Examkin

Tüm alıştırma soruları

2232 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 721Soru →

An enterprise security architect is categorizing control plane and data plane functional duties during a Zero Trust Architecture (ZTA) migration. Match each Zero Trust architecture component on the left with its specific operational responsibility on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Policy Engine (PE)
Policy Administrator (PA)
Policy Enforcement Point (PEP)
Threat Intelligence System

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The Policy Engine renders access authorization decisions; the Policy Administrator commands control plane session establishment or teardown; the Policy Enforcement Point gates data plane traffic; and the Threat Intelligence System supplies contextual threat data to dynamic trust scoring processes.
In Zero Trust Architecture (NIST SP 800-207), the control plane is split into evaluation logic (Policy Engine) and control execution (Policy Administrator), which together make up the Policy Decision Point (PDP). The Policy Enforcement Point (PEP) resides in the data plane to directly gate resource access. External contextual providers, such as Threat Intelligence Systems, supply real-time attack data to inform dynamic trust decisions.

Adım Adım Çözüm

1
Differentiate between Policy Decision Point (PDP) components and Policy Enforcement Point (PEP) locations.
Identified the Policy Engine and Policy Administrator as core PDP components in the control plane, while the PEP functions strictly within the data plane boundary.
ZTA relies on a clear operational separation between control plane decision logic and data plane traffic enforcement.
2
Distinguish between the decision logic (PE) and the execution logic (PA) within the PDP.
Matched the Policy Engine to policy calculation and access decision rendering, and the Policy Administrator to signaling the PEP to open or close session channels.
The PE evaluates contextual inputs against trust algorithms, whereas the PA communicates decision outcomes to enforcement gates.
3
Map supporting data sources to their external telemetry role.
Associated the Threat Intelligence System with providing real-time external threat feeds and dynamic risk context.
Continuous authorization relies on contextual data sources outside standard static identity attributes.

Anahtar Kavram

Zero Trust Control Plane vs. Data Plane Component Functions (NIST SP 800-207)
Soru 722Soru →

A security analyst is auditing a legacy enterprise reporting application. While reviewing the source code responsible for exporting document files, the analyst notes that user-supplied input parameters are directly concatenated into a system command string passed to an operating system command shell executor (`exec()`). The development team proposes mitigating this risk by deploying a Web Application Firewall (WAF) rule designed to inspect requests and block common SQL keywords such as `SELECT`, `INSERT`, and `UNION`. Which of the following evaluations best explains why the proposed mitigation is ineffective?

Cevabı ve açıklamayı göster

Cevap: The proposed control filters database query manipulation techniques rather than operating system shell commands, failing to remediate the un-sanitized command string execution in application code.

Cevap

The proposed control targets database query manipulation rather than operating system shell commands, failing to remediate the un-sanitized command string execution in application code.
The correct answer accurately points out that filtering database query terms addresses SQL Injection, whereas the vulnerability present is OS Command Injection. Because the server executes arbitrary system commands via un-sanitized string concatenation, SQL keyword filters provide no protection against shell metacharacters or operating system utilities.

Adım Adım Çözüm

1
Analyze the vulnerability type in the application stem.
User input concatenated into system execution functions (`exec()`) indicates an OS Command Injection flaw.
Identifying the root cause specifies what input structures and system APIs are exploited.
2
Evaluate the proposed mitigation mechanism against the vulnerability type.
Blocking SQL syntax (`SELECT`, `UNION`) mitigates SQL Injection (SQLi), not system shell command invocation.
Security controls must match the specific attack vector and context.
3
Select the correct evaluation that identifies the flaw in the proposed control.
The correct response notes that filtering database query syntax leaves the OS command execution paths unmitigated.
Remediation requires parameterized execution or strict input sanitization suited for shell commands.

Anahtar Kavram

OS Command Injection and Context-Appropriate Mitigation Controls
Soru 723Soru →

Match each enterprise data protection architectural control to its corresponding storage security function.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Tokenization with Format-Preserving Encryption
Hardware Security Module (HSM) with KMIP
LUN Masking and Fabric Zoning
Cryptographic Erase on Self-Encrypting Drives (SED)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Tokenization with Format-Preserving Encryption matches replacing sensitive values with surrogate tokens while preserving database column schemas. Hardware Security Module (HSM) with KMIP matches providing centralized, tamper-resistant key generation and management. LUN Masking and Fabric Zoning matches restricting SAN access so only authorized HBAs can attach to specific storage targets. Cryptographic Erase on SEDs matches rapidly rendering physical drives unreadable during decommissioning by destroying internal encryption keys.
Each storage security mechanism operates at a distinct operational layer of data storage architecture: application/database field protection (tokenization with FPE), root key lifecycle governance (HSM with KMIP), SAN fabric path isolation (LUN masking and zoning), and media sanitization at end-of-life (cryptographic erase).

Adım Adım Çözüm

1
Analyze field-level data protection and schema preservation needs.
Identify Tokenization with Format-Preserving Encryption as the technique that substitutes sensitive values while keeping existing field formatting intact.
Tokenization replaces raw sensitive entries with surrogate values, avoiding database application syntax errors without storing actual plaintext.
2
Evaluate key protection architectures and interoperability protocols.
Connect HSM with KMIP to centralized hardware key generation, storage, and cross-platform key management communication.
HSMs provide physical and logical tamper protection for keys, and KMIP standardizes key management operations across multi-vendor storage environments.
3
Examine SAN network segmentation and storage access restriction controls.
Match LUN Masking and Fabric Zoning to Host Bus Adapter (HBA) initiator-to-target access enforcement.
Zoning isolates FC switch network communication, and LUN masking ensures storage controllers restrict volume visibility to intended host HBAs.
4
Assess storage drive retirement and media sanitization mechanisms.
Link Cryptographic Erase on SEDs to the immediate destruction of the internal Data Encryption Key (DEK).
Destroying the underlying DEK makes all encrypted blocks on self-encrypting drives permanently unrecoverable in seconds.

Anahtar Kavram

Data Protection and Storage Security Architecture Controls
Soru 724Soru →

A security analyst is defining operational procedures for a Security Information and Event Management (SIEM) deployment. Match each SIEM log management concept on the left with its correct operational description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Log Aggregation
Log Normalization
Event Correlation
Log Retention

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Log Aggregation matches centralizing raw log data from disparate hosts; Log Normalization matches transforming heterogeneous log entries into a standardized schema; Event Correlation matches analyzing relationship patterns between distinct log events; and Log Retention matches storing historical log data for specified timelines to satisfy regulatory requirements.
Each concept aligns with its precise SIEM function: Aggregation collects raw logs into a central location, Normalization standardizes field syntax across vendor logs, Correlation analyzes relationships across events to flag attacks, and Retention maintains historical log archives for compliance.

Adım Adım Çözüm

1
Identify the mechanism for collecting raw logs centrally.
Centralizing raw log data from disparate systems corresponds to Log Aggregation.
Aggregation brings scattered log sources together into a central SIEM collector.
2
Identify the process for unifying varied log formats.
Transforming heterogeneous logs into a standardized schema corresponds to Log Normalization.
Normalization ensures that different log syntax structures share identical field names (e.g., standardizing 'src_ip', 'SourceAddress', and 'src' to a single common field).
3
Identify the analytical process for connecting multi-system events.
Analyzing relationships across distinct log entries corresponds to Event Correlation.
Correlation engine rules detect threat scenarios spanning multiple log sources across time windows.
4
Identify the policy governing historic data storage.
Storing historical logs to satisfy regulatory requirements corresponds to Log Retention.
Retention schedules dictate how long logs remain accessible in hot, warm, or cold storage.

Anahtar Kavram

SIEM Core Log Management Operations
Tahmini Süre:1m 30s
Soru 725Soru →

A enterprise cloud services provider is decommissioning a high-density, multi-tenant Storage Area Network (SAN) array containing sensitive tenant data. The SAN storage tier utilizes Self-Encrypting Drives (SEDs) configured to manage media encryption keys via a centralized Key Management Interoperability Protocol (KMIP) cluster. Due to lease agreements, the physical NVMe solid-state drives must remain intact and intact hardware must be returned to the lessor within a strict two-hour window. Which of the following technical procedures provides the most effective and cryptographically sound method to ensure all tenant data is permanently unrecoverable before the drives are removed?

Cevabı ve açıklamayı göster

Cevap: Instruct the centralized KMIP server to purge the Media Encryption Keys (MEKs) or Key Encryption Keys (KEKs) associated with the SED array to execute cryptographic erasure.

Cevap

Destroying or purging the Key Encryption Keys (KEKs) or Media Encryption Keys (MEKs) on the centralized KMIP server to perform cryptographic erasure (crypto-shredding) is the most effective approach.
Cryptographic erasure (crypto-shredding) relies on deleting the encryption key (MEK/KEK) that protects encrypted data at rest. Because the storage array utilizes Self-Encrypting Drives integrated with a KMIP key manager, purging the keys on the KMIP cluster renders all underlying block data instantaneously unrecoverable while leaving physical drive hardware completely undamaged.

Adım Adım Çözüm

1
Analyze storage architecture components
Identified Self-Encrypting Drives (SEDs) connected to an external enterprise Key Management Interoperability Protocol (KMIP) server storing key material.
Data at rest on SEDs is encrypted at the hardware level using symmetric keys locked by master keys managed externally.
2
Evaluate time and physical hardware constraints
Physical drives must remain undamaged due to lease return obligations, and decommissioning must occur within two hours.
Physical destruction (degaussing, shredding) violates lease terms, and full sector zeroization across multi-terabyte NVMe arrays exceeds the allowed timeframe.
3
Select cryptographic erasure method
Sanitize the media instantly by revoking/deleting the corresponding KEKs/MEKs on the KMIP key management cluster.
Without access to the decryption keys, the encrypted data remaining on the flash sectors becomes mathematically impossible to decipher, achieving NIST SP 800-88 compliant sanitization in seconds.

Anahtar Kavram

Cryptographic Erasure (Crypto-shredding) & Centralized Key Management (KMIP)
Soru 726Soru →

An enterprise digital publishing company is migrating its core subscription portal and web application servers to an Infrastructure as a Service (IaaS) environment hosted by a public cloud provider. Under the cloud shared responsibility model, which of the following security operations remains the sole responsibility of the enterprise security team?

Cevabı ve açıklamayı göster

Cevap: Configuring guest operating system patches and host-based firewalls on deployed virtual machines

Cevap

Configuring guest operating system patches and host-based firewalls on deployed virtual machines is the responsibility of the enterprise security team.
In Infrastructure as a Service (IaaS), the cloud service provider abstracts and manages the physical data center, hardware, network infrastructure, and virtualization layer (hypervisor). The customer retains operational control over the virtual machine instances, including installing, patching, and configuring guest operating systems, middleware, applications, network security rules, and host-based firewalls.

Adım Adım Çözüm

1
Identify the cloud service model referenced in the scenario.
The scenario explicitly specifies Infrastructure as a Service (IaaS).
Security boundaries and operational responsibilities depend directly on whether the service model is IaaS, PaaS, or SaaS.
2
Apply the Cloud Shared Responsibility Model rules for IaaS.
The provider secures the infrastructure (hardware, hypervisor, data center physical security), whereas the customer secures everything operating on top of the hypervisor (guest OS, applications, configurations, data).
Customers maintain administrator access to virtual instances in IaaS, making OS patching and local security controls their responsibility.
3
Evaluate the options against customer responsibilities.
Guest operating system patching and local host firewall configuration correctly reflect customer duties under IaaS.
Physical security, hypervisor updates, and physical disk destruction belong strictly to the cloud provider.

Anahtar Kavram

Shared Responsibility Model in Infrastructure as a Service (IaaS)
Soru 727Soru →

An infrastructure engineer is designing network-level resiliency for a critical telemetry gateway cluster operating within an industrial plant. The business continuity requirement specifies that the server nodes must maintain active network connection redundancy across two physically separate upstream access switches. Crucially, the network management team cannot make any configuration changes or protocol modifications (such as enabling port channels or link aggregation) on the existing switches. Which of the following networking configurations should the engineer implement to satisfy these requirements?

Cevabı ve açıklamayı göster

Cevap: Switch-independent active-backup NIC teaming with transmit load balancing

Cevap

Switch-independent active-backup NIC teaming with transmit load balancing provides host-level network path redundancy without requiring switch configuration changes.
The correct choice utilizes switch-independent active-backup NIC teaming. This architecture allows the host operating system to handle adapter failover independently using MAC management or probing, satisfying both the dual-switch redundancy requirement and the strict operational constraint preventing switch-side configuration changes.

Adım Adım Çözüm

1
Identify the primary constraint and objective in the scenario.
Objective is network link redundancy across dual switches; constraint is zero configuration changes on the access switches.
Any protocol requiring switch-side setup (like LACP or etherchannel) is immediately eliminated.
2
Distinguish host-managed NIC redundancy from switch-managed link aggregation.
Switch-independent NIC teaming allows the host hypervisor to manage link status via probing/beaconing without switch assistance.
The operating system controls which network interface card transmits frames, falling back seamlessly if a link fails.
3
Differentiate network interface high availability from storage fault tolerance and disaster recovery.
Multipath storage/RAID addresses block data access, while SAN replication addresses disaster recovery.
Only NIC teaming directly resolves host-to-switch network communication resilience.

Anahtar Kavram

Switch-Independent NIC Teaming for Host Network Resilience
Tahmini Süre:1m 30s
Soru 728Soru →

During a security audit following an incident attempt on a containerized microservices environment, an analyst discovers that an attacker successfully gained remote code execution within a running container process. However, when the attacker attempted to modify system clock settings and mount host storage volumes, the operations failed because administrative privilege flags were restricted at the kernel level by the container runtime engine. Which security mechanism directly prevented the container process from performing these high-privilege host kernel operations?

Cevabı ve açıklamayı göster

Cevap: Linux kernel capability stripping (such as dropping CAP_SYS_ADMIN)

Cevap

Linux kernel capability stripping (such as dropping CAP_SYS_ADMIN) restricts containerized processes from performing administrative kernel operations.
The correct option correctly identifies Linux kernel capabilities as the security control responsible for breaking root power into granular permissions. By dropping capabilities such as CAP_SYS_ADMIN from the container runtime profile, the host kernel refuses requests to mount filesystems or alter system clocks even if the process operates as root inside the container.

Adım Adım Çözüm

1
Analyze the incident scenario requirements
The attacker achieved execution inside the container but was prevented from performing privileged host kernel operations (such as volume mounting or system clock adjustments).
Understanding the boundary being enforced (process-to-kernel level) identifies which isolation control is responsible.
2
Evaluate container privilege isolation mechanisms
Containers share the host Linux kernel. By default or custom configuration, dropping Linux capabilities (e.g., CAP_SYS_ADMIN, CAP_SYS_TIME) restricts specific system call groups regardless of the user's UID inside the container.
Kernel capabilities decompose traditional root privileges into granular permissions enforced directly by the host OS kernel.
3
Differentiate capability control from hypervisor and network mechanisms
Virtual machine hypervisors isolate guest kernels rather than process capabilities, while firewalls handle network communications.
Accurately matching the operational layer (kernel capabilities) eliminates non-kernel or network-only security controls.

Anahtar Kavram

Linux Kernel Capabilities and Container Privilege Restriction
Soru 729Soru →

An enterprise security architect is refining the organization's data protection and storage security architecture. Match each enterprise storage security objective on the left with the primary storage control or mechanism on the right that best satisfies the requirement.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Preventing unauthorized access to SAN block volumes by restricting visibility to specific Host Bus Adapter (HBA) World Wide Names (WWNs) at the storage controller layer.
Offloading cryptographic key generation, lifecycle management, and secure key storage to dedicated hardware compliant with FIPS 140-3 Level 3 requirements.
Ensuring hardware-level full disk encryption that transparently encrypts data at rest directly on disk controllers without OS overhead.
Replacing sensitive account numbers with surrogate values of identical length and character type before writing to database storage.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct pairings are: 1) Preventing unauthorized SAN volume access pairs with LUN Masking and Zoning. 2) Offloading key generation and lifecycle management to tamper-resistant hardware pairs with Hardware Security Module (HSM). 3) Hardware-level disk block encryption without OS reliance pairs with Self-Encrypting Drives (SED). 4) Replacing account numbers with format-matched surrogate tokens pairs with Format-Preserving Tokenization.
Each requirement directly aligns with a foundational storage security architectural control: LUN Masking/Zoning isolates SAN storage access; HSMs secure key management infrastructure; SEDs deliver hardware-based encryption at rest; and Format-Preserving Tokenization protects structured sensitive data while maintaining system schema constraints.

Adım Adım Çözüm

1
Analyze SAN block volume visibility control requirements
Identify LUN Masking and SAN Fabric Zoning as the mechanisms configured at the storage network layer to restrict volume presentation based on HBA WWN addresses.
LUN masking operates at the storage controller/target level to hide logical units from unauthorized initiator host HBAs.
2
Analyze tamper-resistant key lifecycle management requirements
Identify Hardware Security Module (HSM) as the hardware appliance designed for centralized, FIPS-certified key storage and cryptographic operations.
HSMs isolate root keys and cryptographic processing within physical tamper-evident physical boundaries.
3
Analyze controller-level transparent storage encryption at rest
Identify Self-Encrypting Drives (SED) as self-contained storage media equipped with onboard ASIC encryption controllers.
SEDs implement full disk encryption transparently at hardware speeds without processor overhead from the host operating system.
4
Analyze schema-preserving surrogate data replacement requirements
Identify Format-Preserving Tokenization as the database/application control that maps original sensitive data to tokens of identical structure.
Tokenization removes real sensitive values from the storage backend while maintaining length and field data type formatting.

Anahtar Kavram

Storage Architecture Security Controls & Encryption Mechanisms
Soru 730Soru →

A security analyst inspecting a Security Information and Event Management (SIEM) console reviews the following web server log snippet:

`10.0.4.15 - - [27/Jul/2026:14:15:33 +0000] "GET /cgi-bin/status.sh?cmd=cat%20/etc/passwd HTTP/1.1" 200 1420`

Which of the following cyber attack vectors is directly indicated by this log entry?

Cevabı ve açıklamayı göster

Cevap: Command injection

Cevap

The command injection option is the correct answer.
The correct answer is Command injection because the log entry shows the parameter `cmd=cat%20/etc/passwd`, where `%20` represents a space. This attempts to invoke an operating system command (`cat /etc/passwd`) on the backend web server via a CGI script.

Adım Adım Çözüm

1
Analyze the request URI parameters within the log entry.
Identified URL-encoded shell syntax `cat%20/etc/passwd` passed to parameter `cmd`.
Log analysis requires inspecting user input passed to CGI endpoints to determine intent.
2
Determine the target system and impact of the parameter payload.
The payload attempts to execute the system binary `cat` on the Linux file `/etc/passwd` directly on the web host.
Executing arbitrary operating system commands through web application inputs defines command injection.

Anahtar Kavram

Identifying web application attack indicators in SIEM access logs
Soru 731Soru →

An organization is migrating sensitive financial API workloads from traditional virtual machines to an unmanaged container orchestration cluster hosted on bare-metal servers. During a security architecture review, the security team expresses concern that a container compromise could lead to host kernel exploitation or unauthorized lateral movement between isolated tenant containers. Which TWO of the following technical controls directly mitigate these runtime isolation risks at the host level?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring user namespaces (userns) on the container daemon to map container root permissions to an unprivileged non-root UID on the host host system; Enforcing secure computing mode (seccomp) profiles to restrict the specific system calls containerized processes can make to the host kernel

Cevap

The correct controls are mapping container root accounts to unprivileged host users via user namespaces and restricting system calls via seccomp profiles.
Containers share the host kernel. To protect the host operating system from container-based threats, security controls must restrict host-level privileges and kernel access. User namespaces prevent a containerized root user from possessing administrative access on the host, while seccomp restricts the syscalls that container processes can issue to the kernel.

Adım Adım Çözüm

1
Analyze container privilege risks
Containers share the underlying host operating system kernel, meaning container root privileges could default to host root access if an escape occurs.
Mapping container UID 0 to an unprivileged user ID on the host using user namespaces ensures that escalated container privileges do not translate to host root control.
2
Analyze host kernel attack surface reduction
Restricting available Linux system calls minimizes the attack surface against host kernel vulnerabilities.
Applying seccomp profiles blocks unnecessary or dangerous system calls (such as ptrace or reboot), preventing compromised microservices from executing exploits against the shared kernel.

Anahtar Kavram

Container Security and Host Kernel Isolation Mechanisms
Soru 732Soru →

A security team investigating a SIEM alert reviews the following syslog entries from a Linux authentication server:

text
2026-07-27T10:14:02Z auth-srv sshd[10421]: Failed password for invalid user admin from 198.51.100.45 port 49152 ssh2
2026-07-27T10:14:04Z auth-srv sshd[10423]: Failed password for invalid user guest from 198.51.100.45 port 49154 ssh2
2026-07-27T10:14:06Z auth-srv sshd[10425]: Failed password for user root from 198.51.100.45 port 49156 ssh2
2026-07-27T10:14:08Z auth-srv sshd[10428]: Accepted password for root from 198.51.100.45 port 49160 ssh2
2026-07-27T10:14:15Z auth-srv sudo: root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow

Based on the log snippet, which TWO conclusions accurately describe the activity taking place?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: A successful SSH authentication occurred following rapid sequential authentication failures from a single remote IP address.; An authenticated root session executed a privileged command to inspect system password hashes.

Cevap

The logs indicate that a successful SSH authentication occurred following rapid sequential authentication failures from a single remote IP address, and that an authenticated root session executed a privileged command to inspect system password hashes.
The SSH service log lines confirm multiple failed password attempts from 198.51.100.45 followed by an accepted password log entry for root. Shortly after, the sudo log line records the execution of a command viewing `/etc/shadow`, confirming privilege execution for credential dumping.

Adım Adım Çözüm

1
Analyze the timestamp and source IP patterns in the sshd log entries.
Three failed password attempts occurred between 10:14:02Z and 10:14:06Z from IP 198.51.100.45, followed immediately by an accepted password entry for user root at 10:14:08Z from the same IP address.
This sequence demonstrates an SSH brute-force or credential guessing attempt resulting in successful access.
2
Analyze the subsequent sudo execution log entry.
At 10:14:15Z, the root user executed `/usr/bin/cat /etc/shadow` via sudo.
The file `/etc/shadow` contains hashed passwords; reading this file represents post-exploitation credential harvesting.

Anahtar Kavram

Log Analysis and SIEM Event Correlation
Soru 733Soru →

A manufacturer of medical IoT devices wants to permanently disable hardware debug interfaces, such as JTAG, prior to shipping devices to customers. This control must be executed at the silicon level so that hardware debugging cannot be re-enabled through software or firmware modifications. Which of the following hardware security mechanisms should the manufacturer use?

Cevabı ve açıklamayı göster

Cevap: Blowing an electronic fuse (eFuse) on the System-on-Chip during post-manufacturing provisioning.

Cevap

Blowing an electronic fuse (eFuse) on the System-on-Chip during post-manufacturing provisioning.
Blowing an eFuse provides a permanent, irreversible hardware-level change on the silicon itself. Because blowing a fuse physically breaks electrical traces inside the integrated circuit, it guarantees that debug interfaces such as JTAG cannot be re-enabled through subsequent firmware updates or software attacks.

Adım Adım Çözüm

1
Identify the primary constraint specified in the scenario.
The requirement demands a permanent, irreversible silicon-level hardware control that prevents software from re-enabling debug ports.
Software controls or re-programmable memory can be tampered with if firmware is compromised.
2
Evaluate candidate hardware features against the requirement.
Electronic fuses (eFuses) write One-Time Programmable (OTP) bit states by permanently opening an internal electrical circuit on the chip.
Once an eFuse is blown, the physical link is severed forever, preventing any future firmware or software from re-enabling the debug interface.

Anahtar Kavram

eFuse and One-Time Programmable (OTP) Hardware Security Controls
Tahmini Süre:45s
Soru 734Soru →

A security administrator must securely access an internal database server located within a restricted database zone from a remote management workstation. Place the following connection and transit steps in the correct sequential order from initial external access to final database session establishment according to secure network design principles.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with authenticating to the DMZ bastion host using MFA, passing posture and AAA checks on the bastion, traversing the internal stateful firewall via restrictive bastion-to-database rules, and finally establishing the privileged database session.
Secure network design dictates that administrative access to sensitive internal zones (such as a database subnet) must pass through a jump server located within a DMZ or management zone. First, the administrator must authenticate to the bastion host using MFA. Second, device posture and AAA authorization controls evaluate the session on the bastion host. Third, the connection traverses the internal stateful firewall, which uses tight microsegmentation rules to permit transit only from the bastion host IP address to the database server port. Finally, the user establishes the authenticated session on the internal target database.

Adım Adım Çözüm

1
Initiate connection to the perimeter management DMZ
Administrator successfully authenticates to the jump box via MFA at the network boundary.
Direct connections from remote devices into internal secure zones are prohibited by network segmentation policies.
2
Perform posture and access authorization validation on the jump box
The bastion gateway verifies device health and confirms administrative permissions.
Zero trust microsegmentation requires verifying identity and device security posture before allowing transit deeper into the network.
3
Pass through internal stateful firewall microsegmentation controls
Network traffic is permitted through the internal boundary filter specifically targeting the database zone.
Internal firewalls should enforce strict firewall policies allowing DB ports only from the specific IP address of the jump box.
4
Authenticate to the internal target database server
Privileged database administration session begins inside the target subnet.
This is the final destination node requiring database-level credential verification.

Anahtar Kavram

Bastion Host Transit & Secure Network Segmentation
Soru 735Soru →

A security audit of a legacy financial data synchronization service reveals two key architectural flaws: bulk transaction records are encrypted using AES in Electronic Codebook (ECB) mode, and API client connections are allowed based solely on internal IP address ranges without individual user or service authentication. Which of the following security control and cryptographic weaknesses are present in this system? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Identical plaintext blocks produce identical ciphertext outputs, allowing eavesdroppers to infer structural patterns in encrypted data.; Implicit trust based on network location creates an architectural vulnerability by bypassing continuous identity authentication.

Cevap

The two weaknesses present are: (1) Identical plaintext blocks produce identical ciphertext outputs in ECB mode, exposing structural patterns, and (2) Implicit trust based on network location bypasses explicit identity authentication.
The system exhibits two distinct weaknesses. First, AES in Electronic Codebook (ECB) mode encrypts each plaintext block independently using the same key without randomized initialization vectors, causing identical plaintext blocks to produce identical ciphertext and revealing structural patterns in bulk payloads. Second, authenticating API connections using internal IP subnets relies on implicit network location trust rather than explicit identity authentication, creating a severe control weakness by allowing lateral movement if the internal network is breached.

Adım Adım Çözüm

1
Analyze the cryptographic mode flaw
AES in ECB mode lacks diffusion and randomization because identical 128-bit plaintext blocks yield identical ciphertext blocks.
Cryptographic modes like Cipher Block Chaining (CBC) or Galois/Counter Mode (GCM) use initialization vectors (IVs) to prevent pattern leakage, whereas ECB does not.
2
Analyze the security control flaw
Restricting access based on internal IP subnets relies on implicit network location trust.
Zero Trust architecture mandates explicit identity authentication and authorization rather than relying on network perimeter placement.

Anahtar Kavram

Electronic Codebook (ECB) cipher mode pattern leakage and perimeter-based implicit network location trust vulnerabilities.
Soru 736Soru →

An incident response team investigates a workstation that consistently bypasses security controls during boot-up. Low-level forensic examination reveals that malicious code was injected directly into the device's Unified Extensible Firmware Interface (UEFI) storage, allowing the payload to execute before the operating system kernel and Endpoint Detection and Response (EDR) drivers initialize. Which of the following malware classifications best describes this threat?

Cevabı ve açıklamayı göster

Cevap: Bootkit

Cevap

Bootkit is correct because it specifically targets pre-boot firmware/storage such as UEFI or MBR to execute before the operating system kernel and security agents load.
The correct option identifying the threat as a bootkit accurately reflects malware that infects system boot environments like the MBR, VBR, or UEFI NVRAM. This allows it to run before the OS kernel and security components load, effectively hiding its presence and maintaining high privilege persistence.

Adım Adım Çözüm

1
Analyze the technical telemetry and IoCs in the scenario.
Identified malicious code residing in UEFI storage executing prior to OS kernel and EDR driver initialization.
Determines the specific execution timing and persistence layer of the threat.
2
Evaluate malware classifications against pre-boot execution characteristics.
Bootkits target boot code structures (MBR/VBR/UEFI) to run before the OS environment.
Distinguishes bootkits from OS-level malware like standard kernel rootkits or user-mode Trojans.

Anahtar Kavram

Bootkit Malware and Pre-Boot Persistence
Soru 737Soru →

A cloud security architect is establishing isolation and resource protection mechanisms for a hybrid deployment containing both virtualized workloads and containerized microservices. Match each security mechanism to its primary isolation function.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Linux Namespaces
Linux Control Groups (cgroups)
Secure Computing Mode (seccomp)
Type-1 Hypervisor

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Linux Namespaces match with restricting a process's view of system resources; Linux Control Groups (cgroups) match with enforcing resource allocation limits (CPU, memory, I/O); Secure Computing Mode (seccomp) matches with filtering and restricting kernel system calls; Type-1 Hypervisor matches with providing hardware-level abstraction running directly on bare-metal host hardware.
Each technology provides a distinct security and isolation boundary layer within enterprise virtualization and containerization architectures: Namespaces isolate visibility into host resources, Control Groups enforce resource consumption limits, Seccomp restricts syscall surface area exposed to the shared kernel, and Type-1 hypervisors provide hardware-assisted bare-metal guest isolation.

Adım Adım Çözüm

1
Analyze container kernel isolation and view boundary mechanisms.
Identify that Linux Namespaces restrict process visibility into PIDs, network stacks, and filesystems, while seccomp restricts the system calls executable against the kernel.
Namespaces govern visibility boundaries whereas seccomp governs host syscall attack surface.
2
Analyze container resource governance mechanisms.
Identify that Linux Control Groups (cgroups) regulate compute, memory, and I/O consumption.
cgroups prevent individual microservices from consuming excessive host capacity.
3
Analyze virtualization layer boundaries.
Identify that Type-1 hypervisors execute on physical hardware to partition virtual machines.
Bare-metal hypervisors enforce hardware-level virtual machine boundary isolation.

Anahtar Kavram

Virtualization and Containerization Security Mechanisms
Tahmini Süre:1m 30s
Soru 738Soru →

Match each advanced hardware security mechanism or embedded architecture component to its primary operational security function.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Hardware Root of Trust (RoT) / eFuse
Physical Unclonable Function (PUF)
Bus Encryption Engine
Hardware Security Module (HSM)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Hardware Root of Trust / eFuse pairs with the unalterable hardware baseline for boot signature validation; Physical Unclonable Function (PUF) pairs with deriving cryptographic keys from semiconductor manufacturing variations; Bus Encryption Engine pairs with encrypting data traversing physical PCB traces; Hardware Security Module (HSM) pairs with offloading and managing enterprise cryptographic keys within tamper-evident hardware enclosures.
The correct pairings directly correspond to each technology's foundational architectural design: Hardware Root of Trust (eFuse) provides an unchangeable anchor for boot chain verification; Physical Unclonable Function (PUF) derives keys from physical silicon variances; Bus Encryption Engine protects data in transit over physical board traces; and Hardware Security Module (HSM) manages high-volume enterprise cryptographic keys in dedicated tamper-resistant enclosures.

Adım Adım Çözüm

1
Analyze the role of immutable hardware primitives in secure system startup.
Link Hardware Root of Trust (RoT) and eFuses to the permanent, write-once validation mechanism for initial boot signatures.
Software integrity must be rooted in unmodifiable hardware primitives to prevent low-level firmware tampering.
2
Evaluate key generation mechanisms that avoid static key storage on embedded chips.
Associate Physical Unclonable Functions (PUFs) with generating keys directly from silicon physical variations upon device power-up.
Static flash storage of cryptographic keys exposes system secrets to physical reverse engineering, whereas PUFs dynamically reconstruct keys.
3
Identify protection controls designed for physical system interconnects and memory buses.
Connect Bus Encryption Engines to real-time encryption of physical trace data paths between CPU and RAM.
Physical attacks like memory bus sniffing or logic analyzer probing target plaintext data passing across hardware interconnects.
4
Differentiate endpoint hardware security primitives from centralized infrastructure appliances.
Match Hardware Security Modules (HSMs) to centralized enterprise key lifecycle protection and dedicated cryptographic processing.
HSMs function as enterprise-grade hardware appliances engineered specifically for robust key lifecycle management and high-volume operations.

Anahtar Kavram

Hardware primitives, embedded system hardening, and cryptographic boundary protection
Soru 739Soru →

A security analyst inspecting a SIEM alert reviews the following web server access log entries:

text
192.168.45.10 - - [27/Jul/2026:14:20:01 +0000] "GET /profile.php?id=101%20UNION%20SELECT%20username,password_hash%20FROM%20users-- HTTP/1.1" 200 4512
192.168.45.10 - - [27/Jul/2026:14:20:05 +0000] "POST /login.php HTTP/1.1" 200 1250
192.168.45.10 - - [27/Jul/2026:14:20:12 +0000] "GET /admin/config.php HTTP/1.1" 403 280

Which of the following best describes the attack progression shown in the log snippet and the security mechanism reflected by the final entry?

Cevabı ve açıklamayı göster

Cevap: The attacker executed a SQL injection attack to retrieve credentials, successfully authenticated to the application, and was subsequently denied access due to an authorization restriction.

Cevap

The attacker executed a SQL injection attack to retrieve credentials, successfully authenticated to the application, and was subsequently denied access due to an authorization restriction.
The first log entry shows a URL-encoded SQL injection payload (`UNION SELECT username,password_hash FROM users`) that returned HTTP status code 200 OK, indicating successful execution and data extraction. The second entry shows a POST request to the login endpoint returning HTTP status code 200 OK, confirming successful authentication using the compromised credentials. The final entry targeting `/admin/config.php` returned HTTP status code 403 Forbidden, which signifies an authorization control enforcing access boundaries against an authenticated user.

Adım Adım Çözüm

1
Analyze the first log entry for attack indicators
The URL parameters contain `%20UNION%20SELECT%20username,password_hash%20FROM%20users--`, which is a classic SQL injection payload designed to extract credentials from the backend database.
Identifying the initial exploit vector determines how the attacker gained information or access.
2
Examine subsequent requests to trace event sequence
The second request demonstrates a POST request to `/login.php` resulting in HTTP status code 200 OK, indicating successful authentication.
Correlating timestamped log entries establishes the progression from database compromise to active user session.
3
Interpret the HTTP status code of the final request
The third request targets `/admin/config.php` and receives an HTTP 403 Forbidden response.
HTTP 403 Forbidden indicates that while the user's identity is authenticated, they lack the required access permissions (authorization) to view the requested resource.

Anahtar Kavram

Log Analysis and SIEM Correlation across Application Attack Vectors and AAA Controls
Soru 740Soru →

A commercial logistics enterprise is migrating its legacy cargo tracking application to an Infrastructure as a Service (IaaS) environment hosted by a public cloud service provider. During the architecture review, the chief information security officer (CISO) requests clarification on operational security boundaries under the shared responsibility model. Which of the following best describes the security responsibility allocation for this deployment?

Cevabı ve açıklamayı göster

Cevap: The enterprise retains responsibility for guest operating system patching and host-based firewall configurations, while the cloud provider manages physical hardware maintenance and hypervisor updates.

Cevap

The enterprise retains responsibility for guest operating system patching and host-based firewall configurations, while the cloud provider manages physical hardware maintenance and hypervisor updates.
In Infrastructure as a Service (IaaS), the cloud provider is responsible for securing and maintaining the underlying physical facilities, host hardware, storage subsystems, and hypervisor virtualization layer. The cloud customer remains responsible for everything running on top of the hypervisor, including guest operating system installation and patching, host firewalls, middleware, data encryption, and access management.

Adım Adım Çözüm

1
Identify the cloud service model referenced in the scenario.
The scenario specifies an Infrastructure as a Service (IaaS) deployment model.
Security boundaries shift depending on whether the service model is IaaS, PaaS, or SaaS.
2
Apply the Cloud Shared Responsibility Model to the IaaS framework.
The CSP manages physical assets, storage infrastructure, network hardware, and the hypervisor layer. The customer manages guest OS, application security, middleware, network configuration (firewalls/subnets), and identity governance.
In IaaS, virtualized hardware resources are delivered to the customer, leaving software stack maintenance to the subscriber.
3
Evaluate the options against the derived responsibility boundaries.
The option stating the enterprise manages guest OS patching while the CSP manages hypervisors accurately delineates IaaS duties.
This alignment matches CompTIA Security+ standards for cloud security architecture.

Anahtar Kavram

Shared Responsibility Model in IaaS Cloud Deployments
ÖncekiSayfa 37 / 112Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin