201-250 Flashcards
Which of the following will provide the BEST physical security countermeasures to stop intruders?
(Select TWO.)
A. Alarms B. Signage C. Lighting D. Mantraps E. Fencing F. Sensors Answer: D,E
A security analyst is reviewing a penetration-testing report from a third-party contractor. The
penetration testers used the organization’s new API to bypass a driver to perform privilege escalation on
the organization’s web servers. Upon looking at the API, the security analyst realizes the particular API
call was to a legacy system running an outdated OS.
Which of the following is the MOST likely attack type?
A. Request forgery B. Session replay C. DLL injection D. Shimming Answer: A
A user enters a password to log in to a workstation and is then prompted to enter an authentication
code.
Which of the following MFA factors or attributes are being utilized in the authentication process? (Select
TWO).
A. Something you know B. Something you have C. Somewhere you are D. Someone you are E. Something you are F. Something you can do Answer: B,E
The manager who is responsible for a data set has asked a security engineer to apply encryption to
the data on a hard disk.
The security engineer is an example of a:
A. data controller. B. data owner C. data custodian. D. data processor Answer: D
A security modern may have occurred on the desktop PC of an organization’s Chief Executive Officer
(CEO) A duplicate copy of the CEO’s hard drive must be stored securely to ensure appropriate forensic
processes and the chain of custody are followed.
Which of the following should be performed to accomplish this task?
A. Install a new hard drive in the CEO’s PC, and then remove the old hard drive and place it in a
tamper-evident bag
B. Connect a write blocker to the hard drive Then leveraging a forensic workstation, utilize the dd
command m a live Linux environment to create a duplicate copy
C. Remove the CEO’s hard drive from the PC, connect to the forensic workstation, and copy all the
contents onto a remote fileshare while the CEO watches
D. Refrain from completing a forensic analysts of the CEO’s hard drive until after the incident is confirmed,
duplicating the hard drive at this stage could destroy evidence
Answer: D
An organization blocks user access to command-line interpreters but hackers still managed to invoke
the interpreters using native administrative tools.
Which of the following should the security team do to prevent this from Happening in the future?
A. Implement HIPS to block Inbound and outbound SMB ports 139 and 445.
B. Trigger a SIEM alert whenever the native OS tools are executed by the user
C. Disable the built-in OS utilities as long as they are not needed for functionality.
D. Configure the AV to quarantine the native OS tools whenever they are executed
Answer: C
Which of the following BEST describes the MFA attribute that requires a callback on a predefined
landline?
A. Something you exhibit B. Something you can do C. Someone you know D. Somewhere you are Answer: D
A security analyst needs to implement security features across smartphones. laptops, and tablets.
Which of the following would be the MOST effective across heterogeneous platforms?
A. Enforcing encryption B. Deploying GPOs C. Removing administrative permissions D. Applying MDM software Answer: D
A large industrial system’s smart generator monitors the system status and sends alerts to third-party
maintenance personnel when critical failures occur. While reviewing the network logs the company’s
security manager notices the generator’s IP is sending packets to an internal file server’s IP.
Which of the following mitigations would be BEST for the security manager to implement while
maintaining alerting capabilities?
A. Segmentation B. Firewall whitelisting C. Containment D. isolation Answer: A
Which of the following environments minimizes end-user disruption and is MOST likely to be used to
assess the impacts of any database migrations or major system changes by using the final version of the
code?
A. Staging B. Test C. Production D. Development Answer: B
Which of the following is the correct order of volatility from MOST to LEAST volatile?
A. Memory, temporary filesystems, routing tables, disk, network storage
B. Cache, memory, temporary filesystems, disk, archival media
C. Memory, disk, temporary filesystems, cache, archival media
D. Cache, disk, temporary filesystems, network storage, archival media
Answer: B
A recent security assessment revealed that an actor exploited a vulnerable workstation within an
organization and has persisted on the network for several months. The organization realizes the need to
reassess Its security.
Strategy for mitigating risks within the perimeter.
Which of the following solutions would BEST support the organization’s strategy?
A. FIM B. DLP C. EDR D. UTM Answer: C
A network administrator has been alerted that web pages are experiencing long load times.
After determining it is not a routing or DNS issue, the administrator logs in to the router, runs a command,
and receives the following output:
Which of the following is the router experiencing?
A. DDoS attack B. Memory leak C. Buffer overflow D. Resource exhaustion Answer: D
A user must introduce a password and a USB key to authenticate against a secure computer, and
authentication is limited to the state in which the company resides.
Which of the following authentication concepts are in use?
A. Something you know, something you have, and somewhere you are
B. Something you know, something you can do, and somewhere you are
C. Something you are, something you know, and something you can exhibit
D. Something you have, somewhere you are, and someone you know
Answer: A
A security analyst b concerned about traffic initiated to the dark web from the corporate LAN.
Which of the following networks should he analyst monitor?
A. SFTP B. AS C. Tor D. IoC Answer: C
A root cause analysis reveals that a web application outage was caused by one of the company’s
developers uploading a newer version of the third-party libraries that were shared among several
applications.
Which of the following implementations would be BEST to prevent the issue from reoccurring?
A. CASB B. SWG C. Containerization D. Automated failover Answer: C
A security analyst is reviewing logs on a server and observes the following output:
Which of the following is the security analyst observing?
A. A rainbow table attack B. A password-spraying attack C. A dictionary attack D. A keylogger attack Answer: C
HOTSPOT
Select the appropriate attack and remediation from each drop-down list to label the corresponding attack
with its remediation.
{{ PIC }}
Employees are having issues accessing the company’s website. Some employees report very slow
performance, while others cannot the website at all. The web and security administrators search the logs
and find millions of half-open connections to port 443 on the web server. Further analysis reveals
thousands of different source IPs initiating this traffic.
Which of the following attacks is MOST likely occurring?
A. DDoS B. Man-in-the-middle C. MAC flooding D. Domain hijacking Answer: A
A nuclear plant was the victim of a recent attack, and all the networks were air gapped. A subsequent
investigation revealed a worm as the source of the issue.
Which of the following BEST explains what happened?
A. A malicious USB was introduced by an unsuspecting employee.
B. The ICS firmware was outdated
C. A local machine has a RAT installed.
D. The HVAC was connected to the maintenance vendor.
Answer: A
