Examkin

Tüm alıştırma soruları

2232 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 141Soru →

An enterprise Security Operations Center (SOC) identifies anomalous database queries originating from an authenticated SSL/TLS VPN remote user session outside of normal business hours. Place the following incident response actions in the correct chronological order from first step to last step according to the standard NIST Incident Response Lifecycle.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological sequence according to the NIST Incident Response Lifecycle is: 1. Analyze logs and correlate alerts (Detection and Analysis), 2. Terminate VPN sessions and isolate database servers (Containment), 3. Revoke compromised credentials and remove persistence mechanisms (Eradication), 4. Restore systems from clean backups and enforce MFA reset (Recovery), and 5. Conduct a post-incident review meeting to update playbooks (Post-Incident Activity).
Standard incident response frameworks (such as NIST SP 800-61 Rev. 2) define a sequential lifecycle: Detection & Analysis, Containment, Eradication, Recovery, and Post-Incident Activity. Security teams must first validate indicators to establish scope (Detection & Analysis), immediately restrict attacker access and isolate affected assets (Containment), eliminate threat artifacts and vulnerabilities (Eradication), restore systems to production under secure conditions (Recovery), and finally document lessons learned to improve playbooks (Post-Incident Activity).

Adım Adım Çözüm

1
Identify Detection and Analysis activities
Analyzing VPN logs and SIEM data verifies the unauthorized access and determines the scope of compromise.
Responders must validate that a security incident has occurred and understand its footprint prior to executing operational containment.
2
Identify Containment activities
Terminating active connections and isolating hosts halts active malicious actions and prevents network spread.
Containment limits operational damage while security personnel plan and execute permanent threat eradication.
3
Identify Eradication activities
Revoking compromised tokens, removing backdoor mechanisms, and applying security patches eliminates the adversary's presence.
Eradication removes the root cause so affected hosts can be re-introduced to production safely.
4
Identify Recovery activities
Restoring database systems from known-good backups and re-enabling access brings business operations back online.
Recovery validates system integrity and resumes normal business capabilities under enhanced monitoring.
5
Identify Post-Incident Activity
Conducting a debrief session and updating playbooks documents response efficacy and lessons learned.
Post-incident review improves operational readiness and updates incident response playbooks for future events.

Anahtar Kavram

NIST SP 800-61 Incident Response Lifecycle Phases
Tahmini Süre:1m 30s
Soru 142Soru →

A security engineer is configuring a Service Provider-initiated SAML 2.0 Single Sign-On (SSO) integration between an enterprise SaaS application (Service Provider) and an external cloud Identity Provider (IdP) with mandatory MFA. In what order should the steps occur to complete a secure authentication and access flow?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins with the user requesting access at the Service Provider, followed by the SP generating a SAML AuthnRequest and redirecting the browser to the Identity Provider. Next, the IdP authenticates the user credentials and MFA challenge. After authentication succeeds, the IdP sends a signed SAML response to the SP Assertion Consumer Service endpoint. Finally, the SP validates the signature and token claims before creating the local session.
In a Service Provider (SP)-initiated SAML 2.0 Single Sign-On sequence, the workflow must start at the resource endpoint (SP), redirect to the identity repository (IdP) for credential and MFA verification, return a signed SAML assertion token to the Assertion Consumer Service (ACS) endpoint, and end with cryptographic validation and local session establishment by the SP.

Adım Adım Çözüm

1
Identify the initiation point for Service Provider (SP)-initiated SSO
The unauthenticated client request to the application triggers the creation of a SAML AuthnRequest payload.
In SP-initiated flows, access attempts at the target application must precede redirection.
2
Trace the HTTP redirect sequence
The user's browser transfers the AuthnRequest parameter to the IdP endpoint.
The browser acts as the user-agent bridge carrying authentication requests between decoupled domains.
3
Perform centralized identity verification and policy enforcement
The IdP processes primary credentials and enforces secondary MFA challenges.
Authentication and policy evaluation take place entirely on the trusted Identity Provider.
4
Return the signed security token via browser redirect/POST
The IdP constructs a SAML assertion signed with its private key and sends it to the SP Assertion Consumer Service (ACS).
The ACS endpoint is designed to receive and parse federated identity assertions.
5
Validate cryptographic trust and grant local application authorization
The SP checks the IdP's public certificate signature, expiration timestamps, and recipient claims before granting access.
Verification prevents SAML response spoofing and token replay attacks.

Anahtar Kavram

SAML 2.0 SP-Initiated SSO Authentication Flow
Soru 143Soru →

An enterprise web application experienced an unrecoverable infrastructure failure at its primary facility. The incident response team must execute the disaster recovery plan to activate the secondary warm site and minimize service disruption. In what chronological order should the administrator execute the following steps to complete the failover securely while preserving data integrity?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with declaring the disaster, followed by applying pending transaction logs to reach RPO consistency, promoting the standby database replica to read-write mode, running synthetic validation health checks, and finally updating external DNS records to route user traffic.
The proper disaster recovery sequence balances data protection with operational availability. First, formal disaster declaration initiates the procedure. Second, pending database logs are applied to guarantee data integrity up to the defined RPO. Third, the database replica is promoted to read-write primary status. Fourth, health and security validation checks verify system integrity. Fifth, external DNS records are redirected to route live client traffic to the secondary facility.

Adım Adım Çözüm

1
Initiate administrative failover authorization
Disaster declaration triggers authorized BCP workflows.
Technical failover tasks should not begin without official management invocation of the plan.
2
Reconcile database logs to satisfy RPO
Outstanding transaction logs are fully committed to the standby instance.
Ensures no data loss occurs prior to promoting the database instance.
3
Promote database instance role
Standby database becomes the active primary read-write database.
Application services require write access to backend storage to fulfill user requests.
4
Perform synthetic operational verification
Application dependencies and health indicators are validated.
Prevents routing users to a partially failed or corrupted secondary environment.
5
Cut over global user routing
DNS records point external users to the new active endpoint.
Directing user traffic is the final cutover mechanism after backend readiness is confirmed.

Anahtar Kavram

Disaster Recovery Failover Sequence and RPO/RTO Alignment
Tahmini Süre:1m 30s
Soru 144Soru →

During an ongoing incident investigation, a Security Operations Center (SOC) team detects that an automated Continuous Integration/Continuous Deployment (CI/CD) build server has been compromised. An attacker modified build scripts to exfiltrate enterprise API credentials to an external host while continuing to compile production software images. Which TWO of the following containment actions should the incident response team perform immediately to mitigate the incident while preserving evidence?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Isolate the compromised build server network interface via virtual firewall rules while capturing its volatile RAM.; Revoke and rotate the exposed API tokens and service account credentials associated with the build pipeline.

Cevap

The containment strategy requires isolating the compromised build server network interface while capturing volatile memory, alongside revoking and rotating all exposed API tokens and service account credentials.
Effective containment of a compromised automation pipeline requires stopping both host communication and credential abuse. Isolating the build server at the network level combined with memory capture preserves volatile forensic evidence while halting exfiltration. Concurrently, revoking and rotating exposed API tokens prevents the adversary from leveraging stolen credentials against peripheral enterprise resources.

Adım Adım Çözüm

1
Identify immediate containment goals
Determine that stopping active exfiltration and preventing unauthorized API access takes priority during containment.
Containment limits the scope and damage of an incident without prematurely destroying forensic artifacts.
2
Preserve state while stopping network exfiltration
Isolate the virtual host at the network layer and acquire a memory dump.
Acquiring memory prior to shut down ensures critical volatile evidence (such as injected process memory) is preserved.
3
Invalidate exfiltrated identity assets
Revoke and re-issue all affected tokens and secrets.
Exfiltrated credentials allow threat actors to bypass perimeter boundaries regardless of host containment.

Anahtar Kavram

Incident Response Containment Strategies and Evidence Preservation
Soru 145Soru →

An organization is establishing hardware security specifications for edge computing appliances deployed in remote, physically untrusted locations. The security architect must ensure cryptographic keys stored on hardware cannot be extracted via physical chip probing, and device identities cannot be duplicated onto unauthorized hardware. Which of the following hardware security controls should be implemented to meet these specific requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Physically Unclonable Functions (PUF) to generate unique cryptographic keys derived from semiconductor manufacturing variations; Cryptographic co-processor with active physical tamper detection integrated to trigger key zeroization upon enclosure breach

Cevap

Implementing Physically Unclonable Functions (PUF) to derive unique key material from silicon manufacturing variations, and deploying active tamper-detection mechanisms integrated with cryptoprocessors to zeroize keys upon physical breach.
Physically Unclonable Functions (PUF) utilize unique manufacturing variations in semiconductor silicon to generate distinct cryptographic key material that cannot be cloned across devices. Active tamper detection mechanisms paired with cryptoprocessors provide physical protection by detecting enclosure compromises and immediately zeroizing sensitive keys to prevent extraction via physical probing.

Adım Adım Çözüm

1
Identify the threat vectors described in the scenario.
The primary threat vectors are physical chip probing (key extraction) and hardware cloning (device duplication) in unmonitored locations.
Security controls must specifically target physical and silicon-level protection mechanisms rather than software-based controls.
2
Evaluate hardware mechanism for anti-cloning and unique identity.
Physically Unclonable Functions (PUF) leverage unique sub-micron physical variations in silicon to construct un-clonable key material.
Because no two chips have identical micro-structural variations, PUF prevents hardware cloning and physical key extraction.
3
Evaluate hardware mechanism for physical intrusion protection.
Active tamper detection circuits connected to secure cryptoprocessors perform automated key zeroization when physical breach occurs.
Zeroization ensures sensitive cryptographic material is completely wiped before an adversary can probe memory chips.

Anahtar Kavram

Hardware-Based Key Protection and Anti-Tamper Mechanisms
Soru 146Soru →

A security technician needs to conduct a vulnerability scan on an internal application server to accurately identify missing software patches and internal misconfigurations without disrupting active services. Which of the following scanning approaches best satisfies these requirements?

Cevabı ve açıklamayı göster

Cevap: Credentialed, non-intrusive scan

Cevap

Credentialed, non-intrusive scan
A credentialed, non-intrusive scan uses valid system credentials to authenticate directly to the target operating system. It inspects installed software registries, missing patches, and local security configurations with high accuracy while avoiding aggressive exploit traffic that could disrupt server availability.

Adım Adım Çözüm

1
Determine authentication requirement
Local system access is needed to accurately verify installed software versions and patch levels.
Unauthenticated network scans only see open network ports and service banners, resulting in potential false positives.
2
Determine scan impact requirement
A non-intrusive scan method must be selected.
Intrusive scanning sends exploit payloads or intensive tests that could crash live application services.

Anahtar Kavram

Credentialed vs. Non-Credentialed Vulnerability Scanning
Tahmini Süre:1m 0s
Soru 147Soru →

During a network security monitoring review of a cloud environment, a security analyst examines the following NIDS alert log associated with an internal application gateway:

Timestamp: 2026-07-27T14:22:01Z
Src_IP: 192.168.10.45:49152 -> Dst_IP: 10.0.4.12:80
Signature: HTTP_Req_Pattern_Match
Payload Snippet: POST /search.php HTTP/1.1\r
Host: store.internal\r
User-Agent: Mozilla/5.0\r
Content-Type: application/x-www-form-urlencoded\r
Content-Length: 68\r
\r
item=1+UNION+SELECT+null,username,password_hash+FROM+users--

Following this initial request, outbound firewall logs capture sustained 15-minute periodic TCP connections from 10.0.4.12 to an external IP address over port 443. Based on the log evidence, which of the following represents the most accurate diagnosis of the activity and the appropriate immediate analyst action?

Cevabı ve açıklamayı göster

Cevap: The alert indicates a successful SQL injection exploit leading to potential data exfiltration; the analyst should immediately isolate the web server (10.0.4.12) to contain potential command and control activity.

Cevap

The alert indicates a successful SQL injection exploit leading to potential data exfiltration; the analyst should immediately isolate the web server (10.0.4.12) to contain potential command and control activity.
Analyzing the payload snippet reveals a classic SQL injection pattern (`UNION SELECT null,username,password_hash FROM users--`) attempting to extract user credentials from a backend database. Correlating this NIDS alert with the subsequent sustained outbound TCP port 443 sessions from the target web server indicates potential post-exploitation activity or data exfiltration. Isolating the target web server halts egress communications while enabling forensic analysis.

Adım Adım Çözüm

1
Analyze NIDS HTTP payload syntax
Identified 'UNION SELECT null,username,password_hash FROM users--' as a SQL injection (SQLi) attack targeting backend database credentials.
Determines the specific attack vector targeting the database application logic.
2
Correlate NIDS payload with outbound NetFlow/Firewall logs
Observed subsequent persistent outbound traffic over TCP port 443 from the target server (10.0.4.12) to an external IP.
Establishes post-exploitation behavior indicative of data exfiltration or Command and Control (C2) beaconing.
3
Determine containment response action
Selected network isolation of server 10.0.4.12.
Prevents ongoing outbound data exfiltration while preserving memory and system state for digital forensics.

Anahtar Kavram

SQL Injection Alert Diagnosis and Containment Correlation
Soru 148Soru →

An IAM administrator at an online payment processor is reviewing identity operational logs after an audit revealed that a terminated contractor retained administrative access to production API gateways 48 hours after offboarding:

Timestamp (UTC)Event IDIdentity / SubjectSystem ComponentDetails / Status
2026-07-25 09:00:00EVT-801[email protected]IdP DirectoryUser account status set to Disabled
2026-07-25 09:00:05EVT-802[email protected]SCIM EngineProvisioning push failed: Integration token expired
2026-07-25 09:05:00EVT-803[email protected]API GatewayRefresh token exchange succeeded (New access token issued)
2026-07-27 08:30:00EVT-804[email protected]API GatewayAdministrative configuration change executed

Based on the log analysis, which of the following identifies the primary technical cause of the persistent access and the most effective operational fix?

Cevabı ve açıklamayı göster

Cevap: The automated deprovisioning sync failed due to an expired SCIM integration token, and long-lived OAuth refresh tokens were not explicitly revoked upon account disablement; implementing Continuous Access Evaluation (CAE) or automated token revocation hooks is required.

Cevap

The persistent access was caused by an expired SCIM provisioning token preventing downstream account deprovisioning combined with active OAuth refresh tokens that were not invalidated; the operational fix requires implementing Continuous Access Evaluation (CAE) or automated token revocation hooks.
The logs clearly show that while the account was disabled in the directory (EVT-801), the SCIM engine failed to propagate this disablement due to an expired integration token (EVT-802). As a result, the API Gateway honored the user's existing OAuth refresh token (EVT-803), granting continued access. Remediating this requires repairing SCIM token authentication and enforcing Continuous Access Evaluation (CAE) or automated revocation webhooks to instantly invalidate active tokens when an account status changes.

Adım Adım Çözüm

1
Analyze the log entries sequentially to trace the deprovisioning workflow failure.
Event EVT-801 shows account disablement in the primary Identity Provider at 09:00:00 UTC, but EVT-802 indicates that SCIM provisioning push failed due to an expired integration token five seconds later.
SCIM depends on valid API credentials/tokens to propagate identity lifecycle updates to relying applications.
2
Examine downstream authentication and authorization behavior following the failed SCIM push.
At 09:05:00 UTC (EVT-803), the API Gateway processed a valid OAuth refresh token request because it was never notified of the user's disabled status, issuing a new active access token.
OAuth refresh tokens remain valid until explicitly revoked or expired; disabling an account in the primary IdP does not automatically invalidate active downstream tokens without active revocation mechanisms.
3
Determine the required IAM operational remediation.
Fixing the SCIM integration credential maintenance and deploying Continuous Access Evaluation (CAE) / automated token revocation ensures real-time session invalidation across all relying parties.
CAE enables identity providers and reliance endpoints to communicate security events dynamically, stopping active sessions immediately upon account risk state changes.

Anahtar Kavram

Identity Provisioning, Lifecycle Synchronization, and Token Revocation Operations
Soru 149Soru →

An enterprise security team needs to publish a document that specifies the mandatory minimum technical security settings required for all newly deployed cloud virtual machines. Which type of security governance document should the team create to define these mandatory minimum configurations?

Cevabı ve açıklamayı göster

Cevap: Security baseline

Cevap

A security baseline document defines the minimum mandatory technical configurations required for systems.
A security baseline provides a mandatory set of minimum security settings and configuration controls that all systems of a given type must meet to ensure consistent hardening.

Adım Adım Çözüm

1
Analyze the scenario requirements
The requirement specifies mandatory minimum technical security configurations for virtual machines.
Identifying whether requirements are mandatory technical settings, high-level directives, or optional advice determines the document classification.
2
Evaluate document types against governance definitions
A security baseline explicitly establishes the mandatory minimum build and security controls for operating systems or hardware.
Baselines ensure consistent hardening across deployments.

Anahtar Kavram

Security Baselines and Policy Hierarchy
Soru 150Soru →

An enterprise logistics provider is conducting a quantitative risk assessment for a mission-critical database cluster valued at 2,000,000.ThreatmetricsindicatethataransomwareinfectionresultsinanExposureFactor(EF)of252,000,000. Threat metrics indicate that a ransomware infection results in an Exposure Factor (EF) of 25%, with an unmitigated Annual Rate of Occurrence (ARO) of 0.5. The security team plans to implement an endpoint detection and response (EDR) solution costing 30,000 annually, which is expected to lower the ARO to 0.1 without altering the EF. What is the net annual financial benefit (safeguard value) of implementing this security control?

Cevabı ve açıklamayı göster

Cevap: $170,000

Cevap

The net annual financial benefit of implementing the safeguard is $170,000.
The net annual benefit (safeguard value) measures total financial savings generated by a security control after subtracting its operational expense. First, the Single Loss Expectancy (SLE) is computed as $2,000,000×0.25=$500,000\$2,000,000 \times 0.25 = \$500,000. Next, the baseline Annual Loss Expectancy (ALEinitialALE_{initial}) is $500,000×0.5=$250,000\$500,000 \times 0.5 = \$250,000. After applying the safeguard, the post-control Annual Loss Expectancy (ALEmitigatedALE_{mitigated}) becomes $500,000×0.1=$50,000\$500,000 \times 0.1 = \$50,000. Subtracting mitigated ALE from initial ALE yields a gross loss reduction of $200,000\$200,000. Finally, subtracting the $30,000\$30,000 annual safeguard cost results in a net annual financial benefit of $170,000\$170,000.

Adım Adım Çözüm

1
Calculate Single Loss Expectancy (SLE)
SLE=Asset Value(AV)×Exposure Factor(EF)=$2,000,000×0.25=$500,000SLE = Asset\ Value (AV) \times Exposure\ Factor (EF) = \$2,000,000 \times 0.25 = \$500,000
SLE represents the financial loss incurred each time a single risk event occurs.
2
Calculate Initial Annual Loss Expectancy (ALE_initial)
ALEinitial=SLE×AROinitial=$500,000×0.5=$250,000ALE_{initial} = SLE \times ARO_{initial} = \$500,000 \times 0.5 = \$250,000
Initial ALE establishes the baseline annual monetary loss expected from the threat prior to safeguard implementation.
3
Calculate Mitigated Annual Loss Expectancy (ALE_mitigated)
ALEmitigated=SLE×AROmitigated=$500,000×0.1=$50,000ALE_{mitigated} = SLE \times ARO_{mitigated} = \$500,000 \times 0.1 = \$50,000
Mitigated ALE determines the residual annual expected loss after the safeguard reduces event occurrence frequency.
4
Calculate Net Safeguard Value (Annual Cost-Benefit)
Safeguard Value=(ALEinitial−ALEmitigated)−Annual Safeguard Cost=($250,000−$50,000)−$30,000=$170,000Safeguard\ Value = (ALE_{initial} - ALE_{mitigated}) - Annual\ Safeguard\ Cost = (\$250,000 - \$50,000) - \$30,000 = \$170,000
Net annual financial benefit accounts for both the loss exposure reduction and the ongoing cost of maintaining the control.

Anahtar Kavram

Quantitative Risk Analysis & Safeguard Cost-Benefit Value
Tahmini Süre:2m 0s
Soru 151Soru →

A security operations team must implement appropriate vulnerability assessment methodologies across four distinct IT and operational environments. Which vulnerability scanning approach best matches each enterprise operational requirement?

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Non-intrusive Credentialed Scan
Passive Vulnerability Monitoring
Intrusive Exploitation Scan
Authenticated Dynamic Application Scan

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct pairing matches: Non-intrusive Credentialed Scan with auditing production database OS updates safely; Passive Vulnerability Monitoring with assessing sensitive OT/ICS networks without sending packets; Intrusive Exploitation Scan with confirming shell access from a remote code execution vulnerability in staging; and Authenticated Dynamic Application Scan with analyzing web vulnerabilities behind a login prompt.
Vulnerability scanner methodologies must align with system risk tolerance and application architecture. Passive monitoring avoids packet transmission for delicate operational technology. Non-intrusive credentialed scans safely query local package managers via host credentials. Intrusive scans perform real exploitation checks to confirm true positives in test environments. Authenticated dynamic scans execute web request payloads behind application login mechanisms.

Adım Adım Çözüm

1
Evaluate the requirements and constraints for legacy OT/ICS networks.
Determine that packet injection can crash legacy SCADA controllers, making packetless monitoring necessary.
Passive vulnerability monitoring collects asset and vulnerability intelligence solely by sniffing network traffic.
2
Determine the safest method to verify patch compliance on production hosts during operational hours.
Select non-intrusive credentialed scanning.
Host credentials allow direct inspection of local package manifests without generating heavy or disruptive network attack traffic.
3
Identify the technique required to confirm functional exploitability of a critical flaw.
Select intrusive exploitation scanning.
Intrusive scans validate exploitability by actively executing exploit scripts against target vulnerabilities.
4
Match the web application testing requirement for authenticated areas.
Select authenticated dynamic application scanning.
DAST crawlers require session tokens to traverse and analyze access controls, session state, and input fields behind login interfaces.

Anahtar Kavram

Vulnerability Scanning Methodologies and Environmental Constraints
Tahmini Süre:2m 0s
Soru 152Soru →

Following an enterprise-wide cloud transformation, an organization's Chief Information Security Officer (CISO) establishes a multi-tiered governance structure to enforce security controls across diverse engineering teams. The framework includes high-level security objectives, mandatory technical requirements for microservices, discretionary coding recommendations, and platform-specific step-by-step configuration steps. During an internal compliance review, a software development team is flagged for utilizing AES-128 encryption across microservices instead of the mandatory enterprise cipher specification. The team lead asserts that technical rules specified outside the overarching executive policy document are non-binding recommendations. Which governance document type did the CISO issue to enforce mandatory technical requirements across the enterprise, and what is its role within the governance hierarchy?

Cevabı ve açıklamayı göster

Cevap: Standard; it establishes mandatory technical specifications and rules that operationalize high-level security policies.

Cevap

The standard is the governance document type issued to enforce compulsory technical specifications operationalizing high-level security policies.
In security governance hierarchies, a Standard establishes mandatory technical requirements, rules, or configurations (such as compulsory cryptographic algorithms) that operationalize executive Security Policies across an enterprise.

Adım Adım Çözüm

1
Analyze the CISO's governance hierarchy and the nature of the requirement.
The requirement (specific AES cipher usage) is a mandatory technical specification designed to enforce consistent controls across engineering teams.
Governance documents are differentiated by their level of abstraction, authority level, and mandatory vs. discretionary nature.
2
Evaluate the distinct roles of governance document types in an enterprise framework.
High-level goals belong in policies, step-by-step workflows belong in procedures, suggestions belong in guidelines, and uniform mandatory technical rules belong in standards.
Standards bridge high-level policy intent with actionable, mandatory technical requirements across systems.
3
Identify the correct governance classification for the CISO's cipher requirement.
The document defining compulsory cipher usage across microservices is a Standard.
Engineers must comply with standards because they carry mandatory authority beneath the overarching policy.

Anahtar Kavram

Security Policy Hierarchy (Policies vs Standards vs Baselines vs Guidelines vs Procedures)
Tahmini Süre:2m 0s
Soru 153Soru →

During a routine security review of cloud identity operations, a security analyst discovers that an automated data synchronization process uses a legacy service account configured with a long-lived static API key. The key was inadvertently committed to an internal repository, allowing an unauthorized external entity to request access tokens and enumerate cloud resources. Which of the following operational controls should the security team implement to remediate this vulnerability and secure the service identity lifecycle? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Migrate the automated service identity to use workload identity federation with short-lived, ephemeral tokens instead of hardcoded credentials.; Configure risk-based conditional access policies to evaluate request context and block token issuance from unexpected locations or anomalous sources.

Cevap

The security team should migrate the service account to workload identity federation with short-lived tokens and implement contextual conditional access policies.
Migrating to workload identity federation eliminates static long-lived credentials by issuing short-lived tokens based on trusted identity relationships. Combining this with risk-based conditional access ensures token requests from untrusted origins or anomalous locations are blocked automatically.

Adım Adım Çözüm

1
Identify the primary operational vulnerability.
The vulnerability stems from using long-lived static credentials (API keys) that can be leaked and abused externally.
Static credentials present a continuous risk of exposure and lack dynamic identity verification.
2
Select credential lifecycle remediation controls.
Replace long-lived keys with workload identity federation to issue short-lived, ephemeral access tokens.
Ephemeral tokens drastically reduce the window of opportunity for compromise.
3
Select adaptive access controls for identity operations.
Apply conditional access policies to inspect request context and block suspicious token requests.
Risk-based conditional access enforces Zero Trust principles for service account token requests.

Anahtar Kavram

Workload Identity Federation and Conditional Access Control in IAM Operations
Soru 154Soru →

A security engineer is configuring a newly deployed Security Information and Event Management (SIEM) system to ingest and analyze multi-source telemetry across the enterprise network. Arrange the core stages of the SIEM log processing pipeline in the correct sequential order from initial intake to operational notice.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of stages in the SIEM log processing pipeline is: Log Collection, Parsing, Normalization, Correlation, and Alerting.
The SIEM log processing pipeline must ingest raw logs before evaluating them. Log Collection receives raw telemetry from source hosts. Next, Parsing extracts discrete fields from unformatted text strings. Once parsed, Normalization maps those fields into a uniform taxonomy so events from different vendors can be understood under a single schema. Correlation then evaluates these normalized events across time windows and sources against threat rules. Finally, Alerting notifies security analysts when rule conditions are satisfied.

Adım Adım Çözüm

1
Identify the initial intake phase of event data
Log Collection gathers raw telemetry from endpoints, network devices, and security controls.
Before any processing can begin, raw logs must be collected from their original sources.
2
Structure the unformatted log text into defined fields
Parsing breaks down raw strings into structured data elements like IP addresses, timestamps, and action codes.
SIEM systems cannot efficiently search or evaluate unstructured text without extracting key attributes.
3
Standardize variable field naming across disparate vendor formats
Normalization converts heterogeneous fields (e.g., 'src_ip' vs 'source_address') into a single common schema.
Correlation rules require uniform field names to effectively compare events from different vendors.
4
Evaluate uniform log data against security logic and threat indicators
Correlation cross-examines normalized events to identify suspicious patterns and multi-host activity.
Rule matching must operate on standardized, parsed telemetry to produce reliable threat detection.
5
Notify analysts or triggering automated incident response mechanisms
Alerting dispatches high-priority tickets or push notices for identified threats.
Alerting occurs only after correlation engines determine that specific event thresholds or rules have been triggered.

Anahtar Kavram

SIEM Log Processing Pipeline
Soru 155Soru →

An enterprise security architect is designing an updated Identity and Access Management (IAM) architecture to support dynamic, fine-grained authorization across microservices while automating user account lifecycles across cloud services. Which of the following components or standards should be incorporated into the architecture to fulfill these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: A Policy Decision Point (PDP) utilizing Attribute-Based Access Control (ABAC) to evaluate real-time contextual access requests; System for Cross-domain Identity Management (SCIM) protocol to automate account provisioning and lifecycle synchronization

Cevap

The architecture requires combining a Policy Decision Point (PDP) enforcing Attribute-Based Access Control (ABAC) for dynamic access decisions with the System for Cross-domain Identity Management (SCIM) standard for automated identity provisioning.
Attribute-Based Access Control (ABAC) managed by a central Policy Decision Point (PDP) provides fine-grained context-aware authorization decisions across distributed microservices. Simultaneously, the System for Cross-domain Identity Management (SCIM) standard automates user identity creation, modification, and revocation across connected identity domains.

Adım Adım Çözüm

1
Address the requirement for dynamic, fine-grained authorization
Implement an ABAC-based Policy Decision Point (PDP).
ABAC evaluates dynamic variables (such as risk score, user position, time, and requested data sensitivity) to make granular, real-time access decisions.
2
Address the requirement for automated account lifecycle management across systems
Implement the System for Cross-domain Identity Management (SCIM) standard.
SCIM provides standardized REST/JSON APIs that allow Identity Providers to push user onboarding, profile updates, and offboarding changes across target SaaS applications automatically.

Anahtar Kavram

IAM Architecture Integration: Fine-grained Authorization (PDP/ABAC) and Automated Provisioning (SCIM)
Soru 156Soru →

A security analyst is auditing access logs following an unauthorized privilege escalation incident on a network perimeter gateway. The organization utilizes a centralized RADIUS server integrated with Directory Services for network access control. The authentication and authorization logs display the following consecutive events:

[TIMESTAMP: 2026-07-27T14:22:01Z] RADIUS-Auth: User 'j_doe' successfully authenticated via MS-CHAPv2.
[TIMESTAMP: 2026-07-27T14:22:02Z] RADIUS-Authz: Vendor-Specific Attribute (VSA) 'Cisco-AVPair = shell:priv-lvl=15' rejected due to policy schema syntax mismatch.
[TIMESTAMP: 2026-07-27T14:22:03Z] Gateway-Daemon: Fallback default authorization rule applied; assigned administrative profile (privilege level 15) to session 'j_doe'.

Which of the following operational vulnerabilities is the primary root cause of the unauthorized privilege escalation?

Cevabı ve açıklamayı göster

Cevap: A failure in authorization attribute processing triggered an insecure default fallback configuration on the gateway.

Cevap

A failure in authorization attribute processing triggered an insecure default fallback configuration on the gateway.
The log output shows successful authentication followed by a failure in authorization attribute syntax (Vendor-Specific Attribute). The gateway daemon's flawed logic defaulted to granting full privilege level 15 when the authorization attribute was rejected. The root cause is therefore improper authorization processing leading to an insecure fail-open default configuration.

Adım Adım Çözüm

1
Analyze RADIUS authentication log entry
User 'j_doe' successfully passed authentication using MS-CHAPv2, confirming identity validation occurred correctly.
Differentiates authentication (identity proof) from authorization (permission granting).
2
Analyze RADIUS authorization VSA log entry
The Vendor-Specific Attribute intended to specify privilege level 15 failed due to a syntax error.
Identifies where the permission specification mechanism broke down.
3
Analyze Gateway Daemon fallback log entry
Upon rejection of the authorization attribute, the gateway applied a default local rule granting full privilege level 15 access.
Pinpoints the root cause as fail-open default configuration upon authorization processing failure.

Anahtar Kavram

RADIUS Vendor-Specific Attributes (VSAs) and Fail-Secure vs. Fail-Open Authorization Handling
Soru 157Soru →

A digital forensics analyst has completed the imaging of a seized storage volume from an enterprise database server involved in a security incident. The analyst is preparing to transfer the physical evidence to an external forensic laboratory for detailed examination. Which of the following actions must the analyst take to maintain a valid chain of custody during this transfer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Record cryptographic SHA-256 hashes of the acquired evidence alongside timestamped logs before initiating evidence transfer; Document sign-off signatures of both transferor and recipient detailing the exact date, time, and purpose on the chain of custody log

Cevap

The analyst must record cryptographic hashes of the evidence before transfer and document dual sign-off signatures detailing the date, time, and purpose on the chain of custody log.
Maintaining a valid chain of custody requires documenting every transfer of evidence with detailed logs—including date, time, transferor, recipient, and purpose—as well as verifying evidence integrity via cryptographic hashing before and after transfer.

Adım Adım Çözüm

1
Calculate and record pre-transfer cryptographic hash values
Establishes an integrity baseline for comparing evidence post-transport
Verification of hash integrity proves the digital evidence was not tampered with during transfer.
2
Complete the chain of custody log documentation during handoff
Tracks official custody, transferor/transferee identities, timestamps, and transfer purpose
Provides legal non-repudiation and accountability for who handled the evidence at all times.

Anahtar Kavram

Digital Forensics Chain of Custody and Evidence Integrity
Tahmini Süre:1m 30s
Soru 158Soru →

A Security Operations Center (SOC) analyst receives a high-priority alert indicating that an enterprise Voice over IP (VoIP) management server has established unauthorized outbound secure shell (SSH) sessions to an unknown external IP address and is attempting horizontal scanning across internal server subnets. The analyst inspects network logs and confirms that an active remote code execution exploit took place through the server's web administration panel. According to standard incident response playbooks, which of the following actions should the analyst perform FIRST?

Cevabı ve açıklamayı göster

Cevap: Isolate the compromised VoIP server from the network segment while preserving host volatile memory for forensic investigation.

Cevap

Isolate the compromised VoIP server from the network segment while preserving host volatile memory for forensic investigation.
In accordance with standard NIST SP 800-61 incident response frameworks, once an active system compromise is confirmed, the immediate priority is containment. Isolating the compromised VoIP server from the network halts unauthorized lateral movement and outbound command-and-control communications. Preserving volatile RAM ensures vital forensic evidence remains available for analysis.

Adım Adım Çözüm

1
Identify the current incident response phase based on the scenario state.
The compromise has just been verified, placing the response at the Containment phase.
Before any remediation or recovery can take place, active threats must be contained to prevent further damage or lateral movement.
2
Select the action that properly executes containment while preserving forensic evidence.
Network isolation stops external command-and-control traffic and internal scanning while keeping RAM intact.
Preserving volatile memory (RAM) is crucial before power-down or network disconnect, supporting chain of custody and forensic triage.

Anahtar Kavram

Incident Response Lifecycle - Containment Phase
Soru 159Soru →

A tier 2 incident responder analyzing endpoint telemetry observes an active fileless attack on an enterprise financial server, where an injected process is issuing unauthorized API calls to extract credentials and establish an outbound encrypted beacon. To effectively contain the active compromise and preserve critical evidence for incident triage without losing agent telemetry, which of the following response actions should the responder perform using EDR agent capabilities? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Apply host-level network isolation via the agent while maintaining the agent-to-console management connection; Capture a live volatile memory (RAM) dump of the endpoint directly through agent execution capabilities prior to terminating the suspicious process tree

Cevap

The incident responder should apply host-level network isolation via the EDR agent while maintaining console connectivity, and capture a live volatile memory (RAM) dump of the host before terminating the suspicious process tree.
Combining host-level agent isolation with pre-remediation volatile memory acquisition enables incident responders to contain active network activity instantly while preserving volatile evidence necessary for root cause analysis.

Adım Adım Çözüm

1
Isolate the compromised host at the endpoint layer via EDR console network containment features.
Network communication to external adversary infrastructure and adjacent internal network hosts is severed, stopping lateral movement while preserving SOC remote agent control.
Immediate containment at the host level prevents adversary expansion without blinding the security team.
2
Trigger volatile memory acquisition using EDR forensic capabilities prior to process kill execution.
In-memory code, injected DLLs, and volatile runtime evidence are preserved on disk or uploaded securely for forensic analysis.
Fileless memory threats disappear as soon as the host reboots or the process tree is killed.

Anahtar Kavram

EDR Host Isolation and Volatile Telemetry Preservation
Soru 160Soru →

A systems administrator is configuring a secure remote management channel for server administration over an untrusted network. The security policy mandates perfect forward secrecy so that compromising the server's long-term private key in the future will not allow an attacker to decrypt previously recorded session traffic. Which cryptographic key exchange mechanism should the administrator implement to satisfy this requirement?

Cevabı ve açıklamayı göster

Cevap: Ephemeral Diffie-Hellman key exchange

Cevap

Ephemeral Diffie-Hellman key exchange should be selected because ephemeral keys provide perfect forward secrecy for encrypted sessions.
Ephemeral Diffie-Hellman key exchange satisfies perfect forward secrecy requirements because a unique, temporary key pair is generated for each communication session. Once the session ends, the temporary keys are discarded. An attacker who compromises the server's long-term private key at a later date cannot derive previous session keys or decrypt captured historical traffic.

Adım Adım Çözüm

1
Identify the primary requirement specified in the scenario
The requirement is perfect forward secrecy (PFS) for remote management sessions over an untrusted network.
The system must protect historical session logs from decryption even if long-term server private keys are compromised.
2
Evaluate key exchange mechanisms against the requirement
Ephemeral key exchanges (such as ECDHE or DHE) generate temporary, disposable keys per session rather than deriving session keys from long-term asymmetric keys.
Because temporary session keys are not stored and cannot be derived from long-term keys, forward secrecy is maintained.
3
Select the option that implements ephemeral key exchange
Ephemeral Diffie-Hellman key exchange correctly satisfies the security requirement.
It ensures that compromising long-term keys does not compromise past communication sessions.

Anahtar Kavram

Perfect Forward Secrecy via Ephemeral Diffie-Hellman
ÖncekiSayfa 8 / 112Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin