Examkin

General Security Concepts

268 soru

Tüm türler268Çoktan seçmeli139Çoklu seçim58Eşleştirme57Sıralama14
Soru 201Soru →

During a post-incident review at a logistics company, security analysts discovered that an administrator modified system event logs and disputed making any changes. The logging infrastructure maintained file integrity using standalone SHA-256 hashes stored alongside the logs, but because multiple staff members had write permissions to update those hash files, individual accountability could not be established. Which of the following solutions should the organization implement to achieve non-repudiation for log updates?

Cevabı ve açıklamayı göster

Cevap: Asymmetric digital signatures generated using individual private keys

Cevap

Asymmetric digital signatures generated using individual private keys
Digital signatures enforce non-repudiation by combining a cryptographic hash with asymmetric key pairs. Because the private key is strictly held by a single individual, any signature verified using that individual's public key conclusively proves origin and authenticity, preventing the sender from denying their action.

Adım Adım Çözüm

1
Analyze the problem requirement
The organization requires proof of origin for log entries so administrators cannot deny performing modifications.
Simple hashes prove integrity (data has not changed unintentionally), but do not prove identity (who generated or modified the data).
2
Evaluate cryptographic security services
Non-repudiation requires a mechanism tied uniquely to a single entity that cannot be forged by others sharing access.
Asymmetric cryptography pairs a private key (held exclusively by one user) with a public key (used by anyone to verify signatures).
3
Select the appropriate control
Digital signatures provide non-repudiation, integrity, and authentication simultaneously.
Because only the private key owner could have produced the signature, the signer cannot claim the log entry came from someone else.

Anahtar Kavram

Non-Repudiation vs. Integrity in the CIA Triad
Tahmini Süre:1m 0s
Soru 202Soru →

An enterprise security engineer is auditing the AAA implementation of a newly deployed hybrid cloud access portal. The engineer needs to ensure that access governance controls are strictly categorized according to core AAA principles. Which of the following technical controls specifically perform the Authorization function within this framework? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Applying dynamic VLAN segment assignments and contextual network access rules based on validated security group attributes; Enforcing role-based resource permissions that restrict file system read and write privileges after identity validation

Cevap

The correct controls are applying dynamic VLAN segment assignments based on security groups and enforcing role-based resource permissions after identity validation.
Authorization is responsible for determining permissions and enforcing access boundaries once identity is established. Applying dynamic VLAN access rules based on user group entitlement and enforcing role-based read/write file permissions both explicitly grant or restrict resource access based on policies.

Adım Adım Çözüm

1
Analyze the AAA framework definitions
Authentication proves WHO a user is. Authorization defines WHAT a user can do. Accounting records WHAT a user did and WHEN.
Clear pillar separation is required to correctly map controls to AAA functions.
2
Evaluate the controls presented in the scenario
Dynamic VLAN/access rule assignments and role-based file system permissions directly regulate access to resources based on entitlements.
These controls determine permissions and privilege levels post-identification, which is the exact definition of authorization.
3
Differentiate authentication and accounting distractors
TOTP verification confirms identity (Authentication), while streaming session logs and metrics captures activity tracking data (Accounting).
Neither identity proofing nor log aggregation grants or restricts resource permissions.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA)
Soru 203Soru →

A systems analyst is selecting an encryption method to protect large volumes of static data archived on enterprise storage arrays. The primary requirement is high-speed performance and minimal processing overhead during bulk encryption and decryption operations. Which of the following cryptographic approaches should the analyst implement?

Cevabı ve açıklamayı göster

Cevap: Symmetric encryption using the Advanced Encryption Standard (AES)

Cevap

The analyst should implement symmetric encryption using the Advanced Encryption Standard (AES).
Symmetric key encryption algorithms, such as AES, use the same secret key for both encryption and decryption operations. Due to their mathematical efficiency, symmetric ciphers process large blocks of data rapidly with low CPU usage, making them the standard choice for bulk data-at-rest encryption.

Adım Adım Çözüm

1
Identify the operational requirement from the scenario.
The requirement calls for encrypting large volumes of archived storage with high performance and low computational overhead.
Bulk storage encryption requires an algorithm capable of processing large streams of data without creating processing bottlenecks.
2
Compare algorithm categories for bulk data processing.
Symmetric ciphers use a single key and optimized substitution-permutation operations, making them significantly faster and less resource-intensive than asymmetric ciphers.
Asymmetric algorithms are designed primarily for key exchange, digital signatures, and small payloads due to their high computational cost.

Anahtar Kavram

Symmetric vs. Asymmetric Encryption Performance for Bulk Data
Tahmini Süre:45s
Soru 204Soru →

Match each network access control scenario on the left with the corresponding pillar of the Authentication, Authorization, and Accounting (AAA) framework (or Identification) on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A user enters their account username into a system prompt prior to submitting credentials.
A server validates a user's password and one-time passcode (OTP) against a central database.
A security policy engine checks a user's role and grants read-only access to a specific database.
A gateway logs session start and end times, command history, and total byte counts for auditing.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Entering a username corresponds to Identification. Validating passwords and OTP codes corresponds to Authentication. Enforcing role-based access permissions corresponds to Authorization. Recording session duration and bandwidth consumption corresponds to Accounting.
Each phase of the access control workflow fulfills a distinct AAA pillar: Identification claims identity, Authentication verifies credentials, Authorization enforces permissions, and Accounting logs activity metrics.

Adım Adım Çözüm

1
Analyze the first scenario (entering a username).
Entering a username is the assertion of identity before verification, matching Identification.
Identification establishes who the user claims to be.
2
Analyze the second scenario (validating passwords and OTP codes).
Verifying secret credentials proves the identity claim, matching Authentication.
Authentication verifies proof of identity.
3
Analyze the third scenario (checking roles to grant database permissions).
Restricting access based on policies matches Authorization.
Authorization defines what actions an authenticated user is permitted to perform.
4
Analyze the fourth scenario (logging session duration and byte counts).
Recording usage metrics and session logs matches Accounting.
Accounting tracks resource usage and creates audit logs for oversight.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA) Framework
Soru 205Soru →

A healthcare organization is replacing its legacy virtual private network (VPN) infrastructure with a Zero Trust Architecture (ZTA) to secure access to electronic health record (EHR) microservices hosted across hybrid cloud environments. Which of the following design decisions directly reflect core Zero Trust Architecture principles? (Select THREE.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Re-evaluating identity, device posture, and risk context continuously throughout active sessions rather than relying solely on initial authentication; Implementing microsegmentation and granular authorization policies that restrict access strictly to the explicit resources required for each request; Treating all network traffic as inherently untrusted regardless of whether it originates inside or outside the traditional corporate network boundary

Cevap

The core tenets of Zero Trust Architecture include continuous verification of context throughout active sessions, enforcement of least privilege via granular microsegmentation, and assuming breach by treating all internal and external network traffic as untrusted.
Zero Trust Architecture is anchored by three primary tenets: explicit verification (continuously validating identity, device posture, and context), least privilege access (restricting access to specific resources via microsegmentation), and assuming breach (treating all network traffic as untrusted regardless of origin). Together, these mechanisms eliminate implicit perimeter trust.

Adım Adım Çözüm

1
Analyze the core principles defined by Zero Trust Architecture (such as NIST SP 800-207).
Zero Trust relies on explicit verification, least privilege, and assuming breach regardless of physical or logical network position.
Traditional perimeter security relies on implicit trust within internal subnets, whereas Zero Trust removes implicit trust completely.
2
Evaluate each option against continuous verification, least privilege, and zero implicit perimeter trust.
Continuous re-evaluation of user/device risk, microsegmentation for granular access, and inspecting all network traffic regardless of origin reflect these principles.
These three practices ensure every access request is explicitly authorized using real-time context.
3
Identify misconfigurations and legacy assumptions in the remaining options.
Granting persistent network access after initial MFA and relying solely on firewall IP filters incorrectly depend on static network boundaries and implicit trust.
Static IP rules and one-time authentication fail to validate ongoing session security or application-layer context.

Anahtar Kavram

Zero Trust Architecture Principles (Explicit Verification, Least Privilege, Assume Breach)
Soru 206Soru →

An enterprise organization is establishing a micro-segmented hybrid environment based on Zero Trust Architecture (ZTA) control plane and data plane principles. Match each logical Zero Trust component on the left with its correct operational responsibility on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Policy Engine (PE)
Policy Administrator (PA)
Policy Enforcement Point (PEP)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Policy Engine (PE) matches with evaluating contextual signals and determining access decisions; Policy Administrator (PA) matches with issuing dynamic credentials and signaling path setups; Policy Enforcement Point (PEP) matches with operating in the data plane to inspect traffic and enforce access boundaries.
Under NIST SP 800-207, Zero Trust architecture divides functions between the control plane and data plane. The Policy Engine evaluates trust inputs to decide access. The Policy Administrator communicates control decisions by managing credentials and signaling gateways. The Policy Enforcement Point sits on the data plane to enforce session bounds.

Adım Adım Çözüm

1
Analyze the core function of the Policy Engine (PE)
Identify that the Policy Engine is purely analytical and rule-based, responsible for evaluating trust signals to reach an access decision.
Control plane separation isolates decision logic within the Policy Engine component.
2
Analyze the core function of the Policy Administrator (PA)
Identify that the Policy Administrator acts on the Policy Engine decision by generating required short-lived tokens or keys and signaling the data plane.
The Policy Administrator serves as the control plane actuator between decision logic and physical gateway mechanisms.
3
Analyze the core function of the Policy Enforcement Point (PEP)
Identify that the Policy Enforcement Point directly handles payload traffic on the data plane to permit, restrict, or break session connections.
Data plane enforcement requires inline monitoring and access control mechanisms.

Anahtar Kavram

Logical Components of Zero Trust Architecture (Policy Engine, Policy Administrator, Policy Enforcement Point)
Tahmini Süre:2m 0s
Soru 207Soru →

Match each cryptographic concept or algorithm on the left with its corresponding operational security objective on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Diffie-Hellman (DH)
HMAC
Elliptic Curve Cryptography (ECC)
AES-GCM

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Diffie-Hellman matches establishing a shared secret over an untrusted channel; HMAC matches verifying data integrity and authenticity using a hash and secret key; Elliptic Curve Cryptography matches providing RSA-equivalent security with smaller key sizes; AES-GCM matches delivering authenticated encryption providing confidentiality and integrity.
Each cryptographic concept correctly maps to its definition: Diffie-Hellman enables secure key exchange over untrusted channels; HMAC provides keyed hash authentication; ECC offers high-strength public key security with small key sizes; and AES-GCM provides authenticated symmetric encryption.

Adım Adım Çözüm

1
Identify key exchange mechanisms.
Diffie-Hellman is paired with secure key negotiation across insecure channels.
Diffie-Hellman enables key exchange without broadcasting the shared secret.
2
Analyze message authentication controls.
HMAC pairs with message authentication using secret keys and hashing.
HMAC incorporates a symmetric key into hashing for integrity and authenticity.
3
Evaluate lightweight asymmetric cryptography choices.
ECC pairs with high security, low computational overhead, and smaller key sizes.
ECC achieves equivalent RSA security with shorter keys.
4
Examine symmetric authenticated encryption modes.
AES-GCM pairs with authenticated encryption providing confidentiality and integrity simultaneously.
Galois/Counter Mode (GCM) combines counter mode encryption with Galois field authentication.

Anahtar Kavram

Cryptographic Concepts and Algorithms
Soru 208Soru →

Match each enterprise AAA protocol mechanism or access control payload on the left with its corresponding functional role and operational process on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

RADIUS payload containing Acct-Status-Type = Stop and Acct-Input-Octets = 4194304
TACACS+ packet authorization phase sending AUTHOR_REQUEST for command 'configure terminal'
SAML 2.0 Response payload containing a digitally signed Assertion issued by an Identity Provider (IdP)
IEEE 802.1X EAP-TLS handshake exchanging X.509 client and server certificates

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

RADIUS payload with Acct-Status-Type pairs with Resource Usage & Session Metric Logging (Accounting). TACACS+ AUTHOR_REQUEST pairs with Per-Command Privilege Scoping & Execution Filtering (Authorization). SAML 2.0 Assertion pairs with Federated Identity Verification & Assertion Delivery (Authentication). IEEE 802.1X EAP-TLS handshake pairs with Mutual Cryptographic Identity Verification (Authentication).
The correct pairings evaluate the specific AAA functional domain of each enterprise protocol packet. RADIUS accounting attributes collect metric logs for session auditing. TACACS+ decouples authorization to inspect per-command execution rights. SAML assertions transmit federated identity authentication results across web domains. EAP-TLS enforces mutual authentication using digital certificate handshakes.

Adım Adım Çözüm

1
Analyze the RADIUS Acct-Status-Type payload.
Identified as an Accounting mechanism tracking data transfer volume (octets) and session state.
RADIUS uses Accounting-Request messages (such as Start, Stop, and Interim-Update) to log metrics for auditing and billing.
2
Analyze the TACACS+ AUTHOR_REQUEST payload.
Identified as an Authorization mechanism evaluating individual CLI commands.
TACACS+ decouples AAA, allowing granular authorization queries for specific administrative commands prior to execution.
3
Analyze the SAML 2.0 Response payload.
Identified as a Federated Authentication mechanism using IdP assertions.
SAML assertions communicate user authentication state across domain boundaries from an IdP to a SP.
4
Analyze the IEEE 802.1X EAP-TLS handshake.
Identified as a Mutual Authentication protocol based on dual X.509 certificate validation.
EAP-TLS requires both client and server certificates, satisfying mutual authentication demands at Network Access Control endpoints.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA) Protocol Functional Separation
Tahmini Süre:3m 0s
Soru 209Soru →

A security engineer needs to ensure that software updates distributed to client workstations cannot be denied by the vendor and that their authenticity and integrity can be verified upon download. Which of the following cryptographic techniques directly provides non-repudiation?

Cevabı ve açıklamayı göster

Cevap: Digital signing using asymmetric cryptography

Cevap

Digital signing using asymmetric cryptography
Digital signing utilizes asymmetric cryptography where a sender signs a message digest with their private key. Anyone with access to the public key can verify the signature, proving that the content originated from the private key owner and was not altered, thereby establishing non-repudiation.

Adım Adım Çözüm

1
Identify the primary security requirement from the scenario
The requirement is non-repudiation and origin verification for distributed software updates.
Non-repudiation prevents an entity from denying the creation or authorship of data.
2
Evaluate cryptographic mechanisms against non-repudiation criteria
Digital signatures encrypt a hash digest of the update file using the vendor's private key.
Because only the private key owner can generate the signature, verification with the corresponding public key proves authenticity and prevents denial.

Anahtar Kavram

Digital Signatures and Non-Repudiation
Soru 210Soru →

A network administrator is reviewing access management logs on a remote access VPN gateway. The logs indicate that after a user successfully presents a valid username, password, and time-based one-time password (TOTP), the gateway queries an LDAP directory to check the user's assigned group memberships and determine which specific internal subnets the user is permitted to reach. Which pillar of the AAA framework is being executed during this group membership evaluation?

Cevabı ve açıklamayı göster

Cevap: Authorization

Cevap

Authorization is the pillar of the AAA framework executed when evaluating group membership to grant or restrict access to network resources.
Authorization is responsible for determining permissions and enforcing access policies for an authenticated identity. Checking group membership to grant access to specific subnets directly fulfills the authorization pillar.

Adım Adım Çözüm

1
Analyze the action described in the scenario
The system validates group memberships to determine permitted subnets after identity credentials have already been verified.
Separating identity verification from permission assignment is fundamental to understanding AAA.
2
Map the specific technical action to AAA pillars
Credential presentation (username/password/TOTP) = Authentication; Policy check for resource rights (subnet permissions) = Authorization; Log generation/session tracking = Accounting.
Authorization explicitly defines the rights, privileges, and boundaries granted to a verified identity.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA) Functional Boundaries
Tahmini Süre:1m 15s
Soru 211Soru →

An organization installs highly visible warning signs along the perimeter fence of a secure facility stating that trespassers will be prosecuted. Which of the following security control types is best demonstrated by this measure?

Cevabı ve açıklamayı göster

Cevap: Deterrent control

Cevap

Deterrent control
Deterrent controls aim to discourage potential threat actors from attempting an attack by broadcasting warnings or a visible security presence prior to any unauthorized action.

Adım Adım Çözüm

1
Identify the primary objective of the implemented control.
The control consists of visible warning signs placed prior to any intrusion attempt.
Evaluating when and how the control acts determines its functional classification.
2
Map the objective to CompTIA Security+ functional control types.
Controls intended to dissuade adversaries from attempting an attack are classified as deterrent controls.
Warning signs act as a psychological barrier rather than an active physical block or detection mechanism.

Anahtar Kavram

Functional Security Control Types (Deterrent Controls)
Tahmini Süre:45s
Soru 212Soru →

An aerospace engineering firm hosts sensitive CAD schematics on an internal server. Previously, any workstation connected to the internal corporate LAN was implicitly trusted and allowed access to the repository after a single initial morning domain login. To align this environment with Zero Trust Architecture (ZTA) principles, which strategy should the security team implement?

Cevabı ve açıklamayı göster

Cevap: Enforce explicit authentication and contextual authorization for every access request to the schematics repository, regardless of the user's network location.

Cevap

Enforce explicit authentication and contextual authorization for every access request to the schematics repository, regardless of the user's network location.
Zero Trust Architecture mandates that no network, user, or device is inherently trusted based on physical location or network placement. Enforcing continuous verification through explicit authentication and contextual authorization for every request directly fulfills ZTA principles.

Adım Adım Çözüm

1
Identify the weakness in the legacy security model described in the scenario.
The current model relies on implicit trust granted to devices simply because they are connected to the internal corporate LAN.
Perimeter-focused security assumes internal traffic is trustworthy, leaving internal data vulnerable if an attacker gains access to the corporate network.
2
Apply core Zero Trust Architecture principles to address the architectural limitation.
Transition to explicit verification and continuous authorization for every request.
Zero Trust operates on the principle of 'never trust, always verify,' requiring identity, device stance, and environmental context to be continuously validated regardless of network location.

Anahtar Kavram

Zero Trust Architecture Principles - Explicit Verification and Continuous Assessment
Soru 213Soru →

A security infrastructure team is establishing proactive defense capabilities across an enterprise environment. Match each disruption or deception technology on the left with the scenario that best illustrates its primary operational objective on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Low-interaction honeypot
High-interaction honeypot
DNS sinkhole
Honeytoken

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Low-interaction honeypot matches with emulating basic network service banners; High-interaction honeypot matches with capturing complex zero-day exploitation within a fully operational OS; DNS sinkhole matches with intercepting outbound malicious domain queries; Honeytoken matches with embedding decoy cloud API keys into source code repositories.
Each deception and disruption technology aligns with its core functionality: low-interaction honeypots emulate basic services for low-overhead scanning alerts; high-interaction honeypots run complete operating systems for detailed behavioral analysis; DNS sinkholes block external attacker communication by altering DNS responses; honeytokens serve as decoy credentials to detect unauthorized repository exposure.

Adım Adım Çözüm

1
Analyze resource usage and emulation depth for decoy systems.
Low-interaction honeypots provide basic service responses with minimal overhead, while high-interaction honeypots provide full OS environments for detailed threat research.
Differentiating between low-interaction and high-interaction environments relies on evaluating system resource requirements versus intelligence depth.
2
Identify network disruption controls targeting traffic redirection.
DNS sinkholing manipulates domain resolution to prevent compromised endpoints from contacting external C2 infrastructure.
DNS sinkholes function specifically at the name resolution layer to disrupt malicious communication channels.
3
Evaluate data-centric decoy mechanisms.
Honeytokens consist of fake credentials or data artifacts placed within legitimate systems to detect unauthorized data access.
Decoy keys placed in repositories represent non-functional credential artifacts designed purely for alerting.

Anahtar Kavram

Deception and Disruption Technologies
Soru 214Soru →

Match each operational enterprise security scenario on the left with the corresponding Authentication, Authorization, or Accounting (AAA) functional mechanism on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

An enterprise user submits a password and hardware security key response to an identity provider (IdP) to establish a trusted session.
A microservices gateway inspects embedded scope claims within a bearer token to determine if an API client can execute a database write operation.
A remote access gateway transmits session connection timestamps, disconnect codes, and total megabytes transferred to a central RADIUS server.
A privileged access management (PAM) system records administrative sudo commands, process IDs, and file modification details to an audit repository.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The user credential submission matches Authentication (verifying claimed identity); the API gateway token scope check matches Authorization (evaluating access rights); transmitting session timestamps and bandwidth metrics matches Accounting (measuring resource consumption); and logging privileged commands matches Accounting (logging actions for auditability and non-repudiation).
Each security scenario corresponds directly to its functional AAA pillar: validating user credentials (passwords/keys) establishes identity (Authentication); evaluating token scopes determines permission boundaries for API write calls (Authorization); recording connection metrics tracks resource utilization (Session Accounting); and logging administrative command execution creates a verifiable trail for non-repudiation (Activity Accounting).

Adım Adım Çözüm

1
Analyze scenario 1 (credential validation at the IdP).
Identified as proof of identity (passwords and MFA tokens).
Authentication is strictly responsible for verifying that a subject is who they claim to be prior to granting access.
2
Analyze scenario 2 (evaluating bearer token scopes at an API gateway).
Identified as permission enforcement based on policy/scopes.
Authorization determines what an authenticated subject is allowed to perform on specific resources.
3
Analyze scenario 3 (transmitting session start/stop times and data volume).
Identified as resource utilization and session tracking metrics.
Accounting measures consumption metrics such as connection time, data throughput, and session state.
4
Analyze scenario 4 (recording executed sudo commands and file changes in a PAM system).
Identified as security audit logging and accountability enforcement.
Accounting captures event logs of user actions to ensure traceability, compliance auditing, and non-repudiation.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA)
Tahmini Süre:2m 0s
Soru 215Soru →

A financial services firm is modernizing its security architecture by transitioning from a traditional boundary defense model to a Zero Trust Architecture (ZTA). The security engineering team is defining foundational policy controls for both cloud workloads and remote workforce access. Which of the following architectural practices directly implement core Zero Trust Architecture principles? (Select THREE)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Dynamically re-evaluating access privileges using real-time contextual signals, such as device security posture, user location, and behavioral telemetry.; Implementing microsegmentation around workload boundaries under the operating assumption that internal network segments are inherently untrusted.; Enforcing explicit validation and strict least privilege access rules on a per-session and per-resource granular basis.

Cevap

The core practices implementing Zero Trust Architecture principles are continuous context-based dynamic re-evaluation, microsegmentation assuming internal network segments are untrusted, and explicit validation enforcing least privilege on a per-session/per-resource basis.
Zero Trust Architecture removes implicit trust from enterprise networks. Valid architectural implementations include: dynamically re-evaluating risk and access permissions using ongoing context (such as device state and user location), isolating environments via microsegmentation because internal networks are considered untrusted, and requiring explicit validation of identity and permissions based on least privilege for every individual resource session.

Adım Adım Çözüm

1
Analyze core Zero Trust Architecture (ZTA) tenets defined in framework standards like NIST SP 800-207.
Identified tenets: assume breach, never trust always verify, explicit validation, least privilege, and continuous monitoring/re-evaluation.
Establishing accurate baseline tenets is essential for distinguishing valid ZTA controls from legacy boundary assumptions.
2
Evaluate the option regarding dynamic real-time contextual signals.
Valid ZTA practice.
Continuous verification requires ongoing analysis of device compliance, user behavior, and environmental context throughout the session lifetime.
3
Evaluate the option regarding microsegmentation and internal network assumptions.
Valid ZTA practice.
ZTA operates under an 'assume breach' posture where internal assets receive no default network-level implicit trust.
4
Evaluate the option regarding explicit validation and per-resource least privilege.
Valid ZTA practice.
ZTA mandates enforcing explicit, granular authorization decisions for every individual access request.
5
Differentiate and reject distractors relying on perimeter location trust or static persistent authentication tokens.
Distractor options identified and excluded.
Location-based implicit trust and static post-MFA persistence represent legacy perimeter concepts incompatible with Zero Trust.

Anahtar Kavram

Zero Trust Architecture Principles (Assume Breach, Continuous Verification, Explicit Validation, Least Privilege)
Tahmini Süre:2m 0s
Soru 216Soru →

A security architect is implementing NIST SP 800-207 Zero Trust Architecture (ZTA) logical components within an enterprise hybrid network. Match each Zero Trust logical component on the left with its correct operational responsibility on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Policy Engine (PE)
Policy Administrator (PA)
Policy Enforcement Point (PEP)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Policy Engine matches evaluating policy rules and rendering access decisions; Policy Administrator matches issuing control signals to open or close session connections; Policy Enforcement Point matches intercepting and enforcing access controls on data plane traffic.
In NIST SP 800-207 Zero Trust Architecture, responsibilities are split across control and data planes: the Policy Engine renders access decisions based on contextual risk and policy; the Policy Administrator handles control channel signaling to establish or break connections; and the Policy Enforcement Point acts as the data plane gatekeeper enforcing those decisions on live session traffic.

Adım Adım Çözüm

1
Identify the primary role of the Policy Engine (PE)
The Policy Engine acts as the decision-making authority within the Zero Trust control plane.
Under NIST SP 800-207, the Policy Engine uses trust algorithms and contextual input to determine whether access should be granted.
2
Identify the primary role of the Policy Administrator (PA)
The Policy Administrator manages session state and control plane commands.
Once the Policy Engine renders a decision, the Policy Administrator signals the underlying gateway or client components to open or close the connection.
3
Identify the primary role of the Policy Enforcement Point (PEP)
The Policy Enforcement Point functions as the data plane gateway.
The Policy Enforcement Point sits directly in the communication channel to monitor, allow, or drop connection traffic based on instructions from the Policy Administrator.

Anahtar Kavram

Zero Trust Control Plane vs. Data Plane Component Functions
Tahmini Süre:1m 30s
Soru 217Soru →

A system administrator needs to update an operational system to resolve a software vulnerability. Which of the following actions should the administrator take FIRST as part of the formal change management process to evaluate potential security impacts?

Cevabı ve açıklamayı göster

Cevap: Test the update in a staging environment to evaluate functionality and security side effects.

Cevap

Test the update in a staging environment to evaluate functionality and security side effects.
Testing software updates in a non-production staging environment ensures that potential security flaws, instability, or system incompatibilities are identified and resolved before moving changes to live production systems.

Adım Adım Çözüm

1
Identify the primary requirement in change control procedures.
Recognize that proposed system modifications must be evaluated for security impacts prior to production release.
Controlled testing prevents unexpected security gaps or operational failures.
2
Select the initial step of assessing impact.
Conducting testing in a non-production staging environment provides empirical data on stability and security.
Staging mirrors production without exposing live systems to operational risk.

Anahtar Kavram

Evaluating security impacts in change management staging environments
Tahmini Süre:45s
Soru 218Soru →

A lead security analyst is reviewing the cryptographic design for an enterprise file storage service. The system must encrypt multi-gigabyte data archives efficiently while ensuring data confidentiality, integrity, and origin authenticity. The engineering team proposes encrypting each entire backup file directly using RSA-4096 asymmetric encryption to achieve confidentiality and non-repudiation in a single operation. Which of the following architectural modifications should the security analyst require to meet both performance and security objectives?

Cevabı ve açıklamayı göster

Cevap: Transition to a hybrid encryption scheme utilizing AES-GCM for bulk file encryption and RSA to encrypt the symmetric data encryption key.

Cevap

The security analyst should require transitioning to a hybrid encryption scheme using AES-GCM for bulk payload encryption and RSA for symmetric key encapsulation.
Directly encrypting large files using asymmetric keys (like RSA or ECC) causes severe performance degradation and failure due to block size constraints. The industry standard solution for bulk data protection is hybrid encryption: a high-speed symmetric algorithm (such as AES-GCM) encrypts the bulk file payload using a randomly generated Data Encryption Key (DEK), and the asymmetric key (RSA) is used solely to encrypt the small DEK. Furthermore, AES-GCM provides Authenticated Encryption with Associated Data (AEAD), ensuring both confidentiality and integrity.

Adım Adım Çözüm

1
Analyze the performance bottleneck of asymmetric encryption on bulk data
Identified that RSA encryption applied directly to multi-gigabyte files introduces massive computational overhead and is practically infeasible due to key size limits.
Asymmetric encryption algorithms are mathematically intensive and restricted to encrypting small blocks of data (such as key material).
2
Evaluate symmetric cipher requirements for bulk encryption
Selected AES in Galois/Counter Mode (AES-GCM) to deliver fast symmetric encryption with built-in authenticated encryption (AEAD).
AES-GCM efficiently provides both data confidentiality and integrity verification within a single pass without needing separate signature overhead for bulk content.
3
Integrate asymmetric key management via hybrid encryption
Encapsulated the ephemeral symmetric Data Encryption Key (DEK) using the recipient's RSA public key.
Hybrid encryption achieves the high performance of symmetric ciphers alongside the key distribution advantages of asymmetric cryptography.

Anahtar Kavram

Hybrid Encryption and Authenticated Symmetric Modes
Soru 219Soru →

A security operations team configures an isolated network segment containing multiple fully functional decoy servers and simulated industrial control system (ICS) devices. The environment allows attackers to execute commands, run scripts, and interact extensively with system operating systems so analysts can capture advanced tactics, techniques, and procedures (TTPs). Which of the following deception technologies has been implemented?

Cevabı ve açıklamayı göster

Cevap: High-interaction honeynet

Cevap

High-interaction honeynet
A high-interaction honeynet uses a network of decoy systems that emulate genuine operating systems and services. It provides a rich environment for attackers to interact with, enabling security teams to study complex attack sequences without risking real production networks.

Adım Adım Çözüm

1
Analyze the requirements in the scenario
The scenario describes a network of fully functional decoy servers allowing extensive attacker interaction to gather intelligence on adversary TTPs.
Deception technologies are categorized by their deployment scope (individual host vs. network segment) and interaction level (low vs. high).
2
Distinguish between deception types and production controls
Multiple decoy systems configured on an isolated network segment form a honeynet. Because full OS functionality and deep engagement are allowed, it is classified as high-interaction.
High-interaction honeynets allow adversaries to interact directly with OS services to capture post-compromise activity.

Anahtar Kavram

Deception and Disruption Technologies - Honeynets and Interaction Levels
Soru 220Soru →

A network administrator is configuring a secure transport session to protect financial telemetry transmitted across an untrusted enterprise network. The session configuration requires high-speed symmetric data confidentiality as well as a key exchange mechanism that guarantees Perfect Forward Secrecy (PFS). Which TWO of the following cryptographic mechanisms should the administrator select to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Elliptic Curve Diffie-Hellman Ephemeral (ECDHE); Advanced Encryption Standard in Galois/Counter Mode (AES-GCM)

Cevap

Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) and Advanced Encryption Standard in Galois/Counter Mode (AES-GCM) must be selected.
To protect session data across an untrusted network with both high performance and forward secrecy, administrators pair a symmetric cipher for data payload confidentiality with an ephemeral key exchange protocol. Elliptic Curve Diffie-Hellman Ephemeral provides Perfect Forward Secrecy by establishing unique keying material for each session without relying on reusable private keys. Advanced Encryption Standard in Galois/Counter Mode provides authenticated symmetric bulk encryption, meeting both the performance and confidentiality objectives.

Adım Adım Çözüm

1
Identify the key exchange requirement
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) provides key exchange with Perfect Forward Secrecy (PFS) using short-lived ephemeral key pairs.
PFS ensures that compromising a long-term private key does not compromise past session keys.
2
Identify the bulk confidentiality requirement
Advanced Encryption Standard in Galois/Counter Mode (AES-GCM) provides fast symmetric encryption along with authenticated integrity checks.
Symmetric ciphers are computationally efficient and designed for high-throughput bulk data protection.

Anahtar Kavram

Combining symmetric encryption for bulk confidentiality with ephemeral key exchange for forward secrecy.
ÖncekiSayfa 11 / 14Sonraki
General Security Concepts Alıştırma Soruları — CompTIA Security+ — Sayfa 11 | Examkin