Examkin

Tüm alıştırma soruları

2232 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 1201Soru →

A financial enterprise is deploying specialized infrastructure across regional offices to process centralized database transaction encryption. The security team requires a dedicated hardware-based solution capable of performing high-throughput cryptographic operations while securely storing master keys. The device must ensure keys cannot be extracted even if an adversary gains root access to the host operating system or opens the chassis physical casing. Which of the following hardware security controls best meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Hardware Security Module (HSM)

Cevap

A Hardware Security Module (HSM) is the appropriate control because it provides physical tamper-responsive protection and isolated cryptographic processing for master keys independent of host operating system security.
A Hardware Security Module (HSM) is a hardened, plug-in or external device dedicated to safeguarding digital keys and accelerating cryptographic operations. HSMs feature specialized physical security measures (such as tamper-detecting covers and zeroization circuits) that protect stored keys against both physical access and host system compromise.

Adım Adım Çözüm

1
Identify the core requirements from the scenario
Requirements demand a hardware device that isolates cryptographic keys, processes high-throughput transactions, resists physical chassis intrusion, and remains secure even if host OS root access is compromised.
Analyzing security constraints guides selecting between platform microcontrollers, storage controls, and specialized cryptographic appliances.
2
Evaluate hardware security mechanisms against requirements
An HSM is specifically engineered as a tamper-resistant hardware security enclave designed for dedicated master key lifecycle management and isolated cryptographic processing.
Host-bound microcontrollers (like TPMs) and local disk encryption (like SEDs) do not fulfill high-throughput centralized key appliance demands with active physical zeroization.

Anahtar Kavram

Hardware Security Module (HSM) functionality and tamper protection
Soru 1202Soru →

A Security Operations Center (SOC) analyst receives a high-severity alert indicating that an industrial control system (ICS) building automation gateway has initiated unauthorized outbound encrypted connections to a known malicious external IP address. The analyst confirms that unauthorized administrative access occurred and malicious code is actively running on the gateway. According to the NIST Incident Response Framework, which action should the responder perform FIRST?

Cevabı ve açıklamayı göster

Cevap: Apply an isolated quarantine VLAN profile to the connected switch port to halt external communications.

Cevap

Apply an isolated quarantine VLAN profile to the connected switch port to halt external communications.
According to the NIST Incident Response Framework (SP 800-61), once an incident is detected and confirmed, responders must immediately move to the Containment phase. Placing the switch port into an isolated quarantine VLAN stops command-and-control (C2) communication and lateral movement while keeping the system powered on so volatile memory can be preserved for forensics.

Adım Adım Çözüm

1
Identify the current incident phase based on the scenario
Detection and analysis are complete; an active compromise with C2 outbound traffic is confirmed.
Once an incident is confirmed active, the immediate next phase in NIST SP 800-61 is Containment.
2
Select the proper containment strategy for an active network attack
Apply network-level isolation (quarantine VLAN) to block C2 traffic.
Network containment prevents lateral movement and external data exfiltration while preserving powered-on system state for volatile memory capture.

Anahtar Kavram

NIST Incident Response Lifecycle (Containment Phase)
Soru 1203Soru →

During a threat monitoring shift, a security analyst receives an alert indicating that a built-in operating system binary (`mshta.exe`) executed an unencoded command shell directly in system memory and initiated an encrypted outbound connection to an unknown external IP address. A traditional signature-based antivirus scan on the host reports no infected files on disk. Which capability of an Endpoint Detection and Response (EDR) solution enabled the detection of this activity, and what is the most appropriate initial containment action?

Cevabı ve açıklamayı göster

Cevap: Behavioral telemetry monitoring of process interactions; isolate the affected host from the network using the EDR management console.

Cevap

Behavioral telemetry monitoring of process interactions allows the EDR system to detect fileless execution of legitimate system binaries in RAM, and software-level host isolation via the EDR console is the immediate containment action.
Behavioral telemetry monitoring tracks runtime behavior and anomalous process chains, enabling EDR tools to flag living-off-the-land attacks where native binaries behave maliciously. Performing software-level host isolation directly through the EDR console prevents lateral spread across the network while maintaining the control channel required for incident investigation.

Adım Adım Çözüm

1
Analyze the alert context and execution vector
The attack utilizes a native system binary (`mshta.exe`) running malicious code in memory without dropping files to disk, bypassing static hash-based detection.
Living-off-the-land (LotL) and fileless techniques require continuous behavioral telemetry inspection rather than traditional file scanning.
2
Identify the core EDR detection mechanism
Behavioral telemetry monitoring captures anomalous process behavior, such as a dual-purpose system tool spawning a shell and establishing outbound sockets.
EDR agents monitor API calls, process lineage, and behavioral anomalies continuously.
3
Determine the proper incident containment response
Initiate software-based host network isolation via the EDR agent console.
Host isolation blocks internal network communications to prevent lateral movement while keeping the EDR agent connected for forensic analysis.

Anahtar Kavram

Endpoint Detection and Response (EDR) Behavioral Monitoring and Host Isolation
Tahmini Süre:2m 0s
Soru 1204Soru →

Match each enterprise identity and access management (IAM) protocol to its corresponding architectural use case and operational characteristic.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

OAuth 2.0
OpenID Connect (OIDC)
RADIUS
TACACS+

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

OAuth 2.0 matches delegated API authorization; OpenID Connect matches user authentication extensions on OAuth 2.0; RADIUS matches UDP-based combined network AAA; TACACS+ matches fully encrypted TCP-based administrator device access.
Each protocol is paired according to its native architectural function: OAuth 2.0 provides delegated authorization, OIDC adds user authentication via ID tokens, RADIUS provides combined UDP-based network AAA, and TACACS+ provides fully encrypted, decoupled TCP device management AAA.

Adım Adım Çözüm

1
Differentiate between authorization frameworks and identity layers for web applications.
Identify OAuth 2.0 as the core delegated authorization framework and OIDC as the identity authentication layer.
OAuth 2.0 issues access tokens for APIs, while OIDC adds ID tokens for user identity.
2
Analyze network access protocols vs device administration AAA protocols.
Identify RADIUS for UDP network access AAA and TACACS+ for TCP administrator AAA.
RADIUS combines auth/authz over UDP, whereas TACACS+ separates auth/authz and encrypts full payloads over TCP.

Anahtar Kavram

Identity and Access Management Architecture Protocols
Soru 1205Soru →

A Security Operations Center (SOC) analyst is reviewing an alert generated by a cloud SIEM correlation rule. The rule flagged sequential API events originating from an external IP address in an enterprise AWS CloudTrail log dump:

[
{
"eventTime": "2026-07-27T10:15:02Z",
"eventName": "ConsoleLogin",
"errorMessage": "Failed authentication",
"userIdentity": {"type": "IAMUser", "userName": "svc_deploy"},
"sourceIPAddress": "198.51.100.77"
},
{
"eventTime": "2026-07-27T10:15:18Z",
"eventName": "ConsoleLogin",
"responseElements": {"ConsoleLogin": "Success"},
"userIdentity": {"type": "IAMUser", "userName": "svc_deploy"},
"sourceIPAddress": "198.51.100.77"
},
{
"eventTime": "2026-07-27T10:16:05Z",
"eventName": "AttachUserPolicy",
"errorCode": "AccessDenied",
"errorMessage": "User is not authorized to perform: iam:AttachUserPolicy",
"userIdentity": {"type": "IAMUser", "userName": "svc_deploy"},
"sourceIPAddress": "198.51.100.77"
}
]

Based on the log snippet above, which of the following statements accurately describe the security findings from this log analysis? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The user account successfully established identity authentication following an initial failed login attempt.; The authenticated user encountered an authorization control failure when attempting to modify IAM permissions.

Cevap

The correct findings are that the user account successfully established identity authentication following an initial failed login attempt, and that the authenticated user encountered an authorization control failure when attempting to modify IAM permissions.
The log analysis reveals two distinct events: first, identity verification (authentication) succeeded on the second attempt after an initial failure; second, the user attempted an administrative action (attaching an IAM policy) that was blocked by access control policies, resulting in an authorization failure ('AccessDenied').

Adım Adım Çözüm

1
Analyze the sequential ConsoleLogin events in the log snippet.
The first log entry shows 'Failed authentication' at 10:15:02Z, while the second log entry at 10:15:18Z shows 'Success'.
This establishes that credential identity verification (authentication) was completed on the second attempt.
2
Analyze the subsequent AttachUserPolicy event at 10:16:05Z.
The API call returned errorCode 'AccessDenied' and errorMessage 'User is not authorized to perform: iam:AttachUserPolicy'.
This confirms that while the user was authenticated, their role/account lacked authorization rights to attach IAM policies.

Anahtar Kavram

Log Analysis and SIEM Correlation across AAA Boundaries
Tahmini Süre:1m 30s
Soru 1206Soru →

During a security event, an Endpoint Detection and Response (EDR) agent deployed on a critical file server detects suspicious rapid file modification patterns consistent with ransomware activity. Arrange the following EDR incident containment and response steps in the correct sequential order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct response sequence begins with ingesting and triaging the initial EDR alert, followed immediately by initiating agent-based network isolation to prevent lateral movement. Next, volatile memory is captured and active malicious processes are killed. Following host containment, malicious files are quarantined and modified files are remediated. Finally, a complete system integrity scan is completed before restoring network connectivity.
The standard EDR containment workflow prioritizes rapid threat isolation to prevent lateral movement, followed by volatile evidence preservation, malicious process termination, file quarantine/remediation, and finally health verification prior to restoring network access.

Adım Adım Çözüm

1
Identify and validate threat telemetry
Alert triage confirms active ransomware behavior on the endpoint.
Detection and triage must precede any intervention to verify the scope of the alert.
2
Enforce host isolation via EDR agent
The host is logically isolated from the network while preserving EDR agent management channels.
Immediate containment stops command-and-control (C2) communication and prevents lateral movement across the enterprise.
3
Dump volatile memory and terminate malicious processes
RAM artifacts are saved for forensic examination and execution of the attack payload is halted.
Capturing memory prior to process termination ensures critical volatile evidence is preserved.
4
Quarantine binaries and execute rollback remediation
Malicious code is removed and modified system files are restored from clean snapshots.
Eradication eliminates host artifacts and restores compromised assets to a known good state.
5
Validate endpoint health and un-isolate host
System cleanliness is verified and full network access is safely re-established.
Reconnection to the network should only occur after verified remediation.

Anahtar Kavram

Endpoint Detection and Response (EDR) Incident Containment Workflow
Soru 1207Soru →

A Security Operations Center (SOC) analyst receives a high-severity alert from a Wireless Intrusion Prevention System (WIPS) indicating that an unauthorized rogue access point has been connected to an internal network switch port. Which of the following sequence of steps represents the correct order for responding to this incident according to standard incident response playbooks?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of incident response actions is: 1) Validate the alert by analyzing switch port logs and netflow data; 2) Logically isolate the affected switch port via network management tools; 3) Physically remove the unauthorized access point and update NAC policies; 4) Restore standard switch port settings and verify network telemetry; 5) Conduct a post-incident review to document lessons learned.
Standard incident response frameworks (such as NIST SP 800-61) define a strict sequential process: Detection and Analysis (validating the WIPS alert via switch logs), Containment (logically isolating the switch port), Eradication (physically removing the rogue AP and updating NAC rules), Recovery (restoring switch port operation safely and monitoring telemetry), and Post-Incident Activity (conducting a lessons learned review).

Adım Adım Çözüm

1
Perform Detection and Analysis
Confirmed rogue access point location and operational impact.
Before initiating containment or remediation, responders must analyze and validate the alert to verify an actual incident is taking place.
2
Implement Containment
Rogue access point network communication is disabled.
Isolating the switch port stops potential data exfiltration and unauthorized network access while preserving evidence.
3
Execute Eradication
Rogue hardware is physically removed and NAC controls are updated.
Eradication removes the root cause of the incident from the network architecture.
4
Perform Recovery
Switch port is securely re-enabled and monitored for clean operational status.
Recovery ensures affected infrastructure is returned to safe production operations with active monitoring.
5
Conduct Post-Incident Activity
Incident report created and physical security playbooks updated.
Lessons learned feed back into the incident response lifecycle to harden enterprise defenses against future incidents.

Anahtar Kavram

Incident Response Lifecycle Phases (NIST SP 800-61)
Tahmini Süre:1m 30s
Soru 1208Soru →

During a security review of a custom web reporting service, a security analyst identifies two distinct software vulnerabilities: dynamic user input in the template string parameter is evaluated directly by the rendering engine allowing remote code execution, and un-sanitized file path inputs allow accessing arbitrary system files outside the web root. Which of the following remediation strategies should the development team implement to mitigate these specific vulnerabilities? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Implement strict input validation and path canonicalization to restrict file access strictly within intended directories.; Disable dynamic evaluation within the template renderer and restrict rendering to pre-approved static templates.

Cevap

To remediate the identified directory traversal and server-side template injection (SSTI) vulnerabilities, the development team must implement path canonicalization with strict input validation for file access, and disable dynamic evaluation while restricting rendering to pre-approved static templates.
Path canonicalization resolves relative directory references (such as dot-dot-slash sequences) into absolute file paths and checks them against permitted folder boundaries to prevent file traversal. Removing dynamic code execution features from the template engine and restricting rendering to static templates prevents server-side template injection (SSTI) attacks.

Adım Adım Çözüm

1
Analyze the file retrieval vulnerability to identify proper software mitigation controls.
Recognize that allowing arbitrary file path references enables directory traversal outside the web root.
Path canonicalization converts path inputs to standard absolute forms and verifies them against an explicit whitelist of allowed directories.
2
Analyze the template rendering flaw to eliminate arbitrary code execution opportunities.
Determine that evaluating user-controlled input inside the template engine leads to Server-Side Template Injection (SSTI).
Disabling dynamic string evaluation and strictly using pre-defined static templates isolates template parsing from untrusted input execution.

Anahtar Kavram

Application input validation, path canonicalization, and safe template rendering practices.
Soru 1209Soru →

An organization is establishing a secure onboarding process for system administrators to enforce least privilege and privileged access management (PAM). In what order should the administrative security operations team perform the following operational tasks during user onboarding?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins with identity verification via HR records, followed by provisioning a standard baseline account in the Identity Provider, then integrating the user into the Privileged Access Management solution, and concluding with enforcing Multi-Factor Authentication and conducting a final permission audit.
The correct sequence starts with identity verification against authoritative HR records to validate authorization. Next, a basic non-privileged account is created in the central Identity Provider to enforce least privilege. The account is subsequently registered in the Privileged Access Management (PAM) vault to manage temporary elevation securely. Finally, Multi-Factor Authentication (MFA) registration is completed and initial permissions are audited to finalize secure onboarding.

Adım Adım Çözüm

1
Identity Validation
HR authorization baseline confirmed.
Prevents unauthorized account creation by confirming employment and role requirements before generating directory objects.
2
Baseline Provisioning
Standard non-privileged account created.
Establishes a core user identity following least privilege principles prior to assigning elevated rights.
3
PAM System Integration
Identity linked to vault for just-in-time privilege checkouts.
Ensures administrative activities are subject to credential vaulting, session recording, and automated access revocation.
4
MFA Activation & Audit
Strong authentication registered and RBAC baseline verified.
Ensures multifactor security controls are operational and access limits are verified before granting access to systems.

Anahtar Kavram

Identity Lifecycle Management and PAM Onboarding Operations
Soru 1210Soru →

An enterprise infrastructure security team is performing a post-incident audit across a hybrid multi-cloud environment. Log correlation reveals that a former cloud administrator whose Active Directory account was disabled during an automated offboarding process was still able to access confidential production storage buckets two days later:

[2026-07-25 09:00:00] AD_EVENT: User 'dev_admin_04' status updated to DISABLED via HR workflow.
[2026-07-25 09:01:15] SCIM_EVENT: Provisioning sync sent DELETE request for user GUID 'usr-99482' to Cloud IdP -> HTTP 200 OK.
[2026-07-27 14:10:22] API_GATEWAY: OAuth Token Refresh Request for Client ID 'App-Storage-v2' using Refresh Token 'rt_88dfa2...'.
[2026-07-27 14:10:23] CLOUD_IDP: Token Endpoint issued new Access Token 'at_44c12...' without re-evaluating directory account state.
[2026-07-27 14:11:05] STORAGE_SERVICE: GET /buckets/prod-finance-db -> HTTP 200 OK (Authenticated via 'at_44c12...').

Which of the following operational root causes BEST explains why the offboarded administrator retained API access despite successful SCIM deprovisioning, and what remediation should be implemented?

Cevabı ve açıklamayı göster

Cevap: The Identity Provider token endpoint issued a new access token because it validated the refresh token without checking real-time directory account status; revoking active refresh tokens upon offboarding and enabling Continuous Access Evaluation (CAE) is required.

Cevap

The Identity Provider token endpoint issued a new access token because it validated the refresh token without checking real-time directory account status; revoking active refresh tokens upon offboarding and enabling Continuous Access Evaluation (CAE) is required.
The log analysis demonstrates that while SCIM successfully deprovisioned the user object in the Cloud Identity Provider, the user's previously issued long-lived OAuth refresh token remained active. When the API Gateway presented this refresh token, the token endpoint generated a new access token without performing a real-time check against the user's directory account status. To prevent unauthorized post-offboarding access, IAM operations must explicitly revoke active refresh tokens and user sessions upon termination, as well as deploy Continuous Access Evaluation (CAE) to enforce real-time access policy decisions.

Adım Adım Çözüm

1
Analyze the account deprovisioning log entries.
Active Directory disabled the user account and SCIM issued an automated DELETE call to the Cloud IdP, which returned HTTP 200 OK.
Confirms that account deprovisioning succeeded at both the primary directory level and the federated identity provider level.
2
Examine the OAuth token refresh event occurring two days post-offboarding.
The API Gateway presented a long-lived refresh token (`rt_88dfa2...`), and the Cloud IdP issued a new short-lived access token (`at_44c12...`) without re-evaluating whether the underlying directory user account was active.
Identifies that standard OAuth 2.0 token endpoints evaluate refresh token validity independently of live directory status unless active session revocation or real-time continuous evaluation is configured.
3
Determine the operational root cause and required security remediation.
The root cause is unrevoked refresh tokens combined with passive token validation. The required control remediation is revoking all active refresh tokens and user session state during offboarding, alongside implementing Continuous Access Evaluation (CAE).
Ensures that identity state changes are immediately propagated and enforced across token endpoints and API resource gateways in real time.

Anahtar Kavram

OAuth 2.0 Refresh Token Lifecycle, Session Revocation, and Continuous Access Evaluation (CAE)
Tahmini Süre:2m 0s
Soru 1211Soru →

An enterprise logistics organization is re-architecting its cloud-native platform to comply with NIST SP 800-207 Zero Trust Architecture (ZTA) principles. Which of the following architectural practices must be implemented to establish core Zero Trust controls across the environment? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enforce explicit authentication and authorization for every access request, utilizing dynamic context such as identity, device state, and location regardless of network position.; Implement microsegmentation and end-to-end session encryption between workload components to minimize the blast radius of potential compromises.

Cevap

The core architectural practices required are explicitly verifying every access request using dynamic risk context, and implementing microsegmentation with end-to-end encryption between workload components to contain lateral movement.
Zero Trust Architecture requires explicit verification of every access request using dynamic contextual signals (identity, device posture, location) regardless of network origin, combined with granular microsegmentation and encryption between internal services to assume breach and limit lateral movement.

Adım Adım Çözüm

1
Identify fundamental Zero Trust Architecture (ZTA) tenets
ZTA relies on assuming breach, explicitly verifying all connections, enforcing least privilege, and continuously monitoring access context.
Implicit network trust based on physical location or static perimeters must be removed.
2
Map tenets to enterprise workload controls
Verifying each request dynamically (explicit verification) and segmenting internal workload flows (microsegmentation) directly enact these tenets.
These controls restrict access to authorized subjects and limit lateral movement if a workload is compromised.

Anahtar Kavram

Zero Trust Architecture Principles
Tahmini Süre:1m 30s
Soru 1212Soru →

A security analyst is acquiring digital evidence from a running enterprise application server immediately after detecting an active intrusion. Place the evidence sources in sequence according to the standard order of volatility, starting with the MOST volatile evidence first and ending with the LEAST volatile evidence.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of volatility from most volatile to least volatile is: CPU cache and processor registers, followed by System RAM and ARP cache, Temporary swap space and pagefiles, Local solid-state drive (SSD) storage, and finally Offsite optical and magnetic backup tapes.
Digital forensics standards dictate capturing evidence in order of decreasing volatility to prevent data loss. CPU registers and cache memory vanish almost instantaneously, followed by system RAM and dynamic network tables, virtual memory swap files on disk, non-volatile local drives, and lastly offsite backup media.

Adım Adım Çözüm

1
Identify CPU hardware state as the highest priority.
CPU cache and processor registers are placed first.
Registers and processor cache are the most short-lived data structures in a computer system.
2
Prioritize main system RAM and active network cache.
System RAM and ARP cache are placed second.
Volatile memory contains running process code, cryptographic keys, and active network states that disappear on shutdown.
3
Order secondary virtual storage and local drives.
Temporary swap space and pagefiles are placed third, followed by local SSD storage fourth.
Swap files update dynamically during system runtime, while primary local disk storage retains persistent files.
4
Place long-term offline archives last.
Offsite optical and magnetic backup tapes are placed fifth.
Offline backup media is immutable and least susceptible to immediate modification or loss.

Anahtar Kavram

Order of Volatility
Tahmini Süre:1m 30s
Soru 1213Soru →

An enterprise security team is implementing a Zero Trust Identity and Access Management (IAM) architecture. The team needs to ensure that access to cloud resources is dynamically granted or restricted based on real-time signals, such as user risk level, device health state, and geographic location, rather than relying solely on static group memberships or initial password verification. Which of the following IAM architectural mechanisms should the team implement to satisfy this requirement?

Cevabı ve açıklamayı göster

Cevap: Context-aware access policies

Cevap

Context-aware access policies
Context-aware access policies evaluate real-time signals—such as user IP location, device security posture, and behavioral risk scores—to dynamically enforce granular access controls in alignment with Zero Trust architecture principles.

Adım Adım Çözüm

1
Analyze the architecture requirements in the scenario.
Identified the need for real-time, dynamic access decisions using contextual signals like device health, location, and risk scores.
Zero Trust IAM architecture mandates continuous evaluation rather than one-time static authentication.
2
Evaluate candidate IAM access control mechanisms against dynamic requirements.
Context-aware access policies evaluate incoming telemetry continuously against policy parameters.
Static models like RBAC or MAC cannot dynamically adapt access rights based on real-time situational signals.

Anahtar Kavram

Context-Aware Conditional Access in IAM Architecture
Soru 1214Soru →

A security analyst is investigating a alert generated by a SIEM correlation engine. The console displays the following sequential log entries collected from an enterprise web server and host database:

2026-07-27 11:05:12 | Host: WEB-01 | Apache: 192.168.1.105 - - "POST /login.php HTTP/1.1" 200 4512 "username=admin' OR '1'='1"
2026-07-27 11:05:13 | Host: WEB-01 | Auth: Successful authentication for user 'admin' from 192.168.1.105
2026-07-27 11:05:18 | Host: DB-01 | MySQL: Query executed: SELECT * FROM users WHERE username='admin' OR '1'='1'

Based on these correlated log entries, which of the following best describes the attack vector being executed and its immediate impact?

Cevabı ve açıklamayı göster

Cevap: SQL injection (SQLi) resulting in an authentication bypass by manipulating the backend database query logic.

Cevap

SQL injection (SQLi) resulting in an authentication bypass by manipulating the backend database query logic.
The HTTP POST request contains the classic SQL injection payload 'OR '1'='1, which forces the database conditional check to evaluate as true. As a result, the backend application authenticates the request as the 'admin' user without verifying credentials, leading to an authentication bypass.

Adım Adım Çözüm

1
Analyze the web server request payload in the Apache HTTP log.
The input string "username=admin' OR '1'='1" contains SQL syntax markers intended to alter database query logic.
Web logs reveal initial attack vectors and payload delivery.
2
Correlate web server authentication events with host database query logs.
The database executed `SELECT * FROM users WHERE username='admin' OR '1'='1'`, which evaluates to true for all rows, returning a valid admin record.
Evaluating downstream database behavior confirms if an input payload successfully altered application backend processing.
3
Determine the impact of the successful payload execution.
The web application granted a successful authentication session for 'admin' without requiring a valid password.
Connecting payload execution to log authentication outcomes identifies the threat type as SQL injection leading to authentication bypass.

Anahtar Kavram

SQL Injection (SQLi) Log Analysis
Soru 1215Soru →

A system administrator is auditing user permissions following a departmental transfer. An employee moved from the Accounting department to Human Resources but still retains write access to the Accounting file share. Which of the following identity and access management operations should be executed to resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Conduct an access privilege review to adjust permissions in accordance with least privilege

Cevap

Conducting an access privilege review to adjust permissions in accordance with the principle of least privilege.
An access privilege review allows security administrators to audit user entitlements following organizational changes, revoking obsolete rights so that access aligns with the principle of least privilege.

Adım Adım Çözüm

1
Identify the administrative gap
The employee maintains rights to resources no longer required for their updated job role.
Job transfers often lead to privilege creep if rights from previous roles are not explicitly revoked.
2
Select the appropriate IAM lifecycle process
Perform an access recertification/review.
Periodic or event-driven access reviews evaluate authorization boundaries to remove unneeded entitlements.

Anahtar Kavram

Account Lifecycle Operations & Privilege Recertification
Soru 1216Soru →

An enterprise security architect is transitioning legacy perimeter security controls to align with Zero Trust Architecture (ZTA) design tenets. Match each Zero Trust architectural concept on the left to its corresponding operational function on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Implicit Trust Zone Removal
Continuous Adaptive Risk Evaluation
Microsegmentation
Control Plane and Data Plane Separation

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Implicit Trust Zone Removal corresponds to eliminating default trust based on network location. Continuous Adaptive Risk Evaluation corresponds to dynamically re-evaluating session state and context throughout an active connection. Microsegmentation corresponds to dividing network environments into small isolated zones to restrict lateral movement. Control Plane and Data Plane Separation corresponds to decoupling policy decision logic from application traffic paths.
Each Zero Trust term matches its core architectural operational responsibility: removing implicit trust strips location-based assumptions; continuous adaptive evaluation continuously monitors session context; microsegmentation restricts internal lateral movement; and control/data plane separation decouples policy management from data transit paths.

Adım Adım Çözüm

1
Analyze the core premise of Zero Trust regarding network location and implicit trust.
Identify that removing implicit trust eliminates reliance on physical or IP-based network location.
Legacy networks trust internal IP segments; Zero Trust demands zero inherent trust regardless of location.
2
Evaluate session lifetime management principles in Zero Trust.
Map Continuous Adaptive Risk Evaluation to ongoing context and behavioral re-validation.
Authentication and authorization must not be static single-point-in-time checks.
3
Analyze containment strategies within Zero Trust Architecture.
Map Microsegmentation to creating granular isolated zones around workloads to prevent lateral movement.
Breach containment relies on restricting traffic between workload segments.
4
Examine architectural component separation.
Map Control Plane and Data Plane Separation to isolating policy evaluation logic from data traffic transmission.
Policy engines and administrators process control requests independently of raw data forwarding paths.

Anahtar Kavram

Zero Trust Architecture Principles
Soru 1217Soru →

During an enterprise security audit, an incident response team identifies four distinct technical indicators across wireless and wired network segments. Match each observed technical anomaly on the left to its corresponding attack classification on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A continuous stream of 802.11 management frames containing reason code 7 sent to client MAC addresses, causing immediate wireless disconnection.
Unsolicited ARP replies broadcasted across a subnet associating the default gateway IP address with an unauthorized host MAC address.
Spurious IPv6 Neighbor Advertisement frames claiming ownership of an existing router link-local address without prior Neighbor Solicitation.
An unauthorized access point broadcasting a corporate SSID with an elevated transmit power (+20 dBm+20\text{ dBm}) to force client reassociation.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The technical anomalies match their respective attack categories based on protocol-specific indicators: 802.11 management deauth frames match Deauthentication Attack; unsolicited ARP responses match ARP Poisoning; unauthorized IPv6 Neighbor Advertisements match NDP Spoofing; and rogue APs broadcasting legitimate SSIDs match Evil Twin Attack.
Each technical log indicator aligns directly with its underlying protocol behavior: 802.11 management deauthentication frames force client disconnects (Deauthentication Attack); gratuitous ARP replies corrupt local ARP caches (ARP Poisoning); unsolicited ICMPv6 Neighbor Advertisements corrupt IPv6 neighbor caches (NDP Spoofing); and rogue APs broadcasting identical SSIDs with higher RF signal levels manipulate wireless roaming decisions (Evil Twin Attack).

Adım Adım Çözüm

1
Analyze the 802.11 management frame anomaly with reason code 7.
Reason code 7 explicitly denotes explicit wireless disassociation/deauthentication requesting disconnect, matching Deauthentication Attack.
Deauthentication frames are unauthenticated in legacy 802.11 standards and used to force disconnects.
2
Examine the unsolicited ARP response packet capture.
Mapping the gateway IP to an unknown host MAC address manipulates the switch IPv4 neighbor cache, confirming ARP Poisoning.
ARP lacks authentication mechanisms, allowing malicious hosts to spoof mapping responses.
3
Evaluate the IPv6 Neighbor Advertisement anomaly.
NDP Neighbor Advertisements perform address resolution in IPv6 analogous to ARP in IPv4, making unsolicited NA broadcasts indicative of NDP Spoofing.
Without SEND (Secure Neighbor Discovery), NDP messages can be spoofed to divert IPv6 traffic.
4
Identify the rogue AP broadcasting the legitimate corporate SSID.
Mimicking a valid wireless network name with higher power output to trick station roaming algorithms matches the Evil Twin classification.
Wireless clients typically prefer APs with stronger RSSI operating under known SSIDs.

Anahtar Kavram

Network and Wireless Attack Indicators
Soru 1218Soru →

An enterprise identity administrator is enforcing phishing-resistant multi-factor authentication (MFA) for privileged accounts. What is the correct sequence of events for registering a FIDO2 WebAuthn hardware security key with the Identity Provider (IdP)? Place the steps in chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct registration sequence begins with the IdP issuing a cryptographic challenge nonce to the client browser. Next, the user touches the hardware key to generate an origin-bound asymmetric key pair on the device. Then, the security key signs the challenge and returns the signature, public key, and attestation data to the IdP. Finally, the IdP validates the attestation statement and registers the public key to the user's IAM account profile.
The correct sequence follows the standard FIDO2/WebAuthn registration ceremony. First, the Identity Provider initiates the process by issuing a cryptographic challenge nonce to the browser. Second, upon user presence confirmation, the hardware token generates an origin-bound asymmetric key pair. Third, the token signs the challenge with the private key and returns the public key and attestation payload. Fourth, the Identity Provider verifies the attestation and signature before persisting the public key in the user's IAM profile.

Adım Adım Çözüm

1
Identify the initial server-side trigger.
The Identity Provider generates a cryptographic challenge nonce to prevent replay attacks during WebAuthn registration.
Challenge creation must occur first so that the hardware key has fresh data to sign.
2
Determine the local hardware token response.
The user completes physical presence verification (e.g., touch sensor), prompting the security key to generate an origin-bound public/private key pair.
The key pair is created on-device in response to the browser receiving the registration challenge.
3
Trace the transmission of cryptographic proof.
The security key signs the challenge nonce using the private key and returns the signature, new public key, and attestation object to the IdP.
The IdP requires the signature and public key to verify authentic token hardware before enrollment.
4
Finalize identity binding at the Identity Provider.
The IdP authenticates the attestation metadata, verifies the signature against the issued challenge, and binds the public key to the user's IAM profile.
Saving the verified public key in the IAM user store is the final step required for future authentication.

Anahtar Kavram

FIDO2/WebAuthn Enrollment Ceremony and Cryptographic Credential Binding
Soru 1219Soru →

A network security team receives a high-severity alert indicating anomalous telemetry from a critical database bridge host. An analyst inspects the correlated Network Flow (NetFlow) logs and DNS query events shown below:

Timestamp: 2026-07-27T14:02:11Z | SrcIP: 10.200.4.15:51204 -> DstIP: 198.51.100.77:443 | Proto: TCP | Bytes: 142 | State: ESTABLISHED
Timestamp: 2026-07-27T14:07:11Z | SrcIP: 10.200.4.15:51210 -> DstIP: 198.51.100.77:443 | Proto: TCP | Bytes: 142 | State: ESTABLISHED
Timestamp: 2026-07-27T14:12:10Z | SrcIP: 10.200.4.15:51216 -> DstIP: 198.51.100.77:443 | Proto: TCP | Bytes: 142 | State: ESTABLISHED
DNS Lookup Query: z9x4k1.ec2-updates-sync.net -> Resolved: 198.51.100.77 (TTL: 30s)

The analyst notes that low-volume outbound encrypted connections occur at fixed 300-second intervals following short-TTL DNS queries for algorithmically generated subdomains. Which of the following mitigation actions should the security analyst perform FIRST to contain the threat while minimizing operational disruption to legitimate encrypted web services?

Cevabı ve açıklamayı göster

Cevap: Implement Response Policy Zone (RPZ) DNS sinkholing for the malicious domain and configure egress TLS Server Name Indication (SNI) filtering on the web proxy.

Cevap

Implement Response Policy Zone (RPZ) DNS sinkholing for the malicious domain and configure egress TLS Server Name Indication (SNI) filtering on the web proxy.
The observed telemetry displays classic indicators of compromised host C2 beaconing: regular timing intervals (300 seconds), uniform low byte size (142 bytes), and dynamic DNS lookups with low TTLs. Employing DNS sinkholing (RPZ) combined with proxy-level SNI filtering precisely disrupts the malicious C2 channel without taking down legitimate outbound HTTPS access on port 443.

Adım Adım Çözüm

1
Analyze flow and log telemetry indicators
Identified periodic outbound HTTPS connections (every 300 seconds) with fixed 142-byte payloads to an external IP resolved via short-TTL dynamic DNS, confirming malware C2 beaconing.
Recognizing command and control beaconing behavior isolates the precise threat mechanism.
2
Evaluate candidate mitigation controls for precision and operational impact
Determined that DNS sinkholing via RPZ combined with SNI proxy filtering specifically isolates and redirects malicious communications without impacting unrelated business HTTPS traffic.
Effective security controls must mitigate targeted threats while preserving availability for legitimate services.
3
Select the optimal initial containment step
Selected domain-specific sinkholing and SNI-based egress filtering as the preferred first-line containment strategy.
This approach disrupts C2 reachability immediately with minimal risk of broad service outage.

Anahtar Kavram

Network Security Monitoring Alert Analysis and Command & Control (C2) Beacon Containment
Soru 1220Soru →

During security operations monitoring, an analyst receives an alert indicating anomalous API token creation and unexpected mass repository downloads originating from a compromised developer endpoint connected via VPN. The analyst confirms that an external threat actor is actively leveraging these stolen credentials to access private source code repositories. According to NIST incident response guidelines, which of the following immediate actions should the incident response team perform during the Containment phase of this incident? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Revoke active VPN sessions and invalidate all API tokens associated with the compromised developer account.; Apply restrictive host-based firewall rules to isolate the affected workstation while preserving volatile system memory for analysis.

Cevap

The correct containment actions are revoking the active VPN sessions and invalidating stolen API tokens associated with the account, as well as applying host-based firewall rules to isolate the compromised endpoint while preserving volatile memory.
During the containment phase of an incident response process, the goal is to prevent the threat from spreading or causing further damage while preserving forensic evidence. Revoking compromised credentials and API tokens stops the attacker from continuing exfiltration, while network-isolating the host prevents lateral movement while preserving volatile system RAM for forensic investigation.

Adım Adım Çözüm

1
Identify the primary phase of the incident response lifecycle requested in the scenario.
The scenario specifically asks for actions appropriate for the Containment phase of the NIST SP 800-61 IR framework.
Containment limits the scope and impact of an active breach before recovery steps begin.
2
Evaluate containment actions that immediately halt adversary activity without destroying digital evidence.
Revoking active credentials/tokens stops ongoing unauthorized remote access. Isolating the workstation network interface prevents lateral movement while retaining volatile RAM data.
Effective containment balances stopping threat activity with evidence preservation.
3
Distinguish containment phase actions from eradication, recovery, or post-incident activities.
Actions such as re-imaging hosts or holding lessons learned sessions belong to later IR phases.
Prematurely re-imaging hosts destroys forensic evidence before containment and investigation are complete.

Anahtar Kavram

NIST Incident Response Containment Phase Strategies
ÖncekiSayfa 61 / 112Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin