676-700

Question 1

An organization that is located in a flood zone is MOST likely to document the concerns associated with the restoration of IT operations in a:

A. business continuity plan.
B. communications plan.
C. disaster recovery plan.
D. continuity of operations plan.

Answer 1

C. disaster recovery plan.

Question 2

Which of the following should a security administrator adhere to when setting up a new set of firewall rules?

A. Disaster recovery plan
B. Incident response procedure
C. Business continuity plan
D. Change management procedure

Answer 2

D. Change management procedure

Question 3

During an engagement, penetration testers left USB keys that contained specially crafted malware in the company’s parking lot. A couple days later, the malware contacted the command-and-control server, giving the penetration testers unauthorized access to the company endpoints. Which of the following will most likely be a recommendation in the engagement report?

A. Conduct an awareness campaign on the usage of removable media.
B. Issue a user guidance program focused on vishing campaigns.
C. Implement more complex password management practices.
D. Establish a procedure on identifying and reporting suspicious messages.

Answer 3

A. Conduct an awareness campaign on the usage of removable media.

Question 4

A company recently experienced a significant data loss when proprietary information was leaked to a competitor. The company took special precautions by using proper labels; however, email filter logs do not have any record of the incident. An investigation confirmed the corporate network was not breached, but documents were downloaded from an employee’s COPE tablet and passed to the competitor via cloud storage. Which of the following is the best mitigation strategy to prevent this from happening in the future?

A. User training
B. CASB
C. MDM
D. EDR

Answer 4

B. CASB

Question 5

A manufacturing organization wants to control and monitor access from the internal business network to the segregated production network, while ensuring minimal exposure of the production network to devices. Which of the following solutions would best accomplish this goal?

A. Proxy server
B. NGFW
C. WAF
D. Jump server

Answer 5

D. Jump server

Question 6

Which of the following roles, according to the shared responsibility model, is responsible for securing the company’s database in an IaaS model for a cloud environment?

A. Client
B. Third-party vendor
C. Cloud provider
D. OBA

Answer 6

A. Client

Question 7

Which of the following tools can assist with detecting an employee who has accidentally emailed a file containing a customer’s PII?

A. SCAP
B. NetFlow
C. Antivirus
D. DLP

Answer 7

D. DLP

Question 8

A bank insists all of its vendors must prevent data loss on stolen laptops. Which of the following strategies is the bank requiring?

A. Encryption at rest
B. Masking
C. Data classification
D. Permission restrictions

Answer 8

A. Encryption at rest

Question 9

After a recent vulnerability scan, a security engineer needs to harden the routers within the corporate network. Which of the following is the most appropriate to disable?

A. Console access
B. Routing protocols
C. VLANs
D. Web-based administration

Answer 9

D. Web-based administration

Question 10

A company requires hard drives to be securely wiped before sending decommissioned systems to recycling. Which of the following best describes this policy?

A. Enumeration
B. Sanitization
C. Destruction
D. Inventory

Answer 10

B. Sanitization

Question 11

An attacker posing as the Chief Executive Officer calls an employee and instructs the employee to buy gift cards. Which of the following techniques is the attacker using?

A. Smishing
B. Phishing
C. Impersonating
D. Vishing

Answer 11

D. Vishing

Question 12

Which of the following is a cryptographic concept that operates on a fixed length of bits?

A. Block cipher
B. Hashing
C. Key stretching
D. Salting

Answer 12

A. Block cipher

Question 13

Which of the following best describes a use case for a DNS sinkhole?

A. Attackers can see a DNS sinkhole as a highly valuable resource to identify a company’s domain structure.
B. A DNS sinkhole can be used to draw employees away from known-good websites to malicious ones owned by the attacker.
C. A DNS sinkhole can be used to capture traffic to known-malicious domains used by attackers.
D. A DNS sinkhole can be set up to attract potential attackers away from a company’s network resources.

Answer 13

C. A DNS sinkhole can be used to capture traffic to known-malicious domains used by attackers.

Question 14

Which of the following explains why an attacker cannot easily decrypt passwords using a rainbow table attack?

A. Digital signatures
B. Salting
C. Hashing
D. Perfect forward secrecy

Answer 14

B. Salting

Question 15

A company reduced the area utilized in its data center by creating virtual networking through automation and by creating provisioning routes and rules through scripting. Which of the following does this example describe?

A. IaC
B. MSSP
C. Containers
D. SaaS

Answer 15

A. IaC

Question 16

Historically, a company has had issues with users plugging in personally owned removable media devices into corporate computers. As a result, the threat of malware incidents is almost constant. Which of the following would best help prevent the malware from being installed on the computers?

A. AUP
B. NGFW
C. DLP
D. EDR

Answer 16

D. EDR

Question 17

Which of the following best describes the risk that is present once mitigations are applied?

A. Control risk
B. Residual risk
C. Inherent risk
D. Risk awareness

Answer 17

B. Residual risk

Question 18

A security architect at a large, multinational organization is concerned about the complexities and overhead of managing multiple encryption keys securely in a multicloud provider environment. The security architect is looking for a solution with reduced latency to allow the incorporation of the organization’s existing keys and to maintain consistent, centralized control and management regardless of the data location. Which of the following would best meet the architect’s objectives?

A. Trusted Platform Module
B. IaaS
C. HSMaaS
D. PaaS

Answer 18

C. HSMaaS

Question 19

Which of the following best represents an application that does not have an on-premises requirement and is accessible from anywhere?

A. PaaS
B. Hybrid cloud
C. Private cloud
D. IaaS
E. SaaS

Answer 19

E. SaaS

Question 20

During an investigation, events from two affected servers in the same subnetwork occurred at the same time:

Server 1: 192.168.10.1 [01/Apr/2021:06:00:00 PST] SAN access denied for user ‘admin’
Server 2: 192.168.10.6 [01/Apr/2021:06:01:01 CST] SAN access successful for user ‘admin’

Which of the following should be consistently configured to prevent the issue seen in the logs?

A. Geolocation
B. TOTP
C. NTP
D. MFA

Answer 20

C. NTP

Question 21

The most recent vulnerability scan flagged the domain controller with a critical vulnerability. The systems administrator researched the vulnerability and discovered the domain controller does not run the associated application with the vulnerability. Which of the following steps should the administrator take next?

A. Ensure the scan engine is configured correctly.
B. Apply a patch to the domain controller.
C. Research the CVE.
D. Document this as a false positive.

Answer 21

D. Document this as a false positive.

Question 22

A company has decided to move its operations to the cloud. It wants to utilize technology that will prevent users from downloading company applications for personal use, restrict data that is uploaded, and have visibility into which applications are being used across the company. Which of the following solutions will best meet these requirements?

A. An NGFW
B. A CASB
C. Application whitelisting
D. An NG-SWG

Answer 22

B. A CASB

Question 23

An internet company has created a new collaboration application. To expand the user base, the company wants to implement an option that allows users to log in to the application with the credentials of other popular websites. Which of the following should the company implement?

A. SSO
B. CHAP
C. 802.1x
D. OpenID

Answer 23

D. OpenID

Question 24

Following a prolonged data center outage that affected web-based sales, a company has decided to move its operations to a private cloud solution. The security team has received the following requirements:

• There must be visibility into how teams are using cloud-based services.
• The company must be able to identify when data related to payment cards is being sent to the cloud.
• Data must be available regardless of the end user’s geographic location.
• Administrators need a single pane-of-glass view into traffic and trends.

Which of the following should the security analyst recommend?

A. Create firewall rules to restrict traffic to other cloud service providers.
B. Install a DLP solution to monitor data in transit.
C. Implement a CASB solution.
D. Configure a web-based content filter.

Answer 24

C. Implement a CASB solution.

Question 25

Which of the following best describes the risk that is present once mitigations are applied?

A. Control risk
B. Residual risk
C. Inherent risk
D. Risk awareness

Answer 25

B. Residual risk