Tüm alıştırma soruları

During an off-peak security monitoring review, a security analyst identifies anomalous activity across several database server endpoints. Host telemetry indicates sustained 98% CPU and GPU utilization during non-business hours, accompanied by persistent outbound TCP traffic destined for an external IP address over port 3333 using the Stratum protocol. Endpoint inspection confirms an unauthorized binary executing via a persistent Windows Task Scheduler job. Based on these technical indicators of compromise (IoCs), which of the following malware types has compromised the systems?

An enterprise security architect is mapping enterprise hardening controls to specific vulnerability findings identified during a comprehensive threat assessment. Match each enterprise mitigation strategy on the left with the threat or attack vector on the right that it is primarily designed to counter.

A security administrator is auditing a legacy internal service and discovers two critical cryptographic control weaknesses: the application utilizes static, hardcoded Initialization Vectors (IVs) for Cipher Block Chaining (CBC) encryption, and it explicitly disables Certificate Revocation List (CRL) verification during TLS peer authentication. Which of the following security risks are directly introduced by these weaknesses? (Select TWO.)

A security engineer is analyzing HTTP request logs for a document generation microservice after a Security Information and Event Management (SIEM) alert triggered on high CPU utilization. The service accepts custom template strings from authenticated users to format PDF invoices. Inspection of an isolated POST request payload reveals the following body:

`{"account_id": 9402, "template_body": "{{ self._TemplateReference__context.namespace.__init__.__globals__['os'].popen('id').read() }}"}`

The microservice returned an HTTP 200 OK response containing the payload output: `uid=1001(appworker) gid=1001(appworker)`.

Which of the following vulnerabilities was exploited in this incident, and what primary software control best prevents this vulnerability?

An e-commerce organization is transitioning its customer portal microservices from self-managed virtual machines running in an Infrastructure as a Service (IaaS) environment to a managed Platform as a Service (PaaS) application hosting engine. Which of the following security management tasks is transferred from the organization to the cloud service provider as a direct result of adopting this PaaS model?

An enterprise security operations center (SOC) detects anomalous network and wireless activity across multiple site logs during a synchronized red-team exercise. Match each observed technical log snippet or packet capture indicator to its corresponding network or wireless attack classification.

A healthcare provider maintains an on-premises data center for storing confidential patient health records to maintain direct physical oversight. To handle peak computing demands during annual health audits, the provider integrates resources from a public cloud vendor. Which cloud deployment model is the organization utilizing?

A security analyst reviewing network traffic logs from a global logistics platform notices that high-frequency automated telemetry updates are transmitted using AES encryption. Despite the encryption, an eavesdropper sitting on the network path can easily identify recurring fleet coordinates and status codes because identical 16-byte plaintext blocks consistently produce identical 16-byte ciphertext blocks throughout the session. Which cryptographic weakness is directly responsible for allowing the adversary to reconstruct payload patterns from the intercepted traffic?

A financial institution is deploying a microservice platform using a Function-as-a-Service (FaaS) cloud model to process high-frequency transaction requests. During a security architecture review, the compliance team requires a clear matrix of operational duties between the organization and the cloud service provider (CSP). Which of the following responsibilities is retained solely by the enterprise customer under this deployment model?

A security engineer inspects a vulnerability scan report and port listing for a building automation system (BAS) controller deployed on an internal VLAN (172.16.45.10):

PORT STATE SERVICE REASON
23/tcp open telnet Unencrypted interactive management shell
80/tcp open http Embedded Web Server (Cleartext HTTP Basic Auth)
502/tcp open modbus Modbus TCP (Industrial protocol without built-in authentication)

Which of the following architectural and host vulnerabilities are present on this system? (Select TWO.)

A security analyst needs to gather freely available threat indicators and standardized software vulnerability data without incurring commercial licensing or subscription costs. Which TWO of the following threat intelligence sources should the analyst utilize?

A multinational financial services firm discovers an unauthorized third-party file synchronization application installed across several workstations in the accounting department. The application was introduced by employees seeking to bypass internal network latency when sharing large spreadsheets with external auditors. While analyzing the traffic, security operations identifies that the external cloud server receiving the synchronized financial data was compromised three days prior by a ransomware syndicate, exposing corporate credentials and confidential records. Which of the following best categorizes the primary attack vector utilized and the threat actor attribute responsible for the initial vulnerability?

A network administrator suspects an attacker is performing an Evil Twin attack combined with a disassociation attack to intercept wireless client traffic. Which TWO technical indicators directly point to this specific wireless attack scenario? (Select TWO.)

An enterprise security architect is establishing a security baseline across diverse cloud deployment and service models. Match each security operational task or control responsibility to the corresponding cloud service or deployment model that correctly allocates primary tenant responsibility.

A security analyst investigates packet capture data and network syslog alerts from an enterprise workstation segment. The logs reveal multiple unsolicited gratuitous ARP reply frames mapping the IP address of the subnet default gateway to an unauthorized local host's MAC address. Concurrently, workstations requesting address records for the corporate portal `login.enterprise.local` receive forged response packets directing them to an external public IP address, bypassing the internal primary DNS server. Which of the following attack indicators and techniques are demonstrated in this security incident? (Select TWO.)

During a targeted forensic investigation of a compromised server, an investigator examines volatile memory artifacts using a memory analysis framework. The analysis reveals an injected memory section within the address space of a legitimate lsass.exe process possessing PAGE_EXECUTE_READWRITE memory permissions. Further inspection reveals shellcode executing directly out of unmapped RAM with no corresponding executable file present on the disk or file modification recorded. Which of the following malware classifications best describes this threat?

A security team conducts a static code analysis on a newly developed mobile application. The review reveals that the application uses a hardcoded secret key embedded directly inside the compiled source code to encrypt local user session tokens. Which of the following best describes the primary cryptographic security weakness in this application design?

A threat intelligence team at a healthcare enterprise is designing an automated threat indicator pipeline. The organization wants to ingest structured, machine-readable threat data from trusted peer organizations within its industry sector and automatically exchange standardized operational telemetry across security platforms in real time. Which of the following solutions should the team implement to fulfill these specific requirements? (Select TWO.)

Users in a office location report that all connected wireless devices suddenly lost Wi-Fi signal simultaneously across multiple channels. Analysis using a spectrum analyzer detects a severe, continuous spike in radio frequency interference spanning the entire 2.4 GHz spectrum. Which of the following wireless attacks is indicated by these symptoms?

An incident response team at a regional water utility discovers unauthorized access to its operational technology (OT) network controlling water filtration valves. Forensic analysis reveals that the attacker gained initial access through compromised VPN credentials belonging to an external HVAC contractor, deployed custom zero-day exploits, and maintained undetected access for eight months without altering operations or requesting a ransom. Which of the following threat actor types best matches the attributes and behavior observed in this scenario?