Examkin

Tüm alıştırma soruları

173 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 121Soru →

A network security analyst receives a high-severity Network Intrusion Detection System (NIDS) alert signaling anomalous outbound data transfers from a internal web server to an unknown external IP address. Which of the following sequences represents the correct chronological order of network security monitoring and incident triage steps the analyst should follow from initial alert validation through enterprise protection?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for network security monitoring and triage is: 1) Correlate the NIDS alert with web server access logs and SIEM event streams to confirm a true positive condition; 2) Capture live network flow telemetry and analyze packet payloads to determine the scope of exfiltrated data; 3) Apply targeted network access control rules to isolate the compromised web server from external endpoints; 4) Extract network Indicators of Compromise (IoCs) and deploy updated NIPS signatures across the enterprise perimeter.
The standard network security monitoring triage workflow starts with alert validation against correlated SIEM and web logs to confirm a true positive. Following validation, packet payload and NetFlow telemetry are analyzed to establish the breach extent and extract threat characteristics. Once the attack profile is understood, network isolation controls are applied to block live exfiltration. Finally, derived network Indicators of Compromise (IoCs) are deployed to NIPS rules to prevent secondary attacks enterprise-wide.

Adım Adım Çözüm

1
Verify Alert Authenticity
Confirmed true positive alert identifying the source web server and destination IP.
Initial network monitoring triage requires cross-referencing raw NIDS alerts with host logs and SIEM data to rule out false positives.
2
Analyze Telemetry & Packet Data
Determined exfiltrated data volume, protocols, and malicious payload characteristics.
Inspecting packet payloads and flow records provides detailed context regarding breach impact and specific Indicators of Compromise (IoCs).
3
Enforce Network Isolation
Active exfiltration path blocked without powering off host, preserving volatile RAM and active connection state.
Network containment halts ongoing unauthorized transmission once the nature of the threat is understood.
4
Update Defensive Signatures
Enterprise NIPS and firewall devices configured with new block rules and signatures.
Feeding extracted IoCs back into network intrusion prevention systems mitigates risk across the rest of the enterprise.

Anahtar Kavram

Network Security Incident Monitoring and Alert Triage Workflow
Soru 122Soru →

A security engineer is designing an enterprise Security Information and Event Management (SIEM) log pipeline to ingest data from heterogeneous sources. Place the stages of the log processing life cycle in the correct chronological order from initial log intake to incident detection notification.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequential order of log processing within a SIEM pipeline is: Log Collection & Ingestion, Parsing & Normalization, Aggregation & Indexing, Correlation Engine Processing, and Alerting & Escalation.
In a modern SIEM architecture, log data must flow logically from capture (ingestion) to field mapping (normalization), centralized storage indexing (aggregation), threat pattern evaluation (correlation), and finally analyst notification (alerting).

Adım Adım Çözüm

1
Gather raw telemetry from sources
Raw logs are retrieved via agents, Syslog streams, or cloud API integrations (Log Collection & Ingestion).
Log data must first enter the SIEM platform before any transformation or analysis can occur.
2
Standardize heterogeneous log formats
Raw syslog, JSON, and XML entries are translated into standardized fields such as source IP, destination port, and user ID (Parsing & Normalization).
Disparate logs must share a common schema so cross-platform rules can interpret them uniformly.
3
Store and structure data for searching
Normalized events are indexed into high-performance search databases and datastores (Aggregation & Indexing).
Indexing ensures efficiently structured data availability for rule engines and historical SOC investigations.
4
Evaluate data against detection logic
The correlation engine analyzes normalized, indexed log streams against behavioral patterns and complex conditional rules (Correlation Engine Processing).
Detection engines depend on multi-source normalized events to identify cross-system indicators of compromise.
5
Dispatch actionable security notifications
Matches exceeding risk thresholds generate SOC notifications, tickets, or automated SOAR triggers (Alerting & Escalation).
Notifications take place only after rule logic confirms a security event.

Anahtar Kavram

SIEM Log Processing Pipeline
Soru 123Soru →

A Security Operations Center (SOC) analyst receives an Endpoint Detection and Response (EDR) alert indicating an unauthorized process injection attempt on a critical financial application server. What is the correct operational sequence of actions to take when responding to this incident, ordered from the initial containment step to the final system restoration?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of EDR incident response actions is: 1) Initiate agent-based network isolation, 2) Terminate injected malicious processes, 3) Capture volatile process memory dumps and forensic telemetry, and 4) Execute automated EDR remediation playbooks to purge persistence mechanisms.
The standard EDR containment workflow prioritizes immediate threat isolation (isolating the endpoint from the network while maintaining agent control), followed by stopping active execution (terminating injected processes), collecting volatile forensics for investigation, and finally remediating persistence mechanisms and restoring system integrity.

Adım Adım Çözüm

1
Network Isolation
The host is isolated from the enterprise network, restricting network traffic strictly to EDR control communications.
Immediate containment halts potential lateral movement and command-and-control (C2) communication before further escalation occurs.
2
Process Termination
Active malicious process execution and child processes are stopped.
Halting the injected process prevents ongoing unauthorized activity and potential local damage.
3
Forensic Data Collection
Volatile memory and telemetry are gathered for root-cause analysis.
Acquiring evidence from the contained host ensures indicators of compromise (IoCs) and root cause can be investigated safely.
4
Persistence Removal and Restoration
Malicious artifacts are removed and system integrity is confirmed.
Purging persistence artifacts prevents re-infection when the endpoint is un-isolated and restored to operational service.

Anahtar Kavram

EDR Automated Containment and Incident Response Workflow
Soru 124Soru →

An automated Security Orchestration, Automation, and Response (SOAR) workflow is triggered upon detecting malicious code execution on a workstation. In what order should the playbook execute the following response actions to ensure effective containment while preventing unauthorized operational disruption?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of actions for the SOAR playbook is: 1) Query EDR and threat intelligence APIs to enrich the alert, 2) Evaluate enriched incident data against conditional logic, 3) Issue an automated API call to isolate the workstation, 4) Submit a human-in-the-loop approval request for credential revocation, and 5) Update the ITSM ticket and close the alert.
Effective SOAR playbooks follow a structured lifecycle: enrichment, evaluation, containment, human-in-the-loop approval for high-risk actions, and final ticketing/closure. Gathering threat intelligence and endpoint details first provides the necessary telemetry. Evaluating conditional logic determines response severity. Performing automated endpoint isolation halts lateral movement immediately. Requesting analyst approval before identity credential revocation avoids unnecessary business downtime. Finally, updating and closing the ITSM ticket documents the full audit trail.

Adım Adım Çözüm

1
Enrich alert context
Host criticality metrics and file reputation data are attached to the incident record.
SOAR workflows must gather requisite context from integrated security tools before executing decision logic.
2
Evaluate conditional rules
The playbook determines the containment pathway appropriate for the asset type and severity.
Contextual evaluation ensures low-risk automated actions are performed while high-impact steps are flagged for review.
3
Execute automated network containment
The host is isolated at the endpoint layer to prevent lateral movement.
Containment of compromised endpoints must happen immediately to halt threat spread.
4
Request human-in-the-loop authorization
Tier 2 analyst receives notification to review credential revocation details.
High-impact identity changes carry operational risk and require explicit human verification.
5
Record workflow metrics and close case
Execution logs are written to the ITSM ticketing platform and the case is closed.
Audit records and system metrics must be recorded post-remediation to finalize incident response operations.

Anahtar Kavram

SOAR Playbook Incident Response Execution Order
Soru 125Soru →

An IT administrator needs to request and implement an X.509 server certificate from a public Certificate Authority (CA) to secure a corporate web portal. Arrange the steps of the initial PKI certificate enrollment process in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: 1) Generate the key pair, 2) Create the CSR, 3) Submit the CSR to the CA, 4) CA signs and issues the certificate, 5) Install the certificate on the web server.
In standard Public Key Infrastructure (PKI) workflows, certificate issuance follows a strict logical sequence. First, the requesting server generates an asymmetric key pair (private and public keys). Next, the administrator generates a Certificate Signing Request (CSR) which embeds the public key and organization identity details. The CSR is then submitted to the Certificate Authority (CA), which verifies the requester's identity. Once verified, the CA signs the certificate using its own private key and issues it. Finally, the administrator installs the signed certificate on the web server to service secure TLS connections.

Adım Adım Çözüm

1
Generate asymmetric key pair locally
A public key and private key are generated on the destination server.
A public key is required to populate the Certificate Signing Request (CSR).
2
Build the Certificate Signing Request (CSR)
A CSR file containing the public key and entity identity (Subject/SAN) is compiled.
The CSR acts as the formal application sent to a CA for certificate issuance.
3
Submit CSR to the target CA
The CA receives the CSR and begins domain validation procedures.
The CA must verify identity and domain control before binding its trust signature.
4
CA certificate signing and issuance
The CA signs the applicant's public key with its own private key and returns the X.509 certificate.
The cryptographic signature of the CA establishes trust for clients trusting that CA root.
5
Deploy certificate on server
The server is bound to the new certificate and intermediate CA certificates.
Installation enables the web server to present a trusted certificate during TLS handshakes.

Anahtar Kavram

PKI Certificate Request and Enrollment Workflow
Soru 126Soru →

A security analyst receives a high-severity alert from an Endpoint Detection and Response (EDR) agent indicating that a malicious WMI event subscription has been registered on a critical enterprise server and is attempting to execute unauthorized PowerShell scripts. Place the containment and incident response steps in the correct sequential order from initial response to final remediation.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with validating telemetry alerts, followed by network isolation of the host, process termination, live response artifact collection, and finally persistence cleanup and host restoration.
In standard incident response protocols using EDR technology, the first step is validating telemetry alerts. Once confirmed, immediate network isolation protects the rest of the enterprise from lateral movement. Next, running malicious processes are killed to stop active damage, followed by collecting volatile live response artifacts for root cause analysis. Finally, persistent threat artifacts (such as WMI bindings) are deleted and the clean endpoint is restored.

Adım Adım Çözüm

1
Validate the EDR alert and process tree.
Confirmed malicious WMI event execution.
Prevents taking intrusive containment actions on benign system behavior.
2
Isolate the endpoint network interface via EDR capabilities.
Lateral movement vectors are severed while preserving administrative EDR control channels.
Contains potential containment blast radius to the single endpoint.
3
Terminate active malicious processes.
Malicious code stops executing in host memory.
Halts ongoing damage or data collection on the localized system.
4
Collect live response forensic telemetry.
Volatile memory and script logs are saved for root-cause analysis.
Ensures critical forensic evidence is preserved before system modifications occur.
5
Remediate WMI persistence mechanisms and lift host isolation.
System returned to trusted baseline state and reconnected to network.
Completes the lifecycle of endpoint containment and remediation.

Anahtar Kavram

EDR Incident Containment and Investigation Workflow
Soru 127Soru →

An enterprise mobile application authenticates users via a cloud-hosted Identity Provider (IdP) using the OAuth 2.0 Authorization Code Flow with Proof Key for Code Exchange (PKCE). Place the operational steps of this authentication sequence in the correct order, from initial client initialization to final token delivery.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence is: 1) Client generates the secret code_verifier and computes the code_challenge, 2) Client redirects user to IdP authorization endpoint with the code_challenge, 3) IdP authenticates user and issues an authorization code bound to the code_challenge, 4) Client sends authorization code and plaintext code_verifier to IdP token endpoint, 5) IdP verifies code_verifier against code_challenge and issues access tokens.
Proof Key for Code Exchange (PKCE) mitigates authorization code interception attacks on public clients. The client first creates a secret code_verifier and calculates the code_challenge. Next, it sends the user to the IdP authorization endpoint carrying the code_challenge. After successful user authentication, the IdP returns an authorization code. The client then exchanges this authorization code by sending the plaintext code_verifier directly to the token endpoint. Finally, the IdP verifies that SHA-256 hashing of the code_verifier matches the code_challenge stored during authorization before issuing access and ID tokens.

Adım Adım Çözüm

1
Generate local cryptographic parameters
The client establishes the secret code_verifier and derives the public code_challenge using SHA-256.
PKCE protects public clients against authorization code interception by establishing a secret known only to the legitimate client instance before initiating communication.
2
Initiate authorization request
The client redirects the browser/user-agent to the IdP authorization URI containing the code_challenge.
The IdP needs the code_challenge to associate it with the authorization request session prior to user authentication.
3
Authenticate user and issue authorization code
The IdP validates user credentials and issues a short-lived authorization code.
The authorization code represents temporary authorization granted by the resource owner to the client.
4
Exchange authorization code for tokens
The client makes a POST request to the token endpoint supplying the authorization code and the plaintext code_verifier.
Presenting the unhashed code_verifier proves that the party requesting tokens is the exact same application instance that generated the initial request.
5
Validate verifier and deliver tokens
The IdP hashes the received code_verifier, compares it to the original code_challenge, and returns security tokens.
Token issuance is granted only when SHA-256(code_verifier) strictly equals the code_challenge recorded in Step 3.

Anahtar Kavram

OAuth 2.0 Authorization Code Flow with PKCE (Proof Key for Code Exchange)
Tahmini Süre:1m 30s
Soru 128Soru →

An enterprise security engineer is deploying S/MIME dual-key certificates (separate key pairs for digital signing and data encryption) across an organization using an internal PKI with key recovery capabilities. To comply with security governance, private encryption keys must be escrowed before certificate issuance, while signing keys must never be escrowed. Place the administrative operational steps in the correct chronological sequence from initial key pair creation to final client integration.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins with generating the dual key pairs on the endpoint, followed by archiving the private encryption key into key escrow, creating and transmitting the CSR to the Intermediate CA, the CA signing and publishing the X.509 S/MIME certificate, and finally importing the signed certificate into the user's email client store.
The proper sequence follows the cryptographic lifecycle: generating dual key pairs first provides the necessary key material. Next, the private encryption key must be safely backed up into key escrow before certification to ensure data recovery compliance while maintaining non-repudiation for the private signing key. After escrow verification, the client generates a CSR with public key material and sends it to the Issuing CA. The CA validates the identity, signs the X.509 certificate, and publishes it to the directory repository. Finally, the endpoint installs the signed certificate into the local email client store to enable cryptographic email functions.

Adım Adım Çözüm

1
Initiate asymmetric key pair generation on the local workstation for S/MIME dual-key deployment.
Two distinct key pairs (signing key pair and encryption key pair) are generated.
Cryptographic material must exist before any submission, escrow, or signing actions can proceed.
2
Transmit the private encryption key to the enterprise Key Escrow database over an encrypted session, leaving the signing key strictly local.
The private encryption key is archived for enterprise data recovery compliance, while non-repudiation of digital signatures is preserved.
Enterprise PKI policy mandates that private key escrow occurs prior to CA certification so unbacked-up keys are never issued active certificates.
3
Formulate a Certificate Signing Request (CSR) including the public keys and subject distinguished name, then submit it to the Issuing CA.
The CA receives a structured CSR payload containing the identity details and public key material.
The CSR acts as the formal request for the CA to validate identity and certify public key ownership.
4
The Intermediate CA authenticates the request, signs the X.509 S/MIME certificate with its private key, and publishes the certificate to LDAP.
An authenticated, signed X.509 S/MIME certificate is created and published for enterprise access.
The CA is responsible for establishing trust by signing the public key and making the certificate accessible to other email users.
5
Download and install the issued X.509 certificate into the endpoint's personal certificate store.
The email client binds the signed certificate to the local private keys, completing S/MIME initialization.
The endpoint requires the signed certificate to complete TLS/MIME handshake routines and execute cryptographic operations.

Anahtar Kavram

S/MIME Dual-Key Lifecycle and Key Escrow Workflow
Tahmini Süre:3m 0s
Soru 129Soru →

A security administrator must deploy a critical system patch and an updated security hardening baseline across a fleet of enterprise application servers. To minimize operational risk and maintain security compliance, the administrator must follow a structured configuration and patch management workflow. In what order should the administrator execute these operational steps from first to last?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins with non-production staging validation, followed by Change Advisory Board approval, a phased canary deployment, full production fleet distribution, and final post-deployment compliance scanning to establish the new baseline snapshot.
The standard patch and configuration management lifecycle follows a strict sequence: validate in non-production staging, obtain Change Advisory Board authorization with a rollback plan, execute a limited canary deployment, deploy to the entire production fleet using configuration orchestration, and finally perform an automated compliance scan to record the new baseline snapshot.

Adım Adım Çözüm

1
Staging and Functional Testing
Patch and baseline changes are verified in a non-production sandbox environment.
Prevents catastrophic application breakage by exposing unexpected dependencies and bugs before touching production.
2
Change Control and Authorization
The Change Advisory Board reviews testing evidence and approves the production change request.
Ensures institutional oversight, risk management, and pre-approved fallback procedures prior to deployment.
3
Canary Rollout and Health Monitoring
Changes are applied to a tiny fraction of production servers to gauge operational impact.
Limits the blast radius if subtle production-only anomalies occur.
4
Enterprise Fleet Orchestration
The approved update is deployed automatically to all remaining production systems.
Achieves consistent and efficient enterprise-wide patch coverage after risk validation.
5
Auditing and Baseline Update
Post-patch verification scans confirm compliance and snapshot the new configuration state.
Validates that no systems were missed and updates the baseline reference target used for configuration drift detection.

Anahtar Kavram

Patch and Configuration Management Workflow
Soru 130Soru →

During a security incident, an organization's Security Operations Center (SOC) identifies a compromised containerized application actively scanning internal microservices for vulnerabilities. Place the following incident response actions in the correct sequential order from FIRST to LAST according to standard incident handling frameworks.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of incident response actions is: 1) Isolate the compromised container using microsegmentation network policies; 2) Capture volatile memory artifacts and container runtime logs; 3) Terminate the compromised container instance and redeploy from a verified clean image; 4) Restore normal production routing while monitoring network telemetry; 5) Conduct a post-mortem review to update container security controls.
Standard incident handling frameworks (such as NIST SP 800-61) follow a strict lifecycle order: Containment (isolating network traffic) occurs first to stop active damage; Evidence Preservation collects volatile forensic artifacts before system modification; Eradication removes the root cause by destroying the compromised instance and deploying a trusted build; Recovery restores production operations under enhanced monitoring; Post-incident Activity reviews performance and updates playbooks to enhance future resiliency.

Adım Adım Çözüm

1
Determine the Containment Step
Network isolation via microsegmentation is placed first.
Immediate containment stops active lateral movement and limits incident scope before any destructive or disruptive changes are made.
2
Determine the Evidence Preservation Step
Volatile memory and log collection is placed second.
Evidence preservation must happen while the system remains isolated but before deleting or rebuilding the container instance.
3
Determine the Eradication Step
Termination of the container and redeployment from a clean image is placed third.
Eradication removes the threat vectors and compromised binaries once evidence has been secured.
4
Determine the Recovery Step
Restoring traffic with active telemetry monitoring is placed fourth.
Recovery brings systems safely back into full production under close monitoring to confirm stability.
5
Determine the Lessons Learned Step
Post-mortem review and CI/CD security updates are placed fifth.
Post-incident analysis evaluates the incident response effort after operational restoration to prevent future recurrence.

Anahtar Kavram

NIST Incident Response Lifecycle (Containment, Evidence Preservation, Eradication, Recovery, Lessons Learned)
Soru 131Soru →

A security administrator needs to obtain and deploy a new TLS server certificate signed by a public Certificate Authority (CA). What is the correct sequence of administrative steps to accomplish this task?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: 1) Generate an asymmetric key pair locally on the server; 2) Create a Certificate Signing Request (CSR) containing the public key and domain details; 3) Submit the CSR to the Certificate Authority (CA) for validation and signing; 4) Install the CA-signed digital certificate on the web server.
The standardized PKI certificate enrollment workflow requires local key pair generation first, followed by bundling the public key into a CSR, submitting the CSR to the CA for domain verification and signature, and finally binding the issued certificate to the web service.

Adım Adım Çözüm

1
Generate asymmetric key pair on the server
A public key and a protected private key are created.
The server must possess a private key before requesting a corresponding signed certificate.
2
Formulate Certificate Signing Request (CSR)
A CSR file containing the public key and organizational details is generated.
The CA requires the public key and domain identity details to construct the certificate body.
3
Submit CSR to Certificate Authority (CA)
The CA verifies domain control and issues a signed certificate.
Validation establishes trust before the CA applies its digital signature.
4
Install signed certificate on the server
The web server presents the valid CA-signed certificate during TLS handshakes.
Clients can now establish encrypted TLS sessions by verifying the certificate chain back to a trusted root CA.

Anahtar Kavram

PKI Certificate Request and Enrollment Lifecycle Workflow
Soru 132Soru →

A security administrator is configuring a new high-security internal microservice that requires a valid server TLS certificate. Enterprise policy mandates hardware key protection, accurate Subject Alternative Name (SAN) extension mapping, intermediate CA trust anchoring, and OCSP stapling to eliminate direct client queries to the Certificate Authority. In what order should the administrator perform the following steps to deploy the certificate and enable OCSP stapling?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with generating the private key and CSR with SAN attributes, followed by submitting the CSR to the intermediate CA for issuance, installing the server certificate and intermediate CA chain, querying and caching the timestamped OCSP response from the responder, and finally enabling OCSP stapling on the web server.
The proper sequence follows standard PKI lifecycle principles: key generation and CSR creation must precede CA submission and signing. Once the CA returns the signed certificate, installing it along with the intermediate CA chain establishes local service readiness. Next, the server must query the OCSP responder to cache a valid, time-stamped status assertion. Finally, enabling OCSP stapling allows the server to serve this cached status to clients during TLS negotiation.

Adım Adım Çözüm

1
Generate key pair and create CSR
A CSR containing the public key and SAN extensions is created, while the private key remains protected in the hardware module.
PKI certificate issuance requires a CSR that includes the public key and identity information before contacting a CA.
2
Submit CSR to Intermediate CA
The CA validates the request, signs the certificate, and returns the signed X.509 certificate.
The CA must sign the public key and SAN details to establish authenticity and issue the valid certificate.
3
Install server certificate and trust chain
The web server is configured with its identity certificate and intermediate CA chain.
The server requires the certificate and full intermediate chain to establish trust with clients during TLS handshakes.
4
Fetch and cache OCSP response
The server securely queries the CA's OCSP responder and receives a signed status payload.
OCSP stapling requires the server itself to periodically contact the OCSP responder and cache the time-stamped proof of validity.
5
Enable OCSP stapling for TLS handshakes
Connecting clients receive the server's OCSP response directly during the TLS handshake.
OCSP stapling delivers the pre-fetched revocation status to the client during negotiation, eliminating client-side CA lookup latency and preserving privacy.

Anahtar Kavram

PKI Certificate Enrollment and OCSP Stapling Lifecycle Workflow
Tahmini Süre:2m 0s
Soru 133Soru →

A security operations team is implementing a Just-In-Time (JIT) Privileged Access Management (PAM) workflow to enforce least privilege for emergency system administration. Place the operational steps of the JIT access lifecycle in the correct sequential order from initial request submission to final audit completion.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequential order for the JIT PAM access lifecycle is: 1) Submission of a time-bound request with justification, 2) Policy evaluation and approval routing, 3) Provisioning of ephemeral credentials and session brokering, 4) Execution of administrative duties within the active session window, and 5) Session termination, credential rotation, and audit log archiving upon expiration.
The proper operational sequence follows standard IAM lifecycle controls: submitting a justified request, obtaining policy authorization, issuing ephemeral credentials with monitoring, performing work within the window, and automatically revoking access while archiving audit logs upon expiration.

Adım Adım Çözüm

1
Identify the request initiation step
The process starts when an administrator requests temporary access with ticket context.
JIT access relies on demand-based request triggers rather than static standing privileges.
2
Determine the authorization and governance step
The PAM system verifies rules and obtains necessary approvals.
Authorization must precede credential issuance to enforce identity policies.
3
Identify credential issuance and session setup
Ephemeral credentials or proxy sessions are created with keystroke and session logging.
Brokered access prevents administrators from knowing or storing static root secrets.
4
Determine the task execution step
The user completes maintenance within the active access window.
Administrative tasks must occur inside the securely brokered session framework.
5
Identify session closure and log archiving
Access is automatically revoked, temporary credentials are invalidated, and audit logs are saved.
Automated teardown prevents privilege creep and lingering unauthorized access.

Anahtar Kavram

Just-In-Time (JIT) Privileged Access Management (PAM) Operational Sequence
Soru 134Soru →

An enterprise security operations team needs to update core firewall access control lists (ACLs) to accommodate a new external application service. Place the standard security change management workflow steps in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for the change control workflow is: 1) Perform security impact analysis and document backout plan, 2) Submit change request to CAB for authorization, 3) Validate changes in a staging environment, 4) Implement changes in production during authorized window, and 5) Conduct post-implementation review.
A structured change management workflow ensures security oversight by requiring initial risk assessment and backout planning, CAB authorization, pre-deployment staging validation, scheduled production execution, and final post-implementation verification.

Adım Adım Çözüm

1
Analyze security impact and draft change documentation.
A clear scope, security assessment, and rollback strategy are documented.
Change management policy requires thorough risk assessment before seeking organizational approval.
2
Submit proposal for CAB review.
The Change Advisory Board evaluates business risk and approves implementation.
Formal authorization ensures change alignment with organizational risk tolerance and operational schedules.
3
Execute testing in staging environment.
The proposed rule set and backout steps are validated as safe and functional.
Pre-production testing prevents unexpected outages or unintended security exposure on live networks.
4
Deploy modifications into production.
Firewall ACL updates are applied during the scheduled change window.
Execution within maintenance windows minimizes business disruption during system updates.
5
Perform post-implementation review.
Production security baselines are audited and the change ticket is closed.
Post-implementation audit confirms successful deployment and verifies no drift from baseline security requirements.

Anahtar Kavram

Formal Change Management Workflow and Security Impact Lifecycle
Soru 135Soru →

Following a high-severity alert indicating a web shell has been uploaded to a public-facing corporate web server, an incident response team is deployed to handle the breach. Place the following incident response actions in the correct sequential order from earliest to latest according to the standard NIST Incident Response Lifecycle.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence follows the standard NIST Incident Response Lifecycle: 1. Analyze web server access logs and system memory, 2. Isolate the compromised web server from the internal network, 3. Remove the web shell backdoors and patch the vulnerability, 4. Restore the web application from a clean backup image and return it to production, 5. Conduct a post-incident meeting to document findings and update WAF rules.
The standard NIST incident response methodology strictly mandates moving through Detection & Analysis, Containment, Eradication, Recovery, and Post-Incident Activity. First analyzing system memory and logs allows responders to understand the threat. Network isolation contains the incident from spreading. Eradicating the web shell and patching the vulnerability removes the threat. Restoring from a verified clean backup completes recovery. Finally, conducting a post-mortem review fulfills post-incident obligations.

Adım Adım Çözüm

1
Scope and analyze the threat (Detection & Analysis)
Identified the web shell location and scope of access.
You must first analyze and understand the extent of an active breach before taking disruptive containment steps.
2
Isolate the affected system (Containment)
Prevented lateral movement across the internal enterprise network.
Containment limits operational damage while preserving volatile data for further analysis.
3
Eliminate the threat and vulnerability (Eradication)
Removed malicious web shell files and remediated the root application flaw.
Eradication ensures the attacker cannot maintain persistence once the system is re-exposed.
4
Restore system operations (Recovery)
Web server restored from clean state and validated in production.
Recovery tests and restores operational services safely.
5
Conduct post-incident activities (Post-Incident / Lessons Learned)
Playbooks updated and Web Application Firewall rules hardened.
Lessons learned feed back into the preparation phase to prevent future occurrences.

Anahtar Kavram

NIST Incident Response Lifecycle (Detection & Analysis → Containment → Eradication → Recovery → Post-Incident Activity)
Soru 136Soru →

A security analyst receives a high-priority alert indicating suspicious data transfers originating from an internal workstation. Arrange the network security monitoring and response actions in the correct sequential order from initial alert detection to detection rule optimization.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequential order begins with triaging the initial NIDS alert, followed by cross-referencing NetFlow and firewall logs, performing deep packet inspection on PCAPs, applying NAC network isolation policies, and finally updating SIEM correlation rules and NIDS signatures.
Effective network security monitoring follows a structured incident response sequence. Response starts at initial alert triage, proceeds through flow correlation to verify connection validity, conducts deep packet inspection for payload analysis, executes containment via Network Access Control to halt threat propagation, and finishes by refining detection rules in the SIEM and NIDS.

Adım Adım Çözüm

1
Alert Triage
Identified suspicious alert metadata from the perimeter NIDS sensor.
The analyst must first examine the initial trigger to understand the target host and alert classification.
2
Telemetry Correlation
Confirmed active session duration and transfer volume via NetFlow and firewall log entries.
Before performing resource-intensive analysis, flow telemetry must confirm that actual traffic traversed the network.
3
Packet Payload Inspection
Extracted malicious command-and-control artifacts and payload signatures from PCAP data.
Inspecting raw frame contents provides concrete evidence of compromise needed to justify containment.
4
Host Containment
Isolated the originating workstation from the broader enterprise network using NAC.
Containing the network segment stops data exfiltration and lateral movement while preserving evidence.
5
Rule Optimization and Feedback
Tuned SIEM correlation rules and updated intrusion signatures with newly identified IoCs.
Post-incident detection rule adjustments improve future monitoring speed and reduce false positives.

Anahtar Kavram

Network Security Monitoring Incident Handling Workflow
Soru 137Soru →

An enterprise security architect is establishing a two-tier internal Public Key Infrastructure (PKI) hierarchy. The Root CA will remain air-gapped to maintain security, while a new Intermediate CA will issue operational certificates to web servers. Place the administrative steps for provisioning and activating the Intermediate CA into the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct administrative order is to first generate the private key and CSR locally on the Intermediate CA, transport the CSR out-of-band to the air-gapped Root CA, sign the request with the Root CA's private key, and finally import the signed intermediate certificate into the Intermediate CA while publishing the Root CA public certificate to the enterprise trust store.
In a standard two-tier PKI hierarchy with an air-gapped Root CA, the Intermediate CA first generates its own private key and CSR locally. The request is transported out-of-band to the Root CA, which signs the request using its private key. Finally, the signed certificate is installed on the Intermediate CA, and the Root CA's public certificate is deployed to endpoints' trusted root store to establish a valid trust chain.

Adım Adım Çözüm

1
Generate private key pair and CSR locally on the Intermediate CA server
Creates the asymmetric key pair and formats the public key with subject identity into a CSR.
Private keys must be generated on the host system to prevent key compromise during transit.
2
Transport the CSR to the Root CA via offline media
Delivers the signing request to the isolated issuing system.
Air-gapped Root CAs lack network connectivity to defend against remote network attacks.
3
Sign the Intermediate CSR using the Root CA's private key
Generates a digitally signed Intermediate CA certificate containing path length basic constraints.
The Root CA acts as the trust anchor that validates and authorizes the Intermediate CA.
4
Install the signed certificate on the Intermediate CA and publish the Root CA certificate to client trust stores
Enables the Intermediate CA to sign leaf certificates and ensures endpoints can validate the full certificate path back to the Root CA.
Clients must possess the Root CA's public certificate in their trusted root store to build a trusted certificate path.

Anahtar Kavram

Two-tier PKI deployment and Intermediate CA certificate signing workflow
Soru 138Soru →

A security administrator must deploy a critical security patch across enterprise production application servers following standard change control and patch management practices. Place the following operational lifecycle steps in the correct sequential order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins with non-production sandbox testing, followed by submitting a formal change request to the Change Advisory Board, deploying to a pilot/staging fleet, executing the full production deployment during a scheduled maintenance window, and finally auditing compliance to update the configuration baseline.
Structured patch and configuration management follows a strict procedural lifecycle: non-production sandbox testing, formal Change Advisory Board authorization, staged pilot deployment, enterprise production rollout, and final post-installation verification auditing.

Adım Adım Çözüm

1
Conduct initial functional and security testing in an isolated sandbox environment.
Identifies software conflicts or system crashes without impacting live operations.
Patches must never be applied to production or submitted for formal change approval without preliminary compatibility validation.
2
Submit a change request to the Change Advisory Board (CAB).
Obtains formal management approval, documents risks, and establishes backout plans.
Enterprise change management governance requires documented authorization before deploying changes to live operational systems.
3
Roll out the patch to a pilot or staging group.
Verifies patch stability under real-world conditions on a small subset of systems.
Staging deployments mitigate enterprise-wide outage risks by detecting unexpected edge-case issues early.
4
Perform full production deployment during an approved maintenance window.
Applies the patch across all target enterprise assets.
Deployment timing must align with authorized maintenance windows to minimize disruption to business operations.
5
Conduct automated compliance auditing and update configuration baselines.
Confirms successful patch application and establishes a new hardened system baseline.
Post-patch verification ensures no systems were missed and updates security records to prevent false drift alerts.

Anahtar Kavram

Standard Patch Management Lifecycle and Change Governance
Soru 139Soru →

An IT infrastructure team plans to implement a centralized Privileged Access Management (PAM) solution to manage administrative access across corporate servers. To comply with formal change management policies and minimize operational and security risks, in which sequence should the team perform the following change control steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with documenting the change request and rollback plan, followed by obtaining CAB approval, testing in a staging environment, and finally deploying to production during an approved maintenance window.
A standard change management lifecycle follows a strict sequence: initial creation and risk/rollback documentation, formal evaluation and authorization by the Change Advisory Board (CAB), non-production staging validation to test functionality and rollback procedures, and finally, scheduled production implementation with post-change verification.

Adım Adım Çözüm

1
Document change details, risk assessment, impact analysis, and rollback plan.
A completed formal change request is established.
Risk and operational dependencies must be fully understood and documented prior to evaluation.
2
Submit the documentation to the Change Advisory Board (CAB) for authorization.
Formal CAB approval is granted.
Governance policy requires authorized sign-off before changes can be tested or scheduled.
3
Execute the change within a dedicated staging environment.
Successful functional testing and validation of the rollback procedure in staging.
Testing mitigates the risk of unexpected outages and validates the backout plan safely.
4
Deploy to the production environment during an approved maintenance window.
The PAM system is successfully deployed in production with post-change verification.
Executing during authorized maintenance minimizes user impact and fulfills change control requirements.

Anahtar Kavram

Standard Change Control Workflow Lifecycle
Soru 140Soru →

A security administrator is managing the remediation of a critical zero-day vulnerability affecting enterprise database servers. To ensure business continuity and adhere to organizational risk management policies, the administrator must execute the patch management lifecycle in a structured sequence. Arrange the operational steps below in the correct order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence is: (1) Analyze vendor advisories and test the patch in an isolated staging environment, (2) Submit a formal change management request for Change Advisory Board approval, (3) Apply the patch to production servers during an authorized maintenance window, and (4) Perform post-installation vulnerability scanning and baseline configuration auditing.
The standard enterprise patch management process dictates that security patches must first be tested and validated in a staging environment. Once validated, documentation and back-out plans are submitted for Change Advisory Board review. Following formal authorization, patches are deployed to production systems during designated maintenance windows, after which post-deployment scanning confirms vulnerability closure and baseline compliance.

Adım Adım Çözüm

1
Validate patch functionality and stability in staging.
Identifies software conflicts and confirms patch effectiveness without risking production system uptime.
Security patches must be vetted in a non-production environment prior to enterprise change requests.
2
Obtain Change Advisory Board (CAB) review and operational approval.
Ensures stakeholder alignment, documents risk mitigation strategies, and authorizes execution details.
Enterprise change control protocol mandates formal review of testing evidence and back-out plans before production alterations.
3
Deploy the patch to production systems during scheduled maintenance windows.
Installs security fixes on live infrastructure while minimizing operational disruption to users.
Production changes should follow approved schedules to control operational risk.
4
Conduct post-deployment compliance verification and vulnerability scanning.
Confirms the flaw is successfully remediated and verifies that server configurations match established baselines.
Audit scanning closes the patch lifecycle by verifying technical control effectiveness.

Anahtar Kavram

Patch Management and Change Control Lifecycle Procedures
ÖncekiSayfa 7 / 9Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin