Examkin

Tüm alıştırma soruları

2232 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 1921Soru →

An enterprise cloud engineering team is establishing baseline security controls for a newly migrated production environment. Match each technical implementation on the left with the primary security pillar or objective it satisfies on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Applying asymmetric digital signatures to automated infrastructure deployment manifests before execution
Configuring SHA-256 cryptographic checksums coupled with write-once-read-many (WORM) audit logging
Deploying active-active multi-region database replicas with automated health-check failover
Enforcing client-side AES-256-GCM encryption on cloud object storage buckets

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Asymmetric digital signatures map to Non-Repudiation; SHA-256 hashing with WORM storage maps to Integrity; Active-active multi-region redundancy maps to Availability; Client-side AES-256 encryption maps to Confidentiality.
Each control satisfies its corresponding pillar: asymmetric digital signatures cryptographically bind identity to deployment actions for non-repudiation; SHA-256 hashing with WORM prevents undetected log alteration for integrity; multi-region active-active clustering maintains service uptime for availability; client-side AES-256 encryption prevents unauthorized data viewing for confidentiality.

Adım Adım Çözüm

1
Analyze the technical control for proof of origin and author identity.
Asymmetric digital signatures tie deployment actions directly to the signer's private key, establishing non-repudiation.
Non-repudiation ensures an individual or system cannot deny having performed a specific transaction or authorization.
2
Evaluate controls designed to prevent or detect unauthorized data modification.
SHA-256 hashing combined with WORM storage preserves audit records against undetected changes, fulfilling integrity.
Integrity guarantees data accuracy, completeness, and protection against unauthorized modification.
3
Examine operational controls implemented for uptime and disaster recovery.
Multi-region active-active database clustering ensures resources remain accessible during hardware or network failures, maintaining availability.
Availability ensures systems and data are operational and accessible to authorized users whenever needed.
4
Identify controls designed to prevent unauthorized disclosure of stored data.
Client-side AES-256-GCM encryption secures payload data from unauthorized exposure, guaranteeing confidentiality.
Confidentiality protects sensitive data from unauthorized access or disclosure.

Anahtar Kavram

CIA Triad and Non-Repudiation
Soru 1922Soru →

A security analyst configures an automated reporting tool to sign all generated financial reports using an asymmetric private key. Which of the following core security objectives are directly provided by using digital signatures in this scenario? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Integrity; Non-repudiation

Cevap

The core security objectives directly provided by digital signatures are Integrity and Non-repudiation.
Digital signatures provide integrity by allowing recipients to detect document modification through cryptographic hashing, and non-repudiation by binding the signature uniquely to the sender's private key.

Adım Adım Çözüm

1
Identify the cryptographic mechanism described in the scenario.
The scenario uses asymmetric digital signatures applied to financial reports.
Determining the security control type is necessary to evaluate which security pillars it fulfills.
2
Evaluate how digital signatures affect data tampering.
A cryptographic hash verified by the signature ensures the data has not been altered in transit or storage.
This satisfies the requirement for integrity.
3
Evaluate how asymmetric keys establish proof of origin.
Because the signing key is private to the origin, the sender cannot plausibly deny signing the message.
This satisfies the requirement for non-repudiation.

Anahtar Kavram

Digital signatures combine hashing and asymmetric cryptography to guarantee integrity and non-repudiation without encrypting the underlying data for confidentiality.
Soru 1923Soru →

A security analyst deploys an intentionally vulnerable decoy server on an isolated network segment. The server contains simulated sensitive files and fake credentials designed to attract threat actors, observe their tactics, and generate alerts upon any interaction. Which of the following deception technologies has the analyst implemented?

Cevabı ve açıklamayı göster

Cevap: Honeypot

Cevap

Honeypot
A honeypot is a deception mechanism designed to act as a decoy to lure attackers away from critical production resources while collecting telemetry on unauthorized techniques and behaviors.

Adım Adım Çözüm

1
Identify the primary operational goal described in the scenario.
The goal is to lure threat actors using an intentionally vulnerable decoy server to observe tactics and alert on unauthorized interaction.
Deception technologies create false targets to draw malicious activity away from production systems.
2
Compare the scenario characteristics against standard security technology definitions.
A decoy system containing dummy data deployed specifically for monitoring adversary activity is defined as a honeypot.
Honeypots have no legitimate production value; any interaction with them is treated as suspicious or malicious activity.

Anahtar Kavram

Deception and Disruption Technologies
Soru 1924Soru →

A healthcare provider is deploying a tele-radiology platform where remote radiologists submit diagnostic reports to hospital electronic health record (EHR) systems. Security policy dictates that the platform must guarantee two key objectives: (1) hospitals must be able to prove which specific radiologist authored a report such that the radiologist cannot later claim they did not send it, and (2) any alteration to report contents during transit or storage must be immediately detectable. Which of the following technical controls must be implemented to fulfill these security requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Digital signatures applied to diagnostic reports using each radiologist's private key; Cryptographic hashing generated for report payloads prior to transmission

Cevap

The organization must implement digital signatures applied with individual private keys (to provide non-repudiation and integrity) and cryptographic hashing of report payloads (to verify data integrity).
Digital signatures created with asymmetric private keys provide non-repudiation by binding the specific sender's identity to the report, while cryptographic hashing generates verification digests that detect any file alterations to preserve integrity.

Adım Adım Çözüm

1
Analyze Requirement 1: Non-repudiation of authorship
Non-repudiation requires a mechanism where the sender's identity is cryptographically bound to the data using a secret known only to the sender (a private key). Digital signatures fulfill non-repudiation because only the private key owner could have produced the signature.
Symmetric shared keys or standard login permissions cannot prove individual authorship since keys/credentials may be shared or managed centrally.
2
Analyze Requirement 2: Detection of unauthorized modifications (Integrity)
Data integrity is verified using cryptographic hash functions (such as SHA-256) or digital signatures. Comparing the computed hash digest against the expected hash reveals any tampering in transit or storage.
Hashing creates a deterministic value unique to the exact byte sequence of the diagnostic file.
3
Evaluate distractors against CIA and Non-Repudiation concepts
Symmetric encryption with a shared key ensures confidentiality but fails non-repudiation. RBAC enforces authorization permissions but cannot cryptographically prove data integrity or origin.
Confidentiality and authorization address different security pillars than non-repudiation and integrity.

Anahtar Kavram

CIA Triad and Non-Repudiation
Soru 1925Soru →

A security architect is establishing control and data plane boundaries for a microsegmented enterprise network undergoing transition to a Zero Trust Architecture (ZTA). Match each logical Zero Trust component with its corresponding operational role during access evaluations.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Policy Engine (PE)
Policy Administrator (PA)
Policy Enforcement Point (PEP)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The Policy Engine evaluates policies to make access decisions; the Policy Administrator communicates commands to establish/terminate communication channels; and the Policy Enforcement Point directly intercepts traffic and enforces policies at the data plane.
The Policy Engine evaluates context and policy rules to output access decisions. The Policy Administrator receives those decisions and manages credentials or signaling to setup/tear down communication paths. The Policy Enforcement Point intercepts connections directly to enforce policy controls on active network sessions.

Adım Adım Çözüm

1
Identify the primary decision-making core of Zero Trust Architecture.
Recognize that the Policy Engine (PE) compares access requests against defined security policies to make grant/deny decisions.
Separation of control plane logic requires a centralized decision authority.
2
Identify the component responsible for signaling and connection management.
Recognize that the Policy Administrator (PA) executes PE decisions by instructing the control plane to open or close sessions.
The PA acts as the mediator between logical decisions and physical connection establishment.
3
Identify the data plane component handling direct traffic flow.
Recognize that the Policy Enforcement Point (PEP) resides on the data plane to physically allow, monitor, or block traffic.
PEPs act as gatekeepers directly in the flow of traffic.

Anahtar Kavram

Zero Trust Control Plane vs. Data Plane Architecture Components (NIST SP 800-207)
Soru 1926Soru →

A security analyst is reviewing access policies during an initiative to adopt a Zero Trust Architecture (ZTA). The analyst needs to ensure that access decisions are never granted solely based on a device's physical or network location. Which core Zero Trust principle directly addresses this requirement?

Cevabı ve açıklamayı göster

Cevap: Explicit verification of identity, context, and security posture for every access request

Cevap

Explicit verification of identity, context, and security posture for every access request
Explicit verification mandates that all access requests are authenticated, authorized, and validated against dynamic contextual policies regardless of where the request originates.

Adım Adım Çözüm

1
Identify the primary requirement in the scenario
The scenario requires eliminating automatic trust based on network or physical location.
Zero Trust assumes that threats exist both inside and outside the traditional enterprise perimeter.
2
Evaluate Zero Trust principles against the requirement
Explicit verification requires dynamic authentication and authorization for every access attempt using contextual data.
This guarantees that simply residing on an internal network segment does not grant implicit access to resources.

Anahtar Kavram

Zero Trust Architecture Principles - Explicit Verification
Tahmini Süre:45s
Soru 1927Soru →

An enterprise security manager needs to ensure that high-priority system change requests sent via email cannot be denied by the author after submission. Which of the following security concepts specifically addresses this requirement?

Cevabı ve açıklamayı göster

Cevap: Non-repudiation

Cevap

Non-repudiation
Non-repudiation provides proof of origin and integrity, ensuring that a party to a transaction or communication cannot deny sending a message.

Adım Adım Çözüm

1
Analyze the scenario requirement
The requirement focuses on preventing an author from denying that they submitted an email request.
The core objective is establishing proof of message origin and authenticity.
2
Evaluate candidate security concepts
Non-repudiation provides cryptographic assurance that binds sender identity to the message payload, preventing denial of authorship.
Digital signatures supporting non-repudiation ensure both authenticity and origin validation.

Anahtar Kavram

Non-Repudiation in Security Architecture
Soru 1928Soru →

Match each deception technology term on the left with its corresponding operational description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Honeypot
Honeyfile
Honeynet
Honeytoken

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Honeypot matches with an individual decoy system designed to attract attackers away from production assets. Honeyfile matches with an intentionally attractive dummy document placed to trigger alerts when accessed. Honeynet matches with an entire network segment of decoy systems to study network-wide attacks. Honeytoken matches with a fake piece of data like an API key or credential embedded to track unauthorized usage.
Each deception technology serves a specific operational purpose: Honeypot acts as an individual decoy host; Honeyfile acts as a decoy file; Honeynet acts as an entire decoy network infrastructure; Honeytoken acts as a tracking data element such as an API key or fake credential.

Adım Adım Çözüm

1
Identify single decoy hosts vs. full decoy network structures.
Recognize that a single decoy host is a Honeypot, whereas a full subnet of decoy hosts is a Honeynet.
Scope distinguishes single system traps (honeypots) from network-level environments (honeynets).
2
Differentiate between decoy files and embedded decoy data artifacts.
Map files/documents to Honeyfiles and embedded elements like API keys or credentials to Honeytokens.
Honeyfiles represent discrete documents, while honeytokens represent data elements used as triggers.

Anahtar Kavram

Deception and Disruption Technologies
Tahmini Süre:1m 0s
Soru 1929Soru →

An organization is migrating its customer relationship management operations to a Software as a Service (SaaS) cloud solution. Under the cloud shared responsibility model, which of the following tasks remains the primary responsibility of the organization?

Cevabı ve açıklamayı göster

Cevap: Configuring access permissions and identity management for organizational user accounts

Cevap

Configuring access permissions and identity management for organizational user accounts
Under the cloud shared responsibility model for Software as a Service (SaaS), the cloud service provider (CSP) takes on responsibility for physical infrastructure, hardware, operating systems, hypervisors, and application maintenance. The cloud customer remains responsible for data classification, user identity management, and configuring account access permissions.

Adım Adım Çözüm

1
Identify the cloud service model provided in the scenario.
The scenario specifies a Software as a Service (SaaS) model.
Responsibility boundaries vary depending on whether the service model is IaaS, PaaS, or SaaS.
2
Evaluate the shared responsibility division for SaaS.
The Cloud Service Provider manages hardware, network infrastructure, host operating systems, hypervisors, and software maintenance.
SaaS abstracts all underlying infrastructure and application source code away from the customer.
3
Identify the customer-managed domain in SaaS.
Managing user identity, account provisioning, and data access permissions remains with the cloud customer.
Regardless of the cloud deployment model, data ownership and user access control always remain the responsibility of the cloud tenant.

Anahtar Kavram

Cloud Shared Responsibility Model in SaaS
Tahmini Süre:45s
Soru 1930Soru →

A network administrator conducts a vulnerability assessment on a critical server and discovers that an unencrypted legacy service, Telnet (TCP port 23), is enabled for remote administrative access across the internal network. Which of the following primary vulnerabilities does this host configuration introduce?

Cevabı ve açıklamayı göster

Cevap: Transmission of administrative authentication credentials in cleartext across the network

Cevap

Transmission of administrative authentication credentials in cleartext across the network
Telnet communicates in cleartext without cryptographic protection. Anyone performing packet analysis on the local network segment can easily read administrative credentials and session commands, exposing the host and network to unauthorized access.

Adım Adım Çözüm

1
Analyze the service and port identified in the host assessment
Telnet operates over TCP port 23 as an unencrypted remote access protocol.
Identifying protocol security characteristics is required to assess vulnerability impact.
2
Determine the risk associated with unencrypted management traffic
All traffic, including usernames, passwords, and commands, is sent in plain text.
Unencrypted network communications expose session data to packet sniffing and eavesdropping.

Anahtar Kavram

Unencrypted Legacy Protocols and Network Host Vulnerabilities
Tahmini Süre:45s
Soru 1931Soru →

A security systems administrator analyzes a performance anomaly on an enterprise administrative jump host. System telemetry reveals an unverified process running from `C:\ProgramData\VendorApp\Temp\` that attaches hooks to Windows messaging queues via `SetWindowsHookEx`. Process analysis indicates that the application quietly records active window titles and raw keyboard entry sequences into an encrypted local buffer before exfiltrating the collected logs to a remote server over port 443. The host shows no evidence of automated network scanning, lateral propagation, or unauthorized driver installation. Which of the following malware types has infected the jump host?

Cevabı ve açıklamayı göster

Cevap: Spyware

Cevap

Spyware
The observed malicious program hooks input interfaces (`SetWindowsHookEx`) to log user keystrokes and active application windows, storing them locally before transmitting them off-site over HTTPS. These telemetry artifacts are classic indicators of spyware (specifically keylogging capabilities), designed for covert data surveillance rather than system destruction or propagation.

Adım Adım Çözüm

1
Analyze the observed system behaviors and indicators of compromise (IoCs).
The process hooks `SetWindowsHookEx` to record keystrokes, logs window titles, buffers input locally, and exfiltrates logs remotely over port 443.
Identifying the primary operational objective of the malware establishes its core category.
2
Evaluate propagation and stealth features described in telemetry.
No network replication (worm activity), driver hooking/kernel cloaking (rootkit activity), or file encryption (ransomware activity) is present.
Eliminating non-matching malware capabilities ensures accurate taxonomy classification.
3
Synthesize the IoCs into a standard malware classification.
Covert keylogging and surveillance telemetry directly match the operational definition of Spyware.
Spyware focuses specifically on gathering intelligence and exfiltrating user interaction data without host destruction.

Anahtar Kavram

Malware Indicators of Compromise (Spyware & Keyloggers)
Tahmini Süre:1m 30s
Soru 1932Soru →

A global logistics organization migrates its freight tracking platform to a cloud provider's managed container orchestration service (PaaS). Under the contract, the cloud service provider maintains the physical host infrastructure, hypervisor layer, and control plane nodes. To maintain regulatory compliance, the organization's security architect must establish the operational control boundaries for the deployment. Which of the following security responsibilities rests exclusively with the organization in this managed cloud model?

Cevabı ve açıklamayı göster

Cevap: Configuring container workload security policies, application data encryption keys, and pod access boundaries.

Cevap

Configuring container workload security policies, application data encryption keys, and pod access boundaries.
In PaaS and managed container orchestration environments, the cloud service provider abstracts and manages the underlying hardware, hypervisors, and control plane. The customer retains full ownership and responsibility for application-level security, container workload policies, access control rules, and key management for data encryption.

Adım Adım Çözüm

1
Analyze the cloud service model presented in the scenario.
The scenario describes a managed container service (PaaS) where the cloud service provider (CSP) manages the physical infrastructure, hypervisor, and control plane.
Determining the service model establishes the baseline division of duties under the Shared Responsibility Model.
2
Differentiate CSP responsibilities from customer responsibilities.
The CSP manages host security, physical facilities, and control plane uptime. The customer retains ownership of data classification, container configuration, runtime security, and access rules.
Customers operating in PaaS retain full control over data and application-level security.
3
Identify the option that correctly reflects exclusive customer responsibility.
Managing container security configurations, pod access controls, and application encryption keys is strictly a customer duty.
Application layer controls and customer-managed keys cannot be managed by the CSP.

Anahtar Kavram

Shared Responsibility Model in Platform as a Service (PaaS)
Tahmini Süre:2m 0s
Soru 1933Soru →

During a physical security assessment of an organization's remote branch offices, security auditors discover that unauthorized individuals could gain brief physical access to server hardware hosting edge compute workloads. The audit highlights a critical risk: an attacker with local physical access could reboot the system, modify kernel boot parameters, and force the operating system to load compromised drivers that disable host security software prior to OS initialization. Which of the following enterprise hardening strategies is the MOST effective technical mitigation to prevent this unauthorized pre-boot tampering?

Cevabı ve açıklamayı göster

Cevap: Enable UEFI Secure Boot paired with Measured Boot using a Hardware Root of Trust (TPM) to enforce signature verification and boot chain integrity validation.

Cevap

Enabling UEFI Secure Boot paired with Measured Boot using a Hardware Root of Trust (TPM) to enforce signature verification and boot chain integrity validation.
The correct answer emphasizes UEFI Secure Boot along with Measured Boot and TPM verification. This establishes a trusted boot chain where each stage validates the cryptographic signature of the subsequent stage (firmware -> bootloader -> kernel -> boot-start drivers). If a bootloader parameter or driver has been tampered with by a local attacker, the digital signature check fails and the system refuses to boot the unverified code, effectively preventing early-stage driver suppression.

Adım Adım Çözüm

1
Analyze the threat scenario described in the audit finding.
Identified that the vulnerability occurs during the host hardware initialization phase (pre-boot), where an attacker with physical access tampers with bootloader parameters and boot-start drivers.
Understanding the precise execution phase of the threat is essential for selecting a control that operates at or below that initialization boundary.
2
Evaluate technical mitigation controls capable of restricting host boot behavior.
UEFI Secure Boot establishes a Hardware Root of Trust using cryptographic keys stored in firmware/TPM to inspect digital signatures on bootloaders, OS kernels, and early-launch anti-malware drivers before execution.
If an untrusted driver or modified kernel is detected during startup, Secure Boot halts initialization, preventing the execution of malicious early-stage drivers.
3
Differentiate preventive system hardening from network, application, or detective controls.
Network encryption, WAF filtering, and honeypots do not operate at the firmware/hardware initialization layer and cannot inspect pre-boot integrity.
System hardening against physical pre-boot tampering requires low-level firmware security features rather than perimeter or application-layer defenses.

Anahtar Kavram

Hardware Root of Trust, UEFI Secure Boot, and Measured Boot in Enterprise Host Hardening
Tahmini Süre:2m 0s
Soru 1934Soru →

An organization wants to analyze its newly deployed cloud microservices for runtime security flaws and improper error handling under live execution conditions. The assessment team has been provided with API specifications and functional documentation, but does not have access to the underlying application source code. Which security testing method should the organization perform to satisfy this requirement?

Cevabı ve açıklamayı göster

Cevap: Dynamic Application Security Testing (DAST)

Cevap

Dynamic Application Security Testing (DAST) should be performed because it evaluates a running application in its operational environment without requiring access to source code.
Dynamic Application Security Testing (DAST) evaluates an application by injecting fault-inducing inputs into active endpoints during execution. Because DAST operates on a running instance using exposed interfaces (such as APIs), it does not require access to source code.

Adım Adım Çözüm

1
Analyze the scenario constraints and requirements.
The application must be tested while running (execution state) and source code access is not available (black-box/gray-box testing condition).
Security assessment tools must align with available artifacts and application operational states.
2
Evaluate candidate security testing methodologies.
DAST interacts directly with exposed interfaces/APIs of an executing system to observe responses to malicious inputs and unexpected payloads.
DAST does not require source code and focuses specifically on runtime vulnerabilities.

Anahtar Kavram

Dynamic Application Security Testing (DAST) vs. Other Testing Methodologies
Soru 1935Soru →

An enterprise financial organization is redesigning its network architecture for a cloud-hosted payment gateway platform. While perimeter Next-Generation Firewalls (NGFW) currently inspect all North-South ingress traffic from external clients, recent audit logs revealed that compromised web application nodes in the public presentation subnet attempted unauthorized lateral movement (East-West traffic) to internal database clusters within the same virtual private network. The security team requires a design that enforces granular, application-centric access controls between internal workloads without requiring major subnet re-addressing or causing latency bottlenecks associated with hairpinning internal traffic through a central hardware appliance. Which of the following architectural strategies best satisfies these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy a software-defined microsegmentation architecture utilizing service mesh network policies and mutual TLS (mTLS) between application workload endpoints.

Cevap

Deploying a software-defined microsegmentation architecture utilizing service mesh network policies and mutual TLS (mTLS) between application workload endpoints is the optimal solution.
The correct strategy involves software-defined microsegmentation paired with a service mesh enforcing mTLS. Microsegmentation divides networks into granular security zones down to individual workload instances. By applying policy at the hypervisor or container sidecar level, East-West traffic between web nodes and database clusters is strictly controlled and encrypted regardless of underlying IP subnet structures, eliminating latency from traffic hairpinning through edge firewalls.

Adım Adım Çözüm

1
Analyze the architectural challenge and network traffic vectors.
Identified unauthorized lateral movement (East-West traffic) between compromised web containers and database workloads located within internal network boundaries.
Traditional perimeter firewalls only filter North-South traffic crossing the network boundary and cannot effectively isolate workloads residing inside the same broadcast domain or subnet.
2
Evaluate constraint parameters.
The solution must avoid network hairpinning, IP re-addressing overhead, and performance bottlenecks.
Routing intra-datacenter microservice traffic through a centralized hardware appliance causes latency degradation and scalable failure points.
3
Select the appropriate segmentation model.
Software-defined microsegmentation via service mesh / host network policies enforces identity-based zero-trust isolation directly at the software workload layer.
Microsegmentation isolates individual workloads down to the single container or VM level regardless of physical network topology or shared subnets.

Anahtar Kavram

Microsegmentation and East-West Traffic Isolation
Tahmini Süre:2m 0s
Soru 1936Soru →

A system administrator needs to configure a mission-critical web server to ensure continuous operation even if a single network interface card (NIC) or power circuit fails. Which of the following hardware resilience controls should the administrator implement to eliminate these specific single points of failure? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: NIC teaming configured across separate physical switches; Redundant power supplies connected to independent Power Distribution Units (PDUs)

Cevap

The administrator should implement NIC teaming configured across separate physical switches and redundant power supplies connected to independent PDUs.
The combination of NIC teaming and dual power supplies connected to separate PDUs ensures component-level fault tolerance for both network connectivity and electrical power, satisfying the goal of removing single points of failure.

Adım Adım Çözüm

1
Identify the network interface single point of failure requirement.
Combine multiple network interface cards using NIC teaming connected to distinct switch paths to ensure continuous connectivity upon link failure.
NIC teaming provides adapter fault tolerance at the network layer.
2
Identify the power infrastructure single point of failure requirement.
Equip the server with redundant power supply units (PSUs) plugged into independent electrical circuits via separate PDUs.
Dual PSUs on separate PDUs ensure uninterrupted power delivery if a PSU or power feed drops out.

Anahtar Kavram

Hardware Fault Tolerance and Link Redundancy
Soru 1937Soru →

A digital media broadcasting corporation stores petabytes of high-definition video archives within an enterprise object storage platform. To fulfill compliance mandates from content licensors, the security team must implement a data protection solution that enforces hardware-rooted key protection, strict audit logging of key access requests, and annual key rotation. Crucially, the key rotation process must not require re-encrypting the underlying multi-terabyte static data objects. Which of the following storage security architectures best meets these combined requirements?

Cevabı ve açıklamayı göster

Cevap: Implement envelope encryption using Data Encryption Keys (DEKs) wrapped by Key Encryption Keys (KEKs) stored within a Hardware Security Module (HSM).

Cevap

Envelope encryption using Data Encryption Keys (DEKs) wrapped by Key Encryption Keys (KEKs) inside a Hardware Security Module (HSM) satisfies all requirements.
Envelope encryption utilizes a symmetric Data Encryption Key (DEK) to encrypt bulk data objects and a Key Encryption Key (KEK) managed inside a Hardware Security Module (HSM) to encrypt the DEKs. When key rotation occurs, only the KEK wrapping the DEKs needs to be updated, enabling instant key rotation without reading or re-writing petabytes of static video files. This fulfills hardware-rooted security, access auditing, and zero-downtime key rotation requirements.

Adım Adım Çözüm

1
Analyze storage encryption scale and constraints
Re-encrypting petabytes of static video data during annual key rotation is computationally prohibitive and operationally unfeasible.
Direct bulk data re-encryption requires reading and re-writing all stored data objects.
2
Evaluate key management architectures
Envelope encryption separates data payload encryption (symmetric DEK) from root key protection (KEK).
Rotating the KEK only requires re-wrapping the DEK, leaving the underlying encrypted data payload untouched.
3
Integrate compliance requirements for hardware protection and auditing
Housing the KEK in a Hardware Security Module (HSM) fulfills hardware-rooted security and centralized audit logging requirements.
HSMs provide tamper-resistant key storage and detailed access trail generation.

Anahtar Kavram

Envelope Encryption and HSM Integration for Storage Security
Soru 1938Soru →

An application security analyst is evaluating a custom backend Java service that receives serialized object payloads over an unauthenticated network socket to restore user session state. Code review reveals that the application reinstantiates these binary payloads directly into memory without performing type verification or input validation. Which of the following security risks and mitigation strategies correctly apply to this scenario? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The application is vulnerable to insecure deserialization, which can enable remote code execution or arbitrary object state manipulation.; Refactoring the application to use structured, type-safe data interchange formats (such as JSON or Protocol Buffers) mitigates the vulnerability.

Cevap

The application is vulnerable to insecure deserialization, which can enable remote code execution, and refactoring the service to use safe data interchange formats like JSON or Protocol Buffers mitigates the risk.
Insecure deserialization occurs when untrusted data is used to instantiate objects, allowing attackers to manipulate application logic or execute arbitrary commands. Using type-safe data formats like JSON removes the capability for attackers to supply executable object creation payloads.

Adım Adım Çözüm

1
Analyze the technical scenario for vulnerability indicators
Identified unvalidated binary object payload instantiation over a network socket.
Passing serialized objects directly into memory without type checking defines insecure deserialization.
2
Identify the primary security threat
Insecure deserialization allows remote code execution (RCE) or state manipulation during object reconstruction.
Serialized streams can contain execution gadget chains that trigger upon instantiation.
3
Select appropriate application-level remediation controls
Replace binary object serialization with safe data serialization formats like JSON.
Data-only serialization formats prevent object bytecode execution during parsing.

Anahtar Kavram

Insecure Deserialization and Application Remediation Controls
Soru 1939Soru →

A Security Operations Center (SOC) analyst receives a high-severity SIEM alert and extracts the following raw Active Directory Kerberos ticket request log entry from a central domain controller:

text
Event ID: 4769
Status: 0x0
TargetUserName: [email protected]
Service Name: MSSQLSvc/sql-prod01.finance.local:1433
Service ID: S-1-5-21-3829102-1204918-948102-5102
Ticket Options: 0x40810000
Ticket Encryption Type: 0x17
Client Address: ::ffff:10.12.84.45
Client Port: 53218

Based on the log snippet provided, which threat activity is occurring, and how should the SIEM correlation rule be configured to detect future instances of this attack while minimizing false positives?

Cevabı ve açıklamayı göster

Cevap: A Kerberoasting attack is occurring; configure the SIEM correlation rule to flag Event ID 4769 requests that specify legacy RC4 encryption (0x17) for non-machine Service Principal Names (SPNs).

Cevap

The activity represents a Kerberoasting attack. The SIEM correlation rule should be configured to detect Event ID 4769 logs requesting RC4 encryption (0x17) associated with non-machine user accounts.
The log entry displays Windows Event ID 4769 (Kerberos Service Ticket Request) with a Ticket Encryption Type of 0x17 (RC4-HMAC) for a database service principal name (MSSQLSvc). In Kerberoasting attacks, adversary accounts request Kerberos service tickets for accounts with configured SPNs explicitly requesting downgrade to RC4 encryption, which allows for fast offline cracking of the service account's plain-text password. Fine-tuning the SIEM correlation rule to watch for Event ID 4769 where Ticket Encryption Type is 0x17 targeting user-associated SPNs provides high-confidence detection.

Adım Adım Çözüm

1
Analyze Event ID and Log Metadata
Event ID 4769 corresponds to a Kerberos Service Ticket Request (TGS-REQ). Status 0x0 confirms the request succeeded.
Identifying the event type establishes whether authentication, authorization, or service ticket issuing is taking place.
2
Evaluate Service Name and Encryption Type Parameters
The Service Name targets a SQL service SPN (`MSSQLSvc/...`), and the requested Ticket Encryption Type is `0x17` (RC4-HMAC).
Modern Active Directory environments default to AES-128 (0x12) or AES-256 (0x18). Requesting RC4 (0x17) allows threat actors to extract the ticket from memory and perform offline password brute-forcing (Kerberoasting).
3
Determine Optimal SIEM Correlation Logic
A high-fidelity rule filters for Event ID 4769 where `Ticket Encryption Type` equals `0x17` and the `TargetUserName` is a service account.
Filtering specifically on legacy encryption requests for user-bound SPNs isolates offline ticket extraction attacks while excluding standard AES kerberos traffic.

Anahtar Kavram

Kerberoasting Detection via Event ID 4769 Analysis
Soru 1940Soru →

An enterprise financial services organization is redesigning its hybrid cloud infrastructure to transition from a legacy perimeter security model to a Zero Trust Architecture (ZTA). The security architecture team must define mandatory implementation standards that adhere strictly to NIST SP 800-207 Zero Trust tenets. Which of the following architectural requirements must be enforced to align with Zero Trust principles? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Decouple Policy Decision Point (PDP) logic from Policy Enforcement Points (PEPs) to evaluate continuous contextual telemetry before granting resource access.; Enforce explicit per-session authorization and microsegmentation for all resource requests, treating internal network traffic with the same baseline distrust as external traffic.

Cevap

The correct architectural requirements are decoupling the Policy Decision Point from Policy Enforcement Points to evaluate dynamic contextual telemetry, and enforcing explicit per-session authorization with microsegmentation across all network traffic.
Zero Trust Architecture relies on continuous verification and explicit authorization for every resource request regardless of network position. Decoupling the Policy Decision Point (PDP) from Policy Enforcement Points (PEPs) ensures central, dynamic policy decisions driven by continuous telemetry, while microsegmentation and per-session validation enforce granular control across all enterprise environments.

Adım Adım Çözüm

1
Analyze core Zero Trust Architecture principles
Identified tenets including assumed breach, explicit verification, continuous authentication, dynamic policy evaluation, and microsegmentation.
Zero Trust rejects implicit trust based on network position or single point-in-time authentication.
2
Evaluate control plane architectural components
Confirmed that the Policy Decision Point must dynamically process endpoint telemetry and enterprise policy, instructing Policy Enforcement Points to grant or restrict granular resource access.
Separating policy decision logic from policy enforcement enables adaptive access management.
3
Differentiate Zero Trust controls from legacy perimeter assumptions
Disqualified options that assume internal network safety or treat initial authentication as permanent authorization for a session.
Initial VPN authentication or perimeter location cannot confer implicit trust in a Zero Trust model.

Anahtar Kavram

Zero Trust Architecture Principles and Component Roles (PDP/PEP)
ÖncekiSayfa 97 / 112Sonraki
Tüm alıştırma soruları — CompTIA Security+ | Examkin