576-600 Flashcards
A security analyst is scanning a company’s public network and discovers a host is running a remote desktop that can be used to access the production network. Which of the following changes should the security analyst recommend?
A. Changing the remote desktop port to a non-standard number
B. Setting up a VPN and placing the jump server inside the firewall
C. Using a proxy for web connections from the remote desktop server
D. Connecting the remote server to the domain and increasing the password length
B. Setting up a VPN and placing the jump server inside the firewall
A company recently experienced a major breach. An investigation concludes that customer credit card data was stolen and exfiltrated through a dedicated business partner connection to a vendor, who is not held to the same security control standards. Which of the following is the most likely source of the breach?
A. Side channel
B. Supply chain
C. Cryptographic downgrade
D. Malware
B. Supply chain
A company would like to provide flexibility for employees on device preference. However, the company is concerned about supporting too many different types of hardware. Which of the following deployment models will provide the needed flexibility with the greatest amount of control and security over company data and infrastructure?
A. BYOD
B. VDI
C. COPE
D. CYOD
D. CYOD
Which of the following threat actors is most likely to be motivated by ideology?
A. Business competitor
B. Hacktivist
C. Criminal syndicate
D. Script kiddie
E. Disgruntled employee
B. Hacktivist
A user would like to install software and features that are not available with a mobile device’s default software. Which of the following would all the user to install unauthorized software and enable new features?
A. SQLi
B. Cross-site scripting
C. Jailbreaking
D. Side loading
C. Jailbreaking
A user downloaded an extension for a browser and the user’s device later became infected. The analyst who is investigating the incident saw various logs where the attacker was hiding activity by deleting data. The following was observed running:
New-Partition -DiskNumber 2 -UseMaximumSize -AssignDriveLetter C| Format-Volume -DriveLetter C - FileSystemLabel “New”-FileSystem NTFS - Full -Force -Confirm:$false |
Which of the following is the malware using to execute the attack?
A. PowerShell
B. Python
C. Bash
D. Macros
A. PowerShell
An organization recently acquired an ISO 27001 certification. Which of the following would most likely be considered a benefit of this certification?
A. It allows for the sharing of digital forensics data across organizations.
B. It provides insurance in case of a data breach
C. It provides complimentary training and certification resources to IT security staff
D. It certifies the organization can work with foreign entities that require a security clearance
E. It assures customers that the organization meets security standards
E. It assures customers that the organization meets security standards
A junior security analyst is reviewing web server logs and identifies the following pattern in the log file:
http://comptia.org/../../../etc/passwd
Which of the following types of attacks is being attempted and how can it be mitigated?
A. XSS; implement a SIEM
B. CSRF; implement an IPS
C. Directory traversal; implement a WAF
D. SQL injection; implement an IDS
C. Directory traversal; implement a WAF
A security professional wants to enhance the protection of a critical environment that is used to store and manage a company’s encryption keys. The selected technology should be tamper resistant. Which of the following should the security professional implement to achieve the goal?
A. DLP
B. HSM
C. CA
D. FIM
B. HSM
Which of the following is the correct order of volatility from most to least volatile?
A. Memory, temporary filesystems, routing tables, disk, network storage
B. Cache memory, temporary filesystems, disk, archival media
C. Memory, disk temporary filesystems, cache, archival media
D. Cache, disk, temporary filesystems, network storage, archival media
B. Cache memory, temporary filesystems, disk, archival media
A Chief Information Security Officer (CISO) wants to explicitly raise awareness about the increase of ransomware-as-a-service in a report to the management team. Which of the following best describes the threat actor in the CISO’s report?
A. Insider threat
B. Hacktivist
C. Nation-state
D. Organized crime
D. Organized crime
Which of the following agreements defines response time, escalation points, and performance metrics?
A. BPA
B. MOA
C. NDA
D. SLA
D. SLA
A bakery has a secret recipe that it wants to protect. Which of the following objectives should be added to the company’s security awareness training?
A. Insider threat detection
B. Risk analysis
C. Phishing awareness
D. Business continuity planning
A. Insider threat detection
Which of the following must be considered when designing a high-availability network? (Choose two.)
A. Ease of recovery
B. Ability to patch
C. Physical isolation
D. Responsiveness
E. Attack surface
F. Extensible authentication
A. Ease of recovery
D. Responsiveness
Which of the following strategies shifts risks that are not covered in an organization’s risk strategy?
A. Risk transference
B. Risk avoidance
C. Risk mitigation
D. Risk acceptance
A. Risk transference
