251-300 Flashcards
A company’s Chief Information Office (CIO) is meeting with the Chief Information Security Officer
(CISO) to plan some activities to enhance the skill levels of the company’s developers.
Which of the following would be MOST suitable for training the developers’?
A. A capture-the-flag competition B. A phishing simulation C. Physical security training D. Baste awareness training Answer: B
A security administrator suspects there may be unnecessary services running on a server.
Which of the following tools will the administrator MOST likely use to confirm the suspicions?
A. Nmap B. Wireshark C. Autopsy D. DNSEnum Answer: A
A security engineer has enabled two-factor authentication on all workstations.
Which of the following approaches are the MOST secure? (Select TWO).
A. Password and security question B. Password and CAPTCHA C. Password and smart card D. Password and fingerprint E. Password and one-time token F. Password and voice Answer: C,D
A cybersecurity administrator needs to add disk redundancy for a critical server. The solution must
have a two- drive failure for better fault tolerance.
Which of the following RAID levels should the administrator select?
A. 0 B. 1 C. 5 D. 6 Answer: B
A company was recently breached Part of the company’s new cybersecurity strategy is to centralize
the logs from all security devices.
Which of the following components forwards the logs to a central source?
A. Log enrichment B. Log aggregation C. Log parser D. Log collector Answer: D
A security engineer needs to implement an MDM solution that complies with the corporate mobile
device policy.
The policy states that in order for mobile users to access corporate resources on their devices the
following requirements must be met:
• Mobile device OSs must be patched up to the latest release
• A screen lock must be enabled (passcode or biometric)
• Corporate data must be removed if the device is reported lost or stolen
Which of the following controls should the security engineer configure? (Select TWO)
A. Containerization B. Storage segmentation C. Posturing D. Remote wipe E. Full-device encryption F. Geofencing Answer: D,E
A user contacts the help desk to report the following:
✑ Two days ago, a pop-up browser window prompted the user for a name and password after connecting
to the corporate wireless SSID. This had never happened before, but the user entered the information as
requested.
✑ The user was able to access the Internet but had trouble accessing the department share until the next
day.
✑ The user is now getting notifications from the bank about unauthorized transactions.
Which of the following attack vectors was MOST likely used in this scenario?
A. Rogue access point B. Evil twin C. DNS poisoning D. ARP poisoning Answer: A
A company has limited storage available and online presence that cannot for more than four hours.
Which of the following backup methodologies should the company implement to allow for the FASTEST
database restore time In the event of a failure, which being maindful of the limited available storage
space?
A. Implement fulltape backup every Sunday at 8:00 p.m and perform nightly tape rotations.
B. Implement different backups every Sunday at 8:00 and nightly incremental backups at 8:00 p.m
C. Implement nightly full backups every Sunday at 8:00 p.m
D. Implement full backups every Sunday at 8:00 p.m and nightly differential backups at 8:00
Answer: B
Which of the following often operates in a client-server architecture to act as a service repository.
providing enterprise consumers access to structured threat intelligence data?
A. STIX B. CIRT C. OSINT D. TAXII Answer: B
A forensics investigator is examining a number of unauthorized payments the were reported on the
company’s website. Some unusual log entries show users received an email for an unwanted mailing list
and clicked on a link to attempt to unsubscribe. One of the users reported the email to the phishing team,
and the forwarded email revealed the link to be:
Which of the following will the forensics investigator MOST likely determine has occurred?
A. SQL injection B. CSRF C. XSS D. XSRF Answer: B
A smart retail business has a local store and a newly established and growing online storefront. A
recent storm caused a power outage to the business and the local ISP, resulting in several hours of lost
sales and delayed order processing.
The business owner now needs to ensure two things:
* Protection from power outages
* Always-available connectivity In case of an outage
The owner has decided to implement battery backups for the computer equipment.
Which of the following would BEST fulfill the owner’s second need?
A. Lease a point-to-point circuit to provide dedicated access.
B. Connect the business router to its own dedicated UPS.
C. Purchase services from a cloud provider for high availability
D Replace the business’s wired network with a wireless network.
Answer: C
An organization’s RPO for a critical system is two hours. The system is used Monday through Friday,
from 9:00 am to 5:00 pm. Currently, the organization performs a full backup every Saturday that takes four
hours to complete.
Which of the following additional backup implementations would be the BEST way for the analyst to meet
the business requirements?
A. Incremental backups Monday through Friday at 6:00 p.m and differential backups hourly
B. Full backups Monday through Friday at 6:00 p.m and incremental backups hourly.
C. incremental backups Monday through Friday at 6:00 p.m and full backups hourly.
D. Full backups Monday through Friday at 6:00 p.m and differential backups hourly.
Answer: A
A company has drafted an insider-threat policy that prohibits the use of external storage devices.
Which of the following would BEST protect the company from data exfiltration via removable media?
A. Monitoring large data transfer transactions in the firewall logs
B. Developing mandatory training to educate employees about the removable media policy
C. Implementing a group policy to block user access to system files
D. Blocking removable-media devices and write capabilities using a host-based security tool
Answer: D
A software developer needs to perform code-execution testing, black-box testing, and nonfunctional
testing on a new product before its general release.
Which of the following BEST describes the tasks the developer is conducting?
A. Verification B. Validation C. Normalization D. Staging Answer: A
Which of the following would be the BEST resource lor a software developer who is looking to
improve secure coding practices for web applications?
A. OWASP B. Vulnerability scan results C. NIST CSF D. Third-party libraries Answer: A
A security analyst needs to perform periodic vulnerability scans on production systems.
Which of the following scan Types would produce the BEST vulnerability scan report?
A. Port B. Intrusive C. Host discovery D. Credentialed Answer: D
Which of the following would be BEST for a technician to review to determine the total risk an
organization can bear when assessing a “cloud-first” adoption strategy?
A. Risk matrix B. Risk tolerance C. Risk register D. Risk appetite Answer: B
Following a prolonged datacenter outage that affected web-based sales, a company has decided to
move its operations to a private cloud solution.
The security team has received the following requirements:
• There must be visibility into how teams are using cloud-based services.
• The company must be able to identify when data related to payment cards is being sent to the cloud.
• Data must be available regardless of the end user’s geographic location
• Administrators need a single pane-of-glass view into traffic and trends.
Which of the following should the security analyst recommend?
A. Create firewall rules to restrict traffic to other cloud service providers.
B. Install a DLP solution to monitor data in transit.
C. Implement a CASB solution.
D. Configure a web-based content filter.
Answer: B
A retail executive recently accepted a job with a major competitor. The following week, a security
analyst reviews the security logs and identifies successful logon attempts to access the departed
executive’s accounts.
Which of the following security practices would have addressed the issue?
A. A non-disclosure agreement B. Least privilege C. An acceptable use policy D. Ofboarding 76 / 107 Answer: D
A security analyst discovers several .jpg photos from a cellular phone during a forensics investigation
involving a compromised system. The analyst runs a forensics tool to gather file metadata.
Which of the following would be part of the images if all the metadata is still intact?
A. The GPS location B. When the file was deleted C. The total number of print jobs D. The number of copies made Answer: A
