Tüm alıştırma soruları

Match each threat actor type on the left with its defining capability, access level, or primary motivation on the right.

During a threat hunting exercise on an enterprise web server running Linux, a SOC analyst examines suspicious host telemetry following an alert. The investigation reveals that an external exploit against an HTTP service injected shellcode directly into the heap space of the running `httpd` process. The injected code allocated executable memory regions using `mprotect()` and dynamically resolved socket functions to establish an outbound reverse shell without ever writing any executable files, scripts, or persistent artifacts to the physical disk. Which of the following malware classifications best describes the malicious activity detected on this server?

An enterprise security auditor discovers several vulnerabilities across an organization's internal infrastructure during a comprehensive technical posture assessment. Match each identified host and network vulnerability indicator on the left to its corresponding primary security risk on the right. Which of the following correctly pairs each vulnerability indicator with its primary security risk?

Match each cryptographic or security control weakness on the left with its corresponding technical description on the right.

An energy utility enterprise recently deployed 50,000 smart grid sensors that transmit operational telemetry data to a central management server over encrypted TLS connections. During an independent security audit, analysts discover that while TLS 1.2 is enforced, the server accepts finite-field Diffie-Hellman key exchanges configured with legacy 512-bit prime parameters. Which cryptographic vulnerability does this configuration represent, and what risk does it present to the enterprise?

A security analyst is auditing a C-based backend service responsible for processing batch user updates. Code analysis reveals that the buffer allocation calculation `total_bytes = user_count * sizeof(user_record_t)` uses an unsigned 32-bit integer. When a caller supplies a very large `user_count`, the multiplication arithmetic wraps around, resulting in a small memory allocation from `malloc()`. The application then attempts to copy all incoming user records into this undersized buffer, causing arbitrary memory corruption. Which of the following software vulnerabilities is demonstrated in this scenario?

A security analyst conducts an internal vulnerability assessment on a Linux server host processing enterprise telemetry. During host inspection, the analyst extracts the following active socket states and service configuration snippet:

# netstat -tuln | grep 9099
tcp 0 0 0.0.0.0:9099 0.0.0.0:* LISTEN
# cat /etc/telemetry/agent.conf
[server]
bind_address = "0.0.0.0"
port = 9099
auth_enabled = false

The infrastructure team notes that access control was omitted locally because the host operates behind an enterprise boundary firewall filtering external traffic. However, all internal subnets can reach port 9099 without authentication. Which of the following vulnerabilities is demonstrated by this implementation?

An organization's incident response team is dissecting a multi-channel cyber attack targeting a senior system administrator. The adversary first conducted open-source intelligence (OSINT) gathering on public code repositories to obtain personal details and active project names. Next, the attacker placed a direct voice call to the administrator's personal mobile phone impersonating an IT service desk director, claiming that emergency maintenance was required immediately to prevent critical domain service disruption. During the call, the administrator was instructed to follow a link sent via a cellular text message to enter their administrative single sign-on (SSO) credentials into a fake authentication portal. Which combination of social engineering attack vectors and primary principles of influence were executed by the adversary in this incident?

Match each threat actor category with its primary motivation and characteristic attack vector in an enterprise environment.

A technology firm has deployed several virtual machines on an Infrastructure as a Service (IaaS) public cloud platform. According to the cloud shared responsibility model, which of the following security tasks is the sole responsibility of the customer?

Match each malware classification on the left with its corresponding technical indicator of compromise (IoC) or telemetry profile on the right.

A cybersecurity team is establishing testing procedures for an enterprise security audit. Match each security testing method on the left with its primary operational objective on the right.

A security operations team needs to implement continuous vulnerability assessment and security testing mechanisms for a cloud-hosted e-commerce application platform. The security objective is to identify runtime application vulnerabilities and network anomalies without degrading live user traffic performance or causing service interruptions on production database hosts. Which TWO of the following methods or practices best meet these operational requirements?

Match each host, network, or infrastructure vulnerability scenario on the left with its corresponding primary remediation strategy on the right.

A threat intelligence architect at a critical infrastructure provider is designing an automated threat intelligence sharing framework. The organization needs to ingest structured, machine-readable threat data—including adversary tactics, malware relationships, and indicators of compromise—from an Industry Information Sharing and Analysis Center (ISAC) and feed it directly into security orchestration tools via an automated, HTTPS-based service. Which of the following technical solutions correctly pairs the data representation format with the transport mechanism to meet these requirements?

An enterprise security architect is mapping security governance duties across various cloud service models during a multi-cloud initiative. Match each cloud service model on the left with the customer's primary security responsibility on the right.

An IT security administrator at a retail organization discovers that an authorized system administrator leveraged legitimate elevated privileges to copy and exfiltrate confidential payment database records for personal gain. Which threat actor classification best describes this individual?

An incident responder identifies an active threat on an enterprise network where a malicious program continuously scans adjacent hosts across the local subnet and automatically copies itself to available network shares without requiring any user execution or logged-in credentials. Which of the following malware types is primarily characterized by this autonomous network replication capability?

During an internal security assessment, an analyst discovers that an enterprise host permits unauthenticated administrative connections from any device within the internal network. The system design relies entirely on the border edge firewall to block external threats, assuming all intranet traffic is inherently safe. Which of the following architecture vulnerabilities is primarily demonstrated by this scenario?

A security analyst reviews an alert from an endpoint detection and response (EDR) agent installed on a user workstation. The telemetry reveals a background process silently logging user keystrokes, taking screenshots of desktop applications, and exfiltrating the collected data to an external server. Which of the following malware classifications and attributes describe this activity? (Select TWO.)