651-700 Flashcards

1
Q

A security engineer is reviewing log files after a third party discovered usernames and passwords for the organization’s accounts. The engineer sees there was a change in the IP address for a vendor website one week earlier. This change lasted eight hours. Which of the following attacks was MOST likely used?

A. Man-in-the-middle
B. Spear-phishing
C. Evil twin
D. DNS poisoning

A

D. DNS poisoning

Here’s why DNS poisoning fits this scenario:

DNS Poisoning: Also known as DNS cache poisoning, this attack involves corrupting the DNS cache of a DNS resolver or client. If an attacker successfully poisons the DNS cache, legitimate domain name queries can be redirected to malicious IP addresses controlled by the attacker. In this case, the change in IP address for the vendor website could indicate that DNS records were manipulated to redirect traffic to a malicious server controlled by the attacker for the duration of eight hours.

Let’s briefly review why the other options are less likely in this context:

A. Man-in-the-middle: While a man-in-the-middle (MitM) attack involves intercepting and potentially altering communications between two parties, the specific mention of a change in IP address for a vendor website suggests manipulation of DNS records rather than direct interception of traffic.

B. Spear-phishing: Spear-phishing involves targeted email attacks to trick specific individuals into divulging sensitive information. There is no indication in the scenario that spear-phishing directly led to the change in IP address.

C. Evil twin: An evil twin attack typically involves setting up a rogue wireless access point that mimics a legitimate one to intercept wireless communications. This scenario describes a change in IP address for a vendor website, which is not characteristic of an evil twin attack.

Therefore, D. DNS poisoning is the most likely attack used in this scenario where the organization’s accounts’ usernames and passwords were compromised after a change in the vendor website’s IP address was detected in log files.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A user recently entered a username and password into a recruiting application website that had been forged to look like the legitimate site. Upon investigation, a security analyst identifies the following:
– The legitimate website’s IP address is 10.1.1.20 and eRecruit.local resolves to this IP.
– The forged website’s IP address appears to be 10.2.12.99, based on NetFlow records.
– All three of the organization’s DNS servers show the website correctly resolves to the legitimate IP.
– DNS query logs show one of the three DNS servers returned a result of 10.2.12.99 (cached) at the
approximate time of the suspected compromise.
Which of the following MOST likely occurred?

A. A reverse proxy was used to redirect network traffic.
B. An SSL strip MITM attack was performed.
C. An attacker temporarily poisoned a name server.
D. An ARP poisoning attack was successfully executed.

A

C. An attacker temporarily poisoned a name server.

Here’s the reasoning:

DNS Poisoning: The DNS query logs show that one of the organization's DNS servers returned a result of 10.2.12.99 (which is the forged website's IP address) at the time of the suspected compromise. This indicates that the DNS server cache was poisoned with the incorrect IP address for the legitimate website eRecruit.local. Despite the other two DNS servers showing the correct resolution to 10.1.1.20, the compromised DNS server's cached entry led users to the forged website when they attempted to access eRecruit.local.

Let’s briefly review why the other options are less likely in this context:

A. A reverse proxy was used to redirect network traffic: While a reverse proxy can redirect traffic, it typically operates at the application layer and would not directly affect DNS resolution to the extent described in the scenario.

B. An SSL strip MITM attack was performed: SSL stripping involves downgrading HTTPS connections to HTTP to intercept traffic, but it does not directly manipulate DNS resolution or redirect users to a forged website based on DNS responses.

D. An ARP poisoning attack was successfully executed: ARP poisoning involves manipulating ARP (Address Resolution Protocol) messages to associate a different MAC address with an IP address, typically within a local network. This attack is not related to DNS resolution and would not affect DNS server responses.

Therefore, C. An attacker temporarily poisoned a name server is the most likely scenario based on the DNS query logs showing an incorrect IP address cached by one of the organization’s DNS servers, leading users to enter credentials into a forged website masquerading as the legitimate one.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A recent audit uncovered a key finding regarding the use of a specific encryption standard in a web application that is used to communicate with business customers. Due to the technical limitations of its customers, the company is unable to upgrade the encryption standard. Which of the following types of controls should be used to reduce the risk created by this scenario?

A. Physical
B. Detective
C. Preventive
D. Compensating

A

D. Compensating

Here’s why compensating controls are suitable in this scenario:

Compensating Controls: These controls are alternative measures implemented when it is not feasible to implement the primary control or when the primary control alone is not sufficient. In the context of encryption standards, if upgrading to a more secure standard is not possible due to technical constraints of business customers, compensating controls can be implemented to mitigate the associated risks.

For example, compensating controls could include:

Enhanced monitoring and logging: Implementing additional detective controls to monitor and detect suspicious activities related to encryption.
Stronger authentication mechanisms: Strengthening user authentication to mitigate the risk of unauthorized access even if encryption strength is limited.
Segmentation and isolation: Isolating sensitive data or systems to reduce exposure if encryption is compromised.

These controls help to compensate for the reduced security provided by the outdated encryption standard, thereby reducing the overall risk to an acceptable level given the constraints.

Let’s briefly review why the other options are less appropriate in this scenario:

A. Physical Controls: Physical controls involve measures like locks, fences, and security guards to protect physical assets. They are not directly relevant to mitigating risks associated with encryption standards in a web application.

B. Detective Controls: Detective controls aim to detect incidents or anomalies after they have occurred. While important for monitoring and alerting, they do not address the inherent risk associated with using a less secure encryption standard.

C. Preventive Controls: Preventive controls aim to stop incidents from occurring by implementing security measures such as firewalls, access controls, and encryption standards themselves. However, since upgrading the encryption standard is not feasible, preventive controls alone cannot fully mitigate the risk in this scenario.

Therefore, D. Compensating controls are the appropriate choice to address the risk created by the inability to upgrade the encryption standard, providing alternative measures to mitigate security risks effectively.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which of the following is a team of people dedicated to testing the effectiveness of organizational security programs by emulating the techniques of potential attackers?

A. Red team
B. White team
C. Blue team
D. Purple team

A

A. Red team

Explanation:

Red team: A red team is a group of individuals dedicated to testing the effectiveness of organizational security measures by simulating the tactics, techniques, and procedures (TTPs) of potential attackers. They conduct simulated attacks to identify vulnerabilities in systems, processes, and personnel, often using methods similar to those of malicious actors. The goal is to provide a realistic assessment of an organization's security posture and readiness to defend against real-world threats.

Let’s briefly differentiate the other options:

B. White team: Typically refers to a group responsible for overseeing and ensuring the integrity of a testing process, ensuring it is conducted ethically and within predefined parameters. They do not actively simulate attacks like a red team.

C. Blue team: Refers to the defensive security team within an organization that responds to and defends against security incidents. They monitor systems, analyze logs, and implement defensive measures to protect against real threats.

D. Purple team: A purple team is a collaborative approach where red and blue teams work together closely. The red team simulates attacks, and the blue team defends against them, with both teams sharing knowledge and insights to improve overall security.

Therefore, A. Red team specifically describes the team dedicated to testing security effectiveness through simulated attacks, making it the correct answer in this context.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A security assessment determines DES and 3DES are still being used on recently deployed production servers.
Which of the following did the assessment identify?

A. Unsecure protocols
B. Default settings
C. Open permissions
D. Weak encryption

A

D. Weak encryption

Explanation:

DES (Data Encryption Standard) and 3DES (Triple DES) are encryption algorithms that have been deprecated due to vulnerabilities and weaknesses compared to more modern encryption standards like AES (Advanced Encryption Standard).
Using DES and 3DES on production servers is considered a security risk because they are susceptible to brute-force attacks and other cryptographic weaknesses.
Therefore, the assessment identified "weak encryption" as the issue because DES and 3DES are no longer considered secure encryption standards for protecting sensitive data.

Option A (Unsecure protocols), B (Default settings), and C (Open permissions) do not accurately describe the specific security issue related to the use of DES and 3DES on production servers. Therefore, D. Weak encryption is the correct identification based on the scenario provided.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

The cost of removable media and the security risks of transporting data have become too great for a laboratory.
The laboratory has decided to interconnect with partner laboratories to make data transfers easier and more secure. The Chief Security Officer (CSO) has several concerns about proprietary data being exposed once the interconnections are established. Which of the following security features should the network administrator implement to prevent unwanted data exposure to users in partner laboratories?

A. VLAN zoning with a file-transfer server in an external-facing zone
B. DLP running on hosts to prevent file transfers between networks
C. NAC that permits only data-transfer agents to move data between networks
D. VPN with full tunneling and NAS authenticating through the Active Directory

A

(Community D 43%, B 26%, C 17%)
D. VPN with full tunneling and NAS authenticating through the Active Directory
For the scenario described where proprietary data might be exposed once interconnections are established with partner laboratories, option D (VPN with full tunneling and NAS authenticating through the Active Directory) offers a holistic security solution. It combines the encrypted communication features of a VPN with the strong user and device authentication mechanisms of Active Directory

VLAN zoning and VPN tunneling are both methods used to segment and secure network traffic, but they serve different purposes. VLAN zoning is a technique used to divide a network into separate virtual LANs, allowing for better control and management of network traffic within a single physical network. On the other hand, VPN tunneling creates a secure, encrypted connection over a public network, such as the internet, to connect remote users or branch offices to a central network. While VLAN zoning is more focused on internal network segmentation, VPN tunneling is used to securely connect external networks to a central network

(Brain dump: A. VLAN zoning with a file-transfer server in an external-facing zone)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

A vulnerability assessment report will include the CVSS score of the discovered vulnerabilities because the score allows the organization to better:

A. validate the vulnerability exists in the organization’s network through penetration testing.
B. research the appropriate mitigation techniques in a vulnerability database.
C. find the software patches that are required to mitigate a vulnerability.
D. prioritize remediation of vulnerabilities based on the possible impact.

A

D. prioritize remediation of vulnerabilities based on the possible impact.

Explanation:

CVSS (Common Vulnerability Scoring System) Score: The CVSS score is a standardized numerical rating that assesses the severity of a vulnerability based on several metrics, including exploitability, impact, and complexity. This score helps organizations prioritize which vulnerabilities to address first based on their potential impact on the organization's systems and data.

Prioritize remediation: By including CVSS scores in the vulnerability assessment report, organizations can prioritize their remediation efforts. Vulnerabilities with higher CVSS scores (indicating higher severity) are typically addressed first to mitigate the most significant risks to the organization's security posture.

Let’s briefly review why the other options are less applicable:

A. Validate the vulnerability exists in the organization's network through penetration testing: Penetration testing validates the existence and exploitation of vulnerabilities but does not rely on CVSS scores to do so. CVSS scores provide a severity rating rather than confirming the presence of a vulnerability.

B. Research the appropriate mitigation techniques in a vulnerability database: While CVSS scores can guide decisions on mitigation, they do not directly provide specific mitigation techniques. Organizations typically consult vulnerability databases or security advisories for detailed mitigation guidance.

C. Find the software patches that are required to mitigate a vulnerability: CVSS scores indicate the severity of a vulnerability but do not directly link to specific software patches. Organizations must still refer to vendor advisories and patch management systems to identify and apply appropriate patches.

Therefore, D. prioritize remediation of vulnerabilities based on the possible impact is the primary benefit of including CVSS scores in a vulnerability assessment report. It helps organizations allocate resources efficiently by addressing the most critical vulnerabilities first, thereby enhancing overall security posture.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

A security analyst is performing a forensic investigation involving compromised account credentials. Using the Event Viewer, the analyst was able to detect the following message: “Special privileges assigned to new logon.” Several of these messages did not have a valid logon associated with the user before these privileges were assigned. Which of the following attacks is MOST likely being detected?

A. Pass-the-hash
B. Buffer overflow
C. Cross-site scripting
D. Session replay

A

A. Pass-the-hash

Here’s why:

Pass-the-hash: This attack involves an attacker obtaining hashed credentials (typically through tools like Mimikatz) from a compromised system and then using these hashes to authenticate to other systems without needing to crack the hash into plaintext passwords. When the attacker successfully uses hashed credentials to gain access, it often triggers messages in event logs indicating special privileges assigned to a new logon without a valid initial logon session.

Event Viewer message "Special privileges assigned to new logon": This message suggests that privileges were assigned to a new logon session that did not have a valid previous logon session associated with it. This behavior is characteristic of pass-the-hash attacks where the attacker uses obtained hashes to authenticate and gain access to resources.

Let’s briefly review why the other options are less likely in this context:

B. Buffer overflow: Buffer overflow attacks exploit vulnerabilities in software to overwrite memory and gain unauthorized access to systems or execute arbitrary code. They typically do not manifest as "special privileges assigned to new logon" messages in event logs.

C. Cross-site scripting (XSS): XSS attacks involve injecting malicious scripts into web pages viewed by other users. They do not directly relate to "special privileges assigned to new logon" messages in event logs.

D. Session replay: Session replay attacks involve capturing and replaying legitimate session data to impersonate a legitimate user. They do not typically result in event log messages related to new logon sessions and special privileges.

Therefore, based on the information provided, A. Pass-the-hash is the most likely attack being detected in the forensic investigation involving compromised account credentials.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Company engineers regularly participate in a public Internet forum with other engineers throughout the industry.
Which of the following tactics would an attacker MOST likely use in this scenario?

A. Watering-hole attack
B. Credential harvesting
C. Hybrid warfare
D. Pharming

A

A. Watering-hole attack

Here’s why:

Watering-hole attack: This type of attack involves compromising a website that the targeted individuals (in this case, company engineers) frequently visit. By infecting this legitimate website with malware, the attackers can exploit the trust of the visitors and potentially compromise their systems when they visit the infected site. Since engineers participate regularly in the forum, attackers may target the forum's website or related sites engineers commonly visit.

Credential harvesting: While credential harvesting is a common goal in various cyber attacks, it typically involves more targeted methods such as phishing or social engineering, rather than relying on the engineers' participation in public forums.

Hybrid warfare: This term usually refers to a broader concept involving military and non-military strategies and is not directly related to cyber attacks on Internet forums.

Pharming: Pharming involves redirecting users from legitimate websites to malicious ones without their knowledge, often through DNS cache poisoning or malware. While related to web security, it's less likely in the context of engineers participating in a specific public forum.

Therefore, in the scenario described, A. Watering-hole attack is the tactic that an attacker would most likely use to target company engineers participating in a public Internet forum. This tactic leverages their regular visits to specific websites to deliver malware or compromise their systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

As company uses wireless for all laptops and keeps a very detailed record of its assets, along with a comprehensive list of devices that are authorized to be on the wireless network. The Chief Information Officer (CIO) is concerned about a script kiddie potentially using an unauthorized device to brute force the wireless PSK and obtain access to the internal network. Which of the following should the company implement to BEST prevent this from occurring?

A. A BPDU guard
B. WPA-EAP
C. IP filtering
D. A WIDS

A

Community : B 81%, D 19%
B. WPA-EAP

WPA-EAP provides a stronger form of authentication compared to a simple Pre-Shared Key (PSK). It uses an Extensible Authentication Protocol (EAP) framework, which allows for more advanced authentication methods such as username and password, digital certificates, or token-based authentication. By requiring users to authenticate using stronger credentials, WPA-EAP makes it significantly more difficult for unauthorized devices to gain access to the wireless network through brute force attacks on the PSK.

While options like BPDU guard (A), IP filtering (C), and a WIDS (Wireless Intrusion Detection System) (D) may provide additional security measures, implementing WPA-EAP is specifically targeted at strengthening authentication for wireless access, making it the most effective solution for preventing unauthorized access via brute force attacks on the PSK.

It’s not WIDS (Wireless Intrusion Detection System). A WIDS monitors the radio spectrum for the presence of unauthorized, rogue access points and the use of wireless attack tools. The system monitors the radio spectrum used by wireless LANs, and immediately alerts a systems administrator whenever a rogue access point is detected. Conventionally it is achieved by comparing the MAC address of the participating wireless devices.

Rogue devices can spoof MAC address of an authorized network device as their own. New research uses fingerprinting approach to weed out devices with spoofed MAC addresses. The idea is to compare the unique signatures exhibited by the signals emitted by each wireless device against the known signatures of pre-authorized, known wireless devices.

Brain dump, ChatGPT :
D. A WIDS (Wireless Intrusion Detection System).

Here’s why WIDS is the best choice in this scenario:

WIDS (Wireless Intrusion Detection System): A WIDS monitors the wireless airspace for unauthorized access points, rogue devices, and potential attacks. It can detect anomalies such as brute force attempts on the wireless PSK or the presence of unauthorized devices attempting to connect to the network. By monitoring and analyzing wireless traffic, a WIDS can alert network administrators to suspicious activities and potential security breaches, allowing for prompt action to mitigate threats.

Let’s briefly review why the other options are less suitable in this context:

A. BPDU guard: BPDU guard is used to protect against spanning tree protocol (STP) attacks in Ethernet networks and is not directly related to wireless network security or preventing unauthorized devices from connecting.

B. WPA-EAP: WPA-EAP (Wi-Fi Protected Access - Extensible Authentication Protocol) provides stronger authentication mechanisms than a PSK, but it does not directly prevent unauthorized devices from attempting to brute force the PSK or gain access to the network.

C. IP filtering: IP filtering restricts traffic based on IP addresses and is not effective against unauthorized wireless devices attempting to brute force the PSK or gain access to the network.

Therefore, D. A WIDS is the best choice to help prevent unauthorized access and mitigate the risk posed by a script kiddie attempting to brute force the wireless PSK and gain access to the company’s internal network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

In the middle of a cyberattack, a security engineer removes the infected devices from the network and locks down all compromised accounts. In which of the following incident response phases is the security engineer currently operating?

A. Identification
B. Preparation
C. Lessons learned
D. Eradication
E. Recovery
F. Containment

A

F. Containment

Here’s why:

Containment: This phase focuses on limiting the scope and impact of the incident. Actions typically include isolating affected systems or networks, removing infected devices from the network, and implementing controls to prevent further spread of the attack. By removing infected devices and locking down compromised accounts, the security engineer is actively containing the incident and preventing it from spreading further within the network.

Identification: In the Identification phase, the incident is initially detected and characterized. This involves understanding the nature and extent of the incident, which precedes the containment phase.

Eradication: The Eradication phase involves permanently removing the cause of the incident from the environment. While removing infected devices is part of containment, eradication involves deeper actions to ensure the attack vector is completely eliminated.

Recovery: The Recovery phase focuses on restoring affected systems and services to normal operations after the incident has been contained and eradicated. This phase comes after containment and eradication efforts are successful.

Preparation and Lessons learned: These phases occur before and after the incident response process itself, involving preparing for incidents and improving future response based on lessons learned, respectively.

Therefore, based on the immediate actions described, the security engineer is currently in the Containment phase, actively isolating and preventing further spread of the cyberattack within the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

A network administrator would like to configure a site-to-site VPN utilizing IPSec. The administrator wants the tunnel to be established with data integrity, encryption, authentication, and anti-replay functions. Which of the following should the administrator use when configuring the VPN?

A. AH
B. EDR
C. ESP
D. DNSSEC

A

(Community : C 100%)

C. ESP (Encapsulating Security Payload) is the correct choice for a site-to-site VPN when you need encryption, authentication, data integrity, and anti-replay protection.

A. AH (Authentication Header) provides authentication and data integrity but does not offer encryption or anti-replay protection. It does not encrypt the payload.
B. EDR (Endpoint Detection and Response) is a security technology used for detecting and responding to advanced threats and breaches on endpoints (computers and servers). It’s not related to configuring VPNs.
D. DNSSEC (Domain Name System Security Extensions) is used to add security to the DNS by providing authentication and data integrity for DNS data. It’s not directly related to configuring VPNs with the specified requirements.

ChatGPT:
C. ESP (Encapsulating Security Payload)

Here’s why ESP is the correct choice:

ESP (Encapsulating Security Payload): ESP provides encryption, data integrity, authentication, and anti-replay protection for the IP packets being transmitted over the VPN tunnel. It is a core protocol within IPSec that ensures the confidentiality and integrity of the data being exchanged between the two VPN endpoints.

AH (Authentication Header): AH provides data integrity and authentication, but it does not provide encryption. It is typically used when confidentiality is not required but integrity and authentication are essential.

EDR (Endpoint Detection and Response): EDR is a security solution that monitors and responds to threats on endpoints. It is not related to configuring a site-to-site VPN with IPSec.

DNSSEC (Domain Name System Security Extensions): DNSSEC is a set of extensions to DNS that provide data integrity and authentication for DNS responses. It is not used for configuring VPNs with IPSec.

Therefore, C. ESP (Encapsulating Security Payload) is the protocol that the network administrator should use to ensure the VPN tunnel provides data integrity, encryption, authentication, and anti-replay functions as required.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

A security incident may have occurred on the desktop PC of an organization’s Chief Executive Officer (CEO). A duplicate copy of the CEO’s hard drive must be stored securely to ensure appropriate forensic processes and the chain of custody are followed. Which of the following should be performed to accomplish this task?

A. Install a new hard drive in the CEO’s PC, and then remove the old hard drive and place it in a tamper-evident bag.

B. Connect a write blocker to the hard drive. Then, leveraging a forensic workstation, utilize the dd command in a live Linux environment to create a duplicate copy.

C. Remove the CEO’s hard drive from the PC, connect to the forensic workstation, and copy all the contents onto a remote fileshare while the CEO watches.

D. Refrain from completing a forensic analysis of the CEO’s hard drive until after the incident is confirmed; duplicating the hard drive at this stage could destroy evidence.

A

B. Connect a write blocker to the hard drive. Then, leveraging a forensic workstation, utilize the dd command in a live Linux environment to create a duplicate copy.

Here’s why this option is correct:

Write blocker: A write blocker is a device that allows data to be read from a storage device (like a hard drive) without allowing data to be written back to it. This ensures that the original data on the CEO's hard drive remains unchanged during the duplication process, preserving its integrity for forensic examination.

Forensic workstation: Using a dedicated forensic workstation ensures that the duplication process is conducted in a controlled environment specifically designed for handling forensic evidence. This workstation should have appropriate software and tools for creating forensically sound duplicates.

dd command in a live Linux environment: The dd command is a low-level tool that can create bit-for-bit copies of data. Running dd in a live Linux environment ensures that the duplication process does not alter the original data and captures everything on the hard drive, including deleted files and unallocated space, which may be crucial for forensic analysis.

Let’s briefly review why the other options are not as suitable:

A. Install a new hard drive and place the old hard drive in a tamper-evident bag: This option involves removing the original hard drive and installing a new one, which alters the original configuration and data on the CEO's PC before duplicating. This could potentially affect the integrity of the evidence.

C. Copy all contents onto a remote fileshare while the CEO watches: This method does not use a write blocker and does not ensure that the data is forensically preserved. Additionally, involving the CEO during the duplication process may compromise the chain of custody.

D. Refrain from completing a forensic analysis until after confirming the incident: Delaying duplication and forensic analysis could lead to loss of crucial evidence or compromise the integrity of the investigation if the hard drive is tampered with or compromised further.

Therefore, B. Connect a write blocker to the hard drive and use the dd command in a live Linux environment is the best approach to securely store a duplicate copy of the CEO’s hard drive while preserving its integrity for forensic examination.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A security engineer at an offline government facility is concerned about the validity of an SSL certificate. The engineer wants to perform the fastest check with the least delay to determine if the certificate has been revoked. Which of the following would BEST meet these requirements?

A. RA
B. OCSP
C. CRL
D. CSR

A

B. OCSP (Online Certificate Status Protocol)

Here’s why OCSP is the most suitable choice:

OCSP (Online Certificate Status Protocol): OCSP provides real-time validation of the status of an SSL certificate. When a client (like a web browser) encounters an SSL certificate, it can query the OCSP responder to check if the certificate is still valid or if it has been revoked. This check happens instantly and does not require downloading large lists like Certificate Revocation Lists (CRLs).

RA (Registration Authority): The RA is responsible for verifying the identity of certificate requestors and typically does not handle certificate revocation checks directly.

CRL (Certificate Revocation List): CRLs contain a list of revoked certificates and must be periodically downloaded and checked against. They are not as fast as OCSP because they may require downloading a potentially large list.

CSR (Certificate Signing Request): A CSR is used during the process of requesting a new SSL certificate and is not related to checking the revocation status of an existing certificate.

Therefore, B. OCSP is the best choice for the security engineer at the offline government facility to quickly determine if an SSL certificate has been revoked, ensuring minimal delay and efficient certificate validation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

A security administrator needs to create a RAID configuration that is focused on high read speeds and fault tolerance. It is unlikely that multiple drives will fail simultaneously. Which of the following RAID configurations should the administrator use?

A. RAID 0
B. RAID 1
C. RAID 5
D. RAID 10

A

(Community : D73%, C 24%)
D. RAID 10
RAID 10 (also known as RAID 1+0) combines the benefits of RAID 1 (mirroring) and RAID 0 (striping). It offers high read speeds because data is striped across multiple drives, resulting in parallel read operations. Additionally, it provides fault tolerance by mirroring data across multiple drives. In a RAID 10 configuration, multiple drives can fail as long as they are not part of the same mirrored pair. This configuration offers both performance and redundancy, making it ideal for scenarios where both high read speeds and fault tolerance are priorities.

ChatGPT :
D. RAID 10

Here’s why RAID 10 fits the criteria:

RAID 10 (RAID 1+0): RAID 10 combines features of both RAID 1 (mirroring) and RAID 0 (striping). It provides high read speeds by striping data across multiple drives (like RAID 0), while also offering fault tolerance by mirroring each striped set onto another set of drives. This means that data is both striped and mirrored, providing redundancy against drive failures.

High read speeds: RAID 10 offers excellent read performance because data can be read from multiple drives simultaneously due to striping. This configuration is particularly efficient for read-heavy applications and environments where quick access to data is crucial.

Fault tolerance: RAID 10 can withstand the failure of multiple drives in the array as long as they are not part of the same mirrored pair. It requires a minimum of four drives and allows for the failure of one drive in each mirrored pair without data loss.

Let’s briefly review the other RAID configurations:

RAID 0: Provides striping without redundancy. It offers high read speeds but no fault tolerance. If one drive fails, all data in the array is lost.

RAID 1: Provides mirroring without striping. It offers fault tolerance by duplicating data across drives (two drives minimum), but read speeds are typically not as high as RAID 0 or RAID 10.

RAID 5: Provides striping with distributed parity. It offers good read speeds and fault tolerance through parity information distributed across all drives. However, the rebuild process can be intensive if a drive fails.

Therefore, considering the requirement for high read speeds and fault tolerance with minimal likelihood of simultaneous multiple drive failures, RAID 10 is the best choice among the options provided.

(Brain dump: C. RAID 5 )

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which of the following algorithms has the SMALLEST key size?

A. DES
B. Twofish
C. RSA
D. AES

A

A. DES (Data Encryption Standard)

Here’s why:

DES: Uses a key size of 56 bits. While historically significant, DES is now considered insecure for most applications due to its small key size, making it vulnerable to brute-force attacks.

Twofish: Supports key sizes up to 256 bits, making it more secure than DES.

RSA: A public-key encryption algorithm that typically uses key sizes of 1024 bits or larger for security, although smaller key sizes are also possible.

AES: Uses key sizes of 128, 192, or 256 bits. AES is widely used and considered secure for encrypting sensitive data.

Therefore, A. DES has the smallest key size among the algorithms listed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

During an incident response, a security analyst observes the following log entry on the web server:

GET http://www.companysite.com/product_info.php?show=../../../../etc/passwd HTTP/1.1 Host: www.companysite.com

Which of the following BEST describes the type of attack the analyst is experiencing?

A. SQL injection
B. Cross-site scripting
C. Pass-the-hash
D. Directory traversal

A

D. Directory Traversal or Path Traversal.

Directory Traversal: This attack occurs when an attacker tries to access files and directories that are outside the web server's root directory. In this case, the URL http://www.companysite.com/product_info.php?show=../../../../etc/passwd suggests that the attacker is attempting to navigate up the directory structure (../../..) to reach sensitive files (/etc/passwd).

Here’s why the other options are not correct:

A. SQL injection: Involves injecting SQL queries through web application inputs to manipulate the database. The provided log entry does not show any SQL query manipulation.

B. Cross-site scripting (XSS): Involves injecting malicious scripts into web pages viewed by other users. The log entry does not indicate scripting or injecting content into a web page.

C. Pass-the-hash: Refers to techniques used in credential theft where an attacker captures hashed credentials and uses them to authenticate without knowing the original password. This log entry does not relate to credential passing.

Therefore, based on the log entry provided, the type of attack the analyst is experiencing is Directory Traversal (or Path Traversal).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

A security audit has revealed that a process control terminal is vulnerable to malicious users installing and executing software on the system. The terminal is beyond end-of-life support and cannot be upgraded, so it is placed on a protected network segment. Which of the following would be MOST effective to implement to further mitigate the reported vulnerability?

A. DNS sinkholing
B. DLP rules on the terminal
C. An IP blacklist
D. Application whitelisting

A

D. Application whitelisting.

Here’s why application whitelisting is the best choice:

Application Whitelisting: This approach allows only approved, known applications to run on the system. By explicitly listing and allowing only authorized software to execute, any attempt by malicious users to install and run unauthorized software would be blocked automatically. This is especially crucial for systems like process control terminals where maintaining a strict control over software execution is paramount for security.

Let’s briefly review the other options:

A. DNS sinkholing: DNS sinkholing is a technique used to redirect malicious domain queries to a controlled server. While useful for handling certain types of malicious activities, it does not directly prevent unauthorized software installation and execution on the terminal.

B. DLP (Data Loss Prevention) rules on the terminal: DLP rules focus on preventing sensitive data from leaving the network. While important for data protection, they do not address the core issue of unauthorized software installation and execution on the terminal.

C. An IP blacklist: IP blacklisting can block communication with known malicious IP addresses, but it does not prevent local software execution or installation on the terminal.

Therefore, D. Application whitelisting is the most effective measure to implement in this scenario to mitigate the risk posed by unauthorized software installation and execution on the vulnerable process control terminal.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

A document that appears to be malicious has been discovered in an email that was sent to a company’s Chief Financial Officer (CFO). Which of the following would be BEST to allow a security analyst to gather information and confirm it is a malicious document without executing any code it may contain?

A. Open the document on an air-gapped network.
B. View the document’s metadata for origin clues.
C. Search for matching file hashes on malware websites.
D. Detonate the document in an analysis sandbox.

A

Community : C 55%, D 25%, B 20%
Everyone can change the metadata of a file. B is wrong
“without executing any code it may contain” which means A and D is automatically wrong.
B wouldn’t tell you directly anything about the document
C if you compare the document with hashes and it matches with a known malware, then you know if it is a malware

ChatGPT and Braindump :
D. Detonate the document in an analysis sandbox.

Here’s why this option is the most suitable:

Analysis Sandbox: An analysis sandbox is a controlled environment designed to execute and observe the behavior of potentially malicious files or software in a safe manner. It isolates the document from the production environment, ensuring that any malicious activities it might attempt do not affect real systems. Security analysts can monitor the sandbox to observe the document's behavior, such as network connections it tries to establish, files it tries to access, or processes it attempts to start.

Let’s briefly review the other options:

A. Open the document on an air-gapped network: While an air-gapped network provides isolation from the internet, it does not provide the level of controlled analysis and observation that a dedicated analysis sandbox offers. Opening the document on an air-gapped network could still expose the network to potential risks.

B. View the document's metadata for origin clues: Examining metadata can provide some clues about the document's origin, but it does not confirm whether the document contains malicious code or what actions it might perform if opened.

C. Search for matching file hashes on malware websites: Checking file hashes on malware databases or websites can indicate if the document has been previously identified as malicious, but it does not provide real-time analysis or confirm the specific behavior of the document.

Therefore, D. Detonate the document in an analysis sandbox is the best option to safely gather information and confirm if the document is malicious without risking the security of the CFO’s computer or the company’s network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

A security analyst has received an alert about PII being sent via email. The analyst’s Chief Information Security Officer (CISO) has made it clear that PII must be handled with extreme care. From which of the following did the alert MOST likely originate?

A. S/MIME
B. DLP
C. IMAP
D. HIDS

A

B. DLP (Data Loss Prevention).

Here’s why:

DLP (Data Loss Prevention): DLP solutions are designed to monitor and prevent sensitive data like PII from being sent outside the organization through various channels, including email. They can detect patterns or keywords that indicate the presence of sensitive information in emails and trigger alerts or take actions (such as blocking or quarantining the email) based on predefined policies.

S/MIME (Secure/Multipurpose Internet Mail Extensions): S/MIME is a standard for public key encryption and signing of MIME data. It enhances the security and authenticity of emails but does not specifically detect or prevent the transmission of PII.

IMAP (Internet Message Access Protocol): IMAP is a protocol used by email clients to retrieve messages from a mail server. It facilitates email access but is not directly related to monitoring or detecting PII in emails.

HIDS (Host-based Intrusion Detection System): HIDS monitors activities on individual hosts to detect suspicious behavior or signs of intrusion. While it may detect certain types of unauthorized access or actions on a host, it does not specifically monitor email content or PII transmission.

Therefore, considering the requirement to handle PII with extreme care and the nature of the alert about PII being sent via email, B. DLP (Data Loss Prevention) is the most likely source of the alert. DLP solutions are specifically designed to monitor and prevent the unauthorized transmission of sensitive data, such as PII, through email and other channels.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

A company has drafted an insider-threat policy that prohibits the use of external storage devices. Which of the following would BEST protect the company from data exfiltration via removable media?

A. Monitoring large data transfer transactions in the firewall logs
B. Developing mandatory training to educate employees about the removable media policy
C. Implementing a group policy to block user access to system files
D. Blocking removable-media devices and write capabilities using a host-based security tool

A

D. Blocking removable-media devices and write capabilities using a host-based security tool.

Here’s why this option is the best choice:

Blocking Removable-Media Devices: By using a host-based security tool, the company can enforce policies that block access to removable-media devices such as USB drives, external hard drives, and optical discs. Additionally, the tool can prevent unauthorized writing or copying of data to these devices. This approach directly addresses the insider-threat policy by physically preventing employees from using external storage devices to exfiltrate data.

Let’s briefly review the other options:

A. Monitoring large data transfer transactions in the firewall logs: While monitoring can detect unusual or large data transfers, it may not prevent data exfiltration via removable media if employees can bypass network-based controls by using physical storage devices.

B. Developing mandatory training to educate employees about the removable media policy: Training is important for policy awareness, but it relies on employee compliance and does not physically prevent data exfiltration via removable media.

C. Implementing a group policy to block user access to system files: This restricts access to system files but does not address the use of removable media directly.

Therefore, D. Blocking removable-media devices and write capabilities using a host-based security tool is the most effective measure to enforce the insider-threat policy and mitigate the risk of data exfiltration via external storage devices.

22
Q

After a ransomware attack, a forensics company needs to review a cryptocurrency transaction between the victim and the attacker. Which of the following will the company MOST likely review to trace this transaction?

A. The public ledger
B. The NetFlow data
C. A checksum
D. The event log

A

A. The public ledger.

Here’s why:

Public Ledger (Blockchain): Cryptocurrencies like Bitcoin and Ethereum use a decentralized public ledger (blockchain) that records all transactions. These transactions are transparent and can be accessed and audited by anyone. Each transaction includes details such as the amount transferred, sender's address, recipient's address, and timestamp. By reviewing the blockchain, the forensics company can trace the specific transaction associated with the ransom payment from the victim to the attacker.

Let’s briefly review the other options:

B. NetFlow data: NetFlow data provides information about network traffic flow and volume. While it can be useful for understanding network activity, it does not directly provide information about cryptocurrency transactions.

C. Checksum: A checksum is a hash value used to verify data integrity. It is not relevant for tracing cryptocurrency transactions.

D. Event log: Event logs typically record activities and events within a system or network. They may capture information related to the ransomware attack itself but do not provide details about cryptocurrency transactions.

Therefore, A. The public ledger (blockchain) is the correct answer as it provides the transparent and auditable record necessary to trace the cryptocurrency transaction involved in the ransom payment.

23
Q

A network administrator is setting up wireless access points in all the conference rooms and wants to authenticate devices using PKI. Which of the following should the administrator configure?

A. A captive portal
B. PSK
C. 802.1X
D. WPS

A

C. 802.1X

Here’s why 802.1X is the correct choice:

802.1X: This is an IEEE standard for network access control that provides port-based authentication using EAP (Extensible Authentication Protocol). It is commonly used for authenticating devices in enterprise networks, including wireless networks. With 802.1X, devices authenticate themselves to the network using digital certificates issued by a trusted Certificate Authority (CA) as part of a PKI infrastructure. This ensures strong authentication and secure access to the network.

Let’s briefly review the other options:

A. Captive portal: A captive portal is a web page that users must interact with before being granted access to the network. It typically requires users to enter credentials or accept terms of use, but it does not use PKI for device authentication.

B. PSK (Pre-Shared Key): PSK is a simpler authentication method where all devices share the same secret key. It does not involve PKI or certificate-based authentication.

D. WPS (Wi-Fi Protected Setup): WPS is a method for simplifying the process of connecting devices to a wireless network, often using a PIN or a button press. It does not provide PKI-based authentication.

Therefore, C. 802.1X is the appropriate choice for setting up wireless access points in conference rooms to authenticate devices using PKI, ensuring robust security and controlled access to the network.

24
Q

A security analyst is reviewing the following attack log output:

user comptia\john.smith attempted login with the password password123
user comptia\jane.doe attempted login with the password password123
user comptia\user.one attempted login with the password password123
user comptia\user.two attempted login with the password password123
user comptia\user.three attempted login with the password password123

user comptia\john.smith attempted login with the password password234
user comptia\jane.doe attempted login with the password password234
user comptia\user.one attempted login with the password password234
user comptia\user.two attempted login with the password password234
user comptia\user.three attempted login with the password password234

Which of the following types of attacks does this MOST likely represent?

A. Rainbow table
B. Brute-force
C. Password-spraying
D. Dictionary

A

C. Password-spraying.

Here’s why:

Password-spraying: In a password-spraying attack, attackers attempt to access multiple accounts using commonly used passwords or a small set of passwords across many accounts. This method avoids triggering automated account lockouts that may occur with traditional brute-force attacks, where multiple passwords are tried against a single account.

In the provided log:

Multiple users (john.smith, jane.doe, user.one, user.two, user.three) are attempting to log in with the same passwords ("password123" and "password234").
This pattern suggests that the attackers are trying these common passwords across multiple user accounts within the "comptia" domain.

Brute-force attack involves systematically trying all possible combinations of passwords until the correct one is found. This log does not show systematic attempts of different passwords but rather repetitive attempts with a small set of passwords.

Dictionary attack typically involves trying a list of commonly used passwords or words from a dictionary. Password-spraying is a form of dictionary attack where the same passwords are tried against multiple accounts, rather than trying many different passwords against one account.

Rainbow table attack involves precomputed hashes of passwords and is not evident from the log provided.

Therefore, based on the repeated attempts with common passwords across multiple accounts, C. Password-spraying is the most appropriate classification for the type of attack shown in the log.

25
Q

An organization has hired a security analyst to perform a penetration test. The analyst captures 1Gb worth of inbound network traffic to the server and transfers the pcap back to the machine for analysis. Which of the following tools should the analyst use to further review the pcap?

A. Nmap
B. cURL
C. Netcat
D. Wireshark

A

D. Wireshark.

Here’s why Wireshark is the appropriate choice:

Wireshark: Wireshark is a widely used network protocol analyzer that allows detailed inspection of captured network packets. It provides a graphical interface to interactively browse the pcap file, analyze network traffic, filter packets based on various criteria (e.g., source, destination, protocol), and extract valuable information such as payload contents, headers, and timestamps. It is specifically designed for in-depth packet analysis and is ideal for tasks like examining traffic patterns, identifying anomalies, and detecting potential security issues during penetration testing.

Let’s briefly review the other options:

A. Nmap: Nmap is a network scanning tool used for discovering hosts and services on a computer network. It is not designed for packet capture analysis like Wireshark.

B. cURL: cURL is a command-line tool for transferring data with URLs. It is used for making HTTP requests and does not analyze pcap files.

C. Netcat: Netcat (nc) is a versatile networking tool used for reading from and writing to network connections using TCP or UDP. It is not primarily used for pcap analysis.

Therefore, D. Wireshark is the correct tool for the security analyst to use to further review and analyze the pcap file captured during the penetration test.

26
Q

An organization that is located in a flood zone is MOST likely to document the concerns associated with the restoration of IT operations in a:

A. business continuity plan.
B. communications plan.
C. disaster recovery plan.
D. continuity of operations plan.

A

C. disaster recovery plan.

Here’s why:

Disaster Recovery Plan (DRP): A disaster recovery plan specifically outlines the procedures and strategies for recovering IT systems and infrastructure after a disruptive event, such as a flood. It includes detailed steps for restoring data, applications, hardware, and networks to minimize downtime and ensure business continuity. Given the potential impact of a flood on IT operations, including damage to hardware, data loss, and infrastructure disruption, a DRP is crucial for guiding the organization's response and recovery efforts.

While other plans like a business continuity plan (BCP) and continuity of operations plan (COOP) also play important roles in overall resilience and continuity planning, they may focus more broadly on organizational functions and operations beyond IT-specific considerations.

Therefore, C. disaster recovery plan is the plan where concerns associated with the restoration of IT operations in the event of a flood would typically be documented.

27
Q

Which of the following should a security administrator adhere to when setting up a new set of firewall rules?

A. Disaster recovery plan
B. Incident response procedure
C. Business continuity plan
D. Change management procedure

A

D. Change management procedure.

Here’s why:

Change Management Procedure: Change management procedures are protocols and guidelines that govern how changes to IT systems, including firewall configurations, are planned, tested, approved, implemented, and documented. Adhering to change management procedures ensures that firewall rule changes are carefully considered, properly authorized, and implemented without causing disruptions or introducing vulnerabilities into the network environment. It helps maintain the security and stability of the network by ensuring that changes are controlled and tracked.

While disaster recovery plans, incident response procedures, and business continuity plans are all critical aspects of overall security and operational resilience, they specifically focus on responding to and recovering from incidents and ensuring continuous business operations rather than directly governing the process of making changes to firewall rules.

Therefore, D. Change management procedure is the correct procedure for a security administrator to follow when setting up new firewall rules to ensure proper oversight, control, and documentation of changes.

28
Q

During an engagement, penetration testers left USB keys that contained specially crafted malware in the company’s parking lot. A couple days later, the malware contacted the command-and-control server, giving the penetration testers unauthorized access to the company endpoints. Which of the following will most likely be a recommendation in the engagement report?

A. Conduct an awareness campaign on the usage of removable media.
B. Issue a user guidance program focused on vishing campaigns.
C. Implement more complex password management practices.
D. Establish a procedure on identifying and reporting suspicious messages.

A

A. Conduct an awareness campaign on the usage of removable media.

Here’s why:

Awareness Campaign on Removable Media: The incident highlights a significant security risk posed by removable media (USB keys) that were left in the parking lot and subsequently used to introduce malware into the company's environment. An awareness campaign would educate employees about the risks associated with using untrusted or unknown removable media, such as USB drives found in public places. It would emphasize the importance of not inserting such devices into work computers and reporting them to IT/security personnel immediately.

Other Options Analysis:
    B. User Guidance Program on Vishing Campaigns: Vishing (voice phishing) typically involves social engineering via phone calls, not directly related to the USB drive incident.
    C. More Complex Password Management Practices: While important, complex password management alone wouldn't address the specific incident involving USB keys and malware.
    D. Procedure on Identifying and Reporting Suspicious Messages: This relates more to email and other message-based threats, not specifically to the introduction of malware via USB keys.

Therefore, A. Conduct an awareness campaign on the usage of removable media is the recommendation that directly addresses the incident and helps mitigate similar risks in the future by raising awareness among employees about the dangers of using untrusted removable media.

29
Q

A company recently experienced a significant data loss when proprietary information was leaked to a competitor. The company took special precautions by using proper labels; however, email filter logs do not have any record of the incident. An investigation confirmed the corporate network was not breached, but documents were downloaded from an employee’s COPE tablet and passed to the competitor via cloud storage.
Which of the following is the best mitigation strategy to prevent this from happening in the future?

A. User training
B. CASB
C. MDM
D. EDR

A

B. CASB (Cloud Access Security Broker).

Here’s why CASB is the most suitable option:

CASB (Cloud Access Security Broker): CASB solutions provide visibility and control over cloud applications and data. They can enforce policies regarding data sharing, access, and usage within cloud storage services. In this case, a CASB could have monitored and controlled the transfer of sensitive documents from the COPE tablet to unauthorized cloud storage services. CASBs can detect anomalies, enforce encryption, prevent unauthorized sharing, and provide auditing and logging capabilities to track data movements across cloud environments.

Other Options Analysis:
    A. User Training: While user training is important, it may not prevent deliberate or accidental data leaks via personal cloud storage if technical controls are lacking.
    C. MDM (Mobile Device Management): MDM focuses on managing mobile devices, including security and policy enforcement. However, it may not directly control data once it leaves the device and enters cloud storage.
    D. EDR (Endpoint Detection and Response): EDR is focused on detecting and responding to threats on endpoints. It may not provide direct control over data transferred to cloud services.

Therefore, B. CASB (Cloud Access Security Broker) is the best mitigation strategy in this scenario to prevent unauthorized data leaks via cloud storage by enforcing policies and monitoring data movements effectively.

30
Q

A manufacturing organization wants to control and monitor access from the internal business network to the segregated production network, while ensuring minimal exposure of the production network to devices. Which of the following solutions would best accomplish this goal?

A. Proxy server
B. NGFW
C. WAF
D. Jump server

A

D. Jump server
Reasoning:

Jump server:
    A jump server (also known as a jump box or bastion host) acts as a secure gateway between two networks. It allows controlled access to the production network from the internal business network by requiring users to first authenticate on the jump server before accessing any resources in the production network. This setup limits direct access to the production network, thereby minimizing its exposure to potential threats from the internal network. Additionally, a jump server can be configured to monitor and log all access and activities, providing an additional layer of security and auditability.

Evaluation of Other Options:

Proxy server:
    A proxy server can control and monitor access to certain services and websites by acting as an intermediary. However, it is generally not designed to provide the fine-grained access control and logging necessary for secure interactions between a business and a production network.

NGFW (Next-Generation Firewall):
    An NGFW can provide advanced security features like deep packet inspection, intrusion prevention, and application-level filtering. While it can control and monitor traffic between networks, it might be overkill and more complex than needed for this specific use case. NGFWs are typically used for broader network security purposes.

WAF (Web Application Firewall):
    A WAF is designed to protect web applications by filtering and monitoring HTTP/HTTPS traffic between a web application and the internet. It is not suitable for controlling and monitoring access between an internal business network and a segregated production network.

Conclusion:

A jump server (Option D) is specifically designed for controlling and monitoring access between different network segments, making it the best choice for securely managing access between an internal business network and a segregated production network with minimal exposure.

31
Q

Which of the following roles, according to the shared responsibility model, is responsible for securing the company’s database in an IaaS model for a cloud environment?

A. Client
B. Third-party vendor
C. Cloud provider
D. OBA

A

A. Client
Explanation:

Client:
    In an IaaS model, the cloud provider supplies the basic infrastructure, such as virtual machines, storage, and networks. The client (or customer) is responsible for managing and securing everything that runs on this infrastructure, including the operating systems, applications, and databases. This means the client is responsible for database security measures such as access control, encryption, patch management, and backup.

Evaluation of Other Options:

Third-party vendor:
    While third-party vendors can provide tools and services to help secure a database, the ultimate responsibility for securing the database lies with the client. The client must ensure that any third-party tools are properly configured and maintained.

Cloud provider:
    The cloud provider is responsible for the security of the underlying infrastructure, including the physical security of data centers, hardware, and the virtualization layer. They ensure the infrastructure is secure and available, but the responsibility for securing the data and applications on top of that infrastructure lies with the client.

OBA (Organization-Based Access):
    This is not a standard role in the shared responsibility model. The term might refer to a type of access control or policy, but it is not directly responsible for the overall security of a database.

Conclusion:

In an IaaS model, the client is responsible for securing the company’s database.

32
Q

Which of the following tools can assist with detecting an employee who has accidentally emailed a file containing a customer’s PII?

A. SCAP
B. NetFlow
C. Antivirus
D. DLP

A

D. DLP (Data Loss Prevention).

Here’s why:

DLP (Data Loss Prevention): DLP solutions are designed to monitor and control the movement of sensitive data within an organization. They can detect when sensitive information, such as PII, is being transmitted via email, web applications, or other channels. DLP solutions use policies to identify and prevent unauthorized transmission of sensitive data, including accidental leaks. They can inspect email content, attachments, and metadata to enforce security policies and prevent data breaches.

Other Options Analysis:
    A. SCAP (Security Content Automation Protocol): SCAP is a standardized framework for maintaining the security of enterprise systems. It includes specifications for security-related information, but it does not specifically focus on detecting or preventing accidental data leaks.
    B. NetFlow: NetFlow is a network protocol used for monitoring and collecting IP traffic information. While it can provide insights into network traffic patterns, it is not specifically designed for detecting or preventing data leaks.
    C. Antivirus: Antivirus software is designed to detect and remove malware from systems, but it does not have the capability to monitor or prevent accidental data leaks such as emailing PII.

Therefore, D. DLP (Data Loss Prevention) is the tool that organizations typically use to detect and prevent accidental transmission of sensitive data, such as PII, via email or other channels.

33
Q

A bank insists all of its vendors must prevent data loss on stolen laptops. Which of the following strategies is the bank requiring?

A. Encryption at rest
B. Masking
C. Data classification
D. Permission restrictions

A

A. Encryption at rest.

Here’s why:

Encryption at Rest: This strategy involves encrypting data when it is stored on devices such as laptops, desktops, servers, and storage systems. If a laptop is stolen, encrypted data remains protected because it cannot be accessed without the encryption key. This mitigates the risk of unauthorized access to sensitive information even if the physical device is compromised.

Other Options Analysis:
    B. Masking: Masking involves hiding part of the data to prevent sensitive information exposure, but it is typically used in non-production environments or specific use cases like data analytics, not for securing data on stolen laptops.
    C. Data Classification: Data classification involves categorizing data based on its sensitivity and applying appropriate security controls. While important for overall data management and security, it doesn't specifically address protection against data loss on stolen laptops.
    D. Permission Restrictions: This involves controlling access to data based on user roles and permissions, but it doesn't inherently protect data on stolen laptops unless combined with encryption or other security measures.

Therefore, the bank’s requirement for vendors to implement encryption at rest on laptops ensures that sensitive data remains protected even if the device is lost or stolen.

34
Q

After a recent vulnerability scan, a security engineer needs to harden the routers within the corporate network.
Which of the following is the most appropriate to disable?

A. Console access
B. Routing protocols
C. VLANs
D. Web-based administration

A

D. Web-based administration
Explanation:

Web-based administration:
    Web-based administration interfaces are convenient but often come with significant security risks. They can be exploited if vulnerabilities are present, and they are frequently targeted by attackers. Disabling web-based administration reduces the attack surface and forces the use of more secure methods of router management, such as command-line interfaces (CLI) accessed via secure protocols like SSH.

Evaluation of Other Options:

Console access:
    Disabling console access is not recommended. Console access is crucial for managing and troubleshooting routers, especially if network issues prevent remote access. However, console access should be secured (e.g., with strong authentication methods and physical security measures).

Routing protocols:
    Routing protocols are essential for the router to perform its primary function of directing traffic. Disabling routing protocols would disrupt network operations. Instead, ensure routing protocols are configured securely (e.g., use authentication for routing updates).

VLANs:
    VLANs are a fundamental part of network segmentation and security. Disabling VLANs could lead to network segmentation issues and decreased security. Instead, ensure VLANs are configured correctly and securely.

Conclusion:

Disabling web-based administration is the most appropriate action to harden routers and reduce security vulnerabilities.

35
Q

A company requires hard drives to be securely wiped before sending decommissioned systems to recycling.
Which of the following best describes this policy?

A. Enumeration
B. Sanitization
C. Destruction
D. Inventory

A

B. Sanitization.

Sanitization refers to the process of removing data from storage devices such as hard drives, ensuring that the data cannot be retrieved using normal system functions or software tools. This process typically involves overwriting the entire storage space with random data or zeros multiple times to prevent any residual data from being recovered. Sanitization ensures that sensitive data is properly erased before the equipment is reused or recycled.

Enumeration refers to the process of listing or counting items, which is not directly related to securely wiping hard drives.
Destruction involves physically damaging or destroying the storage device to ensure data cannot be recovered, which is a more extreme measure compared to sanitization.
Inventory refers to keeping track of assets, which may include keeping records of decommissioned systems, but it does not directly relate to wiping hard drives.

Therefore, B. Sanitization is the best description of the policy where hard drives are wiped securely before recycling to ensure data security.

36
Q

An attacker posing as the Chief Executive Officer calls an employee and instructs the employee to buy gift cards. Which of the following techniques is the attacker using?

A. Smishing
B. Phishing
C. Impersonating
D. Vishing

A

(Community : D 74%, C 26%)
While “C. Impersonating” is indeed part of the attacker’s actions, it’s a more generic term for assuming someone else’s identity. In this specific scenario, the attacker is using vishing (voice phishing) to impersonate the Chief Executive Officer (CEO) over the phone, which is a type of social engineering attack where the voice is used to manipulate the employee into buying gift cards. So, “D. Vishing” more accurately describes the specific technique being employed in this situation

(ChatGPT)
D. Vishing.

Vishing (voice phishing) is a type of social engineering attack where attackers use phone calls or voice communication to manipulate individuals into divulging sensitive information or performing actions such as transferring funds, providing access credentials, or purchasing items like gift cards. In this case, the attacker is impersonating the CEO over the phone to trick the employee into buying gift cards, which is a form of vishing attack.

To summarize the other terms related to phishing:

Phishing typically refers to fraudulent emails or messages (e.g., through email, SMS) that attempt to deceive individuals into revealing sensitive information or performing actions.
Smishing is a specific type of phishing that occurs through SMS (text messages) instead of email.
Impersonating refers more broadly to pretending to be someone else, which can apply to various forms of social engineering attacks, including phishing and vishing.

Therefore, in this scenario, the correct answer is D. Vishing, as it involves using voice communication to deceive the employee.

(Brain dump: C. Impersonating)

37
Q

During the onboarding process, an employee needs to create a password for an intranet account. The password must include ten characters, numbers, and letters, and two special characters. Once the password is created, the company will grant the employee access to other company-owned websites based on the intranet profile. Which of the following access management concepts is the company most likely using to safeguard intranet accounts and grant access to multiple sites based on a user’s intranet account? (Choose two.)

A. Federation
B. Identity proofing
C. Password complexity
D. Default password changes
E. Password manager
F. Open authentication

A

A. Federation
C. Password complexity

Federation (Option A) allows the company to manage single sign-on (SSO) across multiple applications or websites. When an employee logs into the intranet with their credentials, federation enables them to seamlessly access other company-owned websites or applications without needing separate logins. This simplifies access management and enhances user experience.

Password complexity (Option C) is enforced during the password creation process for the intranet account. It requires the password to be at least ten characters long, include numbers and letters, and have two special characters. This helps safeguard the intranet accounts by ensuring that passwords are sufficiently strong and resistant to common brute-force attacks.

Therefore, the company is using federation to enable single sign-on across multiple sites based on the intranet profile, and password complexity to strengthen the security of intranet accounts.

38
Q

Which of the following best describes a use case for a DNS sinkhole?

A. Attackers can see a DNS sinkhole as a highly valuable resource to identify a company’s domain structure.
B. A DNS sinkhole can be used to draw employees away from known-good websites to malicious ones owned by the attacker.
C. A DNS sinkhole can be used to capture traffic to known-malicious domains used by attackers.
D. A DNS sinkhole can be set up to attract potential attackers away from a company’s network resources.

A

C. A DNS sinkhole can be used to capture traffic to known-malicious domains used by attackers.

Explanation:
A DNS sinkhole is a technique used in cybersecurity to intercept and redirect specific domain name lookup requests (DNS queries) to a controlled server. The primary purpose of a DNS sinkhole is to capture and analyze traffic destined for known malicious domains. By redirecting DNS queries for these domains to a sinkhole server, security teams can monitor and block connections to malicious infrastructure, thereby preventing systems within the network from communicating with known threats.

Option A is incorrect because a DNS sinkhole is typically used to block or redirect traffic to known malicious domains, not to reveal domain structure to attackers.
Option B is incorrect because the purpose of a DNS sinkhole is not to lure employees to malicious websites but rather to prevent access to them.
Option D is incorrect because a DNS sinkhole is not set up to attract attackers away from a network; its purpose is defensive, to block or redirect traffic from known malicious sources.

Therefore, option C is the best description of a use case for a DNS sinkhole in cybersecurity.

39
Q

Which of the following explains why an attacker cannot easily decrypt passwords using a rainbow table attack?

A. Digital signatures
B. Salting
C. Hashing
D. Perfect forward secrecy

A

B. Salting

Explanation:

Hashing (option C) is the process of converting plaintext passwords into a fixed-size string of characters using a mathematical algorithm. This is a crucial step in securely storing passwords.
Salting (option B) is an additional step where a unique, random value (the salt) is added to each password before hashing. This ensures that even if two users have the same password, their hashed values will be different due to the unique salt. Salting prevents the use of precomputed tables (like rainbow tables) because each password hash is effectively unique.
Digital signatures (option A) are used for verifying the authenticity and integrity of digital messages or documents, not for securing stored passwords.
Perfect forward secrecy (option D) is a property of certain key agreement protocols that ensures session keys are not compromised even if long-term keys are compromised. It is not directly related to password storage or protection.

Therefore, the reason why an attacker cannot easily decrypt passwords using a rainbow table attack is because of salting. Salting ensures that each password hash is unique, even if multiple users have the same password, thereby thwarting the effectiveness of precomputed hash tables like rainbow tables

40
Q

A company reduced the area utilized in its data center by creating virtual networking through automation and by creating provisioning routes and rules through scripting. Which of the following does this example describe?

A. IaC
B. MSSP
C. Containers
D. SaaS

A

A. IaC (Infrastructure as Code)

Explanation:

Infrastructure as Code (IaC) refers to the practice of managing and provisioning computing infrastructure through machine-readable definition files, rather than physical hardware configuration or interactive configuration tools. In the context of the given scenario:

Virtual networking through automation: This involves setting up and managing networking components (like virtual networks, subnets, routes) using scripts or automation tools rather than manually configuring them through console or UI.

Creating provisioning routes and rules through scripting: This indicates the automation of provisioning processes using scripts, which define how resources (such as virtual machines, storage, networking) are provisioned and configured.

These practices align with the principles of Infrastructure as Code, where infrastructure configurations are defined, managed, and automated through code or scripts. This approach provides benefits such as consistency, scalability, and agility in managing infrastructure resources.

Therefore, the scenario described in the question best fits under the concept of Infrastructure as Code (IaC).

41
Q

Historically, a company has had issues with users plugging in personally owned removable media devices into corporate computers. As a result, the threat of malware incidents is almost constant. Which of the following would best help prevent the malware from being installed on the computers?

A. AUP
B. NGFW
C. DLP
D. EDR

A

D. EDR (Endpoint Detection and Response)
Explanation:

EDR (Endpoint Detection and Response):
    EDR solutions provide continuous monitoring and response capabilities for endpoints. They can detect, investigate, and respond to potential security threats in real-time, including those introduced by removable media. EDR can help prevent malware from executing by detecting suspicious activity and automatically taking actions to mitigate threats.

Evaluation of Other Options:

A. AUP (Acceptable Use Policy):
    An AUP can define rules and expectations for acceptable use of corporate assets, including prohibiting the use of personal removable media. However, it relies on user compliance and does not provide a technical enforcement mechanism.

B. NGFW (Next-Generation Firewall):
    An NGFW can provide advanced network security features, including application awareness and control, but it may not be able to directly prevent malware from removable media being installed on endpoints. It is more effective at controlling network traffic rather than local endpoint activities.

C. DLP (Data Loss Prevention):
    DLP solutions focus on preventing sensitive data from leaving the organization and can monitor and control data transfers. While DLP can help manage data transfers to and from removable media, it is not primarily designed to prevent malware infections.

Conclusion:

Implementing EDR (Endpoint Detection and Response) is the best option to prevent malware from being installed on corporate computers due to personally owned removable media devices, as it provides real-time monitoring and response capabilities at the endpoint level.

42
Q

While investigating a recent security breach, an analyst finds that an attacker gained access by SQL injection through a company website. Which of the following should the analyst recommend to the website developers to prevent this from reoccurring?

A. Secure cookies
B. Input sanitization
C. Code signing
D. Blocklist

A

B. Input sanitization.

Explanation:

SQL injection is a type of attack where malicious SQL queries are inserted into input fields of a web application, exploiting vulnerabilities in the application’s code that improperly handles user input. Input sanitization is a process that ensures user input is filtered and validated before being processed by the application. This involves:

Filtering: Allowing only expected characters and patterns in user input.
Validation: Checking input against expected formats, such as ensuring numeric input is numeric and not malicious code.

By implementing rigorous input sanitization techniques, developers can significantly reduce the risk of SQL injection attacks. This approach ensures that any user-supplied data is treated as data rather than executable code, thereby preventing attackers from injecting SQL commands that manipulate the database.

Secure cookies (A) are used to protect session data in transit between the client and server, but they do not directly prevent SQL injection attacks.

Code signing (C) is used to verify the integrity and authenticity of software code, but it does not prevent SQL injection attacks.

Blocklist (D) approaches involve maintaining lists of known malicious inputs to block, but they are less effective than input sanitization because they can miss new or unknown attack patterns.

Therefore, B. Input sanitization is the most effective measure to recommend for preventing SQL injection attacks on the company website.

43
Q

Which of the following best describes the risk that is present once mitigations are applied?

A. Control risk
B. Residual risk
C. Inherent risk
D. Risk awareness

A

B. Residual risk best describes the risk that remains once mitigations are applied.

Explanation:

Control risk (A): This refers to the risk that a company's internal controls will fail to prevent or detect errors or fraud. It is not specifically related to the remaining risk after mitigations.
Residual risk (B): This is the risk that remains after all mitigation efforts and controls have been applied. It represents the remaining exposure that the organization must manage or accept.
Inherent risk (C): This is the level of risk that exists before any controls or mitigations are put in place. It reflects the natural level of risk present in a process or activity.
Risk awareness (D): This refers to the understanding and recognition of risks by the organization's stakeholders. It is a state of knowledge, not a type of risk.

Therefore, residual risk accurately represents the risk that persists after mitigations have been implemented.

44
Q

A security architect at a large, multinational organization is concerned about the complexities and overhead of managing multiple encryption keys securely in a multicloud provider environment. The security architect is looking for a solution with reduced latency to allow the incorporation of the organization’s existing keys and to maintain consistent, centralized control and management regardless of the data location. Which of the following would best meet the architect’s objectives?

A. Trusted Platform Module
B. IaaS
C. HSMaaS
D. PaaS

A

C. HSMaaS (Hardware Security Module as a Service) would best meet the architect’s objectives.

Explanation:

Trusted Platform Module (TPM) (A): TPM is a hardware-based security device used for securing hardware through integrated cryptographic keys. While it provides strong security, it is not designed to manage multiple encryption keys across different cloud environments centrally.

IaaS (Infrastructure as a Service) (B): IaaS provides virtualized computing resources over the internet. While IaaS can be used to deploy HSMs, it does not inherently provide the key management capabilities required for this scenario.

HSMaaS (Hardware Security Module as a Service) (C): HSMaaS offers centralized, secure, and scalable key management. It allows organizations to incorporate their existing keys, manage multiple encryption keys across different cloud providers, and maintain consistent control. HSMaaS reduces latency and provides secure key management without the complexities of handling hardware directly.

PaaS (Platform as a Service) (D): PaaS provides a platform allowing customers to develop, run, and manage applications without the complexity of building and maintaining the underlying infrastructure. While PaaS can include security features, it does not specifically address centralized key management across multiple cloud providers.

Therefore, HSMaaS is the best choice to meet the architect’s objectives of securely managing multiple encryption keys across a multicloud environment with reduced latency and centralized control.

45
Q

Which of the following best represents an application that does not have an on-premises requirement and is accessible from anywhere?

A. PaaS
B. Hybrid cloud
C. Private cloud
D. IaaS
E. SaaS

A

E. SaaS (Software as a Service) best represents an application that does not have an on-premises requirement and is accessible from anywhere.

Explanation:

PaaS (Platform as a Service) (A): PaaS provides a platform for developers to build, deploy, and manage applications without managing the underlying infrastructure. While PaaS can be accessed from anywhere, it is more about providing a platform for development rather than a complete, ready-to-use application.

Hybrid cloud (B): A hybrid cloud combines on-premises infrastructure with cloud services. While it offers flexibility, it still involves on-premises components and does not solely focus on applications accessible from anywhere without on-premises requirements.

Private cloud (C): A private cloud is dedicated to a single organization and can be hosted on-premises or by a third-party provider. It generally involves more control and security but may have on-premises requirements.

IaaS (Infrastructure as a Service) (D): IaaS provides virtualized computing resources over the internet, such as virtual machines, storage, and networking. It is more focused on providing infrastructure rather than specific applications accessible from anywhere.

SaaS (Software as a Service) (E): SaaS delivers software applications over the internet, eliminating the need for on-premises installation or maintenance. Users can access SaaS applications from any location with an internet connection, making it the best option for an application that does not require on-premises infrastructure and is accessible from anywhere.

Therefore, SaaS is the best representation of an application without on-premises requirements that is accessible from anywhere.

46
Q

During an investigation, events from two affected servers in the same subnetwork occurred at the same time:
Server 1: 192.168.10.1 [01/Apr/2021:06:00:00 PST] SAN access denied for user ‘admin’
Server 2: 192.168.10.6 [01/Apr/2021:06:01:01 CST] SAN access successful for user ‘admin’
Which of the following should be consistently configured to prevent the issue seen in the logs?

A. Geolocation
B. TOTP
C. NTP
D. MFA

A

C. NTP (Network Time Protocol)

Explanation:

The issue seen in the logs is that the events from the two servers occurred at different times, even though they are supposed to have happened simultaneously. This discrepancy is likely due to the servers not being synchronized to the same time standard.

NTP (Network Time Protocol) (C): NTP is used to synchronize the clocks of computers to a reference time source. Ensuring all servers and network devices are synchronized to the same time source would prevent the discrepancies in log times, making it easier to correlate events and conduct investigations.

Geolocation (A): Geolocation determines the physical location of a device based on its IP address or other location-based services. This does not address the issue of time discrepancies.

TOTP (Time-based One-Time Password) (B): TOTP is an algorithm that generates a one-time password based on the current time. While it is useful for authentication, it does not address time synchronization between servers.

MFA (Multi-Factor Authentication) (D): MFA requires multiple forms of verification before granting access. While it enhances security, it does not address the issue of synchronizing server times.

Therefore, configuring NTP would be the appropriate solution to ensure that all servers have consistent time settings, preventing the issue seen in the logs.

47
Q

The most recent vulnerability scan flagged the domain controller with a critical vulnerability. The systems administrator researched the vulnerability and discovered the domain controller does not run the associated application with the vulnerability. Which of the following steps should the administrator take next?

A. Ensure the scan engine is configured correctly.
B. Apply a patch to the domain controller.
C. Research the CVE.
D. Document this as a false positive.

A

Community : D. Document this as a false positive (98%)

False Positive: This is a result that indicates a given condition has been fulfilled when it actually has not been fulfilled. In this case, the vulnerability scan flagged a critical vulnerability on the domain controller, but the administrator discovered that the domain controller does not run the associated application with the vulnerability. This indicates that the vulnerability alert is likely a false positive

Braindump & ChatGPT
A. Ensure the scan engine is configured correctly.

Before taking any further actions like applying patches or documenting it as a false positive, it's crucial to verify that the scan engine and its configuration are correct. Misconfigurations can lead to incorrect vulnerability reports. Ensuring the scan engine is accurate helps avoid future false positives and ensures that the vulnerability reports are reliable.

B. Apply a patch to the domain controller.
This step is unnecessary if the vulnerability doesn't apply to the domain controller. Patching should be based on the relevance of the vulnerability.

C. Research the CVE.
While researching the CVE can provide more information, the administrator already determined that the domain controller doesn't run the associated application. Ensuring the scan engine's configuration is accurate should be prioritized.

D. Document this as a false positive.
This step can be taken after confirming that the scan engine is correctly configured and verifying that the vulnerability report was indeed a false positive.

Therefore, the most prudent next step is to ensure the scan engine is configured correctly to prevent future inaccurate vulnerability flags.

48
Q

A company has decided to move its operations to the cloud. It wants to utilize technology that will prevent users from downloading company applications for personal use, restrict data that is uploaded, and have visibility into which applications are being used across the company. Which of the following solutions will best meet these requirements?

A. An NGFW
B. A CASB
C. Application whitelisting
D. An NG-SWG

A

(ChatGPT & Community 92%)
B. A CASB

Explanation:

A CASB (Cloud Access Security Broker) is the best solution to meet the company’s requirements for the following reasons:

Preventing users from downloading company applications for personal use: A CASB can enforce policies that control how and when users access cloud applications, including restricting the download of applications to personal devices.

Restricting data that is uploaded: CASBs can monitor and control data being uploaded to cloud services, ensuring sensitive information is not improperly shared or stored.

Visibility into which applications are being used across the company: CASBs provide detailed visibility and analytics on cloud application usage, helping to monitor and manage the use of sanctioned and unsanctioned applications within the organization.

Other options do not comprehensively meet all these requirements:

A. An NGFW (Next-Generation Firewall): While an NGFW can provide some level of application control and security, it is not specifically designed for managing cloud application usage and data transfer the way a CASB is.

C. Application whitelisting: This approach controls which applications can run on a system but does not provide the broader cloud-specific visibility and data control features that a CASB offers.

D. An NG-SWG (Next-Generation Secure Web Gateway): An NG-SWG can provide web filtering and protection, but it does not offer the same level of cloud application management and data governance capabilities as a CASB.

Therefore, a CASB is the best solution to address the company’s specific needs related to cloud application usage, data control, and visibility.

(Brain dump: D. An NG-SWG)

49
Q

An internet company has created a new collaboration application. To expand the user base, the company wants to implement an option that allows users to log in to the application with the credentials of other popular websites. Which of the following should the company implement?

A. SSO
B. CHAP
C. 802.1x
D. OpenID

A

D. OpenID

Explanation:

OpenID is a protocol that enables users to authenticate using credentials from other popular websites (such as Google, Facebook, or others) to log in to a new application. This approach leverages existing authentication systems, making it easier for users to access the new collaboration application without creating new accounts.

A. SSO (Single Sign-On): SSO allows users to log in once and access multiple applications within the same organization, but it does not necessarily enable logging in with credentials from external websites.

B. CHAP (Challenge-Handshake Authentication Protocol): CHAP is an authentication protocol used mainly in PPP (Point-to-Point Protocol) connections to provide a way for the server to authenticate the client periodically during an ongoing session. It is not relevant to web-based application logins.

C. 802.1x: This is a network access control protocol used primarily for controlling access to wired and wireless networks. It is not related to web-based login systems.

OpenID is the best solution for enabling users to log in to the new collaboration application using credentials from other popular websites.

50
Q

Following a prolonged data center outage that affected web-based sales, a company has decided to move its operations to a private cloud solution. The security team has received the following requirements:
There must be visibility into how teams are using cloud-based services.
The company must be able to identify when data related to payment cards is being sent to the cloud.
Data must be available regardless of the end user’s geographic location.
Administrators need a single pane-of-glass view into traffic and trends.
Which of the following should the security analyst recommend?

A. Create firewall rules to restrict traffic to other cloud service providers.
B. Install a DLP solution to monitor data in transit.
C. Implement a CASB solution.
D. Configure a web-based content filter.

A

C. Implement a CASB solution.

Explanation:

CASB (Cloud Access Security Broker) solutions are designed to provide visibility into cloud service usage, enforce security policies, and ensure compliance with data protection requirements. Implementing a CASB solution would address the requirements mentioned:

Visibility into cloud-based service usage: CASB solutions offer detailed insights into how cloud services are being used across the organization.
Identifying payment card data: CASB can monitor data in transit and at rest for sensitive information, including payment card data, ensuring it is properly managed and protected.
Data availability regardless of location: CASB solutions facilitate secure access to cloud services from any location, maintaining data availability.
Single pane-of-glass view: CASB solutions provide a centralized dashboard that gives administrators a comprehensive view of cloud traffic, usage patterns, and security trends.

The other options do not comprehensively address all the stated requirements:

A. Create firewall rules to restrict traffic to other cloud service providers: This approach might help control traffic but does not provide the required visibility or data protection capabilities.
B. Install a DLP solution to monitor data in transit: While DLP can help protect sensitive data, it does not provide visibility into cloud service usage or a single pane-of-glass view.
D. Configure a web-based content filter: This may help control web access but does not offer the required insights into cloud service usage or comprehensive data protection.