Tüm alıştırma soruları

2232 soru

Tüm türler2,232 Çoktan seçmeli1,151 Çoklu seçim509 Sayısal21 Eşleştirme378 Sıralama173

A security engineer at a financial institution is establishing a patch and configuration management framework for dual-homed payment processing nodes. The environment requires continuous compliance enforcement against baseline images, strict change validation before production deployment, and protection against unauthorized system modifications. Which of the following strategies should the security engineer implement to maintain secure configuration baselines and control patch deployment risks? (Select TWO.)

Geçerli olan tümünü seçin

Utilize automated infrastructure-as-code configuration management tools to continuously audit system state and automatically remediate configuration drift back to approved baselines.

Staging patch updates in an isolated test environment and verifying cryptographic signature hashes prior to deploying updates into production.

Deploying network perimeter firewall filtering rules as a permanent substitute for applying critical operating system security patches.

Reclassifying host-based automated audit logging controls as preventive physical security mechanisms to satisfy compliance reporting mandates.

Cevabı ve açıklamayı göster

Cevap: Utilize automated infrastructure-as-code configuration management tools to continuously audit system state and automatically remediate configuration drift back to approved baselines.; Staging patch updates in an isolated test environment and verifying cryptographic signature hashes prior to deploying updates into production.

Cevap

The security engineer should utilize automated infrastructure-as-code tools to continuously audit and remediate configuration drift, and stage patch updates in an isolated environment while verifying cryptographic signature hashes before production deployment.

Automated infrastructure-as-code tools continuously validate system settings against established security baselines and automatically remediate configuration drift. Additionally, staging patches in an isolated environment combined with verifying cryptographic signatures prevents unstable or malicious update packages from compromising production systems.

Adım Adım Çözüm

Analyze configuration maintenance requirements

Identified the need for continuous drift detection and enforcement using automated configuration baselines.

Manual baseline auditing is ineffective in dynamic environments, making automated remediation via configuration management essential for eliminating drift.

Evaluate patch deployment risk mitigation controls

Selected pre-deployment staging and cryptographic hash verification.

Testing patches in staging prevents unexpected service outages, and verifying signature hashes guarantees patch integrity against tampering.

Assess distractor validity

Rejected using firewalls as permanent patch replacements and misclassifying control categories.

Firewalls do not remediate system code flaws, and mislabeling control types invalidates risk governance modeling.

Anahtar Kavram

Continuous baseline configuration enforcement and staged patch verification

Soru 1382Soru →

A security engineer at an e-commerce organization is investigating an alert indicating anomalous privileged activity on a production database cluster. The authentication and operational log snippet shows:

Parameter	Log Entry Details
Timestamp	2026-07-27T14:22:10Z
Account	admin_jsmith
Source IP	198.51.100.45 (External WAN)
Authentication	RADIUS with MFA (Success)
Executed Action	GRANT ALL PRIVILEGES ON customer_db TO temp_user;
Matched Policy	Default_Admin_Role

The organization's security policy mandates that all privileged administrative sessions on critical systems must be brokered exclusively through a Privileged Access Management (PAM) jump host with short-lived session checkout. Which of the following is the MOST effective operational control modification to prevent direct administrative command execution outside the PAM solution?

Reconfigure network access control lists and authorization policies to restrict administrative session initiation strictly to designated PAM jump host IP addresses.

Implement step-up multi-factor authentication to prompt the administrator for a secondary token prior to executing database privilege elevation statements.

Relocate the database cluster inside the internal corporate network perimeter and permit administrative commands originating from internal subnets.

Configure the Security Information and Event Management (SIEM) system to generate high-priority incident tickets for external administrative logins.

Cevabı ve açıklamayı göster

Cevap: Reconfigure network access control lists and authorization policies to restrict administrative session initiation strictly to designated PAM jump host IP addresses.

Cevap

Reconfigure network access control lists and authorization policies to restrict administrative session initiation strictly to designated PAM jump host IP addresses.

Enforcing network access control lists (ACLs) and restricting authorization rules so that administrative access is accepted only from designated PAM jump host IP addresses provides a preventive control. This ensures all privileged sessions are brokered, recorded, and managed according to enterprise IAM operational policy.

Adım Adım Çözüm

Analyze the log entries and identify the security policy violation.

The log shows a direct RADIUS-authenticated session executing privileged database commands from an external WAN IP address, bypassing the required PAM jump host.

Privileged access management policies require all administrative sessions to be brokered, audited, and isolated through a dedicated PAM proxy or jump server.

Evaluate the required security control type to eliminate direct access bypass.

Enforcing network-level Access Control Lists (ACLs) and authorization policies at the database listener layer ensures that only connections originating from the PAM jump host IP address are accepted for administrative accounts.

Preventive network and authorization controls stop unauthorized direct connections before session establishment occurs.

Anahtar Kavram

Privileged Access Management (PAM) Session Brokering & Enforcement

Soru 1383Soru →

A cybersecurity analyst is preparing to transport a seized, powered-off desktop computer from a remote branch office to the central digital forensics laboratory. Which of the following procedures must be performed to maintain the chain of custody and preserve physical evidence integrity during transit? (Select TWO.)

Geçerli olan tümünü seçin

Record the equipment serial numbers, transfer timestamps, and signatures of both the transferring and receiving custodians on a formal tracking form.

Place the hard drive in a tamper-evident anti-static bag and seal it prior to secure physical transport.

Power on the system at the remote office to calculate and log the baseline cryptographic hash of the primary storage partition before packing.

Apply full-disk encryption to the primary drive prior to shipping to protect sensitive data confidentiality during transit.

Cevabı ve açıklamayı göster

Cevap: Record the equipment serial numbers, transfer timestamps, and signatures of both the transferring and receiving custodians on a formal tracking form.; Place the hard drive in a tamper-evident anti-static bag and seal it prior to secure physical transport.

Cevap

Maintaining chain of custody and physical evidence integrity during transportation requires documenting all transfer details with custodian signatures on a formal tracking log and securing evidence inside sealed, tamper-evident anti-static packaging.

Chain of custody requires continuous tracking of evidence possession via detailed logs containing timestamps, serial numbers, and signatures. Physical evidence must also be packaged in sealed, tamper-evident, anti-static containers to guard against physical damage and tampering.

Adım Adım Çözüm

Identify chain of custody tracking requirements

Every physical transfer of digital evidence must record the date, time, unique identifiers (such as serial numbers), purpose of transfer, and signatures of both releasing and receiving custodians.

This establishes accountability and legally proves who had possession of the evidence at all times.

Identify physical evidence preservation standards

Physical components such as hard drives must be stored in tamper-evident anti-static bags to prevent electrostatic discharge damage and provide clear indicators of unauthorized access.

Ensuring physical protection prevents evidence contamination or damage during transit.

Evaluate prohibited modifications to original media

Actions that modify the drive contents (such as applying encryption) or boot the operating system directly (altering system logs/timestamps) corrupt original evidence.

Forensic evidence acquisition requires static bit-stream imaging using write-blocking technology in controlled lab settings, not live unblocked execution at a remote site.

Anahtar Kavram

Preserving chain of custody documentation and physical evidence integrity during transport

Soru 1384Soru →

A system administrator updates a cluster of web servers with an emergency software patch. Immediately after the update, users report that web applications hosted on those servers are failing to load. Which of the following actions should the administrator take FIRST to restore system functionality?

Execute the documented rollback plan to revert the servers to their known good baseline configuration.

Deploy network firewall rules to block incoming web traffic to the affected servers.

Reclassify the web server security policy from a preventive control to a detective control.

Run an automated vulnerability scan against the web servers to detect open network ports.

Cevabı ve açıklamayı göster

Cevap: Execute the documented rollback plan to revert the servers to their known good baseline configuration.

Cevap

Execute the documented rollback plan to revert the servers to their known good baseline configuration.

When a patch causes unexpected service outage or instability in production, the immediate action within configuration management is to execute a tested rollback plan to restore services to the last known good baseline.

Adım Adım Çözüm

Identify the immediate operational impact following the patch deployment.

The newly applied patch caused application instability and service disruption.

When a patch causes system failure, immediate operational recovery is required.

Initiate the emergency rollback procedures associated with the patch deployment plan.

The servers revert to the previously verified baseline state.

Rollback plans ensure rapid recovery to a stable configuration minimalizing downtime.

Anahtar Kavram

Rollback Planning and Configuration Baselines

Soru 1385Soru →

An organization is onboarding a third-party cloud service provider to support its customer support operations. To ensure accountability, the security team must document measurable performance targets, such as minimum uptime requirements and incident response timeframes. Which of the following agreements should be established with the provider to define these operational metrics?

Service Level Agreement (SLA)

Non-Disclosure Agreement (NDA)

Memorandum of Understanding (MOU)

Interconnection Security Agreement (ISA)

Cevabı ve açıklamayı göster

Cevap: Service Level Agreement (SLA)

Cevap

Service Level Agreement (SLA)

A Service Level Agreement (SLA) is specifically designed to set measurable operational targets, including uptime guarantees, availability expectations, and incident response windows for vendor services.

Adım Adım Çözüm

Identify the core operational requirement from the scenario

The requirement is to formalize measurable targets for service availability, system uptime, and incident response windows.

Third-party risk management relies on distinct agreements depending on whether the requirement involves confidentiality, joint operational intent, technical connectivity, or performance guarantees.

Select the appropriate third-party agreement type

A Service Level Agreement (SLA) directly establishes concrete metrics such as 99.9% uptime, maximum allowable latency, and response time thresholds.

SLAs provide objective criteria for evaluating vendor performance and enforcing contractual remedies if targets are missed.

Anahtar Kavram

Third-Party Risk Agreements - Service Level Agreement (SLA)

Soru 1386Soru →

An organization purchases a comprehensive cybersecurity insurance policy to cover financial losses that may result from potential data breaches. Which of the following risk response strategies is the organization implementing?

Risk transfer

Risk avoidance

Risk mitigation

Risk acceptance

Cevabı ve açıklamayı göster

Cevap: Risk transfer

Cevap

Risk transfer is the strategy of shifting potential risk and financial liability to a third party, such as through cybersecurity insurance.

Risk transfer is executed when an organization shares or shifts the responsibility for risk management and financial burden to an external third party. Obtaining a cyber insurance policy is a textbook example of transferring financial liability.

Adım Adım Çözüm

Identify the primary action taken by the organization in the scenario.

The organization purchased a cybersecurity insurance policy to handle financial loss.

Determining the core action establishes how risk is being handled.

Map the action to formal risk response options.

Purchasing insurance moves the financial impact to a third-party insurer.

Sharing or moving financial liability to another entity is defined as risk transfer.

Anahtar Kavram

Risk Response Strategies (Risk Transfer)

Soru 1387Soru →

A security analyst is triaging log files collected by a SIEM system across web applications, authentication servers, and system logs. Match each log snippet on the left to the corresponding security event or attack vector on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

The HTTP snippet containing 'UNION SELECT' matches SQL Injection; the repeated SSH failed authentication log matches SSH Brute-Force; Windows Event ID 4624 with Logon Type 10 matches RDP Interactive Session; and the HTTP request with '../../' sequences matches Directory/Path Traversal.

Each log entry displays distinct forensic indicators: 'UNION SELECT' points directly to SQL injection; repeated SSH authentication failures indicate brute-force attempts; Windows Event 4624 with Logon Type 10 marks remote interactive RDP logons; and dot-dot-slash patterns indicate path traversal attempts.

Adım Adım Çözüm

Analyze Web Application Logs

Identified SQL query keywords ('UNION SELECT') in the query string of the first log entry and directory navigation dot-dots ('../../') in the fourth entry.

Web logs reveal application-level attacks targeting backend databases or sensitive file paths.

Analyze Linux Authentication Logs

Identified high-frequency failed password entries for SSH targeting administrative users from an external IP.

Syslog authentication events with high frequency from single sources characterize automated password guessing.

Analyze Windows Event Logs

Correlated Event ID 4624 (Successful Logon) with Logon Type 10.

Logon Type 10 is reserved for RemoteInteractive connections such as RDP, distinguishing it from local (Type 2) or network share (Type 3) logons.

Anahtar Kavram

Log Telemetry Analysis and Threat Identification

Soru 1388Soru →

A Security Operations Center (SOC) is designing an automated Security Orchestration, Automation, and Response (SOAR) workflow to handle high-severity alerts triggered when an Amazon S3 storage bucket hosting confidential customer data is modified to allow public read access. The playbook must rapidly mitigate public data exposure while ensuring operational continuity for legitimate internal microservices that depend on the bucket. Which TWO of the following design choices should be incorporated into the automated response playbook to achieve effective containment without causing catastrophic service disruption?

Geçerli olan tümünü seçin

Configure an automated playbook action to invoke cloud API webhooks that immediately apply an explicit 'Block Public Access' policy to the bucket while leaving authenticated IAM roles intact.

Program the playbook to automatically delete the bucket and its objects immediately upon alert ingestion to guarantee zero unauthorized external data egress.

Include an automated enrichment step that queries cloud audit logs for recent policy change events and appends access metadata to the incident ticket prior to triggering analyst notifications.

Deploy an inline endpoint intrusion prevention system (IPS) agent directly onto the cloud object storage service to dynamically filter incoming public HTTP requests.

Cevabı ve açıklamayı göster

Cevap: Configure an automated playbook action to invoke cloud API webhooks that immediately apply an explicit 'Block Public Access' policy to the bucket while leaving authenticated IAM roles intact.; Include an automated enrichment step that queries cloud audit logs for recent policy change events and appends access metadata to the incident ticket prior to triggering analyst notifications.

Cevap

The correct playbook design choices are to invoke cloud API webhooks that apply an explicit public access block to the S3 bucket while preserving authenticated IAM access, and to include automated enrichment that queries cloud audit logs for policy change events to context-enrich the incident ticket.

The correct options properly balance rapid automated containment with operational safety and forensic enrichment. Utilizing API webhooks to apply a public access block neutralizes the misconfiguration immediately without invalidating internal IAM roles required by microservices. Simultaneously, automating the retrieval of audit log metadata provides essential context to responders without delaying containment.

Adım Adım Çözüm

Evaluate containment mechanisms for object storage exposure.

Identified that applying an explicit public block via API webhooks surgically eliminates internet exposure without disrupting internal IAM-authenticated services.

Containment actions in SOAR playbooks must isolate the threat vector without breaking production dependencies.

Assess the role of context enrichment in automated incident workflows.

Determined that gathering recent API audit log trails automatically enriches the ticket with attacker/user context for effective analyst triage.

SOAR platforms excel at aggregating threat intelligence and log metadata before escalating to human responders.

Analyze distractor containment and control options for operational risk and technical feasibility.

Rejected bucket deletion due to severe operational damage and rejected host IPS agent installation due to the architectural reality of cloud object storage services.

Automated playbooks must avoid destructive actions on production data assets and must respect cloud platform control boundaries.

Anahtar Kavram

SOAR Playbook Containment Logic and Context Enrichment

Soru 1389Soru →

An enterprise security analyst is performing a quantitative risk assessment for a high-availability identity authentication cluster with an asset value ( $AV$ ) of $\$1,200,000$ . Threat intelligence data indicates an identity spoofing threat with an annual rate of occurrence ( $ARO$ ) of $0.50$ and an exposure factor ( $EF$ ) of $0.30$ . The organization plans to implement an inline Hardware Security Module (HSM) safeguard costing $\$25,000$ per year, which will reduce the $EF$ to $0.05$ while keeping the $ARO$ constant at $0.50$ . Additionally, to address potential physical facility damage to the datacenter, the organization purchases a third-party commercial insurance policy. Which of the following statements accurately evaluate the risk metrics and risk response strategies in this scenario? (Select TWO.)

Geçerli olan tümünü seçin

The pre-control Annual Loss Expectancy (

ALE

) for the identity spoofing threat is

\$180,000

, and the post-control

ALE

after implementing the HSM cluster is

\$30,000

Purchasing the commercial insurance policy for datacenter facility risks represents a risk transfer strategy.

The Single Loss Expectancy (

SLE

) of the identity spoofing threat prior to HSM deployment is

\$600,000

Purchasing the commercial insurance policy represents a risk avoidance strategy that eliminates the underlying physical facility threat vector.

Cevabı ve açıklamayı göster

Cevap: The pre-control Annual Loss Expectancy ( $ALE$ ) for the identity spoofing threat is $\$180,000$ , and the post-control $ALE$ after implementing the HSM cluster is $\$30,000$ .; Purchasing the commercial insurance policy for datacenter facility risks represents a risk transfer strategy.

Cevap

The pre-control

ALE

\$180,000

and post-control

ALE

\$30,000

, while purchasing the commercial insurance policy represents a risk transfer strategy.

Calculating pre-control

ALE

yields

1,200,000 \times 0.30 \times 0.50 = \$180,000

, and post-control

ALE

yields

1,200,000 \times 0.05 \times 0.50 = \$30,000

. Furthermore, purchasing commercial insurance explicitly transfers financial liabilities of datacenter losses to an insurance provider, satisfying the definition of risk transfer.

Adım Adım Çözüm

Calculate pre-control Single Loss Expectancy (

SLE

) and Annual Loss Expectancy (

ALE

SLE_{pre} = AV \times EF_{pre} = \$1,200,000 \times 0.30 = \$360,000

ALE_{pre} = SLE_{pre} \times ARO = \$360,000 \times 0.50 = \$180,000

Establishing baseline financial loss potential before safeguard deployment.

Calculate post-control Single Loss Expectancy (

SLE

) and Annual Loss Expectancy (

ALE

SLE_{post} = AV \times EF_{post} = \$1,200,000 \times 0.05 = \$60,000

ALE_{post} = SLE_{post} \times ARO = \$60,000 \times 0.50 = \$30,000

Evaluating residual loss exposure after applying the HSM control.

Classify the risk response strategy associated with purchasing commercial insurance.

Purchasing commercial insurance shifts financial exposure to a third party, which defines Risk Transfer.

Distinguishing between risk response options (Acceptance, Avoidance, Mitigation, Transfer).

Anahtar Kavram

Quantitative Risk Assessment Metrics (SLE, ARO, ALE) and Risk Response Classification

Soru 1390Soru →

An enterprise organization is deploying a native mobile application that connects to cloud-hosted REST APIs. The mobile client runs in an untrusted environment where embedded client secrets cannot be kept confidential. Which of the following identity and access management architecture components should the security architect implement to securely authorize the mobile application while mitigating authorization code interception attacks?

OAuth 2.0 Authorization Code Grant with Proof Key for Code Exchange (PKCE)

OAuth 2.0 Implicit Grant with hardcoded API keys for client identification

Static API key authentication combined with internal IP address whitelisting

HTTP Basic Authentication wrapped inside a Role-Based Access Control (RBAC) policy

Cevabı ve açıklamayı göster

Cevap: OAuth 2.0 Authorization Code Grant with Proof Key for Code Exchange (PKCE)

Cevap

OAuth 2.0 Authorization Code Grant with Proof Key for Code Exchange (PKCE)

OAuth 2.0 Authorization Code Grant with PKCE is specifically designed to secure public clients (such as mobile apps and single-page apps) that cannot safely maintain a confidential client secret. By creating a unique code verifier and transformed code challenge for each request, the authorization server verifies that the entity redeeming the code is the exact client instance that requested it.

Adım Adım Çözüm

Analyze client constraints

The target application is a public native mobile client, meaning embedded client secrets cannot be securely stored.

Public clients can be decompiled or inspected by attackers to extract static credentials.

Evaluate risk profile for authorization code flow

Standard Authorization Code Grant requires a client secret, making public clients vulnerable to code interception attacks if secrets are omitted or exposed.

Malicious applications on the mobile device can register custom URI schemes and intercept the authorization code returned by the authorization server.

Select appropriate IAM protocol extension

Proof Key for Code Exchange (PKCE) replaces static secrets with a dynamically generated secret key pair (code_verifier and code_challenge) per request.

This guarantees that only the application instance that initiated the request can exchange the intercepted authorization code for an access token.

Anahtar Kavram

Public Client Token Exchange and PKCE Architecture

Tahmini Süre:1m 30s

Soru 1391Soru →

Match each third-party risk management agreement type on the left with its correct operational description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Service Level Agreement matches performance metrics and uptime guarantees; Non-Disclosure Agreement matches legal confidentiality obligations; Memorandum of Understanding matches mutual intent for collaboration; Interconnection Security Agreement matches technical security requirements for network connections.

Each agreement serves a distinct governance or operational role: Service Level Agreements (SLAs) enforce performance and availability guarantees; Non-Disclosure Agreements (NDAs) enforce confidentiality of sensitive shared data; Memorandums of Understanding (MOUs) document informal or general cooperative goals between organizations; and Interconnection Security Agreements (ISAs) govern the technical security requirements for inter-organizational system connections.

Adım Adım Çözüm

Identify the purpose of each legal and operational agreement used in third-party risk management.

Categorize each agreement by its focus: performance metrics (SLA), privacy/confidentiality (NDA), general collaboration (MOU), or technical connectivity (ISA).

Different third-party agreements address different aspects of governance, legal protection, operational performance, and technical integration.

Match each agreement term to its corresponding definition based on security governance standards.

Pairing SLA with uptime/performance metrics, NDA with confidentiality, MOU with mutual intent/collaboration, and ISA with technical network interconnection parameters.

Accurate pairing ensures correct understanding of third-party contract oversight and compliance.

Anahtar Kavram

Third-Party Agreements and Governance Frameworks

Soru 1392Soru →

A risk analyst is conducting a quantitative risk assessment for a database server hosting core enterprise operational data. The Asset Value ( $AV$ ) of the server is established at $\$500,000$ . Threat intelligence data indicates that a major ransomware incident targeting this database occurs approximately once every 5 years. Financial modeling determines that the Annual Loss Expectancy ( $ALE$ ) for this threat scenario is $\$25,000$ . Based on these quantitative metrics, what is the Exposure Factor ( $EF$ ) associated with a single ransomware incident?

25%

20%

80%

Cevabı ve açıklamayı göster

Cevap: 25%

Cevap

The Exposure Factor (EF) associated with a single ransomware incident is 25%.

The Exposure Factor (

EF

) measures the percentage of an asset destroyed or damaged during a single threat occurrence. Given

ALE = \$25,000

and

ARO = 0.20

(once every 5 years), the Single Loss Expectancy (

SLE

) is

\$25,000 / 0.20 = \$125,000

. Dividing

SLE

by the total Asset Value (

AV = \$500,000

) gives

EF = \$125,000 / \$500,000 = 0.25

, or 25%.

Adım Adım Çözüm

Calculate the Annual Rate of Occurrence (ARO)

ARO = \frac{1}{\text{5 years}} = 0.20

The event occurs once every 5 years, giving an annual frequency of 0.20.

Calculate the Single Loss Expectancy (SLE) from ALE and ARO

SLE = \frac{ALE}{ARO} = \frac{\$25,000}{0.20} = \$125,000

Since

ALE = SLE \times ARO

, dividing

ALE

ARO

yields the expected monetary loss per single incident.

Calculate the Exposure Factor (EF)

EF = \frac{SLE}{AV} = \frac{\$125,000}{\$500,000} = 0.25 \text{ or } 25\%

The Exposure Factor represents the percentage of asset value lost during a single realization of a risk (

SLE = AV \times EF

Anahtar Kavram

Quantitative Risk Assessment Metrics (ALE, SLE, ARO, EF)

Soru 1393Soru →

Match each enterprise identity and access management (IAM) protocol or standard on the left with its primary architectural function on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

OAuth 2.0 matches API authorization delegation; OpenID Connect matches the OAuth 2.0 identity/authentication layer; SAML 2.0 matches XML-based federated Web SSO; SCIM matches automated identity provisioning.

Each protocol serves a distinct architectural purpose in modern enterprise IAM systems: OAuth 2.0 handles delegated API access control, OIDC provides modern OAuth-based user authentication, SAML 2.0 delivers traditional XML-based federated web SSO, and SCIM automates identity lifecycle management and provisioning across cloud and on-premises directories.

Adım Adım Çözüm

Differentiate authentication vs. authorization frameworks.

Identify OAuth 2.0 as strictly authorization/delegation, and OIDC as the identity authentication extension.

OAuth 2.0 alone provides access tokens for API authorization, whereas OIDC adds ID tokens for user authentication.

Identify web federation formats.

Match SAML 2.0 to XML-based security assertions.

SAML 2.0 is the legacy enterprise XML standard for cross-domain SSO federations between IdPs and SPs.

Identify identity lifecycle management standards.

Match SCIM to automated cross-domain user provisioning.

SCIM uses standardized REST endpoints and JSON payloads to sync user account states across systems.

Anahtar Kavram

Enterprise IAM Architectural Protocols & Standards

Soru 1394Soru →

During an ongoing internal incident investigation, a security analyst suspects that a logged-in workstation is currently running an active malicious process in memory that is exfiltrating sensitive database records to an external server. The system is powered on and connected to the local network. To ensure maximum evidentiary value and legal admissibility for potential prosecution, which of the following actions should the analyst take FIRST?

Capture the system's volatile memory (RAM) using an approved live acquisition tool before powering off or disconnecting the device.

Immediately disconnect the power cable to freeze the current disk state and prevent further remote data exfiltration.

Perform a full bit-stream disk clone of the primary storage drive before capturing any system memory artifacts.

Export the system's security event logs to a remote network share to establish non-repudiation of user authentication.

Cevabı ve açıklamayı göster

Cevap: Capture the system's volatile memory (RAM) using an approved live acquisition tool before powering off or disconnecting the device.

Cevap

Capturing the system's volatile memory (RAM) using an approved live acquisition tool before taking any action that modifies the system state.

According to standard digital forensics guidelines and RFC 3227 (Order of Volatility), evidence must be gathered starting from the most volatile items to the least volatile items. Active system memory (RAM) containing execution stacks, network connections, and unencrypted keys is highly perishable and must be preserved prior to powering down or performing disk-level imaging.

Adım Adım Çözüm

Evaluate the current operational state of the compromised host system.

The target computer is powered on with active processes running in system memory.

Understanding host state determines which artifacts are most volatile and at risk of immediate loss.

Apply the Order of Volatility principles to sequence evidence acquisition.

System memory (RAM) and active cache/registers take priority over non-volatile hard disk storage and remote logs.

Volatile data disappears when the device loses power or shuts down, whereas disk data persists across reboots.

Execute live memory capture using an authorized forensic acquisition tool.

A cryptographically hashed RAM dump file is preserved for forensic analysis.

This captures the running malicious process, injected code, and active network connections without destroying evidence.

Anahtar Kavram

Order of Volatility in Digital Forensics

Soru 1395Soru →

A Chief Information Security Officer (CISO) is structuring an organization's governance framework. The CISO needs to clearly differentiate between binding organizational rules and discretionary advice. Which of the following governance document types establish MANDATORY requirements that personnel or technical systems must follow? (Select TWO).

Geçerli olan tümünü seçin

Security Policies

Security Standards

Security Guidelines

Security Control Categories

Cevabı ve açıklamayı göster

Cevap: Security Policies; Security Standards

Cevap

Security Policies and Security Standards establish mandatory compliance requirements within an enterprise governance hierarchy.

In security governance, Security Policies serve as mandatory high-level statements of management intent that direct user conduct and organizational security expectations. Security Standards set specific, mandatory requirements (such as technical requirements or operational constraints) that systems and users must adhere to without exception.

Adım Adım Çözüm

Identify the compliance obligation of each document type in the governance hierarchy.

Policies and Standards are mandatory directives, whereas Guidelines are discretionary.

Governance frameworks separate mandatory directives (Policies, Standards, Baselines, Procedures) from optional recommendations (Guidelines).

Select all option choices that represent binding, mandatory governance documents.

Security Policies and Security Standards are selected.

Security Policies set management intent and mandatory rules across the enterprise, while Security Standards enforce mandatory specific technology choices and baseline requirements.

Anahtar Kavram

Distinction between mandatory compliance documents (Policies, Standards) and discretionary governance materials (Guidelines).

Soru 1396Soru →

A Security Operations Center (SOC) analyst is investigating SIEM alert correlation logs for an internal endpoint with IP address 10.0.4.112. The log collector correlates recursive DNS resolver logs with outbound NetFlow records as shown below:

2026-07-27T11:02:14Z DNS_RESOLV src=10.0.4.112 qtype=TXT qname=a9f1b.data-sync-update.com rcode=NOERROR rdata="ZXhoYWlsZV9jMg=="
2026-07-27T11:03:14Z DNS_RESOLV src=10.0.4.112 qtype=TXT qname=c3k8p.data-sync-update.com rcode=NOERROR rdata="dHJhbnNtaXRfZGF0YQ=="
2026-07-27T11:04:14Z DNS_RESOLV src=10.0.4.112 qtype=TXT qname=e7m2q.data-sync-update.com rcode=NOERROR rdata="Y29tbWFuZF9hY2s=
2026-07-27T11:04:15Z NETFLOW_OUT src=10.0.4.112:49812 dst=203.0.113.88:443 bytes=148200 proto=TCP flags=ACK,PSH

Which of the following findings accurately interpret these network security monitoring logs and represent effective mitigation steps? (Select TWO.)

Geçerli olan tümünü seçin

The pattern of periodic DNS TXT queries with encoded subdomain prefixes indicates DNS tunneling used for command-and-control (C2) communication or data staging.

Configuring DNS sinkholing or Response Policy Zone (RPZ) rules on the local recursive resolver provides immediate containment by blocking resolution of the malicious domain.

The log telemetry demonstrates a client-side Cross-Site Scripting (XSS) attack vector attempting to manipulate local database records via HTTP GET parameters.

Deploying a stateful host-based firewall rule to block all inbound UDP port 53 traffic to endpoint 10.0.4.112 is the primary control to prevent outgoing DNS queries.

Cevabı ve açıklamayı göster

Cevap: The pattern of periodic DNS TXT queries with encoded subdomain prefixes indicates DNS tunneling used for command-and-control (C2) communication or data staging.; Configuring DNS sinkholing or Response Policy Zone (RPZ) rules on the local recursive resolver provides immediate containment by blocking resolution of the malicious domain.

Cevap

The telemetry indicates DNS tunneling for command-and-control (C2) beaconing, which is best contained by implementing DNS sinkholing or Response Policy Zone (RPZ) rules.

The correct options accurately identify the threat as DNS tunneling and select the appropriate remediation. DNS tunneling encodes binary command strings into DNS subdomains and TXT record responses, providing a covert C2 channel over standard port 53 traffic. DNS sinkholing (or RPZ) is the primary containment strategy because it intercepts resolution attempts for the adversary-controlled domain at the recursive resolver level.

Adım Adım Çözüm

Analyze the DNS protocol behavior and query characteristics.

Identified high-frequency, randomized subdomain queries under a single domain (data-sync-update.com) requesting TXT records containing Base64-encoded strings at strict 60-second intervals.

Covert channels like DNS tunneling encode payload data into DNS subdomains or record fields to bypass perimeter firewall inspection.

Correlate DNS telemetry with outbound flow logs.

Confirmed outbound TCP connection spikes immediately following successful DNS TXT query responses.

The C2 agent receives instructions via DNS TXT record payloads and establishes secondary egress connections based on received commands.

Evaluate appropriate network monitoring containment strategies.

Select DNS sinkholing / Response Policy Zones (RPZ) at the internal resolver layer.

Sinkholing prevents the compromised host from resolving malicious C2 domains, isolating the host from external adversary control while logging blocked connection attempts.

Anahtar Kavram

DNS Tunneling Detection and DNS Sinkholing Mitigation

Tahmini Süre:2m 0s

Soru 1397Soru →

During a comprehensive governance realignment, a Chief Risk Officer (CRO) audits an organization's information security documentation structure. The audit reveals that operational teams frequently confuse discretionary advice with mandatory technical requirements, leading to inconsistent security controls across business units. To establish rigid governance boundaries across the enterprise, the CRO restructures the document architecture. Which of the following statements accurately characterize the structural hierarchy, mandatory nature, and operational scope of these security governance documents? (Select THREE).

Geçerli olan tümünü seçin

Security Policies serve as high-level, executive-approved directives that establish organizational security intent and management commitment, whereas Standards define mandatory technical specifications required to enforce those policies.

Security Baselines establish mandatory minimum-security configurations for specific asset classes, while Guidelines offer discretionary recommendations and operational flexibility.

Security Guidelines represent mandatory operational directives issued by technical custodians that system administrators must execute without exception during system deployment.

Security Procedures serve primarily as strategic, high-level detective controls that establish overall corporate risk appetite rather than step-by-step operational workflows.

Procedures provide mandatory, step-by-step instructions that operational personnel must follow sequentially to ensure consistent task execution aligned with enterprise standards.

Cevabı ve açıklamayı göster

Cevap: Security Policies serve as high-level, executive-approved directives that establish organizational security intent and management commitment, whereas Standards define mandatory technical specifications required to enforce those policies.; Security Baselines establish mandatory minimum-security configurations for specific asset classes, while Guidelines offer discretionary recommendations and operational flexibility.; Procedures provide mandatory, step-by-step instructions that operational personnel must follow sequentially to ensure consistent task execution aligned with enterprise standards.

Cevap

The correct statements are those identifying Policies as top-level executive directives supported by mandatory technical Standards, Baselines as mandatory minimum configurations distinct from discretionary Guidelines, and Procedures as mandatory step-by-step operational instructions.

In security governance, Policies provide high-level mandatory executive management directives, supported by mandatory technical Standards. Baselines enforce mandatory uniform technical settings across asset types, while Guidelines offer non-mandatory advisory best practices. Procedures supply the explicit, step-by-step instructions operational teams must follow to satisfy standards.

Adım Adım Çözüm

Analyze the policy hierarchy top layer (Policies and Standards)

Policies define high-level strategic objectives approved by executive leadership, while Standards define mandatory, measurable technical or operational rules required to achieve policy compliance.

Governance frameworks establish a strict chain of authority from strategic intent down to mandatory technical controls.

Evaluate technical configuration baselines versus advisory guidelines

Baselines set the mandatory minimum hardening standards for operating systems and devices, whereas Guidelines provide non-mandatory best practices and recommendations.

Distinguishing mandatory baselines from discretionary guidelines is essential to prevent operational ambiguity.

Examine operational workflow execution documents (Procedures)

Procedures are step-by-step operational documents detailing exact sequential tasks personnel must execute to meet standards and baselines.

Procedures ensure operational repeatability and procedural compliance across technical teams.

Synthesize and validate the correct options

The options describing Policy/Standard alignment, Baseline/Guideline distinction, and mandatory sequential Procedures accurately represent the governance framework.

Incorrect choices misclassify optional guidelines as mandatory directives or misrepresent operational procedures as strategic risk appetite declarations.

Anahtar Kavram

Security Governance Documentation Hierarchy (Policy, Standard, Baseline, Guideline, Procedure)

Soru 1398Soru →

A security analyst is recommending controls to address vulnerabilities discovered during a recent internal security review. Which of the following security actions represent examples of Risk Mitigation? (Select TWO.)

Geçerli olan tümünü seçin

Applying security updates and software patches to eliminate known operating system vulnerabilities.

Purchasing a comprehensive cyber liability insurance policy to cover potential breach financial losses.

Installing network intrusion prevention systems (IPS) to detect and block malicious traffic targeting internal servers.

Disabling and taking offline an unsupported web application to completely eliminate its associated attack surface.

Cevabı ve açıklamayı göster

Cevap: Applying security updates and software patches to eliminate known operating system vulnerabilities.; Installing network intrusion prevention systems (IPS) to detect and block malicious traffic targeting internal servers.

Cevap

Risk Mitigation involves taking specific actions or deploying controls to reduce the probability or impact of a threat. Applying software patches and installing an Intrusion Prevention System (IPS) are both mitigation techniques.

Risk mitigation involves implementing controls and safeguards to lower the likelihood or impact of a security event while continuing the operational activity. Applying software patches closes known security holes, reducing vulnerability likelihood. Deploying an Intrusion Prevention System (IPS) actively blocks malicious activity, reducing risk impact and probability.

Adım Adım Çözüm

Define Risk Mitigation

Identify that mitigation focuses on reducing risk likelihood or impact via controls and safeguards.

Risk mitigation aims to lessen the overall risk score without necessarily eliminating the underlying activity or transferring responsibility.

Evaluate option actions against risk response definitions

Patching systems reduces vulnerability exposure (Mitigation). Deploying an IPS blocks network attacks (Mitigation). Buying insurance shifts financial liability (Transfer). Decommissioning systems removes the risk source completely (Avoidance).

Categorizing each action clarifies which responses alter risk exposure directly through control implementation.

Anahtar Kavram

Risk Response Strategies (Mitigation vs. Transfer vs. Avoidance)

Tahmini Süre:45s

Soru 1399Soru →

A Security Operations Center (SOC) analyst is reviewing the following syslog sequence captured from a Linux bastion server:

Jul 27 14:15:02 sec-srv01 sshd[18420]: Failed password for invalid user admin from 198.51.100.45 port 42102 ssh2
Jul 27 14:15:05 sec-srv01 sshd[18422]: Failed password for invalid user admin from 198.51.100.45 port 42108 ssh2
Jul 27 14:15:09 sec-srv01 sshd[18425]: Failed password for valid user devops from 198.51.100.45 port 42115 ssh2
Jul 27 14:15:14 sec-srv01 sshd[18429]: Accepted publickey for devops from 198.51.100.45 port 42122 ssh2 RSA SHA256:7b+x...

Based on these log entries, which of the following events has occurred?

An external IP performed user enumeration and password attempts before successfully authenticating to a valid account using an SSH key pair.

The devops account successfully authenticated via public key and was automatically granted elevated administrative authorization on the local operating system.

The server blocked a SQL injection authentication bypass attack targeted against the local user database.

The log sequence represents a continuous network drop by the perimeter firewall due to invalid port assignments.

Cevabı ve açıklamayı göster

Cevap: An external IP performed user enumeration and password attempts before successfully authenticating to a valid account using an SSH key pair.

Cevap

An external IP performed user enumeration and password attempts before successfully authenticating to a valid account using an SSH key pair.

The log sequence demonstrates an initial set of failed password authentication attempts from IP address 198.51.100.45 targeting invalid accounts ('admin') and a valid account ('devops'). The final entry shows a successful logon for the user 'devops' using an SSH RSA public key from the same source IP.

Adım Adım Çözüm

Analyze the log entries sequentially by timestamp and event message.

Entries show repeated failed password attempts from IP 198.51.100.45 for both non-existent ('admin') and existing ('devops') accounts.

Tracking account names and failure statuses identifies initial password guessing or account scanning behavior.

Evaluate the final log entry in the sequence.

The final entry records 'Accepted publickey for devops' from the same IP address.

This confirms successful identity verification using SSH key authentication following the failed password attempts.

Anahtar Kavram

SSH Authentication Telemetry and Log Analysis

Soru 1400Soru →

An enterprise Endpoint Detection and Response (EDR) agent detects an unauthorized process attempting to read sensitive memory structures from the Local Security Authority Subsystem Service (LSASS) on a finance system host. In what sequence should the automated EDR response workflow process this security event from initial containment to post-incident analysis?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins with detecting anomalous process behavior, followed by isolating the host via the EDR agent, terminating malicious processes and quarantining artifacts, and concludes with gathering forensic telemetry for fleet-wide IoC threat hunting.

The workflow follows standard EDR incident response methodology: first detect the malicious behavioral attempt on the endpoint, isolate the host to restrict lateral movement, kill malicious processes and quarantine binary components, and finally gather forensic telemetry to hunt for Indicators of Compromise (IoCs) enterprise-wide.

Adım Adım Çözüm

Behavioral Alert Triggering

The EDR agent flags the LSASS memory access attempt as a high-severity alert.

Detection forms the entry point for automated incident playbooks.

Host Containment & Isolation

Network traffic to and from the host is restricted except for the security agent control server.

Isolating the endpoint prevents the attacker from utilizing dumped credentials laterally while investigation proceeds.

Active Mitigation & Artifact Quarantine

The rogue process handle is killed and file modifications are moved to secure quarantine.

Terminating process handles halts local code execution after network propagation risk is mitigated.

Forensic Telemetry & Fleet Hunting

Memory state telemetry is collected and IOC hashes are searched across all endpoints.

Broad threat hunting ensures the adversary has not established duplicate persistence on adjacent hosts.

Anahtar Kavram

Endpoint Detection and Response (EDR) Automated Containment and Remediation Workflow

ÖncekiSayfa 70 / 112Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram