551-575 Flashcards
A security analyst was asked to evaluate a potential attack that occurred on a publicly accessible section of the company’s website. The malicious actor posted an entry in an attempt to trick users into clicking the following:
https://www.c0mpt1a.com/contact-us/%3Fname%3D%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E
Which of the following was most likely observed?
A. DLL injection
B. Session replay
C. SQLi
D. XSS
D. XSS
A company’s Chief Information Security Officer (CISO) recently warned the security manager that the company’s Chief Executive Officer (CEO) is planning to publish a controversial opinion article in a national newspaper, which may result in new cyberattacks. Which of the following would be best for the security manager to use in a threat model?
A. Hacktivists
B. White-hat hackers
C. Script kiddies
D. Insider threats
A. Hacktivists
Which of the following provides a catalog of security and privacy controls related to the United States federal information systems?
A. GDPR
B. PCI DSS
C. ISO 27000
D. NIST 800-53
D. NIST 800-53
An analyst is concerned about data leaks and wants to restrict access to internet services to authorized users only. The analyst also wants to control the actions each user can perform on each service. Which of the following would be the best technology for the analyst to consider Implementing?
A. DLP
B. VPC
C. CASB
D. Content filtering
C. CASB
A grocery store is expressing security and reliability concerns regarding the on-site backup strategy currently being performed by locally attached disks. The main concerns are the physical security of the backup media and the durability of the data stored on these devices. Which of the following is a cost-effective approach to address these concerns?
A. Enhance resiliency by adding a hardware RAID.
B. Move data to a tape library and store the tapes off-site.
C. Install a local network-attached storage.
D. Migrate to a cloud backup solution.
D. Migrate to a cloud backup solution.
Question #556Topic 1
A security engineer needs to recommend a solution to defend against malicious actors misusing protocols and being allowed through network defenses. Which of the following will the engineer most likely recommend?
A. A content filter
B. A WAF
C. A next-generation firewall
D. An IDS
C. A next-generation firewall
A company’s legal department drafted sensitive documents in a SaaS application and wants to ensure the documents cannot be accessed by individuals in high-risk countries. Which of the following is the most effective way to limit this access?
A. Data masking
B. Encryption
C. Geolocation policy
D. Data sovereignty regulation
C. Geolocation policy
An organization suffered numerous multiday power outages at its current location. The Chief Executive Officer wants to create a disaster recovery strategy to resolve this issue. Which of the following options offer low-cost solutions? (Choose two.)
A. Warm site
B. Generator
C. Hot site
D. Cold site
E. Cloud backups
F. UPS
D. Cold site
E. Cloud backups
A security analyst is reviewing the following logs:
[10:00:00 AM] Login rejected - username administrator - password Spring 2023
[10:00:01 AM] Login rejected - username jsmith - password Spring2023
[10:00:01 AM] Login rejected - username guest - password Spring2023
[10:00:02 AM] Login rejected - username cpolk - password Spring2023
[10:00:03 AM] Login rejected - username fmartin - password Spring2023
Which of the following attacks is most likely occurring?
A. Password spraying
B. Account forgery
C. Pass-the-hash
D. Brute-force
A. Password spraying
A security analyst discovers that one of the web APIs is being abused by an unknown third party. Logs indicate that the third party is attempting to manipulate the parameters being passed to the API endpoint. Which of the following solutions would best help to protect against the attack?
A. DLP
B. SIEM
C. NIDS
D. WAF
D. WAF
An application owner reports suspicious activity on an internal financial application from various internal users within the past 14 days. A security analyst notices the following:
- Financial transactions were occurring during irregular time frames and outside of business hours by unauthorized users.
- Internal users in question were changing their passwords frequently during that time period.
- A jump box that several domain administrator users use to connect to remote devices was recently compromised.
- The authentication method used in the environment is NTLM.
Which of the following types of attacks is most likely being used to gain unauthorized access?
A. Pass-the-hash
B. Brute-force
C. Directory traversal
D. Replay
A. Pass-the-hash
During an incident, an EDR system detects an increase in the number of encrypted outbound connections from multiple hosts. A firewall is also reporting an increase in outbound connections that use random high ports. An analyst plans to review the correlated logs to find the source of the incident. Which of the following tools will best assist the analyst?
A. A vulnerability scanner
B. A NGFW
C. The Windows Event Viewer
D. A SIEM
D. A SIEM
A company recently suffered a breach in which an attacker was able to access the internal mail servers and directly access several user inboxes. A large number of email messages were later posted online. Which of the following would best prevent email contents from being released should another breach occur?
A. Implement S/MIME to encrypt the emails at rest.
B. Enable full disk encryption on the mail servers.
C. Use digital certificates when accessing email via the web.
D. Configure web traffic to only use TLS-enabled channels.
A. Implement S/MIME to encrypt the emails at rest.
A company hired a consultant to perform an offensive security assessment covering penetration testing and social engineering. Which of the following teams will conduct this assessment activity?
A. White
B. Purple
C. Blue
D. Red
D. Red
Which of the following exercises should an organization use to improve its incident response process?
A. Tabletop
B. Replication
C. Failover
D. Recovery
A. Tabletop
