151-200 Flashcards
A security analyst needs to perform periodic vulnerably scans on production systems.
Which of the following scan types would produce the BEST vulnerability scan report?
A. Port B. Intrusive C. Host discovery D. Credentialed Answer: D
While reviewing the wireless router, the systems administrator of a small business determines
someone is spoofing the MAC address of an authorized device.
Given the table below:
Which of the following should be the administrator’s NEXT step to detect if there is a rogue system without
impacting availability?
A. Conduct a ping sweep. B. Physically check each system, C. Deny Internet access to the "UNKNOWN" hostname. D. Apply MAC filtering, Answer: D
A Chief Information Security Officer (CISO) needs to create a policy set that meets international
standards for data privacy and sharing.
Which of the following should the CISO read and understand before writing the policies?
A. PCI DSS B. GDPR C. NIST D. ISO 31000 Answer: B
Ann, a forensic analyst, needs to prove that the data she originally acquired has remained
unchanged while in her custody.
Which of the following should Ann use?
A. Chain of custody B. Checksums C. Non-repudiation D. Legal hold Answer: A
A security analyst is performing a forensic investigation compromised account credentials. Using the
Event Viewer, the analyst able to detect the following message, ‘’Special privileges assigned to new
login.’’ Several of these messages did not have a valid logon associated with the user before these
privileges were assigned.
Which of the following attacks is MOST likely being detected?
A. Pass-the-hash B. Buffer overflow C. Cross-site scripting D. Session replay Answer: A
A company has discovered unauthorized devices are using its WiFi network, and it wants to harden
the access point to improve security.
Which of the following configuration should an analyst enable to improve security? (Select Two)
A. RADIUS B. PEAP C. WPS D. WEP-TKIP E. SSL F. WPA2-PSK Answer: D,F
Which of the following is a team of people dedicated testing the effectiveness of organizational
security programs by emulating the techniques of potential attackers?
A. Red team B. While team C. Blue team D. Purple team Answer: A
A user reports constant lag and performance issues with the wireless network when working at a
local coffee shop. A security analyst walks the user through an installation of Wireshark and get a
five-minute pcap to analyze.
The analyst observes the following output:
Which of the following attacks does the analyst MOST likely see in this packet capture?
A. Session replay B. Evil twin C. Bluejacking D. ARP poisoning Answer: B
Which of the following would be BEST to establish between organizations to define the
responsibilities of each party outline the key deliverables and include monetary penalties for breaches to
manage third-party risk?
A. An ARO B. An MOU C. An SLA D. A BPA Answer: B
An organization suffered an outage and a critical system took 90 minutes to come back online.
Though there was no data loss during the outage, the expectation was that the critical system would be
available again within 60 minutes.
Which of the following is the 60-minute expectation an example of:
A. MTBF B. RPO C. MTTR D. RTO Answer: D
A cybersecurity department purchased o new PAM solution. The team is planning to randomize the
service account credentials of the Windows server first.
Which of the following would be the BEST method to increase the security on the Linux server?
A. Randomize the shared credentials B. Use only guest accounts to connect. C. Use SSH keys and remove generic passwords D. Remove all user accounts. Answer: C
A privileged user at a company stole several proprietary documents from a server. The user also
went into the log files and deleted all records of the incident. The systems administrator has Just informed
investigators that other log files are available for review.
Which of the following did the administrator MOST likely configure that will assist the investigators?
A. Memory dumps B. The syslog server C. The application logs D. The log retention policy Answer: B
A company is designing the layout of a new datacenter so it will have an optimal environmental
temperature.
Which of the following must be included? (Select TWO)
A. An air gap B. A cold aisle C. Removable doors D. A hot aisle E. An loT thermostat F. A humidity monitor Answer: E,F
The following is an administrative control that would be MOST effective to reduce the occurrence of
malware execution?
A. Security awareness training B. Frequency of NIDS updates C. Change control procedures D. EDR reporting cycle Answer: A
A researcher has been analyzing large data sets for the last ten months. The researcher works with
colleagues from other institutions and typically connects via SSH to retrieve additional data.
Historically, this setup has worked without issue, but the researcher recently started getting the following
message:
Which of the following network attacks is the researcher MOST likely experiencing?
A. MAC cloning B. Evil twin C. Man-in-the-middle D. ARP poisoning Answer: C
A user recent an SMS on a mobile phone that asked for bank delays.
Which of the following social-engineering techniques was used in this case?
A. SPIM B. Vishing C. Spear phishing D. Smishing Answer: D
Which of the following describes the BEST approach for deploying application patches?
A. Apply the patches to systems in a testing environment then to systems in a staging environment, and
finally to production systems.
B. Test the patches in a staging environment, develop against them in the development environment, and
then apply them to the production systems
C. Test the patches m a test environment apply them to the production systems and then apply them to a
staging environment
D. Apply the patches to the production systems apply them in a staging environment, and then test all of
them in a testing environment
Answer: A
A recent malware outbreak across a subnet included successful rootkit installations on many PCs,
ensuring persistence by rendering remediation efforts ineffective.
Which of the following would BEST detect the presence of a rootkit in the future?
A. FDE B. NIDS C. EDR D. DLP Answer: C
A large enterprise has moved all Hs data to the cloud behind strong authentication and encryption. A
sales director recently had a laptop stolen and later, enterprise data was round to have been
compromised database.
Which of the following was the MOST likely cause?
A. Shadow IT B. Credential stuffing C. SQL injection D. Man-in-the-browser E. Bluejacking Answer: A
To mitigate the impact of a single VM being compromised by another VM on the same hypervisor, an
administrator would like to utilize a technical control to further segregate the traffic.
Which of the following solutions would BEST accomplish this objective?
A. Install a hypervisor firewall to filter east-west traffic.
B. Add more VLANs to the hypervisor network switches.
C. Move exposed or vulnerable VMs to the DMZ.
D. Implement a zero-trust policy and physically segregate the hypervisor servers.
Answer: B
