1-50 Flashcards
The SOC is reviewing process and procedures after a recent incident. The review indicates it took more
than 30 minutes to determine that quarantining an infected host was the best course of action. The
allowed the malware to spread to additional hosts before it was contained.
Which of the following would be BEST to improve the incident response process?
A. Updating the playbooks with better decision points
B. Dividing the network into trusted and untrusted zones
C. Providing additional end-user training on acceptable use
D. Implementing manual quarantining of infected hosts
Answer: A
Which of the following would be BEST to establish between organizations that have agreed cooperate
and are engaged in early discussion to define the responsibilities of each party, but do not want to
establish a contractually binding agreement?
A. An SLA B. AnNDA C. ABPA D. AnMOU Answer: D
Phishing and spear-phishing attacks have been occurring more frequently against a company’s staff.
Which of the following would MOST likely help mitigate this issue?
A. DNSSEC and DMARC
B. DNS query logging
C. Exact mail exchanger records in the DNS
D. The addition of DNS conditional forwarders
Answer: C
Which of the following control sets should a well-written BCP include? (Select THREE)
A. Preventive B. Detective C. Deterrent D. Corrective E. Compensating F. Physical G. Recovery Answer: A,D,G
A security engineer needs to Implement the following requirements:
• All Layer 2 switches should leverage Active Directory tor authentication.
• All Layer 2 switches should use local fallback authentication If Active Directory Is offline.
• All Layer 2 switches are not the same and are manufactured by several vendors.
Which of the following actions should the engineer take to meet these requirements? (Select TWO).
A. Implement RADIUS.
B. Configure AAA on the switch with local login as secondary.
C. Configure port security on the switch with the secondary login method.
D. Implement TACACS+
E. Enable the local firewall on the Active Directory server.
F. Implement a DHCP server.
Answer: A,B
A company wants to deploy PKI on its Internet-facing website.
The applications that are currently deployed are:
✑ www.company.com (main website)
✑ contactus.company.com (for locating a nearby location)
✑ quotes.company.com (for requesting a price quote)
The company wants to purchase one SSL certificate that will work for all the existing applications and any
future applications that follow the same naming conventions, such as store.company.com.
Which of the following certificate types would BEST meet the requirements?
A. SAN B. Wildcard C. Extended validation D. Self-signed Answer: B
A security engineer needs to enhance MFA access to sensitive areas in a building. A key card and
fingerprint scan are already in use.
Which of the following would add another factor of authentication?
A. Hard token B. Retina scan C. SMS text D. Keypad PIN Answer: B
A cybersecurity manager has scheduled biannual meetings with the IT team and department leaders to
discuss how they would respond to hypothetical cyberattacks. During these meetings, the manager
presents a scenario and injects additional information throughout the session to replicate what might occur
in a dynamic cybersecurity event involving the company, its facilities, its data, and its staff.
Which of the following describes what the manager is doing?
A. Developing an incident response plan B. Building a disaster recovery plan C. Conducting a tabletop exercise D. Running a simulation exercise Answer: C
Entering a secure area requires passing through two doors, both of which require someone who is
already inside to initiate access.
Which of the following types of physical security controls does this describe?
A. Cameras B. Faraday cage C. Access control vestibule D. Sensors E. Guards Answer: C
A company recently moved sensitive videos between on-premises. Company-owned websites. The
company then learned the videos had been uploaded and shared to the internet.
Which of the following would MOST likely allow the company to find the cause?
A. Checksums B. Watermarks C. Oder of volatility D. A log analysis E. A right-to-audit clause Answer: D
A user recently entered a username and password into a recruiting application website that had been
forged to look like the legitimate site Upon investigation, a security analyst the identifies the following:
• The legitimate websites IP address is 10.1.1.20 and eRecruit local resolves to the IP
• The forged website’s IP address appears to be 10.2.12.99. based on NetFtow records
• AH three at the organization’s DNS servers show the website correctly resolves to the legitimate IP
• DNS query logs show one of the three DNS servers returned a result of 10.2.12.99 (cached) at the approximate time of the suspected compromise.
Which of the following MOST likely occurred?
A. A reverse proxy was used to redirect network traffic
B. An SSL strip MITM attack was performed
C. An attacker temporarily pawned a name server
D. An ARP poisoning attack was successfully executed
Answer: B
A security analyst needs to make a recommendation for restricting access to certain segments of the network using only data-link layer security.
Which of the following controls will the analyst MOST likely recommend?
A. MAC B. ACL C. BPDU D. ARP Answer: A
A network engineer notices the VPN concentrator overloaded and crashes on days when there are a
lot of remote workers. Senior management has placed greater importance on the availability of VPN
resources for the remote workers than the security of the end users’ traffic.
Which of the following would be BEST to solve this issue?
A. iPSec B. Always On C. Split tunneling D. L2TP Answer: B
The Chief Security Officer (CSO) at a major hospital wants to implement SSO (Single sign-on) to help improve in the
environment patient data, particularly at shared terminals. The Chief Risk Officer (CRO) is concerned that
training and guidance have been provided to frontline staff, and a risk analysis has not been performed.
Which of the following is the MOST likely cause of the CRO’s concerns?
A. SSO would simplify username and password management, making it easier for hackers to pass guess
accounts.
B. SSO would reduce password fatigue, but staff would still need to remember more complex passwords.
C. SSO would reduce the password complexity for frontline staff.
D. SSO would reduce the resilience and availability of system if the provider goes offline.
Answer: D
Which of the following should a data owner require all personnel to sign to legally protect intellectual property?
A. An NDA B. An AUP C. An ISA D. An MOU Answer: D
The process of passively gathering information prior to launching a cyberattack is called:
A. tailgating B. reconnaissance C. pharming D. prepending Answer: B
A university with remote campuses, which all use different service providers, loses Internet
connectivity across all locations. After a few minutes, Internet and VoIP services are restored, only to go
offline again at random intervals, typically within four minutes of services being restored. Outages
continue throughout the day, impacting all inbound and outbound connections and services. Services that
are limited to the local LAN or WiFi network are not impacted, but all WAN and VoIP services are affected.
Later that day, the edge-router manufacturer releases a CVE outlining the ability of an attacker to exploit
the SIP protocol handling on devices, leading to resource exhaustion and system reloads.
Which of the following BEST describe this type of attack? (Choose two.)
A. DoS B. SSL stripping C. Memory leak D. Race condition E. Shimming F. Refactoring Answer: A,D
A network administrator at a large organization Is reviewing methods to improve the security of the
wired LAN Any security improvement must be centrally managed and allow corporate-owned devices to
have access to the intranet but limit others to Internet access only.
Which of the following should the administrator recommend?
A. 802.1X utilizing the current PKI infrastructure
B. SSO to authenticate corporate users
C. MAC address filtering with ACLs on the router
D. PAM for user account management
Answer: A
While checking logs, a security engineer notices a number of end users suddenly downloading files
with the .tar.gz extension. Closer examination of the files reveals they are PE32 files. The end users state
they did not initiate any of the downloads. Further investigation reveals the end users all clicked on an
external email containing an infected MHT file with an href link a week prior.
Which of the following is MOST likely occurring?
A. A RAT was installed and is transferring additional exploit tools.
B. The workstations are beaconing to a command-and-control server.
C. A logic bomb was executed and is responsible for the data transfers.
D. A fireless virus is spreading in the local network environment.
Answer: A
An organization has been experiencing outages during holiday sales and needs to ensure availability
of its point-of-sale systems The IT administrator has been asked to improve both server-data fault
tolerance and site availability under high consumer load.
Which of the following are the BEST options to accomplish this objective’? (Select TWO)
A. Load balancing B. Incremental backups C. UPS D. RAID E. Dual power supply F. NIC teaming Answer: A,D
