Tüm alıştırma soruları

An application security specialist is investigating a recurring system crash in a legacy network daemon written in C. Log analysis reveals that an attacker sent a single network packet containing a 2,048-byte payload field into a fixed 512-byte destination memory buffer, causing a segmentation fault and corrupting the instruction pointer. Which of the following vulnerabilities was exploited, and what is the most effective code-level mitigation?

An enterprise security analyst investigates a workstation after an employee reports unexpected system sluggishness. Detailed inspection of system logs reveals a persistent background process hook intercepting API keystrokes and capturing authentication session cookies. Further analysis of network flow records demonstrates stealthy, recurring outbound connections over non-standard ports transferring the collected data to an external address, while no attempts to scan or infect adjacent hosts are detected. Which of the following malware types and indicators of compromise are demonstrated in this incident? (Select TWO.)

A network technician inspecting local subnet traffic notices a high volume of unsolicited Address Resolution Protocol (ARP) reply packets mapping the legitimate default gateway's IP address to an unknown host's MAC address. Which of the following network attacks is directly indicated by this activity?

A security analyst is establishing a vulnerability testing framework for a web application hosted in a staging environment. The framework requires two specific testing techniques: one method that actively interacts with the executing web application to identify runtime vulnerabilities like cross-site scripting, and another method that passively observes network traffic without injecting traffic or modifying state to identify unencrypted cleartext protocols. Which of the following security assessment methods should the analyst select to fulfill these requirements? (Select TWO.)

During a security audit of a web application, an analyst identifies software flaws caused by processing untrusted user data without proper sanitization or encoding. Which of the following application vulnerabilities result directly from improper input validation? (Select TWO.)

An enterprise security architecture team is auditing security responsibility boundaries across diverse cloud deployment models and specialized security integrations. Which operational security responsibility correctly aligns with each cloud architecture or deployment model?

Match each Zero Trust Architecture (ZTA) functional component on the left with its corresponding operational role on the right.

A network security team is establishing a zero-trust transit pipeline for remote systems administrators managing a backend database server located in a restricted internal network zone. Place the traffic flow controls and access verification steps in the correct sequential order, from the initial remote connection request to establishing access on the target server.

Following a security incident where an attacker leveraged compromised developer credentials to establish unauthorized persistence on Linux bastion hosts, an organization is revising its host hardening standards. The forensic investigation revealed two key persistence mechanisms: authorized keys file tampering to insert persistent public keys and rogue systemd service installation to launch unauthorized background processes. Which TWO of the following mitigation controls should the security team implement to directly prevent and detect these technical persistence techniques?

An enterprise security analyst investigates an incident report where multiple corporate mobile devices in a satellite office automatically established wireless associations with an untrusted rogue access point without user intervention. Packet capture analysis shows that the rogue access point listened for directed 802.11 Probe Request frames sent by client devices searching for their Preferred Network Lists (PNL) and dynamically broadcast matching SSIDs using open authentication. Which of the following attack classifications and technical controls accurately apply to this scenario? (Select TWO.)

A financial enterprise security team mandates that every access request to sensitive payment processing services must be explicitly authenticated, authorized, and encrypted, regardless of whether the request originates from an internal office workstation or a remote home connection. Which core principle of Zero Trust Architecture does this policy directly demonstrate?

A security audit reveals that several non-interactive service accounts on Linux production application servers have interactive login shells assigned in `/etc/passwd`. Additionally, auditors found that world-writable temporary storage locations (`/tmp` and `/var/tmp`) are mounted on the main filesystem partition without restrictive execution flags, allowing local users to execute binaries placed in these directories. Which of the following technical mitigation steps provides the most effective hardening baseline to directly address both audit findings?

Security analysts at a biotechnology firm discover an ongoing, highly covert intrusion targeting proprietary genomic therapy blueprints. Forensic investigation reveals that the attackers utilized undisclosed zero-day exploits, maintained encrypted command-and-control persistence for over eighteen months, and focused strictly on data exfiltration without attempting ransomware deployment or financial extortion. Based on these operational attributes, which of the following threat actor types is most likely responsible for this attack?

To optimize threat data collection, an enterprise security operations team must classify different threat intelligence feed types. Pair each threat intelligence category on the left with its defining operational characteristic on the right.

Match each observed wireless or network anomaly on the left with its corresponding attack classification on the right.

A financial organization is incorporating a legacy mainframe transaction processing engine into its modern hybrid data center architecture. The legacy system cannot support modern endpoint detection software or host-based firewalls, but it must securely accept transactions from front-end web servers while strictly preventing unauthorized lateral movement to adjacent enterprise database subnets. Which network architecture decision best isolates the legacy system while managing East-West traffic risks?

A security operations team is refining its threat intelligence research workflow during an active incident investigation involving suspicious PowerShell scripts executed on an endpoint. An analyst needs to correlate newly identified command-and-control (C2) domains against publicly accessible registration data, historic passive DNS records, and peer-reviewed technical blogs without transmitting internal organization telemetry to external partners or incurring subscription fees. Which of the following threat intelligence source categories best satisfies these operational constraints?

An enterprise help desk analyst receives an incoming phone call from an individual impersonating a senior IT infrastructure manager. The caller claims that a critical core router has failed, causing an ongoing outage that threatens an upcoming executive board demonstration. The caller insists that standard identity verification protocols must be bypassed immediately to reset an administrative service account credential before board members notice the disruption. Fearing administrative escalation, the help desk analyst performs the credential reset. Which social engineering technique and primary influence tactics were directly leveraged by the attacker?

A Chief Information Security Officer (CISO) is auditing enterprise cloud services to enforce compliance with the cloud shared responsibility model across diverse architectures. Match each cloud service model implementation on the left to the corresponding primary security responsibility retained by the cloud customer on the right.

A security monitoring system triggers an alert after Microsoft Word spawns a hidden PowerShell process executing an encoded command. Forensic inspection of the host system indicates that no traditional executable files were written to disk; instead, malicious code resides and executes entirely within volatile memory to maintain an outbound command-and-control session. Which of the following malware types is described in this incident?