Examkin

Security Operations

627 soru

Tüm türler627Çoktan seçmeli320Çoklu seçim139Eşleştirme36Sıralama132
Soru 501Soru →

A security analyst reviewing automated audit logs discovers that several cloud-hosted web servers have diverged from the organization's hardened baseline. Investigation reveals that system administrators manually modified SSL/TLS configuration files to troubleshoot a legacy integration, inadvertently re-enabling weak cipher suites that violate security policy. The central Infrastructure-as-Code (IaC) repository still contains the approved, secure configuration state. Which of the following is the BEST initial action to remediate the vulnerability and prevent future configuration drift?

Cevabı ve açıklamayı göster

Cevap: Execute the automated configuration management orchestration playbook to enforce the repository's declarative baseline state across all servers.

Cevap

Execute the automated configuration management orchestration playbook to enforce the repository's declarative baseline state across all servers.
Automated configuration management tools continuously evaluate server state against a centralized Infrastructure-as-Code repository. When configuration drift occurs due to manual modification, executing the deployment playbook ensures that the approved baseline is redeployed, removing weak ciphers and preventing recurring discrepancies.

Adım Adım Çözüm

1
Identify the root cause of the non-compliance incident.
The non-compliance stems from configuration drift caused by manual intervention on the web servers.
Understanding whether a flaw is software-based or configuration-based determines the correct remediation path.
2
Evaluate automated baseline enforcement mechanisms.
Automated configuration management tools pull approved templates from the IaC repository and overwrite unapproved drift.
Automated enforcement restores baseline compliance rapidly without risk of human error or missed settings.
3
Select the primary operational control that addresses both immediate remediation and long-term compliance.
Executing the configuration management playbook enforces consistency and eliminates drift across the cluster.
Direct baseline enforcement fixes the host system while establishing automated alignment with security governance.

Anahtar Kavram

Configuration Drift and Automated Baseline Enforcement
Tahmini Süre:1m 30s
Soru 502Soru →

A security analyst is reviewing correlated firewall and internal DNS query logs for an internal workstation (10.0.4.15):

[Firewall Log]
Timestamp: 2026-07-27T14:15:02Z Src_IP: 10.0.4.15 Dst_IP: 198.51.100.44 Dst_Port: 53 Protocol: UDP Bytes_Sent: 4520 Bytes_Rcvd: 312 Action: ALLOW
Timestamp: 2026-07-27T14:15:05Z Src_IP: 10.0.4.15 Dst_IP: 198.51.100.44 Dst_Port: 53 Protocol: UDP Bytes_Sent: 4890 Bytes_Rcvd: 298 Action: ALLOW

[DNS Query Log]
Timestamp: 2026-07-27T14:15:02Z Client: 10.0.4.15 Query: 58617a7964617461.exfil.badactor-domain.com Type: TXT RCODE: NOERROR
Timestamp: 2026-07-27T14:15:05Z Client: 10.0.4.15 Query: 6261636b75703031.exfil.badactor-domain.com Type: TXT RCODE: NOERROR

Based on this log telemetry, which of the following statements regarding the threat activity and appropriate mitigation steps are correct? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The host is utilizing DNS tunneling to exfiltrate encoded payload data within subdomain query strings.; Implementing DNS sinkholing or blocking external DNS resolution to the suspicious destination host will help contain the exfiltration path.

Cevap

The host is utilizing DNS tunneling to exfiltrate encoded payload data within subdomain query strings, and implementing DNS sinkholing or blocking external DNS resolution to the suspicious destination host will help contain the exfiltration path.
The combination of high-entropy hexadecimal subdomains, TXT query types, and disproportionately large outbound byte counts in firewall logs over UDP port 53 is a definitive indicator of DNS tunneling. Implementing DNS sinkholing or restricting outbound DNS traffic to trusted internal recursive resolvers successfully mitigates this data exfiltration vector.

Adım Adım Çözüm

1
Analyze the DNS query logs and firewall payload metrics.
Identified high-entropy subdomains requesting TXT records with unusually high outbound byte counts relative to response byte counts over UDP port 53.
Standard DNS queries are small lookup requests; large outbound payloads containing encoded strings point to DNS covert channel/tunneling.
2
Differentiate the identified attack vector from unrelated application and identity threats.
Ruled out application vulnerabilities like XSS/SQLi and authentication control failures.
Traffic occurs at the transport and application layer specifically for DNS resolution (port 53), not web app services or AAA infrastructure.
3
Determine the optimal containment strategy.
Selected DNS sinkholing and blocking unauthorized external DNS resolution.
DNS sinkholing redirects malicious domain requests to a controlled IP, cutting off command and control and data exfiltration routes.

Anahtar Kavram

DNS Tunneling Detection and SIEM Log Correlation
Soru 503Soru →

During a routine operational review of corporate laptops, endpoint telemetry detects a malicious script executing directly in volatile memory and initiating unauthorized outbound traffic to a known adversary infrastructure. To stop lateral movement and data exfiltration immediately while retaining live memory context for incident investigation, which of the following EDR capabilities should be executed?

Cevabı ve açıklamayı göster

Cevap: Initiating agent-based network host isolation

Cevap

Initiating agent-based network host isolation is the correct capability because it disconnects the host from the internal network while keeping EDR communication open and preserving volatile memory.
Initiating agent-based network isolation enables security analysts to halt all unauthorized network communications to and from the endpoint instantly while preserving system state and volatile memory for forensic response.

Adım Adım Çözüm

1
Identify the immediate incident response priority
Containment is required to halt lateral movement and data exfiltration without losing RAM evidence.
Active fileless memory threats require host containment mechanisms rather than static perimeter blocking.
2
Evaluate EDR containment actions
Agent-based network isolation cuts off non-essential network connections at the host level while maintaining administrative console connectivity.
This allows SOC responders to investigate live memory while preventing the adversary from moving laterally.

Anahtar Kavram

Endpoint Detection and Response (EDR) Host Isolation
Soru 504Soru →

A security engineer inspects network security telemetry following a simulated penetration test. The red team successfully executed a known web application exploit payload over an HTTPS connection to an internal web server. Although the Network Intrusion Prevention System (NIPS) was deployed inline and possessed the latest vendor signature for the exploit, it neither generated an alert nor dropped the malicious connection. NetFlow records confirm the attack traffic passed directly through the NIPS interface. Which of the following best explains why the monitoring and alerting controls failed to detect this attack?

Cevabı ve açıklamayı göster

Cevap: The NIPS lacked SSL/TLS decryption capabilities, preventing signature inspection of the encrypted packet payload.

Cevap

The NIPS lacked SSL/TLS decryption capabilities, preventing signature inspection of the encrypted packet payload.
Network Intrusion Prevention Systems (NIPS) perform deep packet inspection by comparing packet payloads against known attack signatures. When web traffic is encrypted using HTTPS (SSL/TLS), the payload content is obfuscated as ciphertext. Unless the NIPS is configured with SSL/TLS decryption (TLS offloading/inspection), the signature engine cannot read the underlying HTTP payload to match known exploit patterns, allowing the malicious traffic to pass unhindered despite the NIPS being inline and updated.

Adım Adım Çözüm

1
Analyze the scenario parameters and network architecture
The traffic was sent over HTTPS (encrypted via SSL/TLS), passed inline through a updated NIPS sensor, but went undetected.
Understanding the delivery protocol (HTTPS) is critical to identifying why deep packet inspection failed.
2
Evaluate sensor inspection mechanics against encrypted protocols
Network Intrusion Prevention Systems rely on matching packet payloads against known signatures. Without SSL/TLS decryption (TLS inspection), packet payloads are encrypted, rendering signatures ineffective.
Encrypted traffic obscures Layer 7 payload content from network monitoring tools unless SSL/TLS decryption is enabled on the sensor.
3
Differentiate correct root cause from distractor misconfigurations
The inability to inspect encrypted ciphertext is the direct cause of signature evaluation failure in this network monitoring context.
Eliminates distractors that confuse sensor deployment types (inline vs. passive TAP), deception technologies (honeypots), or control layer misclassifications.

Anahtar Kavram

Network Security Monitoring & TLS/SSL Decryption Requirements for NIDS/NIPS
Tahmini Süre:2m 0s
Soru 505Soru →

A security analyst receives a high-severity alert from an Endpoint Detection and Response (EDR) agent indicating that a malicious WMI event subscription has been registered on a critical enterprise server and is attempting to execute unauthorized PowerShell scripts. Place the containment and incident response steps in the correct sequential order from initial response to final remediation.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with validating telemetry alerts, followed by network isolation of the host, process termination, live response artifact collection, and finally persistence cleanup and host restoration.
In standard incident response protocols using EDR technology, the first step is validating telemetry alerts. Once confirmed, immediate network isolation protects the rest of the enterprise from lateral movement. Next, running malicious processes are killed to stop active damage, followed by collecting volatile live response artifacts for root cause analysis. Finally, persistent threat artifacts (such as WMI bindings) are deleted and the clean endpoint is restored.

Adım Adım Çözüm

1
Validate the EDR alert and process tree.
Confirmed malicious WMI event execution.
Prevents taking intrusive containment actions on benign system behavior.
2
Isolate the endpoint network interface via EDR capabilities.
Lateral movement vectors are severed while preserving administrative EDR control channels.
Contains potential containment blast radius to the single endpoint.
3
Terminate active malicious processes.
Malicious code stops executing in host memory.
Halts ongoing damage or data collection on the localized system.
4
Collect live response forensic telemetry.
Volatile memory and script logs are saved for root-cause analysis.
Ensures critical forensic evidence is preserved before system modifications occur.
5
Remediate WMI persistence mechanisms and lift host isolation.
System returned to trusted baseline state and reconnected to network.
Completes the lifecycle of endpoint containment and remediation.

Anahtar Kavram

EDR Incident Containment and Investigation Workflow
Soru 506Soru →

A network administrator at a logistics enterprise configures TACACS+ for centralized management of core routers. Network engineers can successfully authenticate to the router command-line interface using their domain credentials. However, when the engineers attempt to run restricted configuration commands, the router returns a permission error. The administrator verifies that credential validation against Active Directory is functioning properly. Which of the following describes the root cause of this operational issue?

Cevabı ve açıklamayı göster

Cevap: The TACACS+ server validated user identity during the authentication phase, but command-level authorization policies were not configured.

Cevap

The correct answer states that the TACACS+ server validated user identity during the authentication phase, but command-level authorization policies were not configured.
The correct answer correctly identifies that TACACS+ separates authentication from authorization. While identity validation against Active Directory succeeded, specific command-level authorization policies were omitted, preventing the router from approving restricted commands.

Adım Adım Çözüm

1
Analyze the reported operational symptom and AAA architecture
Engineers successfully log in (authentication works), but cannot run specific commands (authorization fails).
TACACS+ decouples authentication, authorization, and accounting into discrete protocol interactions.
2
Identify the failing AAA component
Because login succeeds, the identity verification phase (Authentication) is complete, meaning the breakdown is in command authorization rules.
Command authorization determines which specific commands an authenticated user or role is permitted to execute.
3
Determine the root cause
Command-level authorization policies or privilege attribute sets were missing or misconfigured on the TACACS+ server.
Without explicit authorization rules, the network device defaults to denying privileged command execution.

Anahtar Kavram

Separation of Authentication and Authorization in TACACS+ Operations
Tahmini Süre:1m 30s
Soru 507Soru →

A Security Operations Center (SOC) analyst identifies active data exfiltration from a user workstation caused by an unauthorized memory-resident process. The analyst must immediately stop the data egress and restrict lateral network communication while retaining remote console administrative access to collect RAM telemetry and run live response forensic commands. Which of the following capabilities should the analyst execute?

Cevabı ve açıklamayı göster

Cevap: EDR agent host network isolation

Cevap

EDR agent host network isolation isolates the compromised endpoint from all internal and external network communication while preserving the live telemetry management channel for SOC investigation.
The correct answer leverages the EDR agent's native network isolation feature. This places a software boundary around the endpoint host operating system, dropping all incoming and outgoing network traffic except for the encrypted control channel used by security analysts for remote triage and live response.

Adım Adım Çözüm

1
Analyze containment requirements
The target system requires immediate network exfiltration blockage without losing volatile forensic data or analyst management connectivity.
Shutting down the host loses RAM evidence, while network-level blocks may not stop internal lateral movement.
2
Evaluate EDR network isolation capability
EDR agents utilize software-defined filtering at the endpoint kernel layer to block all application layer traffic except the agent-to-console management protocol.
This guarantees containment of malicious outbound/east-west traffic while enabling live response activities.

Anahtar Kavram

EDR Host Isolation and Live Response Containment
Soru 508Soru →

An enterprise mobile application authenticates users via a cloud-hosted Identity Provider (IdP) using the OAuth 2.0 Authorization Code Flow with Proof Key for Code Exchange (PKCE). Place the operational steps of this authentication sequence in the correct order, from initial client initialization to final token delivery.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence is: 1) Client generates the secret code_verifier and computes the code_challenge, 2) Client redirects user to IdP authorization endpoint with the code_challenge, 3) IdP authenticates user and issues an authorization code bound to the code_challenge, 4) Client sends authorization code and plaintext code_verifier to IdP token endpoint, 5) IdP verifies code_verifier against code_challenge and issues access tokens.
Proof Key for Code Exchange (PKCE) mitigates authorization code interception attacks on public clients. The client first creates a secret code_verifier and calculates the code_challenge. Next, it sends the user to the IdP authorization endpoint carrying the code_challenge. After successful user authentication, the IdP returns an authorization code. The client then exchanges this authorization code by sending the plaintext code_verifier directly to the token endpoint. Finally, the IdP verifies that SHA-256 hashing of the code_verifier matches the code_challenge stored during authorization before issuing access and ID tokens.

Adım Adım Çözüm

1
Generate local cryptographic parameters
The client establishes the secret code_verifier and derives the public code_challenge using SHA-256.
PKCE protects public clients against authorization code interception by establishing a secret known only to the legitimate client instance before initiating communication.
2
Initiate authorization request
The client redirects the browser/user-agent to the IdP authorization URI containing the code_challenge.
The IdP needs the code_challenge to associate it with the authorization request session prior to user authentication.
3
Authenticate user and issue authorization code
The IdP validates user credentials and issues a short-lived authorization code.
The authorization code represents temporary authorization granted by the resource owner to the client.
4
Exchange authorization code for tokens
The client makes a POST request to the token endpoint supplying the authorization code and the plaintext code_verifier.
Presenting the unhashed code_verifier proves that the party requesting tokens is the exact same application instance that generated the initial request.
5
Validate verifier and deliver tokens
The IdP hashes the received code_verifier, compares it to the original code_challenge, and returns security tokens.
Token issuance is granted only when SHA-256(code_verifier) strictly equals the code_challenge recorded in Step 3.

Anahtar Kavram

OAuth 2.0 Authorization Code Flow with PKCE (Proof Key for Code Exchange)
Tahmini Süre:1m 30s
Soru 509Soru →

During a routine automated compliance scan, a security operations team discovers a critical zero-day vulnerability in a core software dependency running on legacy Linux application hosts. Vendor testing reveals that applying the official patch breaks custom enterprise middleware dependencies, causing service instability during canary testing. Which of the following actions represents the MOST appropriate immediate strategy to maintain security posture without compromising service availability?

Cevabı ve açıklamayı göster

Cevap: Apply virtual patching rules at the intrusion prevention system (IPS) or web application firewall (WAF) layer while testing a updated middleware revision in a staging environment.

Cevap

Implement virtual patching at the perimeter (IPS/WAF) as a temporary compensating control while validating middleware stability in staging.
Virtual patching utilizes network-level or application-layer security controls (such as IPS signatures or WAF rules) to detect and block exploitation attempts targeting a specific vulnerability before the underlying system software is patched. This serves as an ideal temporary compensating control when vendor patches introduce breaking changes to custom middleware, allowing the organization to mitigate risk immediately while engineers resolve software dependencies in a isolated staging environment.

Adım Adım Çözüm

1
Analyze the patch deployment constraint
Identified that applying the vendor patch directly causes production instability due to middleware incompatibility.
Direct patch deployment is blocked by availability risks, requiring a temporary mitigation strategy.
2
Identify suitable compensating controls
Selected virtual patching via WAF/IPS signatures to filter malicious payloads targeting the zero-day vulnerability.
Virtual patching mitigates the vulnerability exposure vector immediately without altering host software states.
3
Execute long-term remediation workflow
Develop and validate a compatible middleware update in a staging environment prior to final production patch rollout.
Ensures patch management lifecycle integrity through proper testing, staging, and change advisory approval.

Anahtar Kavram

Virtual Patching and Compensating Controls in Patch Management
Tahmini Süre:2m 0s
Soru 510Soru →

A security analyst is investigating a SIEM alert containing the URI parameter: `/inventory.php?item=10' UNION SELECT null, table_name FROM information_schema.tables--`. Moments later, network security monitoring sensors record outbound traffic originating from the targeted web server to an IP address within an isolated deception subnet (honeypot). Which of the following statements accurately identifies the attack technique observed and the operational purpose of the triggered deception control?

Cevabı ve açıklamayı göster

Cevap: The URI payload represents a SQL injection attempt, and the honeypot alert acts as a detective control indicating potential lateral movement or scanning by the attacker.

Cevap

The attack vector is SQL injection, and traffic touching a honeypot serves as a detective control to spot unauthorized network activity.
The URI payload uses SQL syntax ('UNION SELECT') to query database metadata, which is characteristic of SQL injection. Honeypots are deception mechanisms deployed to capture unauthorized interactions, serving as detective controls when suspicious hosts attempt internal probing.

Adım Adım Çözüm

1
Analyze the URI string pattern in the SIEM alert log.
Identify 'UNION SELECT null, table_name FROM information_schema.tables--', which is characteristic of database query manipulation (SQL injection).
Distinguishing application layer payloads is essential for accurate incident triage.
2
Evaluate the role of the network monitoring sensor alert triggered in the deception subnet.
Recognize that honeypots have no legitimate business traffic and function as detective controls for early threat detection.
Honeypots do not act as inline blocking mechanisms; any traffic routed to them indicates suspicious or compromised behavior.
3
Synthesize findings to select the accurate diagnosis.
Confirm that the incident involves SQL injection followed by internal reconnaissance/lateral movement detected by a honeypot.
Combines attack payload classification with correct security control operational classification.

Anahtar Kavram

Network Security Monitoring and Deception Analysis
Tahmini Süre:2m 0s
Soru 511Soru →

During network monitoring, a security team identifies an unauthorized device acting as a rogue DHCP server on a corporate office VLAN, assigning malicious default gateway addresses to internal endpoints. The incident response team has confirmed the alert and identified the specific physical switch port connected to the rogue device. According to standard incident response procedures, which of the following actions should the team perform next?

Cevabı ve açıklamayı göster

Cevap: Shut down the identified switch port to isolate the rogue device from the localized network segment.

Cevap

Shut down the identified switch port to isolate the rogue device from the localized network segment.
In accordance with standard incident response frameworks (such as NIST SP 800-61), after detecting and analyzing an active threat, the immediate priority is Containment. Disabling the switch port connected to the rogue DHCP server immediately prevents the unauthorized device from sending additional malicious network configurations to clients.

Adım Adım Çözüm

1
Analyze the current phase in the incident response lifecycle based on the scenario context.
The incident team has already detected and analyzed the incident, confirming the presence and physical location of the rogue DHCP server.
According to the NIST SP 800-61 IR framework, once an active incident is detected and identified, the immediate next phase is Containment.
2
Evaluate the proposed response actions against containment objectives.
Disabling the specific switch port stops the rogue DHCP server from issuing further unauthorized leases without shutting down unrelated network segments.
Effective containment isolates the threat immediately to prevent further damage while preserving operational stability.
3
Distinguish containment steps from out-of-order eradication, forensic, or detective steps.
Actions such as host re-imaging (eradication/recovery) or creating monitoring rules (detection/prevention) must not supersede active containment.
Following proper IR phase sequencing ensures active risks are neutralized before remediation and long-term improvements begin.

Anahtar Kavram

Incident Response Lifecycle Phase Order (Containment Phase Next Step)
Soru 512Soru →

A security operations analyst is reviewing access gateway logs following reports that remote workers cannot connect to an enterprise VPN. The authentication gateway delegates identity verification to a central SAML 2.0 Identity Provider (IdP) and passes authorization queries to a RADIUS policy server. The analyst inspects the following log entries from the RADIUS policy engine:

[2026-07-27 11:02:14] RADIUS-AUTH: SAML token validated successfully for '[email protected]'.
[2026-07-27 11:02:15] RADIUS-POL: Evaluating Network Policy 'VPN_Engineering_Access'.
[2026-07-27 11:02:15] RADIUS-POL-ERR: Group attribute 'CN=Contractors,OU=Groups' does not match required group 'CN=FullTime_Engineers'.
[2026-07-27 11:02:15] RADIUS-AAA: Sending ACCESS-REJECT for session candidate '[email protected]'.

Based on the log output, which of the following best describes the root cause of the access failure?

Cevabı ve açıklamayı göster

Cevap: Authentication succeeded at the IdP, but authorization failed at the RADIUS policy server due to mismatched group membership attributes.

Cevap

Authentication succeeded at the IdP, but authorization failed at the RADIUS policy server due to mismatched group membership attributes.
The log analysis demonstrates a clear separation between AAA functions. The initial SAML token validation confirms identity verification (authentication) succeeded. However, subsequent policy evaluation against the user's LDAP group attributes failed because the user is listed under 'Contractors' while the target policy requires 'FullTime_Engineers'. Consequently, authorization failed, leading to the RADIUS ACCESS-REJECT response.

Adım Adım Çözüm

1
Analyze the log entries chronologically to separate AAA steps.
The entry at 11:02:14 confirms 'SAML token validated successfully', demonstrating successful identity verification (authentication).
SAML token validation completes the authentication phase of AAA.
2
Evaluate the error event at 11:02:15.
The policy engine reports that 'CN=Contractors' does not match 'CN=FullTime_Engineers'.
This check determines what permissions and resources the authenticated user is allowed to access (authorization phase).
3
Determine the root cause of the ACCESS-REJECT response.
The user was rejected during the authorization phase because their active group attribute did not meet the requirement of the 'VPN_Engineering_Access' policy.
Failing policy criteria triggers an ACCESS-REJECT packet even after successful primary authentication.

Anahtar Kavram

Distinguishing between Authentication and Authorization in RADIUS and Enterprise IAM Operations
Tahmini Süre:1m 15s
Soru 513Soru →

A security analyst is investigating an authentication and privileges alert in a hybrid enterprise environment. The log audit reveals that a non-interactive service account (`svc_vaultsync`) authenticated via LDAPS from a workstation IP address and successfully retrieved domain administrative credentials from a Privileged Access Management (PAM) vault outside scheduled maintenance hours. Which of the following operational controls or administrative practices should the security team implement to mitigate this incident and harden IAM operations against future abuse? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure service accounts to use Group Managed Service Accounts (gMSAs) with auto-rotating passwords and disable interactive shell login capabilities.; Enforce Just-In-Time (JIT) access workflows requiring approval before PAM vault administrative credentials can be checked out.

Cevap

The correct operational measures are configuring Group Managed Service Accounts (gMSAs) with disabled interactive logins, and enforcing Just-In-Time (JIT) PAM checkout approval workflows.
Configuring Group Managed Service Accounts (gMSAs) with automatic password management and non-interactive privileges prevents manual checkout or misuse of service account credentials. Enforcing Just-In-Time (JIT) access requiring explicit approvals ensures privileged credentials cannot be retrieved from a PAM vault without prior authorization.

Adım Adım Çözüm

1
Analyze the incident details from the log audit.
Identified that a service account was used interactively outside maintenance windows to check out domain admin credentials from a PAM vault.
Determining how the service account was abused identifies the weakness in account lifecycle management and PAM checkout rules.
2
Evaluate identity lifecycle and service account security controls.
Converting service accounts to gMSAs removes password exposure and prevents interactive logon capabilities.
Service accounts should be non-interactive and managed dynamically by Active Directory to eliminate static credential theft.
3
Evaluate Privileged Access Management (PAM) operational controls.
Requiring Just-In-Time (JIT) approval workflows prevents unauthorized credential checkout outside approved change windows.
JIT access ensures elevated credentials are only provisioned temporarily and upon explicit manager/peer authorization.

Anahtar Kavram

Privileged Account Lifecycle and Just-In-Time Access Management
Tahmini Süre:1m 30s
Soru 514Soru →

During a scheduled vulnerability assessment of an enterprise network segment, an automated scanner causes several legacy network switches to become unresponsive due to resource exhaustion from high-frequency port probing and service discovery requests. Which of the following adjustments should the security engineer implement to maintain visibility into these network devices without causing service disruptions?

Cevabı ve açıklamayı göster

Cevap: Reduce the scan throttle rate and switch to a non-intrusive scan profile for the affected network segment.

Cevap

Reduce the scan throttle rate and switch to a non-intrusive scan profile for the affected network segment.
Reducing the scan intensity (throttling) and switching to non-intrusive scan settings prevents resource exhaustion on sensitive hardware while allowing the scanner to gather essential service and version information safely.

Adım Adım Çözüm

1
Identify the cause of system disruption during the assessment.
Aggressive, high-frequency port probes and intrusive checks exhausted the processing capacity of legacy switches.
Legacy network equipment often has limited CPU and memory buffers that cannot handle rapid connection requests.
2
Evaluate potential scan configuration changes to mitigate operational impact.
Adjusting scan speed (throttling) and disabling intrusive service exploitation tests prevents denial-of-service conditions.
Non-intrusive scans test for vulnerability signatures without executing aggressive payloads or overwhelming sockets.

Anahtar Kavram

Vulnerability Scanner Tuning and Safe Scanning Operations
Tahmini Süre:1m 15s
Soru 515Soru →

Following an alert indicating potential ransomware propagation via macro execution on an executive laptop, an incident responder requires immediate containment and detailed investigation tools operating directly on the host. Which TWO of the following capabilities represent primary features of an Endpoint Detection and Response (EDR) solution that address this situation?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Remotely isolating the host from the network via agent-based controls to halt lateral movement while preserving management connectivity.; Recording continuously generated process lineage, file modification, and registry access telemetry for historical analysis.

Cevap

The core capabilities of an Endpoint Detection and Response (EDR) platform in this scenario are isolating the host from the network at the software agent layer and recording continuous process, file, and registry telemetry.
Endpoint Detection and Response (EDR) tools emphasize host-level containment and real-time behavioral visibility. Agent-based network isolation immediately stops an active threat from spreading laterally across the enterprise while preserving administrative control. Additionally, EDR provides continuous telemetry recording (such as process trees, memory calls, and file activities) necessary for thorough post-incident analysis.

Adım Adım Çözüm

1
Identify the immediate containment capability required for a compromised endpoint.
Host network isolation implemented by the EDR agent prevents malicious lateral movement without requiring physical network disconnects.
Containment must occur quickly at the endpoint level to stop network spread while maintaining administrative access.
2
Determine the investigative data collection function characteristic of EDR.
Continuous behavioral logging and process lineage telemetry allow analysts to reconstruct attack sequences.
EDR solutions record detailed historical telemetry rather than relying solely on point-in-time file scans.

Anahtar Kavram

Endpoint Detection and Response (EDR) Core Capabilities
Soru 516Soru →

A security administrator must deploy a critical system patch and an updated security hardening baseline across a fleet of enterprise application servers. To minimize operational risk and maintain security compliance, the administrator must follow a structured configuration and patch management workflow. In what order should the administrator execute these operational steps from first to last?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins with non-production staging validation, followed by Change Advisory Board approval, a phased canary deployment, full production fleet distribution, and final post-deployment compliance scanning to establish the new baseline snapshot.
The standard patch and configuration management lifecycle follows a strict sequence: validate in non-production staging, obtain Change Advisory Board authorization with a rollback plan, execute a limited canary deployment, deploy to the entire production fleet using configuration orchestration, and finally perform an automated compliance scan to record the new baseline snapshot.

Adım Adım Çözüm

1
Staging and Functional Testing
Patch and baseline changes are verified in a non-production sandbox environment.
Prevents catastrophic application breakage by exposing unexpected dependencies and bugs before touching production.
2
Change Control and Authorization
The Change Advisory Board reviews testing evidence and approves the production change request.
Ensures institutional oversight, risk management, and pre-approved fallback procedures prior to deployment.
3
Canary Rollout and Health Monitoring
Changes are applied to a tiny fraction of production servers to gauge operational impact.
Limits the blast radius if subtle production-only anomalies occur.
4
Enterprise Fleet Orchestration
The approved update is deployed automatically to all remaining production systems.
Achieves consistent and efficient enterprise-wide patch coverage after risk validation.
5
Auditing and Baseline Update
Post-patch verification scans confirm compliance and snapshot the new configuration state.
Validates that no systems were missed and updates the baseline reference target used for configuration drift detection.

Anahtar Kavram

Patch and Configuration Management Workflow
Soru 517Soru →

During a security incident, an organization's Security Operations Center (SOC) identifies a compromised containerized application actively scanning internal microservices for vulnerabilities. Place the following incident response actions in the correct sequential order from FIRST to LAST according to standard incident handling frameworks.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of incident response actions is: 1) Isolate the compromised container using microsegmentation network policies; 2) Capture volatile memory artifacts and container runtime logs; 3) Terminate the compromised container instance and redeploy from a verified clean image; 4) Restore normal production routing while monitoring network telemetry; 5) Conduct a post-mortem review to update container security controls.
Standard incident handling frameworks (such as NIST SP 800-61) follow a strict lifecycle order: Containment (isolating network traffic) occurs first to stop active damage; Evidence Preservation collects volatile forensic artifacts before system modification; Eradication removes the root cause by destroying the compromised instance and deploying a trusted build; Recovery restores production operations under enhanced monitoring; Post-incident Activity reviews performance and updates playbooks to enhance future resiliency.

Adım Adım Çözüm

1
Determine the Containment Step
Network isolation via microsegmentation is placed first.
Immediate containment stops active lateral movement and limits incident scope before any destructive or disruptive changes are made.
2
Determine the Evidence Preservation Step
Volatile memory and log collection is placed second.
Evidence preservation must happen while the system remains isolated but before deleting or rebuilding the container instance.
3
Determine the Eradication Step
Termination of the container and redeployment from a clean image is placed third.
Eradication removes the threat vectors and compromised binaries once evidence has been secured.
4
Determine the Recovery Step
Restoring traffic with active telemetry monitoring is placed fourth.
Recovery brings systems safely back into full production under close monitoring to confirm stability.
5
Determine the Lessons Learned Step
Post-mortem review and CI/CD security updates are placed fifth.
Post-incident analysis evaluates the incident response effort after operational restoration to prevent future recurrence.

Anahtar Kavram

NIST Incident Response Lifecycle (Containment, Evidence Preservation, Eradication, Recovery, Lessons Learned)
Soru 518Soru →

An enterprise security team is selecting appropriate vulnerability assessment methodologies for distinct operational requirements across the enterprise environment. Match each vulnerability assessment approach on the left with the operational use case on the right that best represents its application.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Credentialed Vulnerability Scanning
Non-Credentialed Vulnerability Scanning
Passive Vulnerability Monitoring
Agent-Based Vulnerability Assessment

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Credentialed Scanning matches authenticated administrative system inspection; Non-Credentialed Scanning matches unauthenticated network service discovery; Passive Monitoring matches non-intrusive SPAN port traffic analysis; Agent-Based Assessment matches continuous endpoint monitoring independent of network location.
Each vulnerability assessment method fulfills a specific operational requirement based on access privileges, network placement, and traffic tolerance. Credentialed scanning provides in-depth host visibility through authentication; non-credentialed scanning measures unauthenticated perimeter exposure; passive monitoring provides zero-impact traffic observation via SPAN/TAP; and agent-based scanning provides continuous host inspection for off-network endpoints.

Adım Adım Çözüm

1
Analyze the access perspective of Credentialed vs. Non-Credentialed scanning.
Credentialed scanning accesses internal OS parameters via login credentials to reduce false positives, matching right_1. Non-credentialed scanning examines exposed network ports without credentials, matching right_2.
Authenticating directly allows scanners to query internal package managers and registries directly, whereas unauthenticated scans only see externally exposed services.
2
Evaluate the traffic impact of Passive Vulnerability Monitoring.
Passive monitoring observes mirrored traffic (SPAN/TAP) without generating probe traffic, matching right_3.
Sensitive industrial control systems or operational technology environments require zero active probe traffic to prevent service disruption.
3
Examine the operational scope of Agent-Based Vulnerability Assessment.
Local agents collect local system data continuously and report back when connected, matching right_4.
Mobile or remote laptops frequently move off-premise, making active network scans ineffective compared to host-installed software agents.

Anahtar Kavram

Vulnerability Scanning Methodologies and Operational Scenarios
Soru 519Soru →

A security analyst detects suspicious fileless activity on an enterprise endpoint, where a legitimate administrative process is spawned to run encoded PowerShell scripts that attempt lateral movement across the internal subnet. The analyst must halt all network communication to and from the compromised host to stop lateral movement, while maintaining active command-and-control connectivity between the endpoint agent and the EDR management console for live forensic investigation. Which of the following Endpoint Detection and Response (EDR) actions should the analyst take?

Cevabı ve açıklamayı göster

Cevap: Initiate host network isolation through the EDR console agent

Cevap

Initiate host network isolation through the EDR console agent
The correct action is to initiate host network isolation via the EDR agent console. Host isolation blocks network adapter communication to restrict lateral movement across the enterprise while preserving the EDR agent's control link so SOC analysts can maintain remote command capabilities and capture volatile system memory.

Adım Adım Çözüm

1
Analyze the scenario requirements
Identified the double constraint: stop lateral network movement while preserving the SOC management tunnel and volatile RAM data for investigation.
Containment must prevent the threat actor from pivoting to other internal systems while allowing responders to analyze the system state.
2
Evaluate host-level containment capabilities offered by EDR solutions
EDR agents provide software-defined host isolation.
Host network isolation drops standard inbound/outbound IP packets while maintaining an explicit whitelist for EDR agent-to-cloud/console telemetry traffic.
3
Compare against alternate network and system controls
Disqualified perimeter firewalls, static antivirus scans, and host power-offs.
Perimeter firewalls ignore internal subnet traffic, static AV fails on memory-resident script execution, and powering off the machine wipes volatile forensic memory.

Anahtar Kavram

EDR Host Isolation and Telemetry Preservation
Soru 520Soru →

A security analyst in a Security Operations Center (SOC) confirms that a workstation in the accounting department is infected with active ransomware. Network monitoring logs indicate the infected host is currently attempting to scan and encrypt remote file shares over SMB across the local subnet. Which of the following actions should the analyst perform FIRST according to standard incident response process playbooks?

Cevabı ve açıklamayı göster

Cevap: Disconnect the infected workstation from the network by disabling its network interface or placing it into an isolated quarantine VLAN.

Cevap

Disconnect the infected workstation from the network by disabling its network interface or placing it into an isolated quarantine VLAN.
Disconnecting the host from the network executes the containment phase of the incident response lifecycle. Immediate containment prevents the active ransomware from spreading laterally across SMB network shares, mitigating further operational damage.

Adım Adım Çözüm

1
Analyze the incident status from the scenario
Detection and analysis are complete; an active ransomware infection and lateral movement attempt via SMB are confirmed.
Determining the current phase dictates which playbook step must follow immediately.
2
Identify the immediate lifecycle requirement
Containment is required to halt further damage and prevent lateral spread to adjacent network storage.
Standard NIST (SP 800-61) and ISO incident handling playbooks mandate containment before moving to eradication or recovery.
3
Select the effective containment control
Isolating the specific workstation (via host network interface disablement or quarantine VLAN assignment) stops SMB traffic without causing unnecessary enterprise disruption.
Host isolation limits the blast radius of the ransomware while preserving evidence for forensic review.

Anahtar Kavram

Incident Response Lifecycle Phases and Containment Playbooks
Tahmini Süre:1m 15s
ÖncekiSayfa 26 / 32Sonraki
Security Operations Alıştırma Soruları — CompTIA Security+ — Sayfa 26 | Examkin