Tüm alıştırma soruları

An incident responder notices that a malicious program rapidly infected dozens of systems across an internal network by exploiting a known remote code execution vulnerability, operating completely independently without any user action. Which of the following malware types best describes this threat?

An incident response team is investigating multiple concurrent network and wireless security anomalies detected across enterprise infrastructure. Match each technical log entry or packet capture indicator to its correct attack classification.

Match each security telemetry log snippet with its corresponding threat classification or event type.

A healthcare enterprise is deploying a Zero Trust Architecture (ZTA) across its clinical telemetry systems. During an active diagnostic data transmission session, an endpoint compliance agent reports that a workstation's local security baseline has been modified unexpectedly, though the clinician's multi-factor authentication (MFA) token remains valid and unexpired. Which of the following operations executed by the Zero Trust control plane best demonstrates the principle of continuous verification?

A security engineer is configuring an automated Security Orchestration, Automation, and Response (SOAR) playbook designed to ingest high-confidence malicious IP addresses from a Threat Intelligence Platform (TIP) and instantly push block rules to perimeter firewalls. During a recent threat feed update, a shared public DNS resolver IP was misclassified as malicious, causing the playbook to automatically block critical outgoing traffic. Which modification to the playbook workflow logic should be implemented to prevent future unintended outages?

A high-precision semiconductor fabrication facility experiences intermittent disruptions across its automated silicon wafer etching equipment. Investigation reveals that custom-compiled bootkit firmware was stealthily flashed onto isolated industrial controllers. The attackers gained initial access six months prior by compromising an offshore vendor's network management software used for remote equipment maintenance, demonstrating long-term persistence, custom exploit development, and zero-day evasions without requesting ransom or leaving overt defacement signatures. Which TWO of the following threat actor attributes or attack vectors are demonstrated in this scenario? (Select TWO)

An enterprise security architect is auditing a remote access workflow designed for external software developers. Under the proposed model, after a developer successfully completes multi-factor authentication (MFA) at the edge gateway, their endpoint is assigned an IP address on the internal development network segment. From that point forward, the session maintains open access to all internal repository servers and staging databases without requiring further authentication or posture checks until disconnect. Which of the following best evaluates this architecture against Zero Trust Architecture (ZTA) principles and identifies the necessary architectural remediation?

An organization implements digital signatures for all high-value financial transactions to ensure that executives cannot deny approving a transaction after it has been submitted. Which security goal is primarily being addressed by this implementation?

A healthcare organization requires that when physicians approve electronic prescription orders, the system must generate proof of origin so that a physician cannot later deny authorizing the order. To accomplish this, the system applies a digital signature using the physician's private key combined with a cryptographic hash of the order details. Which security concept is directly fulfilled by implementing digital signatures to prevent denial of origin?

An enterprise security team is transitioning network operations to align with Zero Trust Architecture (ZTA) principles. Which of the following statements accurately describes a fundamental principle of access control within Zero Trust?

Match each core security goal or concept on the left with its primary operational objective on the right.

A financial software firm secures its system log repository by encrypting log files with AES-256 and generating an HMAC-SHA256 checksum for each entry using a shared secret key accessible by all system administrators. During an investigation into an unauthorized privilege escalation, a senior administrator is suspected of editing log lines to erase evidence. The administrator claims that another employee with administrative credentials must have altered the logs using the shared key. Which security property is currently lacking in the firm's audit system that prevents proving which specific administrator committed the modification?

An enterprise API gateway receives automated configuration updates from external vendors. To satisfy auditing requirements, security policies dictate that the system must establish indisputable proof of origin for every payload, ensuring vendors cannot deny sending a specific update. The system architects propose utilizing SHA-256 hashing paired with pre-shared symmetric keys (HMAC) between the gateway and each vendor. Which security goal remains unfulfilled by this proposed architecture, and why?

Match each enterprise security technical implementation to the specific security pillar or concept it primarily satisfies.

An enterprise logistics company requires software engineers to digitally sign all infrastructure configuration files using their individual asymmetric private keys before pushing them to the automated build pipeline. If an unapproved configuration change causes a service outage, management must be able to indisputably prove which specific engineer authored and submitted the change. Which security principle is primarily fulfilled by this implementation?

A software distribution platform requires package maintainers to cryptographically sign all published updates. This ensures that a maintainer cannot later deny having created and released a specific update package. Which of the following security concepts is best demonstrated by this requirement?

An industrial smart grid operator manages several automated telemetry, control, and audit subsystems. Match each operational security scenario on the left with the primary CIA triad pillar or related security objective that is either violated or enforced on the right.

An enterprise organization is transitioning from a legacy remote-access VPN infrastructure to a Zero Trust Architecture (ZTA). During the redesign, a security architect must define how access requests to sensitive corporate applications are evaluated by the Policy Engine and Policy Enforcement Point. Which of the following operational practices best aligns with the core Zero Trust principle of explicit validation and continuous verification?

A financial enterprise operates a microservices environment governed by Zero Trust Architecture (ZTA) principles. A remote system administrator successfully completes multi-factor authentication (MFA) from a corporate-managed endpoint. Ten minutes into the session, the endpoint's telemetry indicates that its local endpoint detection and response (EDR) agent has been disabled, and the connection origin dynamically shifts to an unknown unmanaged network. Which of the following actions best demonstrates the principle of continuous verification in this scenario?

A financial enterprise is upgrading its automated clearing house payment processing system. To prevent fraud, the system requires that submitted wire transfers include a cryptographic control. The lead security architect proposes requiring sender applications to sign transfer payloads using an asymmetric private key rather than generating a Hash-based Message Authentication Code (HMAC) with a pre-shared symmetric key. Which security objective is uniquely satisfied by transitioning to the asymmetric digital signature approach?