301-400 Flashcards
- A security administrator is opening connectivity on a firewall between Organization A and Organization B Organization B just acquired Organization A.
Which of the following risk mitigation strategies should the administrator implement to reduce the risk involved with this change?
A. DLP on internal network nodes
B. A network traffic analyzer for incoming traffic
C. A proxy server to examine outgoing web traffic
D. IPS/IDS monitoring on the new connection
D. IPS/IDS monitoring on the new connection
An organization is facing budget constraints The Chief Technology Officer (CTO) wants to add a new marketing platform but the organization does not have the resources to obtain separate
servers to run the new platform. The CTO recommends running the new marketing platform on a virtualized video-conferencing
server because video conferencing is rarely used. The Chief Information Security Officer (CISO) denies this request.
Which of the following BEST explains the reason why the CISO has not approved the request?
A. Privilege escalation attacks
B. Performance and availability
C. Weak DAR encryption
D. Disparate security requirements
D. Disparate security requirements
A cloud architect needs to isolate the most sensitive portion of the network while maintaining hosting in a public cloud.
Which of the following configurations can be employed to support this effort?
A. Create a single-tenancy security group in the public cloud that hosts only similar types of servers
B. Privatize the cloud by implementing an on-premises instance.
C. Create a hybrid cloud with an on-premises instance for the most sensitive server types.
D. Sandbox the servers with the public cloud by server type
A. Create a single-tenancy security group in the public cloud that hosts only similar types of servers
A financial services company has proprietary trading algorithms, which were created and are maintained by a team of developers on their private source code repository. If the details of this operation became known to competitors, the company’s ability to profit from its trading would disappear immediately.
Which of the following would the company MOST likely use to protect its trading algorithms?
A. Single-tenancy cloud
B. Managed security service providers
C. Virtual desktop infrastructure
D. Cloud security broker
A. Single-tenancy cloud
An attacker wants to gain information about a company’s database structure by probing the database listener. The attacker tries to manipulate the company’s database to see if it has any vulnerabilities that can be exploited to help carry out an attack.
To prevent this type of attack, which of the following should the company do to secure its database?
A. Mask the database banner
B. Tighten database authentication and limit table access
C. Harden web and Internet resources
D. Implement challenge-based authentication
B. Tighten database authentication and limit table access
An organization based in the United States is planning to expand its operations into the European market later in the year Legal counsel is exploring the additional requirements that must be
established as a result of the expansion.
The BEST course of action would be to
A. revise the employee provisioning and deprovisioning procedures
B. complete a quantitative risk assessment
C. draft a memorandum of understanding
D. complete a security questionnaire focused on data privacy.
D. complete a security questionnaire focused on data privacy.
A security engineer wants to introduce key stretching techniques to the account database to make password guessing attacks more difficult.
Which of the following should be considered to achieve this? (Choose two)
A. Digital signature
B. bcrypt
C. Perfect forward secrecy
D. SHA-256
E. P-384
F. PBKDF2
G. Record-level encryption
B and F
As part of an organization’s ongoing vulnerability assessment program, the Chief Information Security Officer (CISO) wants to evaluate the organization’s systems, personnel, and facilities for
various threats. As part of the assessment the CISO plans to engage an independent cybersecurity assessment firm to perform social engineering and physical penetration testing against the organization’s corporate offices and remote locations.
Which of the following techniques would MOST likely be employed as part of this assessment? (Choose three.)
A. Privilege escalation
B. SQL injection
C. TOC/TOU exploitation
D. Rogue AP substitution
E. Tailgating
F. Vulnerability scanning
G. Vishing
H. Badge skimming
E, G, H
A security engineer discovers a PC may have been breached and accessed by an outside agent. The engineer wants to find out how this breach occurred before remediating the damage.
Which of the following should the security engineer do FIRST to begin this investigation?
A. Create an image of the hard drive
B. Capture the incoming and outgoing network traffic
C. Dump the contents of the RAM
D. Parse the PC logs for information on the attacker.
C. Dump the contents of the RAM
A hospital is using a functional magnetic resonance imaging (fMRI) scanner, which is controlled legacy desktop connected to the network. The manufacturer of the fMRI will not support patching of the legacy system. The legacy desktop needs to be network accessible on TCP port 445. A security administrator is concerned the legacy system will be vulnerable to exploits.
Which of the following would be the BEST strategy to reduce the risk of an outage while still providing for security?
A. Install HIDS and disable unused services.
B. Enable application whitelisting and disable SMB.
C. Segment the network and configure a controlled interface
D. Apply only critical security patches for known vulnerabilities.
C. Segment the network and configure a controlled interface
A Chief Information Security Officer (CISO) has created a survey that will be distributed to managers of mission-critical functions across the organization. The survey requires the managers to determine how long their respective units can operate in the event of an extended IT outage before the organization suffers monetary losses from the outage.
To which of the following is the survey question related? (Choose two.)
A. Risk avoidance
B. Business impact
C. Risk assessment
D. Recovery point objective
E. Recovery time objective
F. Mean time between failures
B & E
Following a recent security incident on a web server the security analyst takes HTTP traffic captures for further investigation. The analyst suspects certain jpg files have important data hidden within them.
Which of the following tools will help get all the pictures from within the HTTP traffic captured to a specified folder?
A. tshark
B. memdump
C. nbtstat
D. dd
A. tshark
A company has completed the implementation of technical and management controls as required by its adopted security, ponies and standards. The implementation took two years and consumed s the budget approved to security projects. The board has denied any further requests for additional budget.
Which of the following should the company do to address the residual risk?
A. Transfer the risk
B. Baseline the risk.
C. Accept the risk
D. Remove the risk
C. Accept the risk
An e-commerce company that provides payment gateways is concerned about the growing expense and time associated with PCI audits of its payment gateways and external audits by customers for their own compliance reasons. The Chief Information Officer (CIO) asks the security team to provide a list of options that will:
- Reduce the overall cost of these audits
- Leverage existing infrastructure where possible
- Keep infrastructure costs to a minimum
- Provide some level of attestation of compliance
Which of the following will BEST address the CIO”s concerns? (Choose two.)
A. Invest in new UBA to detect report, and remediate attacks faster
B. Segment the network to reduce and limit the audit scope
C. Undertake ISO certification for all core infrastructure including datacenters.
D. Implement a GRC system to track and monitor controls
E. Implement DLP controls on HTTP’HTTPS and email
F. Install EDR agents on all corporate endpoints
B & D
An employee decides to log into an authorized system. The system does not prompt the employee for authentication prior to granting access to the console, and it cannot authenticate the network resources.
Which of the following attack types can this lead to if it is not mitigated?
A. Memory leak
B. Race condition
C. Smurf
D. Resource exhaustion
B. Race condition
A company is implementing a new secure identity application, given the following requirements:
- The cryptographic secrets used in the application must never be exposed to users or the OS
- The application must work on mobile devices.
- The application must work with the company’s badge reader system
Which of the following mobile device specifications are required for this design? (Choose two.)
A. Secure element
B. Biometrics
C. UEFI
D. SEAndroid
E. NFC
F. HSM
E & F
A small firm’s newly created website has several design flaws.
The developer created the website to be fully compatible with ActiveX scripts in order to use various digital certificates and trusting certificate authorities. However, vulnerability testing indicates sandboxes were enabled, which restricts the code’s
access to resources within the user’s computer.
Which of the following is the MOST likely cause of the error”?
A. The developer inadvertently used Java applets.
B. The developer established a corporate account with a non-reputable certification authority.
C. The developer used fuzzy logic to determine how the web browser would respond once ports 80and 443 were both open
D. The developer did not consider that mobile code would be transmitted across the network.
A. The developer inadvertently used Java applets.
An organization is integrating an ICS and wants to ensure the system is cyber resilient. Unfortunately, many of the specialized components are legacy systems that cannot be patched. The existing enterprise consists of mission-critical systems that require 99.9% uptime.
To assist in the appropriate design of the system given the constraints, which of the following
MUST be assumed?
A. Vulnerable components
B. Operational impact due to attack
C. Time criticality of systems
D. Presence of open-source software
A. Vulnerable components
The Chief Information Security Officer (CISO) of an organization is concerned with the transmission of cleartext authentication information across the enterprise. A security assessment has been performed and has identified the use of ports 80, 389, and 3268.
Which of the following solutions would BEST address the CISO’s concerns?
A. Disable the ports that are determined to contain authentication information
B. Force HTTPS, enable LDAPS, and disable cleartext global catalog communication.
C. Deploy a VPN between networks that transmits authentication information via cleartext
D. Proxy HTTP traffic and migrate to a more secure directory service
B. Force HTTPS, enable LDAPS, and disable cleartext global catalog communication.
Two competing companies experienced similar attacks on their networks from various threat
actors. To improve response times, the companies wish to share some threat intelligence about
the sources and methods of attack. Which of the following business documents would be BEST
to document this engagement?
A. Business partnership agreement
B. Memorandum of understanding
C. Service-level agreement
D. Interconnection security agreement
D. Interconnection security agreement
A security analyst is evaluating the security of an online customer banking system. The analyst has a 12-character password for the test account. At the login screen, the analyst is asked to enter the third, eighth, and eleventh characters of the password.
Which of the following describes why this request is a security concern? (Choose two.)
A. The request is evidence that the password is more open to being captured via a keylogger.
B. The request proves that salt has not been added to the password hash, thus making it vulnerable to rainbow tables.
C. The request proves the password is encoded rather than encrypted and thus less secure as it can be easily reversed.
D. The request proves a potential attacker only needs to be able to guess or brute force three characters rather than 12 characters of the password.
E. The request proves the password is stored in a reversible format, making it readable by anyone at the bank who is given access.
F. The request proves the password must be in cleartext during transit, making it open to on-path attacks.
D & E
A company would like to obfuscate PII data accessed by an application that is housed in a database to prevent unauthorized viewing. Which of the following should the company do to
accomplish this goal?
A. Use cell-level encryption.
B. Mask the data.
C. Implement a DLP solution.
D. Utilize encryption at rest.
B. Mask the data.
Which of the following BEST describe the importance of maintaining chain of custody in forensic evidence collection? (Choose two.)
A. It increases the likelihood that evidence will be deemed admissible in court.
B. It authenticates personnel who come in contact with evidence after collection.
C. It ensures confidentiality and the need-to-know basis of forensically acquired evidence.
D. It attests to how recently evidence was collected by recording date/time attributes.
E. It provides automated attestation for the integrity of the collected evidence.
F. It ensures the integrity of the collected evidence.
A & F
An organization collects personal data from its global customers. The organization determines how that data is going to be used, why it is going to be used, and how it is manipulated for business processes.
Which of the following will the organization need in order to comply with GDPR? (Choose two.)
A. Data processor
B. Data custodian
C. Data owner
D. Data steward
E. Data controller
F. Data manager
A & E
The Chief Executive Officer (CEO) of a small wholesaler with low margins is concerned about the use of a newly developed artificial intelligence algorithm being used in the organization’s marketing tool. The tool can make automated purchasing approval decisions based on data provided by customers and collected from the Internet.
Which of the following is MOST likely the concern? (Choose two.)
A. Required computing power
B. Cost to maintain
C. Customer privacy
D. Adversarial attacks
E. Information bias
F. Customer approval speed
C & E
An organization recently recovered from an attack that featured an adversary injecting malicious logic into OS bootloaders on endpoint devices. Therefore, the organization decided to require the use of TPM for measured boot and attestation, monitoring each component from the UEFI through the full loading of OS components.
Which of the following TPM structures enables this storage functionality?
A. Endorsement tickets
B. Clock/counter structures
C. Command tag structures with MAC schemes
D. Platform configuration registers
D. Platform configuration registers
A company created an external, PHP-based web application for its customers. A security researcher reports that the application has the Heartbleed vulnerability.
Which of the following would BEST resolve and mitigate the issue? (Choose two.)
A. Deploying a WAF signature
B. Fixing the PHP code
C. Changing the web server from HTTPS to HTTP
D. Using SSLv3
E. Changing the code from PHP to ColdFusion
F. Updating the OpenSSL library
B & F
An analyst has prepared several possible solutions to a successful attack on the company. The solutions need to be implemented with the LEAST amount of downtime.
Which of the following should the analyst perform?
A. Implement all the solutions at once in a virtual lab and then run the attack simulation. Collect the metrics and then choose the best solution based on the metrics.
B. Implement every solution one at a time in a virtual lab, running a metric collection each time. After the collection, run the attack simulation, roll back each solution, and then implement the next.
Choose the best solution based on the best metrics.
C. Implement every solution one at a time in a virtual lab, running an attack simulation each time while collecting metrics. Roll back each solution and then implement the next. Choose the best solution based on the best metrics.
D. Implement all the solutions at once in a virtual lab and then collect the metrics. After collection, run the attack simulation. Choose the best solution based on the best metrics.
D. Implement all the solutions at once in a virtual lab and then collect the metrics. After collection, run the attack simulation. Choose the best solution based on the best metrics.
An investigator is attempting to determine if recent data breaches may be due to issues with a
company’s web server that offers news subscription services.
The investigator has gathered the following data:
- Clients successfully establish TLS connections to web services provided by the server.
- After establishing the connections, most client connections are renegotiated.
- The renegotiated sessions use cipher suite TLS_RSA_WITH_NULL_SHA.
Which of the following is the MOST likely root cause?
A. The clients disallow the use of modem cipher suites.
B. The web server is misconfigured to support HTTP/1.1
C. A ransomware payload dropper has been installed.
D. An entity is performing downgrade attacks on path.
B. The web server is misconfigured to support HTTP/1.1
Which of the following is MOST commonly found in a network SLA contract?
A. Price for extra services
B. Performance metrics
C. Service provider responsibility only
D. Limitation of liability
E. Confidentiality and non-disclosure
B. Performance metrics
A security operations center analyst is investigating anomalous activity between a database server and an unknown external IP address and gathered the following data:
- dbadmin last logged in at 7:30 a.m. and logged out at 8:05 a.m.- A persistent TCP/6667 connection to the external address was established at 7:55 a.m. The connection is still active.- Other than bytes transferred to keep the connection alive, only a fewkilobytes of data transfer every hour since the start of theconnection.
- A sample outbound request payload from PCAP showed the ASCII content: “JOIN #community”.
Which of the following is the MOST likely root cause?
A. A SQL injection was used to exfiltrate data from the database server.
B. The system has been hijacked for cryptocurrency mining.
C. A botnet Trojan is installed on the database server.
D. The dbadmin user is consulting the community for help via Internet Relay Chat.
C. A botnet Trojan is installed on the database server.
Which of the following describes the system responsible for storing private encryption/decryption files with a third party to ensure these files are stored safely?
A. Key escrow
B. TPM
C. Trust models
D. Code signing
A. Key escrow
In comparison to other types of alternative processing sites that may be invoked as a part of disaster recovery, cold sites are different because they:
A. have basic utility coverage, including power and water.
B. provide workstations and read-only domain controllers.
C. are generally the least costly to sustain.
D. are the quickest way to restore business.
E. are geographically separated from the company’s primary facilities.
C. are generally the least costly to sustain.
During a phishing exercise, a few privileged users ranked high on the failure list. The enterprise would like to ensure that privileged users have an extra security- monitoring control in place.
Which of the following is the MOST likely solution?
A. A WAF to protect web traffic
B. User and entity behavior analytics
C. Requirements to change the local password
D. A gap analysis
B. User and entity behavior analytics
An analyst is evaluating the security of a web application that does not hold sensitive or financial data. The application requires users to have a minimum password length of 12 characters. One of the characters must be capitalized, and one must be a number. To reset the password, the user is asked to provide the birthplace, birthdate, and mother’s maiden name. When all of these are entered correctly, a new password is emailed to the user.
Which of the following should concern the analyst the MOST?
A. The security answers may be determined via online reconnaissance.
B. The password is too long, which may encourage users to write the password down.
C. The password should include a special character.
D. The minimum password length is too short.
A. The security answers may be determined via online reconnaissance.
A security researcher has been given an executable that was captured by a honeypot.
Which of the following should the security researcher implement to test the executable?
A. OSINT
B. SAST
C. DAST
D. OWASP
C. DAST
An executive has decided to move a company’s customer-facing application to the cloud after experiencing a lengthy power outage at a locally managed service provider’s data center. The
executive would like a solution that can be implemented as soon as possible.
Which of the following will BEST prevent similar issues when the service is running in the cloud? (Choose two.)
A. Placing the application instances in different availability zones
B. Restoring the snapshot and starting the new application instance from a different zoneC. Enabling autoscaling based on application instance usage
D. Having several application instances running in different VPCs
E. Using the combination of block storage and multiple CDNs in each application instanceF. Setting up application instances in multiple regions
A & F
A hospitality company experienced a data breach that included customer PII. The hacker used social engineering to convince an employee to grant a third-party application access to some company documents within a cloud file storage service.
Which of the following is the BEST solution to help prevent this type of attack in the future?
A. NGFW for web traffic inspection and activity monitoring
B. CSPM for application configuration control
C. Targeted employee training and awareness exercises
D. CASB for OAuth application permission control
C. Targeted employee training and awareness exercises
A product manager at a new company needs to ensure the development team produces high quality code on time. The manager has decided to implement an agile development approach instead of waterfall.
Which of the following are reasons to choose an agile development approach? (Choose two.)
A. The product manager gives the developers more autonomy to write quality code prior to deployment.
B. An agile approach incorporates greater application security in the development process than a waterfall approach does.
C. The scope of work is expected to evolve during the lifetime of project development.
D. The product manager prefers to have code iteratively tested throughout development.
E. The product manager would like to produce code in linear phases.
F. Budgeting and creating a timeline for the entire project is often more straightforward using an agile approach rather than waterfall.
C & D
In a cloud environment, the provider offers relief to an organization’s teams by sharing in many of the operational duties.
In a shared responsibility model, which of the following responsibilities belongs to the provider in a PaaS implementation?
A. Application-specific data assets
B. Application user access management
C. Application-specific logic and code
D. Application/platform software
D. Application/platform software
A local university that has a global footprint is undertaking a complete overhaul of its website and associated systems Some of the requirements are:
- Handle an increase in customer demand of resources
- Provide quick and easy access to information
- Provide high-quality streaming media
- Create a user-friendly interface
Which of the following actions should be taken FIRST?
A. Deploy high-availability web servers.
B. Enhance network access controls.
C. Implement a content delivery network.
D. Migrate to a virtualized environment.
C. Implement a content delivery network.
In order to save money, a company has moved its data to the cloud with a low-cost provider. The company did not perform a security review prior to the move; however, the company requires all of its data to be stored within the country where the headquarters is located. A new employee on the security team has been asked to evaluate the current provider against the most important requirements.
The current cloud provider that the company is using offers:
- Only multitenant cloud hosting
- Minimal physical security
- Few access controls
- No access to the data center
The following information has been uncovered:
- The company is located in a known floodplain. which flooded last year.
- Government regulations require data to be stored within the country.
Which of the following should be addressed FIRST?
A. Update the disaster recovery plan to account for natural disasters.
B. Establish a new memorandum of understanding with the cloud provider.
C. Establish a new service-level agreement with the cloud provider.
D. Provision services according to the appropriate legal requirements.
D. Provision services according to the appropriate legal requirements.
A security administrator needs to implement an X.509 solution for multiple sites within the human resources department. This solution would need to secure all subdomains associated with the domain name of the main human resources web server.
Which of the following would need to be implemented to properly secure the sites and provide easier private key management?
A. Certificate revocation list
B. Digital signature
C. Wildcard certificate
D. Registration authority
E. Certificate pinning
C. Wildcard certificate
An organization’s threat team is creating a model based on a number of incidents in which systems in an air-gapped location are compromised. Physical access to the location and logical
access to the systems are limited to administrators and select, approved, on-site company employees.
Which of the following is the BEST strategy to reduce the risks of data exposure?
A. NDAs
B. Mandatory access control
C. NIPS
D. Security awareness training
B. Mandatory access control
