501-550 Flashcards

1
Q

A government organization is developing an advanced Al defense system. Developers are using information collected from third-party providers. Analysts are noticing inconsistencies in the expected progress of the Al learning and attribute the outcome to a recent attack on one of the suppliers. Which of the following is the most likely reason for the inaccuracy of the system?

A. Improper algorithms security
B. Tainted training data
C. Fileless virus
D. Cryptomalware

A

B. Tainted training data

Explanation:
The inconsistencies in the expected progress of the AI learning are likely due to tainted training data from a recent attack on one of the suppliers. When the training data used to train AI systems is compromised or manipulated (often inadvertently through attacks like data breaches or supply chain attacks), it can lead to inaccurate AI model outputs and behaviors. Therefore, in this scenario, the most likely reason for the inaccuracies in the AI defense system is the tainted training data resulting from the attack on the supplier.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A company’s help desk has received calls about the wireless network being down and users being unable to connect to it. The network administrator says all access points are up and running. One of the help desk technicians notices the affected users are working in a building near the parking lot. Which of the following is the most likely reason for the outage?

A. Someone near the building is jamming the signal.
B. A user has set up a rogue access point near the building.
C. Someone set up an evil twin access point in the affected area.
D. The APs in the affected area have been unplugged from the network.

A

A. Someone near the building is jamming the signal.

Explanation:
The symptoms described — users near a specific area (building near the parking lot) unable to connect to the wireless network while the access points (APs) appear operational — suggest that the wireless signal in that area is being jammed. Jamming refers to intentional interference with wireless signals, which can disrupt or block connectivity.

Here’s why the other options are less likely:

B. A user has set up a rogue access point near the building: While possible, rogue access points usually affect connectivity differently, often by causing conflicts or interference due to overlapping signals. They do not necessarily cause complete outages unless they are disrupting the network significantly.
C. Someone set up an evil twin access point in the affected area: An evil twin AP mimics a legitimate AP to trick users into connecting to it, but it typically does not cause a complete outage unless users connect to it and are subjected to some form of attack or redirection.
D. The APs in the affected area have been unplugged from the network: If APs were unplugged, they would not be operational at all, and users would not detect them as available networks.

Therefore, given the symptoms described (partial outage in a specific area despite APs being up), the most likely cause is deliberate signal jamming affecting the wireless network in that area.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which of the following can best protect against an employee inadvertently installing malware on a company system?

A. Host-based firewall
B. System isolation
C. Least privilege
D. Application allow list

A

D. Application allow list

Explanation:

Application allow list: This security measure restricts the applications that can be installed and run on a system to a predefined list of approved applications. By doing so, it prevents employees from inadvertently installing malware or unauthorized software, as only the applications on the allow list can be executed.

Host-based firewall: While useful for controlling network traffic to and from the host, a firewall does not prevent the installation of malware. It can block malicious traffic but doesn't address the issue of unauthorized software installation.

System isolation: This involves separating systems or segments of a network to limit the spread of malware. While helpful for containing an infection, it does not prevent the initial installation of malware.

Least privilege: This principle involves giving users the minimum level of access necessary to perform their job functions. While it reduces the risk of malware installation by limiting what users can do, it is not as direct or effective as an application allow list in preventing the installation of unauthorized software.

Therefore, an application allow list provides the most direct and effective protection against the inadvertent installation of malware by employees.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

An information security officer at a credit card transaction company is conducting a framework-mapping exercise with the internal controls. The company recently established a new office in Europe. To which of the following frameworks should the security officer map the existing controls? (Choose two.)

A. ISO
B. PCIDSS
C. SOC
D. GDPR
E. CSA
F. NIST

A

B. PCIDSS (Payment Card Industry Data Security Standard): PCIDSS is essential for any organization handling credit card transactions, ensuring secure handling of cardholder information.

D. GDPR (General Data Protection Regulation): GDPR is crucial for compliance with data protection and privacy regulations in the European Union, especially since the company has established an office in Europe.

Explanation:

PCIDSS: Since the company deals with credit card transactions, compliance with PCIDSS is mandatory to secure cardholder data and ensure secure payment processing.
GDPR: With the new office in Europe, compliance with GDPR is necessary to protect personal data and ensure privacy rights of individuals within the EU.

These frameworks address specific regulatory requirements related to data protection, privacy, and secure payment processing, which are critical for the company’s operations in Europe.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A customer called a company’s security team to report that all invoices the customer has received over the last five days from the company appear to have fraudulent banking details. An investigation into the matter reveals the following:

The manager of the accounts payable department is using the same password across multiple external websites and the corporate account. One of the websites the manager used recently experienced a data breach. The manager’s corporate email account was successfully accessed in the last five days by an IP address located in a foreign country.

Which of the following attacks has most likely been used to compromise the manager’s corporate account?

A. Remote access Trojan
B. Brute-force
C. Dictionary
D. Credential stuffing
E. Password spraying

A

E. Password spraying.

Here’s why:

Password Reuse: The manager used the same password across multiple external websites and the corporate account. This practice is risky because if one site is compromised, attackers can use the same credentials to access other accounts.
Data Breach: One of the external websites the manager used recently experienced a data breach. This means that the manager's credentials used on that site could have been exposed.
Successful Access from Foreign IP: The manager's corporate email account was accessed successfully from an IP address located in a foreign country. This suggests unauthorized access likely gained through compromised credentials.

Password Spraying involves using a single password across multiple accounts or services, rather than attempting to brute-force a single account. Attackers try common or previously exposed passwords against multiple accounts, leveraging the likelihood that users reuse passwords across different services. In this scenario, the compromised credentials from the breached external website were likely used in a password spraying attack against the corporate email account, resulting in unauthorized access.

Therefore, the most likely attack used to compromise the manager’s corporate account, given the details provided, is E. Password spraying.

Let’s review why the other answers are not as suitable as Password spraying for describing the attack that compromised the manager’s corporate account:

Remote access Trojan (A): A Remote Access Trojan (RAT) is malicious software that allows an attacker to control a system remotely. While RATs can be used to gain unauthorized access to systems, they are typically not directly linked to the compromise of a corporate account through password reuse or exposure in a data breach.

Brute-force (B): Brute-force attacks involve systematically trying all possible combinations of passwords until the correct one is found. This method is less likely in this scenario because the attack did not involve trying many different passwords against a single account, but rather using a known compromised password across multiple accounts.

Dictionary (C): Dictionary attacks involve using a list of commonly used passwords or words from a dictionary to attempt to gain unauthorized access. This approach is similar to brute-force attacks but focuses on commonly used or easily guessable passwords. It does not directly fit the scenario where a specific compromised password is reused across accounts.

Credential stuffing (D): Credential stuffing involves using large sets of known username and password pairs to gain unauthorized access to accounts. It is typically used against a specific service or website, leveraging credentials obtained from previous data breaches. While similar in concept to password spraying, credential stuffing usually involves automated attempts against a single service, not multiple services.

In contrast, Password spraying specifically fits the scenario where the manager reused the same password across multiple accounts, including an external website that was breached. Attackers took advantage of this password reuse to gain unauthorized access to the manager’s corporate account, which aligns with the details provided in the scenario.

Therefore, E. Password spraying remains the most appropriate answer given the context provided in the question.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

An organization’s corporate offices were destroyed due to a natural disaster, so the organization is now setting up offices in a temporary work space. Which of the following will the organization most likely consult?

A. The business continuity plan
B. The risk management plan
C. The communication plan
D. The incident response plan

A

A. The business continuity plan

Business continuity plans (BCP) are designed to ensure that critical business functions can continue during and after a disaster or disruption. They typically include strategies for relocating operations to alternative facilities, maintaining essential services, and recovering from the disruption. Given that the organization needs to resume its operations in a temporary workspace after the destruction of its corporate offices, consulting the business continuity plan will provide guidance on how to maintain continuity and minimize the impact of the disaster on business operations.

The other options:

B. The risk management plan: While important for assessing and mitigating risks, it doesn't directly address the immediate need to resume operations after a disaster.
C. The communication plan: Important for internal and external communications during incidents, but doesn't address the overall operational recovery.
D. The incident response plan: Focuses on responding to and managing specific incidents as they occur, rather than on long-term operational continuity after a major disaster.

Therefore, A. The business continuity plan is the most appropriate plan for the organization to consult in this situation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Security analysts notice a server login from a user who has been on vacation for two weeks. The analysts confirm that the user did not log in to the system while on vacation. After reviewing packet capture logs, the analysts notice the following:

username : ….smithJA….
Password: 944d369d8880ed401b5ba2c77811

Which of the following occurred?

A. A buffer overflow was exploited to gain unauthorized access.
B. The user’s account was compromised, and an attacker changed the login credentials.
C. An attacker used a pass-the-hash attack to gain access.
D. An insider threat with username smithJA logged in to the account.

A

C. An attacker used a pass-the-hash attack to gain access.

Explanation:

Pass-the-hash attack: In this type of attack, an attacker captures the hashed version of a password and uses it to authenticate to a server without needing to know the actual plaintext password. The packet capture logs showing the password as a hash (944d369d8880ed401b5ba2c77811) suggest that the attacker used this hash to gain access.

Buffer overflow: This type of attack typically involves exploiting software vulnerabilities to execute arbitrary code or cause unintended behavior. The information given does not indicate a buffer overflow.

User account compromise: While the user's account was indeed compromised, there is no evidence from the packet capture logs that the login credentials were changed. The hash being used for authentication points more specifically to a pass-the-hash attack.

Insider threat: This would involve someone within the organization using the username smithJA to log in. The details suggest unauthorized external access rather than an insider threat, especially given the hash usage.

Therefore, the most likely scenario is a pass-the-hash attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

A security analyst is taking part in an evaluation process that analyzes and categorizes threat actors of real-world events in order to improve the incident response team’s process. Which of the following is the analyst most likely participating in?

A. MITRE ATT&CK
B. Walk-through
C. Red team
D. Purple team
E. TAXII

A

A. MITRE ATT&CK

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a knowledge base of adversary tactics and techniques based on real-world observations. It categorizes and describes various techniques used by threat actors during cyber attacks. Security analysts often use MITRE ATT&CK to understand and classify these tactics, which helps in improving incident response strategies and defenses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A network manager wants to protect the company’s VPN by multifactor authentication that uses:
Something you know
Something you have
Somewhere you are
Which of the following would accomplish the manager’s goal?

A. Domain name. PKI, GeoIP lookup
B. VPN IP address, company ID. partner site
C. Password, authentication token, thumbprint
D. Company URL, TLS certificate, home address

A

C. Password, authentication token, thumbprint

Explanation:

Password: Something you know.
Authentication token: Something you have.
Thumbprint: This could refer to biometric data like a fingerprint, which could be considered as part of "somewhere you are" if it implies physical presence (though this interpretation may vary).

Option C covers two out of the three factors explicitly mentioned (something you know and something you have). For the “somewhere you are” factor, typically GeoIP lookup or GPS location would be used, but it’s not directly covered in the provided options.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which of the following terms should be included in a contract to help a company monitor the ongoing security maturity of a new vendor?

A. A right-to-audit clause allowing for annual security audits
B. Requirements for event logs to be kept for a minimum of 30 days
C. Integration of threat intelligence in the company’s AV
D. A data-breach clause requiring disclosure of significant data loss

A

A. A right-to-audit clause allowing for annual security audits

Explanation:

A "right-to-audit" clause in a contract allows the company to conduct regular security audits of the vendor's systems and processes.
This helps the company monitor the ongoing security maturity of the vendor by assessing their adherence to security policies, procedures, and controls.
It ensures transparency and accountability in the vendor's security practices, which is crucial for maintaining trust and ensuring compliance with security standards.

Options B, C, and D are not directly related to monitoring the ongoing security maturity of the vendor. While they are important considerations for security in general, they do not specifically address the need to continuously assess and improve the vendor’s security posture over time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which of the following cloud models provides clients with servers, storage, and networks but nothing else?

A. SaaS
B. PaaS
C. IaaS
D. DaaS

A

C. IaaS

Explanation:

IaaS (Infrastructure as a Service) provides clients with virtualized computing resources over the internet. This includes servers, storage, and networking infrastructure, allowing clients to run their own applications, operating systems, and software.
With IaaS, clients are responsible for managing applications, data, runtime, middleware, and operating systems. The cloud provider manages the infrastructure components such as virtualization, servers, storage, and networking.
This model gives clients flexibility and control over their IT resources without the burden of managing physical hardware.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

A marketing coordinator is trying to access a social media application on a company laptop but is getting blocked. The coordinator opens a help desk ticket to report the issue. Which of the following documents should a security analyst review to determine whether accessing social media applications on a company device is permitted?

A. Incident response policy
B. Business continuity policy
C. Change management policy
D. Acceptable use policy

A

D. Acceptable use policy

Explanation:

An Acceptable Use Policy (AUP) outlines what is considered acceptable behavior by users of a company's IT resources, including computers, networks, and the internet.
AUPs typically define which applications and websites employees are allowed to access while using company-owned devices and networks.
Reviewing the AUP will help determine whether accessing social media applications on a company device is permitted or prohibited.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Law enforcement officials sent a company a notification that states electronically stored information and paper documents cannot be destroyed. Which of the following explains this process?

A. Data breach notification
B. Accountability
C. Legal hold
D. Chain of custody

A

C. Legal hold

Explanation:

Legal hold is a process in which an organization is instructed to preserve all relevant electronic and paper documents related to a legal matter or investigation.
This process ensures that potentially relevant information is not destroyed or altered, which could be critical in legal proceedings.
It is common for law enforcement or legal authorities to issue a legal hold notice to ensure preservation of evidence or information pertinent to an ongoing investigation or legal case.

Legal hold and chain of custody are both important concepts in the context of legal proceedings and investigations, but they serve different purposes:

Legal Hold:
    Purpose: Legal hold (also known as litigation hold or preservation order) is a directive issued to an organization to preserve all relevant documents and information related to a legal matter.
    Scope: It applies broadly to all potentially relevant electronic and paper documents, data, and information.
    Timing: It is typically issued at the onset of legal proceedings or when a legal matter is anticipated, requiring immediate action to prevent spoliation (destruction or alteration) of evidence.

Chain of Custody:
    Purpose: Chain of custody refers to the chronological documentation or paper trail that records the handling, transfer, and location of physical evidence or digital data during an investigation or legal proceeding.
    Scope: It specifically tracks the movement and possession of evidence from the moment it is collected until it is presented in court.
    Documentation: It includes detailed records of who had custody of the evidence, when and where it was transferred, and any actions taken while in possession.

Key Differences:

Focus: Legal hold focuses on the preservation of information and documents that might be relevant to a legal matter, ensuring they are not destroyed.
Documentation: Chain of custody focuses on documenting the handling and movement of physical evidence or digital data to maintain its integrity and admissibility in court.
Legal Implications: Legal hold is about compliance with legal directives to preserve information, while chain of custody ensures the integrity and reliability of evidence for legal proceedings.

In summary, legal hold ensures preservation of information, while chain of custody ensures the integrity and reliability of evidence used in legal proceedings. Both are crucial in different stages of handling legal matters and investigations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A company wants to deploy decoy systems alongside production systems in order to entice threat actors and to learn more about attackers. Which of the following best describes these systems?

A. DNS sinkholes
B. Honeypots
C. Virtual machines
D. Neural networks

A

B. Honeypots

Explanation:
Honeypots are decoy systems or resources intentionally deployed within a network to attract and deceive attackers. They appear to be legitimate systems but are isolated and monitored separately from production systems. The goal of honeypots is to gather information about attackers’ methods, tools, and motives without exposing critical infrastructure or data. This information can then be used to enhance threat intelligence and improve overall security posture by understanding potential attack vectors and vulnerabilities. Therefore, deploying honeypots aligns with the company’s objective to learn more about attackers while protecting their production systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

A company’s help desk received several AV alerts indicating Mimikatz attempted to run on the remote systems. Several users also reported that the new company flash drives they picked up in the break room only have 512KB of storage. Which of the following is most likely the cause?

A. The GPO prevents the use of flash drives, which triggers a false positive AV indication and restricts the drives to only 512KB of storage.

B. The new flash drives need a driver that is being blocked by the AV software because the flash drives are not on the application’s allow list, temporarily restricting the drives to 512KB of storage.

C. The new flash drives are incorrectly partitioned, and the systems are automatically trying to use an unapproved application to repartition the drives.

D. The GPO blocking the flash drives is being bypassed by a malicious flash drive that is attempting to harvest plaintext credentials from memory.

A

D. The GPO blocking the flash drives is being bypassed by a malicious flash drive that is attempting to harvest plaintext credentials from memory.

Explanation:
Mimikatz is a tool commonly used to extract plaintext passwords from memory. If users received new flash drives that are potentially malicious (not from the company or tampered with), they could be attempting to bypass Group Policy Object (GPO) restrictions and exploit vulnerabilities to gather sensitive information like plaintext credentials. This scenario aligns with the AV alerts indicating Mimikatz activity, suggesting a potential security breach involving unauthorized or compromised flash drives attempting to bypass security controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

A company has installed badge readers for building access but is finding unauthorized individuals roaming the hallways. Which of the following is the most likely cause?

A. Shoulder surfing
B. Phishing
C. Tailgating
D. Identity fraud

A

C. Tailgating

Explanation:
Tailgating refers to the practice of unauthorized individuals following closely behind an authorized person to gain entry into a restricted area. In this scenario, despite badge readers being in place for building access, unauthorized individuals are able to enter the premises by closely following behind authorized personnel as they pass through controlled entry points. This is a common physical security issue where the effectiveness of access controls like badge readers is undermined by individuals not properly verifying their own access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

An organization routes all of its traffic through a VPN. Most users are remote and connect into a corporate data center that houses confidential information. There is a firewall at the internet border, followed by a DLP appliance, the VPN server, and the data center itself. Which of the following is the weakest design element?

A. The DLP appliance should be integrated into a NGFW.
B. Split-tunnel connections can negatively impact the DLP appliance’s performance.
C. Encrypted VPN traffic will not be inspected when entering or leaving the network.
D. Adding two hops in the VPN tunnel may slow down remote connections.

A

C. Encrypted VPN traffic will not be inspected when entering or leaving the network.

Explanation:
In the given network design, the weakest element is that encrypted VPN traffic bypasses inspection by the DLP (Data Loss Prevention) appliance. VPNs typically encrypt traffic to secure it from eavesdropping and tampering, which is a security benefit. However, this encryption also prevents deep packet inspection (DPI) by devices like DLP appliances unless they are specifically configured to decrypt and inspect traffic, which can be complex and resource-intensive. This lack of inspection for encrypted VPN traffic means that potential data leaks or policy violations within the encrypted traffic may go undetected, weakening the overall security posture of the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which of the following is the best method for ensuring non-repudiation?

A. SSO
B. Digital certificate
C. Token
D. SSH key

A

B. Digital certificate

Non-repudiation ensures that a party cannot deny the authenticity or integrity of a message or transaction that they have sent or received. Digital certificates play a crucial role in achieving non-repudiation by providing a trusted means to verify the identity of the sender or recipient in electronic communications. When digital signatures are used, which rely on digital certificates, they provide strong evidence of who sent a message and that the message content has not been altered since it was signed. This helps to ensure non-repudiation in digital transactions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which of the following methods is the most effective for reducing vulnerabilities?

A. Joining an information-sharing organization
B. Using a scan-patch-scan process
C. Implementing a bug bounty program
D. Patching low-scoring vulnerabilities first

A

B. Using a scan-patch-scan process

Using a scan-patch-scan process is the most effective method for reducing vulnerabilities among the options provided. Here’s why:

Scan: Conducting regular vulnerability scans helps identify vulnerabilities in systems and applications.
Patch: Applying patches promptly to fix known vulnerabilities is crucial to prevent exploitation by attackers.
Scan again: After patching, conducting another scan ensures that the vulnerabilities have been effectively mitigated and no new issues have been introduced.

This process ensures a systematic approach to vulnerability management, reducing the window of opportunity for attackers to exploit known vulnerabilities. It is a proactive approach that focuses on maintaining the security posture of systems and networks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

An organization is struggling with scaling issues on its VPN concentrator and internet circuit due to remote work. The organization is looking for a software solution that will allow it to reduce traffic on the VPN and internet circuit, while still providing encrypted tunnel access to the data center and monitoring of remote employee internet traffic. Which of the following will help achieve these objectives?

A. Deploying a SASE solution to remote employees
B. Building a load-balanced VPN solution with redundant internet
C. Purchasing a low-cost SD-WAN solution for VPN traffic
D. Using a cloud provider to create additional VPN concentrators

A

(Community A 93%)

A. Deploying a SASE (Secure Access Service Edge) solution to remote employees

A SASE solution is designed to address the exact needs described in the scenario:

Reducing VPN and internet circuit traffic: SASE solutions can optimize traffic by routing it through the closest point of presence (PoP), reducing the load on the VPN concentrator and internet circuit.

Providing encrypted tunnel access: SASE solutions include built-in encryption and secure tunnels to ensure data remains protected during transit between remote employees and the data center.

Monitoring remote employee internet traffic: SASE solutions often include comprehensive visibility and monitoring capabilities, allowing organizations to monitor and manage internet traffic from remote employees effectively.

Therefore, deploying a SASE solution aligns well with the organization’s objectives of reducing VPN and internet circuit traffic while maintaining secure and monitored access for remote employees.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which of the following is the best reason to complete an audit in a banking environment?

A. Regulatory requirement
B. Organizational change
C. Self-assessment requirement
D. Service-level requirement

A

A. Regulatory requirement

In a banking environment, completing an audit is often driven by regulatory requirements. Banks are heavily regulated to ensure financial stability, protect customer data, and maintain compliance with industry standards and laws. Regulatory audits help ensure that banks adhere to these requirements, assess their internal controls, and verify the accuracy and integrity of financial reporting. Therefore, a regulatory requirement is typically the primary reason for conducting audits in banking environments.

22
Q

After a recent ransomware attack on a company’s system, an administrator reviewed the log files. Which of the following control types did the administrator use?

A. Compensating
B. Detective
C. Preventive
D. Corrective

A

B. Detective

In this scenario, the administrator reviewed log files after the ransomware attack. Detective controls are designed to detect and respond to security incidents and events as they occur. Reviewing log files after an attack falls under detective controls because it involves monitoring and analyzing system logs to identify signs of unauthorized access or malicious activities.

23
Q

A technician needs to apply a high-priority patch to a production system. Which of the following steps should be taken first?

A. Air gap the system.
B. Move the system to a different network segment.
C. Create a change control request.
D. Apply the patch to the system.

A

C. Create a change control request.

Before applying a high-priority patch to a production system, it is crucial to follow change management processes. Creating a change control request ensures that the patch deployment is documented, approved, and tracked according to organizational policies and procedures. This helps to mitigate risks associated with the patching process and ensures that appropriate stakeholders are informed and involved in the change management process. Therefore, creating a change control request is the first step that should be taken in this scenario.

24
Q

A security analyst reports a company policy violation in a case in which a large amount of sensitive data is being downloaded after hours from various mobile devices to an external site. Upon further investigation, the analyst notices that successful login attempts are being conducted with impossible travel times during the same time periods when the unauthorized downloads are occurring. The analyst also discovers a couple of WAPs are using the same SSID, but they have non-standard DHCP configurations and an overlapping channel. Which of the following attacks is being conducted?

A. Evil twin
B. Jamming
C. DNS poisoning
D. Bluesnarfing
E. DDoS

A

(Community : A 100%)
A. Evil twin

In this scenario, the presence of WAPs (Wireless Access Points) with the same SSID (Service Set Identifier) but with non-standard DHCP configurations and an overlapping channel suggests the possibility of an evil twin attack. An evil twin attack involves setting up a rogue wireless access point that mimics a legitimate network to trick users into connecting to it. Once connected, the attacker can intercept traffic, capture credentials, and perform other malicious activities, including unauthorized data transfers.

The impossible travel times during login attempts further indicate potential credential harvesting or unauthorized access, which aligns with the tactics used in an evil twin attack to steal credentials and access sensitive data.

Therefore, based on the information provided, the attack being conducted is most likely an evil twin attack.

25
Q

Several users have opened tickets with the help desk. The help desk has reassigned the tickets to a security analyst for further review. The security analyst reviews the following metrics:

Hostname Normal CPU Current CPU Normal network Current network
Utilization % Utilization % connections connections
Accounting-PC 22% 48% 12 66
HR-PC 35% 55% 15 57
IT-PC 78% 98% 25 92
Sales-PC 28% 50% 20 56
Manager-PC 21% 44% 18 49

Which of the following is most likely the result of the security analyst’s review?

A. The ISP is dropping outbound connections.
B. The user of the Sales-PC fell for a phishing attack
C. Corporate PCs have been turned into a botnet.
D. An on-path attack is taking place between PCs and the router.

A

C. Corporate PCs have been turned into a botnet.

Based on the metrics provided:

Normal CPU Utilization: Shows the typical CPU usage percentage.
Current CPU Utilization: Shows the current (potentially abnormal) CPU usage percentage.
Normal network connections: Shows the typical number of network connections.
Current network connections: Shows the current (potentially abnormal) number of network connections.

The IT-PC stands out with significantly higher current CPU utilization (98% compared to a normal of 78%) and a much higher number of current network connections (92 compared to a normal of 25). These metrics suggest that the IT-PC is exhibiting behavior indicative of being compromised or potentially participating in malicious activities, such as being part of a botnet.

Therefore, the most likely result of the security analyst’s review is:

C. Corporate PCs have been turned into a botnet.

This conclusion is drawn based on the abnormal metrics of the IT-PC, which indicate it may be under the control of malicious actors or compromised in some way, potentially being used as part of a botnet to conduct unauthorized activities.

26
Q

An engineer needs to deploy a security measure to identify and prevent data tampering within the enterprise. Which of the following will accomplish this goal?

A. Antivirus
B. IPS
C. FTP
D. FIM

A

D. FIM (File Integrity Monitoring)

File Integrity Monitoring (FIM) tools are designed to monitor and detect changes to files and directories. They maintain a record of file attributes and alert administrators to unauthorized modifications, ensuring the integrity of critical system and data files. This helps in identifying any tampering or unauthorized changes to files within the enterprise environment.

Let’s break down the other options in the context of identifying and preventing data tampering:

A. Antivirus (AV):
Antivirus software is primarily designed to detect and remove malicious software (malware) such as viruses, worms, and Trojans. While it can prevent certain types of data tampering by detecting malware that modifies files, its primary focus is on detecting and mitigating malware threats rather than detecting unauthorized changes to data itself.

B. IPS (Intrusion Prevention System):
An IPS is designed to monitor network traffic and detect/prevent potential intrusions or attacks based on predefined signatures or behavior anomalies. While it can help prevent unauthorized access and protect against some types of network-based attacks, its role is more focused on network security rather than detecting data tampering specifically.

C. FTP (File Transfer Protocol):
FTP is a protocol used for transferring files over a network. While it facilitates data transfer, it does not inherently provide mechanisms for detecting or preventing data tampering. FTP itself is a method of data exchange rather than a security measure designed to protect against tampering.

Therefore, among the options provided, FIM (File Integrity Monitoring) remains the most appropriate choice specifically for identifying and preventing data tampering within the enterprise environment.

27
Q

Which of the following mitigation techniques places devices in physically or logically separated networks and leverages policies to limit the types of communications that are allowed?

A. Host-based firewalls
B. Access control list
C. Port security
D. Least privilege

A

B. Access control list

Explanation:

Access control lists (ACLs) are used to enforce network segmentation by placing devices in physically or logically separated networks (segments or VLANs) and controlling the types of communications allowed between them. ACLs are typically configured on routers, switches, or firewalls and specify which IP addresses, protocols, and ports are permitted or denied to pass through a network interface. This helps limit the scope of communications and restrict unauthorized access between different segments of the network, thereby enhancing network security.

let’s review the other choices:

A. Host-based firewalls:

Host-based firewalls operate at the individual device level, not at the network level. They control incoming and outgoing traffic to and from the device they are installed on, based on predefined rules. While they can provide some level of isolation and protection for the device they are installed on, they do not directly address network segmentation.

C. Port security:

Port security refers to measures taken to limit and control access to network switch ports. It involves configuring switches to allow only specific MAC addresses to access the network through certain ports. Port security focuses on preventing unauthorized devices from connecting to the network via physical switch ports, but it does not inherently provide network segmentation or control over communications between logically separated networks.

D. Least privilege:

Least privilege principle refers to granting users or processes only the minimum privileges necessary to perform their tasks. While it is a fundamental security principle for access control, it pertains more to user and process permissions rather than network segmentation or controlling communications between networks.

(Braindump: A. Host-based firewalls)

28
Q

All security analysts’ workstations at a company have network access to a critical server VLAN. The information security manager wants to further enhance the controls by requiring that all access to the secure VLAN be authorized only from a given single location. Which of the following will the information security manager most likely implement?

A. A forward proxy server
B. A jump server
C. A reverse proxy server
D. A stateful firewall server

A

B. A jump server
Explanation:

Jump Server:
    A jump server (or jump box) is a dedicated device through which access to the secure VLAN is funneled. Analysts must first connect to the jump server, which then provides controlled and logged access to the critical server VLAN. This ensures that all access comes from a single, controlled point, enhancing security and providing better monitoring and auditing capabilities.

Why Not the Other Options?

A. Forward Proxy Server:
    A forward proxy server is typically used to forward client requests to the internet or external networks and often for purposes like caching, content filtering, and anonymity. It is not designed to control access to a specific internal network segment.

C. Reverse Proxy Server:
    A reverse proxy server sits in front of web servers to intercept requests from clients and forward them to the appropriate backend server. It helps with load balancing, security, and caching for web applications, but it is not suited for controlling access from internal workstations to a secure VLAN.

D. Stateful Firewall Server:
    A stateful firewall server can control access based on IP addresses, ports, and protocols and keep track of the state of active connections. While it enhances security, it does not enforce access from a single location. It is more about controlling types of traffic and monitoring connections rather than ensuring a single point of entry.

In summary, a jump server is specifically designed to act as a single access point for connecting to more secure or restricted network segments, making it the best choice for this scenario.

29
Q

Which of the following best describes why a company would erase a newly purchased device and install its own image with an operating system and applications?

A. Installing a new operating system thoroughly tests the equipment
B. Removing unneeded applications reduces the system’s attack surface
C. Reimaging a system creates an updated baseline of the computer image
D. Wiping the device allows the company to evaluate its performance

A

B. Removing unneeded applications reduces the system’s attack surface
Explanation:

Reducing Attack Surface:
    When a company erases a newly purchased device and installs its own image, the primary goal is often to ensure that only the necessary applications and configurations are present. This process eliminates pre-installed software (often called bloatware) and other unnecessary applications that could introduce vulnerabilities or be exploited by attackers. By minimizing the number of applications and services running on the device, the overall attack surface is reduced, enhancing security.

Why Not the Other Options?

A. Installing a new operating system thoroughly tests the equipment:
    While installing a new operating system might help test the equipment to some extent, it is not the primary reason for erasing and reimaging a device. The main goal is to ensure security and consistency.

C. Reimaging a system creates an updated baseline of the computer image:
    Although reimaging can help establish a consistent and updated baseline, the primary reason is still to remove unnecessary applications and potential security risks, thereby reducing the attack surface.

D. Wiping the device allows the company to evaluate its performance:
    Evaluating performance is not typically the main reason for reimaging a device. The focus is on security, control, and ensuring the device conforms to the company’s standards and policies.

In summary, the best reason a company would erase a newly purchased device and install its own image is to reduce the system’s attack surface by removing unneeded applications.

30
Q

A backdoor was detected on the containerized application environment. The investigation detected that a zero-day vulnerability was introduced when the latest container image version was downloaded from a publicregistry. Which of the following is the best solution to prevent this type of incident from occurring again?

A. Enforce the use of a controlled trusted source of container images.
B. Deploy an IPS solution capable of detecting signatures of attacks targeting containers.
C. Define a vulnerability scan to assess container images before being introduced on the environment.
D. Create a dedicated VPC for the containerized environment.

A

A. Enforce the use of a controlled trusted source of container images.
Explanation:

Controlled Trusted Source:
    By enforcing the use of a controlled and trusted source of container images, the organization can ensure that all container images are vetted and verified before they are used in the production environment. This significantly reduces the risk of introducing zero-day vulnerabilities or malicious backdoors that might be present in images from untrusted public registries.

Why Not the Other Options?

B. Deploy an IPS solution capable of detecting signatures of attacks targeting containers:
    While deploying an Intrusion Prevention System (IPS) can help detect and prevent known attacks, it may not be effective against zero-day vulnerabilities for which signatures do not yet exist. Additionally, it does not address the root cause of the issue—using untrusted container images.

C. Define a vulnerability scan to assess container images before being introduced on the environment:
    Defining and running vulnerability scans on container images is an important step, but it may not catch all zero-day vulnerabilities, as these are unknown at the time of scanning. While useful, this approach alone is insufficient without ensuring the images come from a trusted source.

D. Create a dedicated VPC for the containerized environment:
    Creating a dedicated Virtual Private Cloud (VPC) can help isolate the containerized environment and improve security, but it does not prevent the introduction of vulnerabilities through untrusted container images. It is more of a network segmentation strategy rather than a solution to the root cause.

In summary, enforcing the use of a controlled trusted source of container images is the best solution to prevent the introduction of zero-day vulnerabilities from untrusted public registries, addressing the root cause of the problem.

31
Q

An external forensics investigator has been hired to investigate a data breach at a large enterprise with numerous assets. It is known that the breach started in the perimeter network and moved to the sensitive information, generating multiple logs as the attacker traversed through the network. Which of the following will best assist with this investigation?

A. Perform a vulnerability scan to identify the weak spots.
B. Use a packet analyzer to investigate the NetFlow traffic.
C. Check the SIEM to review the correlated logs.
D. Require access to the routers to view current sessions.

A

C. Check the SIEM to review the correlated logs.
Explanation:

Security Information and Event Management (SIEM):
    A SIEM system collects, correlates, and analyzes logs from various sources across the network. This provides a comprehensive view of the activities and events that occurred during the breach. By reviewing the correlated logs, the investigator can trace the attacker's steps, identify patterns, and understand how the breach propagated through the network. This holistic view is crucial for understanding the full scope of the breach and identifying the affected assets.

Why Not the Other Options?

A. Perform a vulnerability scan to identify the weak spots:
    While a vulnerability scan can identify potential weaknesses in the network, it does not provide the historical data needed to investigate how the breach occurred or trace the attacker's movements.

B. Use a packet analyzer to investigate the NetFlow traffic:
    A packet analyzer can provide detailed information about network traffic, but it may be overwhelming to analyze large volumes of traffic data without the context provided by correlated logs. It is more useful for specific traffic analysis rather than understanding the overall breach.

D. Require access to the routers to view current sessions:
    Viewing current sessions on routers can provide information about ongoing connections, but it does not help in understanding the historical context of the breach. It also does not provide a comprehensive view of the attacker's activities throughout the network.

In summary, checking the SIEM to review the correlated logs is the best approach for a comprehensive investigation of the data breach, as it provides a detailed and correlated view of the attacker’s activities across the network.

32
Q

A Chief Information Security Officer (CISO) needs to create a policy set that meets international standards for data privacy and sharing. Which of the following should the CISO read and understand before writing the policies?

A. PCI DSS
B. GDPR
C. NIST
D. ISO 31000

A

B. GDPR
Explanation:

General Data Protection Regulation (GDPR):
    GDPR is a comprehensive data protection regulation enacted by the European Union that sets standards for data privacy and protection for individuals within the EU. It also addresses the export of personal data outside the EU. Given its international impact and stringent requirements for data privacy and sharing, it is crucial for the CISO to understand GDPR when creating policies that meet international standards for data privacy.

Why Not the Other Options?

A. PCI DSS:
    The Payment Card Industry Data Security Standard (PCI DSS) is focused on securing credit card transactions and protecting cardholder data. While important for financial data security, it is not as broad in scope as GDPR regarding overall data privacy and sharing.

C. NIST:
    The National Institute of Standards and Technology (NIST) provides a cybersecurity framework and guidelines primarily used within the United States. While useful for developing cybersecurity policies, it does not specifically address international data privacy laws like GDPR.

D. ISO 31000:
    ISO 31000 is a standard for risk management and provides guidelines for risk management processes. It is not specifically focused on data privacy and protection standards.

In summary, understanding GDPR is essential for the CISO to create a policy set that aligns with international standards for data privacy and sharing.

33
Q

During an internal penetration test, a security analyst identified a network device that had accepted cleartext authentication and was configured with a default credential. Which of the following recommendations should the security analyst make to secure this device?

A. Configure SNMPv1.
B. Configure SNMPv2c.
C. Configure SNMPv3.
D. Configure the default community string.

A

C. Configure SNMPv3.
Explanation:

SNMPv3 (Simple Network Management Protocol version 3):
    SNMPv3 provides enhanced security features, including encryption and authentication, to protect data being transmitted and to ensure that only authorized users can access the SNMP data. By configuring SNMPv3, the security analyst can secure the device against cleartext authentication and ensure that default credentials are no longer a security risk.

Why Not the Other Options?

A. Configure SNMPv1:
    SNMPv1 does not support encryption or authentication, and all data, including credentials, is transmitted in cleartext. This does not address the security issues identified.

B. Configure SNMPv2c:
    SNMPv2c offers some improvements over SNMPv1 but still lacks robust security features like encryption and proper authentication. It also transmits data, including credentials, in cleartext.

D. Configure the default community string:
    Changing the default community string can help improve security but does not address the issue of cleartext authentication. It is a partial measure and not as secure as implementing SNMPv3.

In summary, configuring SNMPv3 is the best recommendation to secure the device as it provides encryption and authentication features that protect against cleartext authentication and the use of default credentials.

34
Q

Developers are writing code and merging it into shared repositories several times a day, where it is tested automatically. Which of the following concepts does this best represent?

A. Functional testing
B. Stored procedures
C. Elasticity
D. Continuous integration

A

D. Continuous integration
Explanation:

Continuous Integration (CI):
    CI is a software development practice where developers frequently integrate their code changes into a shared repository. Each integration is automatically verified by building the application and running tests to detect errors as quickly as possible. This practice aims to improve software quality and reduce the time taken to deliver new software updates.

Why Not the Other Options?

A. Functional testing:
    Functional testing involves testing the functionality of the software to ensure it behaves as expected. While functional tests may be part of the CI process, they do not encompass the entire concept of continuously integrating code.

B. Stored procedures:
    Stored procedures are precompiled collections of SQL statements stored in a database. They are used for database operations but are not related to the practice of integrating and testing code frequently.

C. Elasticity:
    Elasticity refers to the ability of a system to dynamically adjust its resources to handle varying loads, often in the context of cloud computing. It is not related to the practice of continuous integration in software development.

In summary, the practice of developers writing code and merging it into shared repositories several times a day, where it is tested automatically, best represents continuous integration.

35
Q

A large financial services firm recently released information regarding a security breach within its corporate network that began several years before. During the time frame in which the breach occurred, indicators show an attacker gained administrative access to the network through a file downloaded from a social media site and subsequently installed it without the user’s knowledge. Since the compromise, the attacker was able to take command and control of the computer systems anonymously while obtaining sensitive corporate and personal employee information. Which of the following methods did the attacker most likely use to gain access?

A. A bot
B. A fileless virus
C. A logic bomb
D. A RAT

A

D. A RAT
Explanation:

Remote Access Trojan (RAT):
    A RAT is a type of malware that gives the attacker full control over the infected computer. It often remains undetected and can perform a variety of tasks, such as stealing information, installing other malware, and controlling the system remotely. In this scenario, the attacker gaining administrative access, taking command and control of the systems, and obtaining sensitive information fits the behavior of a RAT.

Why Not the Other Options?

A. A bot:
    A bot is typically part of a botnet and is used for tasks like DDoS attacks, spamming, or mining cryptocurrencies. While a bot can perform some malicious activities, it doesn't fully explain the detailed control and information theft described in the scenario.

B. A fileless virus:
    A fileless virus operates in memory and doesn't leave traditional footprints on the file system, making it hard to detect. While it could have been used to gain initial access, the detailed and prolonged control over systems described in the scenario is more characteristic of a RAT.

C. A logic bomb:
    A logic bomb is a piece of code intentionally inserted into a software system that will set off a malicious function when certain conditions are met. Logic bombs are typically used for specific timed attacks or when certain conditions are met, but they do not provide ongoing control over a system.

In summary, the prolonged, detailed control over the systems and the ability to steal sensitive information as described in the scenario are most characteristic of a Remote Access Trojan (RAT).

36
Q

Recent changes to a company’s BYOD policy require all personal mobile devices to use a two-factor authentication method that is not something you know or have. Which of the following will meet this requirement?

A. Facial recognition
B. Six-digit PIN
C. PKI certificate
D. Smart card

A

A. Facial recognition
Explanation:

Facial recognition:
    This is a biometric authentication method that relies on something you are (your face) rather than something you know (like a PIN) or something you have (like a smart card or PKI certificate). It fits the requirement for a two-factor authentication method that is neither something you know nor something you have.

Why Not the Other Options?

B. Six-digit PIN:
    A PIN is something you know, which does not meet the requirement.

C. PKI certificate:
    A PKI certificate is something you have, which does not meet the requirement.

D. Smart card:
    A smart card is also something you have, which does not meet the requirement.

In summary, facial recognition is the only option that fits the requirement for a two-factor authentication method that is neither something you know nor something you have, as it relies on biometric data (something you are).

37
Q

A critical file server is being upgraded, and the systems administrator must determine which RAID level the new server will need to achieve parity and handle two simultaneous disk failures. Which of the following RAID levels meets this requirement?

A. RAID 0+1
B. RAID 2
C. RAID 5
D. RAID 6

A

D. RAID 6
Explanation:

RAID 6 is designed to provide redundancy that can withstand the failure of up to two disk drives simultaneously.
In RAID 6, data is striped across multiple drives, and parity information is distributed across all drives.
This allows for recovery from the failure of any two drives without data loss.
RAID 6 requires a minimum of four drives and uses two parity blocks per stripe.

Why Not the Other Options?

RAID 0+1 (RAID 10):
    RAID 0+1 combines features of RAID 0 (striping) and RAID 1 (mirroring).
    It can handle the failure of a single drive in each mirrored pair but not two simultaneous failures in different pairs.

RAID 2:
    RAID 2 uses Hamming code for error correction but is rarely used due to its complexity and lack of practical application in modern systems.

RAID 5:
    RAID 5 stripes data across multiple drives and uses parity to provide fault tolerance.
    It can handle the failure of one drive without data loss but is vulnerable to data loss if two drives fail simultaneously during rebuild.

Therefore, RAID 6 is the appropriate choice when the requirement is to achieve parity and handle two simultaneous disk failures with redundancy and data protection.

38
Q

A company must ensure sensitive data at rest is rendered unreadable. Which of the following will the company most likely use?

A. Hashing
B. Tokenization
C. Encryption
D. Segmentation

A

C. Encryption

Encryption is the process of encoding data in such a way that only authorized parties can access it. It is commonly used to ensure that sensitive data at rest (stored data) remains unreadable to unauthorized users or attackers who might gain access to the storage medium. Here’s why encryption fits the requirement:

Encryption transforms plaintext (readable data) into ciphertext (unreadable data) using an algorithm and a cryptographic key.
Authorized users with the correct decryption key can reverse the encryption process to access the original plaintext data.
It provides strong protection against unauthorized access, ensuring that even if data storage is compromised, the encrypted data remains secure.

Why Not the Other Options?

Hashing (Option A): Hashing is a one-way process that generates a fixed-size string (hash value) from input data. It is used primarily for data integrity verification and does not provide a way to reverse the process to retrieve the original data. Therefore, it does not render data unreadable but rather validates data integrity.

Tokenization (Option B): Tokenization substitutes sensitive data with a non-sensitive placeholder (token). Tokens are typically mapped to sensitive data stored in a secure vault or database. While it enhances security by reducing exposure of sensitive data, it is not primarily used to render data unreadable in storage but rather during transmission or processing.

Segmentation (Option D): Segmentation refers to dividing a network into smaller segments to reduce traffic congestion and improve security management. It does not directly apply to rendering data at rest unreadable.

Therefore, encryption is the method most suitable for ensuring that sensitive data at rest remains unreadable to unauthorized individuals or entities.

39
Q

A security assessment found that several embedded systems are running unsecure protocols. These systems were purchased two years ago, and the company that developed them is no longer in business. Which of the following constraints best describes the reason the findings cannot be remediated?

A. Inability to authenticate
B. Implied trust
C. Lack of computing power
D. Unavailable patch

A

D. Unavailable patch

The reason the findings cannot be remediated in this scenario is due to the unavailability of patches. Since the company that developed the embedded systems is no longer in business:

Patches are updates or fixes provided by software vendors to address security vulnerabilities or bugs in their products.
Without the original vendor's support or availability, there will be no new patches or updates released for the embedded systems.
As a result, any security vulnerabilities identified in these systems that require patches to fix cannot be addressed, leaving them exposed to potential exploitation.

Why Not the Other Options?

Inability to authenticate (Option A): This typically refers to issues related to verifying the identity of users or systems. While authentication may be a concern, it does not directly prevent the application of security patches.

Implied trust (Option B): Implied trust relates to assumptions made about the trustworthiness of systems or entities. It does not directly relate to the inability to apply patches due to vendor unavailability.

Lack of computing power (Option C): This constraint refers to insufficient hardware resources to perform certain tasks. While it can be a limitation, it does not prevent the installation of patches if they were available.

Therefore, unavailable patch (Option D) is the most relevant constraint in this scenario, as it directly addresses the inability to remediate security vulnerabilities in the embedded systems due to the absence of support from the original vendor.

40
Q

A security engineer is concerned about using an agent on devices that relies completely on defined known-bad signatures. The security engineer wants to implement a tool with multiple components including the ability to track, analyze, and monitor devices without reliance on definitions alone. Which of the following solutions best fits this use case?

A. EDR
B. DLP
C. NGFW
D. HIPS

A

A. EDR (Endpoint Detection and Response)

EDR (Endpoint Detection and Response) solutions are designed to provide continuous monitoring, analysis, and response capabilities on endpoints. They go beyond traditional antivirus solutions that rely on known-bad signatures by offering:

Behavioral analysis: EDR solutions monitor endpoint behavior in real-time to detect suspicious activities and anomalies.

Endpoint visibility: They provide detailed visibility into endpoint activities, processes, and network connections.

Threat hunting: EDR allows security teams to proactively search for indicators of compromise (IOCs) and potential threats across endpoints.

Response capabilities: EDR platforms often include response features such as quarantine, containment, and automated response actions to mitigate threats.

In contrast to solutions like DLP (Data Loss Prevention), NGFW (Next-Generation Firewall), and HIPS (Host-based Intrusion Prevention System), EDR is specifically tailored to monitor and respond to endpoint security incidents based on behavior and context rather than relying solely on predefined signatures of known threats. Therefore, for the described use case where the security engineer wants a solution that tracks, analyzes, and monitors devices without relying solely on known-bad signatures, EDR would be the most suitable choice.

41
Q

A user’s login credentials were recently compromised. During the investigation, the security analyst determined the user input credentials into a pop-up window when prompted to confirm the username and password. However, the trusted website does not use a pop-up for entering user credentials. Which of the following attacks occurred?

A. Cross-site scripting
B. SQL injection
C. DNS poisoning
D. Certificate forgery

A

A. Cross-site scripting (XSS)

Here’s why:

Cross-site scripting (XSS) involves injecting malicious scripts into web pages viewed by other users. One common form of XSS is when an attacker injects scripts into a legitimate website, which then prompts users to enter their credentials into a fake pop-up window.

In this scenario, the user was prompted to input credentials into a pop-up window, but the legitimate website does not use such pop-ups for credential input. This indicates that an attacker likely injected a malicious script (via XSS) into the website to trick users into disclosing their login credentials.

SQL injection (B) involves inserting SQL code into a form field to manipulate the database. It doesn't directly involve prompting users with fake login prompts.

DNS poisoning (C) involves corrupting the DNS cache to redirect domain name queries to malicious sites, not directly related to the description.

Certificate forgery (D) involves creating fake digital certificates to impersonate a legitimate website, not directly related to the described scenario.

Therefore, based on the given details, Cross-site scripting (XSS) is the most appropriate answer.

42
Q

To reduce costs and overhead, an organization wants to move from an on-premises email solution to a cloud-based email solution. At this time, no other services will be moving. Which of the following cloud models would best meet the needs of the organization?

A. MaaS
B. IaaS
C. SaaS
D. PaaS

A

C. SaaS (Software as a Service)

Explanation:

SaaS (Software as a Service) provides software applications delivered over the internet, usually on a subscription basis. In this case, the organization can subscribe to a cloud-based email service where the email application is hosted and managed by the service provider.
SaaS eliminates the need for the organization to manage and maintain email servers, reducing costs associated with hardware, software licenses, and IT staff overhead.
With SaaS, the organization can access the email service from anywhere via the internet, benefiting from scalability, reliability, and typically lower upfront costs compared to on-premises solutions.

Other options:

MaaS (Monitoring as a Service) typically refers to cloud-based monitoring services, not relevant for email services.
IaaS (Infrastructure as a Service) provides virtualized computing resources over the internet, such as virtual machines and storage. It does not focus on delivering software applications like email services.
PaaS (Platform as a Service) provides a platform allowing customers to develop, run, and manage applications without the complexity of building and maintaining the underlying infrastructure. While it could potentially host custom applications including email services, it's not specifically tailored for standalone email solutions like SaaS.

Therefore, SaaS is the most appropriate choice for the organization’s need to migrate to a cloud-based email solution while reducing costs and overhead.

43
Q

A software development manager wants to ensure the authenticity of the code created by the company. Which of the following options is the most appropriate?

A. Testing input validation on the user input fields
B. Performing code signing on company-developed software
C. Performing static code analysis on the software
D. Ensuring secure cookies are used

A

B. Performing code signing on company-developed software

Here’s why:

Code Signing: Code signing involves digitally signing software to confirm its authenticity and integrity. It provides a way for users and systems to verify that the software they are installing or executing comes from a trusted source and has not been tampered with since it was signed.

Authenticity Assurance: By using code signing, the software development manager can ensure that the code produced by the company is authenticated. This helps in building trust with users and customers who rely on the software.

Security and Integrity: Code signing helps in verifying that the code has not been altered or compromised during distribution or deployment. This is crucial for maintaining the integrity of the software and protecting against unauthorized modifications.

While options like testing input validation (A), performing static code analysis (C), and ensuring secure cookies (D) are important security practices, they do not directly address the issue of code authenticity as effectively as code signing (option B) does.

44
Q

An organization is having difficulty correlating events from its individual AV, EDR, DLP, SWG, WAF, MDM, HIPS, and CASB systems. Which of the following is the best way to improve the situation?

A. Remove expensive systems that generate few alerts.
B. Modify the systems to alert only on critical issues.
C. Utilize a SIEM to centralize logs and dashboards.
D. Implement a new syslog/NetFlow appliance.

A

C. Utilize a SIEM to centralize logs and dashboards.

Here’s why:

SIEM (Security Information and Event Management): A SIEM system is designed to centralize the collection, normalization, correlation, and analysis of security-related data from various sources. It aggregates logs and events from disparate systems into a single platform, providing a unified view of the organization's security posture.

Correlation and Analysis: SIEM systems use correlation rules and algorithms to detect patterns and anomalies across different logs and events. This enables security teams to identify potential security incidents or threats that may span multiple systems.

Centralized Management: By using a SIEM, organizations can streamline their incident detection and response processes. Security analysts can investigate incidents more efficiently with centralized dashboards and tools for monitoring and managing security events.

Option A (removing expensive systems that generate few alerts) and option B (modifying systems to alert only on critical issues) may not be ideal because they could overlook important security events that don’t meet the predefined criteria. Option D (implementing a new syslog/NetFlow appliance) addresses part of the issue by improving log collection, but it doesn’t provide the advanced correlation and analysis capabilities offered by a SIEM.

Therefore, option C (utilizing a SIEM to centralize logs and dashboards) is the most effective solution for improving the correlation of events across multiple security systems in the organization.

45
Q

A company’s end users are reporting that they are unable to reach external websites. After reviewing the performance data for the DNS severs, the analyst discovers that the CPU, disk, and memory usage are minimal, but the network interface is flooded with inbound traffic. Network logs show only a small number of DNS queries sent to this server. Which of the following best describes what the security analyst is seeing?

A. Concurrent session usage
B. Secure DNS cryptographic downgrade
C. On-path resource consumption
D. Reflected denial of service

A

D. Reflected denial of service

Here’s why:

Reflected Denial of Service (DDoS): This occurs when an attacker sends requests to a server with a spoofed source IP address, making it appear that the requests are coming from the victim's IP address. The server then responds to these requests, sending large amounts of data to the victim's IP address, overwhelming their network connection.

Symptoms Matching: In this scenario, the DNS server is experiencing inbound traffic flooding its network interface, despite minimal DNS queries being sent to it. This mismatch indicates that the server is likely being used as an amplifier in a DDoS attack. The server is responding to spoofed requests that appear to originate from the victim's network, thereby flooding the victim's network interface with unwanted traffic.

Other Options Considered: Concurrent session usage (option A) typically refers to the number of active sessions or connections, which doesn't fit the described scenario. Secure DNS cryptographic downgrade (option B) and on-path resource consumption (option C) are not directly related to the symptoms of a flooded network interface due to DDoS.

Therefore, option D (Reflected denial of service) best describes the situation where the DNS server is flooded with inbound traffic due to being used as an unwitting amplifier in a DDoS attack.

46
Q

An audit identified PII being utilized in the development environment of a critical application. The Chief Privacy Officer (CPO) is adamant that this data must be removed; however, the developers are concerned that without real data they cannot perform functionality tests and search for specific data. Which of the following should a security professional implement to best satisfy both the CPO’s and the development team’s requirements?

A. Data purge
B. Data encryption
C. Data masking
D. Data tokenization

A

(Community C 59%, B 32%)

C. Data masking

Here’s why data masking is the most appropriate solution:

Data Masking: This technique involves transforming sensitive data within the development environment so that it is anonymized or obfuscated. This allows the development team to work with realistic data for testing and debugging purposes while ensuring that the actual PII is not exposed or used inappropriately.

Balancing Privacy and Functionality: Data masking strikes a balance by protecting sensitive information (in this case, PII) while still providing developers with data that resembles real-world scenarios. This enables them to adequately test functionality, simulate user interactions, and troubleshoot issues without compromising privacy or violating regulations.

Compliance and Security: By implementing data masking, the organization can comply with privacy regulations (such as GDPR, CCPA) and internal privacy policies enforced by the CPO, while also maintaining data security in the development environment.

While options like data purge (option A) and data encryption (option B) focus on removing or securing data, they may not allow the development team to continue their necessary testing activities effectively. Data tokenization (option D), while useful for securing sensitive data by replacing it with non-sensitive tokens, might not provide realistic test data that developers require.

Therefore, option C (Data masking) is the best choice to ensure both compliance with privacy requirements and support for development activities in the presence of sensitive PII data.

47
Q

A security analyst is investigating a malware incident at a company. The malware is accessing a command-and-control website at www.comptia.com. All outbound Internet traffic is logged to a syslog server and stored in /logfiles/messages. Which of the following commands would be best for the analyst to use on the syslog server to search for recent traffic to the command-and-control website?

A. head -500 www.comptia.com | grep /logfiles/messages
B. cat /logfiles/messages | tail -500 www.comptia.com
C. tail -500 /logfiles/messages | grep www.comptia.com
D. grep -500 /logfiles/messages | cat www.comptia.com

A

C. tail -500 /logfiles/messages | grep www.comptia.com

Here’s why:

tail -500 /logfiles/messages: This command will retrieve the last 500 lines from the file /logfiles/messages, which contains the outbound Internet traffic logs.

grep www.comptia.com: The grep command is used to search for occurrences of the string www.comptia.com within the output obtained from tail. This will filter out and display only the lines that contain references to www.comptia.com, which in this case, would indicate outbound connections to the command-and-control website.

Let’s briefly discuss why the other options are not correct:

Option A: head -500 www.comptia.com | grep /logfiles/messages
    This command attempts to search the first 500 lines of a file named www.comptia.com and then grep for /logfiles/messages, which is not relevant to searching log files for traffic to www.comptia.com.

Option B: cat /logfiles/messages | tail -500 www.comptia.com
    This command would attempt to retrieve the last 500 lines from the www.comptia.com file, which is not the log file where the traffic data is stored.

Option D: grep -500 /logfiles/messages | cat www.comptia.com
    This command is syntactically incorrect and does not perform the intended search on the syslog file /logfiles/messages.

Therefore, option C is the correct choice as it effectively retrieves the recent log entries related to outbound traffic to www.comptia.com from the syslog file /logfiles/messages.

48
Q

A systems administrator set up an automated process that checks for vulnerabilities across the entire environment every morning. Which of the following activities is the systems administrator conducting?

A. Scanning
B. Alerting
C. Reporting
D. Archiving

A

A. Scanning

Here’s why:

Scanning: This refers to the process of systematically checking for vulnerabilities, weaknesses, or potential threats within a system or network. In this case, the automated process is designed to scan the entire environment regularly, likely using vulnerability scanning tools or scripts.

Automated Process: By automating the scanning process to run every morning, the systems administrator ensures that potential vulnerabilities are identified promptly and consistently.

Options like alerting (option B), reporting (option C), and archiving (option D) are related activities but do not directly describe the primary action of actively checking for vulnerabilities. Alerting involves notifying stakeholders of detected issues, reporting involves summarizing findings, and archiving involves storing data for future reference, none of which directly perform the initial act of scanning for vulnerabilities.

Therefore, option A (Scanning) best describes the activity conducted by the systems administrator in this scenario.

49
Q

An engineer is setting up a VDI environment for a factory location, and the business wants to deploy a low-cost solution to enable users on the shop floor to log in to the VDI environment directly. Which of the following should the engineer select to meet these requirements?

A. Laptops
B. Containers
C. Thin clients
D. Workstations

A

C. Thin clients

Here’s why thin clients are suitable for this scenario:

Cost-Effective: Thin clients are typically less expensive than traditional desktops or laptops. They are designed to connect to a centralized VDI infrastructure where the actual computing is done on servers rather than locally on the client device. This reduces the hardware cost per user.

VDI Compatibility: Thin clients are specifically built to work with VDI environments. They have minimal local processing power and storage because most computing tasks are handled by the VDI servers. This makes them ideal for deploying a VDI solution in a cost-effective manner.

Shop Floor Environment: In factory locations, there might be environmental factors such as dust, temperature variations, and physical hazards that could potentially damage or affect traditional desktops or laptops. Thin clients, being simpler and more robust with fewer moving parts, are often more durable in such environments.

Options like laptops (option A) and workstations (option D) are typically more expensive and may not be necessary if the primary requirement is to access the VDI environment. Containers (option B) are a different technology used for application deployment and management, not for providing access to a VDI environment.

Therefore, option C (Thin clients) is the most appropriate choice for deploying a low-cost solution to enable users on the shop floor to log in to the VDI environment directly.

50
Q

A systems administrator receives the following alert from a file integrity monitoring tool:
The hash of the cmd.exe file has changed.
The systems administrator checks the OS logs and notices that no patches were applied in the last two months.
Which of the following most likely occurred?

A. The end user changed the file permissions.
B. A cryptographic collision was detected.
C. A snapshot of the file system was taken.
D. A rootkit was deployed.

A

D. A rootkit was deployed.

Here’s why:

File Integrity Change: File integrity monitoring tools are designed to detect unauthorized changes to critical system files, such as cmd.exe. A sudden change in the hash of a system file like cmd.exe indicates that the file has been altered.

No Patch Activity: Since no patches were applied recently, a legitimate update to cmd.exe through official channels (such as Windows Update) is unlikely. Therefore, the change in the file's hash is not due to a standard update process.

Rootkit Deployment: Rootkits are malicious software that are specifically designed to conceal their presence and activities on a system. They often replace or modify critical system files like cmd.exe to maintain stealth and control over the compromised system.

Options like the end user changing file permissions (option A), a cryptographic collision (option B), or a snapshot of the file system being taken (option C) are less likely explanations in this context. File permissions changes by end users typically do not alter the hash of system files like cmd.exe. Cryptographic collisions are extremely rare and not typically the cause of hash changes in system files. Taking a snapshot of the file system would not alter the hash of a specific file like cmd.exe unless the snapshot process itself was maliciously altering files.

Therefore, option D (A rootkit was deployed) is the most plausible explanation for the observed change in the hash of the cmd.exe file detected by the file integrity monitoring tool.