101-150 Flashcards
The facilities supervisor for a government agency is concerned about unauthorized access to
environmental systems in the event the staff WiFi network is breached.
Which of the blowing would BEST address this security concern?
A. install a smart meter on the staff WiFi.
B. Place the environmental systems in the same DHCP scope as the staff WiFi.
C. Implement Zigbee on the staff WiFi access points.
D. Segment the staff WiFi network from the environmental systems network.
Answer: D
An organization just experienced a major cyberattack modem. The attack was well coordinated
sophisticated and highly skilled.
Which of the following targeted the organization?
A. Shadow IT B. An insider threat C. A hacktivist D. An advanced persistent threat Answer: D
Joe, an employee, receives an email stating he won the lottery. The email includes a link that
requests a name, mobile phone number, address, and date of birth be provided to confirm Joe’s identity
before sending him the prize.
Which of the following BEST describes this type of email?
A. Spear phishing B. Whaling C. Phishing D. Vishing Answer: C
An organization wants to implement a third factor to an existing multifactor authentication. The
organization already uses a smart card and password.
Which of the following would meet the organization’s needs for a third factor?
A. Date of birth B. Fingerprints C. PIN D. TPM Answer: B
Which of the following ISO standards is certified for privacy?
A. ISO 9001 B. ISO 27002 C. ISO 27701 D. ISO 31000 Answer: C
The CSIRT is reviewing the lessons learned from a recent incident. A worm was able to spread
unhindered throughout the network and infect a large number of computers and servers.
Which of the following recommendations would be BEST to mitigate the impacts of a similar incident in
the future?
A. Install a NIDS device at the boundary.
B. Segment the network with firewalls.
C. Update all antivirus signatures daily.
D. Implement application blacklisting.
Answer: B
A RAT that was used to compromise an organization’s banking credentials was found on a user’s
computer. The RAT evaded antivirus detection. It was installed by a user who has local administrator
rights to the system as part of a remote management tool set.
Which of the following recommendations would BEST prevent this from reoccurring?
A. Create a new acceptable use policy.
B. Segment the network into trusted and untrusted zones.
C. Enforce application whitelisting.
D. Implement DLP at the network boundary.
Answer: C
A network manager is concerned that business may be negatively impacted if the firewall in
its datacenter goes offline.
The manager would like to Implement a high availability pair to:
A. decrease the mean ne between failures B. remove the single point of failure C. cut down the mean tine to repair D. reduce the recovery time objective Answer: B
Which of the following organizational policies are MOST likely to detect fraud that is being conducted
by existing employees? (Select TWO).
A. Offboarding B. Mandatory vacation C. Job rotation D. Background checks E. Separation of duties F. Acceptable use Answer: B,C
Accompany deployed a WiFi access point in a public area and wants to harden the configuration to
make it more secure. After performing an assessment, an analyst identifies that the access point is
configured to use WPA3, AES, WPS, and RADIUS.
Which of the following should the analyst disable to enhance the access point security?
A. WPA3 B. AES C. RADIUS D. WPS Answer: D
A security audit has revealed that a process control terminal is vulnerable to malicious users installing
and executing software on the system. The terminal is beyond end-of-life support and cannot be
upgraded, so it is placed on a projected network segment.
Which of the following would be MOST effective to implement to further mitigate the reported
vulnerability?
A. DNS sinkholding B. DLP rules on the terminal C. An IP blacklist D. Application whitelisting Answer: D
Which of the following scenarios would make a DNS sinkhole effective in thwarting an attack?
A. An attacker is sniffing traffic to port 53, and the server is managed using unencrypted usernames and
passwords.
B. An organization is experiencing excessive traffic on port 53 and suspects an attacker is trying to DoS
the domain name server.
C. Malware trying to resolve an unregistered domain name to determine if it is running in an isolated
sandbox
D. Routing tables have been compromised, and an attacker is rerouting traffic to malicious websites
Answer: D
The website http://companywebsite.com requires users to provide personal information including
security responses, for registration.
Which of the following would MOST likely cause a date breach?
A. LACK OF INPUT VALIDATION B. OPEN PERMISSIONS C. UNSCECURE PROTOCOL D. MISSING PATCHES Answer: A
The IT department’s on-site developer has been with the team for many years. Each time an
application is released, the security team is able to identify multiple vulnerabilities.
Which of the following would BEST help the team ensure the application is ready to be released to
production?
A. Limit the use of third-party libraries.
B. Prevent data exposure queries.
C. Obfuscate the source code.
D. Submit the application to QA before releasing it.
Answer: D
The following are the logs of a successful attack.
Which of the following controls would be BEST to use to prevent such a breach in the future?
A. Password history B. Account expiration C. Password complexity D. Account lockout Answer: D
Which of the following cloud models provides clients with servers, storage, and networks but nothing
else?
A. SaaS B. PaaS C. IaaS D. DaaS Answer: C
A forensics examiner is attempting to dump password cached in the physical memory of a live system
but keeps receiving an error message.
A. The examiner does not have administrative privileges to the system
B. The system must be taken offline before a snapshot can be created
C. Checksum mismatches are invalidating the disk image
D. The swap file needs to be unlocked before it can be accessed
Answer: D
To secure an application after a large data breach, an e-commerce site will be resetting all users’
credentials.
Which of the following will BEST ensure the site’s users are not compromised after the reset?
A. A password reuse policy
B. Account lockout after three failed attempts
C. Encrypted credentials in transit
D. A geofencing policy based on login history
Answer: C
A security analyst has been asked to investigate a situation after the SOC started to receive alerts
from the SIEM.
The analyst first looks at the domain controller and finds the following events: {{ PIC }}
To better understand what is going on, the analyst runs a command and receives the following output: {{ PIC }}
Based on the analyst’s findings, which of the following attacks is being executed?
A. Credential harvesting B. Keylogger C. Brute-force D. Spraying Answer: D
An attacker has successfully exfiltrated several non-salted password hashes from an online system.
Given the logs below:
Which of the following BEST describes the type of password attack the attacker is performing?
A. Dictionary B. Pass-the-hash C. Brute-force D. Password spraying Answer: A
