Tüm alıştırma soruları

A network administrator needs to establish a remote management session to perform critical database maintenance from an untrusted external network. Arrange the following network boundary transit steps and control points in the correct order, starting from the external connection initiation to the final session establishment on the internal database server.

A security architect is reviewing the access control path for remote administrators connecting from an untrusted management subnet to a high-security internal database zone holding regulated financial records. To enforce defense-in-depth and zero-trust principles, traffic must traverse multiple inspection boundaries and transit controls in a precise order. Sequence the security controls and transit points in the correct order that administrative network traffic must navigate from the originating management workstation to the target database server.

A security analyst is configuring a new Security Information and Event Management (SIEM) solution. Place the core stages of the SIEM log processing pipeline in the correct sequential order from initial log entry to analyst notification.

During the deployment of a new Security Information and Event Management (SIEM) system, a security engineer is configuring the automated pipeline for handling enterprise security events. Arrange the stages of the SIEM data processing pipeline in the correct chronological order from initial log intake to final analyst notification.

A security administrator must securely access an internal database server located within a restricted database zone from a remote management workstation. Place the following connection and transit steps in the correct sequential order from initial external access to final database session establishment according to secure network design principles.

A enterprise security architect is configuring an automated cross-region database failover workflow between two active-passive data centers to maintain zero Recovery Point Objective (RPO) and minimal Recovery Time Objective (RTO) during an ungraceful outage. Arrange the operational steps of the automated failover sequence in the correct chronological order from first step executed to final step completed.

A Security Operations Center (SOC) engineer is building an automated Security Information and Event Management (SIEM) pipeline to process multi-cloud telemetry and on-premises event streams. To ensure correlation rules operate efficiently and reduce false positives, log data must be processed in a precise operational order. What is the correct sequence of stages for log processing within a SIEM pipeline from initial data reception to security incident notification?

A security administrator is reviewing the automated failover process for a high-availability cluster to ensure continuous operations during a hardware failure. What is the correct order of steps the cluster system takes when a primary node fails?

A security engineer is configuring an enterprise Security Information and Event Management (SIEM) system to process event data collected from heterogeneous endpoints and network appliances across the organization. Arrange the stages of the SIEM log processing pipeline in the correct chronological sequence from initial log capture to analyst notification.

An enterprise web application triggers a high-severity alert indicating that an active OAuth access token is simultaneously originating requests from two geographically disparate IP addresses. A security operations team is configuring an automated Security Orchestration, Automation, and Response (SOAR) playbook to remediate the account takeover attempt while preserving evidence. Place the following SOAR automated playbook steps into the correct execution sequence from first to last.

An organization is aligning its cybersecurity procedures with the NIST SP 800-61 incident response framework. Place the core phases of the incident response process in the correct chronological order from first to last.

A network security architect is establishing ingress and zone traversal inspection controls for a public-facing e-commerce platform. The architecture requires multi-tiered network segmentation to isolate external web traffic from sensitive internal backend databases. In what order should inbound network traffic pass through these security controls and network zones, starting from initial external ingress to the final destination in the isolated database zone?

Place the core stages of the Security Information and Event Management (SIEM) log processing pipeline in the correct sequential order from initial intake to analyst notification.

An incident response specialist is preparing to collect evidence from an active, powered-on server involved in a security incident. In what sequence should the specialist acquire the following digital evidence sources to strictly adhere to the Order of Volatility, moving from most volatile to least volatile?

A security operations team has confirmed a active malware infection on a financial database administrator's workstation. Arrange the incident response playbook actions in the correct chronological order from first to last.

A security operations team is configuring an enterprise Security Information and Event Management (SIEM) data pipeline to process heterogeneous log sources across cloud and on-premises environments. In what sequential order does the SIEM pipeline process incoming event data from initial receipt to alert generation?

A Security Operations Center (SOC) team is investigating a multi-stage enterprise breach. A SIEM correlation engine collected logs across web application firewalls, endpoint detection agents, and Windows Domain Controllers. Based on log signatures and attack techniques, arrange the following log events in the correct chronological order of the attacker's progression through the cyber kill chain (from initial access to persistence).

A security operations center (SOC) analyst confirms an active Golden Ticket attack originating from a compromised Active Directory Domain Controller within an enterprise network. Arrange the following incident response procedures in the correct chronological order according to standard NIST incident response lifecycle guidelines, starting with the earliest step.

An organization is updating its cybersecurity incident response plan according to the standard NIST SP 800-61 framework. In what sequential order should the core phases of the incident response lifecycle be performed from first to last?

A security analyst discovers that an operational AWS IAM access key belonging to a production microservice repository was inadvertently committed to a public version control repository. Following standard incident response playbook procedures for credential exposure, place the following response actions in the correct sequential order from first to last.