Examkin

Tüm alıştırma soruları

378 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 61Soru →

Match each vulnerability assessment and security testing method to its corresponding operational characteristic.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Credentialed Vulnerability Scanning
Static Application Security Testing (SAST)
Dynamic Application Security Testing (DAST)
Passive Network Vulnerability Monitoring

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Credentialed Scanning pairs with direct host queries using administrative rights; SAST pairs with non-execution analysis of source code; DAST pairs with external black-box testing of running applications; Passive Monitoring pairs with analyzing mirrored packet flows without active probes.
Each security assessment method maps directly to its core function: credentialed scanning uses administrative access for host audits; SAST analyzes uncompiled/static code; DAST tests executing web apps; and passive network monitoring analyzes mirrored traffic safely.

Adım Adım Çözüm

1
Identify the operation mode of Credentialed Vulnerability Scanning.
It logs into host operating systems using administrative credentials to check patch levels.
Authenticating directly to target hosts yields internal configuration visibility without relying on network probing.
2
Distinguish SAST from DAST based on application execution status.
SAST checks static code prior to deployment, while DAST tests live, running web applications.
SAST identifies code-level security issues before execution, whereas DAST uncovers runtime configuration and input handling weaknesses.
3
Differentiate passive monitoring from active vulnerability scanning.
Passive monitoring relies on mirrored network telemetry without generating active probe traffic.
Observing traffic non-intrusively protects sensitive environments (such as OT/ICS) from network-induced destabilization.

Anahtar Kavram

Selecting appropriate vulnerability testing methodologies based on execution state, authentication level, and operational impact risk.
Soru 62Soru →

Match each technical telemetry scenario with its corresponding malware classification based on the observed indicators of compromise.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

PowerShell executing with `-EncodedCommand` and `-NoProfile` parameters, fetching payload instructions directly into volatile memory without writing binaries to local storage.
Ring 0 kernel driver execution that modifies Direct Kernel Object Manipulation (DKOM) structures to hide process IDs and files from system management utilities.
A database script scheduled to run a destructive query automatically 30 days after a specific employee account is set to inactive status in the directory.
Automated network telemetry showing a workstation self-propagating across port 445 to adjacent subnets without requiring human interaction.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

PowerShell memory-only execution matches Fileless Malware; Ring 0 DKOM manipulation matches Rootkit; Conditional script trigger matches Logic Bomb; Autonomous self-propagation matches Worm.
The paired classifications accurately reflect the technical behavior of each malware category: memory-only PowerShell execution represents fileless malware, Ring 0 DKOM manipulation represents a rootkit, conditional payload execution represents a logic bomb, and autonomous SMB scanning represents a worm.

Adım Adım Çözüm

1
Analyze the technical indicators in each scenario.
Identified volatile memory execution, kernel-level cloaking, triggered execution, and autonomous network propagation.
Differentiating malware types relies on analyzing execution mechanics, persistence mechanisms, and propagation behavior.
2
Map execution mechanics to malware definitions.
Living-off-the-land memory execution aligns with fileless malware, while Ring 0 system cloaking maps to rootkits.
Fileless malware minimizes disk footprint; rootkits conceal artifacts by altering low-level OS operations.
3
Map trigger conditions and propagation characteristics.
Status-triggered malicious scripts map to logic bombs; self-directed SMB scanning maps to worms.
Logic bombs rely on specific logical triggers, whereas worms actively scan and infect network targets independently.

Anahtar Kavram

Malware Types and Indicators of Compromise
Soru 63Soru →

Match each threat actor profile to the primary attribute combination and attack strategy that most accurately characterizes their operations.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Nation-state adversary
Hacktivist collective
Disgruntled insider
Organized crime syndicate

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Nation-state adversaries correspond to extensive funding, high sophistication, and geopolitical espionage goals. Hacktivist collectives match ideological motivation with public-facing attacks like DDoS and defacement. Disgruntled insiders possess internal credentials and act out of grievance or financial incentive. Organized crime syndicates deploy profit-driven ransomware operations with high capabilities.
Each threat actor type possesses distinct attributes: nation-states focus on strategic state-sponsored espionage with custom vectors; hacktivists aim for public awareness using disruption tactics; insiders utilize legitimate credentials for malicious exfiltration; and organized crime syndicates operate as sophisticated financial enterprises.

Adım Adım Çözüm

1
Analyze the motivation, funding, and sophistication of nation-state actors.
Identified geopolitical espionage, high funding, stealth, and supply chain vectors.
Nation-states focus on long-term intelligence gathering backed by state resources.
2
Evaluate the primary drivers and vectors of hacktivist groups.
Matched to political/social ideology and high-visibility disruption tactics like DDoS.
Hacktivists seek publicity for their cause rather than covert intelligence or monetary gain.
3
Differentiate insider threats from external actors.
Matched to internal access capabilities and grievance-driven exfiltration.
Insiders exploit preexisting legitimate privileges to bypass perimeter controls.
4
Identify the core attributes of organized cybercrime syndicates.
Matched to monetary profit targets and ransomware extortion models.
Organized crime prioritizes financial returns over political or strategic objectives.

Anahtar Kavram

Threat Actor Profiling and Attributes
Soru 64Soru →

An enterprise security architect is establishing an operational governance framework for cloud adoption across multiple business units. Match each security administration task on the left with the primary responsible party under the cloud shared responsibility model on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Configuring guest operating system security patches, local firewall rules, and custom kernel configurations on virtual computing instances
Securing application source code, managing API authentication keys, and configuring database schemas within a managed serverless platform
Managing user identity lifecycle, access permissions, multi-factor authentication enforcement, and data governance within a cloud-hosted productivity suite
Maintaining physical server hardware, facility perimeter controls, datacenter environmental monitoring, and hypervisor integrity

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Guest OS configuration matches Customer responsibility in IaaS; Application and API security match Customer responsibility in PaaS; Identity and data governance match Customer responsibility in SaaS; Physical infrastructure and hypervisor maintenance match Cloud Service Provider baseline responsibility.
The cloud shared responsibility matrix defines operational boundaries based on service abstraction. Infrastructure as a Service requires customers to maintain everything above the hypervisor (including OS patching and host firewall rules). Platform as a Service offloads OS and runtime management to the vendor, leaving application code, API security, and database schemas with the customer. Software as a Service offloads full application maintenance, yet identity lifecycle and data protection remain customer duties. Physical datacenter facilities, hardware, and hypervisor security remain the provider's responsibility across all public cloud service models.

Adım Adım Çözüm

1
Evaluate Infrastructure as a Service (IaaS) boundary
Determine that virtual machine OS configuration, kernel settings, and host firewalls fall on the subscriber side of the boundary.
IaaS provides raw compute infrastructure where the provider stops managing at the hypervisor layer.
2
Evaluate Platform as a Service (PaaS) boundary
Determine that managing code, API access tokens, and data schema falls to the subscriber.
PaaS abstracts compute and OS management, allowing subscribers to focus purely on application logic and dataset design.
3
Evaluate Software as a Service (SaaS) boundary
Determine that user authentication policies and data governance remain customer responsibilities.
Even when application hosting and infrastructure are completely managed by a vendor, data ownership and credential security never shift away from the customer.
4
Evaluate Cloud Service Provider baseline obligations
Identify physical datacenter security, power infrastructure, and hypervisor maintenance as universal provider duties.
The provider owns and manages the physical hardware and underlying virtualization layer supporting public cloud instances.

Anahtar Kavram

Cloud Shared Responsibility Model across Service Models (IaaS, PaaS, SaaS)
Soru 65Soru →

A security analyst conducts a comprehensive infrastructure security assessment across enterprise systems. Match each security assessment finding to its corresponding host, network, or architecture vulnerability classification.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A containerized application process escapes its isolation boundary and accesses raw host operating system memory through a shared kernel vulnerability.
An internal management server exposes dynamic RPC endpoints across all network interfaces without authentication or access controls.
An edge security appliance firmware image utilizes static, vendor-hardcoded private cryptographic keys across all customer deployments.
An administrative web portal transmits session tokens in HTTP request headers over an unsegmented internal local area network.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Container process namespace escape matches Host Operating System Isolation Vulnerability. Dynamic open RPC endpoint exposure matches Unauthenticated Network Service Exposure. Hardcoded firmware private keys match Embedded System Credential Flaw. Cleartext HTTP session transmission over flat subnets matches Cleartext Protocol Architecture Weakness.
Each security assessment finding maps directly to its specific vulnerability domain: kernel namespace breakouts represent host isolation flaws, open RPC management interfaces represent unauthenticated service exposure, hardcoded embedded keys represent firmware credential weaknesses, and HTTP session token transmission across unsegmented subnets represents cleartext protocol architecture weaknesses.

Adım Adım Çözüm

1
Analyze host-level virtualization and container runtime security boundaries.
Determine that escaping container boundaries to access host memory breaks host kernel isolation.
Containers share the host operating system kernel, so kernel exploits compromise host isolation.
2
Evaluate network service configurations and access control policies.
Identify that unauthenticated RPC listener endpoints expose critical infrastructure interfaces to arbitrary network clients.
Exposing internal management services without authentication allows unauthenticated remote execution.
3
Inspect embedded hardware firmware key management implementation.
Classify static private keys burned into firmware images as embedded device credential flaws.
Shared hardcoded keys allow attackers to intercept traffic or impersonate any deployed hardware unit.
4
Review network protocol encryption and network segmentation controls.
Link unencrypted HTTP session token transit on unsegmented subnets to cleartext protocol architecture weaknesses.
Lack of transport-layer security combined with flat network topology permits credential sniffing by adjacent hosts.

Anahtar Kavram

Host, Network, and Architecture Vulnerabilities
Soru 66Soru →

A security analyst is reviewing telemetry logs and incident report artifacts following a series of network anomalies. Match each observed technical telemetry artifact on the left with its corresponding malware classification on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Execution of obfuscated PowerShell scripts pulling payloads directly into host RAM via WMI repository subscriptions without creating disk binaries
Modification of the Volume Boot Record (VBR) to execute malicious code prior to operating system kernel initialization
A database trigger configured to execute a destructive SQL script automatically when a specific user ID is purged from the HR database
An unexpected outbound C2 encrypted session established by svchost.exe spawned directly as a child process of winword.exe

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Execution of PowerShell via WMI matches Fileless Malware; VBR modification matches Bootkit; HR database deletion trigger matches Logic Bomb; Word spawning svchost for C2 matches Remote Access Trojan (RAT).
Each telemetry artifact distinctly maps to its underlying malware mechanism: in-memory execution via system binaries matches fileless malware; boot sector modification prior to OS load matches bootkit persistence; event-triggered malicious payloads represent logic bombs; and process tree anomalies establishing remote command channels indicate Remote Access Trojans.

Adım Adım Çözüm

1
Analyze memory and file system artifacts
In-memory execution of obfuscated scripts via native tools (WMI/PowerShell) indicates Fileless Malware.
Fileless malware avoids traditional disk-based detection by operating exclusively in volatile memory.
2
Evaluate boot sequence persistence mechanisms
Pre-boot code execution altering the Volume Boot Record indicates a Bootkit.
Bootkits target the storage system's boot sectors to gain control before operating system security controls initiate.
3
Examine event-driven triggers
Code scheduled to run upon HR database user purging matches a Logic Bomb.
Logic bombs lie dormant until specific environmental conditions or administrative events execute the payload.
4
Analyze process tree lineage and network behavior
Productivity software spawning system host processes that initiate outbound command-and-control traffic matches a Remote Access Trojan (RAT).
RATs typically leverage process hollowing or malicious process spawn techniques to conceal C2 communications.

Anahtar Kavram

Malware Telemetry and Indicator Classification
Tahmini Süre:2m 0s
Soru 67Soru →

Match each enterprise security incident scenario to the primary social engineering attack vector it exemplifies.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

An attacker compromises a legitimate, industry-specific news website frequently visited by target organization personnel to deliver drive-by exploit payloads.
An attacker sends highly tailored emails referencing internal project codes and executive names to trick specific financial staff into authorizing wire transfers.
An attacker carrying large packages closely follows an authorized employee through a card-restricted building entrance without presenting access credentials.
An attacker sends fraudulent SMS text messages impersonating corporate IT support to remote staff, directing them to a fake login portal to harvest credentials.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The compromised industry news site matches Watering Hole Attack; the tailored executive emails match Spear Phishing; following an employee through a secure doorway matches Tailgating; and the fake IT support text messages match Smishing.
Each incident scenario aligns with a specific vector: Watering Hole attacks infect third-party websites commonly visited by target groups; Spear Phishing uses customized digital messages targeted at specific organizational roles; Tailgating exploits human politeness to breach physical entry points; and Smishing uses mobile SMS messaging to deceive targets.

Adım Adım Çözüm

1
Analyze Scenario 1 involving the compromise of a trusted third-party website visited by target personnel.
Identified as a Watering Hole Attack because the vector relies on infecting a site known to be frequented by a specific target group.
This strategy avoids direct communication with targets and exploits implicit trust in external resources.
2
Analyze Scenario 2 involving customized emails sent to specific financial personnel with confidential internal context.
Identified as Spear Phishing because it targets specific individuals using recon-derived information.
Unlike bulk phishing, spear phishing relies on targeted context to increase credibility.
3
Analyze Scenario 3 involving physical entry behind an authorized employee carrying packages.
Identified as Tailgating, a physical social engineering method.
The attacker relies on social courtesy and physical distraction to bypass physical access controls.
4
Analyze Scenario 4 involving fake IT support messages delivered to mobile phones via SMS.
Identified as Smishing (SMS Phishing).
Smishing specifically uses cellular text messaging services to deliver phishing lures.

Anahtar Kavram

Classification of Social Engineering Vectors and Tactical Indicators
Soru 68Soru →

An enterprise security operations center is reviewing four complex, multi-stage security incidents involving targeted human manipulation. Match each social engineering tactical delivery technique on the left to the corresponding operational scenario indicator on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Reverse Social Engineering
MFA Fatigue (Push Spamming) with Vishing
Watering Hole Attack
Pretexting with Typosquatting

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Reverse Social Engineering matches the scenario where an adversary causes network disruptions and advertises a fake helpline so victims call them. MFA Fatigue with Vishing matches the scenario involving repeated push notification prompts coupled with an urgent phone call from a fake technician. Watering Hole Attack matches the scenario where a niche vendor technical forum frequented by engineers is compromised. Pretexting with Typosquatting matches the scenario where a lookalike supplier domain and false narrative are used to modify invoice payment details.
Each attack vector is correctly paired based on operational mechanics: Reverse Social Engineering relies on victim-initiated contact; MFA Fatigue combined with Vishing leverages pushed authentication spam alongside voice coercion; Watering Hole attacks exploit trusted industry watering holes/websites; and Pretexting with Typosquatting combines fraudulent role-play with misleading lookalike domains.

Adım Adım Çözüm

1
Analyze the tactical delivery methods
Identify key characteristics of Reverse Social Engineering, MFA Fatigue/Vishing, Watering Hole, and Pretexting with Typosquatting.
Matching requires identifying the core delivery vector and psychological levers used in each attack.
2
Evaluate the first scenario involving breakroom flyers and self-initiated victim calls
Map to Reverse Social Engineering.
In reverse social engineering, the target relies on assistance published by the attacker, initiating the contact themselves.
3
Evaluate the second scenario involving compromised niche vendor forums
Map to Watering Hole Attack.
Watering hole attacks selectively infect websites known to be trusted and frequented by the target demographic.
4
Evaluate the third scenario involving off-hours push prompts and phone calls
Map to MFA Fatigue with Vishing.
Push spamming weakens user resistance through repetitive MFA prompts, while voice phishing reinforces the false urgency.
5
Evaluate the fourth scenario involving lookalike vendor domains and executive impersonation
Map to Pretexting with Typosquatting.
Typosquatting provides technical plausibility via lookalike domains, while pretexting builds the false narrative to redirect funds.

Anahtar Kavram

Social Engineering Attack Vectors and Incident Indicators
Soru 69Soru →

A security technician is categorizing host and network vulnerabilities discovered during an enterprise infrastructure audit. Match each vulnerability descriptor on the left with its primary architectural risk on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Unpatched Out-of-Band (OOB) Baseboard Management Controller (BMC)
Use of unencrypted SNMPv1 community strings across network subnets
Unauthenticated HTTP access to Instance Metadata Service (IMDS)
Unsupported End-of-Life (EOL) operating system on an unsegmented network

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Unpatched Out-of-Band (OOB) Baseboard Management Controller (BMC) matches Direct hardware-level control bypassing host operating system security controls; Use of unencrypted SNMPv1 community strings across network subnets matches Interception of telemetry data and management passwords via network sniffing; Unauthenticated HTTP access to Instance Metadata Service (IMDS) matches Temporary cloud identity credential harvesting via Server-Side Request Forgery (SSRF); Unsupported End-of-Life (EOL) operating system on an unsegmented network matches Unmitigated exploit execution enabling rapid lateral movement.
Each host and network vulnerability corresponds to its specific operational impact: BMC management interfaces provide raw hardware control below the OS layer; cleartext SNMPv1 leaks management community strings; IMDS endpoints allow SSRF attacks to harvest temporary cloud security tokens; and unpatched EOL operating systems grant unmitigated exploit opportunities on flat networks.

Adım Adım Çözüm

1
Examine the scope and operational layer of each vulnerability listed on the left.
Identified physical out-of-band management controllers, unencrypted management protocols, cloud metadata endpoints, and legacy host operating systems.
Accurate risk classification requires analyzing where each component operates in the enterprise architecture.
2
Correlate out-of-band management (BMC) with low-level hardware risks.
BMCs control server hardware directly and bypass host OS security controls when compromised.
OOB hardware interfaces run dedicated firmware below the main operating system level.
3
Correlate legacy management protocols (SNMPv1) with network eavesdropping risks.
Cleartext transmission permits unauthorized traffic inspection and credential theft.
SNMPv1 does not provide packet encryption or cryptographic authentication.
4
Correlate cloud IMDS endpoints with web/application exploitation vectors.
IMDS exposes sensitive identity role credentials to local application calls, creating SSRF risks.
Cloud instance metadata services reply to unauthenticated HTTP GET requests from internal interfaces.
5
Correlate unsupported EOL operating systems with vulnerability exploitation risks.
Unpatched legacy platforms allow unmitigated exploit execution and rapid network propagation.
Vendors cease issuing security updates for EOL products, leaving known vulnerabilities open.

Anahtar Kavram

Host, Network, and Architecture Vulnerabilities
Soru 70Soru →

Match each malware type on the left with its corresponding technical indicator of compromise (IoC) on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Ransomware
Keylogger
Logic Bomb
Rootkit

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Ransomware pairs with mass file encryption and payment demand; Keylogger pairs with keystroke interception and recording; Logic Bomb pairs with dormant code triggered by specific events; Rootkit pairs with kernel-level modifications hiding processes.
Each malware type directly matches its signature telemetry: Ransomware performs bulk file encryption for extortion; Keyloggers record user input; Logic bombs execute based on predefined system triggers; Rootkits alter kernel structures to maintain stealth.

Adım Adım Çözüm

1
Examine the operational objective of each listed malware classification.
Identified key goals: extortion for Ransomware, credential harvesting for Keyloggers, conditional malicious execution for Logic Bombs, and deep OS evasion for Rootkits.
Understanding malware objectives reveals their corresponding technical telemetry.
2
Map each malware category to its distinct primary indicator of compromise (IoC).
Ransomware matches file encryption/ransom instructions; Keylogger matches recorded keystrokes; Logic Bomb matches event/time trigger; Rootkit matches kernel obfuscation.
Correlating telemetry traits enables security analysts to correctly identify and mitigate threats.

Anahtar Kavram

Malware Classifications and Technical IoCs
Soru 71Soru →

Match each threat actor type on the left with its defining capability, access level, or primary motivation on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Nation-state actor
Insider threat
Hacktivist
Script kiddie

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Nation-state actors correspond to state sponsorship and advanced persistent threat capabilities. Insider threats correspond to existing legitimate privileges. Hacktivists correspond to ideological or political motivations. Script kiddies correspond to low technical sophistication using pre-existing scripts.
Nation-state actors possess high sophistication and state funding. Insider threats leverage authorized internal access. Hacktivists operate based on social/political motives. Script kiddies rely on pre-written tools due to limited skill.

Adım Adım Çözüm

1
Analyze each threat actor category based on standard cybersecurity taxonomy.
Identified key threat actors: Nation-state, Insider threat, Hacktivist, and Script kiddie.
Threat actors are categorized by sophistication, motivation, resources, and access levels.
2
Evaluate the distinguishing attributes listed on the right.
Mapped each threat actor to its primary attribute.
Correct alignment demonstrates fundamental knowledge of threat actor profiles and operational risk vectors.

Anahtar Kavram

Threat Actor Attributes and Classifications
Soru 72Soru →

An enterprise security auditor discovers several vulnerabilities across an organization's internal infrastructure during a comprehensive technical posture assessment. Match each identified host and network vulnerability indicator on the left to its corresponding primary security risk on the right. Which of the following correctly pairs each vulnerability indicator with its primary security risk?

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Windows system service configured with an unquoted executable path containing spaces under C:\Program Files\
Legacy SMB service configured to permit anonymous null sessions over the IPC$ share
Internal web application proxy configured to support 3DES and NULL cipher suites
Embedded network device running firmware susceptible to a stack-based buffer overflow

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct pairings match each host/network vulnerability to its specific threat impact: the unquoted service path matches local privilege escalation; SMB null sessions match unauthenticated reconnaissance; weak TLS cipher suites match cryptographic downgrade; and stack-based buffer overflow firmware matches remote code execution.
The pairings correctly connect each technical vulnerability mechanism to its operational security impact. Unquoted service paths expose local execution order bugs used for privilege elevation; SMB IPC$ null sessions expose administrative RPC endpoints for network discovery; legacy cipher suites expose TLS handshakes to algorithm downgrade attacks; and stack-based memory bounds failures permit arbitrary code execution.

Adım Adım Çözüm

1
Analyze host-level binary execution vulnerabilities.
Unquoted service paths containing spaces cause Windows to search for executables at each space break. This directly maps to local privilege escalation via path hijacking.
Windows process creation attempts to execute the shortest valid path string when spaces are unquoted.
2
Analyze network protocol misconfigurations for information exposure.
Anonymous SMB null sessions over IPC$ enable unauthenticated RPC queries to list domain objects, mapping directly to unauthenticated reconnaissance.
Legacy NetBIOS/SMB behavior allowed unauthenticated connections to inspect system resources.
3
Evaluate transport layer cryptographic weaknesses.
Supporting 3DES or NULL cipher suites allows attackers to force weak or non-existent encryption during negotiation, mapping directly to cryptographic downgrade and eavesdropping.
Permitting weak algorithms enables protocol downgrade attacks such as POODLE or SWEET32.
4
Evaluate memory corruption flaws in network device firmware.
Unchecked memory writes in firmware lead to instruction pointer overwrites, mapping directly to remote code execution.
Buffer overflow conditions alter control flow execution to arbitrary shellcode.

Anahtar Kavram

Host, Network, and Architecture Vulnerabilities
Soru 73Soru →

Match each cryptographic or security control weakness on the left with its corresponding technical description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Hardcoded Cryptographic Key
Deprecated/Weak Cipher Suite
Expired SSL/TLS Certificate
Unsalted Password Hash

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Hardcoded Cryptographic Key matches embedding secret symmetric keys directly within application code; Deprecated/Weak Cipher Suite matches utilizing legacy algorithms with short key lengths or known structural flaws; Expired SSL/TLS Certificate matches failing to renew a digital credential prior to its validity end date; Unsalted Password Hash matches storing password digests without unique random data.
Each security control weakness aligns with its fundamental technical definition. Hardcoding keys puts secrets in binaries; legacy cipher suites rely on flawed algorithms like DES/RC4; expired certificates break the validity lifecycle in PKI; and unsalted hashes expose stored credentials to precomputed rainbow table lookups.

Adım Adım Çözüm

1
Analyze 'Hardcoded Cryptographic Key'
Identify that embedding key material inside software code allows attackers who disassemble the software to retrieve the secret key.
Matches the description of embedding secret keys directly within application code or compiled binaries.
2
Analyze 'Deprecated/Weak Cipher Suite'
Identify that older algorithms such as DES or RC4 do not meet modern security baseline requirements.
Matches utilizing legacy algorithms with short key lengths or known structural flaws.
3
Analyze 'Expired SSL/TLS Certificate'
Recognize that digital certificates require active validity windows for trust verification.
Matches failing to renew a digital credential prior to its validity end date.
4
Analyze 'Unsalted Password Hash'
Recall that cryptographic salts add unique randomness to prevent hash collisions across identical passwords.
Matches storing password digests without unique random data.

Anahtar Kavram

Cryptographic and Security Control Weaknesses
Soru 74Soru →

Match each threat actor category with its primary motivation and characteristic attack vector in an enterprise environment.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Nation-State Threat Actor
Organized Crime Threat Group
Shadow IT / Unintentional Insider
Hacktivist Collective

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Nation-State Threat Actor pairs with geopolitical espionage using supply chain compromises and zero-day exploits. Organized Crime Threat Group pairs with financial motivation using stolen credentials for extortion software. Shadow IT / Unintentional Insider pairs with convenience motivation using unauthorized cloud services. Hacktivist Collective pairs with ideological motivation using DDoS and web defacements.
Each threat actor category aligns directly with its characteristic motivation, capability level, and preferred attack vector: Nation-state actors seek geopolitical intelligence via zero-days and supply chain exploits; organized crime seeks financial gain through ransomware and credential theft; shadow IT stems from non-malicious employee convenience via unauthorized SaaS tools; and hacktivists seek publicity for political causes using DDoS and defacement.

Adım Adım Çözüm

1
Identify the primary motivation and sophistication level for each threat actor.
Nation-state actors focus on espionage, organized crime on money, hacktivists on ideology, and shadow IT on convenience.
Threat actor categorization starts by distinguishing core intent and capability bounds.
2
Map each threat actor profile to its matching attack vector and operational objective.
Espionage maps to supply chain/zero-days, financial extortion maps to credential compromise/ransomware, convenience maps to unauthorized cloud/web vectors, and ideological disruption maps to DDoS/defacement.
Attack vectors reflect the resources, persistence requirements, and targets typical of each actor category.

Anahtar Kavram

Threat Actor Profiles, Motivations, and Vectors
Soru 75Soru →

Match each malware classification on the left with its corresponding technical indicator of compromise (IoC) or telemetry profile on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Rootkit
Logic Bomb
Fileless Malware
Remote Access Trojan (RAT)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Rootkit pairs with kernel telemetry showing SSDT modifications; Logic Bomb pairs with the script triggered by user account status changes; Fileless Malware pairs with in-memory execution via WMI; Remote Access Trojan pairs with disguised utility establishing outbound C2 communication.
Rootkit matches kernel-level SSDT modification and API evasion. Logic Bomb matches the conditional trigger tied to user account changes. Fileless Malware matches memory-only WMI/PowerShell execution. Remote Access Trojan matches the disguised utility creating outbound C2 traffic.

Adım Adım Çözüm

1
Examine stealth and kernel-level manipulation telemetry.
Link SSDT modifications and hidden process enumeration to Rootkit functionality.
Rootkits focus on stealth by hooking API routines and altering operating system kernel structures.
2
Analyze event-driven payload execution triggers.
Match account disability conditions to Logic Bomb behavior.
Logic bombs remain inactive until predefined logical or temporal conditions occur.
3
Analyze non-persistent, memory-only execution signatures using native tools.
Match WMI and memory-only command execution to Fileless Malware.
Fileless malware avoids traditional file-based detection by executing code within RAM via trusted binaries.
4
Examine backdoor capabilities hidden within legitimate-looking software.
Match disguised utility establishing external C2 tunnels to Remote Access Trojan (RAT).
RATs provide full operational control to attackers via covert outbound channels while pretending to be harmless applications.

Anahtar Kavram

Malware Classifications and Telemetry Artifacts
Tahmini Süre:1m 30s
Soru 76Soru →

A cybersecurity team is establishing testing procedures for an enterprise security audit. Match each security testing method on the left with its primary operational objective on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Software Composition Analysis (SCA)
Dynamic Application Security Testing (DAST)
Gray-Box Penetration Testing
Credentialed Vulnerability Scanning

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Software Composition Analysis (SCA) matches with evaluating project dependencies; Dynamic Application Security Testing (DAST) matches with automated runtime testing of a live application; Gray-Box Penetration Testing matches with simulating an attack using limited credentials and partial documentation; Credentialed Vulnerability Scanning matches with using administrative credentials to audit local patch levels and configurations.
Each testing methodology serves a specific operational function during an assessment: Software Composition Analysis evaluates open-source components and software supply chain vulnerabilities; Dynamic Application Security Testing tests live web services without source code visibility; Gray-Box Penetration Testing assesses systems using partial knowledge and limited accounts; and Credentialed Vulnerability Scanning performs internal configuration audits with administrative access.

Adım Adım Çözüm

1
Analyze the primary focus of Software Composition Analysis (SCA).
SCA targets third-party libraries, packages, and open-source dependencies incorporated into software products.
Security vulnerabilities often stem from outdated external software modules rather than custom code.
2
Differentiate runtime application assessment (DAST) from static code review.
DAST tests a live application from an external interface perspective without requiring source code access.
DAST discovers vulnerabilities such as SQL injection or cross-site scripting while the application runs.
3
Distinguish access levels in penetration testing methodologies.
Gray-box testing provides assessors with partial knowledge or low-privilege user credentials to test realistic insider user threat vectors.
Black-box provides zero prior knowledge, whereas white-box provides complete internal access and source code.
4
Evaluate the mechanism of credentialed vulnerability scanning.
Credentialed scanning logs directly into endpoints using valid system credentials.
Authenticated access allows low-impact inspection of OS patch levels, software registries, and internal configuration details.

Anahtar Kavram

Vulnerability Assessment and Security Testing Methods
Soru 77Soru →

Match each host, network, or infrastructure vulnerability scenario on the left with its corresponding primary remediation strategy on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

An internal vulnerability scan detects TCP port 445 active on host endpoints with SMBv1 enabled.
An audit reveals an enterprise cloud storage bucket containing plain-text API keys accessible via public URLs.
Network telemetry shows an internal DNS server responding to unrestricted recursive queries from external IP addresses.
An embedded building automation controller transmits sensor data across the LAN using unencrypted HTTP and factory default credentials.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct pairings match each security vulnerability scenario to its targeted technical control: SMBv1 exposure pairs with legacy protocol deprecation and SMBv3 enforcement; public cloud storage credential exposure pairs with IAM bucket restrictions and secrets management; open recursive DNS resolving pairs with recursive client restrictions and Response Rate Limiting; unencrypted embedded controller traffic with default credentials pairs with firmware hardening, credential replacement, and TLS transport encryption.
Each vulnerability scenario represents a failure at a distinct layer of the architecture (host OS protocol, cloud infrastructure access control, network core services, or embedded endpoint security). remediations must directly address the specific root cause flaw at that layer rather than relying on generic perimeter controls.

Adım Adım Çözüm

1
Analyze host protocol vulnerability (left item 1)
Identified SMBv1 legacy protocol risk
SMBv1 lacks modern security features and is susceptible to exploitation, requiring protocol deprecation and migration to SMBv3.
2
Analyze cloud infrastructure vulnerability (left item 2)
Identified public bucket and cleartext secret exposure
Cloud storage configuration issues are resolved by enforcing strict IAM access controls and externalizing secret management.
3
Analyze network infrastructure vulnerability (left item 3)
Identified open DNS recursive resolver exposure
Open DNS resolvers facilitate amplification attacks, requiring ACLs to limit recursive queries to trusted internal clients.
4
Analyze embedded architecture vulnerability (left item 4)
Identified weak authentication and unencrypted operational technology traffic
Embedded systems must be hardened by changing default credentials and enforcing encrypted transport protocols.

Anahtar Kavram

Host, Network, and Architecture Vulnerability Remediation
Soru 78Soru →

An enterprise security architect is mapping security governance duties across various cloud service models during a multi-cloud initiative. Match each cloud service model on the left with the customer's primary security responsibility on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Infrastructure as a Service (IaaS)
Platform as a Service (PaaS)
Software as a Service (SaaS)
Function as a Service (FaaS)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Infrastructure as a Service (IaaS) matches with configuring guest operating system security patches, virtual machine firewalls, and installed middleware applications. Platform as a Service (PaaS) matches with managing application code and database schemas while relying on the provider to maintain the operating system and runtime framework. Software as a Service (SaaS) matches with configuring user identity access permissions and monitoring data access policies while the provider maintains all application code, runtime, and infrastructure. Function as a Service (FaaS) matches with managing event trigger permissions and stateless code execution logic while the provider completely abstracts infrastructure host provisioning and scaling.
Each cloud service model defines a distinct boundary of ownership under the shared responsibility framework. In Infrastructure as a Service (IaaS), customer responsibility extends from the guest OS upward (including OS patching and virtual network security). Platform as a Service (PaaS) shifts OS and runtime maintenance to the provider, leaving code and database management to the customer. Software as a Service (SaaS) shifts application code management to the provider, leaving identity governance and data access to the customer. Function as a Service (FaaS) abstracts server infrastructure entirely, limiting customer responsibility to discrete event-driven function code.

Adım Adım Çözüm

1
Analyze the scope of customer control in Infrastructure as a Service (IaaS).
Identify that IaaS grants full control down to the operating system level, making OS patch management and virtual firewalls customer duties.
Under the cloud shared responsibility model for IaaS, virtualization hardware is provider-managed, but guest OS and compute configurations belong to the customer.
2
Analyze Platform as a Service (PaaS) boundaries.
Determine that PaaS abstracts OS and runtime management, limiting customer duties to code development and database management.
PaaS providers manage the framework and environment to streamline application development for enterprise developers.
3
Evaluate Software as a Service (SaaS) responsibility scope.
Recognize that SaaS offloads all application maintenance to the vendor, restricting customer duties to identity, access, and data security.
SaaS solutions deliver fully formed applications where customers only govern data and access permissions.
4
Determine Function as a Service (FaaS) responsibility.
Confirm that serverless execution removes host management completely, focusing customer effort strictly on short-lived function logic and execution triggers.
FaaS dynamic execution models isolate customer responsibility to individual units of deployed logic and authorization policies.

Anahtar Kavram

Cloud Shared Responsibility Model across Service Delivery Architecture Types
Soru 79Soru →

An enterprise security architect is mapping enterprise hardening controls to specific vulnerability findings identified during a comprehensive threat assessment. Match each enterprise mitigation strategy on the left with the threat or attack vector on the right that it is primarily designed to counter.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

DNS Sinkholing coupled with DNSSEC validation
Microsegmentation utilizing host-based firewalls and network access control policies
Application allowlisting via strict code-signing and publisher policy enforcement
Privileged Access Management (PAM) with Just-In-Time (JIT) access and dual-operator controls

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Each enterprise mitigation strategy accurately maps to its corresponding risk: DNS sinkholing counters command-and-control (C2) channel establishing via DNS hijacking/tunneling; microsegmentation mitigates internal lateral movement across compromised workloads; application allowlisting blocks unauthorized zero-day software execution; and Privileged Access Management with JIT access eliminates standing rights to prevent insider privilege abuse.
The correct pairings align each defense-in-depth control with the primary attack vector it neutralizes: DNS sinkholing and DNSSEC address malicious domain resolution and C2 tunneling; host-level microsegmentation controls east-west traffic to halt lateral movement; application allowlisting enforces code-signing requirements to prevent unauthorized code execution; and PAM with JIT access revokes standing administrative rights to prevent insider abuse and unauthorized privilege exploitation.

Adım Adım Çözüm

1
Analyze the technical mechanism of DNS sinkholing with DNSSEC validation.
Identified that inspecting and redirecting DNS queries directly targets malicious domain lookup behavior typical of malware calling home via domain generation algorithms (DGAs) or DNS tunneling.
DNS-level mitigations specifically operate on domain resolution traffic to neutralize outbound C2 channels.
2
Evaluate the architectural purpose of host-based microsegmentation.
Determined that enforcing strict policy boundaries between host workloads prevents network traversal between internal nodes.
Microsegmentation is explicitly designed to contain blast radiuses by preventing unauthorized lateral (east-west) traffic flow.
3
Assess the operational mechanism of application allowlisting via code-signing enforcement.
Recognized that blocking execution based on digital signature certificates prevents unauthorized scripts, DLLs, and binary executables from running.
Allowlisting explicitly blocks untrusted binaries and zero-day executables that lack pre-approved publisher attestations.
4
Review Privileged Access Management (PAM) with Just-In-Time (JIT) and dual-operator controls.
Matched temporary privilege elevation and secondary approval workflows to the mitigation of standing administrative access abuse.
Removing persistent standing privileges and enforcing peer verification addresses insider threats and unauthorized administrative modifications.

Anahtar Kavram

Mitigation Strategies and Enterprise Hardening Practices
Soru 80Soru →

An enterprise security operations center (SOC) detects anomalous network and wireless activity across multiple site logs during a synchronized red-team exercise. Match each observed technical log snippet or packet capture indicator to its corresponding network or wireless attack classification.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Syslog alert: 'MAC 00:11:22:33:44:55 associated with BSSID AA:BB:CC:DD:EE:FF sent 802.11 Reason Code 7 (Class 3 frame received from nonassociated STA) to 150 clients simultaneously.'
Packet capture snippet: Repeated ARP replies broadcasted to 192.168.1.255 stating IP 192.168.1.1 is at MAC 00:AA:11:BB:22:CC, while switches report 192.168.1.1 active port MAC as 00:11:22:33:44:55.
Wireless analyzer log: Broadcast beacon frames detected for SSID 'Corp-Secure' on Channel 6 using WPA2-Enterprise with BSSID 02:14:6C:AA:BB:CC, matching the enterprise SSID but operating at a significantly higher RSSI (-35 dBm) than legitimate APs (-72 dBm).
SIEM log event: DNS server log showing sudden resolution of intranet.corp.internal from 10.0.5.50 to 192.168.100.45 following non-authoritative UDP port 53 response injection without query ID mismatch alerts on clients.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct pairings match each technical log snippet to its distinct attack indicator: 802.11 Reason Code 7 management frames indicate a Deauthentication attack; mismatched ARP gateway MAC bindings indicate ARP Poisoning; a high-RSSI unauthorized AP matching corporate SSID indicates an Evil Twin; and unauthorized IP resolution via forged records indicates DNS Cache Poisoning.
Each indicator uniquely aligns with standard protocol behaviors under attack: 802.11 disassociation frames force client disconnections; gratuitous ARP replies corrupt local MAC resolution tables; unauthorized high-power BSSIDs spoofing corporate SSIDs represent Evil Twins; and corrupt DNS response mappings indicate DNS cache poisoning.

Adım Adım Çözüm

1
Analyze the wireless management frame log snippet (802.11 Reason Code 7).
Reason Code 7 signifies disassociation due to class 3 frame receipt from a nonassociated station. Mass broadcast indicates a wireless disassociation/deauthentication attack.
Identify wireless denial-of-service or credential-harvesting pre-attack indicators.
2
Analyze the ARP packet capture log.
Discrepancy between broadcasted ARP reply MAC addresses and physical switch port MAC tables points to gratuitous/unsolicited ARP spoofing used for on-path interception.
Distinguish ARP poisoning indicators from normal network ARP traffic.
3
Analyze the wireless beacon frame capture for Corp-Secure.
An unauthorized BSSID advertising the legitimate SSID with an unusually high RSSI indicates a malicious rogue AP configured as an Evil Twin.
Recognize rogue wireless infrastructure masquerading as legitimate corporate access points.
4
Analyze the DNS resolution anomaly log.
Forged responses updating cached IP mapping for internal domain names demonstrate DNS cache poisoning.
Differentiate protocol spoofing at layer 7 (DNS) from layer 2 (ARP) and layer 1/2 (Wireless).

Anahtar Kavram

Identification and analysis of network and wireless attack indicators including ARP poisoning, DNS cache poisoning, Evil Twin access points, and 802.11 disassociation attacks.
Tahmini Süre:3m 0s
ÖncekiSayfa 4 / 19Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin