Examkin

Tüm alıştırma soruları

2232 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 1241Soru →

A security administrator is auditing an organization's identity lifecycle procedures to ensure clear operational separation between authentication and authorization controls. Which of the following operational activities specifically perform authentication? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Verifying a user's time-based one-time password (TOTP) token during the login sequence; Validating submitted user credential hashes against an Active Directory domain controller

Cevap

Verifying a user's time-based one-time password (TOTP) token during the login sequence and validating submitted user credential hashes against an Active Directory domain controller specifically perform authentication.
Authentication strictly addresses identity verification. Verifying TOTP tokens and checking submitted credentials against an Active Directory domain controller both serve to confirm that a user is who they claim to be.

Adım Adım Çözüm

1
Define authentication within IAM operations.
Authentication is the process of proving a claimed identity using credentials, tokens, or biometric factors.
Establishing identity must happen before access permissions can be evaluated.
2
Evaluate each activity against the definition of authentication.
Checking TOTP tokens and validating password hashes verify identity claims. Configuring folder permissions assigns rights (authorization), and trusting internal subnets assumes implicit network trust without identity verification.
Only mechanisms that validate claimed identity qualify as authentication operations.

Anahtar Kavram

Distinguishing identity verification (authentication) from access control enforcement (authorization) and perimeter implicit trust in IAM operations.
Soru 1242Soru →

During network telemetry monitoring, a security technician observes an alert generated when an internal workstation attempts an unauthorized connection to a non-production server that contains simulated sensitive files and no real enterprise services. Which of the following network security monitoring concepts is actively being utilized in this scenario?

Cevabı ve açıklamayı göster

Cevap: A honeypot deployed as a deception mechanism to detect unauthorized internal access

Cevap

A honeypot deployed as a deception mechanism to detect unauthorized internal access
A honeypot is a security control designed to act as a decoy to lure potential attackers or unauthorized users. Because a honeypot has no legitimate business purpose or real production traffic, any interaction or connection attempt made to it generates a high-confidence alert for security analysts.

Adım Adım Çözüm

1
Analyze the network monitoring scenario
Identified a non-production decoy server designed with simulated data to attract interaction.
Security monitoring systems use intentionally vulnerable or decoy assets to alert security teams of lateral movement or unauthorized scanning.
2
Evaluate the security mechanism type
Decoy systems intended for detection and threat intelligence gathering are classified as honeypots.
Honeypots do not serve legitimate business functions, so any connection attempt to one triggers a high-fidelity alert.

Anahtar Kavram

Honeypots and Deception Technologies in Network Security Monitoring
Soru 1243Soru →

A security architect is evaluating hardware security controls for enterprise hardware and embedded system deployments. Match each hardware security component on the left to its corresponding security capability on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Secure Element (SE)
Baseboard Management Controller (BMC)
Memory Protection Unit (MPU)
Hardware Root of Trust (eFuse / Immutable ROM)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct matches pair Secure Element (SE) with tamper-resistant credential storage; Baseboard Management Controller (BMC) with out-of-band remote management; Memory Protection Unit (MPU) with hardware memory region isolation; and Hardware Root of Trust (eFuse / Immutable ROM) with unalterable boot validation.
Each hardware component is correctly mapped to its essential function: Secure Elements handle isolated credential and key storage; Baseboard Management Controllers perform out-of-band remote administration; Memory Protection Units enforce internal memory access restrictions; and Hardware Roots of Trust anchor secure boot validation using immutable hardware.

Adım Adım Çözüm

1
Evaluate the functional scope of a Secure Element (SE).
Identified as a specialized, tamper-resistant chip designed to store sensitive tokens and biometric data securely.
SE provides physical and logical isolation from the main operating system for crypto operations.
2
Evaluate the architectural role of a Baseboard Management Controller (BMC).
Identified as out-of-band motherboard hardware that enables remote administration.
BMCs function independently of the main processor and host operating system.
3
Evaluate the mechanism of a Memory Protection Unit (MPU).
Identified as micro-architectural hardware that restricts execution regions and memory access.
MPUs enforce boundary protection in embedded hardware to block buffer overflows and privilege escalation.
4
Evaluate the purpose of a Hardware Root of Trust built on eFuse or Immutable ROM.
Identified as the static cryptographic foundation for boot validation.
Write-once or read-only hardware cannot be overwritten by software malware, forming an immutable trust anchor.

Anahtar Kavram

Hardware Security Components and Embedded Controls
Soru 1244Soru →

A security technician needs to assess an internal enterprise server to accurately identify missing operating system patches and local software misconfigurations while minimizing network bandwidth usage. Which of the following scan methods should the technician execute?

Cevabı ve açıklamayı göster

Cevap: Credentialed vulnerability scan

Cevap

Credentialed vulnerability scan
A credentialed vulnerability scan authenticates directly to the target operating system, allowing the scanner to inspect internal file versions, package managers, and registry settings directly. This yields precise patch and configuration details without requiring heavy network packet generation.

Adım Adım Çözüm

1
Determine host assessment requirements
The scenario requires auditing internal system configuration details and patch levels without causing server instability.
Reading internal system registries and software patch databases requires local system authorization.
2
Select the appropriate vulnerability scanning method
Executing a credentialed scan allows the scanner to log in locally to perform a direct inventory.
Credentialed scans provide host-level precision, significantly reduce false positives, and consume less network bandwidth compared to intense unauthenticated probing.

Anahtar Kavram

Credentialed vs. Non-Credentialed Vulnerability Assessment
Soru 1245Soru →

A security analyst reviews packet capture metrics following reports of intermittent traffic manipulation on a corporate wireless network. The packet capture reveals unexpected network protocol behavior during client IP address assignment. Which TWO of the following indicators specifically point to a rogue DHCP server attack on the network? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Multiple DHCP OFFER packets originating from an unauthorized MAC address containing an unapproved default gateway IP; Duplicate DHCP ACK responses observed on the subnet assigning client IP configurations outside the authorized scope pool

Cevap

The presence of a rogue DHCP server is confirmed by unauthorized DHCP OFFER packets containing an unapproved default gateway address and duplicate DHCP ACK responses assigning IP configurations outside the legitimate network scope.
A rogue DHCP server operates by broadcasting unauthorized DHCP OFFER and DHCP ACK packets in response to client DHCP DISCOVER requests. These unauthorized packets contain modified IP settings, such as an unapproved default gateway address or DNS server IP, enabling the attacker to perform on-path network interception.

Adım Adım Çözüm

1
Analyze the observed network protocol behavior described in the scenario
Identified anomalous IP address assignment traffic during client network initialization.
DHCP attacks target the automated address allocation process on local subnets.
2
Evaluate the specific packet types and attributes characteristic of rogue DHCP servers
Rogue DHCP servers race against legitimate DHCP servers to respond to client DISCOVER messages with unauthorized DHCP OFFER and ACK packets.
By supplying invalid gateway or DNS settings, the attacker establishes an on-path position for interception.
3
Differentiate rogue DHCP indicators from unrelated wireless attacks
Disassociation frame floods represent wireless DoS/deauthentication attacks, while IV reuse represents cryptographic key cracking attempts.
Accurate incident diagnosis requires matching protocol anomalies directly to the underlying threat vector.

Anahtar Kavram

Rogue DHCP Server Attack Indicators
Soru 1246Soru →

A municipal water utility is re-architecting remote operational telemetry monitoring access for field maintenance engineers. The security architect must enforce Zero Trust Architecture (ZTA) principles to prevent unauthorized lateral movement across operational technology (OT) networks. Which of the following access control implementations best demonstrates the core Zero Trust tenets of explicit verification and least privilege?

Cevabı ve açıklamayı göster

Cevap: Deploying an inline Policy Enforcement Point (PEP) that evaluates user identity, endpoint health, and contextual risk for every individual database query before granting per-session access.

Cevap

Deploying an inline Policy Enforcement Point (PEP) that evaluates user identity, endpoint health, and contextual risk for every individual database query before granting per-session access.
The option specifying an inline Policy Enforcement Point (PEP) directly aligns with NIST SP 800-207 Zero Trust Architecture principles. It enforces explicit verification by continuously inspecting user identity, device compliance posture, and contextual parameters for every database transaction, granting minimal per-session access without assuming network-based implicit trust.

Adım Adım Çözüm

1
Analyze the core requirements of Zero Trust Architecture (ZTA).
ZTA requires eliminating implicit trust based on network location and enforcing continuous explicit verification and least privilege for every access request.
Traditional perimeter security assumes internal network traffic is trustworthy, whereas Zero Trust assumes breach and verifies continuously.
2
Evaluate the role of Policy Decision Points (PDP) and Policy Enforcement Points (PEP).
An inline PEP intercepting every transaction ensures dynamic contextual evaluation (user identity, device posture, location, risk) before granting temporal, per-session authorization.
Explicit verification must occur dynamically on a per-request basis rather than relying on a one-time perimeter check.

Anahtar Kavram

Zero Trust Architecture Principles - Explicit Verification and Continuous Authorization
Tahmini Süre:1m 30s
Soru 1247Soru →

Match each resilience and redundancy mechanism on the left with the corresponding operational requirement or architecture scenario on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Automatic Transfer Switch (ATS)
Geographic Asynchronous Replication
Multipath I/O (MPIO)
Dynamic BGP Multihoming

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct pairings match Automatic Transfer Switch (ATS) to single-corded utility power delivery via seamlessly transferred electrical loads; Geographic Asynchronous Replication to maintaining distant data availability with a non-zero RPO; Multipath I/O (MPIO) to storage access path aggregation over redundant HBAs; and Dynamic BGP Multihoming to enterprise boundary traffic rerouting across multiple ISP links.
Each redundancy technology directly targets a specific physical or logical component failure domain: ATS addresses single-corded power feed failure, MPIO addresses storage channel and HBA adapter failure, BGP multihoming addresses WAN ISP link failure, and Asynchronous Replication addresses regional datacenter failure without application performance degradation.

Adım Adım Çözüm

1
Analyze power redundancy requirements for single-corded hardware.
An Automatic Transfer Switch (ATS) is required to feed single-corded appliances from redundant PDUs without power interruption.
ATS handles power source failover at the rack level when a PDU or utility feed loses power.
2
Evaluate long-distance database disaster recovery methods.
Geographic Asynchronous Replication allows cross-datacenter sync over WAN without local commit latency constraints.
Asynchronous replication tolerates network latency across geographic sites while accepting a minor RPO delta.
3
Assess host-to-SAN storage link redundancy.
Multipath I/O (MPIO) aggregates multiple Host Bus Adapter (HBA) paths into a redundant logical channel.
MPIO protects host storage connectivity against individual HBA, cable, or fiber channel switch failures.
4
Examine WAN perimeter network resilience.
Dynamic BGP Multihoming maintains network connectivity across independent Internet service provider links.
BGP detects link failure and updates routing tables to direct inbound and outbound traffic over functional paths.

Anahtar Kavram

High Availability and Infrastructure Redundancy Controls
Soru 1248Soru →

A logistics enterprise is deploying thousands of handheld mobile terminals to remote distribution staff. The devices operate in physically untrusted environments and store sensitive customer authentication data. The security engineering team mandates that each device must validate system integrity from power-on through operating system initialization using hardware-bound cryptographic measurements, while securely storing full-disk encryption keys on a dedicated cryptoprocessor integrated into the endpoint's motherboard. Which of the following hardware security controls BEST meets this requirement?

Cevabı ve açıklamayı göster

Cevap: Trusted Platform Module (TPM)

Cevap

Trusted Platform Module (TPM)
The correct option is the Trusted Platform Module (TPM). A TPM is a hardware-based cryptoprocessor integrated into endpoint motherboards that securely generates and stores cryptographic keys, while providing platform integrity measurements (measured boot) to ensure firmware and system boot files have not been compromised.

Adım Adım Çözüm

1
Analyze the endpoint hardware security requirements specified in the scenario.
Identified two primary requirements: motherboard-integrated hardware cryptoprocessor key storage and hardware-bound platform boot integrity measurement on individual mobile endpoints.
Security controls must match both the form factor (endpoint motherboard) and functional requirements (boot integrity and key protection).
2
Evaluate hardware security mechanisms against the requirement profile.
A Trusted Platform Module (TPM) is designed specifically for endpoint systems to store cryptographic keys isolated from the main CPU and verify boot integrity metrics via Platform Configuration Registers (PCRs).
Other options either target data center infrastructure (HSM), focus strictly on storage media encryption (SED), or lack hardware-level isolation (software key stores).

Anahtar Kavram

Trusted Platform Module (TPM) and Endpoint Hardware Security
Tahmini Süre:1m 30s
Soru 1249Soru →

A security administrator is planning a routine security evaluation of internal server infrastructure. Which of the following are distinct operational advantages of conducting a credentialed vulnerability scan rather than a non-credentialed network scan? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Identification of missing local software patches and operating system updates; Lower rate of false positives due to direct host configuration querying

Cevap

Credentialed vulnerability scans provide direct inspection of missing local patches and system configurations while significantly reducing false positives through direct host querying.
Credentialed vulnerability scans log into target systems to directly audit local file versions, installed security updates, and configuration files. This internal visibility enables precise patch verification and dramatically reduces false positives compared to unauthenticated network probing.

Adım Adım Çözüm

1
Analyze the operational differences between credentialed (authenticated) and non-credentialed (unauthenticated) vulnerability scans.
Credentialed scans log into target host operating systems using administrative access, allowing direct inspection of patch registries, local settings, and software inventories.
Understanding scanner access privileges highlights what host-level visibility is gained.
2
Evaluate the impact on reporting accuracy and false positive rates.
Direct host access provides definitive data on installed patch levels, reducing false positives caused by generic network banner grabbing.
Authenticated access eliminates guesswork for services hidden behind network security controls or running on non-standard ports.
3
Differentiate vulnerability scanners from active control mechanisms like firewalls or automated remediation systems.
Vulnerability scanners remain detective assessment tools and do not directly enforce network firewall filtering or alter security control classifications.
Scanners produce diagnostic data; mitigation requires separate patch management or configuration enforcement processes.

Anahtar Kavram

Credentialed vs. Non-Credentialed Vulnerability Scanning
Soru 1250Soru →

A security administrator is troubleshooting a critical network storage appliance in a data center. The appliance features dual internal power supply units (PSUs) to ensure hardware fault tolerance. However, during a recent scheduled power maintenance event on a single electrical circuit, the appliance unexpectedly lost power and shut down. Investigation reveals that both PSUs were plugged into the same rack Power Distribution Unit (PDU). Which of the following infrastructure modifications should the administrator implement to prevent single-circuit power outages from taking the appliance offline?

Cevabı ve açıklamayı göster

Cevap: Connect each power supply unit to separate, independent Power Distribution Units (PDUs) fed by distinct power sources.

Cevap

Connect each power supply unit to separate, independent Power Distribution Units (PDUs) fed by distinct power sources.
Connecting each redundant power supply unit to a separate, independent Power Distribution Unit fed by distinct power lines eliminates single points of failure in the electrical distribution path. If one PDU or utility feed goes offline, the second PSU continues to draw power from the remaining active PDU, allowing the appliance to operate without interruption.

Adım Adım Çözüm

1
Analyze the root cause of the system outage described in the scenario.
The system shut down because both redundant power supplies were plugged into the same PDU, making that PDU and its single circuit a single point of failure.
Redundant hardware components inside a chassis cannot provide high availability if they rely on a single shared upstream power source.
2
Identify the appropriate architectural modification for power redundancy.
Each power supply unit must be connected to independent PDUs backed by separate electrical circuits or Uninterruptible Power Supply (UPS) feeds.
A dual-bus power configuration ensures continuous server operation even if an entire PDU or electrical breaker trips.

Anahtar Kavram

Power Redundancy and Single Points of Failure
Tahmini Süre:1m 15s
Soru 1251Soru →

Following an influx of fileless malware alerts detected by an Endpoint Detection and Response (EDR) solution, a Security Operations Center (SOC) team is refining an automated Security Orchestration, Automation, and Response (SOAR) playbook. During initial testing, a high-severity alert triggered the playbook to automatically isolate a primary Domain Controller, causing a critical network outage. Which playbook design modification BEST balances rapid threat containment with enterprise operational resilience to prevent future accidental outages?

Cevabı ve açıklamayı göster

Cevap: Implement conditional evaluation of asset tags to mandate manual analyst approval before executing host isolation on critical infrastructure.

Cevap

Implement conditional evaluation of asset tags to mandate manual analyst approval before executing host isolation on critical infrastructure.
Implementing conditional evaluation of asset tags—mandating analyst approval prior to isolating critical systems like Domain Controllers while permitting automatic containment for standard endpoints—strikes the correct balance between rapid threat mitigation and enterprise system availability.

Adım Adım Çözüm

1
Analyze the incident trigger and operational impact
Identified that unvalidated, fully automated isolation of critical core assets (such as Domain Controllers) introduces high risk of self-inflicted service outages.
SOAR playbooks must balance containment velocity against the operational impact of false positives or unvalidated high-severity alerts.
2
Evaluate risk mitigation strategies within playbook logic
Determined that integrating asset tag evaluation (e.g., critical infrastructure vs. standard endpoint) enables contextual response pathways.
Standard workstation endpoints can be automatically contained immediately, whereas critical infrastructure assets can route to an analyst queue for quick manual validation.
3
Select the optimal playbook containment design
Incorporating conditional branching and human-in-the-loop approval for critical assets prevents unplanned operational downtime while retaining rapid automated response for non-critical systems.
This approach preserves enterprise availability while preserving automated containment capabilities across the rest of the environment.

Anahtar Kavram

SOAR Automated Response Playbook Design and Asset-Aware Containment Logic
Soru 1252Soru →

A security operations analyst at a financial institution is investigating an unauthorized change alert on a core network device. The organization relies on a central TACACS+ server integrated with an LDAP directory for network device administration. The analyst reviews the following TACACS+ audit log entries:

text
[2026-07-27 14:15:02 UTC] AUTHEN PASS: user="net_admin1" port="tty1" rem_addr="10.1.5.22"
[2026-07-27 14:15:10 UTC] AUTHOR PASS: user="net_admin1" cmd="show running-config"
[2026-07-27 14:16:05 UTC] AUTHOR FAIL: user="net_admin1" cmd="configure terminal" reason="Privilege level insufficient"
[2026-07-27 14:16:12 UTC] AUTHEN PASS: user="svc_monitor" port="tty2" rem_addr="10.1.5.50"
[2026-07-27 14:16:30 UTC] AUTHOR PASS: user="svc_monitor" cmd="configure terminal" matched_rule="rule_group_ops_override"

Further inspection confirms that `svc_monitor` is a low-privilege automated monitoring account with read-only rights in the LDAP directory. Which of the following operational misconfigurations best explains why `svc_monitor` was permitted to run the restricted command while `net_admin1` was denied?

Cevabı ve açıklamayı göster

Cevap: An explicit command authorization override rule on the TACACS+ server granted command permissions directly to the monitoring group, decoupling authorization from the LDAP role attributes.

Cevap

An explicit command authorization override rule on the TACACS+ server granted command permissions directly to the monitoring group, decoupling authorization from the LDAP role attributes.
TACACS+ strictly separates authentication from authorization, evaluating authorization on a granular per-command basis. The log shows that `svc_monitor` authenticated successfully via LDAP but executed the command because a specific TACACS+ authorization rule (`rule_group_ops_override`) explicitly permitted it, overriding directory-level role expectations.

Adım Adım Çözüm

1
Analyze the TACACS+ log entries for authentication and authorization events.
Both `net_admin1` and `svc_monitor` passed authentication (`AUTHEN PASS`). However, `net_admin1` failed authorization for `configure terminal`, whereas `svc_monitor` passed authorization due to `matched_rule="rule_group_ops_override"`.
Determining where the access decision diverged is essential to isolating the misconfiguration.
2
Evaluate TACACS+ operational architecture features regarding AAA separation.
TACACS+ completely separates Authentication, Authorization, and Accounting (AAA). Authorization policies are evaluated on a per-command basis using TACACS+ policy sets.
Understanding TACACS+ behavior explains how authorization can yield results independent of central authentication store roles.
3
Identify the operational root cause.
The local TACACS+ server contained a custom authorization rule (`rule_group_ops_override`) that matched `svc_monitor` and permitted command execution despite its low-privilege group status in LDAP.
Overly permissive or leftover local command authorization rules override intended centralized privilege restrictions.

Anahtar Kavram

TACACS+ AAA Decoupling and Per-Command Authorization
Tahmini Süre:2m 0s
Soru 1253Soru →

A security analyst inspecting telemetry from an Endpoint Detection and Response (EDR) system observes an unapproved administrative utility downloading an encoded payload from an external domain, followed by an immediate attempt to modify host boot configurations. Which of the following is the MOST effective immediate action the analyst should take using the EDR platform to contain the incident?

Cevabı ve açıklamayı göster

Cevap: Perform host-level network isolation via the EDR console while keeping the management channel open for live investigation.

Cevap

Initiating host-level network isolation via the EDR console while retaining agent management connectivity is the most effective containment step.
Isolating the endpoint at the network layer via EDR restricts network access (stopping command-and-control communication and lateral movement) while preserving the agent connection so analysts can continue investigating and gathering memory forensics.

Adım Adım Çözüm

1
Analyze the telemetry alert
Identified suspicious command execution and payload download on an active endpoint.
Determines the immediate severity and potential for lateral movement.
2
Select the containment control
Apply EDR host-level network isolation.
Host isolation cuts off network connectivity to prevent spread, while maintaining the EDR control plane for remote triage.

Anahtar Kavram

Endpoint Detection and Response (EDR) Host Isolation
Soru 1254Soru →

A security administrator notices during a routine audit that an employee who transferred to a new department retains active access permissions from their previous job role. Which identity and access management procedure should be executed to address this issue?

Cevabı ve açıklamayı göster

Cevap: Perform user permission recertification and role adjustment

Cevap

Perform user permission recertification and role adjustment
Performing user permission recertification and role adjustment systematically reviews an account's granted entitlements, revoking stale access rights to enforce the principle of least privilege following role transfers.

Adım Adım Çözüm

1
Identify the core access issue resulting from the internal department transfer.
The user retains privilege creep (unneeded legacy access rights).
Changes in job roles require aligning permissions with current duties.
2
Evaluate the appropriate IAM operational control.
Permission recertification and privilege adjustment resolves inappropriate access.
Recertification audits existing rights and removes unneeded authorizations.

Anahtar Kavram

Account Lifecycle Management and Permission Recertification
Soru 1255Soru →

A Security Operations Center (SOC) analyst is inspecting web server access logs ingested into a SIEM platform. An automated correlation rule generated a low-priority informational alert after detecting directory path indicators in incoming HTTP requests. The SIEM displays the following sequential log entries:

192.168.1.45 - - [27/Jul/2026:14:22:01 +0000] "GET /api/v1/download?file=../../../../etc/passwd HTTP/1.1" 200 4096
192.168.1.45 - - [27/Jul/2026:14:22:05 +0000] "GET /api/v1/download?file=..%2f..%2f..%2f..%2fetc%2fshadow HTTP/1.1" 403 280

Based on these log entries, which of the following conclusions accurately identifies the security incident status and the required SIEM management action?

Cevabı ve açıklamayı göster

Cevap: A path traversal attack successfully accessed a sensitive system file on the first request, requiring the SIEM correlation rule severity to be escalated from informational to high.

Cevap

A path traversal attack successfully accessed a sensitive system file on the first request, requiring the SIEM correlation rule severity to be escalated from informational to high.
The correct response recognizes that the HTTP status code 200 combined with a 4096-byte payload on the request containing path traversal sequences (../../../../etc/passwd) indicates that the application successfully served file contents to the attacker. Because the initial SIEM alert was categorized as low-priority/informational, the analyst must escalate the rule severity to ensure immediate incident response triggers upon successful exploitation.

Adım Adım Çözüm

1
Analyze the request URI parameters in both log entries
Identified path traversal patterns (../../../../ and URL-encoded ..%2f..%2f..%2f..) targeting restricted system files (/etc/passwd and /etc/shadow).
Determining the threat vector requires evaluating the input payload within the HTTP GET request string.
2
Evaluate the HTTP response status codes and byte sizes in sequence
The first request returned HTTP status 200 (OK) with 4096 bytes transferred. The second request returned HTTP status 403 (Forbidden) with 280 bytes.
HTTP 200 indicates the server fulfilled the request and returned file content, whereas HTTP 403 indicates subsequent access blocking.
3
Determine the incident impact and required SIEM management response
Successful unauthorized retrieval of /etc/passwd confirms a successful breach. The low-priority SIEM rule failed to reflect the true severity.
SIEM correlation rules must be tuned to alert with high severity when directory traversal attempts return HTTP 200 success codes.

Anahtar Kavram

Directory Traversal Log Analysis and SIEM Alert Tuning
Soru 1256Soru →

A security operations team is investigating an incident where an attacker maintained active access to enterprise cloud applications following the revocation of a compromised user's directory credentials. The centralized Identity Provider (IdP) successfully initiated password resets and disabled the directory account in response to a SIEM alert, yet the attacker continued performing privileged actions in single sign-on (SSO) web applications for several hours. Which of the following operational root causes directly contributed to this continuous unauthorized access and failure of immediate session termination? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The Identity Provider revoked user refresh tokens without invalidating active stateless JSON Web Tokens (JWTs) or clearing active session caches at the Relying Party applications.; The application architecture relied on standard OAuth 2.0 access token lifetimes without implementing Continuous Access Evaluation Protocol (CAEP) or real-time event-driven session revocation.

Cevap

The persistent access was caused by the IdP revoking refresh tokens without invalidating active stateless JWT access tokens or session caches at the application tier, alongside the absence of Continuous Access Evaluation Protocol (CAEP) integration to communicate real-time credential revocation events to relying applications.
In modern federated IAM architectures, revoking credentials at the identity provider (IdP) stops new authentication requests and refresh token usage. However, active sessions established via stateless access tokens (such as JSON Web Tokens) remain valid at relying applications until their expiration time unless active token invalidation (or session cache clearing) is performed. Furthermore, implementing Continuous Access Evaluation Protocol (CAEP) allows identity providers to push real-time security events (e.g., credential revocation, user disablement) directly to relying parties, enabling immediate termination of active sessions across applications.

Adım Adım Çözüm

1
Analyze the IAM session flow and revocation mechanics
Disabling an account or revoking refresh tokens in an IdP stops new authentication attempts and token refreshes, but does not inherently revoke currently active access tokens already issued to client applications.
Stateless access tokens (like JWTs) are verified digitally by applications without querying the IdP on every API request until the token expires.
2
Evaluate real-time event integration protocols between IdPs and Relying Parties
Without CAEP or shared signals framework (SSF), relying party applications operate in isolation from IdP status changes until existing token lifetimes lapse.
CAEP enables real-time synchronization of security events (e.g., account disablement, session revocation) between identity providers and service providers.
3
Identify misattributed infrastructure controls
Network perimeter firewalls, RADIUS servers, and TACACS+ AAA configurations govern network access and infrastructure device logins, not web SSO access token lifecycles.
Operational IAM incident response requires distinguishing identity protocol mechanics (OAuth/OIDC/SAML) from network layer AAA controls.

Anahtar Kavram

Federated Identity Session Lifecycles & Real-Time Revocation (CAEP/JWT Invalidation)
Soru 1257Soru →

An IT security operations team wants to streamline incident triage by automatically connecting threat intelligence feeds with security monitoring tools and executing pre-defined response actions across different platforms. Which technology should the team implement to achieve this orchestration and automation?

Cevabı ve açıklamayı göster

Cevap: Security Orchestration, Automation, and Response (SOAR)

Cevap

Security Orchestration, Automation, and Response (SOAR)
Security Orchestration, Automation, and Response (SOAR) integrates disparate security systems and software, allowing organizations to execute automated playbooks that enrich alerts and streamline response actions across the enterprise.

Adım Adım Çözüm

1
Analyze the operational requirement given in the scenario.
The requirement calls for integrating disparate security tools and automating threat triage using pre-defined response actions.
Combining disparate tools into unified workflows requires an orchestration layer.
2
Compare the core functions of security solutions against the requirement.
SOAR connects threat feeds and security tools to run automated response playbooks, fulfilling all requirements.
SOAR is specifically designed for cross-platform security automation and workflow orchestration.

Anahtar Kavram

Security Automation and Orchestration (SOAR)
Soru 1258Soru →

During an internal fraud investigation, a security analyst seizes a desktop computer and generates a forensic image of the primary storage drive. Months later, during a legal proceeding, opposing counsel moves to suppress the forensic disk image evidence. Which of the following circumstances would serve as the strongest basis for suppressing the evidence due to a breakdown in the chain of custody?

Cevabı ve açıklamayı göster

Cevap: An unrecorded gap exists in the evidence log showing a missing signature during the physical transfer of the drive between two investigators.

Cevap

An unrecorded gap in the physical evidence log showing a missing signature during transfer serves as the strongest basis for suppressing evidence due to a chain of custody failure.
The chain of custody is a strict administrative and legal process requiring detailed record-keeping of every individual who collected, transported, accessed, or secured physical evidence. An unrecorded transfer or missing custodian signature creates an unverified gap in possession, making it impossible to legally guarantee that the evidence was not tampered with, swapped, or altered.

Adım Adım Çözüm

1
Analyze the core objective of maintaining a chain of custody.
Chain of custody requires a complete, unbroken, chronological documentation trail of every person who possessed, transferred, or examined physical evidence.
Any unaccounted period or missing transfer sign-off compromises legal verification that evidence remained unaltered while in law enforcement or analyst custody.
2
Distinguish legal custodial requirements from technical acquisition choices.
Gaps in transfer logs directly breach procedural custody rules, whereas choices regarding software vs. hardware write-blockers, hashing algorithms, or network acquisition interfaces represent technical methodology.
Technical acquisition choices do not undermine evidence admissibility as long as verification hashes match and custodial logs are maintained.

Anahtar Kavram

Chain of Custody and Evidence Admissibility
Soru 1259Soru →

A security technician is configuring network security monitoring rules to detect active compromises and data exfiltration. Which of the following observations represent valid network-level threat indicators that should trigger an immediate security alert? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Outbound network flow logs showing persistent connection attempts to known malicious Command and Control (C2) IP addresses; Network Intrusion Detection System (NIDS) alerts identifying anomalous ICMP packet payloads containing encoded data transfers from an internal server

Cevap

The valid indicators of network-based compromise requiring alerts are persistent outbound connections to known Command and Control (C2) IP addresses and NIDS alerts identifying anomalous ICMP packet payloads carrying encoded data.
Outbound connection attempts to known Command and Control infrastructure and protocol anomalies like data-laden ICMP payloads represent real-time network layer telemetry indicating compromised internal assets and active tunneling, making both essential network alert triggers.

Adım Adım Çözüm

1
Evaluate network connection telemetry for outbound threat indicators
Persistent outbound traffic to known C2 addresses confirms active malware beaconing from internal hosts.
Compromised endpoints routinely initiate outbound sessions to external command infrastructure to receive instructions.
2
Analyze protocol payloads for covert channel activity
Anomalous ICMP packets carrying data payloads signal ICMP tunneling.
Standard ICMP traffic carries simple echo request/reply data; embedding arbitrary data payloads indicates protocol misuse for data exfiltration.

Anahtar Kavram

Network Security Monitoring and Alerting
Soru 1260Soru →

A Security Operations Center (SOC) team deploys an automated Security Orchestration, Automation, and Response (SOAR) playbook designed to mitigate rapid ransomware propagation. The playbook triggers automatically upon receiving high-severity Endpoint Detection and Response (EDR) telemetry, querying external threat intelligence APIs to verify file hashes before calling a Network Access Control (NAC) API to isolate the host network interface. During a red-team simulation, synthetic high-volume alert telemetry from an active primary domain controller causes the playbook to execute auto-isolation on the server, resulting in an immediate domain-wide operational outage. Which modification to the SOAR playbook logic or execution configuration best mitigates the operational risk of automated service disruption while maintaining rapid containment capabilities for verified threats?

Cevabı ve açıklamayı göster

Cevap: Implement conditional asset tagging with human-in-the-loop approval gates for tier-0 infrastructure alongside scoped containment actions such as perimeter firewall blocking instead of full interface isolation.

Cevap

Implementing asset-aware conditional logic with human-in-the-loop (HITL) approval gates for critical tier-0 infrastructure and utilizing scoped containment controls best balances operational availability with incident response automation.
The correct answer addresses the root cause of the outage by introducing asset awareness and conditional execution paths into the SOAR playbook logic. For critical infrastructure (such as domain controllers or key database servers), automated full-network isolation poses a greater risk to business continuity than the threat itself. Implementing human-in-the-loop (HITL) approval gates or lower-impact microsegmentation/egress filtering preserves security operations without causing enterprise-wide outages.

Adım Adım Çözüm

1
Analyze the operational vulnerability in the existing automated playbook
The SOAR playbook performs aggressive automated network interface isolation indiscriminately on any host, including critical tier-0 domain controllers.
Automated containment actions must evaluate the operational criticality of the target system to prevent self-inflicted denial-of-service events.
2
Evaluate containment actions based on risk and asset classification
Tier-0 systems require human-in-the-loop approval or non-disruptive scoped containment (e.g., blocking outbound external traffic rather than full port shutdown).
Asset awareness in playbooks ensures that high-impact automated actions are constrained when applied to critical enterprise services.
3
Differentiate effective logic fixes from misconfigured or non-functional options
Changing thresholds increases false positives, reclassifying control metadata does not change execution behavior, and imposing interactive MFA breaks system-to-system API authentication.
Only logic adjustments incorporating asset tags and approval workflow gates properly resolve the operational risk.

Anahtar Kavram

SOAR Playbook Design & Safety Controls
Tahmini Süre:2m 0s
ÖncekiSayfa 63 / 112Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin