131-155 Flashcards
A corporation is concerned that, if a mobile device is lost, any sensitive information on the device could be
accessed by third parties. Which of the following would BEST prevent this from happening? (Select TWO).
A. Initiate remote wiping on lost mobile devices.
B. Use FDE and require PINs on all mobile devices.
C. Use geolocation to track lost devices
D. Require biometric logins on all mobile devices.
E. Install antivirus on mobile endpoints.
F. Patch cirtical vulnerabilities at least daily.
A. Initiate remote wiping on lost mobile devices.
B. Use FDE and require PINs on all mobile devices.
A security administrator’s review of network logs indicates unauthorized network access, the source of which
appears to be wired data jacks in the lobby area. Which of the following represents the BEST course of action
to prohibit this access?
A. Enabling BDPU guard
B. Enabling loop prevention
C. Enabling port security
D. Enabling anti-spoofing
C. Enabling port security
which of the following is the BEST use of a WAF?
A. To protect sites on web servers that are publicly accessible
B. To allow access to web services of internal users of the organization
C. To maintain connection status of all HTTP requests
D. To deny access to all websites with certain contents
A. To protect sites on web servers that are publicly accessible
A technician is auditing network security by connecting a laptop to open hardwired jacks within the facility to
verify they cannot connect. Which of the following is being tested?
A. Layer 3 routing
B. Port security
C. Secure IMAP
D. SMIME
B. Port security
A security professional wants to test a piece of malware that was isolated on a user’s computer to document
its effect on a system. Which of the following is the FIRST step the security professional should take?
A. Create a sandbox on the machine.
B. Open the file and run it.
C. Create a secure baseline of the system state.
D. Harden the machine.
A. Create a sandbox on the machine.
A forensic analyst is creating a report of findings for litigation purposes. The analyst must ensure data is
preserved using all elements of the CIA triad. Given this scenario, which of the following should the analyst
use to BEST meet these requirements?
A. Hashing for confidentiality, full backups for integrity, and encryption for availability
B. Full backups for confidentiality, encryption for integrity, and hashing for availability
C. Hashing for confidentiality, encryption for integrity, and full backup for availability
D. Encryption for confidentiality, hashing for integrity, and full backups for availability
D. Encryption for confidentiality, hashing for integrity, and full backups for availability.
An attacker had obtained the user ID and password of a datacenter’s backup operator and has gained access
to a production system. Which of the following would be the attacker’s NEXT action?
A. Perform a passive reconnaissance of the network.
B. Initiate a confidential data exfiltration process.
C. Look for known vulnerabilities to escalate privileges.
D. Create an alternate user ID to maintain persistent access.
C. Look for known vulnerabilities to escalate privileges.
A healthcare company is revamping its IT strategy in light of recent regulations. The company is concerned
about compliance and wants to use a pay-per-use model. Which of the following is the BEST solution?
A. On-premise hosting
B. Community cloud
C. Hosted infrastucture
D. Public SaaS
B. Community cloud
A developer wants to use a life-cycle model that utilizes a cascade model and has a definite beginning and
end to each stage. Which of the following models BEST meets this need?
A. Agile
B. Iterative
C. Waterfall
D. Spiral
C. Waterfall
A security administrator wants to implement a system that will issue digital security tokens, which require the
following:
The token-generating system must be distributed and decentralized.
The validity of each token must be verifiable.
Transaction and token integrity are more important that the confidentiality of the token.’
Which of the following should the administrator implement?
A. PKI with OCSP
B. GPG
C. Web of trust
D. Blockchain
E. Cryptographic service provider
D. Blockchain
An organizations’ policy requires users to create passwords with an uppercase letter, lowercase letter, number,
and symbol. This policy is enforced with technical controls, which also prevents users from using any of their
previous 12 passwords. The organization does not use single sign-on, nor does it centralize storage of
passwords.
The incident response team recently discovered that passwords for one system were compromised.
Passwords for a completely separate system have NOT been compromised, but unusual login activity has
been detected for that separate system. Account login has been detected for users who are on vacation.
Which of the following BEST describes what is happening?
A. Some users are meeting password complexity requirements but not password length requirements.
B. The password history is insufficient, and old passwords are still valid across many different systems.
C. Some users are reusing passwords, and some of the compromised passwords are valid on multiple
systems.
D. The compromised password file has been brute-force hacked, and the complexity requirements are not
adequate to mitigate this risk.
C. Some users are reusing passwords, and some of the compromised passwords are valid on multiple
systems.
Which of the following BEST distinguishes Agile development from other methodologies in terms of
vulnerability management?
A. Cross-functional teams
B. Rapid deployments
C. Daily standups
D. Peer review
E. Creating user stories
B. Rapid deployments
A network administrator is ensuring current account policies and procedures are following best practives and
will not be flagges in an upcoming audit. While running reports on current group memberships, the network
administrator logs the following access:
User Current Job title Accounting group HR group IT group Research
group
User1 IT help desk rep x x x
User2 Senior Accountant x x x x
User3 Product development Mgr x x x
User4 HR representative x x
Upon further review, the network administrator discovers all of these employees have been in their current
positions for at least two years. Which of the following practices should the network administrator recommend
for this scenario?
A. permission and usage reviews that occur on a regularly scheduled basis
B. Separating of duties and time-of-day restrictions for accounts with privileged access
C. Inactive account disablement and setting of expiration dates for all new service accounts
D. Immediate review of group nesting policies to prevent excessive permissions from occurring again
A. permission and usage reviews that occur on a regularly scheduled basis
Which of the following documents would provide specific guidance regarding ports and protocols that should
be disabled on an operating system?
A. Regulatory requirements
B. Secure configuration guide
C. Application installation guide
D. User manuals
B. Secure configuration guide
A state-sponsored threat actor has launched several successful attacks against a corporate network. Although
the target has a robust patch management program in place, the attacks continue in depth and scope, and the
security department has no idea how the attacks are able to gain access. Given that patch management and
vulnerability scanner are being used, which of the following would be used to analyze the attack methodology?
A. rogue system detection
B. Honeypots
C. Next-generation firewall
D. Penetration test
B. Honeypots
