Examkin

Tüm alıştırma soruları

2232 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 1321Soru →

A security administrator is establishing a high-availability disaster recovery plan for a mission-critical web application. During an unrecoverable primary data center outage, administrative staff must execute a site failover to the secondary site. Place the following failover operational steps in the correct chronological sequence from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence is: 1) Detect primary site failure and initiate failover, 2) Isolate the primary site to prevent split-brain condition, 3) Promote the secondary database to primary active read-write mode, and 4) Update GSLB DNS records to direct user traffic to the secondary site.
In high-availability and disaster recovery architectures, site failover must follow a strict dependencies-first operational sequence. Detecting failure precedes all administrative actions. Fencing the primary node must occur next to prevent split-brain data corruption caused by simultaneous active nodes. Subsequently, backend state stores (databases) must be promoted to read-write mode before front-end services can handle transactions. Finally, GSLB/DNS redirection is updated to send live client traffic to the secondary location.

Adım Adım Çözüm

1
Identify system status
Automated monitoring flags primary site unavailability and triggers the failover routine.
Monitoring and detection must precede any operational state changes.
2
Enforce fencing and isolation
Primary nodes are isolated to ensure they do not attempt to process writes concurrently.
Fencing prevents split-brain scenarios where both data centers attempt to write to shared or replicated databases simultaneously.
3
Promote secondary data tier
Secondary standby database is converted to primary read-write status.
Application services cannot function correctly until the backend data layer is capable of processing state modifications.
4
Redirect traffic ingress
GSLB endpoints update DNS records to point to the secondary site IP infrastructure.
Traffic routing is updated last to ensure users land on fully configured and operational services.

Anahtar Kavram

Disaster Recovery Failover Sequencing and Split-Brain Prevention
Soru 1322Soru →

A Security Operations Center (SOC) team is designing an automated Security Orchestration, Automation, and Response (SOAR) playbook to mitigate Active Directory Kerberoasting attacks detected by SIEM log correlations. The attack patterns involve rapid requests for Service Principal Name (SPN) tickets across domain accounts. If the SOAR playbook executes unvalidated credential resets across all flagged accounts, critical production services using Group Managed Service Accounts (gMSAs) will experience severe outages. Which of the following playbook logic designs correctly balances automated response speed with operational risk mitigation for Tier-0 identity infrastructure?

Cevabı ve açıklamayı göster

Cevap: Implement conditional branching that parses asset tags and account attributes, automatically enforcing ticket-granting restrictions on standard user accounts while routing service account remediation to a Human-in-the-Loop (HITL) approval queue.

Cevap

The correct playbook logic uses conditional branching based on asset tags and account types, automating containment for standard user accounts while utilizing Human-in-the-Loop (HITL) approvals for critical service accounts.
The option advocating conditional branching combined with Human-in-the-Loop (HITL) approval correctly balances threat containment with business continuity. By distinguishing between standard user accounts and mission-critical Group Managed Service Accounts (gMSAs), the SOAR playbook can rapidly restrict compromised user tickets while preventing catastrophic outages on Tier-0 identity infrastructure.

Adım Adım Çözüm

1
Evaluate operational impact vs automated containment speed
Identified that automated actions on critical service accounts (gMSAs) present severe downtime risks.
SOAR playbooks must account for asset criticality to prevent self-inflicted outages during automated response.
2
Implement conditional logic and enrichment in the SOAR workflow
Branch workflow paths based on account classification (user vs service account).
Enables immediate automated isolation for low-impact user accounts while protecting critical infrastructure.
3
Integrate Human-in-the-Loop (HITL) safeguards
Require manual analyst authorization before executing disruptive changes on service accounts.
Provides a safety check for high-tier assets while preserving overall response orchestration efficiency.

Anahtar Kavram

SOAR Playbook Design and Operational Risk Safeguards
Soru 1323Soru →

A security analyst is preparing to roll out a critical operating system update across an enterprise environment. To minimize operational risk and prevent application incompatibility during deployment, which of the following actions should be performed FIRST?

Cevabı ve açıklamayı göster

Cevap: Test the update in a representative non-production staging environment.

Cevap

Testing the update in a representative non-production staging environment.
Testing patches in a representative staging environment ensures that potential software conflicts, performance issues, or system crashes are identified and resolved before updates are introduced into live operational environments.

Adım Adım Çözüm

1
Identify the primary goal of patch management testing controls.
Recognize that software patches must be validated prior to broad deployment to avoid unexpected downtime.
Unvalidated patches may introduce bugs or break critical dependencies.
2
Determine the appropriate initial environment for patch execution.
Select a isolated staging or sandbox environment that mirrors production configurations.
Staging testing confirms stability and application compatibility safely before production rollout.

Anahtar Kavram

Patch Testing and Staging Environment Validation
Tahmini Süre:1m 0s
Soru 1324Soru →

A Security Operations Center (SOC) team is designing an automated workflow to revoke access tokens across multiple cloud services whenever a credential leak is detected. Which component of a Security Orchestration, Automation, and Response (SOAR) platform executes these predefined, multi-step actions across disparate security tools?

Cevabı ve açıklamayı göster

Cevap: Automated playbooks

Cevap

Automated playbooks execute predefined multi-step actions across disparate security tools within a SOAR platform.
Automated playbooks within a SOAR platform sequence and execute predefined actions—such as calling APIs to revoke tokens or block IP addresses—across integrated platforms without manual intervention.

Adım Adım Çözüm

1
Identify the operational requirement in the scenario.
The scenario describes executing predefined, automated multi-step response actions across multiple cloud services and security systems.
Understanding the need for programmatic action across distinct security tools isolates the core orchestration function.
2
Evaluate the role of SOAR components.
SOAR platforms use playbooks to codify incident response processes into automated workflows.
Playbooks integrate with APIs to automate complex remediation tasks such as revoking tokens or isolating hosts.

Anahtar Kavram

SOAR Automated Playbooks
Soru 1325Soru →

A security administrator needs to apply a critical security update to enterprise web servers. What is the correct sequence of steps the administrator should follow to complete the patch management workflow?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for the patch management process is: 1) Identify and acquire the security patch, 2) Validate and test the patch in a non-production staging environment, 3) Submit a change request for approval by the Change Advisory Board, and 4) Deploy the patch to production servers.
The standard enterprise patch management lifecycle progresses logically from patch discovery and acquisition, to non-production staging validation, followed by formal governance approval from the Change Advisory Board, and concluding with scheduled deployment to production systems.

Adım Adım Çözüm

1
Identify and acquire the security patch from a verified vendor source.
The authentic security update is retrieved and verified.
You must obtain and verify the update before testing or scheduling deployment.
2
Validate and test the security patch in a non-production staging environment.
Patch stability, performance impact, and compatibility are verified.
Staging validation detects software conflicts without jeopardizing live production services.
3
Submit a change request for review and approval by the Change Advisory Board (CAB).
Formal authorization and back-out plans are officially documented and approved.
Enterprise change governance requires technical test evidence before approving live modifications.
4
Deploy the patch to production servers during an authorized maintenance window.
Production systems are updated with minimal disruption to users.
Deployment occurs only after validation and governance requirements are fully satisfied.

Anahtar Kavram

Standard Enterprise Patch Management Lifecycle
Soru 1326Soru →

A security operations analyst is investigating an unauthorized privilege escalation incident on a critical Linux database server. A database administrator checked out temporary, just-in-time (JIT) root access through the enterprise Privileged Access Management (PAM) vault to conduct routine maintenance. Reviewing the target server's local `/var/log/secure` logs alongside the PAM gateway logs reveals the following entries:

[PAM Gateway] 14:02:11 UTC - JIT Session #8942 initiated for User 'db_admin_01' -> Target: db01.corp.internal (SSH proxy port 2222)
[PAM Gateway] 14:02:12 UTC - MFA Challenge SUCCESS (FIDO2 Security Key)
[Target syslog] 14:02:12 UTC - sshd[4102]: Accepted publickey for db_admin_01 from 10.200.15.5 (PAM Proxy) port 48110 ssh2
[Target syslog] 14:15:33 UTC - sshd[4891]: Accepted password for db_admin_01 from 10.200.45.118 (Dev Subnet) port 51204 ssh2
[Target syslog] 14:15:40 UTC - sudo[4910]: db_admin_01 : TTY=pts/2 ; PWD=/tmp ; USER=root ; COMMAND=/usr/bin/chmod +s /bin/bash

Which of the following operational root causes BEST explains why the unauthorized secondary SSH session from 10.200.45.118 was established without going through the PAM gateway's MFA controls?

Cevabı ve açıklamayı göster

Cevap: The local server retained static administrative credentials, allowing direct SSH authentication from unapproved source IPs bypassing proxy-enforced PAM workflow.

Cevap

The target server retained static local administrative credentials, allowing direct SSH password authentication from unapproved IP addresses outside the PAM proxy pathway.
The root cause is that local password authentication remained active and configured with static credentials on the target host. Effective PAM deployments require that direct administrative access routes be locked down so that connections can ONLY originate from the PAM proxy using dynamically rotated or vault-managed credentials. Because static password login remained enabled, an actor possessing the password connected directly from an internal subnet (10.200.45.118), completely bypassing the PAM proxy and its enforced MFA controls.

Adım Adım Çözüm

1
Analyze the log entries from the PAM gateway and target server.
The legitimate session at 14:02:12 UTC connected via the PAM Proxy (10.200.15.5) using public key authentication after FIDO2 MFA. The second session at 14:15:33 UTC connected directly from a developer workstation (10.200.45.118) using password authentication.
Tracing origin IPs and authentication methods reveals how the second connection bypassed the gateway.
2
Evaluate why the PAM vault proxy was bypassed.
PAM solutions enforce MFA and session recording by acting as an inline proxy. If target systems allow direct SSH access via static password credentials rather than restricting access strictly to short-lived SSH keys or proxy IPs, attackers can connect directly.
Identifying the operational flaw in credential management explains the security control failure.
3
Determine the necessary operational remediation.
Disable static local passwords, enforce SSH host key trust strictly with the PAM proxy, or utilize local account password vaulting/rotation to eliminate direct static logins.
Direct authentication paths must be remediated to ensure all administrative access routes through the PAM solution.

Anahtar Kavram

Privileged Access Management (PAM) Operational Hardening and Session Interception
Tahmini Süre:2m 0s
Soru 1327Soru →

During a routine compliance evaluation, a security analyst reviews a credentialed vulnerability scan report for an internal server subnet holding sensitive payment data. The report identifies multiple critical operating system kernel vulnerabilities on the hosts. The network operations team argues that because an inline Intrusion Prevention System (IPS) and a Web Application Firewall (WAF) inspect all incoming traffic, the host-level patch deployment can be indefinitely deferred by relying on these edge defenses. Which of the following recommendations should the security analyst provide to properly address the risk?

Cevabı ve açıklamayı göster

Cevap: Apply the missing operating system patches directly to the hosts during an authorized maintenance window, as network-level controls do not resolve host-based system vulnerabilities.

Cevap

Apply the missing operating system patches directly to the hosts during an authorized maintenance window, as network-level controls do not resolve host-based system vulnerabilities.
Credentialed vulnerability scans inspect the internal system state of hosts to detect unpatched software and missing OS updates directly. Network security controls such as WAFs and IPSs act as perimeter or compensating controls, but they do not alter or fix vulnerable local code. Therefore, applying the operating system patches during a scheduled maintenance window is the only action that fully remediates the vulnerability.

Adım Adım Çözüm

1
Analyze the vulnerability scan type and findings.
The credentialed scan inspected internal system states directly and identified critical operating system kernel vulnerabilities.
Credentialed scans provide accurate, host-internal software flaw visibility regardless of perimeter network devices.
2
Evaluate the proposed mitigation alternative against security engineering principles.
IPS and WAF devices inspect network traffic but do not modify or fix flawed host software binaries.
Network controls are compensating controls that minimize exposure but do not remediate host vulnerabilities.
3
Determine the appropriate remediation path.
Remediate host operating system vulnerabilities directly via patch management during an approved maintenance window.
Host patching permanently eliminates the vulnerability, ensuring compliance and defense-in-depth.

Anahtar Kavram

Credentialed Vulnerability Scanning vs. Perimeter Compensating Controls
Tahmini Süre:2m 0s
Soru 1328Soru →

During a legal discovery phase following a enterprise data breach investigation, opposing counsel challenges the admissibility of a forensic disk image, alleging that unauthorized modifications could have occurred while the evidence was stored in the forensic laboratory safe. Which of the following evidence handling practices provides the primary technical proof to refute this integrity challenge?

Cevabı ve açıklamayı göster

Cevap: Comparing the cryptographic hash value calculated during evidence intake against a newly calculated hash of the stored image

Cevap

Comparing the cryptographic hash value calculated during evidence intake against a newly calculated hash of the stored image provides the definitive proof of data integrity required to defeat court challenges.
Cryptographic hashing (such as SHA-256) is used in digital forensics to verify data integrity. Computing a hash value immediately after evidence acquisition and comparing it against a hash calculated at any later point (such as during trial or discovery) proves that the bit-stream forensic image has not been altered or tampered with during storage.

Adım Adım Çözüm

1
Identify the specific forensic requirement challenged in the scenario
Opposing counsel is questioning evidence integrity (whether data was altered during storage).
Establishing chain of custody and evidence admissibility requires proving data integrity from acquisition through trial.
2
Evaluate technical controls for verifying bit-stream evidence integrity
Cryptographic hashing algorithms (like SHA-256 or MD5) generate a unique fixed-length digest of the entire image.
If even a single bit of the forensic image changes during storage, recalculating the hash will produce a completely different value.
3
Select the option that directly validates that no alteration occurred
Re-hashing the stored image and comparing it to the original hash recorded upon intake proves data integrity.
Matching hashes demonstrate beyond reasonable doubt that the evidence remained identical throughout the storage period.

Anahtar Kavram

Forensic Hash Verification and Integrity Enforcement
Soru 1329Soru →

A security analyst is configuring a Security Orchestration, Automation, and Response (SOAR) playbook to automatically handle alerts triggered when a cloud IAM access key is exposed in a public repository. Arrange the automated response workflow steps into the correct chronological sequence from first step to final step.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct execution sequence begins with event ingestion and log enrichment, followed by automated identity containment (session revocation and policy denial), automated credential remediation (key rotation in secrets manager), and concludes with stakeholder notification and incident documentation.
The standard SOAR playbook lifecycle dictates that alerts must first be enriched with contextual log data. Once scope is established, automated containment actions (revoking sessions and denying API actions) are applied to stop active exposure. Following successful isolation, remediation actions rotate credentials in secret stores, and finally, notification tasks update human analysts and close the automated ticket workflow.

Adım Adım Çözüm

1
Perform initial ingestion and automated context enrichment.
Alert data is parsed and CloudTrail/audit logs are collected to quantify the scope of use of the leaked API key.
Enrichment provides necessary context on key usage before modifying permissions or terminating sessions.
2
Execute identity containment controls.
Active sessions created using the key are revoked and an inline explicit deny policy is bound to the identity.
Containment limits damage by ensuring an attacker cannot continue making authorized API calls.
3
Perform secret rotation and remediation.
A new API key pair is generated and securely injected into the enterprise secrets management vault.
Automated remediation restores operational functionality safely with fresh, secure credentials.
4
Notify stakeholders and close the automation workflow.
The application owner receives summary metrics and audit logs for final verification.
Documentation and communication complete the incident lifecycle within the SOAR framework.

Anahtar Kavram

SOAR Automated Incident Response Lifecycle
Soru 1330Soru →

An enterprise network security engineer evaluates telemetry from a perimeter Network Intrusion Detection System (NIDS) and flow collector monitoring a secure database VLAN. The monitoring system flagged outbound encrypted connections over TCP port 443 originating from internal database server 10.0.4.15 toward an external destination.

AttributeValue / Captured Telemetry
Source IP & Port10.0.4.15 : 49152
Destination IP & Port198.51.100.42 : 443
Flow VolumeBytes Sent: 4,820,100 \Bytes Received: 1,200
TLS Server Name Indication (SNI)update.vendor-cloud-services.com
JA3 TLS Fingerprint7715705b32eef410403f9b223bc6a136 (Known C2 toolkit hash)
Reverse DNS Lookuphost42.unknown-bulletproof-host.net

Based on the network security monitoring data, which of the following represents the most accurate diagnosis of the activity and the appropriate immediate action?

Cevabı ve açıklamayı göster

Cevap: The telemetry indicates domain fronting or SNI spoofing used for data exfiltration to a malicious command-and-control server; the host 10.0.4.15 should be isolated immediately.

Cevap

The telemetry indicates domain fronting or SNI spoofing used for data exfiltration to a malicious command-and-control server; the host 10.0.4.15 should be isolated immediately.
The network security monitoring telemetry presents key indicators of encrypted data exfiltration over TCP port 443. The high volume of outbound bytes (4.8 MB) relative to inbound bytes (1.2 KB), combined with a JA3 fingerprint matching known malicious C2 software and a reverse DNS mismatch against the requested TLS SNI, confirms domain fronting / SNI spoofing. The immediate requirement in incident triage is isolating the host from the network to halt exfiltration.

Adım Adım Çözüm

1
Analyze flow volume telemetry
Identified massive outbound data transfer (4.8 MB sent vs. 1.2 KB received), indicating active data exfiltration rather than standard operational traffic.
High ratio of sent to received data on database servers is a key indicator of compromise.
2
Correlate TLS headers with network intelligence
The TLS Server Name Indication (SNI) claims to be a legitimate vendor service, but the reverse DNS points to an untrusted host, and the JA3 TLS fingerprint matches a known malicious command-and-control (C2) framework.
Discrepancy between SNI hostnames and JA3 fingerprints indicates SNI spoofing or domain fronting techniques used by adversaries to bypass simple domain blocklists.
3
Determine containment priority
Select host containment and network isolation as the immediate incident response action.
Active data exfiltration and C2 activity require immediate containment to stop ongoing data loss before conducting root-cause analysis.

Anahtar Kavram

Network Security Monitoring & TLS Egress Anomaly Detection
Soru 1331Soru →

An organization is updating a SOAR playbook to mitigate compromised API access keys linked to high-availability microservices. To prevent accidental operational outages on mission-critical services while maintaining rapid incident containment and enrichment, which TWO of the following playbook configurations should be implemented?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Incorporate a human-in-the-loop manual approval step before executing automated account or access suspension against critical production infrastructure.; Execute temporary API session token revocation while simultaneously querying threat intelligence connectors for context enrichment.

Cevap

The playbook should require human-in-the-loop approval before suspending critical production assets and perform targeted API session token revocation paired with threat intelligence enrichment.
Integrating a human-in-the-loop authorization gate before modifying critical production assets prevents automated outages. Concurrently, revoking active API session tokens and gathering threat intelligence achieves rapid, focused containment while preserving surrounding microservice availability.

Adım Adım Çözüm

1
Evaluate the risk of automated containment actions against mission-critical infrastructure.
Unconditional automated isolation of critical production services presents an unacceptably high risk of self-inflicted downtime.
Human-in-the-loop (HITL) approval gates ensure human authorization before destructive containment steps execute against core services.
2
Select targeted containment mechanisms with low operational blast radius.
Revoking specific API session tokens disrupts adversary access without impacting underlying host OS or service availability.
Token revocation neutralizes compromised credential misuse quickly while automated threat intelligence feeds provide context to SOC analysts.

Anahtar Kavram

SOAR Playbook Logic, Operational Risk Mitigation, and Targeted Response
Tahmini Süre:2m 0s
Soru 1332Soru →

An enterprise logistics company maintains a legacy asset-tracking application running on an unpatchable operating system. Completely replacing the application would cost $1.5 million and cause severe operational downtime. To address the threat of potential exploitation, the security team deploys an inline intrusion prevention system (IPS) and isolates the host within a dedicated virtual local area network (VLAN) guarded by strict firewall rules. Which of the following risk response strategies did the organization execute?

Cevabı ve açıklamayı göster

Cevap: Risk mitigation

Cevap

Risk mitigation
Risk mitigation (also known as risk reduction) involves implementing administrative, physical, or technical security controls to diminish the likelihood or impact of a risk. Installing an intrusion prevention system (IPS) and configuring network microsegmentation actively reduce the probability of exploitation without discontinuing the legacy server.

Adım Adım Çözüm

1
Analyze the scenario requirements and operational context
The organization cannot retire the system (avoidance) or accept the unmitigated vulnerability (acceptance), but needs to continue using the application safely.
Identifying business constraints clarifies why simple removal or passive tolerance is insufficient.
2
Evaluate the specific controls implemented by the security team
Deploying an inline IPS and configuring network isolation reduce threat likelihood and limit attack blast radius.
Technical controls that reduce vulnerability likelihood or impact fall under risk reduction/mitigation.
3
Match the implemented action to the formal risk response definition
Applying technical safeguards to decrease residual risk constitutes risk mitigation.
Risk mitigation actively lowers risk metrics without transferring liability or terminating the underlying process.

Anahtar Kavram

Risk Response Strategies
Tahmini Süre:1m 15s
Soru 1333Soru →

During network security monitoring of a segmented cloud environment, an analyst receives an automated Network Intrusion Detection System (NIDS) alert indicating that an internal deception host (honeypot) has initiated outbound network connections toward an unknown external address. A team member suggests modifying network routing policies to use this honeypot host as an inline security filter for all outbound enterprise traffic to block unauthorized connections. Which of the following best explains why this recommendation represents a fundamental misunderstanding of network monitoring and deception controls?

Cevabı ve açıklamayı göster

Cevap: Honeypots are designed purely as threat intelligence and detective monitoring tools, not inline preventive traffic-filtering mechanisms.

Cevap

Honeypots are designed purely as threat intelligence and detective monitoring tools, not inline preventive traffic-filtering mechanisms.
Deception technologies, such as honeypots, are specialized detective security controls placed in network environments to lure attackers, detect unauthorized access attempts, and capture threat intelligence. Because any traffic interacting with a honeypot is inherently suspicious, these assets are strictly isolated and monitored passively. They are not production gateways or inline filtering systems, and routing legitimate enterprise network traffic through them introduces severe security risks and operational degradation.

Adım Adım Çözüm

1
Analyze the role of the security asset identified in the alert.
The target asset is a honeypot (deception technology) within a monitored network segment.
Honeypots have no legitimate production duties and exist strictly to detect, trap, and monitor unauthorized interactions.
2
Evaluate the proposed operational change.
Routing production outbound traffic through a honeypot treats a detective deception control as an inline preventive firewall.
Honeypots are not hardened or designed to function as high-throughput inline filtering gateways for production environments.
3
Select the option that correctly contrasts deception controls with inline filtering.
The correct response highlights that honeypots function as detective and intelligence-gathering tools rather than inline filtering appliances.
Proper security architecture distinguishes passive detective monitoring tools from active preventive traffic-filtering controls.

Anahtar Kavram

Honeypot Functionality vs. Inline Defense Controls
Tahmini Süre:1m 30s
Soru 1334Soru →

A security analyst is conducting a qualitative risk assessment for a critical internal web application. Which of the following core factors are primarily evaluated to determine the overall qualitative risk score? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The likelihood of a threat actor exploiting an application vulnerability; The operational and organizational impact if a threat event occurs

Cevap

The core factors evaluated during a qualitative risk assessment are the likelihood of a threat exploiting a vulnerability and the potential operational impact of that event.
Qualitative risk assessments determine overall risk severity by analyzing two primary variables: the likelihood (probability) that a vulnerability will be exploited and the impact (severity) of the resulting damage to the organization.

Adım Adım Çözüm

1
Identify the primary parameters used in qualitative risk rating scales.
Qualitative risk analysis assigns subjective categories (such as High, Medium, Low) based on Likelihood and Impact.
Risk is fundamentally calculated as a function of the probability of an incident (Likelihood) and the resulting damage (Impact).
2
Differentiate qualitative factors from quantitative metrics and specific defensive controls.
Exact financial calculations like Single Loss Expectancy (SLE) belong to quantitative risk assessments, while honeypots represent specialized security controls.
Qualitative metrics intentionally avoid precise financial figures and specific operational control parameters.

Anahtar Kavram

Qualitative Risk Assessment Factors (Likelihood vs. Impact)
Soru 1335Soru →

A cybersecurity analyst is configuring an automated incident response playbook within a Security Orchestration, Automation, and Response (SOAR) platform to process high-severity credential dumping alerts triggered by Endpoint Detection and Response (EDR) agents. To effectively contain potential lateral movement without introducing catastrophic operational downtime to enterprise operations, which of the following playbook logic designs should be implemented?

Cevabı ve açıklamayı göster

Cevap: Apply automated host isolation to standard workstation alerts while routing alerts involving Tier-0 infrastructure, such as domain controllers, to a Human-in-the-Loop (HITL) manual approval gate before containment.

Cevap

Implement conditional branching that executes automated network isolation on standard endpoints while enforcing a Human-in-the-Loop (HITL) manual authorization step for critical Tier-0 infrastructure.
The correct option correctly implements conditional branching and Human-in-the-Loop (HITL) governance in SOAR workflows. Isolating standard endpoints immediately limits credential abuse and lateral movement, whereas requiring analyst verification for Tier-0 assets (like domain controllers) mitigates the risk of automated service denial across the enterprise.

Adım Adım Çözüm

1
Analyze the impact of automated SOAR containment actions on enterprise assets.
Unchecked automated isolation of Tier-0 systems like domain controllers can cause widespread outages and operational disruption.
SOAR playbooks must balance velocity of response with risk management.
2
Design conditional logic within the SOAR workflow.
Standard endpoints receive immediate automated containment to halt lateral movement, while critical servers trigger an analyst notification for manual intervention.
Human-in-the-Loop (HITL) approval prevents false-positive automated outages on key systems.

Anahtar Kavram

SOAR Playbook Logic and Operational Risk Management
Soru 1336Soru →

An organization is designing an automated identity lifecycle architecture to synchronize user identity state between its cloud-based HR system and its central Identity Provider (IdP). Which of the following requirements must be implemented within this architecture to support secure automated user provisioning and real-time deprovisioning? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Implementation of standardized System for Cross-domain Identity Management (SCIM) service endpoints to automate identity schema operations between systems.; Deployment of centralized session revocation mechanisms to invalidate active tokens and application access upon user status change signals.

Cevap

Standardized System for Cross-domain Identity Management (SCIM) endpoints must be implemented for automated identity schema operations, along with centralized session revocation mechanisms to invalidate active application tokens upon deprovisioning.
Automating identity provisioning between HR platforms and centralized Identity Providers requires SCIM service endpoints to standardize user schema updates and deprovisioning calls across multi-tenant applications. Furthermore, to prevent unauthorized access via active sessions after account suspension, the architecture must incorporate centralized token and session revocation capabilities across all downstream relying parties.

Adım Adım Çözüm

1
Analyze identity lifecycle architecture requirements for cloud HR to IdP integration.
Identified the requirement for automated, standardized provisioning and deprovisioning protocols.
SCIM is the industry standard protocol built explicitly for exchange of user identity information across independent domains.
2
Evaluate deprovisioning security controls to prevent orphaned account exploitation.
Determined that session revocation mechanisms must propagate status changes immediately.
Deprovisioning an account in the IdP is insufficient if active OAuth tokens or SAML sessions remain valid on target applications.
3
Distinguish correct architectural solutions from misconfigurations and conceptual errors.
Selected SCIM and session revocation while eliminating perimeter-only defenses and authentication/authorization confusion.
Perimeter firewalls do not protect cloud-hosted resources, and credential prompts handle identity verification rather than authorization rights.

Anahtar Kavram

Automated Identity Lifecycle & Provisioning Architecture
Tahmini Süre:1m 30s
Soru 1337Soru →

A security analyst is setting up an automated Security Orchestration, Automation, and Response (SOAR) playbook to streamline initial response tasks when a suspicious email attachment is reported. Which of the following tasks are most appropriate for full automation without requiring human-in-the-loop approval? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Submitting the suspicious attachment hash to external threat intelligence feeds for automated reputation scoring; Isolating the affected recipient workstation from the internal network using integrated endpoint protection tools

Cevap

The actions appropriate for full automation are querying external threat intelligence feeds for hash reputation scoring and isolating the recipient workstation via endpoint security controls.
Automating reputation lookups with threat intelligence feeds allows rapid risk assessment without operational risk. Similarly, isolating a single workstation prevents lateral movement of suspected fileless or payload-based malware while keeping containment tightly targeted.

Adım Adım Çözüm

1
Identify non-disruptive enrichment workflows suitable for SOAR playbooks.
Automated hash reputation lookup against threat intelligence sources enriches alert telemetry safely.
Enrichment tasks are read-only and do not affect business operations.
2
Identify targeted containment controls for individual endpoint protection.
Host isolation via Endpoint Detection and Response (EDR) limits lateral threat movement.
Host isolation protects the broader network while targeting only the potentially compromised machine.

Anahtar Kavram

SOAR Playbook Automation and Enrichment
Tahmini Süre:1m 0s
Soru 1338Soru →

An incident response team is responding to a confirmed security incident involving unauthorized API key usage and data exfiltration from an enterprise cloud storage bucket. Place the following incident response actions in the correct sequential order from first step to last step according to standard incident response playbooks.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence follows the standard NIST incident response framework: Detection & Analysis (analyzing audit logs to scope the incident), Containment (revoking access keys and locking down storage access), Eradication & Recovery (deleting backdoor IAM roles and restoring secure baseline permissions), and Post-Incident Activity (holding a lessons-learned retrospective and updating playbooks).
The standard incident response process flows sequentially through four main phases: Detection & Analysis, Containment, Eradication & Recovery, and Post-Incident Activity. First, analyzing audit logs establishes incident scope (Detection & Analysis). Second, revoking compromised access keys halts ongoing exfiltration (Containment). Third, deleting unauthorized backdoor roles and restoring baseline permissions removes threat persistence and restores secure operations (Eradication & Recovery). Finally, conducting a post-incident retrospective documents lessons learned (Post-Incident Activity).

Adım Adım Çözüm

1
Perform Detection & Analysis
Validate the security event and establish the full scope of compromised cloud resources using audit log analysis.
Before executing containment, responder actions must be guided by verified scope and threat intelligence.
2
Execute Containment strategy
Disable compromised access credentials and restrict bucket access policies to prevent further data loss.
Containment limits damage and prevents the adversary from continuing unauthorized data exfiltration.
3
Perform Eradication & Recovery
Purge any secondary backdoor roles installed by the attacker and return cloud environment permissions to a verified clean state.
Eradication removes all mechanisms of adversary persistence, while recovery restores systems to normal production status.
4
Conduct Post-Incident Activity
Document timeline, evaluate incident response performance, and update playbooks to improve future defense capabilities.
Lessons learned activities occur post-remediation to prevent recurrence and enhance operational readiness.

Anahtar Kavram

NIST Incident Response Lifecycle Phases
Soru 1339Soru →

A Security Operations Center (SOC) analyst receives an Endpoint Detection and Response (EDR) telemetry alert indicating a malicious DLL side-loading attempt on an enterprise domain controller. Arrange the standard EDR incident response steps in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of actions is: 1) Detect and flag the behavioral anomaly via EDR telemetry, 2) Apply host-level network isolation, 3) Collect volatile memory snapshots and execution logs, and 4) Terminate malicious processes, remove persistence keys, and restore network connectivity.
The correct order follows the standard incident containment life cycle: telemetry detection identifies the threat, host isolation immediately contains lateral movement while maintaining EDR management channels, forensic collection gathers volatile evidence safely, and remediation cleans the system before network restoration.

Adım Adım Çözüm

1
Identify threat activity using EDR behavioral monitoring telemetry
Alert generated for unauthorized process execution and side-loading
Detection provides the necessary diagnostic context to initiate incident response.
2
Isolate the endpoint using host-level network containment
Host is logically disconnected from the network while preserving EDR control
Containing the host mitigates lateral spread and C2 communication immediately.
3
Gather forensic artifacts and volatile memory captures via EDR console
Volatile evidence is preserved without risking network exposure
Collecting triage data while isolated ensures evidence is captured prior to system modification.
4
Remediate threat artifacts and lift host network isolation
Rogue processes killed, persistence removed, and endpoint restored to normal operations
Remediation and un-isolation conclude the active containment and response lifecycle.

Anahtar Kavram

EDR automated containment and forensic investigation workflow
Tahmini Süre:1m 30s
Soru 1340Soru →

A network administrator needs to monitor enterprise traffic volumes, protocol distributions, and IP communication pairs across internal routers without inspecting or storing packet payloads. Which of the following monitoring mechanisms should the administrator implement?

Cevabı ve açıklamayı göster

Cevap: NetFlow flow telemetry collection

Cevap

NetFlow flow telemetry collection is the correct mechanism because it captures network session metadata (source/destination IPs, ports, and transfer sizes) across network devices without storing full packet payloads.
NetFlow flow telemetry collection gathers lightweight session metadata—including source and destination IP addresses, ports, protocol types, and byte counts—from network devices. It allows security analysts to observe network traffic statistics across the enterprise without the overhead of full packet payload capture.

Adım Adım Çözüm

1
Identify the core requirement from the scenario.
The requirement is to track network traffic volume, protocols, and IP communication pairs across routers without storing packet payloads.
Understanding the monitoring requirements narrows down full packet capture versus flow-based telemetry mechanisms.
2
Evaluate the capabilities of network flow technologies.
NetFlow/IPFIX aggregates traffic metadata (headers, byte counts, session durations) at router interfaces without payload recording.
Flow data provides high-level visibility across broad network infrastructure with minimal storage overhead.

Anahtar Kavram

Network Flow Monitoring (NetFlow/IPFIX)
Tahmini Süre:45s
ÖncekiSayfa 67 / 112Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin