Tüm alıştırma soruları

2232 soru

Tüm türler2,232 Çoktan seçmeli1,151 Çoklu seçim509 Sayısal21 Eşleştirme378 Sıralama173

A healthcare enterprise is architecting a storage and data security solution for its electronic health record (EHR) database environment. The design must ensure bulk data at rest remains cryptographically secured without causing significant performance overhead on database queries, while also preventing unauthorized exfiltration of sensitive patient records across endpoint storage interfaces and removable media. Which of the following security controls should the architect integrate to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Deploy symmetric envelope encryption or hardware-accelerated volume encryption (such as AES-256) for the underlying storage subsystem.

Utilize asymmetric RSA-4096 key pairs for bulk block-level encryption of the enterprise database volumes.

Implement endpoint Data Loss Prevention (DLP) software agents to inspect, classify, and enforce contextual blocking on local storage transfers.

Configure perimeter firewalls to generate SHA-256 cryptographic hashes for all outbound data transfers to enforce non-repudiation.

Deploy network-level intrusion detection systems (IDS) as the primary control to prevent bulk data copy operations to external USB drives.

Cevabı ve açıklamayı göster

Cevap: Deploy symmetric envelope encryption or hardware-accelerated volume encryption (such as AES-256) for the underlying storage subsystem.; Implement endpoint Data Loss Prevention (DLP) software agents to inspect, classify, and enforce contextual blocking on local storage transfers.

Cevap

The correct architecture controls are deploying symmetric encryption (such as AES-256) for bulk storage volume protection and implementing endpoint Data Loss Prevention (DLP) agents for endpoint storage exfiltration control.

Protecting bulk data at rest efficiently requires high-speed symmetric ciphers (such as AES-256) at the storage volume level, which ensures strong confidentiality without computational performance degradation. Preventing data exfiltration to endpoint storage devices requires endpoint Data Loss Prevention (DLP) agents that monitor and enforce policy rules on data in use and local storage interfaces.

Adım Adım Çözüm

Analyze storage encryption at rest requirements for high-performance database workloads.

Bulk encryption requires fast, hardware-accelerated symmetric ciphers like AES-256 to avoid severe query latency.

Symmetric ciphers use a single secret key and process bulk data efficiently compared to asymmetric ciphers.

Evaluate data exfiltration protection across endpoint storage and removable media.

Host/endpoint DLP agents inspect content and context on the local machine to block unauthorized transfers to removable storage.

Network-based controls cannot see or restrict local device bus transfers like USB writes.

Anahtar Kavram

Data Protection and Storage Security Architecture

Soru 742Soru →

A security engineering team is implementing an automated threat intelligence platform to exchange structured cyber threat data with an industry ISAC and ingest machine-readable indicators into internal security tools. Which of the following components specifically define the standardized language for expressing threat data and the automated transport protocol for exchanging it? (Select TWO.)

Geçerli olan tümünü seçin

STIX (Structured Threat Information eXpression)

TAXII (Trusted Automated eXchange of Indicator Information)

CVE (Common Vulnerabilities and Exposures)

Honeypot network deployment

Firewall access control list (ACL) rules

Cevabı ve açıklamayı göster

Cevap: STIX (Structured Threat Information eXpression); TAXII (Trusted Automated eXchange of Indicator Information)

Cevap

STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Indicator Information)

Structured Threat Information eXpression defines the standardized schema for representing threat intelligence in a consistent machine-readable format, while Trusted Automated eXchange of Indicator Information defines the automated transport protocol for exchanging that intelligence over HTTPS.

Adım Adım Çözüm

Identify the data representation standard required for machine-readable threat intelligence.

STIX provides the standardized XML/JSON schema for describing cyber threat indicators, threat actors, and attack patterns.

Security tools require a consistent data structure to parse and act upon external threat intelligence automatically.

Identify the transport mechanism designed to deliver structured threat feeds between systems.

TAXII defines the web service specifications and API protocols for securely transferring STIX threat data over HTTPS.

Automated ingestion requires a standardized messaging and transport protocol to push and pull threat data.

Evaluate the incorrect options against threat intelligence sharing specifications.

CVE indexes known software flaws, honeypots gather raw local telemetry via deception, and firewall ACLs enforce traffic policy; none of these serve as threat sharing data formats or transport protocols.

Differentiating threat data representation/transport mechanisms from vulnerability dictionaries, threat collection systems, and network controls ensures proper threat intel pipeline architecture.

Anahtar Kavram

STIX/TAXII Threat Intelligence Standards

Tahmini Süre:1m 30s

Soru 743Soru →

An organization determines that the Single Loss Expectancy (SLE) for a critical server data breach is $40,000. Historical security assessment data indicates an Annual Rate of Occurrence (ARO) of 0.25 for this event. What is the Annual Loss Expectancy (ALE) associated with this risk?

$10,000

$40,000

$160,000

$100,000

Cevabı ve açıklamayı göster

Cevap: $10,000

Cevap

$10,000

The Annual Loss Expectancy (ALE) is determined using the quantitative risk formula ALE = SLE * ARO. Multiplying the Single Loss Expectancy (

40,000) by the Annual Rate of Occurrence (0.25) results in an ALE of

10,000.

Adım Adım Çözüm

Identify the given quantitative metrics from the scenario

Single Loss Expectancy (SLE) = $40,000; Annual Rate of Occurrence (ARO) = 0.25

These variables are the essential inputs for determining annual financial risk.

Apply the quantitative risk assessment formula for Annual Loss Expectancy

ALE = SLE * ARO

ALE measures expected annual financial loss by weighting single incident impact by yearly frequency.

Multiply SLE by ARO

40,000 * 0.25 =

10,000

Performing this calculation yields the expected annual cost of the risk.

Anahtar Kavram

Quantitative Risk Assessment (ALE Calculation)

Soru 744Soru →

A security analyst reviews the following log entry from an internal web proxy gateway:

`2026-07-27T14:22:05Z proxy01 squid[4812]: 10.10.4.15 TCP_DENIED/403 3512 GET http://known-malicious-domain.org/updater.exe - HIER_NONE/- text/html`

Which of the following conclusions can be directly drawn from this log entry? (Select TWO.)

Geçerli olan tümünü seçin

The web proxy successfully blocked the outbound GET request attempt.

The connection attempt originated from the internal IP address 10.10.4.15.

The internal host 10.10.4.15 was successfully infected by updater.exe.

The remote server at known-malicious-domain.org returned an HTTP 200 OK status.

Cevabı ve açıklamayı göster

Cevap: The web proxy successfully blocked the outbound GET request attempt.; The connection attempt originated from the internal IP address 10.10.4.15.

Cevap

The proxy server blocked the outbound GET request attempt, and the connection attempt originated from the internal IP address 10.10.4.15.

Analyzing the log entry fields shows that internal IP 10.10.4.15 attempted to fetch an executable via HTTP GET. The proxy log header records 'TCP_DENIED/403', which demonstrates that the proxy policy triggered an HTTP 403 Forbidden action and prevented the file download.

Adım Adım Çözüm

Identify the source IP address in the log header.

The log lists `10.10.4.15` as the client IP initiating the connection request.

Proxy log formats place the client IP field prior to the action status codes.

Examine the proxy action code and HTTP status code.

The entry displays `TCP_DENIED/403`.

`TCP_DENIED` indicates proxy policy enforcement blocking the traffic, and HTTP code `403` signifies Access Forbidden.

Anahtar Kavram

Web Proxy Log Parsing and Event Status Interpretation

Tahmini Süre:45s

Soru 745Soru →

Match each threat intelligence source type to its primary operational use case or intelligence characteristic in an enterprise security framework.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Open-Source Intelligence (OSINT) matches publicly accessible research repositories; ISAC matches sector-specific peer sharing networks; Dark Web Intelligence matches monitoring of hidden services for credential exposures; Commercial feeds match vendor-managed paid tactical indicator streams.

Each threat intelligence source type is accurately mapped to its primary delivery model and operational scope: OSINT uses public data, ISACs facilitate sector-specific peer collaboration, Dark Web intelligence monitors illicit underground communities, and Commercial feeds provide paid, automated tactical data streams.

Adım Adım Çözüm

Analyze Open-Source Intelligence (OSINT)

Identified as freely available public data, matching open telemetry and code repositories.

OSINT encompasses all publicly available sources requiring no proprietary access.

Analyze Information Sharing and Analysis Centers (ISACs)

Identified as sector-specific peer sharing organizations.

ISACs focus on industry-wide collaborative threat intelligence.

Analyze Dark Web Threat Intelligence

Identified as intelligence gathered from hidden services and illicit market sites.

Dark web monitoring targets underground forums and leaked data.

Analyze Commercial/Proprietary Feeds

Identified as vendor-supplied, paid feeds with high confidence for automated ingestion.

Commercial feeds provide actionable, structured indicators backed by service contracts.

Anahtar Kavram

Classification and Operational Applications of Threat Intelligence Sources

Soru 746Soru →

A security analyst investigating a high-priority SIEM alert reviews the following audit log snippet generated sequentially across cloud control plane services within a 15-second window:

[
{
"eventTime": "2026-07-27T14:22:05Z",
"eventName": "AssumeRole",
"userIdentity": { "type": "AWSAccount", "principalId": "AROA3X921EXAMPLE:session1" },
"sourceIPAddress": "198.51.100.45",
"requestParameters": { "roleArn": "arn:aws:iam::123456789012:role/DevOps-Admin-Role" }
},
{
"eventTime": "2026-07-27T14:22:12Z",
"eventName": "GetSecretValue",
"userIdentity": { "type": "AssumedRole", "principalId": "AROA3X921EXAMPLE:DevOps-Admin-Role" },
"sourceIPAddress": "198.51.100.45",
"requestParameters": { "secretId": "prod/db/credentials" }
},
{
"eventTime": "2026-07-27T14:22:18Z",
"eventName": "CreateAccessKey",
"userIdentity": { "type": "AssumedRole", "principalId": "AROA3X921EXAMPLE:DevOps-Admin-Role" },
"sourceIPAddress": "198.51.100.45",
"requestParameters": { "userName": "backup-svc" }
}
]

Based on these log entries, which of the following best assesses the threat activity and identifies the appropriate SIEM correlation rule tuning strategy?

An adversary assumed an administrative role to harvest database credentials and establish persistence via access key creation; configure a SIEM correlation rule to detect rapid sequences of AssumeRole followed by credential generation from untrusted IP addresses.

A SQL injection attack successfully extracted database secrets; deploy web application firewall (WAF) inspection rules to sanitize HTTP GET parameters on the secrets service endpoint.

An authentication failure occurred due to expired user credentials during IAM login; increase the SIEM alert threshold to trigger only after multiple failed login attempts.

Legitimate automated credential rotation; increase the SIEM correlation rule time window from seconds to hours to filter out operational false positives.

Cevabı ve açıklamayı göster

Cevap: An adversary assumed an administrative role to harvest database credentials and establish persistence via access key creation; configure a SIEM correlation rule to detect rapid sequences of AssumeRole followed by credential generation from untrusted IP addresses.

Cevap

The correct answer accurately identifies the attack chain: an actor leveraged temporary security credentials from an assumed role (AssumeRole) to read sensitive production secrets (GetSecretValue) and immediately created long-term access keys (CreateAccessKey) for persistence. Designing a SIEM correlation rule to monitor tight time windows between role assumption and persistence mechanisms from external IP addresses provides high-fidelity detection for account compromise.

Adım Adım Çözüm

Analyze the event sequence and timestamps in the cloud audit log snippet.

The log shows three distinct events from IP address 198.51.100.45 spanning 13 seconds: AssumeRole, GetSecretValue, and CreateAccessKey.

Tracking event progression across short timestamps reveals automated or rapid post-exploitation behavior.

Evaluate the security impact of each API operation in the context of the cyber attack lifecycle.

AssumeRole elevates permissions, GetSecretValue retrieves production database credentials (credential access), and CreateAccessKey generates long-term API access keys for an existing user account (persistence).

Identifying the specific API actions maps the log events directly to adversary tactics and techniques.

Determine the optimal SIEM correlation rule design to detect this pattern.

A multi-event correlation rule linking identity assumption, secret retrieval, and persistence generation within a tight time frame (e.g., < 60 seconds) effectively alerts on compromised role abuse without generating excessive false positives.

SIEM correlation engines rely on temporal and logical chaining of heterogeneous event types to identify compound threats.

Anahtar Kavram

Cloud Security Log Analysis and Multi-Event SIEM Correlation Rules

Soru 747Soru →

A healthcare organization is refactoring its data architecture to secure sensitive patient diagnostic records stored on a Network Attached Storage (NAS) array. The security requirements dictate that data must be encrypted at rest, key lifecycle operations must be centrally managed and audited, and storage administrators must not have direct access to root cryptographic keys or store them on the local NAS hardware. Which of the following data protection solutions best fulfills these architectural requirements?

Integrate the NAS array with a centralized Key Management Interoperability Protocol (KMIP) server backed by a Hardware Security Module (HSM).

Encrypt the bulk NAS storage volumes using asymmetric RSA keys generated and stored locally on each NAS controller.

Implement stateful network firewall controls and VLAN microsegmentation between the database hosts and the NAS array.

Apply Hash-based Message Authentication Codes (HMAC) across all NAS file system blocks.

Cevabı ve açıklamayı göster

Cevap: Integrate the NAS array with a centralized Key Management Interoperability Protocol (KMIP) server backed by a Hardware Security Module (HSM).

Cevap

Integrate the NAS array with a centralized Key Management Interoperability Protocol (KMIP) server backed by a Hardware Security Module (HSM).

Integrating a storage array with a Key Management Interoperability Protocol (KMIP) server backed by a Hardware Security Module (HSM) ensures bulk data at rest is encrypted using symmetric keys managed through a standardized enterprise protocol. The HSM provides dedicated, tamper-resistant hardware to generate, store, and audit root keys independently of the NAS array and administrators.

Adım Adım Çözüm

Analyze storage encryption and key management requirements.

Identified the need for bulk encryption at rest, centralized key lifecycle administration, and secure key storage isolated from the NAS device.

Storing keys locally on storage arrays introduces security risks and management overhead.

Evaluate key management standards and hardware security controls.

KMIP enables standardized communication between storage devices and centralized key management systems, while HSMs provide tamper-resistant hardware protection for root keys.

Combining KMIP and HSM satisfies both centralized management and secure key storage demands.

Compare against incorrect alternatives.

Asymmetric bulk encryption is computationally impractical, firewall segmentation only addresses network boundary security, and HMACs provide integrity rather than confidentiality.

Only the KMIP and HSM integration meets all requirements for data at rest encryption and secure key management.

Anahtar Kavram

Centralized Storage Key Management and HSM Integration

Soru 748Soru →

A global healthcare organization requires a federated access solution allowing external medical specialists from partner hospitals to query patient diagnostic APIs hosted in its cloud environment. The architecture must ensure partner organizations maintain control over their own user credentials, support identity assertion, enable fine-grained attribute-based access decisions at the API gateway without exposing internal directory services, and avoid establishing persistent network-level perimeter trust. Which architectural combination of identity and authorization frameworks best satisfies these security requirements?

OpenID Connect (OIDC) for user identity assertion combined with OAuth 2.0 access tokens evaluated at the API gateway for authorization

OAuth 2.0 client credentials grant secured by mutual TLS (mTLS) to authenticate external specialists directly against the internal directory

RADIUS federation using EAP-TLS paired with IPsec site-to-site tunnels to establish continuous network access to API endpoints

Kerberos cross-realm trust configured with SAML 2.0 HTTP Artifact Binding to issue local Ticket Granting Tickets for external API access

Cevabı ve açıklamayı göster

Cevap: OpenID Connect (OIDC) for user identity assertion combined with OAuth 2.0 access tokens evaluated at the API gateway for authorization

Cevap

OpenID Connect (OIDC) for user identity assertion combined with OAuth 2.0 access tokens evaluated at the API gateway for authorization

Combining OpenID Connect (OIDC) with OAuth 2.0 directly satisfies federated access, decentralized credential management, and Zero Trust API protection. OIDC acts as the identity layer enabling external Identity Providers (IdPs) to assert user identity using signed JSON Web Tokens (JWTs). OAuth 2.0 provides delegated authorization, passing access tokens containing scopes and claims to the cloud API gateway for fine-grained enforcement without exposing legacy internal directory services or relying on perimeter network connectivity.

Adım Adım Çözüm

Analyze identity federation and credential boundary requirements

External partner organizations must manage their own credentials, requiring an external Identity Provider (IdP) capable of issuing standardized identity assertions.

Direct credential sharing or internal directory registration violates federation architecture principles.

Evaluate API authorization enforcement mechanics

OAuth 2.0 access tokens containing JSON Web Token (JWT) scopes and user claims allow the API gateway to enforce fine-grained attribute-based access control (ABAC).

Application programming interfaces (APIs) require stateless token verification at the gateway layer rather than legacy session cookies or network-level checks.

Synthesize OIDC and OAuth 2.0 roles into the final architecture

OIDC handles the authentication ('who the specialist is') via ID tokens from the partner IdP, while OAuth 2.0 handles authorization ('what APIs the specialist can access') via access tokens.

Combining OIDC for identity assertion with OAuth 2.0 for API access control meets all security, cloud compatibility, and Zero Trust requirements.

Anahtar Kavram

Federated Identity and API Authorization Architecture (OIDC & OAuth 2.0)

Tahmini Süre:3m 0s

Soru 749Soru →

A financial enterprise is deploying a third-party reporting server into a virtualized datacenter. The reporting server requires outbound internet access to fetch external market data, but corporate security policy dictates that it must be strictly prevented from initiating lateral connections to any other internal virtual machines, even those within the same subnet. Which of the following network architecture design solutions best satisfies this requirement?

Implement microsegmentation policies using a software-defined network or host-based firewall rules to control east-west traffic at the hypervisor level.

Position the reporting server in a traditional edge perimeter DMZ and rely on the main enterprise boundary firewall to restrict internal access.

Deploy a dual-homed jump box to proxy management requests from the administration network to the reporting server.

Place the reporting server behind an air-gapped physical network interface to physically isolate all network communications.

Cevabı ve açıklamayı göster

Cevap: Implement microsegmentation policies using a software-defined network or host-based firewall rules to control east-west traffic at the hypervisor level.

Cevap

Implementing microsegmentation policies using software-defined networking or granular host/hypervisor firewall rules provides the necessary east-west traffic control to prevent lateral movement within the same subnet while maintaining required internet connectivity.

Microsegmentation applies granular, software-defined security policies at the individual workload or hypervisor level. This enables strict filtering of east-west traffic, preventing the reporting server from initiating connections to adjacent internal virtual machines regardless of network topology, while allowing specific outbound north-south internet traffic.

Adım Adım Çözüm

Analyze the operational and security requirements

The server needs outbound internet connectivity (north-south traffic), but must not initiate lateral connections to adjacent internal systems (east-west traffic), including hosts on its local subnet.

Security controls must enforce granular isolation without severing required external communications.

Evaluate segmentation methodologies against lateral traffic control

Traditional subnets and perimeter DMZs permit uninspected traffic between hosts within the same VLAN/subnet. Air-gapping severs all connectivity including required internet access.

Microsegmentation abstracts security policies down to individual workloads or hypervisors, enabling zero-trust east-west filtering.

Select the optimal architecture control

Microsegmentation policies effectively isolate the host from lateral peers while permitting intended outbound paths.

This satisfies both PCI/enterprise compliance rules and functional requirements.

Anahtar Kavram

Microsegmentation and East-West Traffic Isolation

Soru 750Soru →

A storage administrator is configuring security mechanisms for sensitive database volumes hosted on an enterprise Storage Area Network (SAN). The administrator needs to protect data at rest with hardware-accelerated bulk encryption and ensure that top-level encryption keys are managed in a tamper-resistant environment. Which of the following technologies should the administrator deploy? (Select TWO.)

Geçerli olan tümünü seçin

Self-Encrypting Drives (SEDs) to perform automatic hardware-based disk encryption

Hardware Security Modules (HSMs) to generate and securely store root keying material

Asymmetric RSA-4096 algorithms to encrypt all underlying storage blocks

Inline network firewalls to block unauthorized Fibre Channel LUN access

Digital signatures applied to storage arrays to enforce data non-repudiation

Cevabı ve açıklamayı göster

Cevap: Self-Encrypting Drives (SEDs) to perform automatic hardware-based disk encryption; Hardware Security Modules (HSMs) to generate and securely store root keying material

Cevap

The administrator should deploy Self-Encrypting Drives (SEDs) for hardware bulk encryption and Hardware Security Modules (HSMs) for root key management.

Deploying Self-Encrypting Drives (SEDs) ensures bulk data on physical media is transparently encrypted at rest with minimal performance impact. Utilizing Hardware Security Modules (HSMs) ensures master encryption keys are generated, stored, and managed inside dedicated, tamper-resistant cryptographic hardware.

Adım Adım Çözüm

Identify the requirement for hardware-accelerated bulk data encryption at rest.

Self-Encrypting Drives (SEDs) handle transparent, high-speed symmetric encryption at the drive controller level.

Bulk storage requires symmetric hardware ciphers like AES to maintain performance without host CPU overhead.

Identify the key management requirement for securing top-level encryption keys.

Hardware Security Modules (HSMs) isolate and safeguard key generation and key protection operations.

Centralized, tamper-resistant HSM devices ensure encryption keys are protected outside system memory.

Anahtar Kavram

Storage Security Architecture: Data at Rest Encryption and Key Management

Soru 751Soru →

A financial enterprise is decommissioning a multi-tenant cloud storage array containing sensitive personally identifiable information (PII) stored across encrypted block volumes. The architecture relies on envelope encryption where unique Data Encryption Keys (DEKs) are wrapped by Key Encryption Keys (KEKs) managed inside a Key Management Interoperability Protocol (KMIP)-compliant Hardware Security Module (HSM). The compliance team mandates immediate, verifiable data sanitization before the physical storage media is recycled by the provider, but traditional multi-pass disk overwriting would exceed bandwidth limits and disrupt SAN performance. Which of the following storage security architectural approaches best satisfies these operational and compliance constraints?

Perform cryptographic erasure by zeroizing and securely deleting the wrapping Key Encryption Keys from the central Hardware Security Module.

Re-encrypt the bulk storage volumes using asymmetric 4096-bit RSA public key pairs prior to volume detachment.

Configure restrictive Fibre Channel SAN zoning and LUN masking rules to isolate the targeted storage volumes at the storage network layer.

Deploy inline Data Loss Prevention agents on storage controllers to audit and block external data read requests during decommissioning.

Cevabı ve açıklamayı göster

Cevap: Perform cryptographic erasure by zeroizing and securely deleting the wrapping Key Encryption Keys from the central Hardware Security Module.

Cevap

Perform cryptographic erasure by zeroizing and securely deleting the wrapping Key Encryption Keys from the central Hardware Security Module.

Cryptographic erasure (crypto-shredding) is the process of deliberately deleting or zeroizing the cryptographic keys (specifically the KEKs or DEKs) used to protect encrypted data. In an envelope encryption architecture backed by an HSM, destroying the wrapping Key Encryption Key makes it mathematically impossible to recover the Data Encryption Keys or the block storage ciphertext, satisfying standards such as NIST SP 800-88 without generating heavy disk I/O.

Adım Adım Çözüm

Analyze operational and compliance requirements for storage media sanitization

Determined that physical overwrite operations (such as NIST 800-88 Clear/Purge via multi-pass zeroing) are unfeasible due to SAN throughput constraints.

Sanitization must be executed instantly at the cryptographic boundary.

Evaluate the key hierarchy within the envelope encryption model

DEKs encrypt the raw data blocks, while KEKs protect the DEKs within the HSM. Without access to the KEK, wrapped DEKs cannot be decrypted.

Destroying the root KEK permanently breaks the cryptographic trust chain.

Select Cryptographic Erasure (Crypto-Shredding) as the target control

Zeroizing key material in the KMIP HSM renders the data mathematically unrecoverable, fulfilling media sanitization requirements.

Crypto-shredding guarantees sanitization even if the physical media is later repurposed or retained by a third-party cloud provider.

Anahtar Kavram

Cryptographic Erasure (Crypto-Shredding) and Key Management Architecture

Soru 752Soru →

A security administrator is documenting high-availability and business continuity metrics for an organization's core infrastructure. Match each availability metric on the left with its corresponding description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Recovery Time Objective (RTO) matches the maximum targeted duration to restore a system; Recovery Point Objective (RPO) matches the maximum acceptable amount of data loss measured in time; Mean Time Between Failures (MTBF) matches the average expected operational time between breakdowns; Mean Time to Repair (MTTR) matches the average duration required to troubleshoot and repair a failed component.

Recovery Time Objective (RTO) represents the target time to bring systems back online. Recovery Point Objective (RPO) defines maximum tolerated data loss measured in time. Mean Time Between Failures (MTBF) measures system component reliability and expected operational runtime between crashes. Mean Time to Repair (MTTR) quantifies the average duration needed to repair and restore a failed item.

Adım Adım Çözüm

Identify metrics measuring service recovery speed and acceptable data loss.

RTO focuses on duration until service availability is restored, while RPO focuses on acceptable data loss window.

Differentiating time-to-restore (RTO) from data loss tolerance (RPO) is essential for disaster recovery planning.

Identify metrics measuring hardware/system reliability and repair time.

MTBF measures expected operational uptime between failures, while MTTR measures the duration required to fix a failure.

Understanding hardware reliability metrics helps establish realistic availability baselines and SLA expectations.

Anahtar Kavram

Business Impact and High Availability Metrics

Tahmini Süre:1m 0s

Soru 753Soru →

A biomedical engineering department at a regional hospital plans to integrate networked smart infusion pumps into the facility's network. To minimize the threat of malware spreading laterally from compromised medical devices to critical electronic health record (EHR) databases while still allowing automated telemetry collection by central servers, which network architecture control should the security team implement?

Place the medical devices into an isolated network segment enforced by firewalls that restrict traffic solely to authorized telemetry collector endpoints.

Connect the medical devices directly to the internal enterprise subnet while relying on perimeter firewalls to block external malicious traffic.

Implement a complete physical air gap around the medical devices, disconnecting them entirely from all corporate and monitoring networks.

Deploy a passive Network Intrusion Detection System (NIDS) tap as a preventive isolation control between the medical devices and the core network.

Cevabı ve açıklamayı göster

Cevap: Place the medical devices into an isolated network segment enforced by firewalls that restrict traffic solely to authorized telemetry collector endpoints.

Cevap

Place the medical devices into an isolated network segment enforced by firewalls that restrict traffic solely to authorized telemetry collector endpoints.

Placing the medical devices into a dedicated, firewall-enforced network segment (such as a restricted VLAN or microsegment) isolates potentially vulnerable hardware while permitting explicitly defined, unidirectional or limited telemetry traffic to monitoring servers. This enforces the principle of least privilege at the network level and contains lateral threat propagation.

Adım Adım Çözüm

Analyze the operational and security requirements

The medical devices require network connectivity for automated telemetry collection, but lateral access to sensitive EHR databases must be strictly prevented.

Security controls must balance operational availability with risk mitigation against lateral movement.

Evaluate segmentation strategies

Network segmentation via dedicated VLANs and stateful firewall policies isolates high-risk medical IoT equipment while allowing controlled East-West communications strictly to designated telemetry servers.

Proper zone isolation limits breach blast radiuses and prevents unauthorized lateral network traversal.

Anahtar Kavram

Secure Network Design and Segmentation

Soru 754Soru →

A enterprise security architect is configuring an automated cross-region database failover workflow between two active-passive data centers to maintain zero Recovery Point Objective (RPO) and minimal Recovery Time Objective (RTO) during an ungraceful outage. Arrange the operational steps of the automated failover sequence in the correct chronological order from first step executed to final step completed.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence for automated database failover is: 1) Evaluate cluster quorum consensus via an independent witness site; 2) Execute node fencing (STONITH) to forcibly isolate the failed primary database; 3) Verify write-ahead log sequence numbers (LSN) on the standby node; 4) Promote the standby database instance to read-write state; 5) Update Global Server Load Balancing (GSLB) health checks and DNS records.

The sequence follows standard high-availability resiliency protocols: Cluster quorum must first be established to prevent split-brain, followed immediately by STONITH fencing of the legacy node. Once fenced, data consistency (LSN sync) must be verified on the target node before promoting it to primary. Finally, global network routing (GSLB/DNS) is updated to steer client traffic to the newly active environment.

Adım Adım Çözüm

Quorum Validation

Cluster consensus confirmed via witness node.

Prevents split-brain scenarios where both nodes concurrently assume primary role.

Node Fencing

Unresponsive primary node isolated and write privileges revoked.

Guarantees data integrity and prevents corrupting writes from a flapping primary server.

Log Sequence Synchronization Audit

Standby database confirms all synchronous transactions are committed.

Ensures adherence to the zero Recovery Point Objective (RPO) requirement before promotion.

Node Promotion

Secondary database becomes active write target.

Establishes a functional database primary capable of accepting new application transactions.

Traffic Redirection

GSLB points application requests to the newly promoted site.

Completes failover by restoring service availability to end clients.

Anahtar Kavram

High-Availability Failover & Fencing Sequences

Soru 755Soru →

An enterprise organization operates two data centers connected via a low-latency dark fiber link. The business continuity requirement mandates a strict Recovery Point Objective of zero ( $RPO = 0$ ) for transactional database records during a primary site outage, while simultaneously preventing split-brain conditions during automated failover. Which of the following high-availability storage configurations best satisfies these requirements?

Synchronous storage replication configured with an independent quorum witness node

Local RAID 10 array implemented with dual redundant storage controllers and multipath I/O

Asynchronous storage replication combined with dynamic server load balancing

Cold site infrastructure restored continuously via differential snapshot backups

Cevabı ve açıklamayı göster

Cevap: Synchronous storage replication configured with an independent quorum witness node

Cevap

Synchronous storage replication configured with an independent quorum witness node provides real-time zero data loss (RPO = 0) across sites while avoiding split-brain split scenarios during automated failovers.

Synchronous storage replication guarantees that data is written to both storage systems before completing the transaction, satisfying the strict requirement of zero data loss (

RPO = 0

). Adding a quorum witness node located outside the main data path provides cluster state verification, preventing split-brain conditions where both sites attempt to take control independently.

Adım Adım Çözüm

Analyze the RPO requirement

An RPO of zero (

RPO = 0

) requires zero data loss, necessitating synchronous replication where write acknowledgments occur only after data is written to both primary and secondary storage targets.

Asynchronous methods acknowledge writes before secondary persistence, allowing data loss gaps.

Evaluate high availability and failover mechanism constraints

Automated multi-site failover requires a third-party witness or quorum device outside the two replication endpoints.

Without a quorum witness, network interruptions between sites cause both nodes to assume primary status, leading to data corruption via split-brain state.

Select the optimal architectural control

Synchronous replication with a quorum witness satisfies both zero data loss and safe failover constraints.

It addresses both the data preservation requirement (

RPO = 0

) and the operational failover constraint.

Anahtar Kavram

Synchronous Replication and Quorum Clustering for Zero RPO High Availability

Soru 756Soru →

An aerospace security architecture team is designing a satellite communications (SATCOM) avionics gateway for autonomous aircraft. The gateway will operate in environments susceptible to physical interception, probe attacks, and firmware tampering. To meet stringent safety standards, the hardware must establish an immutable boot verification chain and prevent physical extraction of secret keys stored in memory. Which TWO of the following hardware security controls should the team implement to satisfy these architecture requirements? (Select TWO)

Geçerli olan tümünü seçin

Integrating a hardware Root of Trust (RoT) backed by a Trusted Platform Module (TPM) to validate cryptographic measurements during every stage of the boot sequence.

Leveraging Physically Unclonable Functions (PUFs) to dynamically derive cryptographic keys from silicon micro-structure variations rather than storing static key material in non-volatile memory.

Configuring kernel-level Mandatory Access Control (MAC) policies within the operating system to prevent unauthorized processes from modifying system binaries.

Deploying an inline hardware Intrusion Prevention System (IPS) module on the internal communication bus to filter malicious memory packets.

Cevabı ve açıklamayı göster

Cevap: Integrating a hardware Root of Trust (RoT) backed by a Trusted Platform Module (TPM) to validate cryptographic measurements during every stage of the boot sequence.; Leveraging Physically Unclonable Functions (PUFs) to dynamically derive cryptographic keys from silicon micro-structure variations rather than storing static key material in non-volatile memory.

Cevap

The correct controls to implement are integrating a hardware Root of Trust backed by a Trusted Platform Module (TPM) for boot validation and leveraging Physically Unclonable Functions (PUFs) for tamper-resistant key generation.

Establishing a hardware Root of Trust (RoT) using a cryptoprocessor such as a Trusted Platform Module (TPM) ensures that every stage of boot firmware is verified against cryptographically secure measurement hashes before execution. Furthermore, Physically Unclonable Functions (PUFs) leverage unique semiconductor manufacturing variations to generate cryptographic keys dynamically, preventing attackers from physically extracting static keys from non-volatile memory via chip decapsulation or microprobing.

Adım Adım Çözüm

Identify the core security requirements established in the scenario.

The requirements are establishing an immutable boot verification chain and protecting cryptographic keys from physical memory extraction and reverse engineering.

Hardware security architecture requires aligning specific physical mechanisms with their corresponding threat vectors.

Evaluate mechanisms for establishing an immutable boot verification chain.

A Trusted Platform Module (TPM) providing a hardware Root of Trust (RoT) measures and validates each stage of the boot sequence (Secure Boot / Measured Boot).

Hardware-level cryptoprocessors enforce trust starting at power-on before any untrusted software runs.

Evaluate mechanisms for securing cryptographic key storage against physical extraction.

Physically Unclonable Functions (PUFs) generate unique cryptographic keys on the fly using tiny manufacturing variations in the silicon chip, eliminating the need to store static keys in flash or EEPROM memory.

If physical keys are never stored at rest in memory circuits, physical probing or decap attacks cannot extract them.

Anahtar Kavram

Hardware Root of Trust & Silicon-Level Key Protection

Tahmini Süre:2m 0s

Soru 757Soru →

An enterprise security team is upgrading its data protection and storage security architecture to protect sensitive databases and block storage volumes across on-premises SAN and cloud environments. The architect needs to implement controls that ensure centralized key governance for encrypted storage, isolate storage network traffic to authorized hosts, and prevent unauthorized exfiltration of sensitive files from endpoints. Which of the following technical controls should the architect implement to meet these storage security requirements? (Select THREE)

Geçerli olan tümünü seçin

Deploy dedicated Hardware Security Modules (HSMs) to manage master encryption keys and secure volume envelope encryption key hierarchies.

Configure Storage Area Network (SAN) LUN masking and Fibre Channel zoning to restrict logical unit access strictly to authorized servers.

Deploy endpoint Data Loss Prevention (DLP) agents to monitor, detect, and block unauthorized copying of sensitive storage data to removable media or cloud shares.

Implement asymmetric RSA-4096 algorithms for direct bulk disk block encryption to maximize storage write throughput.

Apply stateless perimeter router access control lists (ACLs) to remediate memory buffer overflow vulnerabilities in host storage controller software.

Cevabı ve açıklamayı göster

Cevap: Deploy dedicated Hardware Security Modules (HSMs) to manage master encryption keys and secure volume envelope encryption key hierarchies.; Configure Storage Area Network (SAN) LUN masking and Fibre Channel zoning to restrict logical unit access strictly to authorized servers.; Deploy endpoint Data Loss Prevention (DLP) agents to monitor, detect, and block unauthorized copying of sensitive storage data to removable media or cloud shares.

Cevap

The enterprise must deploy Hardware Security Modules (HSMs) for centralized encryption key governance, configure SAN LUN masking and Fibre Channel zoning for storage access isolation, and implement endpoint Data Loss Prevention (DLP) agents to prevent unauthorized data exfiltration.

Hardware Security Modules (HSMs) safeguard master cryptographic keys used in envelope encryption for storage volumes. SAN LUN masking and Fibre Channel zoning provide network and logical isolation ensuring only authorized servers mount specific storage drives. Endpoint Data Loss Prevention (DLP) inspects file actions and blocks unauthorized data exfiltration.

Adım Adım Çözüm

Identify key management requirements for storage encryption

Deploying an HSM provides secure, centralized storage and lifecycle management for volume encryption keys.

Bulk storage encryption relies on robust master key management to prevent key exposure.

Determine storage network segmentation and access control mechanisms

Configuring Fibre Channel zoning and SAN LUN masking restricts host connectivity to explicitly assigned storage logical units.

Without isolation, unauthorized SAN hosts could access sensitive block storage volumes.

Select data exfiltration prevention controls for endpoints

Deploying endpoint DLP monitors and enforces policy rules on sensitive files stored on endpoints.

DLP inspects data contents and prevents unauthorized transfers to external media or network locations.

Anahtar Kavram

Data Protection and Storage Security Architecture Controls

Soru 758Soru →

A security technician analyzing network packet captures following a reported credential compromise notes that multiple workstations are issuing UDP port 5355 multicast requests after failing standard DNS name resolution for local resources. Immediately following each multicast query, an unauthorized host on the local subnet returns spoofed name resolution responses, directing the victim workstations to initiate SMB authentication over TCP port 445 to the attacker's machine. Which of the following technical indicators specifically confirm the presence of this attack? Select TWO.

Geçerli olan tümünü seçin

Unicast UDP port 5355 responses sent by a single non-authoritative host answering broadcast requests for internal server names

Frequent ICMPv6 Type 134 Router Advertisement packets altering default gateway routes across local VLAN segments

Unsolicited SMB NTLMv2 challenge-response hash transmissions routed to an unauthorized internal IP address

Repeated 802.11 management frames containing Reason Code 7 directed at authenticated wireless endpoints

Cevabı ve açıklamayı göster

Cevap: Unicast UDP port 5355 responses sent by a single non-authoritative host answering broadcast requests for internal server names; Unsolicited SMB NTLMv2 challenge-response hash transmissions routed to an unauthorized internal IP address

Cevap

The correct indicators are unicast UDP port 5355 responses sent by a non-authoritative host answering broadcast queries for internal names, and unsolicited SMB NTLMv2 challenge-response hash transmissions routed to an unauthorized internal IP address.

The scenario describes LLMNR (Link-Local Multicast Name Resolution) poisoning. When Windows clients fail standard DNS resolution, they broadcast LLMNR queries on UDP port 5355. An attacker operating a listener responds with spoofed unicast replies. When the victim client attempts to connect to the target resource via SMB, it sends its NTLMv2 challenge-response hash to the attacker's machine.

Adım Adım Çözüm

Identify the primary name resolution protocol associated with UDP port 5355 multicast traffic.

UDP 5355 corresponds to Link-Local Multicast Name Resolution (LLMNR), which endpoints use when DNS lookup fails.

Recognizing port-protocol mappings establishes the baseline vulnerability mechanism.

Analyze how an attacker exploits failed name resolution over local multicast.

An attacker listens for multicast queries and immediately responds with spoofed unicast answers claiming to be the requested resource.

This confirms LLMNR poisoning as the initial access indicator.

Trace the subsequent protocol activity triggered by the spoofed name resolution.

Victim systems connect to the attacker's IP over SMB (TCP 445) and attempt authentication, transmitting NTLMv2 hashes to the rogue host.

This establishes the secondary credential harvesting indicator.

Anahtar Kavram

LLMNR/NBT-NS Poisoning and Credential Harvesting Indicators

Tahmini Süre:1m 30s

Soru 759Soru →

An enterprise security architecture team is evaluating cloud deployment and service models for a multi-cloud initiative. Match each operational requirement on the left with the most appropriate cloud architecture or service model on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

1. Custom legacy database requiring physical host isolation -> Private Cloud (IaaS); 2. Web services with provider-managed runtime and OS patching -> Platform as a Service (PaaS); 3. Transient event-driven code execution -> Serverless (FaaS); 4. Co-hosted platform shared by partner financial institutions -> Community Cloud.

Matching each requirement accurately aligns business demands with cloud service abstraction boundaries. Private Cloud (IaaS) provides dedicated hardware control; PaaS offloads OS/runtime maintenance while hosting persistent apps; Serverless (FaaS) executes code transiently without server management; and Community Cloud serves multi-organizational groups sharing specific compliance and functional goals.

Adım Adım Çözüm

Analyze the hardware and control requirements for the database scenario.

Identified direct hardware control, hypervisor management, and physical isolation as characteristics of Private Cloud (IaaS).

IaaS provides maximum architectural control to the organization, while private deployment guarantees dedicated isolation.

Evaluate the management boundary for web services with managed runtime and OS patching.

Identified abstraction of OS and runtime environment as characteristics of PaaS.

Under PaaS, the provider handles infrastructure maintenance and middleware, leaving application code to the consumer.

Examine the operational mechanics of transient event-triggered microservices.

Matched zero-server management and event execution to Serverless (FaaS).

FaaS abstracts server instances completely, executing logic on demand in response to events.

Determine the cloud deployment model for joint industry collaboration under common compliance standards.

Matched shared infrastructure between partner institutions to Community Cloud.

Community clouds are designed for multi-tenant access restricted to organizations bound by shared mission goals or compliance standards.

Anahtar Kavram

Cloud Deployment Models and Shared Responsibility Boundaries

Soru 760Soru →

An aerospace engineering organization has implemented Zero Trust Architecture (ZTA) controls for engineers accessing proprietary CAD schematics stored in a hybrid cloud repository. During an active remote session from a corporate laptop, the security monitoring system detects that the local endpoint protection agent was disabled and the asset's dynamic risk score surged. Although the engineer successfully completed multi-factor authentication (MFA) at session initiation, access to the repository is revoked instantly. Which Zero Trust Architecture core principle is directly demonstrated by this access enforcement action?

Continuous verification and dynamic risk assessment throughout the session lifecycle

Implicit trust placement within internal subnets once multi-factor authentication is validated

Perimeter-based identity authorization with static role assignments for corporate assets

Network-level compensating controls enforced at the boundary firewall following identity assertion

Cevabı ve açıklamayı göster

Cevap: Continuous verification and dynamic risk assessment throughout the session lifecycle

Cevap

Continuous verification and dynamic risk assessment throughout the session lifecycle

The scenario demonstrates immediate access termination when a client device's security posture degrades mid-session. Under Zero Trust Architecture principles, explicit verification must occur continuously rather than once at initial authentication. Policy Decision Points (PDPs) evaluate real-time contextual signals—such as endpoint health, user risk score, and system compliance—to adjust or revoke access dynamically throughout the connection lifecycle.

Adım Adım Çözüm

Analyze the access control trigger and response described in the scenario.

Access was granted following MFA, but was dynamically terminated mid-session due to host security posture degradation (disabled protection agent and spiked risk score).

Understanding why access was altered mid-session identifies the specific operational policy logic.

Evaluate the action against Zero Trust Architecture principles.

Zero Trust dictates that authentication and authorization are never static events; Policy Decision Points (PDPs) must continuously re-evaluate sessions using dynamic context and real-time security signals.

This contrasts with legacy security architectures that assume trusted status after initial authentication.

Select the option that accurately describes this architectural behavior.

The concept of continuous verification and dynamic risk assessment throughout the session lifecycle correctly describes immediate revocation upon host posture decay.

It explicitly captures the core ZTA tenet of continuous re-assessment without relying on implicit, persistent session trust.

Anahtar Kavram

Continuous Verification and Dynamic Context-Based Access Control

Tahmini Süre:1m 30s

ÖncekiSayfa 38 / 112Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram