Tüm alıştırma soruları

Soru 121Soru →

Match each observed network or wireless attack indicator on the left with its corresponding attack classification on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Rogue access point mimicking SSID matches Evil Twin; RF signal noise causing connectivity loss matches RF Jamming; Spoofed 802.11 management frames match Deauthentication Attack; Unsolicited Layer 2 responses matching gateway IP to unauthorized MAC matches ARP Poisoning.

Each indicator matches its respective attack mechanism directly: broadcasting a duplicate enterprise SSID represents an Evil Twin; physical RF spectrum noise represents RF Jamming; sending disassociation management packets represents a Deauthentication attack; and distributing forged IP-to-MAC mappings represents ARP Poisoning.

Adım Adım Çözüm

1

Analyze each network or wireless attack indicator in the left column.

Identify key characteristics: SSID spoofing, physical radio interference, 802.11 disassociation/deauthentication frames, and unsolicited MAC-to-IP cache updates.

Matching indicators requires recognizing the fundamental technical mechanism associated with each threat.

2

Pair each indicator with its respective threat classification.

Correlate rogue SSID broadcasting to Evil Twin, RF noise to RF Jamming, disconnect frames to Deauthentication, and ARP cache corruption to ARP Poisoning.

Each security threat leaves distinct Layer 1, Layer 2, or Layer 3 artifacts.

Anahtar Kavram

Network and Wireless Attack Indicators

Soru 122Soru →

A security analyst is reviewing the security architecture for a hybrid cloud deployment containing both virtual machines and containerized applications. Match each security mechanism on the left with its primary isolation property on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Kernel Namespaces match process-level visibility segregation within a shared OS kernel. Control Groups (cgroups) match restricting hardware resource consumption. Type 1 Hypervisor matches abstracting physical hardware for strong VM isolation. Microsegmentation matches enforcing granular network traffic control and boundaries.

Kernel namespaces isolate what processes can see (PIDs, network adapters, filesystems). Control groups (cgroups) control how much host hardware resources a container can use. Type 1 hypervisors run directly on hardware to deliver rigid virtual machine isolation. Microsegmentation creates micro-perimeters around workloads to control east-west network traffic.

Adım Adım Çözüm

1

Analyze container OS kernel isolation constructs.

Linux kernel namespaces isolate process visibility (e.g., PID space, mount points), while control groups (cgroups) govern resource usage constraints like CPU and memory limits.

Distinguishing between resource visibility isolation and resource consumption limiting is fundamental to container host hardening.

2

Evaluate hypervisor virtual machine abstraction capabilities.

A Type 1 bare-metal hypervisor mediates guest operating system interactions directly on hardware, creating strong isolation boundaries that prevent inter-VM compromises.

Virtual machines run discrete guest kernels, providing stronger containment than shared-kernel container architectures.

3

Identify network security mechanisms for virtualized environments.

Microsegmentation implements policy-driven network access controls around individual microservices or VMs to restrict east-west lateral traffic.

Network-level isolation complements host-level container and hypervisor execution boundaries.

Anahtar Kavram

Virtualization and Container Isolation Mechanisms

Soru 123Soru →

Match each observed security incident technical indicator on the left with its corresponding malware classification on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

The scheduled task creating persistent access matches Trojan; kernel memory manipulation to hide processes matches Rootkit; automated port 445 network propagation matches Worm; and environmental trigger execution matches Logic Bomb.

Each indicator aligns with a distinct technical behavior: kernel cloaking via DKOM signifies a Rootkit; autonomous network scanning and SMB exploitation signifies a Worm; pre-configured conditional triggering signifies a Logic Bomb; and hidden persistence via routine operating system utilities signifies a Trojan.

Adım Adım Çözüm

1

Analyze item 1 regarding scheduled task obfuscated scripts creating unauthorized accounts.

Identified as a Trojan.

Trojans masquerade as or leverage legitimate functionality to secretly introduce unauthorized capabilities.

2

Analyze item 2 regarding Direct Kernel Object Manipulation (DKOM).

Identified as a Rootkit.

Rootkits operate at kernel privilege levels to alter system structures and mask processes.

3

Analyze item 3 regarding port 445 scanning and self-replication.

Identified as a Worm.

Worms propagate autonomously across network vulnerabilities without requiring user action.

4

Analyze item 4 regarding execution dependent on database record thresholds.

Identified as a Logic Bomb.

Logic bombs trigger malicious execution based on specific operational or logical events.

Anahtar Kavram

Distinguishing technical indicators of compromise across fundamental malware classifications.

Soru 124Soru →

An enterprise security architect is refining the workload protection matrix for a multi-tenant cloud environment hosting both legacy virtualized infrastructure and microservice containers. Match each virtualization or containerization security control on the left to its corresponding isolation property or policy enforcement mechanism on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Control Groups (cgroups) matches with enforcing resource utilization quotas; Linux Namespaces matches with providing segregated operational views of system resources; Type-1 Hypervisor Isolation matches with providing dedicated hardware-enforced abstraction directly on physical host processors; CNI Microsegmentation matches with implementing granular packet filtering rules at the virtual network layer.

Each security control aligns directly with its primary system level: cgroups manage hardware resource quotas (CPU/RAM/IO), namespaces isolate kernel object visibility (PID/NET/MNT), Type-1 hypervisors manage bare-metal hardware abstraction for full VM execution isolation, and CNI microsegmentation manages granular software-defined network traffic controls across pods.

Adım Adım Çözüm

1

Analyze resource governing mechanisms for OS-level virtualization.

Control Groups (cgroups) strictly manage resource boundaries such as CPU limits, memory quotas, and block I/O rates to stop noisy-neighbor resource exhaustion.

cgroups provide hardware resource allocation control rather than structural visibility isolation.

2

Evaluate process and environment isolation primitives in container engines.

Linux Namespaces provide discrete visibility domains (PID, NET, IPC, MNT, UTS, USER) preventing one container from inspecting or interacting with system objects of another.

Namespaces abstract what a process can see rather than limiting how much CPU or RAM it consumes.

3

Examine hypervisor architectural models and hardware separation boundaries.

Type-1 (bare-metal) hypervisors run directly on underlying physical hardware host chips to enforce VM memory and CPU execution isolation without depending on a general-purpose host OS.

This establishes hardware ring isolation distinct from container kernel-sharing.

4

Determine modern network isolation methods within container orchestration systems.

CNI Microsegmentation utilizes eBPF or iptables at the virtual interface layer to enforce Zero Trust security rules on East-West traffic between container endpoints.

Microsegmentation protects pod-to-pod network pathways rather than host compute resources.

Anahtar Kavram

Virtualization and Containerization Security Mechanisms

Soru 125Soru →

Match each storage security mechanism or state to its corresponding enterprise data protection objective.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Data Masking pairs with replacing sensitive dataset values with realistic structural proxies for development environments; Data in Transit Protection pairs with securing data traversing network links between host servers and storage arrays using TLS or IPSec; Cryptographic Erasure pairs with sanitizing retired media by destroying encryption keys; SAN Isolation pairs with restricting logical storage volume access using Fibre Channel zoning and LUN masking.

The correct matches align each security mechanism with its explicit implementation objective: Data Masking replaces sensitive values for test environments; Data in Transit Protection encrypts network pathways between hosts and arrays using protocols like TLS/IPSec; Cryptographic Erasure sanitizes media by destroying encryption keys; SAN Isolation isolates storage volumes to authorized host systems using LUN masking and Fibre Channel zoning.

Adım Adım Çözüm

1

Analyze each storage security concept listed on the left.

Identified four key concepts: Data Masking (obfuscation), Data in Transit Protection (network transport security), Cryptographic Erasure (media sanitization), and SAN Isolation (storage network access control).

Understanding the core functional domain of each storage security control is required to pair it correctly.

2

Correlate each control with its technical implementation objective listed on the right.

Data Masking correlates to proxy values for testing; Data in Transit to TLS/IPSec network encryption; Cryptographic Erasure to key destruction; SAN Isolation to Fibre Channel zoning and LUN masking.

These associations accurately reflect standard enterprise storage security architecture practices.

Anahtar Kavram

Data Protection and Storage Security Architecture Controls

Soru 126Soru →

An enterprise systems administrator is performing a security posture review of host operating systems, network services, and infrastructure hardware. Match each host, network, or architecture vulnerability to its corresponding primary risk or operational impact.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Resource Exhaustion via Memory Leak matches with RAM continuously allocated without release causing instability; Unsupported/EOL Host System matches with security patches no longer provided by the vendor; Unnecessary Open Ports matches with active listening daemons running without requirement broadening attack surface; Out-of-Band Controller Misconfiguration matches with default credentials and unencrypted protocols enabled on hardware interfaces.

Each vulnerability directly pairs with its core operational impact: memory leaks exhaust host system memory; end-of-life status deprives systems of vendor updates; unnecessary listening ports expand the host attack surface; and out-of-band management misconfigurations expose hardware interfaces through weak access controls.

Adım Adım Çözüm

1

Analyze host resource management failure indicators.

Identify that progressive, unreleased RAM usage leading to application crash defines a memory leak resource exhaustion condition.

Software that fails to clean up allocated memory consumes finite system memory pools over time.

2

Evaluate lifecycle security risks for legacy host operating systems.

Determine that end-of-life systems lack vendor patch support, leaving exposed flaws unmitigated.

When software reaches end-of-life status, vendor engineering teams cease issuing security advisories and security updates.

3

Examine host attack surface management concepts.

Recognize that running unnecessary services leaves open ports active, expanding host exposure.

Disabling unused services and closing unneeded ports is a fundamental host-hardening practice to minimize entry vectors.

4

Assess hardware infrastructure management vulnerabilities.

Associate out-of-band management controllers with default credential and unencrypted access weaknesses.

Baseboard management controllers operate independently of host operating systems and require strict access controls.

Anahtar Kavram

Host, Network, and Architecture Vulnerabilities

Tahmini Süre:1m 30s

Soru 127Soru →

To enforce defense-in-depth across a multi-tenant cloud infrastructure hosting both virtual machines and container workloads, a platform security engineer must align security mechanisms with their specific operational boundaries. Match each virtualization or containerization technology on the left with its primary isolation boundary or resource control capability on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Linux Namespaces matches with partitioning system resources; Control Groups (cgroups) matches with limiting hardware consumption; Type-1 Bare-Metal Hypervisor matches with enforcing hardware-assisted ring isolation between guest OS instances; and Kernel-level Security Modules matches with restricting process privileges via Mandatory Access Control profiles.

Each technology provides a specific layer of defense-in-depth: Linux Namespaces partition system resource visibility (PIDs, network interfaces, mount points); Control Groups (cgroups) govern hardware resource consumption limits (CPU, memory, I/O rates); Type-1 Bare-Metal Hypervisors manage guest virtual machines via hardware-assisted execution boundaries; and Kernel-level Security Modules enforce Mandatory Access Control policies to restrict process capabilities and syscall access on the shared host kernel.

Adım Adım Çözüm

1

Analyze Linux Namespaces functionality

Namespaces control process visibility of system abstractions such as process IDs, network interfaces, and file system mounts.

Namespaces determine what an isolated containerized process can see.

2

Analyze Control Groups (cgroups) functionality

cgroups enforce resource allocations and ceilings for CPU usage, memory allocation, and I/O rates.

cgroups determine what host resources an isolated process can consume.

3

Analyze Type-1 Bare-Metal Hypervisor isolation

Bare-metal hypervisors run directly on hardware and enforce strict hardware-level memory and CPU Ring-0 isolation between guest kernels.

Hypervisors provide hardware-assisted virtualization boundaries between fully independent operating systems.

4

Analyze Kernel-level Security Modules (AppArmor/SELinux)

Security modules restrict syscall privileges and file path operations using Mandatory Access Control rules.

MAC profiles restrict container capabilities at runtime, preventing container escapes from accessing sensitive host system resources.

Anahtar Kavram

Containerization vs. Virtualization Isolation Architecture

Tahmini Süre:2m 0s

Soru 128Soru →

Match each observed technical indicator from packet captures and system logs to its corresponding network or wireless attack classification.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

VLAN double tagging frames correspond to VLAN Hopping; unauthorized gateway options in DHCP responses correspond to a Rogue DHCP Server Attack; unauthorized OBEX data extraction over Bluetooth corresponds to Bluesnarfing; anomalous ISO 14443 timing delays correspond to an RFID/NFC Relay Attack.

Each indicator uniquely aligns with its attack mechanism: nested 802.1Q headers represent Double Tagging VLAN Hopping; rogue default gateway assignments via DHCP Option 3 represent Rogue DHCP deployment; unauthorized data exfiltration via Bluetooth OBEX represents Bluesnarfing; and timing anomalies in ISO 14443 smart card authentication indicate an RFID/NFC Relay Attack.

Adım Adım Çözüm

1

Analyze frame encapsulation logs for 802.1Q tags.

Multiple nested 802.1Q VLAN headers sent from an access port demonstrate an exploitation of switch native VLAN tag stripping, which is characteristic of double tagging VLAN hopping.

Switches strip the outer native VLAN tag and forward the frame with the inner tag to another targeted VLAN without validating access rules.

2

Examine DHCP protocol interaction logs.

Unauthorized answers offering network configuration parameters (Option 3 for Default Gateway) point to a Rogue DHCP Server.

Attackers place rogue DHCP servers on a segment to redirect default gateway traffic to an attacker-controlled address for man-in-the-middle operations.

3

Evaluate wireless short-range data exchange protocol logs.

Unsolicited access using OBEX Push profile to download internal device memory (contacts) characterizes Bluesnarfing.

Bluesnarfing targets Bluetooth vulnerabilities to steal confidential information, unlike Bluejacking which only transmits unwanted messages.

4

Inspect physical security proximity credential timing logs.

Propagation delays during ISO 14443 contactless smart card challenge-responses signal an intermediary proxying the signal, defining a Relay Attack.

Relay attacks transmit contactless RFID/NFC RF signals over secondary channels, introducing measurable latency into proximity validation protocols.

Anahtar Kavram

Network and Wireless Attack Indicators

Tahmini Süre:2m 0s

Soru 129Soru →

Match each storage security and data protection mechanism to its primary enterprise operational control function.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

LUN Masking matches restricting storage volume access by host HBA ports; Hardware Security Module matches dedicated hardware key management; Endpoint Data Loss Prevention matches monitoring and blocking unauthorized file transfers to local external storage; Tokenization matches replacing sensitive data fields with non-sensitive surrogate values.

Each security solution fulfills a distinct storage architecture requirement: LUN Masking isolates SAN volumes per host HBA, HSMs secure root cryptographic keys within dedicated hardware, Endpoint DLP enforces egress data policies on client endpoints, and Tokenization replaces sensitive data elements with non-cryptographic tokens.

Adım Adım Çözüm

1

Analyze SAN block storage isolation mechanisms.

Identify LUN Masking as the storage architecture technique used to restrict volume visibility to authorized host HBAs.

Storage Area Networks require logical partitioning so servers only see assigned storage blocks.

2

Evaluate key protection architectures.

Map dedicated physical hardware appliances for root keys to Hardware Security Modules (HSMs).

HSMs offer hardened cryptographic boundaries separate from general application software.

3

Differentiate endpoint data protection controls from backend data obfuscation.

Assign file exfiltration blocking on host nodes to Endpoint DLP, and database field surrogate substitution to Tokenization.

DLP inspects user data transport actions, while tokenization alters data storage representations.

Anahtar Kavram

Enterprise Data Protection and Storage Architecture Controls

Soru 130Soru →

A security technician is setting up a Security Information and Event Management (SIEM) log processing pipeline. Match each SIEM log management phase to its corresponding core function.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Parsing matches extracting key data fields; Normalization matches mapping attributes into a single standardized schema; Correlation matches linking related log events across sources; Aggregation matches combining repetitive identical event records.

Each SIEM log processing stage performs a distinct function: Parsing extracts structured data fields from raw logs; Normalization maps extracted data to a standardized schema; Correlation connects multiple event streams using logic rules to detect security incidents; and Aggregation deduplicates log volume.

Adım Adım Çözüm

1

Identify the data extraction phase

Parsing separates unstructured log lines into discrete elements like IP addresses and event IDs.

SIEM parsers read raw log strings and extract structured fields.

2

Identify the standardization phase

Normalization translates varying field names from different vendors into a unified schema.

Consistent naming conventions enable effective cross-platform querying.

3

Identify the event analysis and rule evaluation phase

Correlation connects separate events over time to detect multi-stage attacks.

Correlation engines combine data streams from multiple sensors to trigger security alerts.

4

Identify the deduplication and volume reduction phase

Aggregation consolidates identical entries into a single summary record.

Grouping duplicate logs saves bandwidth and storage while reducing noise.

Anahtar Kavram

SIEM Log Processing Pipeline

Soru 131Soru →

A security architect is updating an enterprise data protection framework to address regulatory compliance and storage security requirements across cloud and on-premises infrastructure. Match each data protection technology to the enterprise operational requirement it primarily fulfills.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Hardware Security Module (HSM) matches dedicated cryptographic key protection in tamper-resistant hardware; Format-Preserving Tokenization matches substituting sensitive values with formatted surrogates; SAN LUN Masking matches isolating storage volumes by Host Bus Adapter (HBA) WWNs; and DLP Document Fingerprinting matches identifying sensitive unstructured file exfiltration using content hashes.

Each pair correctly matches a key storage and data protection architecture technology to its operational role. HSM provides physical and logical protection for master keys; format-preserving tokenization protects sensitive payloads while avoiding application breaking changes; SAN LUN masking enforces volume access boundaries; and DLP document fingerprinting protects unstructured IP exfiltration.

Adım Adım Çözüm

1

Analyze key management requirements

Identify that dedicated, tamper-resistant cryptographic hardware isolation maps to a Hardware Security Module (HSM).

HSMs provide specialized cryptographic protection for root and master keys.

2

Evaluate data masking and schema preservation needs

Identify that substituting sensitive fields with surrogate values while maintaining string structure maps to Format-Preserving Tokenization.

Tokenization replaces sensitive values while format-preserving techniques maintain field length and validation syntax.

3

Examine SAN access control mechanisms

Identify that restricting LUN visibility using World Wide Names (WWNs) at the storage target maps to SAN LUN Masking.

LUN masking prevents unauthorized servers on the SAN fabric from seeing or mounting storage volumes allocated to other hosts.

4

Examine egress monitoring technologies

Identify that matching unstructured document content against stored cryptographic signatures maps to DLP Document Fingerprinting.

Fingerprinting enables Data Loss Prevention solutions to track proprietary file forms and exact text patterns during transfer.

Anahtar Kavram

Enterprise storage security controls must align specific architectural mechanisms—such as hardware key protection, storage volume isolation, data tokenization, and DLP content inspection—with distinct threat models and operational constraints.

Soru 132Soru →

Match each virtualization and containerization security mechanism on the left with its primary operational function on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Type 1 Hypervisor pairs with bare-metal hardware virtual machine management; Linux Namespaces pairs with process visibility isolation; Control Groups (cgroups) pairs with resource allocation restrictions; Container Microsegmentation pairs with granular container network traffic policy enforcement.

Each security mechanism is accurately matched to its design purpose: Type 1 Hypervisors manage bare-metal VM isolation, Linux Namespaces restrict container visibility, Control Groups enforce resource limits, and Microsegmentation secures container-to-container network communication.

Adım Adım Çözüm

1

Differentiate between hypervisor virtualization and container OS-level isolation.

Identify Type 1 Hypervisor as bare-metal hardware abstraction for VMs.

Bare-metal hypervisors manage virtual machines directly on hardware without relying on a general-purpose host OS.

2

Distinguish between Linux kernel features used for container isolation.

Associate Linux Namespaces with resource visibility and Control Groups (cgroups) with resource limitations.

Namespaces control what a container can see (PIDs, mounts, networking), while cgroups control how much compute capacity a container can consume.

3

Identify network-layer isolation specific to microservice environments.

Link Container Microsegmentation to fine-grained network access controls.

Microsegmentation prevents unauthorized lateral movement by isolating network flows between specific workloads.

Anahtar Kavram

Virtualization and Container Isolation Controls

Soru 133Soru →

An enterprise security architect is establishing operational boundaries across a multi-cloud enterprise ecosystem. Match each cloud security implementation task on the left with the corresponding cloud service model on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Task 1 matches Function as a Service (FaaS) / Serverless; Task 2 matches Infrastructure as a Service (IaaS); Task 3 matches Software as a Service (SaaS); Task 4 matches Platform as a Service (PaaS).

Each cloud service model defines a specific division of responsibilities under the Shared Responsibility Model: IaaS delegates OS, virtual network, and storage controls to the customer; PaaS delegates application runtime and database configuration to the customer while automating OS management; SaaS limits customer responsibility to data access and identity management; FaaS abstracts all infrastructure and server runtimes, focusing strictly on stateless event execution.

Adım Adım Çözüm

1

Analyze Task 1 regarding stateless execution microservices without OS or web server management.

Identified as Function as a Service (FaaS) / Serverless, where infrastructure and OS management are fully abstracted.

Serverless architectures require developers only to upload code functions and define event triggers.

2

Analyze Task 2 regarding guest OS updates, virtual firewalls, and persistent storage management.

Identified as Infrastructure as a Service (IaaS).

Under IaaS shared responsibility, the cloud provider manages physical hardware and hypervisors, whereas the customer manages guest OS, network controls, and storage encryption.

3

Analyze Task 3 regarding tenant access control and DLP integration for vendor-hosted productivity suites.

Identified as Software as a Service (SaaS).

SaaS applications are completely hosted by the cloud provider, leaving the customer only in control of data access, user identities, and data loss prevention configurations.

4

Analyze Task 4 regarding application source code, database table permissions, and runtime framework configurations with provider OS patching.

Identified as Platform as a Service (PaaS).

PaaS abstracts operating system administration while giving the customer control over application deployment, runtime configurations, and backend database schemas.

Anahtar Kavram

Cloud Shared Responsibility Model across Service Models (IaaS, PaaS, SaaS, FaaS)

Soru 134Soru →

Match each hardware security mechanism to its primary security function.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

The hardware security mechanisms match their functions as follows: Trusted Platform Module (TPM) pairs with storing host keys and measuring endpoint boot integrity; Hardware Security Module (HSM) pairs with enterprise high-throughput cryptographic processing; eFuse pairs with permanently altering physical chip states for anti-rollback protection; and UEFI Secure Boot pairs with verifying cryptographic signatures on bootloaders before execution.

Each security mechanism directly aligns with its hardware role: Trusted Platform Module (TPM) serves host endpoints by storing keys and holding hardware boot measurements; Hardware Security Module (HSM) offloads server-side cryptographic workloads; eFuse physically enforces immutable hardware states such as rollback protection; and UEFI Secure Boot verifies cryptographically signed startup binaries.

Adım Adım Çözüm

1

Analyze endpoint-level cryptographic hardware controls.

Trusted Platform Module (TPM) is identified as the local microcontroller on host motherboards for key storage and measurements.

TPMs are standard endpoint chips used to protect full disk encryption keys and verify device posture.

2

Analyze enterprise-level high-performance hardware crypto appliances.

Hardware Security Module (HSM) is identified as the high-throughput server appliance.

HSMs handle centralized enterprise key management and offload heavy cryptographic operations.

3

Analyze physical hardware lock mechanisms in microchips.

eFuse is identified as the technology that permanently alters internal circuits.

Once an eFuse is blown, the physical change is irreversible, prohibiting firmware downgrades or unauthorized debug interface access.

4

Analyze firmware startup signature verification mechanisms.

UEFI Secure Boot is identified as the process checking boot code signatures.

Secure Boot prevents rootkits by verifying digital signatures against known trust anchors before code executes.

Anahtar Kavram

Hardware-based root of trust components and embedded system security controls

Tahmini Süre:1m 0s

Soru 135Soru →

An enterprise cloud security architect is establishing baseline control requirements for host operating systems, hypervisors, and container runtime environments across a hybrid infrastructure. Match each security mechanism to its corresponding isolation property or security enforcement role.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Linux Namespaces match isolated process views of system resources; Linux Control Groups (cgroups) match limiting hardware resource consumption; Type-1 Bare-Metal Hypervisor matches executing directly on host hardware for virtual machine separation; Secure Computing Mode (seccomp) matches filtering host kernel system calls.

Each mechanism aligns directly with its underlying operating system or hypervisor security control role: Namespaces restrict system visibility, cgroups control resource limits, Type-1 hypervisors provide bare-metal hardware separation, and seccomp limits system call access to the host kernel.

Adım Adım Çözüm

1

Analyze container kernel isolation controls.

Identify that Linux Namespaces control resource visibility (what a process can see), whereas cgroups control resource allocation (how much a process can consume).

Differentiating process boundaries from resource constraint enforcement is essential in container runtime security.

2

Analyze kernel interface reduction mechanisms.

Identify seccomp as the Linux security capability that restricts privileged kernel syscall execution.

Syscall filtering mitigates container escape vulnerabilities that target host kernel flaws.

3

Analyze hypervisor virtualization mechanisms.

Identify Type-1 hypervisors as bare-metal software layers enforcing hardware abstraction for guest VMs.

Hardware-assisted hypervisors create a distinct security boundary separate from container OS-level virtualization.

Anahtar Kavram

Virtualization vs. Containerization Isolation Primitives

Soru 136Soru →

A enterprise network security architect is reviewing the organization's network segmentation model across physical, virtual, and industrial environments. Match each network segmentation approach to the business and architectural requirement it best addresses.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Air Gap matches physical isolation of OT systems; Microsegmentation matches granular software-defined East-West traffic control between workloads; Screened Subnet matches hosting public-facing services separated from private networks; Jump Box matches providing a single audited administrative transit point into sensitive zones.

Air gapping ensures physical isolation for critical OT systems. Microsegmentation enforces policy-based isolation for East-West cloud workload traffic. A screened subnet isolates internet-accessible assets from internal networks, and a jump box securely bridges administrative access into high-security zones.

Adım Adım Çözüm

1

Analyze the operational requirements for high-security OT environments requiring total network disconnect.

Identify Air Gap as the physical isolation technique suited for SCADA/ICS safety systems.

Air gapping completely eliminates network vectors by removing physical connection paths.

2

Analyze requirements for preventing lateral movement within modern data center workload tiers.

Identify Microsegmentation as the appropriate control for granular East-West traffic restriction.

Microsegmentation uses software-defined policies to isolate individual container workloads regardless of physical topology.

3

Analyze requirements for exposing public services securely.

Identify Screened Subnet (DMZ) as the perimeter boundary control.

Screened subnets buffer public traffic between internal and external firewalls.

4

Analyze administrative security access requirements for sensitive zones.

Identify Jump Box (Bastion Host) as the controlled management transit server.

Jump boxes enforce centralized authentication, access controls, and logging for administrative sessions.

Anahtar Kavram

Secure Network Segmentation Archetypes and Traffic Control Controls

Soru 137Soru →

An enterprise airport operations authority is redesigning its security architecture across operational technology (OT), cloud management, tenant infrastructure, and administrative networks. Match each network isolation and control mechanism on the left to its corresponding architectural requirement on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Unidirectional Data Diode pairs with outbound-only SCADA telemetry; Microsegmentation pairs with stopping East-West lateral movement between cloud microservices; Hardened Jump Server pairs with audited vendor administrative access; Physical Air Gap pairs with isolating critical runway control hardware via offline media ingestion.

Each isolation mechanism aligns with specific threat model requirements: data diodes physically enforce one-way telemetry streaming; microsegmentation controls internal lateral movement across cloud workloads; jump servers control and audit remote management access; air gaps eliminate all network-based attack vectors against critical physical control systems.

Adım Adım Çözüm

1

Evaluate hardware-enforced single-direction communication constraints.

Identify that streaming telemetry outbound while physically blocking inbound traffic requires a Unidirectional Data Diode.

Data diodes utilize physical optical transmitters and receivers that prevent electromagnetic or logical return channels.

2

Evaluate lateral communication controls for cloud workloads.

Match Microsegmentation to the requirement of limiting East-West traffic between individual containerized instances.

Traditional perimeter firewalls cannot inspect or restrict peer-to-peer traffic inside the same virtual layer 2 network segment without software-defined microsegmentation.

3

Evaluate privileged remote management architectures.

Match Hardened Jump Server with MFA and Session Auditing to third-party vendor administrative access requirements.

Jump boxes isolate external administrative sessions from internal infrastructure while recording session activity for compliance and forensics.

4

Evaluate total isolation controls for high-consequence OT infrastructure.

Match Physical Air Gap with Media Sanitization Kiosk to the safety-critical automated runway control systems.

Complete physical separation removes external connectivity attack vectors, using controlled offline kiosks as the sole ingestion path for maintenance files.

Anahtar Kavram

Network Segmentation and Isolation Architecture Controls

Tahmini Süre:2m 0s

Soru 138Soru →

Match each Identity and Access Management (IAM) protocol to its primary architectural use case.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

SAML 2.0 matches XML-based web SSO federation; OAuth 2.0 matches token-based authorization for API access; OpenID Connect matches the authentication identity layer built on OAuth 2.0; RADIUS matches centralized AAA network access control.

Each IAM protocol satisfies a specific architectural domain: SAML 2.0 facilitates XML web federation across organizations; OAuth 2.0 grants granular authorization tokens to APIs; OpenID Connect adds an authentication identity layer over OAuth 2.0 using JWTs; RADIUS delivers network-level AAA for VPNs and wireless infrastructure.

Adım Adım Çözüm

1

Identify the primary architectural function (Authentication vs. Authorization vs. Network AAA) for each protocol.

Categorize SAML 2.0 and OIDC as web identity/SSO authentication, OAuth 2.0 as API authorization, and RADIUS as network AAA.

IAM architecture requires matching protocols to their specific layer in the security stack.

2

Differentiate web federation standards based on message format and structure.

Associate SAML 2.0 with XML assertions and OIDC with JSON Web Tokens (JWT) extending OAuth 2.0.

SAML 2.0 is enterprise XML-focused, while OIDC modernizes web authentication over RESTful/JSON endpoints.

3

Pair RADIUS with network-level authentication mechanisms.

Connect RADIUS to 802.1X port security and VPN access control.

RADIUS is designed for infrastructure device network access control, unlike web application protocols.

Anahtar Kavram

IAM Protocol Architectural Selection

Tahmini Süre:45s

Soru 139Soru →

A system administrator is auditing isolation and runtime protection controls across a enterprise infrastructure hosting both virtual machines and containerized microservices. Match each security control on the left with the specific operational threat or attack vector it directly mitigates on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Hypervisor patch management matches VM escape exploitation; Control Groups (cgroups) enforcement matches resource exhaustion denial-of-service; Read-only root file system configuration matches malicious file persistence; Static image scanning matches deployment of unpatched software vulnerabilities.

Each security mechanism directly addresses a distinct layer of virtualization or container architecture: hypervisor patching protects hardware abstraction boundaries; cgroups manage shared kernel resource allocation; read-only root file systems enforce immutability at runtime; and static scanning secures software components in the build pipeline.

Adım Adım Çözüm

1

Analyze virtual machine isolation mechanisms.

Identify that hypervisor patching specifically targets vulnerabilities allowing guest-to-host privilege escalation and VM escape.

Hypervisors manage hardware virtualization boundaries; failure to patch allows guest workloads to break out of hardware abstraction.

2

Differentiate container resource boundary controls from namespace isolation.

Map Linux Control Groups (cgroups) directly to resource consumption limits.

cgroups set boundaries on system resources like CPU, memory, and disk I/O, preventing neighbor starvation.

3

Evaluate container file system runtime security.

Connect read-only root file systems to preventing unauthorized file modifications and persistence.

Immutable runtime container storage prevents attackers from dropping binaries or modifying system binaries during runtime compromise.

4

Examine pre-deployment supply chain security controls.

Associate CI/CD static image scanning with identifying known vulnerabilities in container images.

Automated scanning checks container layers against vulnerability databases before code is deployed.

Anahtar Kavram

Virtualization vs Containerization Security Boundaries

Soru 140Soru →

Match each storage security technology to its primary operational function.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Tokenization maps to replacing sensitive data fields with non-sensitive surrogate tokens; Self-Encrypting Drive (SED) maps to providing automatic, hardware-level block encryption directly on physical storage media; Hardware Security Module (HSM) maps to safeguarding and managing cryptographic keys inside dedicated physical security hardware; Data Loss Prevention (DLP) maps to monitoring and blocking unauthorized transmission or exfiltration of sensitive information.

Tokenization obfuscates data using surrogate tokens; SED provides automated physical drive encryption; HSM secures cryptographic keys; DLP inspects data to prevent unauthorized transfers.

Adım Adım Çözüm

1

Analyze each security technology listed on the left.

Identified Tokenization, SED, HSM, and DLP as primary storage and data protection mechanisms.

Each technology satisfies a specific, distinct function within enterprise storage architecture.

2

Match each technology to its unique functional capability.

Tokenization replaces data with surrogate tokens; SED encrypts disk blocks directly; HSM protects cryptographic keys; DLP prevents exfiltration.

Matching capabilities directly tests core knowledge of data protection and storage security mechanisms.

Anahtar Kavram

Storage and Data Protection Controls

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram