251-300 Flashcards
A security analyst is concerned about critical vulnerabilities that have been detected on some applications running inside containers. Which of the following is the BEST remediation strategy?
A Update the base container Image and redeploy the environment.
B Include the containers in the regular patching schedule for servers.
C Patch each running container individually and test the application.
D Update the host in which the containers are running.
A. Update the base container Image and redeploy the environment.
A small, local company experienced a ransomware attack. The company has one web-facing server and a few workstations. Everything is behind an ISP firewall. A single web facing server is set up on the router to forward all polls so that the server is viewable from the internet. The company uses an older version of third-party software to manage the website. The assets were never patched. Which of the following should be done to prevent an attack like this from happening again? (Choose three.)
A install DLP software to prevent data loss
B Use the latest version of software
C Install a SIEM device
D Implement MDM
E Implement a screened subnet for the web server
F Install an endpoint security solution
G Update the website certificate and revoke the existing ones
H Deploy additional network sensors
B. Use the latest version of software
E. Implement a screened subnet for the web server
F. Install an endpoint security solution
Which of the following BEST helps to demonstrate integrity during a forensic investigation?
A Event logs
B Encryption
C Hashing
D Snapshots
C. Hashing
A company is moving its retail website to a public cloud provider. The company wants to tokenize credit card data but not allow the cloud provider to see the stored credit card information. Which of the following would BEST meet these objectives?
A WAF
B CASB
C VPN
D TLS
D. TLS
An organization has been experiencing outages during holiday sales and needs to ensure availability of its point-of-sale systems. The IT administrator has been asked to improve both server-data fault tolerance and site availability under high consumer load. Which of the following are the best options to accomplish this objective? (Choose two.)
A Load balancing
B Incremental backups
C UPS
D RAID
E Dual power supply
F VLAN
A. Load balancing
D. RAID
A junior security analyst is conducting an analysis after passwords were changed on multiple accounts without users interaction. The SIM have multiple login entries with the following text
suspicious event - user:
scheduledtasks successfully authenticate on AD on abnormal time
suspicious event - user: scheduledtasks failed to execute c:weekly _checkupslamazing-3rdparty-domain-assessment. py
suspicious event - user: scheduledtasks failed to execute c:weekly checkups\secureyourAD-3rdparty-compliance sh
suspicious event - user: scheduledtasks successfully executed c:weekly checkupslamazing-3rdparty-domain-assessment.py
Which of the following is the MOST likely attack conducted on the environment?
A Malicious script
B Privilege escalation
C Domain hijacking
D DNS poisoning
B. Privilege escalation
Users have been issued smart cards that provide physical access to a building. The cards also contain tokens that can be used to access information systems. Users can log in to any thin client located throughout the building and see the same desktop each time. Which of the following technologies are being utilized to provide these capabilities? (Choose two.)
A COPE
B VDI
C GPS
D TOTP
E REID
F BYOD
B. VDI
E. REID
A security team has been alerted to a flood of incoming emails that have various subject lines and are addressed to multiple email inboxes. Each email contains a URL shortener link that is redirecting to a dead domain. Which of the following is the best step for the security team to take?
A Create a blocklist for all subject lines.
B Send the dead domain to a DNS sinkhole
C Quarantine all emails received and notify all employees.
D Block the URL shortener domain in the web proxy.
D. Block the URL shortener domain in the web proxy.
Which of the following can be used to calculate the total loss expected per year due to a threat targeting an asset?
A EF x asset value
B ALE/ SLE
C MTBF x impact
D SLEXARO
D. SLEXARO
A security analyst is reviewing packet capture data from a compromised host on the network. In the packet capture, the analyst locates packets that contain large amounts of text. Which of the following is most likely installed on the compromised host?
A Keylogger
B Spyware
C Trojan
D Ransomware
A. Keylogger
An organization routes all of its traffic through a VPN. Most users are remote and connect into a corporate data center that houses confidential information. There is a firewall at the internet border, followed by a DLP appliance, the VPN server, and the data center itself. Which of the following is the weakest design element?
A The DLP appliance should be integrated into a NGFW.
B Split-tunnel connections can negatively impact the DLP appliance’s performance
C Encrypted VPN traffic will not be inspected when entering or leaving the network.
D Adding two hops in the VPN tunnel may slow down remote connections
C. Encrypted VPN traffic will not be inspected when entering or leaving the network.
The Chief Compliance Officer from a bank has approved a background check policy for all new hires. Which of the following is the policy MOST likely protecting against?
A Preventing any current employees’ siblings from working at the bank to prevent nepotism
B Hiring an employee who has been convicted of theft to adhere to industry compliance
C Filterina applicants who have added false information to resumes so they appear better qualified
D Ensuring no new hires have worked at other banks that may be trying to steal customer information
D. Ensuring no new hires have worked at other banks that may be trying to steal customer information
A company recently set up an e commerce portal to sell its products online. The company wants to start accepting credit cards for payment, which requires compliance with a security standard Which of the following standards must the company comply with before accepting credit cards on its e-commerce platform?
A PCIDSS
B ISO 22301
C ISO 27001
D NIST CSF
A. PCIDSS
A vulnerability assessment report will include the CVSS score of the discovered vulnerabilities because the score allows the organization to better:
A validate the vulnerability exists in the organization’s network through penetration testing
B research the appropriate mitigation techniques in a vulnerability database.
C find the software patches that are required to mitigate a vulnerability.
D prioritize remediation of vulnerabilities based on the possible impact.
D. prioritize remediation of vulnerabilities based on the possible impact.
A network administrator has been alerted that web pages are experiencing long load times. After determining it is not a routing or DNS issue, the administrator logs in to the router, runs a command, and receives the following output:
CPU 0 percent busy, from 300 sec ago 1 sec ave: 99 percent busy
5 sec ave: 97 percent bus
1 min ave: 83 percent busy
Which of the following is the router experiencing?
A DDoS attack
B Memor leak
C Buffer overflow
D Resource exhaustion
D. Resource exhaustion
An organization recently released a software assurance policy that requires developers to run code scans each night on the repository. After the first night, the security team alerted the developers that more than 2,000 findings were reported and need to be addressed. Which of the following is the MOST likely cause for the high number of findings?
A The vulnerability scanner was not properly configured and generated a high number of false positives
B Third-party libraries have been loaded into the repository and should be removed from the codebase
C The vulnerability scanner found several memory leaks during runtime, causing duplicate reports for the same issue
D The vulnerability scanner was not loaded with the correct benchmarks and needs to be updated.
D. The vulnerability scanner was not loaded with the correct benchmarks and needs to be updated.
Which of the following control types is patch management classified under?
A Deterrent
B Physical
C Corrective
D Detective
C. Corrective
Which of the following is a benefit of including a risk management framework into an organization’s security approach?
A It defines expected service levels from participating supply chain partners to ensure system outages are remediated in a timely manner.
B It identifies specific vendor products that have been tested and approved for use in a secure environment.
C It provides legal assurances and remedies in the event a data breach occurs
D It incorporates control, development, policy, and management activities into IT operations.
D. It incorporates control, development, policy, and management activities into IT operations.
A security analyst is reviewing the following logs:
[10:00:00 AM Login relected
- username administrator - password Spring2023
[10: 00:01 AM] Login rejected
- username jsmith - password Spring2023
[10:00:01 AM] Login rejected
use rare guest password Spring2023
[10:00:02 AM) Login rejected - username polk password Spring2023
(10:00:03 AM] Login rejected - username martin - password spring2023
Which of the following attacks is most likely occurring?
A Password spraying
B Account forgery
C Pass-the-hash
D Brute-force
A. Password spraying
While checking logs, a security engineer notices a number of end users suddenly downloading files with the tar g extension. Closer examination of the files reveals they are PE32 files. The end users state they did not initiate any of the downloads. Further investigation reveals the end users all clicked on an external email containing an infected MHT file with an href link a week prior.
Which of the following is MOST likely occurring?
A A RAT was installed and is transferring additional exploit tools
B The workstations are beaconing to a command-and-control server.
C A logic bomb was executed and is responsible for the data transfers.
D A fileless virus is spreading in the local network environment
B. The workstations are beaconing to a command-and-control server.
After a recent security incident, a security analyst discovered that unnecessary ports were open on a firewall policy for a web server. Which of the following firewall polices would be MOST secure for a web server?
[Source Destination Port Action]
ANY ANY TCP 80 DENY
ANY ANY TCP 443 ALLOW
ANY ANY ANY ALLOW
