Tüm alıştırma soruları

378 soru

Soru 21Soru

An enterprise security engineer is configuring vulnerability assessment approaches across specialized network segments and target environments. Match each operational scenario on the left with the scanning methodology or configuration best suited to satisfy its operational requirements on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Auditing mobile workforce endpoints operating off-network without requiring VPN connectivity or subjecting host interfaces to active port scanning
Discovering active assets and potential vulnerabilities within a legacy SCADA environment where active probe packets risk triggering physical component outages
Testing a running web application for dynamic injection vulnerabilities and session management defects without needing local host OS credentials
Evaluating external perimeter security exposure strictly from the perspective of an external untrusted adversary with zero internal network access

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Each scenario maps to its respective specialized methodology: off-network endpoints use agent-based scanning; sensitive SCADA environments require passive network monitoring; web application testing uses DAST; and perimeter testing requires external non-credentialed scanning.
Each scenario maps directly to its intended scanning approach based on target architecture, network reachability, protocol layer, and operational risk tolerance.

Adım Adım Çözüm

1
Analyze the operational constraints of mobile workforce endpoints operating without VPN connection.
Agent-based scanning operates locally on endpoints and reports back independently of local network connectivity, matching the mobile workforce requirement.
Network-based scanning requires reachable IP pathways or VPN connections that off-network laptops lack.
2
Evaluate the sensitivity constraints of legacy operational technology (SCADA) environments.
Passive network monitoring listens to wire traffic without sending active probe packets that could fault fragile PLCs.
Active probing can cause legacy OT devices to crash or behave unpredictably.
3
Examine the requirements for evaluating running web application code flaws without OS credentials.
DAST probes the web application protocol stack in a running state, identifying web-layer vulnerabilities without requiring host OS logins.
DAST evaluates input handling and session security externally at the application layer.
4
Determine the methodology for assessing perimeter exposure from an untrusted external perspective.
External non-credentialed scanning targets public-facing IP addresses outside the perimeter without authentication credentials.
This accurately mimics the vantage point and access level of an external attacker.

Anahtar Kavram

Vulnerability Scanning Methodologies and Environment-Specific Configurations
Soru 22Soru

Match each organizational vulnerability assessment requirement to the most appropriate scan configuration method.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Evaluating perimeter security posture and exposed services from an unauthenticated external adversary's perspective
Auditing internal server patch levels and local registry configurations with high accuracy and minimal network bandwidth overhead
Maintaining continuous software vulnerability visibility for roaming remote worker laptops without requiring a VPN connection
Enumerate active host IP addresses and open network ports across a newly acquired subnet prior to conducting detailed assessments

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

1. Evaluating perimeter security from an unauthenticated adversary perspective matches Non-credentialed external network vulnerability scan.
2. Auditing internal patch levels and registry configurations with minimal bandwidth matches Credentialed network vulnerability scan.
3. Continuous vulnerability visibility for roaming laptops without VPN matches Agent-based vulnerability scan.
4. Enumerating active host IP addresses and open ports across a subnet matches Network discovery scan.
Each vulnerability scanning approach serves a distinct operational purpose: non-credentialed external scans evaluate perimeter risk from an attacker's perspective; credentialed network scans deliver low-impact, high-accuracy internal patch audits; host-based agents ensure continuous compliance for remote assets outside the network perimeter; and discovery scans rapidly map network topology and active hosts.

Adım Adım Çözüm

1
Analyze the operational location, authentication requirements, and goal for each assessment scenario.
Identified four unique deployment requirements: unauthenticated external probing, authenticated internal audit, off-network continuous monitoring, and asset discovery.
Vulnerability scanning methods differ primarily by authentication level, host proximity/deployment model, and depth of analysis.
2
Map external probing without credentials to non-credentialed external scans.
Requirement 1 correctly pairs with Non-credentialed external network vulnerability scan.
This mode accurately mimics an external threat actor's vantage point on public-facing assets.
3
Map internal patch verification requiring low network impact to credentialed network scans.
Requirement 2 correctly pairs with Credentialed network vulnerability scan.
Authentication allows scanner access to inspect administrative logs, registries, and configuration files directly.
4
Map remote roaming endpoints to host agents, and subnet host mapping to discovery scans.
Requirement 3 pairs with Agent-based scan; Requirement 4 pairs with Network discovery scan.
Agents provide persistent endpoints monitoring independent of network location, whereas discovery scans rapidly enumerate host availability and ports.

Anahtar Kavram

Vulnerability Assessment Scanner Methods and Configurations
Soru 23Soru

A security operations team must implement appropriate vulnerability assessment methodologies across four distinct IT and operational environments. Which vulnerability scanning approach best matches each enterprise operational requirement?

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Non-intrusive Credentialed Scan
Passive Vulnerability Monitoring
Intrusive Exploitation Scan
Authenticated Dynamic Application Scan

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct pairing matches: Non-intrusive Credentialed Scan with auditing production database OS updates safely; Passive Vulnerability Monitoring with assessing sensitive OT/ICS networks without sending packets; Intrusive Exploitation Scan with confirming shell access from a remote code execution vulnerability in staging; and Authenticated Dynamic Application Scan with analyzing web vulnerabilities behind a login prompt.
Vulnerability scanner methodologies must align with system risk tolerance and application architecture. Passive monitoring avoids packet transmission for delicate operational technology. Non-intrusive credentialed scans safely query local package managers via host credentials. Intrusive scans perform real exploitation checks to confirm true positives in test environments. Authenticated dynamic scans execute web request payloads behind application login mechanisms.

Adım Adım Çözüm

1
Evaluate the requirements and constraints for legacy OT/ICS networks.
Determine that packet injection can crash legacy SCADA controllers, making packetless monitoring necessary.
Passive vulnerability monitoring collects asset and vulnerability intelligence solely by sniffing network traffic.
2
Determine the safest method to verify patch compliance on production hosts during operational hours.
Select non-intrusive credentialed scanning.
Host credentials allow direct inspection of local package manifests without generating heavy or disruptive network attack traffic.
3
Identify the technique required to confirm functional exploitability of a critical flaw.
Select intrusive exploitation scanning.
Intrusive scans validate exploitability by actively executing exploit scripts against target vulnerabilities.
4
Match the web application testing requirement for authenticated areas.
Select authenticated dynamic application scanning.
DAST crawlers require session tokens to traverse and analyze access controls, session state, and input fields behind login interfaces.

Anahtar Kavram

Vulnerability Scanning Methodologies and Environmental Constraints
Tahmini Süre:2m 0s
Soru 24Soru

An enterprise security architect is aligning network isolation mechanisms with specific high-assurance business requirements across diverse deployment environments. Match each network segmentation approach on the left with its defining architectural implementation requirement on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Software-Defined Microsegmentation with Service Mesh
Unidirectional Security Gateway (Data Diode)
Air-Gapped Network Topology
Screened Subnet (DMZ) Architecture

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Software-Defined Microsegmentation pairs with enforcing East-West workload identity traffic control. Unidirectional Security Gateway pairs with physically blocking inbound signals while streaming outbound telemetry. Air-Gapped Network Topology pairs with completely detaching offline root CAs from networks. Screened Subnet Architecture pairs with terminating incoming North-South Internet traffic in a perimeter buffer zone.
Each isolation mechanism corresponds directly to its architectural domain: Software-Defined Microsegmentation governs dynamic East-West service traffic using workload identity; Unidirectional Security Gateways (data diodes) enforce physical one-way transmission for telemetry; Air-Gapping provides complete physical and logical isolation for offline assets like root CAs; and Screened Subnets (DMZs) isolate perimeter North-South public access points.

Adım Adım Çözüm

1
Analyze workload identity vs. network subnetting controls for microservice architectures.
Identify that Software-Defined Microsegmentation with a Service Mesh manages East-West traffic based on service identities rather than IP addresses.
Containerized workloads require dynamic granular policies that transcend static IP boundaries.
2
Evaluate strict physical traffic direction enforcement mechanisms for telemetry export.
Identify that a Data Diode (Unidirectional Gateway) physically restricts data flow to outbound-only transmissions.
Hardware-enforced optical paths prevent bi-directional handshake capability, protecting critical infrastructure from inbound attacks.
3
Determine the highest level of isolation for offline infrastructure assets like root CAs.
Select Air-Gapped Network Topology as the mechanism ensuring total physical and logical network separation.
Root CAs must remain immune to remote exploitation by eliminating network interfaces entirely.
4
Examine perimeter inspection zone characteristics for untrusted public traffic.
Match Screened Subnet (DMZ) Architecture with North-South public traffic termination and proxy inspection.
DMZs act as intermediate buffers preventing direct internet access to sensitive internal application tiers.

Anahtar Kavram

Selecting and matching network segmentation archetypes (DMZ, microsegmentation, air-gapping, data diode) to specific isolation and traffic flow requirements.
Soru 25Soru

An enterprise security architecture team at a telecommunications firm is updating their threat landscape documentation. Match each threat actor category on the left with its primary operational attributes, resources, and attack vector characteristics on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Nation-state / Advanced Persistent Threat (APT)
Disgruntled Insider
Hacktivist Collective
Shadow IT

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Nation-state / APT matches with high sophistication, state funding, and supply chain/zero-day vectors. Disgruntled Insider matches with legitimate access, personal motivation, and internal sabotage/exfiltration vectors. Hacktivist Collective matches with ideological motivation and high-visibility DDoS/defacement vectors. Shadow IT matches with operational convenience lacking malicious intent, introducing unvetted assets.
Correctly matching threat actors requires aligning their core motivations, sophistication levels, resource availability, and primary attack mechanisms. Nation-state actors rely on heavy funding and stealth (zero-days/supply chain); insiders leverage authorized access; hacktivists target public visibility for ideological causes; and shadow IT introduces risks unintentionally due to unapproved operational workarounds.

Adım Adım Çözüm

1
Analyze the resources and motivation of Nation-state actors.
Identify that state-sponsored APT groups have high funding and use covert vectors like zero-days and supply chain intrusions.
Nation-states focus on long-term espionage requiring significant capital and advanced expertise.
2
Evaluate internal threats acting out of revenge or financial gain.
Identify that disgruntled insiders utilize established system access and privilege.
Insiders bypass perimeter controls naturally because they hold legitimate user accounts.
3
Examine ideological threat actors and their typical goals.
Match hacktivists with political motives and public disruption tactics like DDoS.
Hacktivist success relies on public attention and statement-making rather than hidden data theft.
4
Differentiate unsanctioned internal IT usage from intentional attacks.
Match Shadow IT with non-malicious employee workarounds that expose cloud assets.
Shadow IT stems from a desire for efficiency, leading to security blind spots.

Anahtar Kavram

Threat Actor Classifications, Attributes, and Attack Vector Characteristics
Soru 26Soru

Match each storage security control mechanism to its corresponding enterprise architectural objective.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

LUN Masking and Fabric Zoning
KMIP-integrated Hardware Security Module (HSM)
Exact Data Matching (EDM) DLP
Format-Preserving Encryption (FPE)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct pairings match LUN Masking and Fabric Zoning with SAN volume isolation, KMIP-integrated HSM with centralized key management root-of-trust, Exact Data Matching DLP with hashed database record inspection, and Format-Preserving Encryption with format-constrained ciphertext transformation.
Each storage security technology fulfills a distinct operational mandate: LUN Masking and Fabric Zoning isolate SAN storage volumes; a KMIP-integrated HSM standardizes storage encryption key lifecycles; Exact Data Matching DLP inspects outbound traffic using database record hashes; and Format-Preserving Encryption secures stored values while maintaining original database field formats.

Adım Adım Çözüm

1
Analyze SAN boundary security controls
LUN Masking and Fabric Zoning segment network traffic and restrict volume access at the storage controller and switch tier based on host HBA identity.
This isolates storage logical units from unauthorized hosts on the shared storage network.
2
Evaluate key management architecture for bulk storage encryption
A KMIP-integrated HSM centralizes key generation, storage, and distribution across disparate storage arrays.
KMIP enables standardized communication between key management servers and storage clients.
3
Identify structured data exfiltration prevention controls
Exact Data Matching (EDM) relies on database hashes to pinpoint sensitive structured records leaving the network.
EDM reduces false positives compared to standard pattern matching when monitoring data in transit.
4
Determine data-at-rest obfuscation for legacy database schemas
Format-Preserving Encryption maintains field lengths and character sets during encryption.
FPE satisfies compliance encryption requirements without breaking database constraints.

Anahtar Kavram

Enterprise Storage Security Architecture and Data Protection Controls
Soru 27Soru

An enterprise security architect is designing an Identity and Access Management (IAM) architecture to support modern cloud applications, API access, network administration, and automated user lifecycle management. Match each IAM protocol or specification on the left to its corresponding architectural use case on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

SAML 2.0
OAuth 2.0
OpenID Connect (OIDC)
TACACS+
SCIM

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

SAML 2.0 matches XML-based federation assertion exchange between IdP and SP; OAuth 2.0 matches API authorization and access token delegation; OpenID Connect (OIDC) matches user identity authentication layer over OAuth using JWT ID tokens; TACACS+ matches full-payload encrypted network AAA separating authN and authZ; SCIM matches automated identity provisioning/deprovisioning REST standard.
Each IAM technology fulfills a distinct architectural role within enterprise security. SAML 2.0 facilitates XML assertion-based web browser federation SSO across organizations. OAuth 2.0 governs delegated access authorization to protected resources via tokens. OpenID Connect operates on top of OAuth 2.0 to add authentication capability using JWT ID tokens. TACACS+ provides secure administrative AAA for network appliances with full payload encryption and command-level authorization decoupling. SCIM provides standard REST endpoints to automate identity provisioning and account lifecycle operations across enterprise and cloud services.

Adım Adım Çözüm

1
Analyze SAML 2.0 functionality.
Identified SAML 2.0 as an XML-based federated SSO standard that passes security assertions between Identity Providers and Service Providers.
SAML relies on XML payload assertions across cross-domain boundaries.
2
Analyze OAuth 2.0 functionality.
Identified OAuth 2.0 as an authorization framework that delegates scoped API access tokens to applications.
OAuth 2.0 provides delegated authorization rather than direct authentication.
3
Analyze OpenID Connect (OIDC) functionality.
Identified OIDC as an authentication extension on top of OAuth 2.0 utilizing JSON Web Tokens (JWTs).
OIDC fills the authentication gap in OAuth 2.0 by introducing standardized ID tokens.
4
Analyze TACACS+ network administrative AAA properties.
Identified TACACS+ as encrypting the entire packet body and decoupling authentication from command authorization.
Unlike RADIUS, TACACS+ separates AAA functions and provides full payload encryption.
5
Analyze SCIM protocol functionality.
Identified SCIM as an open standard protocol for automating cloud identity provisioning and deprovisioning.
SCIM uses RESTful Web APIs and standardized JSON/XML schemas to manage identity lifecycle changes across disparate SaaS systems.

Anahtar Kavram

Identity and Access Management Architecture Protocols and Frameworks
Soru 28Soru

A maritime shipping enterprise is formalizing its cloud security architecture strategy across diverse operational environments. Match each security operational requirement on the left with the corresponding cloud model or security architecture component on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Enforcing data loss prevention (DLP) and access controls across web applications used by corporate employees without modifying the cloud application code.
Provisioning isolated compute and storage infrastructure exclusively dedicated to single-tenant regulatory compliance data within an enterprise-controlled datacenter.
Deploying virtual instances where the enterprise retains full administrative control over operating system hardening, middleware configuration, and local firewall rules.
Participating in a joint logistics tracking platform hosted in the cloud and shared exclusively among authorized trade partners and customs authorities.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Enforcing DLP across web applications matches Cloud Access Security Broker (CASB); Dedicated single-tenant infrastructure matches Private Cloud Deployment Model; Managing guest OS hardening and firewall rules on virtual instances matches Infrastructure as a Service (IaaS); Shared tracking platform among authorized partners matches Community Cloud Deployment Model.
Each operational requirement correctly aligns with its architectural counterpart based on the shared responsibility model and deployment boundaries: CASB handles proxy/API security enforcement for cloud applications, Private Cloud guarantees single-tenant isolation, IaaS gives the customer full OS-level management control, and Community Cloud supports shared infrastructure restricted to specified industry partners.

Adım Adım Çözüm

1
Analyze the operational security requirement for intermediate policy enforcement over third-party web apps.
Identify that a Cloud Access Security Broker (CASB) provides inline or API-based enforcement of DLP and access control across cloud services.
CASB acts as an intermediary enforcing security, compliance, and governance policies.
2
Evaluate the tenancy and location requirements for single-tenant compliance data.
Map single-tenant, dedicated enterprise infrastructure to a Private Cloud model.
Private clouds guarantee isolated resources managed solely for one enterprise.
3
Examine the management responsibility boundary of guest OS hardening and middleware.
Map guest OS administration and virtual firewall control to Infrastructure as a Service (IaaS).
In IaaS, the customer retains control over the operating system and above, while the provider manages physical infrastructure.
4
Determine the cloud deployment model for infrastructure shared among bounded organizations with common goals.
Map joint industry partner platforms to a Community Cloud model.
Community clouds host joint infrastructure shared exclusively among participating entities with shared missions or compliance mandates.

Anahtar Kavram

Cloud Service and Deployment Models
Tahmini Süre:1m 30s
Soru 29Soru

During an incident triage session, security analysts isolate four distinct technical telemetry artifacts collected from host and network sensors. Match each observed technical indicator on the left with its primary malware classification on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

An EDR alert indicates an unapproved binary disguised as a system management utility that opens an outbound port to accept administrative control commands.
Network security monitoring logs reveal automated, high-volume SMB traffic scanning adjacent subnets to exploit vulnerabilities without user interaction.
Memory forensics reveals shellcode executing dynamically within hijacked system process RAM spaces with no compiled executable written to disk.
Low-level system integrity monitoring detects unauthorized modifications to sector 0 of the primary disk to execute payload code before the operating system kernel initializes.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The technical indicators match their malware classifications as follows: The rogue binary establishing backdoor control matches Remote Access Trojan (RAT); automated network scanning and vulnerability exploitation across subnets matches Self-Propagating Worm; memory-only shellcode execution without disk artifacts matches Fileless Malware; and disk sector 0 modification pre-OS boot matches Bootkit.
The disguised administrative access binary matches the Remote Access Trojan because it masquerades as a benign utility while providing covert remote command capability. The network scanning activity targeting port 445 matches the Self-Propagating Worm due to its autonomous spreading nature without victim interaction. The RAM-resident shellcode execution matches Fileless Malware as it avoids traditional disk-based detection. The sector 0 modification matches Bootkit because it alters the storage boot loader to execute code prior to kernel loading.

Adım Adım Çözüm

1
Analyze each observed indicator of compromise to determine its primary infection vector and operational mechanism.
Indicator 1 uses disguise for remote control; Indicator 2 uses automated network replication; Indicator 3 operates purely in volatile memory; Indicator 4 targets pre-boot disk sectors.
Accurate malware classification requires identifying key behavioral signatures in system telemetry.
2
Map each behavioral signature to official malware taxonomy definitions.
Disguised remote access tool -> Remote Access Trojan; Autonomous network propagation -> Worm; Volatile memory injection -> Fileless Malware; MBR/pre-kernel persistence -> Bootkit.
Correlating telemetry artifacts to specific taxonomy terms ensures precise threat identification and response.

Anahtar Kavram

Malware Types and Indicators of Compromise
Soru 30Soru

A security team is conducting a technical audit of an organization's network and application infrastructure. Match each identified cryptographic or security control weakness on the left with the precise risk or impact it presents on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Disabling Certificate Revocation List (CRL) and OCSP validation checks on client systems
Configuring block ciphers using Cipher Block Chaining (CBC) mode with static, predictable Initialization Vectors
Deploying Diffie-Hellman Key Exchange configured with a 1024-bit prime group (Group 2)
Embedding static API secret keys directly into compiled client-side mobile application code

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct pairings match each specific cryptographic weakness to its primary security consequence: Disabling CRL/OCSP checking leads to acceptance of revoked certificates; static IVs in CBC mode allow pattern recognition and replay attacks; 1024-bit DH Group 2 allows session decryption through precomputation attacks; hardcoded API keys in client binaries lead to universal key exposure via reverse engineering.
Each weakness is paired with its direct operational impact: Disabling revocation checks allows revoked certificates to be accepted; using static IVs in CBC mode compromises semantic security, enabling pattern leakage; using 1024-bit DH groups permits key exchange cracking via precomputation; hardcoding secret keys allows binary reverse-engineering to expose credentials universally.

Adım Adım Çözüm

1
Analyze the impact of ignoring certificate revocation status (CRL/OCSP).
Identify that revoked or compromised certificates will still be trusted by the system.
Revocation validation guarantees that certificates invalidated before their planned expiration date are rejected.
2
Evaluate the mathematical requirement for Initialization Vectors in CBC block cipher mode.
Determine that static or predictable IVs leak information about plaintext patterns.
CBC mode requires unpredictable IVs to ensure identical plaintext blocks produce distinct ciphertext blocks.
3
Assess the cryptographic strength of 1024-bit Diffie-Hellman Key Exchange (Group 2).
Connect low key sizes to vulnerability against precomputation-based MitM attacks.
1024-bit modulus sizes offer insufficient security against modern discrete logarithm precomputation algorithms.
4
Examine the security implications of embedding secret keys within distributed client code.
Recognize that static secrets in client binaries can be extracted through reverse-engineering.
Client applications operate on untrusted hardware where binary disassembly can easily reveal hardcoded secrets.

Anahtar Kavram

Cryptographic and Security Control Weaknesses
Tahmini Süre:2m 0s
Soru 31Soru

Match each specialized enterprise network architectural scenario with the network segmentation control or isolation mechanism that best satisfies its security and operational constraints.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A legacy industrial control system (ICS) sensor network running end-of-life firmware must transmit batch operational logs out to an external cloud database while strictly blocking any physical or logical inbound transmission paths.
A multi-tenant containerized microservices application requires workload-to-workload identity verification and dynamically enforced intra-host software policy without relying on static IP subnets or perimeter firewall rules.
A corporate remote access environment requires external third-party auditors to access internal administrative web consoles without granting their client devices direct IP network routing into the internal corporate subnets.
A public access Wi-Fi network deployed across corporate branch offices must allow connected client endpoints to reach the default gateway while prohibiting direct Layer 2 peer-to-peer traffic between clients on the same subnet.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The scenarios correctly match as follows: Legacy ICS telemetry requiring strictly one-way egress matches Unidirectional Data Diode with physical layer isolation; Multi-tenant container microservice isolation requiring identity verification matches Service Mesh Microsegmentation using eBPF and mTLS attestation; Third-party remote access without direct subnet routing matches Jump Box / Bastion Host in a DMZ with proxy brokering; Public branch Wi-Fi client-to-client blocking on a shared subnet matches Private VLANs (PVLANs) configured with isolated ports.
Each segmentation technology directly aligns with the operational constraints of the scenario: physical data diodes guarantee hardware-level one-way transmission for sensitive OT logs; eBPF microsegmentation with mTLS enforces identity-based zero trust for ephemeral container workloads; proxy-based jump boxes isolate internal networks from third-party client routing; and PVLAN isolated ports restrict Layer 2 lateral communications on shared wireless subnets.

Adım Adım Çözüm

1
Analyze the legacy ICS requirement for guaranteed one-way outbound data movement with zero inbound connectivity.
Identified physical unidirectional data diode enforcement as the only control preventing backchannel traffic hardware-wide.
Firewalls or software ACLs can be misconfigured or bypassed, whereas data diodes enforce hardware-level physical one-way transmission.
2
Evaluate intra-host container microservices dynamic zero-trust requirements.
Identified service mesh microsegmentation using eBPF and mTLS workload attestation.
Dynamic container environments require identity-based policy enforcement rather than static network IP subnet boundaries.
3
Evaluate third-party remote management without network-level access.
Identified jump box / bastion host with application proxy brokering in a DMZ.
Proxying session protocol payloads avoids routing network packets directly from untrusted client endpoints into corporate subnets.
4
Analyze public Wi-Fi peer-to-peer Layer 2 isolation on the same broadcast domain.
Identified Private VLANs (PVLANs) with isolated ports.
PVLAN isolated ports allow frames to flow only to promiscuous ports (gateway) and drop inter-port client communication.

Anahtar Kavram

Selecting network architecture controls based on isolation boundaries (physical, microsegmentation, proxy/bastion, and Layer 2 PVLANs).
Soru 32Soru

A security team is selecting security testing methods and assessment techniques for different operational scenarios. Match each security assessment method on the left with its corresponding operational description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Active Vulnerability Scanning
Passive Vulnerability Scanning
Grey-Box Penetration Testing
Dynamic Application Security Testing (DAST)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Active Vulnerability Scanning matches with sending crafted packets directly to target hosts; Passive Vulnerability Scanning matches with analyzing network traffic signatures in real time; Grey-Box Penetration Testing matches with simulating an attack using partial internal knowledge; Dynamic Application Security Testing (DAST) matches with evaluating running web applications externally without access to source code.
Each assessment method correctly aligns with its execution context: Active scanning sends direct probes to discover vulnerabilities; Passive scanning non-intrusively monitors traffic; Grey-box testing utilizes partial system information; and DAST evaluates live applications dynamically without access to underlying source code.

Adım Adım Çözüm

1
Identify active network testing mechanisms.
Active vulnerability scanning relies on sending probes directly to targets to query system state.
Direct host probing allows detection of specific service versions and missing patches.
2
Identify non-intrusive traffic monitoring techniques.
Passive scanning observes network traffic without injecting probes.
Monitoring packets preserves bandwidth and avoids disruption to sensitive hosts.
3
Differentiate penetration testing knowledge scopes.
Grey-box testing provides limited internal information like credentials or diagrams.
Partial visibility simulates an insider or compromised user threat scenario.
4
Classify application security testing frameworks.
DAST tests operating applications from the outside during execution.
Runtime analysis evaluates application responses without requiring source code.

Anahtar Kavram

Vulnerability Assessment and Security Testing Methods
Soru 33Soru

During a comprehensive security audit for a healthcare enterprise, a security analyst identifies several distinct threat profiles and attack vectors. Match each threat actor type or vector on the left with its defining operational attribute or scenario on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Shadow IT Deployment
Hacktivist Collective
Advanced Persistent Threat (APT)
Disgruntled Employee (Intentional Insider)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Shadow IT Deployment matches introducing unvetted SaaS tools without IT authorization. Hacktivist Collective matches coordinating website defacements and DDoS attacks driven by political causes. Advanced Persistent Threat (APT) matches executing long-term cyber espionage using zero-day exploits and state resources. Disgruntled Employee matches exfiltrating research using legitimate administrative privileges prior to resignation.
Shadow IT is characterized by unauthorized technology adoption (unvetted SaaS). Hacktivists are driven by social or political motives through disruptive acts (defacement/DDoS). APTs possess nation-state backing and high technical sophistication for persistent espionage. Disgruntled employees abuse authorized access for malicious exfiltration prior to departure.

Adım Adım Çözüm

1
Analyze the core motivation, resource capability, and authorization level of each threat actor and vector.
Shadow IT is defined by unvetted internal tool adoption; Hacktivism by political disruption; APT by state-backed sophisticated espionage; Insider by privilege abuse due to grievance.
Accurately categorizing threat actors requires distinguishing between intent, capability, funding, and operational methods.
2
Pair each threat actor or vector with its corresponding operational description.
Shadow IT maps to unvetted SaaS usage; Hacktivists map to political DDoS/defacement; APT maps to state-funded zero-day espionage; Disgruntled Employee maps to privilege abuse prior to resignation.
Each scenario aligns with a unique combination of threat attributes specified in security standards.

Anahtar Kavram

Threat Actor Types, Attributes, and Attack Vectors
Soru 34Soru

Match each business continuity concept on the left with the operational description on the right that best defines its role in disaster recovery planning.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Work Recovery Time (WRT)
Maximum Tolerable Downtime (MTD)
Mean Time to Repair (MTTR)
Single Point of Failure (SPOF)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct pairings align each continuity metric with its precise operational boundary: Work Recovery Time matches the phase for post-restoration business testing; Maximum Tolerable Downtime matches the ultimate time limit before irreversible damage; Mean Time to Repair matches the technical fix duration; and Single Point of Failure matches a critical unredundant component.
Each business continuity concept directly matches its operational definition: Work Recovery Time focuses on business verification after technical recovery; Maximum Tolerable Downtime represents the upper time boundary before critical business collapse; Mean Time to Repair is the average technical restoration speed; and Single Point of Failure is an unredundant bottleneck that can halt an entire service.

Adım Adım Çözüm

1
Differentiate between technical restoration metrics and business recovery testing phases.
Identified MTTR as technical repair duration and WRT as business verification time.
MTTR focuses on hardware/software fix speed, whereas WRT occurs after technical restoration to validate business data and processes.
2
Distinguish organizational outage thresholds from system vulnerability concepts.
Associated MTD with total allowable failure time limit and SPOF with architectural vulnerability lacking redundancy.
MTD establishes overall outage limits, while SPOF identifies specific single components capable of taking down whole systems.

Anahtar Kavram

Business Continuity Planning and Metrics
Soru 35Soru

An enterprise security architecture team is evaluating modern Identity and Access Management (IAM) components to enhance security across hybrid environments. Based on enterprise security best practices, how should each IAM standard or architecture component be matched to its primary architectural role?

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

SCIM (System for Cross-domain Identity Management)
OAuth 2.0 Token Exchange
Privileged Access Management (PAM) with Ephemeral Credentials
FIDO2 / WebAuthn Framework

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Each IAM architectural component correctly aligns with its core functionality: SCIM handles automated identity provisioning, OAuth 2.0 Token Exchange propagates identity across microservices, PAM with ephemeral credentials eliminates static admin credentials, and FIDO2/WebAuthn delivers phishing-resistant authentication.
SCIM automates cross-domain provisioning; OAuth 2.0 Token Exchange securely transfers delegative identity context across API endpoints; PAM with ephemeral credentials removes persistent privileged secrets; and FIDO2/WebAuthn provides hardware-backed, domain-bound authentication resistant to phishing.

Adım Adım Çözüm

1
Analyze identity lifecycle standards
Identify SCIM as the standard protocol for automated provisioning and deprovisioning across SaaS services.
SCIM uses standardized RESTful schemas to sync user accounts between identity providers and cloud applications.
2
Evaluate token delegation in distributed systems
Identify OAuth 2.0 Token Exchange as the method for context propagation in microservice architecture.
Token exchange enables secure impersonation or delegation across backend services without exposing primary credentials.
3
Examine privileged access hardening techniques
Identify PAM with Ephemeral Credentials for dynamic short-lived administrative access.
Ephemeral credentials mitigate pass-the-hash and lateral movement risks associated with persistent admin accounts.
4
Assess strong authentication frameworks
Identify FIDO2/WebAuthn for hardware-bound, phishing-resistant authentication.
FIDO2 cryptographically binds authenticators to origin domains, preventing credential harvesting via proxy attacks.

Anahtar Kavram

Identity and Access Management Architecture Components and Protocols
Tahmini Süre:2m 0s
Soru 36Soru

Match each vulnerability assessment scan approach with its corresponding operational description.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Credentialed Scan
Non-Credentialed Scan
Intrusive Scan

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Credentialed Scan pairs with using administrative access for internal patch checks; Non-Credentialed Scan pairs with examining unauthenticated network services; Intrusive Scan pairs with actively exploiting weaknesses with disruption risk.
Credentialed scanning uses administrative privileges to check internal host states, non-credentialed scanning evaluates exposed network services without access permissions, and intrusive scanning actively verifies vulnerability exploitability with potential operational impact.

Adım Adım Çözüm

1
Analyze the authentication requirement of each scanning method.
Credentialed scans use authorized accounts to perform inside-out administrative checks, whereas non-credentialed scans inspect systems outside-in without credentials.
Differentiating access capabilities defines host-level vs network-level inspection.
2
Evaluate the operational impact and active testing behavior.
Intrusive scanning actively simulates exploits to verify vulnerability presence, distinguishing it from passive or non-intrusive measurement techniques.
Identifying operational risk separates discovery scans from exploitation attempts.

Anahtar Kavram

Vulnerability scanning modes and operational characteristics
Tahmini Süre:1m 0s
Soru 37Soru

A security operations team is organizing its threat intelligence pipeline to improve context, automation, and threat response capabilities across different enterprise monitoring tools. Match each threat intelligence source type on the left to its corresponding operational characteristic or operational capability on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Information Sharing and Analysis Center (ISAC)
Commercial / Proprietary Threat Feed
Open-Source Intelligence (OSINT)
National Vulnerability Database (NVD)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Information Sharing and Analysis Center (ISAC) matches sector-specific peer sharing; Commercial/Proprietary Feed matches curated SLA-backed data; Open-Source Intelligence (OSINT) matches freely accessible public threat insights; National Vulnerability Database (NVD) matches standardized CVE and CVSS repositories.
Each intelligence source type is matched to its primary operational framework: ISACs provide sector-specific peer sharing, Commercial feeds provide SLA-backed curated intelligence, OSINT provides freely accessible public research, and NVD provides standardized vulnerability tracking with CVE/CVSS identifiers.

Adım Adım Çözüm

1
Analyze the operational role of ISACs
Identify ISACs as trusted platforms for industry-specific threat sharing (e.g., FS-ISAC for financial services).
ISACs focus on sector-specific peer intelligence sharing.
2
Distinguish between proprietary feeds and OSINT
Commercial feeds offer vendor SLAs and curated indicators, whereas OSINT is gathered from publicly accessible sources without SLAs.
Paid feeds trade cost for SLA guarantees and lower false-positive rates compared to unvetted public feeds.
3
Map vulnerability database characteristics
NVD provides public, structured vulnerability records categorized by CVEs and evaluated with CVSS metrics.
Vulnerability databases focus on flaw scoring rather than active adversary threat actor feeds.

Anahtar Kavram

Threat Intelligence Sources and Research
Soru 38Soru

Match each Zero Trust Architecture (ZTA) logical component defined in NIST SP 800-207 to its primary operational responsibility.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Policy Engine (PE)
Policy Administrator (PA)
Policy Enforcement Point (PEP)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The Policy Engine is responsible for evaluation and authorization decisions; the Policy Administrator handles control plane management and session credential signaling; the Policy Enforcement Point actively enforces access controls directly within the data plane.
According to NIST SP 800-207 Zero Trust Architecture, the Policy Engine handles the decision logic, the Policy Administrator handles control plane orchestrations and session keys, and the Policy Enforcement Point performs data plane enforcement directly on connections.

Adım Adım Çözüm

1
Identify the core decision-making entity within the control plane.
The Policy Engine evaluates context, identity, and posture against trust rules to grant or deny access.
Zero Trust separates policy decision-making from policy enforcement mechanisms.
2
Determine which component translates policy decisions into control plane commands.
The Policy Administrator receives the decision from the Policy Engine and communicates with enforcement points to initiate or terminate communication channels.
The Policy Administrator serves as the controller orchestrating session setup and credential issuance.
3
Identify the data plane component interacting directly with network connections.
The Policy Enforcement Point monitors and filters data traffic, enabling or tearing down access sessions.
Enforcement must happen directly at the boundary of the requested resource or workload.

Anahtar Kavram

Logical Architecture of Zero Trust (NIST SP 800-207 Control and Data Planes)
Soru 39Soru

Match each core security goal on the left with its primary operational objective on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Confidentiality
Integrity
Availability
Non-Repudiation

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Confidentiality matches with preventing unauthorized disclosure; Integrity matches with ensuring data remains accurate and unaltered; Availability matches with ensuring systems and services are accessible when needed; Non-Repudiation matches with providing verified proof of message authorship so the sender cannot deny sending it.
Each concept aligns directly with its fundamental security definition: Confidentiality prevents unauthorized viewing of sensitive information; Integrity safeguards data against unauthorized modification; Availability ensures system resources are ready for use when needed; Non-Repudiation uses proof of identity and origin so an actor cannot deny an event or message.

Adım Adım Çözüm

1
Identify the primary definition of Confidentiality
Confidentiality protects data against unauthorized disclosure or viewing, matching the corresponding objective describing prevention of unauthorized disclosure.
Keeping data secret from unauthorized entities is the fundamental pillar of confidentiality.
2
Identify the primary definition of Integrity
Integrity guarantees data trustworthiness and accuracy, matching the objective regarding preventing unauthorized modification or alteration.
Maintaining unaltered data state ensures system and message integrity.
3
Identify the primary definition of Availability
Availability ensures uptime and accessibility of systems and data for authorized users upon demand.
Operational continuity and service access form the core requirement of availability.
4
Identify the primary definition of Non-Repudiation
Non-repudiation provides indisputable proof of origin, matching the requirement that a sender cannot deny submitting or authoring a message.
Cryptographic mechanisms like digital signatures tie the action directly to a private key holder.

Anahtar Kavram

Core concepts of the CIA Triad and Non-Repudiation
Soru 40Soru

Match each cloud service model to its primary operational responsibility boundary.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Infrastructure as a Service (IaaS)
Platform as a Service (PaaS)
Software as a Service (SaaS)
Serverless Architecture (FaaS)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Infrastructure as a Service (IaaS) pairs with customer management of operating systems and middleware on virtual machines. Platform as a Service (PaaS) pairs with customer management of application code while the provider manages the OS and runtime. Software as a Service (SaaS) pairs with full vendor management of infrastructure and application software, leaving customer control over access and data. Serverless Architecture (FaaS) pairs with event-driven function deployment without persistent server management.
Each cloud service model defines a distinct boundary under the shared responsibility framework: IaaS provides virtual hardware requiring customer OS management; PaaS abstracts the OS to provide a runtime environment for customer application code; SaaS delivers fully managed application software requiring customer oversight only for identity and data security; Serverless abstracts server management completely to run event-triggered function code.

Adım Adım Çözüm

1
Identify the base virtualization level for Infrastructure as a Service.
Recognize that IaaS gives customers root/administrator control over guest virtual machines and OS configurations.
IaaS provides raw infrastructure primitives like virtual machines, compute resources, and storage volumes.
2
Evaluate Platform as a Service boundaries.
Determine that PaaS hides the OS layer and presents developers with an application execution framework.
PaaS abstracts compute environment configuration so developers focus on coding and database deployment.
3
Evaluate Software as a Service boundaries.
Recognize that SaaS delivers complete turn-key applications.
SaaS applications require zero system or software maintenance from end users beyond identity and data management.
4
Evaluate Serverless/FaaS boundaries.
Match stateless function execution triggers with serverless model concepts.
Serverless architectures dynamically execute stateless functions on demand without customer server management.

Anahtar Kavram

Cloud Shared Responsibility Model across Service Delivery Models
ÖncekiSayfa 2 / 19Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin