Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Sec 101 > 600-700 > Flashcards

600-700 Flashcards

You may prefer our related Brainscape-certified flashcards:
Physics 101 flashcards Psychology 101 flashcards Chemistry 101 flashcards Biology 101 flashcards Organic Chemistry 101 flashcards Sociology 101 flashcards
1
Q

Which of the following has been implemented when a host-based firewall on a legacy Linux system allows connections from only specific internal IP addresses?

A. Compensating control
B. Network segmentation
C. Transfer of risk
D. SNMP traps

A

B. Network segmentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

An attacker tricks a user into providing confidential information. Which of the following describes this form of malicious reconnaissance?

A. Phishing
B. Social engineering
C. Typosquatting
D. Smishing

A

B. Social engineering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A large bank with two geographically dispersed data centers is concerned about major power disruptions at both locations. Every day each location experiences very brief outages that last for a few seconds. However, during the summer a high risk of intentional under-voltage events that could last up to an hour exists, particularly at one of the locations near an industrial smelter. Which of the following is the best solution to reduce the risk of data loss?

A. Dual supply
B. Generator
C. PDU
D. Daily backups

A

B. Generator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

An organization would like to store customer data on a separate part of the network that is not accessible to users on the mam corporate network. Which of the following should the administrator use to accomplish this goal?

A. Segmentation
B. Isolation
C. Patching
D. Encryption

A

A. Segmentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A company is adding a clause to its AUP that states employees are not allowed to modify the operating system on mobile devices. Which of the following vulnerabilities is the organization addressing?

A. Cross-site scripting
B. Buffer overflow
C. Jailbreaking
D. Side loading

A

C. Jailbreaking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A company is expanding its threat surface program and allowing individuals to security test the company’s internet-facing application. The company will compensate researchers based on the vulnerabilities discovered. Which of the following best describes the program the company is setting up?

A. Open-source intelligence
B. Bug bounty
C. Red team
D. Penetration testing

A

B. Bug bounty

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

An organization experiences a cybersecurity incident involving a command-and-control server. Which of the following logs should be analyzed to identify the impacted host? (Choose two.)

A. Application
B. Authentication
C. Error
D. Network
E. Firewall
F. System

A

B. Authentication
D. Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

An administrator assists the legal and compliance team with ensuring information about customer transactions is archived for the proper time period. Which of the following data policies is the administrator carrying out?

A. Compromise
B. Retention
C. Analysis
D. Transfer
E. Inventory

A

B. Retention

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which of the following are the MOST likely vectors for the unauthorized or unintentional inclusion of vulnerable code in a software company’s final software releases? (Choose two.)

A. Unsecure protocols
B. Use of penetration-testing utilities
C. Weak passwords
D. Included third-party libraries
E. Vendors/supply chain
F. Outdated anti-malware software

A

D. Included third-party libraries
E. Vendors/supply chain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

An organization has a growing workforce that is mostly driven by additions to the sales department. Each newly hired salesperson relies on a mobile device to conduct business. The Chief Information Officer (CIO) is wondering if the organization may need to scale down just as quickly as it scaled up. The CIO is also concerned about the organization’s security and customer privacy. Which of the following would be BEST to address the CIO’s concerns?

A. Disallow new hires from using mobile devices for six months.
B. Select four devices for the sales department to use in a CYOD model.
C. Implement BYOD for the sales department while leveraging the MDM.
D. Deploy mobile devices using the COPE methodology.

A

C. Implement BYOD for the sales department while leveraging the MDM.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

A company has limited storage space available and an online presence that cannot be down for more than four hours. Which of the following backup methodologies should the company implement to allow for the FASTEST database restore time in the event of a failure, while being mindful of the limited available storage space?

A. Implement full tape backups every Sunday at 8:00 p.m. and perform nightly tape rotations.
B. Implement differential backups every Sunday at 8:00 p.m. and nightly incremental backups at 8:00 p.m.
C. Implement nightly full backups every Sunday at 8:00 p.m.
D. Implement full backups every Sunday at 8:00 p.m. and nightly differential backups at 8:00 p.m.

A

D. Implement full backups every Sunday at 8:00 p.m. and nightly differential backups at 8:00 p.m.

A differential backup strategy only copies data changes since the last full backup.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

A startup company is using multiple SaaS and IaaS platforms to stand up a corporate infrastructure and build out a customer-facing web application. Which of the following solutions would be BEST to provide security, manageability, and visibility into the platforms?

A. SIEM
B. DLP
C. CASB
D. SWG (secure web gateway)

A

C. CASB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which of the following technical controls is BEST suited for the detection and prevention of buffer overflows on hosts?

A. DLP
B. HIDS
C. EDR
D. NIPS

A

C. EDR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A consultant is configuring a vulnerability scanner for a large, global organization in multiple countries. The consultant will be using a service account to scan systems with administrative privileges on a weekly basis, but there is a concern that hackers could gain access to the account and pivot throughout the global network. Which of the following would be BEST to help mitigate this concern?

A. Create different accounts for each region, each configured with push MFA notifications.
B. Create one global administrator account and enforce Kerberos authentication.
C. Create different accounts for each region, limit their logon times, and alert on risky logins.
D. Create a guest account for each region, remember the last ten passwords, and block password reuse.

A

C. Create different accounts for each region, limit their logon times, and alert on risky logins.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

While troubleshooting a firewall configuration, a technician determines that a “deny any” policy should be added to the bottom of the ACL. The technician updates the policy, but the new policy causes several company servers to become unreachable. Which of the following actions would prevent this issue?

A. Documenting the new policy in a change request and submitting the request to change management

B. Testing the policy in a non-production environment before enabling the policy in the production network

C. Disabling any intrusion prevention signatures on the “deny any” policy prior to enabling the new policy

D. Including an “allow any” policy above the “deny any” policy

A

A. Documenting the new policy in a change request and submitting the request to change management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

A network technician is installing a guest wireless network at a coffee shop. When a customer purchases an item, the password for the wireless network is printed on the receipt so the customer can log in. Which of the following will the technician MOST likely configure to provide the highest level of security with the least amount of overhead?

A. WPA-EAP
B. WEP-TKIP
C. WPA-PSK
D. WPS-PIN

A

C. WPA-PSK (Wi-Fi Protected Access - Pre-Shared Key)

Here’s why:

WPA-PSK provides a reasonable level of security for a guest network without the complexity of more advanced authentication methods.

It uses a pre-shared key (password), which is printed on the receipt, making it easy for customers to log in.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which of the following ISO standards is certified for privacy?

A. ISO 9001
B. ISO 27002
C. ISO 27701
D. ISO 31000

A

C. ISO 27701

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

An organization suffered an outage, and a critical system took 90 minutes to come back online. Though there was no data loss during the outage, the expectation was that the critical system would be available again within 60 minutes. Which of the following is the 60-minute expectation an example of?

A. MTBF
B. RPO
C. MTTR
D. RTO

A

D. RTO

RTO (Recovery Time Objective): is a measure that defines the maximum allowable downtime for a system or service. It represents the time within which a system must be recovered and become operational again after an incident. In the given scenario, the 60-minute expectation of having the critical system available again falls under RTO. RTO specifies the organization’s recovery goals for system availability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

A security analyst needs to be proactive in understanding the types of attacks that could potentially target the company’s executives. Which of the following intelligence sources should the security analyst review?

A. Vulnerability feeds
B. Trusted automated exchange of indicator information
C. Structured threat information expression
D. Industry information-sharing and collaboration groups

A

D. Industry information-sharing and collaboration groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

An enterprise has hired an outside security firm to conduct penetration testing on its network and applications. The firm has agreed to pay for each vulnerability that is discovered. Which of the following BEST represents the type of testing that will occur?

A. Bug bounty
B. Black-box
C. Gray-box
D. White-box
E. Red-team

A

A. Bug bounty

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Users have been issued smart cards that provide physical access to a building. The cards also contain tokens that can be used to access information systems. Users can log in to any thin client located throughout the building and see the same desktop each time. Which of the following technologies are being utilized to provide these capabilities? (Choose two.)

A. COPE
B. VDI
C. GPS
D. TOTP
E. RFID
F. BYOD

A

B. VDI
E. RFID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

A security engineer needs to implement an MDM solution that complies with the corporate mobile device policy. The policy states that in order for mobile users to access corporate resources on their devices, the following requirements must be met:

  • Mobile device OSs must be patched up to the latest release.
  • A screen lock must be enabled (passcode or biometric).
  • Corporate data must be removed if the device is reported lost or stolen.

Which of the following controls should the security engineer configure? (Choose two.)

A. Containerization
B. Storage segmentation
C. Posturing
D. Remote wipe
E. Full-device encryption
F. Geofencing

A

D. Remote wipe
E. Full-device encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

A systems administrator needs to implement an access control scheme that will allow an object’s access policy to be determined by its owner. Which of the following access control schemes BEST fits the requirements?

A. Role-based access control
B. Discretionary access control
C. Mandatory access control
D. Attribute-based access control

A

B. Discretionary access control

DAC, the owner of an object has full control over who can access it. The owner can grant or revoke access to the object as they see fit. This is the most flexible access control scheme, but it can also be the most complex to manage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which of the following security concepts should an e-commerce organization apply for protection against erroneous purchases?

A. Privacy
B. Availability
C. Integrity
D. Confidentiality

A

C. Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

A network administrator needs to build out a new datacenter, with a focus on resiliency and uptime. Which of the following would BEST meet this objective? (Choose two.)

A. Dual power supply
B. Off-site backups
C. Automatic OS upgrades
D. NIC teaming
E. Scheduled penetration testing
F. Network-attached storage

A

A. Dual power supply
B. Off-site backups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

A company’s Chief Information Officer (CIO) is meeting with the Chief Information Security Officer (CISO) to plan some activities to enhance the skill levels of the company’s developers. Which of the following would be MOST suitable for training the developers?

A. A capture-the-flag competition
B. A phishing simulation
C. Physical security training
D. Basic awareness training

A

A. A capture-the-flag competition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

A cybersecurity administrator has a reduced team and needs to operate an on-premises network and security infrastructure efficiently. To help with the situation, the administrator decides to hire a service provider. Which of the following should the administrator use?

A. SDP
B. AAA
C. IaaS
D. MSSP
E. Microservices

A

D. MSSP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which of the following threat vectors would appear to be the most legitimate when used by a malicious actor to impersonate a company?

A. Phone call
B. Instant message
C. Email
D. Text message

A

C. Email

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

The SOC is reviewing processes and procedures after a recent incident. The review indicates it took more than 30 minutes to determine that quarantining an infected host was the best course of action. This allowed the malware to spread to additional hosts before it was contained. Which of the following would be BEST to improve the incident response process?

A. Updating the playbooks with better decision points
B. Dividing the network into trusted and untrusted zones
C. Providing additional end-user training on acceptable use
D. Implementing manual quarantining of infected hosts

A

A. Updating the playbooks with better decision points

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

A smart switch has the ability to monitor electrical levels and shut off power to a building in the event of power surge or other fault situation. The switch was installed on a wired network in a hospital and is monitored by the facilities department via a cloud application. The security administrator isolated the switch on a separate VLAN and set up a patching routine. Which of the following steps should also be taken to harden the smart switch?

A. Set up an air gap for the switch.
B. Change the default password for the switch
C. Place the switch in a Faraday cage.
D. Install a cable lock on the switch.

A

B. Change the default password for the switch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

A company recently set up an e-commerce portal to sell its products online. The company wants to start accepting credit cards for payment, which requires compliance with a security standard. Which of the following standards must the company comply with before accepting credit cards on its e-commerce platform?

A. PCI DSS
B. ISO 22301
C. ISO 27001
D. NIST CSF

A

A. PCI DSS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Which of the following allows for functional test data to be used in new systems for testing and training purposes to protect the real data?

A. Data encryption
B. Data masking
C. Data deduplication
D. Data minimization

A

B. Data masking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

A company recently moved sensitive videos between on-premises, company-owned websites. The company then learned the videos had been uploaded and shared to the Internet. Which of the following would MOST likely allow the company to find the cause?

A. Checksums
B. Watermarks
C. Order of volatility
D. A log analysis
E. A right-to-audit clause

A

D. A log analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

A public relations team will be taking a group of guests on a tour through the facility of a large e- commerce company. The day before the tour, the company sends out an email to employees to ensure all whiteboards are cleaned and all desks are cleared. The company is MOST likely trying to protect against:

A. loss of proprietary information.
B. damage to the company’s reputation.
C. social engineering.
D. credential exposure.

A

A. loss of proprietary information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Which of the following BEST explains the reason why a server administrator would place a document named password.txt on the desktop of an administrator account on a server?

A. The document is a honeyfile and is meant to attract the attention of a cyberintruder.
B. The document is a backup file if the system needs to be recovered.
C. The document is a standard file that the OS needs to verify the login credentials.
D. The document is a keylogger that stores all keystrokes should the account be compromised.

A

A. The document is a honeyfile and is meant to attract the attention of a cyberintruder.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

A security analyst needs to generate a server certificate to be used for 802.1X and secure RDP connections. The analyst is unsure what is required to perform the task and solicits help from a senior colleague. Which of the following is the FIRST step the senior colleague will most likely tell the analyst to perform to accomplish this task?

A. Create an OCSP.
B. Generate a CSR.
C. Create a CRL.
D. Generate a .pfx file.

A

B. Generate a CSR.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

When selecting a technical solution for identity management, an architect chooses to go from an in-house solution to a third-party SaaS provider. Which of the following risk management strategies is this an example of?

A. Acceptance
B. Mitigation
C. Avoidance
D. Transference

A

D. Transference

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Which of the following describes the BEST approach for deploying application patches?

A. Apply the patches to systems in a testing environment, then to systems in a staging environment, and finally to production systems.
B. Test the patches in a staging environment, develop against them in the development environment, and then apply them to the production systems.
C. Test the patches in a test environment, apply them to the production systems, and then apply them to a staging environment.
D. Apply the patches to the production systems, apply them in a staging environment, and then test all of them in a testing environment.

A

A. Apply the patches to systems in a testing environment, then to systems in a staging environment, and finally to production systems.

38
Q

A small business just recovered from a ransomware attack against its file servers by purchasing the decryption keys from the attackers. The issue was triggered by a phishing email and the IT administrator wants to ensure it does not happen again. Which of the following should the IT administrator do FIRST after recovery?

A. Scan the NAS for residual or dormant malware and take new daily backups that are tested on a frequent basis.
B. Restrict administrative privileges and patch all systems and applications.
C. Rebuild all workstations and install new antivirus software.
D. Implement application whitelisting and perform user application hardening.

A

C. Rebuild all workstations and install new antivirus software.

39
Q

After entering a username and password, an administrator must draw a gesture on a touch screen. Which of the following demonstrates what the administrator is providing?

A. Multifactor authentication
B. Something you can do
C. Biometrics
D. Two-factor authentication

A

B. Something you can do

40
Q

A root cause analysis reveals that a web application outage was caused by one of the company’s developers uploading a newer version of the third-party libraries that were shared among several applications. Which of the following implementations would be BEST to prevent this issue from reoccurring?

A. CASB
B. SWG
C. Containerization
D. Automated failover

A

C. Containerization

41
Q

The Chief Security Officer (CSO) at a major hospital wants to implement SSO to help improve security in the environment and protect patient data, particularly at shared terminals. The Chief Risk Officer (CRO) is concerned that training and guidance have not been provided to frontline staff, and a risk analysis has not been performed. Which of the following is the MOST likely cause of the CRO’s concerns?

A. SSO would simplify username and password management, making it easier for hackers to guess accounts.
B. SSO would reduce password fatigue, but staff would still need to remember more complex passwords.
C. SSO would reduce the password complexity for frontline staff.
D. SSO would reduce the resilience and availability of systems if the identity provider goes offline.

A

D. SSO would reduce the resilience and availability of systems if the identity provider goes offline. Most Voted

42
Q

Joe, a user at a company, clicked an email link that led to a website that infected his workstation. Joe was connected to the network, and the virus spread to the network shares. The protective measures failed to stop this virus, and it has continued to evade detection. Which of the following should a security administrator implement to protect the environment from this malware?

A. Install a definition-based antivirus.
B. Implement an IDS/IPS.
C. Implement a heuristic behavior-detection solution.
D. Implement CASB to protect the network shares.

A

C. Implement a heuristic behavior-detection solution.

42
Q

A software developer needs to perform code-execution testing, black-box testing, and non- functional testing on a new product before its general release. Which of the following BEST describes the tasks the developer is conducting?

A. Verification
B. Validation
C. Normalization
D. Staging

A

B. Validation

43
Q

A security engineer is reviewing log files after a third party discovered usernames and passwords for the organization’s accounts. The engineer sees there was a change in the IP address for a vendor website one week earlier. This change lasted eight hours. Which of the following attacks was MOST likely used?

A. Man-in-the-middle
B. Spear-phishing
C. Evil twin
D. DNS poisoning

A

D. DNS poisoning

44
Q

A user recently entered a username and password into a recruiting application website that had been forged to look like the legitimate site. Upon investigation, a security analyst identifies the following:

  • The legitimate website’s IP address is 10.1.1.20 and eRecruit.local resolves to this IP.
  • The forged website’s IP address appears to be 10.2.12.99, based on NetFlow records.
  • All three of the organization’s DNS servers show the website correctly resolves to the legitimate IP.
  • DNS query logs show one of the three DNS servers returned a result of 10.2.12.99 (cached) at the approximate time of the suspected compromise.

Which of the following MOST likely occurred?

A. A reverse proxy was used to redirect network traffic.
B. An SSL strip MITM attack was performed.
C. An attacker temporarily poisoned a name server.
D. An ARP poisoning attack was successfully executed.

A

C. An attacker temporarily poisoned a name server.

45
Q

A recent audit uncovered a key finding regarding the use of a specific encryption standard in a web application that is used to communicate with business customers. Due to the technical limitations of its customers, the company is unable to upgrade the encryption standard. Which of the following types of controls should be used to reduce the risk created by this scenario?

A. Physical
B. Detective
C. Preventive
D. Compensating

A

D. Compensating

46
Q

Which of the following is a team of people dedicated to testing the effectiveness of organizational security programs by emulating the techniques of potential attackers?

A. Red team
B. White team
C. Blue team
D. Purple team

A

A. Red team

47
Q

The cost of removable media and the security risks of transporting data have become too great for a laboratory. The laboratory has decided to interconnect with partner laboratories to make data transfers easier and more secure. The Chief Security Officer (CSO) has several concerns about proprietary data being exposed once the interconnections are established. Which of the following security features should the network administrator implement to prevent unwanted data exposure to users in partner laboratories?

A. VLAN zoning with a file-transfer server in an external-facing zone
B. DLP running on hosts to prevent file transfers between networks
C. NAC that permits only data-transfer agents to move data between networks
D. VPN with full tunneling and NAS authenticating through the Active Directory

A

D. VPN with full tunneling and NAS authenticating through the Active Directory

47
Q

A security assessment determines DES and 3DES are still being used on recently deployed production servers. Which of the following did the assessment identify?

A. Unsecure protocols
B. Default settings
C. Open permissions
D. Weak encryption

A

D. Weak encryption

48
Q

A vulnerability assessment report will include the CVSS score of the discovered vulnerabilities because the score allows the organization to better:

A. validate the vulnerability exists in the organization’s network through penetration testing.
B. research the appropriate mitigation techniques in a vulnerability database.
C. find the software patches that are required to mitigate a vulnerability.
D. prioritize remediation of vulnerabilities based on the possible impact.

A

D. prioritize remediation of vulnerabilities based on the possible impact.

49
Q

A security analyst is performing a forensic investigation involving compromised account credentials. Using the Event Viewer, the analyst was able to detect the following message: “Special privileges assigned to new logon.” Several of these messages did not have a valid logon associated with the user before these privileges were assigned. Which of the following attacks is MOST likely being detected?

A. Pass-the-hash
B. Buffer overflow
C. Cross-site scripting
D. Session replay

A

A. Pass-the-hash

50
Q

Company engineers regularly participate in a public Internet forum with other engineers throughout the industry. Which of the following tactics would an attacker MOST likely use in this scenario?

A. Watering-hole attack
B. Credential harvesting
C. Hybrid warfare
D. Pharming

A

A. Watering-hole attack

51
Q

As company uses wireless for all laptops and keeps a very detailed record of its assets, along with a comprehensive list of devices that are authorized to be on the wireless network. The Chief Information Officer (CIO) is concerned about a script kiddie potentially using an unauthorized device to brute force the wireless PSK and obtain access to the internal network. Which of the following should the company implement to BEST prevent this from occurring?

A. A BPDU guard
B. WPA-EAP
C. IP filtering
D. A WIDS

A

B. WPA-EAP

52
Q

In the middle of a cyberattack, a security engineer removes the infected devices from the network and locks down all compromised accounts. In which of the following incident response phases is the security engineer currently operating?

A. Identification
B. Preparation
C. Lessons learned
D. Eradication
E. Recovery
F. Containment

A

F. Containment

53
Q

A network administrator would like to configure a site-to-site VPN utilizing IPSec. The administrator wants the tunnel to be established with data integrity, encryption, authentication, and anti-replay functions. Which of the following should the administrator use when configuring the VPN?

A. AH
B. EDR
C. ESP
D. DNSSEC

A

C. ESP (Encapsulating Security Payload) is the correct choice for a site-to-site VPN when you need encryption, authentication, data integrity, and anti-replay protection.

54
Q

A security incident may have occurred on the desktop PC of an organization’s Chief Executive Officer (CEO). A duplicate copy of the CEO’s hard drive must be stored securely to ensure appropriate forensic processes and the chain of custody are followed. Which of the following should be performed to accomplish this task?

A. Install a new hard drive in the CEO’s PC, and then remove the old hard drive and place it in a tamper-evident bag.
B. Connect a write blocker to the hard drive. Then, leveraging a forensic workstation, utilize the dd command in a live Linux environment to create a duplicate copy.
C. Remove the CEO’s hard drive from the PC, connect to the forensic workstation, and copy all the contents onto a remote fileshare while the CEO watches.
D. Refrain from completing a forensic analysis of the CEO’s hard drive until after the incident is confirmed; duplicating the hard drive at this stage could destroy evidence.

A

B. Connect a write blocker to the hard drive. Then, leveraging a forensic workstation, utilize the dd command in a live Linux environment to create a duplicate copy.

55
Q

A security engineer at an offline government facility is concerned about the validity of an SSL certificate. The engineer wants to perform the fastest check with the least delay to determine if the certificate has been revoked. Which of the following would BEST meet these requirements?

A. RA
B. OCSP
C. CRL
D. CSR

A

D. CSR

56
Q

A security engineer at an offline government facility is concerned about the validity of an SSL certificate. The engineer wants to perform the fastest check with the least delay to determine if the certificate has been revoked. Which of the following would BEST meet these requirements?

A. RA
B. OCSP
C. CRL
D. CSR

A

C. CRL (Certificate Revocation List).

Reasoning:

In an offline environment, real-time online checks using OCSP are not feasible. CRLs provide a comprehensive list of all certificates that have been revoked by a Certificate Authority. This list can be manually downloaded and transferred to the offline facility periodically, allowing for local checks against the list to determine if a certificate has been revoked. This manual transfer and local validation make CRLs more suitable for strictly offline scenarios, ensuring that certificate validity can still be checked even without direct online access.

57
Q

A security administrator needs to create a RAID configuration that is focused on high read speeds and fault tolerance. It is unlikely that multiple drives will fail simultaneously. Which of the following RAID configurations should the administrator use?

A. RAID 0
B. RAID 1
C. RAID 5
D. RAID 10

A

D. RAID 10

58
Q

Which of the following algorithms has the SMALLEST key size?

A. DES
B. Twofish
C. RSA
D. AES

A

A. DES

59
Q

A security audit has revealed that a process control terminal is vulnerable to malicious users installing and executing software on the system. The terminal is beyond end-of-life support and cannot be upgraded, so it is placed on a protected network segment. Which of the following would be MOST effective to implement to further mitigate the reported vulnerability?

A. DNS sinkholing
B. DLP rules on the terminal
C. An IP blacklist
D. Application whitelisting

A

D. Application whitelisting

60
Q

A document that appears to be malicious has been discovered in an email that was sent to a company’s Chief Financial Officer (CFO). Which of the following would be BEST to allow a security analyst to gather information and confirm it is a malicious document without executing any code it may contain?

A. Open the document on an air-gapped network.
B. View the document’s metadata for origin clues.
C. Search for matching file hashes on malware websites.
D. Detonate the document in an analysis sandbox.

A

C. Search for matching file hashes on malware websites.

61
Q

A security analyst has received an alert about PII being sent via email. The analyst’s Chief Information Security Officer (CISO) has made it clear that PII must be handled with extreme care. From which of the following did the alert MOST likely originate?

A. S/MIME
B. DLP
C. IMAP
D. HIDS

A

B. DLP

62
Q

A company has drafted an insider-threat policy that prohibits the use of external storage devices. Which of the following would BEST protect the company from data exfiltration via removable media?

A. Monitoring large data transfer transactions in the firewall logs
B. Developing mandatory training to educate employees about the removable media policy
C. Implementing a group policy to block user access to system files
D. Blocking removable-media devices and write capabilities using a host-based security tool

A

D. Blocking removable-media devices and write capabilities using a host-based security tool

63
Q

After a ransomware attack, a forensics company needs to review a cryptocurrency transaction between the victim and the attacker. Which of the following will the company MOST likely review to trace this transaction?

A. The public ledger
B. The NetFlow data
C. A checksum
D. The event log

A

A. The public ledger

64
Q

A network administrator is setting up wireless access points in all the conference rooms and wants to authenticate devices using PKI. Which of the following should the administrator configure?

A. A captive portal
B. PSK
C. 802.1X
D. WPS

A

C. 802.1X

65
Q

An organization has hired a security analyst to perform a penetration test. The analyst captures 1Gb worth of inbound network traffic to the server and transfers the pcap back to the machine for analysis. Which of the following tools should the analyst use to further review the pcap?

A. Nmap
B. cURL
C. Netcat
D. Wireshark

A

D. Wireshark

66
Q

An organization that is located in a flood zone is MOST likely to document the concerns associated with the restoration of IT operations in a:

A. business continuity plan.
B. communications plan.
C. disaster recovery plan.
D. continuity of operations plan.

A

C. disaster recovery plan.

67
Q

Which of the following should a security administrator adhere to when setting up a new set of firewall rules?

A. Disaster recovery plan
B. Incident response procedure
C. Business continuity plan
D. Change management procedure

A

D. Change management procedure

68
Q

During an engagement, penetration testers left USB keys that contained specially crafted malware in the company’s parking lot. A couple days later, the malware contacted the command-and-control server, giving the penetration testers unauthorized access to the company endpoints. Which of the following will most likely be a recommendation in the engagement report?

A. Conduct an awareness campaign on the usage of removable media.
B. Issue a user guidance program focused on vishing campaigns.
C. Implement more complex password management practices.
D. Establish a procedure on identifying and reporting suspicious messages.

A

A. Conduct an awareness campaign on the usage of removable media.

69
Q

A company recently experienced a significant data loss when proprietary information was leaked to a competitor. The company took special precautions by using proper labels; however, email filter logs do not have any record of the incident. An investigation confirmed the corporate network was not breached, but documents were downloaded from an employee’s COPE tablet and passed to the competitor via cloud storage. Which of the following is the best mitigation strategy to prevent this from happening in the future?

A. User training
B. CASB
C. MDM
D. EDR

A

C. MDM

70
Q

A manufacturing organization wants to control and monitor access from the internal business network to the segregated production network, while ensuring minimal exposure of the production network to devices. Which of the following solutions would best accomplish this goal?

A. Proxy server
B. NGFW
C. WAF
D. Jump server

A

D. Jump server

71
Q

Which of the following roles, according to the shared responsibility model, is responsible for securing the company’s database in an IaaS model for a cloud environment?

A. Client
B. Third-party vendor
C. Cloud provider
D. OBA

A

A. Client

72
Q

Which of the following tools can assist with detecting an employee who has accidentally emailed a file containing a customer’s PII?

A. SCAP
B. NetFlow
C. Antivirus
D. DLP

A

D. DLP

73
Q

A company requires hard drives to be securely wiped before sending decommissioned systems to recycling. Which of the following best describes this policy?

A. Enumeration
B. Sanitization
C. Destruction
D. Inventory

A

B. Sanitization

73
Q

A bank insists all of its vendors must prevent data loss on stolen laptops. Which of the following strategies is the bank requiring?

A. Encryption at rest
B. Masking
C. Data classification
D. Permission restrictions

A

A. Encryption at rest

74
Q

After a recent vulnerability scan, a security engineer needs to harden the routers within the corporate network. Which of the following is the most appropriate to disable?

A. Console access
B. Routing protocols
C. VLANs
D. Web-based administration

A

D. Web-based administration

75
Q

An attacker posing as the Chief Executive Officer calls an employee and instructs the employee to buy gift cards. Which of the following techniques is the attacker using?

A. Smishing
B. Phishing
C. Impersonating
D. Vishing

A

D. Vishing

76
Q

Which of the following is a cryptographic concept that operates on a fixed length of bits?

A. Block cipher
B. Hashing
C. Key stretching
D. Salting

A

A. Block cipher

77
Q

Which of the following best describes a use case for a DNS sinkhole?

A. Attackers can see a DNS sinkhole as a highly valuable resource to identify a company’s domain structure.
B. A DNS sinkhole can be used to draw employees away from known-good websites to malicious ones owned by the attacker.
C. A DNS sinkhole can be used to capture traffic to known-malicious domains used by attackers.
D. A DNS sinkhole can be set up to attract potential attackers away from a company’s network resources.

A

C. A DNS sinkhole can be used to capture traffic to known-malicious domains used by attackers.

78
Q

A company reduced the area utilized in its data center by creating virtual networking through automation and by creating provisioning routes and rules through scripting. Which of the following does this example describe?

A. IaC (Infrastructure as Code )
B. MSSP
C. Containers
D. SaaS

A

A. IaC (Infrastructure as Code )

This is on the test

79
Q

Which of the following explains why an attacker cannot easily decrypt passwords using a rainbow table attack?

A. Digital signatures
B. Salting
C. Hashing
D. Perfect forward secrecy

A

B. Salting

79
Q

Historically, a company has had issues with users plugging in personally owned removable media devices into corporate computers. As a result, the threat of malware incidents is almost constant. Which of the following would best help prevent the malware from being installed on the computers?

A. AUP
B. NGFW
C. DLP
D. EDR

A

D. EDR

80
Q

While investigating a recent security breach, an analyst finds that an attacker gained access by SQL injection through a company website. Which of the following should the analyst recommend to the website developers to prevent this from reoccurring?

A. Secure cookies
B. Input sanitization
C. Code signing
D. Blocklist

A

B. Input sanitization

81
Q

Which of the following best describes the risk that is present once mitigations are applied?

A. Control risk
B. Residual risk
C. Inherent risk
D. Risk awareness

A

B. Residual risk

82
Q

A security architect at a large, multinational organization is concerned about the complexities and overhead of managing multiple encryption keys securely in a multicloud provider environment. The security architect is looking for a solution with reduced latency to allow the incorporation of the organization’s existing keys and to maintain consistent, centralized control and management regardless of the data location. Which of the following would best meet the architect’s objectives?

A. Trusted Platform Module
B. IaaS
C. HSMaaS
D. PaaS

A

C. HSMaaS

83
Q

Which of the following best represents an application that does not have an on-premises requirement and is accessible from anywhere?

A. PaaS
B. Hybrid cloud
C. Private cloud
D. IaaS
E. SaaS

A

E. SaaS

84
Q

During an investigation, events from two affected servers in the same subnetwork occurred at the same time:

Server 1: 192.168.10.1 [01/Apr/2021:06:00:00 PST] SAN access denied for user ‘admin’
Server 2: 192.168.10.6 [01/Apr/2021:06:01:01 CST] SAN access successful for user ‘admin’

Which of the following should be consistently configured to prevent the issue seen in the logs?

A. Geolocation
B. TOTP
C. NTP
D. MFA

A

C. NTP (Network Time Protocol)

NTP is used to synchronize the time across devices on a network. Inconsistent time settings between servers can lead to confusion during investigations and issues with event correlation. Configuring NTP ensures that all devices in the network maintain accurate and synchronized time, which is essential for proper log management, security analysis, and event coordination. (synchronized is the word here)

84
Q

The most recent vulnerability scan flagged the domain controller with a critical vulnerability. The systems administrator researched the vulnerability and discovered the domain controller does not run the associated application with the vulnerability. Which of the following steps should the administrator take next?

A. Ensure the scan engine is configured correctly.
B. Apply a patch to the domain controller.
C. Research the CVE.
D. Document this as a false positive.

A

D. Document this as a false positive.

THIS IS ON THE TEST

85
Q

A company has decided to move its operations to the cloud. It wants to utilize technology that will prevent users from downloading company applications for personal use, restrict data that is uploaded, and have visibility into which applications are being used across the company. Which of the following solutions will best meet these requirements?

A. An NGFW
B. A CASB
C. Application whitelisting
D. An NG-SWG

A

B. A CASB

86
Q

An internet company has created a new collaboration application. To expand the user base, the company wants to implement an option that allows users to log in to the application with the credentials of other popular websites. Which of the following should the company implement?

A. SSO
B. CHAP
C. 802.1x
D. OpenID

A

D. OpenID

87
Q

Following a prolonged data center outage that affected web-based sales, a company has decided to move its operations to a private cloud solution. The security team has received the following requirements:

  • There must be visibility into how teams are using cloud-based services.
  • The company must be able to identify when data related to payment cards is being sent to the cloud.
  • Data must be available regardless of the end user’s geographic location.
  • Administrators need a single pane-of-glass view into traffic and trends.

Which of the following should the security analyst recommend?

A. Create firewall rules to restrict traffic to other cloud service providers.
B. Install a DLP solution to monitor data in transit.
C. Implement a CASB solution.
D. Configure a web-based content filter.

A

C. Implement a CASB solution. Most Voted

88
Q
A

Sec 101 (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions