellings; vishing relies on voice phone calls for deception; and tailgating exploits physical proximity to enter secure areas without credentials.

Adım Adım Çözüm

1
Identify the primary mechanism of each social engineering attack vector listed.
Watering hole focuses on group web targeting, typosquatting relies on mistyped URLs, vishing uses voice telephone calls, and tailgating relies on unauthorized physical following.
Understanding the core transport vector (web, network domain, telephony, or physical access) distinguishes each attack type.
2
Map each concept to the scenario containing matching technical or physical indicators.
Mapped industry portal compromise to watering hole, fake login URL to typosquatting, executive phone call to vishing, and unbadged entry to tailgating.
Evaluating specific indicators in each scenario ensures precise alignment with the threat definition.

Anahtar Kavram

Social Engineering Attacks and Vectors
Tahmini Süre:1m 30s
Soru 297Soru

Match each enterprise security implementation to its primary CompTIA Security+ classification by category and functional type.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Installing motion-activated floodlights and warning signs along the perimeter fence line of a remote data center facility.
Deploying a host-based file integrity monitoring (FIM) agent to inspect critical system files for unauthorized changes.
Formalizing an enterprise incident response policy and standard operating procedures (SOPs) mandated by management.
Executing automated endpoint quarantine and running malware cleanup scripts to restore infected systems back to a known good state.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

1. Installing motion-activated floodlights and warning signs matches Physical / Deterrent.
2. Deploying host-based file integrity monitoring (FIM) matches Technical / Detective.
3. Formalizing an enterprise incident response policy and SOPs matches Managerial / Directive.
4. Executing automated endpoint quarantine and malware cleanup scripts matches Technical / Corrective.
Each security implementation correctly pairs its underlying mechanism (category: Technical, Managerial, Operational, Physical) with its operational purpose (functional type: Preventive, Deterrent, Detective, Corrective, Compensating, Directive) according to standard CompTIA Security+ SY0-701 guidelines.

Adım Adım Çözüm

1
Analyze the physical perimeter control (floodlights and signage).
Identified as a physical mechanism (Physical category) intended to discourage attackers before an action occurs (Deterrent functional type).
Physical elements protecting tangible assets that discourage breach attempts align with Physical / Deterrent.
2
Analyze the host-based software control (File Integrity Monitoring).
Identified as a system/software mechanism (Technical category) designed to discover anomalous modifications (Detective functional type).
Software-driven monitoring tools that alert on system compromise function as Technical / Detective controls.
3
Analyze the governance document (incident response policy and SOPs).
Identified as administrative oversight (Managerial category) that mandates expected security practices (Directive functional type).
Framework policies set by leadership to dictate compliant behavior are Managerial / Directive.
4
Analyze the remediation action (quarantine and cleanup scripts).
Identified as a software automated response (Technical category) aimed at reversing harm and restoring operations (Corrective functional type).
Automated technical actions taken post-incident to fix compromised endpoints fit Technical / Corrective.

Anahtar Kavram

Classification of Security Control Categories (Technical, Managerial, Operational, Physical) and Functional Types (Preventive, Deterrent, Detective, Corrective, Compensating, Directive)
Soru 298Soru

Match each regulatory compliance framework or legal mandate on the left with its primary governing scope or regulatory requirement on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Children's Online Privacy Protection Act (COPPA)
NYDFS Cybersecurity Regulation (23 NYCRR 500)
Federal Information Security Modernization Act (FISMA)
Digital Operational Resilience Act (DORA)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

COPPA matches verifiable parental consent for children under 13; NYDFS Cybersecurity Regulation matches designating a qualified CISO and submitting annual compliance certification; FISMA matches federal agency security controls aligned with NIST frameworks; DORA matches European ICT risk management and operational resilience requirements.
Each regulatory framework is accurately paired with its legal scope. COPPA targets online services collecting data from children under 13; NYDFS Cybersecurity Regulation targets state-regulated financial entities by requiring a designated CISO and annual attestation; FISMA governs federal agency information systems via NIST standards; and DORA establishes European Union operational resilience and ICT incident reporting rules.

Adım Adım Çözüm

1
Identify the mandate of COPPA
COPPA protects children online by requiring verifiable parental consent before gathering personal data from anyone under 13.
The primary focus of COPPA is child privacy protection for commercial websites and online services.
2
Identify the mandate of the NYDFS Cybersecurity Regulation
NYDFS 23 NYCRR 500 mandates covered financial entities to designate a CISO and submit annual compliance attestations.
This state regulation sets explicit governance and reporting rules for financial services licensed in New York.
3
Identify the mandate of FISMA
FISMA mandates federal information system protection using NIST frameworks.
FISMA legally binds federal executive agencies and government contractors to maintain standardized security controls.
4
Identify the mandate of DORA
DORA enforces digital operational resilience and incident reporting for European financial entities and ICT providers.
DORA standardizes ICT risk management across financial sectors in the European Union.

Anahtar Kavram

Scope and technical obligations of international, federal, state, and sector-specific regulatory compliance frameworks.
Tahmini Süre:1m 30s
Soru 299Soru

An enterprise security team is defining fundamental data governance and privacy requirements for a new corporate application. Match each data governance concept on the left with its corresponding operational description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Data Sovereignty
Data Minimization
Data Anonymization
Data Retention Policy

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Data Sovereignty pairs with subjecting data to local laws where stored; Data Minimization pairs with collecting only strictly necessary data; Data Anonymization pairs with irreversibly removing identifiable attributes; Data Retention Policy pairs with establishing storage timelines and disposal schedules.
Each concept directly aligns with its fundamental security requirement: Data Sovereignty relates to legal jurisdiction based on physical storage location; Data Minimization enforces collecting only what is strictly necessary; Data Anonymization irreversibly removes PII; and Data Retention Policies specify holding periods and secure destruction.

Adım Adım Çözüm

1
Identify the core objective of Data Sovereignty
Recognize that legal jurisdiction over data depends on geographic physical location.
Sovereignty relates directly to national boundaries and regional data privacy compliance laws.
2
Identify the core objective of Data Minimization
Recognize the constraint to restrict collection to minimal required fields.
Minimization reduces risk exposure by preventing superfluous collection of sensitive user information.
3
Identify the core objective of Data Anonymization
Recognize irreversible destruction of identity markers.
Unlike pseudonymization, true anonymization cannot be reversed to expose personal identities.
4
Identify the core objective of a Data Retention Policy
Recognize lifecycle rules governing how long data stays in storage and when it must be purged.
Retention policies balance compliance obligations with risk reduction through timely data destruction.

Anahtar Kavram

Data Governance, Classification, and Privacy Controls

Daha Fazla Pratik

Review how data pseudonymization differs from data anonymization under GDPR and modern privacy standards.
Tahmini Süre:1m 0s
Soru 300Soru

Match each social engineering attack vector or technique on the left with the enterprise incident scenario on the right that best demonstrates its execution.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Pharming
Quid Pro Quo
Hoax
Dumpster Diving

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Pharming matches the DNS/host file redirection scenario; Quid Pro Quo matches offering an IT upgrade service in exchange for credentials; Hoax matches the false virus alert instructing file deletion; Dumpster Diving matches searching physical waste bins for discarded documents.
Each attack vector is paired correctly according to its characteristic method: Pharming alters name resolution to redirect traffic, Quid Pro Quo exchanges a service for credentials, Hoax disseminates false alarms to provoke self-harming behavior, and Dumpster Diving physically recovers sensitive discarded items from trash bins.

Adım Adım Çözüm

1
Analyze the technical mechanics described in each scenario.
Identify technical redirection (Pharming), physical scavenging (Dumpster Diving), false threat warning (Hoax), and transactional incentive offering (Quid Pro Quo).
Social engineering vectors are distinguished by their primary delivery medium and psychological mechanism.
2
Pair each technique with its corresponding operational scenario.
Pharming links to DNS corruption, Quid Pro Quo links to service exchange for credentials, Hoax links to fake virus alert causing self-inflicted damage, and Dumpster Diving links to waste bin scavenging.
Matching requires evaluating key indicators such as DNS tampering, physical access to trash, service offers, and deceitful warnings.

Anahtar Kavram

Social engineering attack vectors and operational techniques
Tahmini Süre:1m 30s
ÖncekiSayfa 15 / 19Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin