Examkin

Tüm alıştırma soruları

2232 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 761Soru →

A system administrator is upgrading a mission-critical server to eliminate single points of failure. The server hardware is equipped with dual hot-swappable power supply units. To ensure continuous operation even if a primary utility feed fails, which of the following configuration controls should the administrator implement?

Cevabı ve açıklamayı göster

Cevap: Connect each power supply unit to an independent power circuit fed by a separate Uninterruptible Power Supply (UPS).

Cevap

Connecting each power supply unit to an independent power circuit fed by a separate Uninterruptible Power Supply (UPS).
Connecting dual hot-swappable power supplies to independent electrical circuits and separate UPS units eliminates single points of failure at the power layer. If one power source or supply fails, the remaining supply maintains system power without causing downtime.

Adım Adım Çözüm

1
Identify the potential single point of failure described in the scenario.
The risk is an electrical power circuit or power supply failure affecting server uptime.
Dual power supply units are present, but if both are plugged into the same power distribution source, an outage on that circuit will cause total downtime.
2
Evaluate hardware fault tolerance mechanisms for power infrastructure.
Connecting each PSU to distinct electrical circuits backed by independent UPS units guarantees redundant power paths.
If one circuit or UPS fails, the second PSU continues drawing power seamlessly without interruption.

Anahtar Kavram

Power Infrastructure Redundancy and Fault Tolerance
Tahmini Süre:1m 0s
Soru 762Soru →

During a network security monitoring session, an analyst receives alerts indicating that an enterprise layer 2 switch is broadcasting unicast frames meant for a specific server out of all active switch ports. Inspection of the switch switchport log shows a single interface generating thousands of inbound Ethernet frames per second, each containing unique, rapidly changing source MAC addresses. Which of the following network attacks is taking place?

Cevabı ve açıklamayı göster

Cevap: MAC flooding designed to overflow the switch CAM table and force traffic to fail open like a hub

Cevap

The attack taking place is MAC flooding designed to overflow the switch CAM table and force traffic to fail open like a hub.
The correct answer identifies MAC flooding. In a MAC flooding attack, an adversary sends a massive volume of Ethernet frames with randomized source MAC addresses to a switch port. This rapidly exhausts the finite storage space in the switch Content Addressable Memory (CAM) table. Once full, the switch can no longer store valid MAC-to-port mappings and reverts to a fail-open mode, broadcasting all incoming unicast frames out of every active port, which allows the attacker to capture traffic intended for other endpoints.

Adım Adım Çözüm

1
Analyze the observed technical indicators in the switch logs.
The log shows a single port transmitting thousands of frames per second with randomized source MAC addresses.
Rapidly generated unique MAC addresses target the limited storage capacity of the switch's Content Addressable Memory (CAM) table.
2
Evaluate the resulting switch behavior.
The switch is broadcasting unicast frames out of all physical ports.
When the CAM table becomes completely full, the switch cannot learn new MAC entries and defaults to broadcasting (failing open) so traffic can still reach its destination, allowing sniffing of unicast traffic.
3
Match the observed symptoms to the correct attack classification.
MAC flooding (CAM table overflow).
This behavior is the classic signature of a MAC flooding attack.

Anahtar Kavram

MAC Flooding and Switch Fail-Open Behavior
Soru 763Soru →

A senior security architect is auditing an enterprise data center infrastructure to eliminate single points of failure (SPOFs) and ensure compliance with strict uptime service level agreements (SLAs). Match each hardware or operational redundancy mechanism to its corresponding technical implementation objective.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Multipathing (MPIO)
Dual Power Supplies with Independent PDU Feeds
NIC Teaming (802.3ad LACP)
Asynchronous Multi-Site Storage Replication

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Multipathing (MPIO) matches maintaining redundant block-level I/O paths between host HBAs and SAN storage; Dual Power Supplies with Independent PDU Feeds matches mitigating electrical breaker trips and rack-level PDU disruptions; NIC Teaming (802.3ad LACP) matches aggregating physical Ethernet interfaces for Layer 2 failover; Asynchronous Multi-Site Storage Replication matches regional disaster protection over WAN links with non-zero RPO.
Each architectural control fulfills a distinct redundancy layer (storage I/O, electrical infrastructure, network interface aggregation, or disaster recovery site replication) without overlapping scope.

Adım Adım Çözüm

1
Analyze storage path redundancy requirements.
Multipathing (MPIO) provides host-to-SAN fault tolerance across redundant controllers and Fibre Channel/iSCSI paths.
MPIO operates at the block storage driver layer rather than standard network link aggregation.
2
Evaluate electrical fault tolerance controls.
Dual power supplies plugged into separate PDUs isolate electrical component failures.
Decoupling electrical circuits guarantees continuous host operation if a circuit or PDU encounters a fault.
3
Examine network link-layer resilience mechanisms.
NIC Teaming (802.3ad LACP) binds interface cards for switch port failover and link load distribution.
LACP aggregates physical Ethernet links to eliminate single cable or port failures.
4
Determine geographic site replication parameters.
Asynchronous replication allows multi-site protection across long distances without application latency degradation.
Because network latency over WAN prohibits zero-RPO synchronous commits, asynchronous transfer allows local writes to complete immediately.

Anahtar Kavram

Infrastructure Resilience and Redundancy Controls
Soru 764Soru →

An defense contractor is engineering autonomous marine surveying submersibles deployed in untrusted oceanic regions. The vehicle onboard processing unit must generate device-unique cryptographic keys for encrypting collected telemetry. To resist sophisticated physical tamper attacks—such as silicon chip decapsulation, focused ion beam microprobing, and non-volatile memory readout if a submersible is captured—the keying material must not exist as stored digital bits anywhere on physical media when powered off. Which hardware security technology should be implemented to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: A Physically Unclonable Function (PUF) embedded within the system-on-chip silicon

Cevap

A Physically Unclonable Function (PUF) embedded within the system-on-chip silicon
A Physically Unclonable Function (PUF) leverages microscopic physical variations inherent in semiconductor manufacturing to generate unique cryptographic keys on demand. Because the key is derived dynamically from physical silicon properties rather than stored as persistent binary data in non-volatile memory, an attacker cannot extract key material even when performing physical chip decapsulation or direct microprobing.

Adım Adım Çözüm

1
Analyze the threat model and physical constraints presented in the scenario.
The device operates autonomously without network access and faces physical capture, including physical silicon decapsulation and microprobing threats.
Understanding the physical attack vector dictates whether logical, discrete, or silicon-level key generation controls are required.
2
Evaluate key storage mechanics across candidate hardware components.
TPMs, TEEs, and standard non-volatile storage rely on persistent binary representations of keys, whereas a PUF derives keys dynamically from silicon manufacturing variations.
If keys are never stored as binary states in flash memory, physical memory extraction and decapsulation attacks cannot yield the key material.
3
Select the hardware mechanism that satisfies both offline operation and anti-decapsulation physical security.
The Physically Unclonable Function (PUF) fulfills all physical anti-tamper and dynamic key generation requirements.
PUF acts as a digital fingerprint of the silicon chip, synthesizing cryptographic keys only during runtime.

Anahtar Kavram

Physically Unclonable Functions (PUF) and Hardware Root of Trust Anti-Tamper Mechanisms
Tahmini Süre:2m 0s
Soru 765Soru →

An enterprise automated distribution center utilizes networked Industrial Internet of Things (IIoT) controllers for material handling equipment. The security architecture team must enable the corporate enterprise resource planning (ERP) platform to exchange telemetry and commands with the IIoT controllers while preventing compromised IIoT devices from traversing laterally into corporate endpoints. Which of the following network design controls should the security team implement? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Place IIoT controllers into a dedicated microsegmented network zone governed by strict East-West access control policies.; Deploy an inline Next-Generation Firewall (NGFW) performing stateful protocol inspection between the corporate ERP network and the IIoT zone.

Cevap

The security team should implement dedicated microsegmentation for IIoT devices with East-West access policies, and deploy an inline Next-Generation Firewall (NGFW) performing stateful protocol inspection between the corporate ERP network and the IIoT zone.
Placing IIoT controllers into a microsegmented zone enforces strict East-West control policies, preventing unauthorized lateral movement if one device is breached. Deploying an inline Next-Generation Firewall (NGFW) between the corporate ERP network and the IIoT zone ensures rigorous stateful North-South inspection and protocol filtering across boundary zones.

Adım Adım Çözüm

1
Identify the primary traffic flows and risks
North-South traffic flows between ERP and IIoT; East-West traffic flows between individual IIoT controllers.
Isolation requires distinct controls for lateral movement and zone-boundary transit.
2
Select intra-zone isolation mechanism
Microsegmentation with granular access control policies.
Prevents compromised IIoT endpoints from pivoting to neighboring controllers.
3
Select inter-zone perimeter enforcement mechanism
Inline Next-Generation Firewall (NGFW) with deep packet inspection.
Ensures stateful inspection and validation of telemetry/command protocols traversing between corporate and IIoT zones.

Anahtar Kavram

Secure Network Design and Microsegmentation
Soru 766Soru →

A university is expanding its online video streaming platform by establishing a hybrid cloud architecture. The IT security team deploys virtual machines within a public cloud Infrastructure as a Service (IaaS) tenant to handle high-throughput video transcoding workloads, while maintaining student academic records within an on-premises datacenter. Which of the following operational security responsibilities fall solely on the university's internal security team for the public cloud IaaS components? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring guest operating system network firewalls and installing OS-level security patches; Defining access control policies and identity permissions for video data storage buckets and application users

Cevap

The university's internal security team is solely responsible for configuring guest operating system firewalls and applying OS patches, as well as managing access control policies for application data and identity permissions.
In Infrastructure as a Service (IaaS), the cloud provider manages the physical infrastructure, facility security, hardware, and hypervisor layer. The customer retains full responsibility for managing the guest operating systems (including OS firewall rules and patch management) and defining access control and identity permissions for data assets stored within the cloud environment.

Adım Adım Çözüm

1
Analyze the cloud service model referenced in the scenario.
The infrastructure uses Infrastructure as a Service (IaaS).
Determining the service model establishes the baseline division of duties in the Shared Responsibility Model.
2
Delineate customer responsibilities from cloud service provider (CSP) responsibilities in IaaS.
The CSP manages physical facility security, host hardware, and the hypervisor layer. The customer manages guest OS, middleware, runtime applications, network security controls on the VM, and data access policies.
IaaS leaves all operating system management and data protection under the customer's operational scope.
3
Identify the two options matching the customer's operational scope.
Guest OS firewalling/patching and data/identity access control policy configuration are customer duties.
These activities align directly with customer-owned layers in IaaS architecture.

Anahtar Kavram

Cloud Shared Responsibility Model in IaaS Environments
Soru 767Soru →

A biomedical research enterprise is migrating its hybrid cloud infrastructure to align with Zero Trust Architecture (ZTA) principles to protect sensitive patient records and proprietary research data. Which of the following architectural strategies MUST the security engineering team implement to strictly enforce Zero Trust principles? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Implement continuous, risk-based session evaluation at the Policy Decision Point (PDP) that dynamically reassesses access grants based on endpoint telemetry and user behavior.; Enforce microsegmentation around individual workload components so that all lateral east-west network traffic is explicitly authenticated, authorized, and encrypted.

Cevap

The correct architectural strategies are implementing continuous, risk-based session evaluation at the Policy Decision Point (PDP) using dynamic telemetry, and enforcing microsegmentation around individual workload components so that all lateral east-west traffic is explicitly authenticated, authorized, and encrypted.
Zero Trust Architecture requires continuous explicit verification and strict resource isolation. Implementing dynamic telemetry checks at the Policy Decision Point (PDP) ensures access grants are re-evaluated continuously against current risk state. Enforcing microsegmentation prevents lateral attacker movement by inspecting and authorizing all internal east-west traffic regardless of network location.

Adım Adım Çözüm

1
Evaluate Zero Trust core tenets regarding continuous verification and dynamic access control.
Dynamic policy evaluation at the Policy Decision Point (PDP) ensures access permissions dynamically adapt to changes in device posture, threat intelligence, and user risk metrics.
Static initial logins are insufficient; continuous posture and risk assessment are required under Zero Trust principles.
2
Analyze network isolation and segmentation requirements under an assumed breach posture.
Microsegmentation restricts lateral movement by requiring explicit authorization and encryption for all internal workloads, treating all east-west network traffic as un-trusted.
Perimeter defenses and legacy VPNs grant implicit trust once inside, which contradicts Zero Trust requirements.

Anahtar Kavram

Zero Trust Architecture Principles: Continuous Verification, Microsegmentation, and Explicit Access Controls
Soru 768Soru →

A Security Operations Center (SOC) engineer is building an automated Security Information and Event Management (SIEM) pipeline to process multi-cloud telemetry and on-premises event streams. To ensure correlation rules operate efficiently and reduce false positives, log data must be processed in a precise operational order. What is the correct sequence of stages for log processing within a SIEM pipeline from initial data reception to security incident notification?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequential order of the SIEM pipeline stages is: Log Ingestion and Collection, followed by Parsing and Normalization, followed by Contextual Enrichment, followed by Rule Correlation, and concluding with Alerting and Incident Dispatch.
The SIEM log processing pipeline follows a logical data flow: First, Log Ingestion and Collection gathers raw event data from distributed endpoints. Second, Parsing and Normalization converts unformatted raw strings into standard key-value fields with unified UTC timestamps. Third, Contextual Enrichment adds value to parsed fields by attaching threat intelligence markers, asset risk levels, and location data. Fourth, Rule Correlation analyzes these normalized and enriched events against rule logic across time windows to detect suspicious patterns. Finally, Alerting and Incident Dispatch triggers analyst notifications and SOAR response playbooks upon confirmed rule matches.

Adım Adım Çözüm

1
Identify the entry point of the SIEM data pipeline.
Raw logs must first be gathered from source systems (firewalls, servers, cloud APIs) via collectors.
Data cannot be transformed or analyzed before it is ingested into the system.
2
Determine the data structuring requirement.
Raw logs are parsed into key-value pairs and timestamps are normalized to UTC.
Correlation and querying require standardized field structures across disparate log sources.
3
Apply contextual intelligence to structured logs.
Enrich normalized fields with GeoIP data, threat feeds, and asset risk scores.
Enrichment depends on having distinct, standardized fields (like source IP) to look up external context.
4
Evaluate enriched events against threat detection logic.
Run events through correlation rules across time-windowed cross-source event streams.
Correlation logic requires enriched contextual data and normalized fields to reliably match patterns across different sources without false positives.
5
Identify the final output phase of the pipeline.
Trigger SOC console alerts, ticketing, and SOAR orchestration responses.
Alerting is the output triggered only after correlation conditions are satisfied.

Anahtar Kavram

SIEM Log Processing Pipeline Order
Tahmini Süre:2m 0s
Soru 769Soru →

An enterprise security architecture assessment identified several technical flaws across the organization's cryptographic implementations and control configurations. Match each cryptographic or security control weakness on the left to its corresponding security impact on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Static RSA key exchange without ephemeral key parameters
Hardcoded symmetric encryption keys embedded in client application binaries
Disabled Certificate Revocation List (CRL) and OCSP validation on client endpoints
Cipher Block Chaining (CBC) mode initialized with predictable Initialization Vectors

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Static RSA key exchange matches retroactive decryption of past session traffic due to lack of Perfect Forward Secrecy; hardcoded symmetric keys match binary reverse engineering leading to global key exposure; disabled revocation checking matches acceptance of revoked certificates during man-in-the-middle attacks; predictable CBC IVs match susceptibility to block pattern analysis and chosen-ciphertext attacks.
Each identified weakness maps directly to its technical vulnerability: static RSA key exchange lacks forward secrecy resulting in retroactive traffic decryption; hardcoded client secrets permit reverse engineering and key extraction; bypassing CRL/OCSP validation forces endpoints to trust revoked certificates during interception attacks; and predictable IVs in CBC mode break cipher non-determinism, exposing sessions to chosen-ciphertext analysis.

Adım Adım Çözüm

1
Analyze the impact of static RSA key exchange.
Determined that without ephemeral key negotiation (such as DHE or ECDHE), session keys depend directly on the server's private key, failing to provide Perfect Forward Secrecy (PFS).
This structural flaw enables adversaries who capture and archive encrypted session traffic to decrypt all past communications if the private key is later compromised.
2
Evaluate the security risk of hardcoded secret keys in client binaries.
Recognized that software binaries distributed to end-user devices can be decompiled.
Hardcoded keys can be extracted via static binary analysis, compromising confidentiality across every instance of the software.
3
Examine the consequence of disabling certificate revocation checks.
Identified that client software bypasses CRL and OCSP verification steps during TLS handshakes.
Without revocation verification, clients trust compromised certificates that have been explicitly revoked by the issuing Certificate Authority.
4
Assess the cryptographic vulnerability of predictable IVs in Cipher Block Chaining mode.
Understood that CBC mode requires unpredictable, random IVs to ensure ciphertext randomized outputs.
Predictable IVs allow adversaries to craft matching plaintext guesses and observe cipher outputs, leading to information disclosure via chosen-ciphertext side-channel attacks.

Anahtar Kavram

Cryptographic and Security Control Weaknesses
Soru 770Soru →

A system administrator is configuring isolation controls on a host operating system running multiple production application containers. Which of the following security mechanisms directly restrict containerized processes from escalating privileges on the host kernel and limiting system calls? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring Secure Computing Mode (seccomp) profiles for container runtime environments; Enabling user namespaces to map container root users to non-root host accounts

Cevap

The correct mechanisms are configuring Secure Computing Mode (seccomp) profiles and enabling user namespaces.
Seccomp restricts the syscall boundary exposed by the host kernel to containerized workloads, while user namespaces isolate administrative privileges by ensuring a container's root user does not map to root authority on the underlying host operating system.

Adım Adım Çözüm

1
Analyze container kernel isolation requirements
Identify controls that limit kernel attack surfaces and host account exposure.
Containers share the underlying host OS kernel, making system call filtering critical.
2
Evaluate system call restriction mechanisms
Seccomp profiles restrict syscall access per container process.
Restricting syscalls prevents compromised containers from executing dangerous kernel routines.
3
Evaluate identity and privilege boundary controls
User namespaces map container UID 0 (root) to an unprivileged host UID.
This prevents container escapes from granting root privileges on the underlying host machine.

Anahtar Kavram

Container Host Isolation and Kernel Hardening Mechanisms
Soru 771Soru →

An organization is updating its high-availability and resilience architecture for a critical enterprise resource planning (ERP) system. A system administrator proposes replacing off-site asynchronous data backups with a local RAID 10 storage configuration, arguing that RAID 10 provides both fault tolerance and complete disaster recovery resilience. Which of the following best explains the fundamental vulnerability created by this proposed change?

Cevabı ve açıklamayı göster

Cevap: RAID 10 provides localized hardware fault tolerance against drive failure but does not protect against catastrophic site loss, data corruption, or physical disasters.

Cevap

RAID 10 provides localized hardware fault tolerance against drive failure but does not protect against catastrophic site loss, data corruption, or physical disasters.
The correct answer highlights that while RAID 10 offers excellent fault tolerance by mirroring and striping disks locally, it is not a disaster recovery mechanism. If the data center experiences a physical disaster, or if data is deleted or encrypted by ransomware, RAID mirrors those destructive changes immediately across all drives. Off-site backups or replication remain mandatory for disaster recovery.

Adım Adım Çözüm

1
Analyze the proposed architectural modification.
The proposal substitutes off-site data backups with local RAID 10 storage arrays.
Disaster recovery planning requires evaluating whether local redundant storage can compensate for site-level backup strategies.
2
Evaluate the technical capabilities of RAID 10.
RAID 10 combines disk mirroring and striping, allowing array survival during individual disk failures without operational downtime.
RAID provides localized hardware fault tolerance and high availability for storage media.
3
Identify boundary limitations of RAID 10 compared to backups.
RAID 10 instantly mirrors logical corruptions, malicious deletions, and ransomware encryption across mirrored pairs, and remains vulnerable to complete facility destruction.
Fault tolerance mechanisms sustain operational continuity through component failures, whereas backups and off-site replication facilitate disaster recovery following site loss or data corruption.

Anahtar Kavram

Distinguishing Fault Tolerance from Disaster Recovery and Backups
Soru 772Soru →

Match each observed wireless or network attack technical indicator to its corresponding security threat classification.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Packet capture logs displaying continuous transmission of IEEE 802.11 management frames with subtype 0x000C sent to client MAC addresses with spoofed access point source addresses.
Spectrum analyzer logs recording high-power broadband carrier noise across the 2.4 GHz ISM band causing a complete collapse in the signal-to-noise ratio (SNR).
System logs showing unsolicited Bluetooth L2CAP and Service Discovery Protocol (SDP) requests pushing unwanted text contact notes to nearby discoverable mobile devices.
Packet captures recording unauthorized ICMPv6 Type 134 messages broadcast from a unauthorized endpoint to dynamically reconfigure neighbor default routing paths.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The observed technical indicators match as follows: 802.11 management frames (subtype 0x000C) match Deauthentication Attack; broadband high-power noise matches RF Jamming Attack; unsolicited Bluetooth text messages match Bluejacking Attack; unauthorized ICMPv6 Type 134 broadcasts match Rogue IPv6 Router Advertisement Attack.
Each indicator directly corresponds to its characteristic protocol behavior: 802.11 subtype 0x000C identifies wireless deauthentication; RF spectrum noise indicates physical radio frequency jamming; unsolicited Bluetooth message delivery represents Bluejacking; and unauthorized ICMPv6 Type 134 frames represent a rogue IPv6 Router Advertisement attack.

Adım Adım Çözüm

1
Analyze frame subtypes and protocol headers in wireless packet captures.
IEEE 802.11 subtype 0x000C specifically designates Deauthentication management frames designed to drop wireless client connections.
Identifying specific frame types isolates wireless denial-of-service vectors.
2
Evaluate RF spectrum metrics and signal noise metrics.
Continuous high-power noise overwhelming the signal-to-noise ratio indicates intentional intentional physical layer interference (RF Jamming).
Jamming impacts physical layer propagation rather than logical protocol exchanges.
3
Examine short-range wireless protocol traffic and payload types.
Unsolicited messaging via Bluetooth SDP/L2CAP characterizes Bluejacking (distinguished from Bluesnarfing, which steals data).
Bluejacking focuses on sending messages rather than exfiltrating stored data.
4
Inspect ICMPv6 packet types and network layer routing announcements.
ICMPv6 Type 134 corresponds to Router Advertisements (RA). Unauthorized RA messages alter host IPv6 gateway configurations.
IPv6 Stateless Address Autoconfiguration (SLAAC) relies on ICMPv6 Type 134, making rogue RAs a prominent network layer threat indicator.

Anahtar Kavram

Technical Indicators of Network and Wireless Attacks
Tahmini Süre:1m 30s
Soru 773Soru →

A security architect is establishing physical and firmware-level hardening controls for an industrial IoT edge gateway deployed in physically accessible utility substations. Which option correctly matches each embedded hardware security control to its primary operational security role?

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Microcontroller Memory Protection Unit (MPU)
Immutable Mask ROM Bootloader
Tamper-Resistant Secure Element (SE)
Inline Bus Encryption Engine

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Microcontroller Memory Protection Unit (MPU) matches restricting task memory and peripheral access by privilege level; Immutable Mask ROM Bootloader matches serving as the unalterable Hardware Root of Trust for initial boot validation; Tamper-Resistant Secure Element (SE) matches providing hardened cryptographic storage resistant to physical/side-channel extraction; Inline Bus Encryption Engine matches protecting external memory interconnects against physical bus probing.
Each component is mapped to its core architectural security scope: the MPU isolates software privilege levels and memory space; the Immutable Mask ROM forms the immutable Root of Trust for booting; the Secure Element safeguards cryptographic keys against physical tamper; and the Inline Bus Encryption Engine secures physical hardware interconnects against logic analyzer capture.

Adım Adım Çözüm

1
Analyze the hardware protection layer enforced at the microcontroller CPU execution level.
Identify that the Memory Protection Unit (MPU) isolates memory regions and peripherals based on task privilege levels.
MPUs define access permissions for specific memory segments to prevent non-privileged tasks from modifying core hardware configuration.
2
Identify the foundation of the boot signature verification chain.
Map the Immutable Mask ROM Bootloader to the initial Hardware Root of Trust.
Because mask ROM cannot be altered post-fabrication, it guarantees that the initial boot execution vector cannot be corrupted or bypassed.
3
Evaluate key storage mechanisms resilient against physical attack vectors.
Associate the Tamper-Resistant Secure Element (SE) with side-channel resistant cryptographic key operations.
Secure Elements incorporate active shields and power-glitch protection specifically to counter physical hardware extraction techniques.
4
Evaluate memory interconnect defenses for off-chip communication paths.
Match the Inline Bus Encryption Engine to protecting external memory buses against physical probing.
Unencrypted buses between system-on-chip controllers and external memory are vulnerable to logic analyzers; inline bus encryption encrypts data over these physical traces.

Anahtar Kavram

Hardware-based security mechanisms provide distinct operational guarantees across processing privilege isolation, boot sequence verification, key protection against physical attacks, and memory bus confidentiality.
Soru 774Soru →

Match each storage security technology to its primary operational application within an enterprise architecture.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Self-Encrypting Drive (SED)
Data Loss Prevention (DLP)
Hardware Security Module (HSM)
Tokenization

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct pairings match Self-Encrypting Drive (SED) to hardware-level disk encryption; Data Loss Prevention (DLP) to data monitoring and exfiltration prevention; Hardware Security Module (HSM) to key generation and secure key storage; and Tokenization to replacing sensitive data fields with non-sensitive placeholder values.
Each technology is correctly paired with its core operational capability. Self-Encrypting Drives deliver controller-based disk encryption, Data Loss Prevention mitigates unauthorized data exfiltration, Hardware Security Modules protect cryptographic keys and perform high-assurance crypto operations, and Tokenization substitutes sensitive data fields with non-sensitive tokens using a secure vault.

Adım Adım Çözüm

1
Evaluate Self-Encrypting Drive (SED)
Identified as disk controller hardware-level bulk encryption.
SED operates transparently on disk controller hardware without requiring host CPU cycles.
2
Evaluate Data Loss Prevention (DLP)
Identified as a content monitoring and exfiltration enforcement system.
DLP inspects structured and unstructured data to detect and prevent unauthorized policy violations.
3
Evaluate Hardware Security Module (HSM)
Identified as a dedicated tamper-resistant cryptographic appliance.
HSMs store master keys and perform cryptoprocessing inside a secure physical boundary.
4
Evaluate Tokenization
Identified as a data substitution method using non-sensitive placeholders.
Tokenization maps sensitive database values to surrogate tokens via a database vault rather than mathematical encryption algorithms.

Anahtar Kavram

Data Protection and Storage Security Architecture Controls
Soru 775Soru →

An internal penetration testing team discovers that a custom mobile application's source code explicitly disables Transport Layer Security (TLS) certificate validation routines. The application is configured to accept any presented digital certificate without verifying its certificate authority (CA) trust chain or hostname matching. Which of the following best describes the primary security risk introduced by this cryptographic control weakness?

Cevabı ve açıklamayı göster

Cevap: It enables unauthorized network nodes to perform Man-in-the-Middle (MitM) attacks by presenting arbitrary certificates to intercept traffic.

Cevap

It enables unauthorized network nodes to perform Man-in-the-Middle (MitM) attacks by presenting arbitrary certificates to intercept traffic.
Transport Layer Security (TLS) relies on digital certificate validation to establish server authenticity. When an application disables checks for hostname matching and trust chain validation, it accepts any digital certificate presented to it. An attacker on the network path can easily intercept connection attempts, substitute their own certificate, and execute a Man-in-the-Middle (MitM) attack to inspect or modify encrypted data in transit.

Adım Adım Çözüm

1
Analyze the identified security vulnerability
The application code deliberately bypasses TLS certificate chain verification and hostname validation.
Understanding the function of TLS certificate validation is necessary to evaluate the attack surface.
2
Determine the impact of disabling certificate trust checks
Without validation, the application cannot confirm whether a server certificate was issued by a trusted Certificate Authority or belongs to the legitimate endpoint.
Improper certificate validation negates the authentication component of TLS.
3
Identify the threat vector enabled by this weakness
An attacker positioned on the communication path can present a self-signed or invalid certificate, which the client will accept, exposing encrypted traffic to decryption and manipulation (MitM).
Man-in-the-Middle attacks exploit client failure to validate identity credentials during cryptographic handshakes.

Anahtar Kavram

Improper Certificate Validation & Trust Weakness
Soru 776Soru →

A global audit firm is implementing a Zero Trust Architecture (ZTA) for partner consultants accessing sensitive financial databases. During an active user session, real-time endpoint telemetry reports that a consultant's laptop has disabled its endpoint detection agent and initiated access from an unrecognized IP address, despite having passed initial Multi-Factor Authentication (MFA). Which of the following architectural responses best exemplifies core Zero Trust principles in this scenario?

Cevabı ve açıklamayı göster

Cevap: Instruct the Policy Decision Point (PDP) to dynamically re-evaluate the session trust score and signal the Policy Enforcement Point (PEP) to terminate or restrict access immediately.

Cevap

Instruct the Policy Decision Point (PDP) to dynamically re-evaluate the session trust score and signal the Policy Enforcement Point (PEP) to terminate or restrict access immediately.
Under Zero Trust Architecture, access is never implicitly granted or maintained based solely on initial authentication. When risk signals change (such as disabled security agents or context anomalies), the Policy Decision Point (PDP) dynamically re-evaluates trust and directs the Policy Enforcement Point (PEP) to restrict or terminate access in real time.

Adım Adım Çözüm

1
Analyze the scenario metrics and threat posture change during an active session.
The device posture degraded (EDR agent disabled) and context changed unexpectedly (unrecognized IP address).
Zero Trust assumes breach and requires continuous inspection rather than static, one-time authentication.
2
Determine the required Zero Trust Architecture component interaction.
The PDP processes real-time telemetry to update the dynamic trust score, and the PEP enforces the updated policy decision by immediately restricting or terminating access.
ZTA relies on dynamic control plane decisions to enforce granular access state changes in real time.

Anahtar Kavram

Continuous Verification and Dynamic Policy Enforcement in Zero Trust Architecture
Tahmini Süre:2m 0s
Soru 777Soru →

A Security Operations Center (SOC) analyst is reviewing the following aggregated log entries from a SIEM alert involving an internal host (10.2.12.85):

[Log 1: Active Directory Domain Controller - Event ID 4768]
TargetUserName: svc_database
ServiceTicketOptions: 0x40810000
TicketEncryptionType: 0x17 (RC4-HMAC)
ClientAddress: 10.2.12.85

[Log 2: Host Endpoint Sysmon - Event ID 1]
ProcessID: 4820
Image: C:\Windows\System32\cmd.exe
CommandLine: cmd.exe /c powershell.exe -nop -w hidden -e JABzAD0...
ParentImage: C:\Windows\System32\services.exe

[Log 3: Perimeter Firewall Log]
SrcIP: 10.2.12.85:51244 | DstIP: 198.51.100.72:443 | Protocol: TCP | SentBytes: 485200 | RecvBytes: 1420 | Action: ALLOW

Based on the log correlation above, which of the following cyber attack techniques is occurring?

Cevabı ve açıklamayı göster

Cevap: Kerberoasting combined with encoded command execution and covert data exfiltration

Cevap

The correlated logs demonstrate Kerberoasting combined with encoded command execution and covert data exfiltration.
The combination of requesting RC4-encrypted Kerberos tickets for a service account (Event ID 4768), spawned obfuscated PowerShell processes (Sysmon Event ID 1), and a disproportionately large outbound network transfer points directly to Kerberoasting followed by automated payload execution and exfiltration.

Adım Adım Çözüm

1
Analyze Log 1 (Active Directory Event ID 4768)
Identify a Kerberos TGS request for service account 'svc_database' using legacy RC4 encryption (0x17), indicative of Kerberoasting.
Attackers request Kerberos service tickets with RC4 encryption because they can be cracked offline to reveal service account passwords.
2
Analyze Log 2 (Sysmon Event ID 1)
Identify suspicious obfuscated command execution via PowerShell launched by cmd.exe.
Base64 encoded command arguments (-e / -encodedcommand) are frequently utilized by post-exploitation frameworks to bypass simple command line inspection.
3
Analyze Log 3 (Perimeter Firewall Log)
Identify anomalous outbound transfer (485KB sent vs 1.4KB received) over HTTPS.
A high ratio of sent bytes compared to received bytes to an external IP address signals data exfiltration.

Anahtar Kavram

Log Correlation and SIEM Multi-Source Threat Analysis
Tahmini Süre:2m 0s
Soru 778Soru →

An organization wants to enable its employees to access an external web-based software application using their existing internal network credentials without prompting them to re-enter their passwords. Which of the following identity architecture technologies best satisfies this requirement?

Cevabı ve açıklamayı göster

Cevap: Federated Single Sign-On using Security Assertion Markup Language (SAML)

Cevap

Federated Single Sign-On using Security Assertion Markup Language (SAML)
Federated Single Sign-On (SSO) using SAML (Security Assertion Markup Language) allows an organization's Identity Provider (IdP) to authenticate users locally and pass secure tokens to an external Service Provider (SP). This eliminates the need for users to re-enter credentials when accessing third-party software.

Adım Adım Çözüm

1
Analyze the scenario requirement
The requirement asks for a solution allowing internal corporate credentials to authenticate access to an external third-party application without multiple password prompts.
This requires a federated identity architecture that establishes trust between an internal Identity Provider (IdP) and an external Service Provider (SP).
2
Evaluate potential IAM protocols and technologies
SAML is standard for browser-based federated single sign-on between enterprise identity stores and cloud services.
SAML tokens securely transmit authentication assertions between the enterprise and the application.

Anahtar Kavram

Federated Identity Management and Single Sign-On (SSO)
Soru 779Soru →

A SOC analyst reviews the following web server access log entry presented in a Security Information and Event Management (SIEM) console:

10.0.0.15 - - [27/Jul/2026:11:05:14 +0000] "GET /products.php?id=1%20OR%201=1 HTTP/1.1" 200 452

Which type of attack vector is indicated by this log entry?

Cevabı ve açıklamayı göster

Cevap: SQL injection

Cevap

SQL injection
The payload `1 OR 1=1` appended to the parameter string in the HTTP GET request is designed to manipulate SQL statements executed by the database backend, making SQL injection the correct attack vector.

Adım Adım Çözüm

1
Inspect the URL query parameters within the HTTP GET request in the web log entry.
The query string contains `id=1%20OR%201=1`, where `%20` represents URL-encoded space characters.
Log parsing requires analyzing user-supplied parameters for unexpected syntax or command injection characters.
2
Evaluate the intent of the injected parameters.
The syntax `1 OR 1=1` forces a SQL conditional clause to evaluate to true regardless of original query conditions.
This is a fundamental signature of an inline SQL injection attack against a web application database.

Anahtar Kavram

Identifying SQL Injection Indicators in SIEM Web Server Logs
Soru 780Soru →

A threat intelligence analyst at a cloud service provider is tasked with obtaining early-warning indicators regarding unpatched, zero-day vulnerabilities currently being offered for sale by illicit actors prior to public disclosure. Which threat intelligence source type should the analyst primarily monitor to fulfill this requirement?

Cevabı ve açıklamayı göster

Cevap: Dark web threat intelligence feeds

Cevap

Dark web threat intelligence feeds serve as the primary source for monitoring illicit marketplaces and closed underground communities trading unpatched vulnerabilities and zero-day exploits.
Dark web threat intelligence involves monitoring underground markets, specialized forums, and anonymized networks where threat actors actively buy, sell, and share zero-day vulnerabilities, stolen credentials, and custom attack tooling before the broader cybersecurity community becomes aware of them.

Adım Adım Çözüm

1
Analyze the operational intelligence requirement
Identified the core requirement as gathering early-warning threat data on zero-day vulnerabilities being actively commercialized by cybercriminals prior to public release.
The scenario highlights pre-disclosure sales in illicit communities rather than public disclosures or post-incident analysis.
2
Evaluate intelligence source characteristics
Recognized that dark web intelligence specifically monitors onion sites, darknet markets, and invitation-only threat actor forums.
Zero-day sales and criminal trade occur within restricted channels inaccessible through conventional web indexing or public feeds.
3
Select the optimal intelligence source type
Determined that dark web threat intelligence feeds provide the necessary visibility into illicit exploit trading.
Other public sources (such as NVD or OSINT) only register vulnerabilities after public disclosure or CVE assignment.

Anahtar Kavram

Threat Intelligence Sources (Dark Web vs. OSINT vs. Vulnerability Databases)
Tahmini Süre:1m 0s
ÖncekiSayfa 39 / 112Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin