106-130 Flashcards
A security engineer is concerned about susceptibility to HTTP downgrade attacks because the current
customer portal redirects users from port 80 to the secure site on port 443. Which of the following would be
MOST appropriate to mitigate the attack?
A. DNSSEC
B. HSTS
C. Certificate pinning
D. OCSP
B. HSTS
A security analyst is deploying a next-generation firewall. The analyst wants to protect against malicious
payloads found on TLS-enabled websites. After enabling the firewall to scan encrypted HTTP traffic, the users
receive an error message on the browser, stating the connection is not private. Which of the following would
allow the analyst to inspect this traffic while preventing this error from appearing?
A. Enable TLS inspection in the firewall’s configuration settings.
B. Make an exception in the firewall, excluding URLs that begin with https:// from being scanned.
C. Disable public certificate pinning in the browser’s settings on every desktop computer.
D. Add the firewall’s certificate to the trusted root certificate store on all of the computers.
E. Use the company’s CA to issue certificates for the affected domains and add these certificates to the
firewall.
A. Enable TLS inspection in the firewall’s configuration settings.
A security administrator found the following piece of code referenced on a domain controller’s task scheduler:
$var = GetDomainAdmins
If $var != ‘fabio’
SetDomainAdmins = NULL
With which of the following types of malware is the code associated?
A. RAT
B. Backdoor
C. Logic bomb
D. Crypto-malware
C. Logic bomb
An organization is considering utilizing a third-party web-hosting service for a human resources application.
The organization’s Chief Information Officer (CIO) is concerned the web-hosting service may not have a
sufficient level of security. The sales representative for the web-hosting service suggests that the CIO use
banner grabbing to test the security levels of an existing website hosted by the company (www.example.com).
Which of the following commands should the CIO use? (Select TWO).
A. nc
B. telnet
C. ifconfig
D. tracert
E. netstat
F. nslookup
A. nc
B. telnet
An employee is observed taking photos of sensitive documents, but the employee is reportedly on a special
assignment. The company’s policies are:
No photography is allowed in the building without authorization.
If photographs are taken, do not confront the offender
Report incidents to the compliance officer.
Which of the following actions should be taken?
A. Confiscate the camera.
B. Ask if the employee needs assistance.
C. Report a policy violation.
D. Take custody of the sensitive documents.
C. Report a policy violation.
An administrator is disposing of media that contains sensitive information. Which of the following will provide
the MOST effective method of dispose of the media while ensuring the data will be unrecoverable?
A. Wipe the hard drive.
B. Shred the hard drive.
C. Sanitize all of the data.
D. Degauss the hard drive.
B. Shred the hard drive.
Which of the following is a security consideration for loT devices?
A. loT devices have built-in accounts that users rarely access.
B. loT devices have less processing capabilities.
C. loT devices are physically segmented from each other.
D. loT devices have purpose-built applications.
A. loT devices have built-in accounts that users rarely access.
A manager makes an unannounced visit to the marketing department and performs a walk-through of the
office. The manager observes unclaimed documents on printers. A closer look at these documents reveals
employee names, addresses, ages, birth dates, marital/dependent statuses, and favorite ice cream flavors.
The manager brings this to the attention of the marketing department head. The manager believes this
information to be PII, but the marketing head does not agree. Having reached a stalemate, which of the
following is the most appropriate action to take NEXT?
A. Elevate to the Chief Executive Officer (CEO) for redress; change from the top down usually succeeds.
B. Find the privacy officer in the organization and let the officer act as the arbiter.
C. Notify employees whose names are on these files that their personal information is being compromised.
D. To maintain a working relationship with marketing, quietly record the incident in the risk register.
B. Find the privacy officer in the organization and let the officer act as the arbiter.
An incident response analyst at a company is reviewing a SIEM alert that indicates an employee received a
message containing a potentially malicious attachment. The analyst confirms the attachment is malicious.
After removing the malware, the same incident reoccurs. Which of the following responses should have been
done to address the situation correctly?
A. Containment
B. Eradication
C. Identification
D. Lessors learned
D. Lessors learned
A company recently installed fingerprint scanners at all entrances to increase the facility’s security. The
scanners were installed on Monday morning, and by the end of the week it was determined that 1.5% of valid
users were denied entry. Which of the following measurements do these users fall under?
A. FRR
B. FAR
C. CER
D. SLA
A. FRR
A systems administrator has installed a new UTM that is capable of inspecting SSL/TLS traffic for malicious
payloads. All inbound network traffic coming from the Internet and terminating on the company’s secure web
servers must be inspected. Which of the following configurations would BEST support this requirement?
A. The web servers’ CA full certificate chain must be installed on the UTM.
B. The UTM’s certificate pair must be installed on the web servers.
C. The web servers’ private certificate must be installed on the UTM.
D. The UTM and web servers must use the same certificate authority.
A. The web servers’ CA full certificate chain must be installed on the UTM.
A security administrator receives a request from a customer for certificates to access servers securely. The
customer would like a single encrypted file that supports PKCS and contains the private key. Which of the
following formats should the technician use?
A. PEM
B. DER
C. P12
D. PTX
C. P12
Which of the following controls is implemented in lieu of the primary security controls?
A. Compensating
B. Corrective
C. Detective
D. Deterrent
A. Compensating
A systems administrator is increasing the security settings on a virtual host to ensure users on one VM cannot
access information fro another VM.
Which of the following is the administrator protecting against?
A. VM sprawl
B. VM escape
C. VM migration
D. VM sandboxing
B. VM escape
A systems administrator wants to disable the use of usernames and passwords for SSH authentication and
enforce key-based authentication. Which of the following should the administrator do NEXT to enforce this
new configuration?
A. Issue a public/private key pair for each use and securely distrubute a private key to each employee.
B. Instruct users on how to create a public/private key pair and install users’ public keys on the server.
C. Disable the username and password authentication and enable TOTP in the sshd.conf file.
D. Change the default SSH port, enable TCP tunneling, and provide a pre-configured SSH client.
B. Instruct users on how to create a public/private key pair and install users’ public keys on the server.
