Examkin

Tüm alıştırma soruları

2232 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 901Soru →

A DevSecOps engineer is configuring a shared Linux compute host that executes untrusted CI/CD pipeline container images. To minimize the risk of a container process exploiting kernel vulnerabilities or escalating privileges on the underlying host operating system, which of the following controls should be implemented? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable user namespaces (userns) to map container root UID 0 to an unprivileged user ID on the host OS.; Apply custom SECCOMP profiles to restrict the specific Linux kernel system calls available to containerized processes.

Cevap

The host environment is secured by configuring user namespaces to map container root privilege to an unprivileged host account and applying SECCOMP profiles to limit accessible kernel system calls.
Implementing user namespaces ensures that even if a container process is compromised as root inside its runtime container, it corresponds to an unprivileged account on the host system. Applying custom SECCOMP profiles further reduces kernel exploitation vectors by enforcing a strict filter on the Linux system calls allowed for the containerized application.

Adım Adım Çözüm

1
Analyze container privilege escalation risks
Identified that containers sharing the host kernel can pose severe risks if a process running as root inside a container breaks out into the host OS.
Container processes run as root by default unless user namespaces remap root (UID 0) inside the container to an unprivileged account on the host.
2
Evaluate syscall attack surface controls
Determined that SECCOMP profiles enforce syscall restrictions directly at the Linux kernel interface.
Restricting unneeded syscalls prevents containers from executing dangerous kernel functions capable of triggering privilege escalation vulnerabilities.

Anahtar Kavram

Container Host Isolation and Kernel Hardening Controls
Soru 902Soru →

A international maritime logistics enterprise operates edge storage appliances at remote port facilities to handle offline container manifest data. The security architecture team must ensure that if storage drives are physically stolen from an unattended facility, the data at rest cannot be extracted. Additionally, key lifecycle management must be centralized without relying on local site administrators to manually unlock storage volumes after a system reboot. Which of the following storage security architectures best meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Self-Encrypting Drives (SEDs) integrated with an enterprise Key Management Interoperability Protocol (KMIP) server

Cevap

Self-Encrypting Drives (SEDs) integrated with an enterprise Key Management Interoperability Protocol (KMIP) server
Self-Encrypting Drives (SEDs) perform low-level hardware cryptographic operations directly on the drive controller, ensuring that data is completely inaccessible if physical drives are detached or stolen. Connecting SEDs to a centralized Key Management Interoperability Protocol (KMIP) server enables centralized key management and automated, secure authentication during remote appliance booting without requiring local administrator password entry.

Adım Adım Çözüm

1
Identify the primary security requirement for physical drive theft.
Protection of data at rest on physical storage media requires full disk or media-level encryption.
If physical drives are stolen from a remote port site, unencrypted media can be read directly on an external controller.
2
Evaluate key management constraints for unattended remote appliances.
Centralized, automated key orchestration is necessary to unlock encryption keys across remote nodes without manual local administrator intervention.
Standardizing key lifecycle management via KMIP allows central Hardware Security Modules (HSMs) or key servers to supply media encryption keys securely over network boot.
3
Select the control architecture that combines hardware-level encryption with automated key management.
Self-Encrypting Drives (SEDs) combined with a central KMIP service satisfy both hardware encryption and centralized key management.
SEDs perform transparent hardware-level cryptographic operations with negligible performance overhead and lock automatically upon loss of power or physical removal.

Anahtar Kavram

Data Protection at Rest and Centralized Storage Key Management
Soru 903Soru →

A security analyst receives a critical Endpoint Detection and Response (EDR) alert showing an unauthorized process attempting to dump LSASS memory on a key workstation in the finance department. The alert confirms that the malicious process is actively attempting to establish command-and-control (C2) communications. According to standard NIST SP 800-61 incident response guidelines, what is the immediate next action the analyst should take?

Cevabı ve açıklamayı göster

Cevap: Isolate the infected finance workstation from the network to prevent lateral movement and C2 traffic.

Cevap

Isolate the infected finance workstation from the network to prevent lateral movement and C2 traffic.
In standard incident response frameworks (such as NIST SP 800-61), once an active threat or compromise is detected, the immediate priority is Containment. Network isolation of the compromised host prevents the adversary from pivoting laterally within the enterprise network, executing further commands, or exfiltrating harvested credentials while keeping volatile memory intact for analysis.

Adım Adım Çözüm

1
Identify the current lifecycle phase of the incident response process based on the EDR alert.
The incident is actively occurring in real time on a live host, placing the response in the Containment, Eradication, and Recovery phase.
Immediate containment is required first to limit damage and prevent active threat propagation.
2
Determine the proper initial response action for an active endpoint compromise.
Network isolation (host quarantine) stops C2 communication and lateral movement without destroying volatile RAM evidence.
Containment must precede eradication actions like wiping or re-imaging.

Anahtar Kavram

Incident Response Containment Phase Procedures
Soru 904Soru →

A cloud security engineering team is designing an Identity and Access Management (IAM) architecture for microservices operating across multi-cloud Kubernetes environments. The architecture must enforce Zero Trust principles by replacing static API keys and long-lived service account tokens with short-lived X.509 certificates issued automatically through platform attestation rather than user credentials. Which of the following identity architecture solutions best satisfies these requirements?

Cevabı ve açıklamayı göster

Cevap: Implement SPIFFE/SPIRE workload identities to issue verifiable cryptographic credentials based on node and workload attestation.

Cevap

SPIFFE/SPIRE workload identities providing short-lived cryptographic credentials via platform attestation.
SPIFFE/SPIRE (Secure Production Identity Framework for Everyone / SPIFFE Runtime Environment) is specifically engineered for workload identity architecture in heterogeneous cloud environments. It performs node and workload attestation to automatically issue short-lived, verifiable SPIFFE ID X.509 documents (SVIDs), fulfilling Zero Trust requirements for microservices without static secret management.

Adım Adım Çözüm

1
Analyze the core architectural requirement
The requirement specifies non-person workload authentication across multi-cloud clusters using short-lived cryptographic identity issued via automated platform attestation.
Static credentials and network-level trust boundaries violate Zero Trust principles in dynamic cloud-native environments.
2
Evaluate workload identity standards
SPIFFE (Secure Production Identity Framework for Everyone) defines a framework for workload identity, and SPIRE provides the implementation to attest platforms and issue short-lived X.509 SVIDs.
This establishes cryptographically verifiable workload identity without relying on human interaction or static secrets.
3
Eliminate inappropriate identity and network mechanisms
IPsec relies on perimeter/node-level security; SAML 2.0 target user browser SSO; OAuth 2.0 Implicit Grant is insecure and suited for front-end clients.
None of these alternatives provide workload-level platform attestation for containerized microservices.

Anahtar Kavram

Workload Identity and Platform Attestation in Zero Trust IAM Architecture
Soru 905Soru →

A security analyst identifies an active incident where a web server is communicating with an unauthorized external command-and-control (C2) server. According to standard incident response playbooks, which of the following initial actions should the incident response team perform during the containment phase? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Isolate the compromised web server from the local network segment.; Implement outbound firewall block rules targeting the external command-and-control IP address.

Cevap

Isolate the compromised web server from the local network segment and implement outbound firewall block rules targeting the external command-and-control IP address.
During the containment phase, the immediate objective is to stop the spread of the attack and prevent further unauthorized access or exfiltration. Isolating the server prevents lateral spread within the subnet, while blocking the external destination IP at the boundary firewall cuts off remote adversary control. Both actions fit directly into the containment playbook.

Adım Adım Çözüm

1
Determine the current phase of the incident response process based on the active state of the compromise.
Because active external communication and host compromise are occurring in real time, response efforts must focus on Containment.
Containment limits the scope and impact of an incident before technical remediation can take place.
2
Identify specific technical actions that halt the spread of the attack without destroying live evidence prematurely.
Disconnecting/isolating the host from the network and blocking outbound connection attempts to the C2 IP meet containment criteria.
These controls restrict network access and halt adversary control while preserving system RAM and forensic log data.
3
Filter out actions associated with subsequent incident response phases.
Re-imaging the host (Eradication/Recovery) and holding a review session (Lessons Learned) are recognized as premature.
Executing recovery or lessons-learned tasks during containment leaves active threats unconstrained or destroys essential evidence.

Anahtar Kavram

Incident Response Process - Containment Phase Execution
Soru 906Soru →

During cloud infrastructure monitoring, a SOC analyst detects suspicious automated API calls using a developer service account key to copy sensitive object storage buckets to an unapproved external destination. The security team must immediately initiate containment procedures according to the incident response playbook. Which of the following containment actions should the incident response team execute immediately? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Revoke the compromised service account's active access keys and temporary session tokens.; Attach an explicit inline deny policy to the service account restricting object storage read and export operations.

Cevap

The incident response team should revoke the compromised service account's active access keys and session tokens, and attach an explicit inline deny policy restricting object storage operations.
In cloud incident response playbooks, containing compromised identity credentials requires stopping authentication and authorization channels immediately. Revoking access keys invalidates credential access, while applying an explicit IAM deny policy provides immediate permission enforcement across the cloud environment to stop ongoing data exfiltration.

Adım Adım Çözüm

1
Identify the compromised identity vector
Determined that an exposed cloud service account key is being used for unauthorized API calls.
Containment must target the specific vector facilitating unauthorized access.
2
Execute immediate credential invalidation
Revoked access keys and active tokens for the compromised service account identity.
Prevents the threat actor from issuing further API commands.
3
Enforce explicit policy-level containment
Attached an inline IAM deny policy prohibiting S3/object storage data reads and exports.
Guarantees immediate blocking of API permissions even if cached tokens persist.

Anahtar Kavram

Cloud Identity Incident Containment
Soru 907Soru →

Match each enterprise security risk scenario on the left with the most effective enterprise hardening mitigation on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Adversaries running unauthorized portable executables and unverified scripts from user temporary directories.
Lateral movement attacks utilizing legacy protocol downgrades and credential harvesting in Active Directory.
Unauthorized bootloader modification and rootkit persistence during early system startup.
Physical data exfiltration and rogue firmware injection via unmonitored client peripheral connections.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Each enterprise security risk maps directly to its specific technical hardening control: executing unauthorized binaries is mitigated by application allowlisting; legacy protocol exploitation is mitigated by disabling NTLMv1/SMBv1; bootloader tampering is mitigated by UEFI Secure Boot and TPM; and physical peripheral threats are mitigated by disabling USB storage device classes.
Each risk finding is addressed by its corresponding host or infrastructure hardening strategy: unauthorized application execution is directly prevented by application allowlisting; credential theft via protocol downgrades is mitigated by deprecating legacy protocols like NTLMv1/SMBv1; bootloader integrity tampering is prevented by hardware-backed UEFI Secure Boot; and physical storage exfiltration is controlled by disabling USB device classes.

Adım Adım Çözüm

1
Analyze execution risks from untrusted paths and match with application control mechanisms.
Identify that restricting unapproved scripts/executables requires Application Allowlisting policies.
Traditional antivirus alone often fails against custom or unverified binaries running from user directories.
2
Analyze domain lateral movement techniques relying on legacy protocols.
Identify that disabling NTLMv1/SMBv1 blocks relay and downgrade attacks.
Hardening domain network traffic requires enforcing modern protocols like Kerberos and SMB Signing.
3
Evaluate boot-level bootkit and rootkit threat vectors.
Identify that verifying pre-OS code integrity requires UEFI Secure Boot and TPM.
Hardware-rooted trust ensures that modified bootloaders cannot load before OS security controls start.
4
Evaluate physical endpoint security vectors.
Identify that restricting USB storage classes mitigates local exfiltration via peripheral devices.
Host peripheral port restriction is a key host-hardening practice for preventing physical vector compromises.

Anahtar Kavram

Enterprise Host and Infrastructure Hardening Mitigations
Soru 908Soru →

An enterprise wants to allow its employees to securely sign in to multiple external cloud-based vendor applications using their central corporate identity provider, ensuring that user passwords are never transmitted to or stored by the external vendors. Which Identity and Access Management (IAM) architectural solution best fulfills this requirement?

Cevabı ve açıklamayı göster

Cevap: Federated Identity Management using Single Sign-On protocols

Cevap

Federated Identity Management using Single Sign-On protocols is the correct architectural solution.
Federated Identity Management allows organizations to establish single sign-on across separate administrative domains. Through standards like SAML 2.0 or OpenID Connect, the central Identity Provider authenticates the user locally and issues a cryptographically signed assertion token to external cloud applications, preventing credential exposure.

Adım Adım Çözüm

1
Analyze the enterprise requirement
The requirement calls for centralized identity verification across external domain boundaries without sharing sensitive passwords.
Security best practices demand establishing trust relationships with external cloud services via centralized assertions.
2
Evaluate IAM architectural solutions for cross-domain identity sharing
Federated Identity Management (using standards such as SAML or OIDC) relies on token-based assertions from an Identity Provider (IdP) to Service Providers (Relying Parties).
Tokens allow external vendors to validate user identity securely without ever receiving password credentials.

Anahtar Kavram

Federated Identity Management and Cross-Domain Trust Architecture
Tahmini Süre:45s
Soru 909Soru →

A Security Operations Center (SOC) analyst is reviewing SIEM log correlation logic designed to detect unauthorized administrative lateral movement. The SIEM rule requires three conditions to trigger a high-severity alert:
1. A Windows Event ID 4624 (Logon Type 3 - Network) for a service account.
2. A Windows Event ID 4672 (Special privileges assigned) for the same account occurring within 60 seconds60\text{ seconds} of the logon event.
3. A Sysmon Event ID 1 (Process Creation) where `ParentImage` is `services.exe` occurring within 30 seconds30\text{ seconds} of privilege assignment.

The analyst extracts the following log sequence from a compromised server:

text
[2026-07-27T14:10:02Z] Host=SRV-FIN01 EventID=4624 LogonType=3 TargetUserName=svc_backup WorkstationName=WKSTN-77
[2026-07-27T14:11:05Z] Host=SRV-FIN01 EventID=4672 TargetUserName=svc_backup PrivilegeList=SeDebugPrivilege
[2026-07-27T14:11:15Z] Host=SRV-FIN01 EventID=1 Image=C:\Windows\System32\cmd.exe ParentImage=C:\Windows\System32\services.exe

Despite malicious process execution occurring, no SIEM alert was generated. Which of the following best explains why the correlation rule failed to trigger?

Cevabı ve açıklamayı göster

Cevap: The elapsed time between Event ID 4624 and Event ID 4672 was 63 seconds, exceeding the 60-second correlation window.

Cevap

The elapsed time between the logon event (14:10:02Z) and the privilege assignment event (14:11:05Z) was 63 seconds, which exceeds the 60-second correlation window required by the rule.
The correct answer identifies the timestamp discrepancy between the initial logon log (14:10:02Z) and the privilege assignment log (14:11:05Z). The elapsed duration of 63 seconds exceeds the strict 60-second window configured in the correlation logic, causing the SIEM engine to drop the event sequence before evaluating subsequent conditions.

Adım Adım Çözüm

1
Analyze the timestamps of the first two correlated events in the log sequence.
Event ID 4624 occurred at 14:10:02Z and Event ID 4672 occurred at 14:11:05Z.
SIEM correlation rules evaluate temporal relationships between consecutive events.
2
Calculate the time delta between Event ID 4624 and Event ID 4672.
Δt=14:11:05−14:10:02=63 seconds\Delta t = 14:11:05 - 14:10:02 = 63\text{ seconds}.
The rule explicitly requires the privilege assignment event to occur within 60 seconds of the logon event.
3
Evaluate the calculated time delta against the SIEM rule condition.
Since 63 seconds>60 seconds63\text{ seconds} > 60\text{ seconds}, condition 2 of the correlation rule failed, preventing alert generation.
Sliding correlation windows require all boolean conditions and time bounds to be satisfied simultaneously.

Anahtar Kavram

SIEM Temporal Event Correlation and Time Window Thresholds
Tahmini Süre:2m 30s
Soru 910Soru →

During a security investigation following alerts from an enterprise Network Intrusion Detection System (NIDS), a security analyst inspects captured traffic headers from a user workstation. The network logs reveal that outbound TCP port 443 connections destined for an internal authentication portal are systematically terminated via forged TCP Reset (RST) packets, while concurrent HTTP 302 response headers redirect the user's browser to submit credentials in cleartext over port 80. Which of the following network attacks is best demonstrated by these observed technical indicators?

Cevabı ve açıklamayı göster

Cevap: An on-path attack executing SSL stripping to downgrade secure sessions to unencrypted communications

Cevap

An on-path attack executing SSL stripping to downgrade secure sessions to unencrypted communications.
The scenario describes an on-path (man-in-the-middle) attack utilizing SSL stripping. In an SSL stripping attack, the threat actor sits between the client and the destination server, intercepting initial HTTPS connection attempts (port 443) and forcing the client to communicate over unencrypted HTTP (port 80) via HTTP 302 redirects. This enables the attacker to view and harvest credentials transmitted in cleartext.

Adım Adım Çözüm

1
Analyze the observed traffic indicators from the NIDS packet capture.
Identified TCP port 443 RST packets paired with HTTP 302 redirect headers targeting port 80.
Understanding packet behaviors helps isolate whether the attack operates at Layer 2, Layer 3/4, or Layer 7.
2
Evaluate the mechanism used to manipulate the client session.
The attacker actively interferes with HTTPS establishment and redirects traffic to an unencrypted channel.
This behavior specifically characterizes protocol downgrade attacks designed to bypass TLS transport security.
3
Match the observed indicators to the corresponding attack taxonomy classification.
SSL stripping (an on-path attack variant) intercepting secure sessions.
SSL stripping replaces secure HTTPS links with plain HTTP links to capture transmitted credentials in cleartext.

Anahtar Kavram

SSL/TLS Stripping and On-Path Network Attack Indicators
Tahmini Süre:1m 30s
Soru 911Soru →

A security technician is reviewing Wireless Intrusion Prevention System (WIPS) alerts after several wireless industrial sensors lost connectivity simultaneously. The WIPS telemetry reveals a sudden, sustained rise in the physical RF noise floor to −50 dBm-50\text{ dBm} across all channels in the 2.4 GHz2.4\text{ GHz} spectrum, resulting in a severely degraded Signal-to-Noise Ratio (SNR) and a high rate of corrupted frame retransmissions. Which of the following wireless attacks is indicated by these metrics?

Cevabı ve açıklamayı göster

Cevap: Radio Frequency (RF) jamming

Cevap

Radio Frequency (RF) jamming
Radio Frequency (RF) jamming occurs when an attacker transmits continuous high-power signals on target wireless frequencies. This elevates the ambient noise floor, degrades the Signal-to-Noise Ratio (SNR) to unusable levels, and prevents legitimate devices from maintaining connectivity across affected frequency channels.

Adım Adım Çözüm

1
Analyze the WIPS log telemetry
Identified a sharp increase in the background RF noise floor (reaching −50 dBm-50\text{ dBm}) affecting all channels in the 2.4 GHz2.4\text{ GHz} spectrum.
Physical layer interference spanning multiple channels indicates signal disruption at the radio frequency layer rather than protocol manipulation.
2
Evaluate the impact on wireless performance metrics
Noted a drastic drop in Signal-to-Noise Ratio (SNR) leading to frame corruption and lost sensor connectivity.
When the noise floor approaches or exceeds signal strength, wireless receivers cannot distinguish legitimate data frames from background noise.
3
Correlate indicators to specific attack signatures
Conclude that intentional high-power RF transmission (jamming) is causing the denial-of-service condition.
RF jamming elevates the physical noise floor uniformly across frequency bands without transmitting valid 802.11 frames.

Anahtar Kavram

Identifying Radio Frequency (RF) jamming attack indicators in wireless networks
Soru 912Soru →

A security analyst in a Security Operations Center (SOC) receives a high-confidence alert that a finance department workstation is infected with worm-like malware actively attempting to spread to adjacent hosts on the local subnet. According to standard incident response playbooks, which of the following actions should the analyst perform first?

Cevabı ve açıklamayı göster

Cevap: Disconnect the infected workstation from the network to isolate it from surrounding systems.

Cevap

Disconnect the infected workstation from the network to isolate it from surrounding systems.
Disconnecting the infected workstation from the network is a primary containment action. In standard incident response frameworks (such as NIST SP 800-61), once an active threat is identified, containment must occur immediately to prevent the incident from expanding and causing further damage across the enterprise network.

Adım Adım Çözüm

1
Identify the current phase of the incident response process based on the scenario indicators.
An active malware infection spreading across the local subnet indicates an ongoing, uncontained threat.
Determining the active IR phase guides the priority of subsequent actions.
2
Apply the standard Incident Response framework lifecycle order (Preparation -> Identification -> Containment -> Eradication -> Recovery -> Lessons Learned).
The immediate objective after identification is Containment.
Containment limits the scope of damage and stops potential lateral movement.
3
Select the action corresponding to the Containment phase.
Disconnecting the machine isolates the threat from spreading further.
Network isolation prevents the worm from compromising additional hosts on the subnet.

Anahtar Kavram

Incident Response Lifecycle - Containment Phase Priority
Soru 913Soru →

A security analyst discovers that an operational AWS IAM access key belonging to a production microservice repository was inadvertently committed to a public version control repository. Following standard incident response playbook procedures for credential exposure, place the following response actions in the correct sequential order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of incident response actions is: 1) Revoke the exposed IAM access key and apply an explicit deny policy, 2) Isolate affected compute instances and preserve volatile memory, 3) Analyze CloudTrail logs to identify and eradicate persistence mechanisms, 4) Deploy clean application instances with rotated credentials and restore operations, and 5) Conduct a post-incident review to implement automated secret scanning and update playbooks.
The correct order follows standard incident response frameworks applied to credential exposure playbooks: initial containment (revoking credentials and isolating workloads), eradication (analyzing audit logs to uncover and remove adversary persistence), recovery (redeploying clean workloads with newly generated secrets), and post-incident activity (updating preventive secret-scanning hooks and playbooks).

Adım Adım Çözüm

1
Revoke Compromised Credentials
Terminates ongoing malicious API transactions using the exposed access key.
Immediate containment must disable the attack vector before the adversary can execute further actions.
2
Isolate Systems and Safeguard Evidence
Prevents adversary lateral movement and preserves volatile memory dumps.
Workload isolation limits blast radius while preserving digital forensic evidence for investigation.
3
Scope Impact and Eradicate Persistence
Identifies unauthorized infrastructure modifications, rogue IAM roles, and persistent backdoors.
Complete eradication requires identifying and removing all adversary footholds prior to system recovery.
4
System Recovery and Secret Rotation
Restores application workloads using clean images and new secrets.
Recovery ensures business services resume securely without lingering threat actor access.
5
Post-Incident Lessons Learned
Implements automated CI/CD secret scanning and improves the response playbook.
Post-incident activities address root causes and update organizational controls to prevent recurrence.

Anahtar Kavram

Incident Response Lifecycle & Playbook Execution Sequence
Soru 914Soru →

A security operations team is configuring a Security Information and Event Management (SIEM) data pipeline to handle heterogeneous syslog and event streams from enterprise endpoints, firewalls, and application servers. Place the following SIEM processing stages in the correct chronological order from initial data intake to analyst notification.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological sequence for processing logs within a SIEM pipeline is: Log Collection, Log Parsing, Log Normalization, SIEM Correlation, and Alert Generation.
The correct order follows the standard SIEM processing pipeline lifecycle: Raw log entries are first gathered during Log Collection. Once ingested, Log Parsing extracts discrete data elements from raw strings. Next, Log Normalization maps these parsed elements to a unified schema so logs from different vendors can be compared uniformly. SIEM Correlation then evaluates rules across the normalized event streams to detect multi-host or multi-step threats. Finally, Alert Generation triggers incident tickets and notifications for security analysts when correlation thresholds are matched.

Adım Adım Çözüm

1
Identify the initial intake phase of raw log data from distributed security controls and endpoints.
Log Collection is established as the first stage.
Data must be gathered from source systems before any downstream processing or analysis can occur.
2
Determine how raw log strings are structured into key-value data elements.
Log Parsing follows collection.
Unstructured text entries must be parsed into distinct key-value pairs before standardizing field formats.
3
Standardize variable field naming conventions across diverse vendor logs.
Log Normalization follows parsing.
Mapping parsed fields to a unified data model allows the correlation engine to evaluate heterogeneous logs consistently.
4
Analyze cross-system normalized events against security logic rules.
SIEM Correlation follows normalization.
Correlation rules require standardized inputs from multiple log sources to detect multi-stage attack indicators.
5
Output security events requiring human intervention or automated incident response.
Alert Generation is the final stage.
Alerts and tickets are generated only after correlation logic identifies suspicious behavior matching defined thresholds.

Anahtar Kavram

SIEM Log Processing Pipeline Lifecycle
Soru 915Soru →

A Security Operations Center (SOC) team validates an active alert showing that a core database server hosting sensitive human resources data is performing covert DNS tunneling to transmit data to an external command-and-control (C2) IP address. The incident has been confirmed and analyzed. According to the NIST SP 800-61 incident response lifecycle, which of the following actions should the incident response team perform FIRST?

Cevabı ve açıklamayı göster

Cevap: Isolate the compromised database server from the network by adjusting security group rules or applying a containment VLAN.

Cevap

Isolate the compromised database server from the network by adjusting security group rules or applying a containment VLAN.
According to standard NIST SP 800-61 guidelines for incident response, once an incident is detected and confirmed, the immediate next phase is Containment. Isolating the affected database server stops active DNS tunneling exfiltration and prevents lateral movement while maintaining volatile system evidence for forensic analysis.

Adım Adım Çözüm

1
Identify the current phase in the NIST SP 800-61 incident response framework based on scenario context.
The incident has already been detected and analyzed; the active incident requires immediate mitigation to prevent further damage.
The scenario states that the breach is validated and data exfiltration via covert DNS tunneling is actively occurring.
2
Determine the required primary objective for an ongoing data exfiltration event.
Prevent further data loss and restrict adversary control over the compromised asset.
Containment limits the scope of an incident before permanent recovery or root-cause remediation steps are executed.
3
Select the action that aligns with the containment phase prior to eradication or recovery.
Isolating the database server from the network effectively halts DNS tunneling exfiltration while preserving system state.
Network isolation contains the threat immediately without altering volatile memory or alerting attackers prior to isolating the breach.

Anahtar Kavram

Incident Response Lifecycle Phase Order (Containment before Eradication and Recovery)
Tahmini Süre:2m 0s
Soru 916Soru →

A forensic analyst receives a bit-stream disk image of a compromised virtual domain controller from an external incident response team. Prior to initiating analysis, the analyst calculates a SHA-256 hash of the evidence file and discovers that it does not match the SHA-256 hash value documented on the accompanying chain of custody form. Which of the following describes the most appropriate immediate course of action for the analyst to take?

Cevabı ve açıklamayı göster

Cevap: Document the hash discrepancy on the chain of custody log and halt analysis on the copy until the integrity discrepancy is investigated, as the evidence is legally inadmissible in its current state.

Cevap

Document the hash discrepancy on the chain of custody log and halt analysis on the copy until the integrity discrepancy is investigated, as the evidence is legally inadmissible in its current state.
In digital forensics, a cryptographic hash (such as SHA-256) serves as a digital fingerprint verifying that an evidence copy remains an exact bit-stream duplicate of the original source. If the computed hash does not match the hash logged at acquisition, the integrity of the evidence has been compromised. The investigator must document the discrepancy in the chain of custody record and refrain from analyzing the corrupted copy until the baseline can be verified against master image copies.

Adım Adım Çözüm

1
Verify cryptographic integrity baseline
Discovered SHA-256 hash mismatch between received disk image and chain of custody documentation.
Cryptographic hashes verify that forensic images are bit-for-bit identical to the acquired evidence.
2
Apply forensic evidence handling rules
Recognize potential evidence contamination, corruption, or improper transfer handling.
A hash mismatch proves the evidence file was altered after the baseline hash was recorded.
3
Execute chain of custody protocol
Log the discrepancy immediately and suspend analysis on the compromised file pending source verification.
Preserves forensic soundness and prevents downstream analysis of corrupted or invalid evidence.

Anahtar Kavram

Cryptographic Hash Verification and Chain of Custody Integrity
Soru 917Soru →

A security specialist investigates an automated alert triggered in a Security Information and Event Management (SIEM) dashboard. The alert aggregates logs from the web application firewall (WAF) and the database audit logger as shown below:

[2026-07-27T14:02:11Z] WAF_LOG: Src=203.0.113.84 URI="/search.php?item=1%27%20OR%201=1--" Action=ALLOWED HTTP_Status=200
[2026-07-27T14:02:15Z] DB_AUDIT: User=app_web Query="SELECT * FROM items WHERE item_id = '1' OR 1=1--" Execution_Status=SUCCESS RowsReturned=84200
[2026-07-27T14:02:18Z] SIEM_CORRELATION: RuleID=RL-4092 Trigger="High Volume Data Read Post WAF Anomaly"

Based on these correlated log entries, which of the following security events is actively occurring?

Cevabı ve açıklamayı göster

Cevap: A successful SQL Injection (SQLi) attack that bypassed web application filtering and resulted in unauthorized data retrieval.

Cevap

A successful SQL Injection (SQLi) attack that bypassed web application filtering and resulted in unauthorized data retrieval.
The correct answer identifies a successful SQL Injection attack. The WAF log captures the URI parameter containing the classic SQL syntax injection `1' OR 1=1--`. The database audit log demonstrates that the input was passed un-sanitized into the SQL query statement, evaluating `1=1` to true for all rows and returning 84,200 database records.

Adım Adım Çözüm

1
Analyze the WAF log payload
The HTTP request contains the URL parameter `item=1' OR 1=1--`, which utilizes SQL metacharacters (`'` and `--`) to alter database query syntax.
Recognizing attack signatures in web logs is necessary to determine the threat vector.
2
Examine the DB Audit log entry
The web application account executed `SELECT * FROM items WHERE item_id = '1' OR 1=1--` and returned 84,200 records.
Verifying database logs confirms whether the injected payload reached the backend and executed successfully.
3
Correlate event timeline and SIEM rule trigger
The SIEM successfully correlated the WAF payload with the subsequent bulk database read, confirming an active SQL injection data exfiltration attempt.
Correlating timestamped logs across heterogeneous systems allows analysts to validate true positive incidents.

Anahtar Kavram

Log Analysis and SIEM Event Correlation
Tahmini Süre:1m 30s
Soru 918Soru →

A telemedicine organization is updating its infrastructure to align with Zero Trust Architecture (ZTA) principles for remote radiologists querying patient imaging databases hosted across hybrid cloud environments. The lead security architect mandates that access decisions must continuously evaluate user identity, device compliance, and real-time risk context, while separate proxy gateways enforce those authorization decisions at the resource boundary. Which of the following architectural implementations best satisfies this requirement?

Cevabı ve açıklamayı göster

Cevap: Establishing a centralized Policy Decision Point (PDP) to continuously evaluate contextual trust signals and direct dedicated Policy Enforcement Points (PEPs) to grant or deny access per request

Cevap

Establishing a centralized Policy Decision Point (PDP) to continuously evaluate contextual trust signals and direct dedicated Policy Enforcement Points (PEPs) to grant or deny access per request.
Zero Trust Architecture explicitly separates control plane functions from data plane functions. The Policy Decision Point (PDP) evaluates policy, device posture, identity context, and threat intelligence to make dynamic access decisions. It then instructs the Policy Enforcement Point (PEP) situated inline near the target resource to allow, deny, or terminate specific connection sessions.

Adım Adım Çözüm

1
Identify key Zero Trust requirements from the scenario
The architecture demands dynamic evaluation of context and device health (decision logical component) separated from traffic enforcement at resource boundaries (enforcement logical component).
Zero Trust separates the control plane (PDP) from the data plane (PEP).
2
Map ZTA functional components to the requirement
The Policy Decision Point (PDP), consisting of the Policy Engine and Policy Administrator, computes trust and sends decisions to the Policy Enforcement Point (PEP) operating inline.
This guarantees per-request evaluation and explicit verification rather than implicit network-level trust.

Anahtar Kavram

Decoupling Policy Decision Points (PDP) from Policy Enforcement Points (PEP) in Zero Trust Architecture
Soru 919Soru →

A lead security analyst at a financial enterprise is optimizing the organization's security operations center (SOC) workflows. The analyst requires an external threat intelligence source that provides professionally verified, machine-readable technical Indicators of Compromise (IoCs)—such as malicious IP addresses, domain names, and file hashes—updated in real time for direct automated ingestion into their SIEM. Which of the following threat intelligence sources best satisfies these requirements?

Cevabı ve açıklamayı göster

Cevap: Commercial threat intelligence feed

Cevap

Commercial threat intelligence feeds provide professionally curated, structured, and machine-readable indicator streams designed specifically for real-time automated ingestion into enterprise SIEM systems.
Commercial threat intelligence feeds deliver structured, professionally curated, and validated indicators of compromise (IoCs) formatted specifically for direct automated ingestion into enterprise security solutions like SIEMs and firewalls.

Adım Adım Çözüm

1
Analyze the operational requirements stated in the scenario
The requirement calls for a source delivering verified, machine-readable Indicators of Compromise (IoCs) structured for direct, real-time SIEM automation.
Evaluating specific criteria such as automation capability, data structure, and technical level isolates the appropriate threat intelligence category.
2
Differentiate between threat intelligence source characteristics
Commercial feeds deliver vetted, structured IoC feeds with SLA-backed accuracy; OSINT blogs are unstructured; NVD focuses on software flaws rather than active attack indicators; and ISAC executive briefings deliver strategic human-focused narrative reports.
Understanding the distinct roles of commercial feeds, vulnerability repositories, public intelligence, and sector sharing bodies is essential for effective security deployment.
3
Determine the optimal threat intelligence source
The commercial threat intelligence feed is the only option that fulfills all criteria for automated real-time technical ingestion and vendor verification.
Commercial providers specialize in low-latency, machine-readable formats (such as STIX/TAXII integrations) designed specifically for security tool automation.

Anahtar Kavram

Threat Intelligence Sources and Research
Soru 920Soru →

A security analyst is investigating a high-priority correlation alert in a Security Information and Event Management (SIEM) dashboard. The analyst reviews the following sequential event logs collected from a Web Application Firewall (WAF), an Nginx web server, and a Linux host kernel audit subsystem (auditd):

text
[2026-07-27T14:22:01.104Z] WAF-ALERT rule_id=942100 severity=CRITICAL client_ip=198.51.100.44 uri="/api/v1/export?format=pdf&cmd=id" action=DETECTED_ONLY
[2026-07-27T14:22:01.108Z] HTTP-ACCESS client_ip=198.51.100.44 status=200 method=GET uri="/api/v1/export?format=pdf&cmd=%3B%20cat%20%2Fetc%2Fpasswd" bytes=4096
[2026-07-27T14:22:01.112Z] AUDITD type=EXECVE pid=88412 ppid=1420 (www-data) comm="sh" args="sh -c cat /etc/passwd"

Based on the provided log telemetry, which of the following conclusions and remediation requirements are correct? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The Web Application Firewall was operating in a non-blocking inspection mode, allowing the command injection payload to reach the backend web server.; The attacker successfully executed arbitrary OS commands under the context of the unprivileged web service account (www-data).

Cevap

The WAF was operating in detection-only mode, permitting the payload to pass, and the attacker successfully achieved remote OS command execution as the web service user.
Analyzing the log timestamps and fields reveals two key findings: First, the WAF log displays action=DETECTED_ONLY, meaning the WAF alerted on the threat signature but did not drop or reset the TCP connection. Second, the host system audit log (auditd EXECVE) confirms that the web application executed a shell command ('sh -c cat /etc/passwd') under the privileges of the web service account ('www-data').

Adım Adım Çözüm

1
Analyze the WAF log entry for enforcement action and alert triggers.
Rule 942100 triggered a critical severity alert for client IP 198.51.100.44, but the action was logged as DETECTED_ONLY rather than BLOCKED.
Determines whether perimeter filtering inline controls prevented the malicious request.
2
Analyze the HTTP web server access log for response status and payload content.
The server returned HTTP status 200 OK with 4096 response bytes for a URI containing URL-encoded shell parameters (%3B%20cat%20%2Fetc%2Fpasswd).
Confirms the backend application accepted the HTTP request and processed it successfully.
3
Correlate host system audit logs (auditd) using process telemetry and timestamps.
Four milliseconds after the HTTP request, auditd logged an EXECVE execution event of 'sh -c cat /etc/passwd' originating from parent process ID 1420 owned by the 'www-data' service account.
Confirms root cause and successful execution of OS command injection on the host OS.

Anahtar Kavram

SIEM Correlation of WAF, Web, and Host Logs for Command Injection
ÖncekiSayfa 46 / 112Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin