Examkin

Tüm alıştırma soruları

2232 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 1181Soru →

A network security administrator is investigating reports of intermittent network interception on a local subnet. Upon inspecting the ARP table of a target workstation, the administrator records the following entry state:

IP AddressMAC AddressBinding Type
192.168.1.100-11-22-AA-BB-CCDynamic
192.168.1.10500-11-22-AA-BB-CCDynamic

Where 192.168.1.1 is the default gateway and 192.168.1.105 belongs to an unauthorized host on the network. Which of the following attack types is indicated by these findings?

Cevabı ve açıklamayı göster

Cevap: ARP Poisoning

Cevap

ARP Poisoning
ARP poisoning is characterized by spoofed ARP responses that bind an attacker's MAC address to the IP address of a legitimate host or gateway on the local network. The ARP cache output clearly demonstrates two distinct IP addresses bound to the exact same physical MAC address (00-11-22-AA-BB-CC), indicating traffic redirection to the attacker's system.

Adım Adım Çözüm

1
Analyze the observed network indicator table
The gateway IP (192.168.1.1) and host IP (192.168.1.105) both map to the identical MAC address 00-11-22-AA-BB-CC.
In standard IPv4 Ethernet networks, each IP address on a local segment must map to a unique physical network interface MAC address.
2
Identify the underlying mechanism and protocol vulnerability
Unsolicited ARP responses (Gratuitous ARP) allow an attacker host to overwrite legitimate entries in local ARP caches.
Address Resolution Protocol (ARP) lacks intrinsic authentication mechanisms, making local devices trust incoming ARP responses.
3
Select the matching attack classification
Mapping an attacker's hardware address to a gateway IP address is the core indicator of ARP poisoning.
This setup allows the unauthorized host to execute an On-Path (Man-in-the-Middle) attack by intercepting subnet traffic destined for the gateway.

Anahtar Kavram

ARP Poisoning Indicators
Soru 1182Soru →

Match each enterprise security assessment objective on the left with the scanning configuration or methodology best suited to satisfy it on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Detecting OS patch deficiencies on short-lived, auto-scaling cloud compute nodes without relying on periodic network sweeps
Identifying security vulnerabilities within application dependencies before software builds are pushed to production registries
Assessing authenticated user session security on a live web application without triggering automated account lockouts
Discovering active services and rogue endpoints on a sensitive SCADA/ICS network segment without sending probe traffic

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct pairings match each specific enterprise constraint with its appropriate scanning methodology: assessing short-lived auto-scaling nodes requires Agent-Based Vulnerability Scanning; inspecting application libraries pre-deployment requires Static Container & Dependency Scanning; testing authenticated web applications without lockout requires Credentialed Dynamic Web Application Scanning with Throttled Authentication Scripts; and discovering assets on sensitive SCADA networks requires Passive Network Monitoring.
Each assessment methodology addresses distinct operational constraints. Agent-based scanning is ideal for ephemeral cloud workloads because the scanner software executes locally as soon as the instance boots, sending results back to a central console without needing network probe access. Static container and dependency scanning shifts security left into the software development life cycle, analyzing manifest files and container layers before software reaches production. Credentialed dynamic web scanning allows deep inspection of post-authentication application logic, but requires specific throttling rules so automated fuzzing does not trigger account lockouts. Passive network monitoring reads raw traffic copies (SPAN/TAP) to build an asset inventory on sensitive industrial SCADA networks without generating active network traffic that could cause device crashes.

Adım Adım Çözüm

1
Analyze the technical constraints and risk profiles for each enterprise deployment environment.
Identified key operational boundaries: ephemeral lifetime in cloud nodes, shift-left pipeline security for dependencies, lockout sensitivity in web apps, and system instability risks in SCADA networks.
Matching scanning methods to enterprise scenarios requires balancing coverage depth against network and operational impact.
2
Select the scanning architecture tailored to mitigate each specific operational drawback.
Local agents solve cloud host ephemerality; pipeline integration catches build defects early; throttled dynamic scanners prevent web account lockouts; passive packet capturing avoids SCADA crashes.
Each vulnerability assessment method operates at a distinct layer (host, pipeline, application layer, or passive wire level) designed for specific operational constraints.

Anahtar Kavram

Selecting and configuring vulnerability assessment methods appropriate for cloud, pipeline, web application, and operational technology (OT) environments.
Tahmini Süre:2m 30s
Soru 1183Soru →

During security operations monitoring, incident responders confirm an active data exfiltration event where an internal database server is sending bulk sensitive records via covert DNS port 53 queries to an untrusted external domain. According to standard incident response lifecycle frameworks, which of the following actions represents the immediate next step the incident response team should perform?

Cevabı ve açıklamayı göster

Cevap: Isolate the compromised database host from the network and block the external destination domain at the egress firewall.

Cevap

Isolate the compromised database host from the network and block the external destination domain at the egress firewall.
Isolating the host or blocking the external destination domain directly addresses the containment phase of the incident response lifecycle. Halting the DNS tunneling channel prevents additional data loss while keeping the host available for volatile memory capture and forensic investigation.

Adım Adım Çözüm

1
Identify the current incident response phase based on the scenario.
The incident has been detected and validated as an ongoing breach (data exfiltration in progress).
Recognizing active exfiltration places the incident response team immediately into the containment phase.
2
Apply NIST SP 800-61 containment strategies to halt threat impact.
Network isolation and egress blocking immediately interrupt the exfiltration channel.
Containment limits damage to enterprise assets before forensic preservation, eradication, and recovery begin.
3
Evaluate distractors for out-of-sequence or mismatched control responses.
Actions such as host re-imaging belong to eradication/recovery, while WAF tuning misdiagnoses the DNS tunneling vector.
Standard IR playbooks strictly require containment to precede eradication and recovery.

Anahtar Kavram

Incident Response Lifecycle Containment Phase
Soru 1184Soru →

A manufacturing company relies on legacy operational technology (OT) workstations to manage assembly line machinery. Because these systems run specialized software on an outdated operating system that cannot receive vendor security updates, the security team must harden the workstations without disrupting continuous operations. The primary requirement is to block unauthorized executable files and unapproved dynamic-link libraries (DLLs) from running on the systems. Which of the following host hardening strategies is MOST effective for this requirement?

Cevabı ve açıklamayı göster

Cevap: Implementation of application allowlisting policies

Cevap

Implementation of application allowlisting policies is the most effective host hardening strategy.
Application allowlisting (also known as application whitelisting) enforces an explicit default-deny rule on host OS processes. Only pre-approved binaries, scripts, and libraries (DLLs) specified by hash, path, or digital signature are permitted to execute. This makes it ideal for static legacy operational technology environments where OS patching is impossible.

Adım Adım Çözüm

1
Analyze the scenario constraints and requirements.
The target legacy OT systems cannot be patched, run fixed single-purpose software, and require strict prevention of unauthorized binary execution.
Hardening unpatchable legacy hosts requires restrictive execution controls rather than relying on patch management or perimeter filters.
2
Evaluate candidate host-hardening controls against binary execution restriction.
Application allowlisting enforces a strict default-deny policy for any executable, script, or library file not explicitly approved by file path, publisher certificate, or cryptographic hash.
Default-deny application control is optimal for static-function systems like HMIs and OT controllers.
3
Compare against network-level and detective controls.
Firewalls, honeypots, and vulnerability scanners fail to stop localized file execution on the endpoint.
Endpoint security controls are necessary to enforce execution protection on host systems.

Anahtar Kavram

Host Application Hardening and Allowlisting
Soru 1185Soru →

An Endpoint Detection and Response (EDR) agent on a critical enterprise macOS host generates a high-priority alert indicating that an unprivileged process is attempting direct system calls to read sensitive memory structures, bypassing user-mode security hooks. Which of the following actions performed via the EDR administration console is the most appropriate immediate step to contain the incident while preserving volatile forensic evidence?

Cevabı ve açıklamayı göster

Cevap: Initiate network-level host isolation of the endpoint through the EDR console.

Cevap

Initiate network-level host isolation of the endpoint through the EDR console.
Initiating network-level host isolation via the EDR console immediately disconnects the endpoint from external network communications and internal lateral movement vectors. Crucially, host isolation allows the OS to remain powered on so security analysts can remotely collect volatile memory (RAM) and EDR telemetry for forensic investigation.

Adım Adım Çözüm

1
Identify the primary threat containment objective.
Recognize that memory manipulation attacks require stopping active malicious propagation without destroying volatile system memory.
Shutting down the host loses critical RAM artifacts needed for memory analysis.
2
Evaluate EDR containment capabilities vs legacy or network controls.
EDR host isolation places software-level network filters directly on the host interface, disabling external communications while preserving local system state and analyst management sessions.
Perimeter firewalls do not prevent local segment lateral movement, and antivirus signatures cannot stop in-memory execution.
3
Select the correct EDR workflow response.
Host isolation provides immediate containment compliant with proper incident response phase sequence.
Containment must occur before full eradication and recovery, without violating evidence preservation principles.

Anahtar Kavram

EDR Host Isolation and Telemetry Preservation
Tahmini Süre:2m 0s
Soru 1186Soru →

A cybersecurity analyst is setting up a scheduled vulnerability assessment for production servers. The main requirement is to identify missing patches and misconfigurations without risking system crashes or service outages. Which scanning method should the analyst use?

Cevabı ve açıklamayı göster

Cevap: Non-intrusive vulnerability scan

Cevap

The analyst should select a non-intrusive vulnerability scan.
A non-intrusive vulnerability scan identifies security weaknesses, missing patches, and misconfigurations by inspecting version strings and configuration data without attempting to exploit the vulnerabilities. This satisfies the requirement to safely assess systems without taking production services offline.

Adım Adım Çözüm

1
Identify the primary operational constraint in the scenario.
The assessment must assess system security without causing service outages or system instability on production servers.
Production environments require safe testing methods that minimize operational downtime risks.
2
Evaluate scanning techniques against the constraint.
Non-intrusive scans query systems for version information and known flaw indicators without trying to exploit them.
Exploitation attempts are reserved for intrusive scans and penetration testing.
3
Select the appropriate scanning technique.
Choose a non-intrusive vulnerability scan as the safest assessment option.
It fulfills the requirement to identify vulnerabilities safely without risking service interruption.

Anahtar Kavram

Non-intrusive vs. Intrusive Vulnerability Scanning
Soru 1187Soru →

A Security Operations Center (SOC) analyst detects an unauthorized third-party integration added to an enterprise cloud tenant, followed by bulk exfiltration of sensitive email records via an exposed OAuth 2.0 token. According to standard incident response frameworks, in what sequence should the IR team execute the following response and recovery steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of incident response steps is: 1) Revoke the malicious OAuth 2.0 token and isolate compromised user accounts to stop ongoing exfiltration (Containment); 2) Remove the rogue third-party app integration from the cloud tenant and audit application permissions (Eradication); 3) Restore compromised account configurations, issue new credentials, and re-enable monitored email services (Recovery); 4) Conduct a post-incident review to document the timeline and update consent policies (Lessons Learned).
NIST SP 800-61 Rev 2 incident response playbooks require executing steps sequentially: Containment (revoking tokens/isolating accounts to stop damage), Eradication (deleting rogue applications to remove persistence), Recovery (restoring account configurations and services safely), and Lessons Learned (post-incident reviews to refine policy and controls).

Adım Adım Çözüm

1
Identify initial Containment actions
Revoking the active OAuth token and isolating affected accounts immediately halts unauthorized data exfiltration.
Containment is the priority operational phase immediately following detection to minimize blast radius.
2
Identify Eradication actions
Deleting the rogue OAuth application integration removes the threat actor's persistence mechanism.
Eradication eliminates root-cause vulnerabilities and malicious artifacts once active threats are contained.
3
Identify Recovery actions
Resetting credentials and re-enabling email services returns the business environment to normal baseline operation.
Recovery validates that systems are clean and monitored before restoring them to full production.
4
Identify Post-Incident / Lessons Learned actions
Documenting metrics and updating cloud consent policies hardens governance against similar attack vectors.
Lessons learned activities synthesize incident metrics to strengthen controls and update playbooks post-remediation.

Anahtar Kavram

Incident Response Lifecycle Phases (NIST SP 800-61 Rev 2 / CompTIA IR Framework)
Soru 1188Soru →

A security analyst confirms that an active remote access Trojan (RAT) is running on an internal finance server and establishing outbound connections to an external command-and-control server. According to standard incident response lifecycle frameworks, which of the following actions should the analyst perform NEXT?

Cevabı ve açıklamayı göster

Cevap: Isolate the finance server from the network to halt communication with the external server.

Cevap

Isolate the finance server from the network to halt communication with the external server.
Network isolation of the affected host is the primary action during the containment phase. Following incident detection and confirmation, containment must occur immediately to prevent the attacker from exfiltrating data or expanding their reach across the network.

Adım Adım Çözüm

1
Determine the current phase of the incident response process.
An active intrusion with command-and-control traffic has been verified, transitioning the response from detection to containment.
According to standard frameworks (such as NIST SP 800-61), active threats must be contained immediately to minimize damage.
2
Select the action that restricts impact while protecting evidence.
Network isolation prevents lateral movement and exfiltration while keeping RAM and volatile storage intact for forensic collection.
Containment limits the scope of an incident prior to starting eradication or recovery steps.

Anahtar Kavram

Incident Response Phase Order (Containment First)
Tahmini Süre:1m 0s
Soru 1189Soru →

A security analyst is reviewing correlated alerts in a Security Information and Event Management (SIEM) dashboard following an automated high-severity trigger. The SIEM correlated the following two sequential event log entries captured from an internal workstation within a 5-second interval:

text EventID: 4624 Source: Microsoft-Windows-Security-Auditing Time: 2026-07-27T14:22:05Z Logon Type: 3 (Network) Account Name: admin_corp Workstation Name: WS-FINANCE-04 Source Network Address: 10.0.4.112 Elevated Token: Yes EventID: 7045 Source: Service Control Manager Time: 2026-07-27T14:22:10Z User: NT AUTHORITY\SYSTEM Service Name: PSEXESVC Service File Name: %SystemRoot%\PSEXESVC.exe Image Path: C:\Windows\PSEXESVC.exe Start Type: demand start

Which of the following attack vectors is most directly indicated by this log sequence?

Cevabı ve açıklamayı göster

Cevap: Lateral movement executing remote service installation via administrative credentials

Cevap

Lateral movement executing remote service installation via administrative credentials
The combination of Event ID 4624 showing a Logon Type 3 (Network logon) with an elevated token and Event ID 7045 logged 5 seconds later showing the installation of `PSEXESVC.exe` directly indicates remote execution via PsExec. Attackers frequently leverage PsExec with stolen administrative credentials to move laterally across workstations and servers.

Adım Adım Çözüm

1
Analyze Event ID 4624 details
Identified a successful Network Logon (Logon Type 3) using an elevated account (`admin_corp`) initiated from remote host `10.0.4.112`.
Logon Type 3 indicates network authentication to host resources, such as SMB shares or administrative RPC interfaces.
2
Analyze Event ID 7045 details
Identified the installation of a new system service named `PSEXESVC` running executable `PSEXESVC.exe` under `NT AUTHORITY\SYSTEM`.
Event ID 7045 tracks new Windows service creations. `PSEXESVC` is the default service binary registered by Sysinternals PsExec during remote process execution.
3
Correlate both log events in temporal order
Confirmed network authentication followed within 5 seconds by remote service installation.
This specific log pairing is a high-confidence signature of PsExec-based lateral movement across enterprise Windows hosts.

Anahtar Kavram

Correlating Windows Security Event ID 4624 (Logon Type 3) and System Event ID 7045 (Service Installation) to detect remote administrative tool usage and lateral movement.
Soru 1190Soru →

A security analyst is investigating a suspected threat actor moving laterally within an enterprise network. The edge firewall recorded no unauthorized inbound traffic, and the legacy signature-based antivirus on host endpoints reported zero malicious file detections. However, the Endpoint Detection and Response (EDR) agent flagged an active alert when a natively trusted system utility, `wmic.exe`, was executed by a parent process to delete volume shadow copies. Which of the following capabilities of EDR enabled the identification of this malicious activity?

Cevabı ve açıklamayı göster

Cevap: Continuous behavioral telemetry monitoring and process lineage tracking

Cevap

Continuous behavioral telemetry monitoring and process lineage tracking
The correct answer highlights EDR's core strength: continuously capturing process execution context, command-line arguments, and parent-child process relationships. Because `wmic.exe` is a legitimate Windows binary, legacy signature scanners mark it as clean. EDR detects the threat by analyzing the anomaly in behavioral telemetry and process lineage when an administrative tool is invoked inappropriately.

Adım Adım Çözüm

1
Analyze the attack mechanism described in the scenario
The attacker utilized a legitimate, signed system utility (`wmic.exe`) to execute a command, bypassing file-based antivirus signatures.
Living off the Land (LotL) attacks rely on native OS binaries that carry valid signatures.
2
Evaluate why perimeter and signature controls failed
Perimeter firewalls only inspect boundary network traffic, and legacy AV relies on known bad file hashes.
Valid OS utilities do not trigger file signature alerts or perimeter boundary violations.
3
Identify the specific EDR mechanism that triggered the detection alert
EDR records continuous endpoint behavioral telemetry, including process creation trees (parent-child process execution lineage).
Detecting unusual execution contexts of legitimate binaries requires analyzing process behavior and execution chains.

Anahtar Kavram

EDR Behavioral Telemetry and Process Lineage
Soru 1191Soru →

A security analyst reviews an alert from a Network Intrusion Detection System (NIDS). The alert log captures an incoming HTTP request containing the payload: `http://example.com/login?user=admin' OR '1'='1'--`. Which of the following statements correctly identify the type of attack detected and an effective mitigation? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The log entry captures a SQL injection attack targeting the backend database to bypass authentication.; Implementing parameterized queries (prepared statements) within the web application prevents this attack type.

Cevap

The alert indicates a SQL injection attack, and the proper mitigation is implementing parameterized queries in the web application code.
The payload `' OR '1'='1'--` is a classic SQL injection signature aimed at evaluating database queries to true to bypass authentication. Using parameterized queries in the application code ensures database drivers handle user inputs as parameter data rather than executable commands, rendering SQL injection ineffective.

Adım Adım Çözüm

1
Analyze the network security monitoring alert payload
Identified SQL syntax manipulation (`' OR '1'='1'--`) designed to evaluate boolean logic to true.
Recognizing command syntax patterns helps differentiate between web application attack types.
2
Match the attack pattern to the correct attack category
Confirmed the attack is SQL injection rather than client-side script execution (XSS).
SQL injection specifically targets relational database management systems integrated with web applications.
3
Identify the appropriate remediation control
Selected parameterized queries as the secure application development mitigation.
Parameterized queries ensure user input cannot modify the structure of pre-compiled SQL statements.

Anahtar Kavram

Network Intrusion Detection and Web Attack Analysis
Tahmini Süre:1m 0s
Soru 1192Soru →

During a financial audit of a modern web application, security engineers discover that concurrent asynchronous POST requests to the payment endpoint allow users to apply a single-use promotional credit code multiple times simultaneously before the database updates the credit balance to zero. Which of the following application vulnerabilities is being exploited in this scenario?

Cevabı ve açıklamayı göster

Cevap: Time-of-check to time-of-use (TOCTOU) race condition

Cevap

Time-of-check to time-of-use (TOCTOU) race condition
The correct answer correctly identifies the vulnerability as a race condition, specifically a time-of-check to time-of-use (TOCTOU) flaw. When multiple asynchronous requests execute simultaneously, the application checks the credit balance validity for all threads before any single thread finishes updating the balance, allowing duplicate redemptions.

Adım Adım Çözüm

1
Analyze the reported application behavior
Multiple asynchronous requests are processed simultaneously to reuse a single-use resource before the database state updates.
Identifying the root cause requires understanding how timing and state changes interact during concurrent processing.
2
Evaluate vulnerability classifications
The flaw occurs because the system validates state at time t1t_1 (check) and modifies state at time t2t_2 (use), creating a window for exploit via concurrent threads.
This timing window between validation and execution is the defining characteristic of a TOCTOU race condition.

Anahtar Kavram

Race Conditions and Concurrency Issues (TOCTOU)
Soru 1193Soru →

A digital forensic examiner receives a powered-off workstation hard drive confiscated during an insider threat investigation. The examiner needs to duplicate the physical drive onto a forensic storage unit for analysis while ensuring evidence admissibility in court. Which of the following actions should the examiner take FIRST?

Cevabı ve açıklamayı göster

Cevap: Attach the drive to a hardware write-blocker before connecting it to the forensic workstation.

Cevap

Attach the drive to a hardware write-blocker before connecting it to the forensic workstation.
Attaching the drive to a hardware write-blocker prevents any write signals from reaching the source disk, guaranteeing that no file timestamps or data blocks are altered during the acquisition phase.

Adım Adım Çözüm

1
Identify the primary requirement for disk-based evidence acquisition.
The target physical storage device must be protected against any write commands from the acquiring system.
Operating systems automatically write hidden system metadata, update access timestamps, or modify logs when storage drives are attached without hardware write protection.
2
Select the appropriate control for physical disk evidence protection.
Interpose a hardware write-blocker between the original suspect storage drive and the forensic analysis machine.
Hardware write-blockers intercept write commands at the controller layer, ensuring bit-for-bit acquisition without altering the source media.

Anahtar Kavram

Write-Blocker Utilization and Forensics Integrity
Tahmini Süre:1m 0s
Soru 1194Soru →

A system architect is designing high-availability storage connectivity for a mission-critical database server connected to a Storage Area Network (SAN). The design must ensure continuous data access even if a host bus adapter (HBA), interconnect cable, or SAN switch fails, while also balancing traffic across active pathways. Which of the following architectural controls should the security architect implement to fulfill this requirement?

Cevabı ve açıklamayı göster

Cevap: Multipath I/O (MPIO)

Cevap

Multipath I/O (MPIO) is the correct architectural control to provide high availability and load balancing for SAN storage connectivity across redundant host bus adapters and storage switches.
Multipath I/O (MPIO) is designed specifically to leverage multiple physical connections (host bus adapters, cables, and SAN switches) between a server and a storage array. It provides automatic path failover and load balancing, ensuring continuous operational availability if any single network path component fails.

Adım Adım Çözüm

1
Analyze the technical requirements of the scenario.
The requirement calls for fault tolerance and load balancing across storage interface hardware (HBAs), cabling, and SAN switches for block-level storage access.
Identifying the layer of redundancy needed (storage network transport vs. internal disk array vs. Ethernet LAN) directs the selection of the correct control.
2
Evaluate the capabilities of storage-specific redundant pathway controls.
Multipath I/O (MPIO) recognizes duplicate paths to the same block storage target, dynamically routing traffic around failed host adapters, SAN switches, or cables without dropping the connection.
MPIO operates specifically at the operating system storage driver layer to aggregate separate physical SAN pathways.
3
Differentiate MPIO from non-applicable redundancy controls.
RAID protects local disks, backups provide point-in-time recovery, and standard LACP handles local Ethernet switch ports rather than SAN block storage fabrics.
Preventing single points of failure in storage networks requires path redundancy designed specifically for Fibre Channel or iSCSI storage controllers.

Anahtar Kavram

Multipath I/O (MPIO) for SAN Redundancy
Tahmini Süre:1m 30s
Soru 1195Soru →

A security engineer is designing an embedded industrial sensor node deployed in untrusted physical locations. The design requires that the system only executes cryptographically signed boot code during power-on to prevent unauthorized firmware modifications. Which of the following hardware security controls should the engineer implement to fulfill this requirement?

Cevabı ve açıklamayı göster

Cevap: Hardware Root of Trust with Secure Boot

Cevap

Hardware Root of Trust with Secure Boot
The combination of a Hardware Root of Trust and Secure Boot anchors security in immutable read-only memory (such as internal boot ROM or eFuses). During device bootup, the hardware Root of Trust cryptographically verifies the digital signature of the bootloader before executing it, ensuring that altered or untrusted firmware cannot run.

Adım Adım Çözüm

1
Analyze the hardware security requirement
The scenario requires ensuring that only cryptographically signed boot code runs at startup to prevent unauthorized firmware modification on an embedded device.
Embedded hardware in untrusted physical environments requires cryptographic validation of firmware before execution.
2
Evaluate hardware-based security controls
Secure Boot anchored in a hardware Root of Trust uses immutable boot ROM keys to verify the signature of the bootloader image.
This establishes a cryptographically validated chain of trust from initial hardware power-on through operating system execution.
3
Differentiate from software, cryptographic payload, or detective controls
Software agents, data-at-rest encryption, and logging operate post-boot or focus on confidentiality rather than early boot signature validation.
Hardware boot verification must occur prior to any software-level control execution.

Anahtar Kavram

Hardware Root of Trust and Secure Boot
Tahmini Süre:1m 15s
Soru 1196Soru →

A network administrator is configuring centralized AAA for enterprise network hardware. During testing, administrative authentication to an edge switch succeeds via TACACS+, but the user is placed into unprivileged user EXEC mode rather than privileged EXEC mode. The TACACS+ server logs confirm that primary user authentication was successful. Which of the following identity and access management operations issues is the MOST likely cause of this behavior?

Cevabı ve açıklamayı göster

Cevap: The TACACS+ authorization configuration is missing the specific Attribute-Value (AV) pair required to grant privileged shell access.

Cevap

The TACACS+ authorization configuration is missing the specific Attribute-Value (AV) pair required to grant privileged shell access.
TACACS+ separates authentication from authorization. While authentication verifies identity, authorization attributes—specifically shell Attribute-Value (AV) pairs like privilege level 15—must be explicitly returned by the server to grant elevated command execution rights.

Adım Adım Çözüm

1
Analyze TACACS+ protocol architecture principles.
Identify that TACACS+ explicitly separates Authentication, Authorization, and Accounting (AAA) functions into distinct processing phases.
Understanding AAA separation is necessary to diagnose why authentication succeeds while privilege level assignment fails.
2
Evaluate the symptom against the log entry.
The server confirms successful authentication, ruling out credential verification failure, but the client device places the user in unprivileged mode.
This indicates an authorization policy misconfiguration where privilege level attributes were omitted from the server response.
3
Identify the required TACACS+ payload component.
TACACS+ uses Attribute-Value (AV) pairs (such as service=shell and priv-lvl=15) during the authorization exchange to assign command permissions.
Without these AV pairs in the authorization response, the client device defaults to the lowest privilege execution mode.

Anahtar Kavram

TACACS+ AAA Operational Separation and Authorization Attribute Configuration
Soru 1197Soru →

A security analyst reviews alert logs from a Wireless Intrusion Detection System (WIDS) deployed at a corporate headquarters. The WIDS flagged an anomaly where a single access point MAC address is sending immediate 802.11 Probe Response frames to every nearby device broadcasting Probe Requests, automatically matching whatever Service Set Identifier (SSID) the client requests—including 'Airport_Free_WiFi', 'Hotel_Guest', and 'Home_Network'. Which of the following attack types is indicated by this wireless behavior?

Cevabı ve açıklamayı göster

Cevap: Karma attack

Cevap

Karma attack
The correct answer identifies a Karma attack. In a Karma attack, a rogue access point exploits the behavior of wireless devices broadcasting probe requests for SSIDs in their Preferred Network List (PNL). The attacker's AP responds to every probe request claiming to be the exact network the client is seeking, enticing the device to connect automatically.

Adım Adım Çözüm

1
Analyze the observed wireless frame behavior in the WIDS log
The rogue device responds to client probe requests by dynamically adopting whichever SSID the requesting device searches for.
Wireless client devices maintain a Preferred Network List (PNL) and broadcast probe requests searching for known networks.
2
Differentiate Karma attacks from general rogue APs or deauthentication attacks
Karma specifically exploits client probe request broadcasts by spoofing responses for any SSID, causing clients to auto-connect to the rogue AP.
This behavior directly defines the signature mechanism of a Karma attack.

Anahtar Kavram

Karma Attack Indicators
Soru 1198Soru →

A security administrator is preparing to perform a credentialed vulnerability scan on internal application servers. Which of the following represent primary advantages of using a credentialed vulnerability scan instead of an unauthenticated scan? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Accurate identification of missing internal software patches and local configuration settings; Significantly lower rate of false-positive vulnerability findings in scan reports

Cevap

The correct advantages are accurate identification of missing internal software patches and local configuration settings, and a significantly lower rate of false-positive vulnerability findings in scan reports.
Credentialed (authenticated) vulnerability scans log directly into target host systems using administrative credentials. This allows the scanner to query local package management databases, inspect registry configurations, and verify exact software build numbers. As a result, credentialed scans provide precise patch visibility and drastically minimize false positives compared to unauthenticated network scans.

Adım Adım Çözüm

1
Analyze the scanning context and capability requirements
Recognize that credentialed (authenticated) scans operate with administrative access on target operating systems.
Authenticating to target systems enables direct local inspection of host resources, configuration files, and installed software registries.
2
Evaluate the benefits of credentialed access against non-credentialed access
Identify that host-level inspection yields precise patch inventory data and reduces misidentifications (false positives).
Unauthenticated scans rely on external network responses and banner grabbing, which often produce false positives when services conceal exact version information.
3
Distinguish vulnerability assessment functions from active defense and remediation tools
Rule out automatic remediation and inline network traffic blocking.
Assessment scanners focus on discovery and reporting rather than active remediation or inline network filtering.

Anahtar Kavram

Credentialed vs. Unauthenticated Vulnerability Scanning
Tahmini Süre:50s
Soru 1199Soru →

A financial technology organization is refactoring its internal microservices communication architecture to align with Zero Trust Architecture (ZTA) principles. An application security architect specifies that internal services must no longer trust incoming network traffic based on IP subnets or internal network placement. Instead, every request must be dynamically evaluated against contextual security policies and session health attributes before access is granted. Which logical component within the Zero Trust framework is directly responsible for evaluating these access policies and rendering the authorization decision?

Cevabı ve açıklamayı göster

Cevap: Policy Decision Point (PDP)

Cevap

The Policy Decision Point (PDP) is the component responsible for evaluating access policies and rendering authorization decisions.
The Policy Decision Point (PDP) is the ultimate decision-making component in a Zero Trust Architecture. It receives contextual telemetry (such as user identity, device posture, and risk factors), compares it against enterprise security policies, and outputs an authorization determination.

Adım Adım Çözüm

1
Identify the primary responsibility described in the scenario
The requirement is to evaluate dynamic contextual policies and render an authorization decision for microservices requests.
Zero Trust Architecture separates the decision-making control plane from the enforcement data plane.
2
Differentiate between Zero Trust control plane functional components
The Policy Decision Point (PDP) makes authorization decisions, whereas the Policy Enforcement Point (PEP) enforces those decisions at the traffic gate.
Understanding the division of responsibilities ensures correct architecture design.

Anahtar Kavram

Zero Trust Policy Decision Point (PDP) vs Policy Enforcement Point (PEP)
Soru 1200Soru →

An enterprise security team deployed agent-based vulnerability scanners across a hybrid environment comprising bare-metal host servers, containerized application workloads on managed Kubernetes nodes, and high-transaction database instances. During the initial operational assessment, the security team identifies two critical issues:
1. The installed host agents successfully inventory host OS packages but fail to detect software vulnerabilities existing inside running container filesystem layers.
2. Standard network-based vulnerability scans triggered against the database servers caused severe query latency and session timeouts.

Which of the following architectural modifications or scanning strategies should the security team implement to resolve both operational issues? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Integrate container image registry and CI/CD pipeline scanning to analyze container layers prior to deployment.; Configure credentialed, low-impact scanning profiles or schedule non-intrusive scans during designated maintenance windows for database targets.

Cevap

The security team should integrate container image registry and CI/CD pipeline scanning to analyze container layers prior to deployment, and configure credentialed, low-impact scanning profiles or schedule non-intrusive scans during designated maintenance windows for database targets.
Container base images and application layers are isolated from host OS package managers, requiring registry and CI/CD pipeline scanner integration to identify container vulnerabilities. Furthermore, active network scanning of high-transaction database systems can cause resource starvation and crashes; adjusting scan policy profiles to non-intrusive credentialed scans or scheduling scans during low-traffic maintenance windows mitigates operational impact.

Adım Adım Çözüm

1
Analyze container visibility limitation
Host-level vulnerability agents view the host operating system user space and kernel but do not inspect internal container image layers or containerized package managers.
Container security requires static analysis of base images during the build/registry phase (CI/CD pipeline scanning) or specialized container-aware agents.
2
Address database latency and session timeout issues caused by active scanning
Active uncredentialed network probing sends high volumes of packets and test vectors that overload database socket connections and CPU threads.
Sensitive target systems like production databases require non-intrusive credentialed scans, performance throttling, or execution during designated maintenance windows to maintain availability.
3
Evaluate alternative options
Reclassifying vulnerability types in SIEM rules or launching intrusive exploit payloads either corrupts vulnerability metrics or causes severe service outages.
Proper vulnerability management relies on accurate categorization and non-disruptive discovery methods.

Anahtar Kavram

Vulnerability Assessment in Containerized Workloads and High-Availability Infrastructure
ÖncekiSayfa 60 / 112Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin