Tüm alıştırma soruları

Soru 321Soru →

An enterprise security manager is defining an updated data governance and privacy enforcement framework to ensure compliance with global regulations. Match each data governance role or privacy mechanism on the left to its corresponding operational responsibility or functional objective on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Data Owner pairs with defining classification and access requirements. Data Custodian pairs with implementing technical controls, key management, and backups. Data Protection Officer (DPO) pairs with privacy compliance oversight, DPIA evaluation, and supervisory liaison. Data Controller pairs with determining the purpose and legal basis for data processing.

The correct pairings accurately reflect standard governance frameworks. The Data Owner is accountable for data classification and policy setting. The Data Custodian implements technical protection mechanisms and manages daily system operations. The DPO provides regulatory oversight and leads privacy impact assessments. The Data Controller establishes the lawful purpose and parameters for personal data collection and processing.

Adım Adım Çözüm

1

Differentiate governance roles between operational execution, business accountability, legal entity status, and compliance oversight.

Identified that technical database administration tasks belong to the custodian, while policy determination belongs to the owner.

CompTIA Security+ requires clear separation of duties between technical implementation (custodian) and strategic business ownership (owner).

2

Map regulatory compliance and privacy oversight responsibilities.

Linked the Data Protection Officer (DPO) to DPIA reviews and independent regulatory communication.

Under privacy frameworks like GDPR, the DPO serves an advisory and monitoring function rather than executing technical maintenance.

3

Differentiate the Data Controller's legal role from internal data ownership.

Associated Data Controller with defining the legal basis and purpose for processing personal data.

The Data Controller establishes the processing objectives and compliance framework for personal data.

Anahtar Kavram

Data Governance Roles and Responsibilities

Soru 322Soru →

A security analyst is categorizing corporate IT procedures according to the core components of the AAA framework. Match each operational scenario to the AAA component it primarily demonstrates.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Matching credential verification to Authentication, permission enforcement to Authorization, and activity logging to Accounting.

Authentication handles proof of identity (passwords, multi-factor tokens). Authorization manages permission policies and resource boundaries (read/write rights based on roles). Accounting captures historical logs, metrics, and audit records of user actions.

Adım Adım Çözüm

1

Identify the purpose of credential verification (username, password, TOTP).

Confirming the user's identity corresponds to Authentication.

Authentication asks 'Who are you?' and validates claims with credentials.

2

Analyze the process of checking access rights and group policies for resource usage.

Restricting access levels based on roles corresponds to Authorization.

Authorization asks 'What are you allowed to do?' and enforces permissions.

3

Examine the function of recording timestamps and user queries into audit logs.

Tracking active usage and generating audit trails corresponds to Accounting.

Accounting asks 'What did you do?' and maintains records for tracking and auditing.

Anahtar Kavram

Core Pillars of Authentication, Authorization, and Accounting (AAA)

Soru 323Soru →

A security architect for a regional energy utility is reviewing security mechanisms implemented across the smart grid infrastructure. Match each technical security control scenario on the left with the primary CIA Triad pillar or Non-Repudiation objective it satisfies on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

The operator authentication control with asymmetric digital signatures matches Non-Repudiation. Encrypting smart meter telemetry with AES-256-GCM matches Confidentiality. Firmware hash tree verification matches Integrity. Redundant paths and failover clustering match Availability.

Each technical scenario corresponds to a foundational security objective: asymmetric signing of commands provides Non-Repudiation by uniquely binding actions to individual operators; payload encryption protects customer usage privacy under Confidentiality; cryptographic hashing verifies unauthorized code modifications under Integrity; and system redundancy maintains uninterrupted operational access under Availability.

Adım Adım Çözüm

1

Analyze the hardware token and asymmetric signature control for tripping commands.

Digital signatures link specific commands to an individual's private key, establishing undeniable proof of origin.

Non-repudiation prevents an entity from denying an action or transaction performed.

2

Analyze the AES-256-GCM encryption of smart meter telemetry.

Encryption shields sensitive customer consumption data from unauthorized eavesdropping across public links.

Confidentiality ensures data is accessible only to authorized entities.

3

Analyze the cryptographic hash tree verification for RTU firmware.

Hashing confirms that the firmware payload remains unaltered from its original authorized state.

Integrity guards against improper data modification or destruction.

4

Analyze the redundant network paths and automatic failover architecture.

High-availability controls prevent single points of failure from causing system downtime.

Availability ensures timely and reliable access to and use of information.

Anahtar Kavram

Core Security Goals (CIA Triad and Non-Repudiation)

Soru 324Soru →

An enterprise security architect is mapping operational security controls to primary security principles within a multi-tier datacenter deployment. Match each operational control on the left with the corresponding core CIA Triad or Non-Repudiation goal on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Full disk encryption corresponds to Confidentiality. Cryptographic checksum verification corresponds to Integrity. Redundant power systems correspond to Availability. Asymmetric digital signatures on administrative updates correspond to Non-Repudiation.

Each operational control serves a specific primary security pillar: encryption prevents unauthorized viewing (Confidentiality), checksum comparison ensures data remains unaltered (Integrity), redundant power infrastructure maintains continuous service uptime (Availability), and asymmetric key signatures cryptographically tie an operation to a specific actor so they cannot deny performing it (Non-Repudiation).

Adım Adım Çözüm

1

Analyze the primary objective of each listed technical or operational control.

Encryption obscures data from unauthorized eyes; checksums detect unauthorized changes; power redundancy prevents service outage; digital signatures bind actions to a specific identity.

Understanding the security function of each control is necessary before categorizing it within foundational security frameworks.

2

Map each control objective to its foundational security pillar.

Obscuring data maps to Confidentiality; detecting alterations maps to Integrity; preventing outages maps to Availability; binding identity to an immutable action maps to Non-Repudiation.

This completes the precise alignment between implementation mechanisms and security principles.

Anahtar Kavram

CIA Triad and Non-Repudiation

Soru 325Soru →

A security administrator is categorizing system events and operational functions into the core pillars of the Authentication, Authorization, and Accounting (AAA) framework. Match each operational scenario on the left to the corresponding AAA pillar on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Presenting a smart card and PIN matches Authentication; evaluating cloud folder permissions matches Authorization; recording session timestamps and bandwidth consumption matches Accounting.

Authentication verifies identity via credentials (smart card and PIN). Authorization determines resource access boundaries and user permissions (cloud folder modification checks). Accounting tracks, measures, and audits user sessions and resource usage (timestamps, session length, and bandwidth consumption).

Adım Adım Çözüm

1

Analyze the first scenario regarding smart card and PIN submission.

Classify this action as identity verification.

Authentication is responsible for verifying the claimed identity of a user or system using provided credentials.

2

Analyze the second scenario regarding security group policy checks for folder modification.

Classify this action as privilege enforcement.

Authorization determines what specific actions, privileges, or resources an authenticated user is permitted to access.

3

Analyze the third scenario regarding logging login timestamps, session length, and data volume.

Classify this action as auditing and metrics tracking.

Accounting measures resource utilization and logs session activities for accountability and auditing purposes.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA)

Soru 326Soru →

Match each core Zero Trust Architecture (ZTA) principle to its corresponding operational description.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Explicit Validation pairs with always authenticating and authorizing based on all available data points before granting entry. Continuous Verification pairs with constantly evaluating session security posture throughout an active connection. Assume Breach pairs with operating under the premise that internal networks contain hostile actors and using microsegmentation to minimize blast radius.

Each Zero Trust principle aligns directly with its operational intent: Explicit Validation mandates verifying all available data points prior to access; Continuous Verification monitors active sessions dynamically over time; and Assume Breach designs controls under the premise that internal networks are inherently untrusted.

Adım Adım Çözüm

1

Identify the core objective of Explicit Validation.

Recognize that explicit validation demands validating identity, context, and permissions on every request prior to granting access.

Explicit validation eliminates implicit trust based on network location or past authorization.

2

Identify the core objective of Continuous Verification.

Recognize that trust must be dynamic and continuously re-assessed throughout the lifecycle of an active session.

Initial authentication is insufficient if device state or user context changes after access is established.

3

Identify the core objective of Assume Breach.

Recognize that defense strategy must assume adversaries already possess internal access, requiring microsegmentation and end-to-end encryption.

Assuming breach minimizes lateral movement and reduces the potential blast radius of security incidents.

Anahtar Kavram

Zero Trust Architecture Principles

Soru 327Soru →

Match each enterprise identity and access management scenario on the left with the corresponding core AAA phase or concept on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Entering a User Principal Name maps to Identification. Validating FIDO2 signatures and PINs maps to Authentication. Evaluating SAML role attributes against ACLs maps to Authorization. Logging session timestamps and executed commands via TACACS+ maps to Accounting.

Each scenario represents a distinct stage in identity and access management: Identification is claiming an identity (entering a UPN); Authentication is proving that identity (validating FIDO2 keys and PINs); Authorization is determining allowable actions (checking SAML attributes against ACLs); and Accounting is recording session data and actions for audit logs (logging TACACS+ execution details).

Adım Adım Çözüm

1

Analyze the first scenario (entering UPN at a prompt).

The subject is claiming who they are without providing proof yet.

Claiming an identity before credential verification is the Identification phase.

2

Analyze the second scenario (validating FIDO2 key signatures and PINs).

The system is verifying the truth of the claimed identity using cryptographic keys and factors.

Proving identity using verification factors is the Authentication phase.

3

Analyze the third scenario (evaluating SAML roles and risk scores against ACLs).

The system is determining what permissions and privileges the authenticated user has.

Enforcing access policies and granting resource rights is the Authorization phase.

4

Analyze the fourth scenario (logging TACACS+ timestamps, commands, and bandwidth).

The system is tracking user activity and resource utilization for historical auditing.

Recording actions, resource usage, and session metrics is the Accounting phase.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA) Framework

Soru 328Soru →

A security engineering team is establishing baseline controls for a cloud-native software delivery pipeline. Match each security implementation on the left with the primary security objective (CIA Triad pillar or Non-Repudiation) it provides on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Digitally signing container images maps to Non-Repudiation; encrypting database backups at rest maps to Confidentiality; deploying multi-region auto-scaling load balancers maps to Availability; and generating SHA-256 hashes maps to Integrity.

Each security control aligns directly with a core security objective: Asymmetric digital signatures ensure Non-Repudiation because the signature uniquely proves origin identity. Encryption protects Confidentiality by preventing unauthorized disclosure. Redundant auto-scaling architectures maintain Availability by ensuring system resilience and uptime. Cryptographic hashing enforces Integrity by verifying that files have not suffered unauthorized tampering.

Adım Adım Çözüm

1

Analyze container image signing

Asymmetric digital signatures tie an action to a specific private key owner.

This guarantees origin authenticity and prevents the publisher from denying authorship (Non-Repudiation).

2

Analyze database backup encryption

AES-256 encryption obscures sensitive static data.

Restricting unauthorized viewing of data enforces secrecy (Confidentiality).

3

Analyze multi-region auto-scaling

Redundant infrastructure withstands regional failures and sudden load increases.

Ensuring continuous system uptime and responsiveness supports service accessibility (Availability).

4

Analyze SHA-256 package hashing

A cryptographic hash produces a unique digest that changes if data is modified.

Verifying that files remain unaltered during transmission ensures data accuracy (Integrity).

Anahtar Kavram

Mapping technical controls to the CIA Triad (Confidentiality, Integrity, Availability) and Non-Repudiation principles.

Soru 329Soru →

An enterprise security team is implementing NIST SP 800-207 Zero Trust Architecture (ZTA) principles across their hybrid cloud infrastructure. Match each core Zero Trust operational requirement to its corresponding technical implementation.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Continuous Explicit Verification matches with dynamically re-evaluating risk signals throughout active sessions; Microsegmentation Enforcement matches with isolating workloads to restrict lateral movement; Assume Breach Posture matches with encrypting internal traffic and treating internal subnets as untrusted; Control and Data Plane Decoupling matches with separating centralized policy decision logic from gatekeeper enforcement mechanisms.

Each Zero Trust principle directly aligns with specific architectural behaviors: Continuous Explicit Verification constantly reassesses session trust based on real-time context; Microsegmentation limits east-west lateral movement between workloads; Assuming Breach eliminates internal network trust and mandates universal encryption; and Decoupling Control/Data Planes separates policy decision logic from policy enforcement nodes.

Adım Adım Çözüm

1

Analyze the operational objective of Continuous Explicit Verification.

Identified that authentication/authorization must occur continually based on live signals rather than once at perimeter entry.

Zero Trust eliminates implicit session trust after initial authentication.

2

Analyze Microsegmentation Enforcement.

Mapped to workload-level isolation and limiting lateral movement.

Microsegmentation divides networks into tiny isolated zones around critical assets.

3

Analyze Assume Breach Posture.

Mapped to internal traffic distrust and universal encryption.

Assuming breach forces organizations to secure internal communications as if the network is compromised.

4

Analyze Control and Data Plane Decoupling.

Mapped to separating Policy Engine/Administrator functions from Policy Enforcement Points.

NIST SP 800-207 specifies logical separation between governance logic and traffic enforcement.

Anahtar Kavram

Zero Trust Architecture Core Tenets & NIST SP 800-207 Logical Architecture

Soru 330Soru →

Match each network access control scenario on the left with the corresponding pillar of the Authentication, Authorization, and Accounting (AAA) framework (or Identification) on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Entering a username corresponds to Identification. Validating passwords and OTP codes corresponds to Authentication. Enforcing role-based access permissions corresponds to Authorization. Recording session duration and bandwidth consumption corresponds to Accounting.

Each phase of the access control workflow fulfills a distinct AAA pillar: Identification claims identity, Authentication verifies credentials, Authorization enforces permissions, and Accounting logs activity metrics.

Adım Adım Çözüm

1

Analyze the first scenario (entering a username).

Entering a username is the assertion of identity before verification, matching Identification.

Identification establishes who the user claims to be.

2

Analyze the second scenario (validating passwords and OTP codes).

Verifying secret credentials proves the identity claim, matching Authentication.

Authentication verifies proof of identity.

3

Analyze the third scenario (checking roles to grant database permissions).

Restricting access based on policies matches Authorization.

Authorization defines what actions an authenticated user is permitted to perform.

4

Analyze the fourth scenario (logging session duration and byte counts).

Recording usage metrics and session logs matches Accounting.

Accounting tracks resource usage and creates audit logs for oversight.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA) Framework

Soru 331Soru →

An enterprise organization is establishing a micro-segmented hybrid environment based on Zero Trust Architecture (ZTA) control plane and data plane principles. Match each logical Zero Trust component on the left with its correct operational responsibility on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Policy Engine (PE) matches with evaluating contextual signals and determining access decisions; Policy Administrator (PA) matches with issuing dynamic credentials and signaling path setups; Policy Enforcement Point (PEP) matches with operating in the data plane to inspect traffic and enforce access boundaries.

Under NIST SP 800-207, Zero Trust architecture divides functions between the control plane and data plane. The Policy Engine evaluates trust inputs to decide access. The Policy Administrator communicates control decisions by managing credentials and signaling gateways. The Policy Enforcement Point sits on the data plane to enforce session bounds.

Adım Adım Çözüm

1

Analyze the core function of the Policy Engine (PE)

Identify that the Policy Engine is purely analytical and rule-based, responsible for evaluating trust signals to reach an access decision.

Control plane separation isolates decision logic within the Policy Engine component.

2

Analyze the core function of the Policy Administrator (PA)

Identify that the Policy Administrator acts on the Policy Engine decision by generating required short-lived tokens or keys and signaling the data plane.

The Policy Administrator serves as the control plane actuator between decision logic and physical gateway mechanisms.

3

Analyze the core function of the Policy Enforcement Point (PEP)

Identify that the Policy Enforcement Point directly handles payload traffic on the data plane to permit, restrict, or break session connections.

Data plane enforcement requires inline monitoring and access control mechanisms.

Anahtar Kavram

Logical Components of Zero Trust Architecture (Policy Engine, Policy Administrator, Policy Enforcement Point)

Tahmini Süre:2m 0s

Soru 332Soru →

Match each cryptographic concept or algorithm on the left with its corresponding operational security objective on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Diffie-Hellman matches establishing a shared secret over an untrusted channel; HMAC matches verifying data integrity and authenticity using a hash and secret key; Elliptic Curve Cryptography matches providing RSA-equivalent security with smaller key sizes; AES-GCM matches delivering authenticated encryption providing confidentiality and integrity.

Each cryptographic concept correctly maps to its definition: Diffie-Hellman enables secure key exchange over untrusted channels; HMAC provides keyed hash authentication; ECC offers high-strength public key security with small key sizes; and AES-GCM provides authenticated symmetric encryption.

Adım Adım Çözüm

1

Identify key exchange mechanisms.

Diffie-Hellman is paired with secure key negotiation across insecure channels.

Diffie-Hellman enables key exchange without broadcasting the shared secret.

2

Analyze message authentication controls.

HMAC pairs with message authentication using secret keys and hashing.

HMAC incorporates a symmetric key into hashing for integrity and authenticity.

3

Evaluate lightweight asymmetric cryptography choices.

ECC pairs with high security, low computational overhead, and smaller key sizes.

ECC achieves equivalent RSA security with shorter keys.

4

Examine symmetric authenticated encryption modes.

AES-GCM pairs with authenticated encryption providing confidentiality and integrity simultaneously.

Galois/Counter Mode (GCM) combines counter mode encryption with Galois field authentication.

Anahtar Kavram

Cryptographic Concepts and Algorithms

Soru 333Soru →

Match each enterprise AAA protocol mechanism or access control payload on the left with its corresponding functional role and operational process on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

RADIUS payload with Acct-Status-Type pairs with Resource Usage & Session Metric Logging (Accounting). TACACS+ AUTHOR_REQUEST pairs with Per-Command Privilege Scoping & Execution Filtering (Authorization). SAML 2.0 Assertion pairs with Federated Identity Verification & Assertion Delivery (Authentication). IEEE 802.1X EAP-TLS handshake pairs with Mutual Cryptographic Identity Verification (Authentication).

The correct pairings evaluate the specific AAA functional domain of each enterprise protocol packet. RADIUS accounting attributes collect metric logs for session auditing. TACACS+ decouples authorization to inspect per-command execution rights. SAML assertions transmit federated identity authentication results across web domains. EAP-TLS enforces mutual authentication using digital certificate handshakes.

Adım Adım Çözüm

1

Analyze the RADIUS Acct-Status-Type payload.

Identified as an Accounting mechanism tracking data transfer volume (octets) and session state.

RADIUS uses Accounting-Request messages (such as Start, Stop, and Interim-Update) to log metrics for auditing and billing.

2

Analyze the TACACS+ AUTHOR_REQUEST payload.

Identified as an Authorization mechanism evaluating individual CLI commands.

TACACS+ decouples AAA, allowing granular authorization queries for specific administrative commands prior to execution.

3

Analyze the SAML 2.0 Response payload.

Identified as a Federated Authentication mechanism using IdP assertions.

SAML assertions communicate user authentication state across domain boundaries from an IdP to a SP.

4

Analyze the IEEE 802.1X EAP-TLS handshake.

Identified as a Mutual Authentication protocol based on dual X.509 certificate validation.

EAP-TLS requires both client and server certificates, satisfying mutual authentication demands at Network Access Control endpoints.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA) Protocol Functional Separation

Tahmini Süre:3m 0s

Soru 334Soru →

A security infrastructure team is establishing proactive defense capabilities across an enterprise environment. Match each disruption or deception technology on the left with the scenario that best illustrates its primary operational objective on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Low-interaction honeypot matches with emulating basic network service banners; High-interaction honeypot matches with capturing complex zero-day exploitation within a fully operational OS; DNS sinkhole matches with intercepting outbound malicious domain queries; Honeytoken matches with embedding decoy cloud API keys into source code repositories.

Each deception and disruption technology aligns with its core functionality: low-interaction honeypots emulate basic services for low-overhead scanning alerts; high-interaction honeypots run complete operating systems for detailed behavioral analysis; DNS sinkholes block external attacker communication by altering DNS responses; honeytokens serve as decoy credentials to detect unauthorized repository exposure.

Adım Adım Çözüm

1

Analyze resource usage and emulation depth for decoy systems.

Low-interaction honeypots provide basic service responses with minimal overhead, while high-interaction honeypots provide full OS environments for detailed threat research.

Differentiating between low-interaction and high-interaction environments relies on evaluating system resource requirements versus intelligence depth.

2

Identify network disruption controls targeting traffic redirection.

DNS sinkholing manipulates domain resolution to prevent compromised endpoints from contacting external C2 infrastructure.

DNS sinkholes function specifically at the name resolution layer to disrupt malicious communication channels.

3

Evaluate data-centric decoy mechanisms.

Honeytokens consist of fake credentials or data artifacts placed within legitimate systems to detect unauthorized data access.

Decoy keys placed in repositories represent non-functional credential artifacts designed purely for alerting.

Anahtar Kavram

Deception and Disruption Technologies

Soru 335Soru →

Match each operational enterprise security scenario on the left with the corresponding Authentication, Authorization, or Accounting (AAA) functional mechanism on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

The user credential submission matches Authentication (verifying claimed identity); the API gateway token scope check matches Authorization (evaluating access rights); transmitting session timestamps and bandwidth metrics matches Accounting (measuring resource consumption); and logging privileged commands matches Accounting (logging actions for auditability and non-repudiation).

Each security scenario corresponds directly to its functional AAA pillar: validating user credentials (passwords/keys) establishes identity (Authentication); evaluating token scopes determines permission boundaries for API write calls (Authorization); recording connection metrics tracks resource utilization (Session Accounting); and logging administrative command execution creates a verifiable trail for non-repudiation (Activity Accounting).

Adım Adım Çözüm

1

Analyze scenario 1 (credential validation at the IdP).

Identified as proof of identity (passwords and MFA tokens).

Authentication is strictly responsible for verifying that a subject is who they claim to be prior to granting access.

2

Analyze scenario 2 (evaluating bearer token scopes at an API gateway).

Identified as permission enforcement based on policy/scopes.

Authorization determines what an authenticated subject is allowed to perform on specific resources.

3

Analyze scenario 3 (transmitting session start/stop times and data volume).

Identified as resource utilization and session tracking metrics.

Accounting measures consumption metrics such as connection time, data throughput, and session state.

4

Analyze scenario 4 (recording executed sudo commands and file changes in a PAM system).

Identified as security audit logging and accountability enforcement.

Accounting captures event logs of user actions to ensure traceability, compliance auditing, and non-repudiation.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA)

Tahmini Süre:2m 0s

Soru 336Soru →

A security architect is implementing NIST SP 800-207 Zero Trust Architecture (ZTA) logical components within an enterprise hybrid network. Match each Zero Trust logical component on the left with its correct operational responsibility on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Policy Engine matches evaluating policy rules and rendering access decisions; Policy Administrator matches issuing control signals to open or close session connections; Policy Enforcement Point matches intercepting and enforcing access controls on data plane traffic.

In NIST SP 800-207 Zero Trust Architecture, responsibilities are split across control and data planes: the Policy Engine renders access decisions based on contextual risk and policy; the Policy Administrator handles control channel signaling to establish or break connections; and the Policy Enforcement Point acts as the data plane gatekeeper enforcing those decisions on live session traffic.

Adım Adım Çözüm

1

Identify the primary role of the Policy Engine (PE)

The Policy Engine acts as the decision-making authority within the Zero Trust control plane.

Under NIST SP 800-207, the Policy Engine uses trust algorithms and contextual input to determine whether access should be granted.

2

Identify the primary role of the Policy Administrator (PA)

The Policy Administrator manages session state and control plane commands.

Once the Policy Engine renders a decision, the Policy Administrator signals the underlying gateway or client components to open or close the connection.

3

Identify the primary role of the Policy Enforcement Point (PEP)

The Policy Enforcement Point functions as the data plane gateway.

The Policy Enforcement Point sits directly in the communication channel to monitor, allow, or drop connection traffic based on instructions from the Policy Administrator.

Anahtar Kavram

Zero Trust Control Plane vs. Data Plane Component Functions

Tahmini Süre:1m 30s

Soru 337Soru →

Match each organizational security measure to its corresponding functional control type according to CompTIA Security+ standards.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Restoring from backups matches Corrective Control; Publishing acceptable use policy matches Directive Control; Configuring firewall rules matches Preventive Control; Deploying NIDS alerts matches Detective Control.

Each security control implementation aligns directly with standard CompTIA Security+ functional control classifications: restoring from backups fixes damage after an incident (Corrective), policies set required conduct rules (Directive), firewalls actively block threats before entry (Preventive), and intrusion detection systems discover and alert on suspicious activity (Detective).

Adım Adım Çözüm

1

Analyze the operational goal of restoring system configurations from backups after an attack.

Identified as a corrective action designed to reverse impact and restore operational capability.

Corrective controls focus on mitigation and recovery after a security incident has taken place.

2

Evaluate the administrative nature of publishing an acceptable use policy.

Identified as a policy-driven directive establishing mandatory rules and expectations.

Directive controls prescribe required behavior and compliance regulations across an organization.

3

Examine the technical enforcement of a firewall rule blocking unauthorized inbound traffic.

Identified as a preventive measure designed to stop unauthorized actions before they happen.

Preventive controls proactively block security breaches or policy violations from occurring.

4

Determine the role of a network intrusion detection system generating alerts.

Identified as a detective measure focused on observing and signaling active or historical anomalies.

Detective controls discover and flag unauthorized or unexpected activities during or post-execution.

Anahtar Kavram

Functional Types of Security Controls

Soru 338Soru →

Match each social engineering attack vector on the left with its correct scenario description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Spear Phishing matches customized targeted emails, Vishing matches voice call scams, Tailgating matches unauthorized physical entry following an employee, and Watering Hole matches compromising a commonly visited website.

Each attack vector is matched to its core operational characteristic: Spear Phishing uses tailored targeted emails; Vishing relies on voice phone calls; Tailgating exploits physical proximity to enter secure doors; and Watering Hole attacks infect third-party sites trusted by a specific user group.

Adım Adım Çözüm

1

Identify the vector focused on tailored email messaging.

Spear Phishing connects to targeting specific individuals with customized email communications.

Unlike generic phishing, spear phishing relies on specific recon to craft personalized emails.

2

Identify the voice-based social engineering vector.

Vishing connects to conducting scams over voice phone calls.

Vishing is short for voice phishing.

3

Identify the physical access social engineering technique.

Tailgating connects to following an authorized employee into a secured facility.

Tailgating relies on courtesy or distraction to bypass access control portals physically.

4

Identify the web-based compromise vector.

Watering Hole connects to compromising a site frequently visited by a target demographic.

Watering hole attacks target the online resources trusted by specific target groups.

Anahtar Kavram

Social Engineering Attack Vectors and Manifestations

Soru 339Soru →

Match each cryptographic mechanism to its primary operational security objective.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Key Stretching matches with repeatedly executing an algorithm to increase computational cost and impede offline brute-force attempts. Password Salting matches with adding unique random bytes to credentials prior to hashing to prevent precomputed rainbow table attacks. Perfect Forward Secrecy matches with generating unique ephemeral session keys so that compromising a long-term key does not decrypt past sessions. Homomorphic Encryption matches with enabling mathematical processing directly on encrypted data without needing to decrypt it first.

Each cryptographic technique aligns with a distinct operational goal: Key stretching increases computational difficulty against offline cracking; Password salting defeats precomputed hash lookups; Perfect Forward Secrecy protects recorded historical traffic using ephemeral keys; Homomorphic encryption enables calculations on ciphertexts without exposing plaintext.

Adım Adım Çözüm

1

Identify the purpose of Key Stretching.

Key stretching algorithms (such as PBKDF2 or bcrypt) iterate a cryptographic hash function thousands of times to add execution overhead.

This directly increases computational cost for attackers performing offline brute-force attacks.

2

Identify the purpose of Password Salting.

Salting prepends or appends unique random bits to passwords before computing their digests.

This guarantees unique hash outputs for identical passwords, neutralizing precomputed rainbow table lookups.

3

Identify the purpose of Perfect Forward Secrecy.

Perfect Forward Secrecy uses ephemeral key exchange algorithms (like ECDHE) to generate distinct session keys for every communication session.

This ensures that compromise of a long-term private key does not compromise past encrypted sessions.

4

Identify the purpose of Homomorphic Encryption.

Homomorphic encryption allows third parties to compute operations directly on ciphertexts.

This enables secure data analysis in untrusted environments without decrypting data to plaintext.

Anahtar Kavram

Cryptographic Concepts and Algorithms

Soru 340Soru →

An enterprise security architect is standardizing cryptographic controls across a zero-trust network infrastructure. Match each security design requirement on the left with the most appropriate cryptographic mechanism or algorithm on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

1. Negotiating a transient shared secret with PFS matches ECDHE; 2. Simultaneous confidentiality, integrity, and authenticity matches AES-GCM; 3. Mitigating GPU brute-force cracking of stored credentials matches Argon2id; 4. Non-repudiation for software updates without payload encryption matches ECDSA.

Each requirement directly aligns with the operational purpose of the corresponding cryptographic primitive: ECDHE for forward-secret key exchange, AES-GCM for authenticated symmetric encryption, Argon2id for memory-hard credential hashing, and ECDSA for asymmetric digital signatures.

Adım Adım Çözüm

1

Analyze key exchange requirements for session key forward secrecy.

Ephemeral Diffie-Hellman key exchanges (like ECDHE) generate temporary key pairs per session, guaranteeing Perfect Forward Secrecy.

Static asymmetric keys (like basic RSA or DH) do not satisfy PFS requirements because private key compromise exposes past traffic.

2

Evaluate cipher modes for combined confidentiality and integrity protection.

Galois/Counter Mode (GCM) is an AEAD mode combining AES block cipher encryption with Galois field authentication.

Standard block modes like CBC require a separate MAC algorithm (e.g., HMAC) to achieve authenticated encryption.

3

Determine password hashing mechanisms designed for high compute/memory cost.

Argon2id incorporates salt and deliberate CPU/memory overheads to neutralize parallelized cracking hardware.

Standard fast hash functions (SHA-256) are vulnerable to rapid GPU dictionary attacks when applied directly to passwords.

4

Identify asymmetric mechanisms providing non-repudiation for cleartext payloads.

Digital signatures (such as ECDSA) sign a digest of the payload using a private key, ensuring origin verification without requiring data encryption.

Public key encryption provides confidentiality rather than payload signing for unencrypted public distribution.

Anahtar Kavram

Cryptographic Concepts and Algorithms

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram