701 Q&A Flashcards
NO.1 After performing an assessment, an analyst wants to provide a risk rating for the findings. Which of the following concepts should most likely be considered when calculating the ratings?
Impact and likelihood
NO.2 A certificate vendor notified a company that recently invalidated certificates may need to be updated. Which of the following mechanisms should a security administrator use to determine whether the certificates installed on the company’s machines need to be updated?
CRL
NO.3 The CIRT is reviewing an incident that involved a human resources recruiter exfiltrating sensitive company data. The CIRT found that the recruiter was able to use HTTP over port 53 to upload documents to a web server.
Which of the following security infrastructure devices could have identified and blocked this activity?
NGFW utilizing application inspection
NO.4 A recent malware outbreak across a subnet included successful rootkit installations on many PCs, ensuring persistence by rendering remediation efforts ineffective. Which of the following would best detect the presence of a rootkit in the future?
EDR
NO.5 Malware spread across a company’s network after an employee visited a compromised industry blog. Which of the following best describes this type of attack?
Watering-hole
NO.6 A company hired a consultant to perform an offensive security assessment covering penetration testing and social engineering.
Which of the following teams will conduct this assessment activity?
Red
NO.7 A software development manager wants to ensure the authenticity of the code created by the company. Which of the following options is the most appropriate?
Performing code signing on company-developed software
NO.8 Which of the following would be used to detect an employee who is emailing a customer list to a personal account before leaving the company?
DLP (Data Loss Prevention)
NO.9 An organization’s internet-facing website was compromised when an attacker exploited a buffer overflow. Which of the following should the organization deploy to best protect against similar attacks in the future?
WAF (Web Application Firewall)
NO.10 Which of the following best practices gives administrators a set period to perform changes to an operational system to ensure availability and minimize business impacts?
Scheduled downtime
NO.11 Which of the following security concepts is being followed when implementing a product that offers protection against DDoS attacks?
Availability
NO.12 An organization experiences a cybersecurity incident involving a command-and-control server. Which of the following logs should be analyzed to identify the impacted host? (Choose two.)
Network
Firewall
NO.13 Which of the following is used to quantitatively measure the criticality of a vulnerability?
CVSS (Common Vulnerability Scoring System)
NO.14 A security engineer needs to configure an NGFW to minimize the impact of the increasing number of various traffic types during attacks. Which of the following types of rules is the engineer the most likely to configure?
Behavioral-based
NO.15 A company is discarding a classified storage array and hires an outside vendor to complete the disposal. Which of the following should the company request from the vendor?
Certification
NO.16 An organization recently updated its security policy to include the following statement: Regular expressions are included in source code to remove special characters such as $, |, ;. &,`, and ? from variables set by forms in a web application. Which of the following best explains the security technique the organization adopted by making this addition to the policy?
Input validation
NO.17 Which of the following vulnerabilities is associated with installing software outside of a manufacturer’s approved software repository?
Side loading
NO.18 A systems administrator is changing the password policy within an enterprise environment and wants this update implemented on all systems as quickly as possible. Which of the following operating system security measures will the administrator most likely use?
Pushing GPO update
NO.19 Which of the following is the most likely outcome if a large bank fails an internal PCI DSS compliance assessment?
Fines
NO. 20 Which of the following would be the best way to block unknown programs from executing ?
Application allow list
NO.21 A security analyst is reviewing alerts in the SIEM related to potential malicious network traffic coming from an employee’s corporate laptop. The security analyst has determined that additional data about the executable running on the machine is necessary to continue the investigation. Which of the following logs should the analyst use as a data source?
Endpoint
NO.22 An administrator was notified that a user logged in remotely after hours and copied large amounts of data to a personal device.
Which of the following best describes the user’s activity?
Insider threat
NO.23 A company tested and validated the effectiveness of network security appliances within the corporate network. The IDS detected a high rate of SQL injection attacks against the company’s servers, and the company’s perimeter firewall is at capacity. Which of the following would be the best action to maintain security and reduce the traffic to the perimeter firewall?
Set the appliance to IPS mode and place it in front of the company firewall.
NO.25 Which of the following penetration testing teams is focused only on trying to compromise an organization using an attacker’s tactics?
Red
NO. 24 (PBQ) Hotspot Question: You are a security administrator investigating a potential infection on a network.
TOP ROW
PC#1 - Origin & Infected
PC#2 - Clean
PC#3 - Infected
BOTTOM ROW:
PC#1 Clean
PC#2 Infected
NO.26 Which of the following is the best way to secure an on-site data center against intrusion from an insider?
Access badge
NO.27 A security consultant needs secure, remote access to a client environment. Which of the following should the security consultant most likely use to gain access?
IPSec
NO.28 A security architect at a large, multinational organization is concerned about the complexities and overhead of managing multiple encryption keys securely in a multicloud provider environment. The security architect is looking for a solution with reduced latency to allow the incorporation of the organization’s existing keys and to maintain consistent, centralized control and management regardless of the data location. Which of the following would best meet the architect’s objectives?
HSMaaS
HSM as a Service (HSMaaS), Hardware security modules (HSMs) are fortified, tamper-resistant hardware components that produce, safeguard, and manage keys for encrypting and decrypting data and establishing digital signatures and certificates.
NO.29 Which of the following practices would be best to prevent an insider from introducing malicious code into a company’s development process?
Peer review and approval
NO.30 Which of the following describes the reason root cause analysis should be conducted as part of incident response?
To prevent future incidents of the same nature
NO.31 A security analyst scans a company’s public network and discovers a host is running a remote desktop that can be used to access the production network. Which of the following changes should the security analyst recommend?
Setting up a VPN and placing the jump server inside the firewall
NO.32 A technician is opening ports on a firewall for a new system being deployed and supported by a SaaS provider. Which of the following is a risk in the new system?
Supply chain vendor
NO.33 A network manager wants to protect the company’s VPN by implementing multifactor authentication that uses:
- Something you know
- Something you have
- Something you are
Password, authentication token, thumbprint
NO.34 An IT manager informs the entire help desk staff that only the IT manager and the help desk lead will have access to the administrator console of the help desk software. Which of the following security techniques is the IT manager setting up?
Least privilege
NO.35 Which of the following can be used to identify potential attacker activities without affecting production servers?
Honey pot
NO.36 An enterprise is trying to limit outbound DNS traffic originating from its internal network. Outbound DNS requests will only be allowed from one device with the IP address 10.50.10.25. Which of the following firewall ACLs will accomplish this goal?
Access list outbound permit 10.50.10.25 32 0.0.0.0/0 port 53
Access list outbound deny 0.0.0.0.0.0.0.0.0/0 port 53
NO.37 A company’s public-facing website, https://www.organization.com, has an IP address of 166.18.75.6. However, over the past hour the SOC has received reports of the site’s homepage displaying incorrect information. A quick nslookup search shows https://www.organization.com is pointing to 151.191.122.115. Which of the following is occurring?
DNS spoofing
NO.38 A systems administrator uses a key to encrypt a message being sent to a peer in a different branch office. The peer then uses the same key to decrypt the message. Which of the following describes this example?
Symmetric
NO.39 Which of the following must be considered when designing a high-availability network? (Choose two).
Ease of recovery
Attack surface
NO.40 Which of the following would be most useful in determining whether the long-term cost to transfer a risk is less than the impact of the risk?
ALE (Annual Loss Expectancy)
NO.41An organization wants to limit potential impact to its log-in database in the event of a breach. Which of the following options is the security team most likely to recommend?
Hashing
NO.42 A network administrator is working on a project to deploy a load balancer in the company’s cloud environment. Which of the following fundamental security requirements does this project fulfill?
Availability
NO.43 An organization wants to ensure the integrity of compiled binaries in the production environment. Which of the following security measures would best support this objective?
Code signing
NO.44 An attacker posing as the Chief Executive Officer calls an employee and instructs the employee to buy gift cards. Which of the following techniques is the attacker using?
Impersonating
NO.45 Which of the following can best protect against an employee inadvertently installing malware on a company system?
Application allow list
NO.46 A company purchased cyber insurance to address items listed on the risk register. Which of the following strategies does this represent?
Transfer
NO.48 Which of the following is the phase in the incident response process when a security analyst reviews roles and responsibilities?
Preparation
Preparation is the phase in the incident response process when a security analyst reviews roles and responsibilities, as well as the policies and procedures for handling incidents.
NO.47 A company must ensure sensitive data at rest is rendered unreadable. Which of the following will the company most likely use?
Encryption
NO.49 An organization disabled unneeded services and placed a firewall in front of a business- critical legacy system. Which of the following best describes the actions taken by the organization?
Compensating controls
NO.50 Which of the following is a primary security concern for a company setting up a BYOD program?
Jailbreaking
NO.51 An administrator assists the legal and compliance team with ensuring information about customer transactions is archived for the proper time period. Which of the following data policies is the administrator carrying out?
Retention
NO.52 An employee receives a text message from an unknown number claiming to be the company’s Chief Executive Officer and asking the employee to purchase several gift cards. Which of the following types of attacks does this describe?
Smishing
NO.53 The local administrator account for a company’s VPN appliance was unexpectedly used to log in to the remote management interface. Which of the following would have most likely prevented this from happening?
Changing the default password
NO.54 A company is redesigning its infrastructure and wants to reduce the number of physical servers in use. Which of the following architectures is best suited for this goal?
Virtualization
NO.55 A company is planning a disaster recovery site and needs to ensure that a single natural disaster would not result in the complete loss of regulated backup data. Which of the following should the company consider?
Geographic dispersion
Geographic dispersion is the practice of having backup data stored in different locations that are far enough apart to minimize the risk of a single natural disaster affecting both sites.
NO.57 Security controls in a data center are being reviewed to ensure data is properly protected and that human life considerations are included. Which of the following best describes how the controls should be set up?
Safety controls should fail open.
NO.56 A systems administrator is looking for a low-cost application-hosting solution that is cloud- based. Which of the following meets these requirements?
Serverless framework
NO.58 A security administrator identifies an application that is storing data using MD5. Which of the following best identifies the vulnerability likely present in the application?
Cryptographic
NO.59 A systems administrator receives the following alert from a file integrity monitoring tool: The hash of the cmd.exe file has changed.
The systems administrator checks the OS logs and notices that no patches were applied in the last two months. Which of the following most likely occurred?
A rootkit was deployed.
A rootkit is a type of malware that modifies or replaces system files or processes to hide its presence and activity.
NO.60 A company is decommissioning its physical servers and replacing them with an architecture that will reduce the number of individual operating systems. Which of the following strategies should the company use to achieve this security requirement?
Containerization
Containerization allows multiple applications to run in isolated environments on a single operating system, significantly reducing the overhead compared to running multiple virtual machines, each with its own OS.
NO.61 Which of the following most impacts an administrator’s ability to address CVEs discovered on a server?
Patch availability
NO.62 A U.S.-based cloud-hosting provider wants to expand its data centers to new international locations. Which of the following should the hosting provider consider first?
Local data protection regulations
Local data protection regulations are the first thing that a cloud-hosting provider should consider before expanding its data centers to new international locations.
NO.63 Which of the following threat actors is the most likely to use large financial resources to attack critical systems located in other countries?
Nation-state
NO.64 An employee receives a text message that appears to have been sent by the payroll department and is asking for credential verification. Which of the following social engineering techniques are being attempted? (Choose two.)
Impersonation
Smishing
NO.65 Which of the following is the most common data loss path for an air-gapped network?
Removable devices
NO.66 To improve the security at a data center, a security administrator implements a CCTV system and posts several signs about the possibility of being filmed. Which of the following best describe these types of controls? (Select two).
Deterrent
Detective
NO.68 Which of the following best describes configuring devices to log to an off-site location for possible future reference?
Log aggregation
Archiving
Answer: A or C
NO.67 Which of the following is required for an organization to properly manage its restore process in the event of system failure?
DRP
A disaster recovery plan (DRP) is a set of policies and procedures that aim to restore the normal operations of an organization in the event of a system failure, natural disaster, or other emergency.
NO.69 Which of the following would be best suited for constantly changing environments?
Containers
NO.70 An administrator discovers that some files on a database server were recently encrypted. The administrator sees from the security logs that the data was last accessed by a domain user. Which of the following best describes the type of attack that occurred?
Insider threat
NO.71 A company’s legal department drafted sensitive documents in a SaaS application and wants to ensure the documents cannot be accessed by individuals in high-risk countries. Which of the following is the most effective way to limit this access?
Geolocation policy
A geolocation policy is a policy that restricts or allows access to data or resources based on the geographic location of the user or device.
NO.72 A penetration tester begins an engagement by performing port and service scans against the client environment according to the rules of engagement. Which of the following reconnaissance types is the tester performing?
Active
NO.73 Which of the following is a common source of unintentional corporate credential leakage in cloud environments?
Code repositories
Code repositories: Developers sometimes inadvertently include sensitive information, such as API keys, passwords, and other credentials, in their code.
NO.74 After a company was compromised, customers initiated a lawsuit. The company’s attorneys have requested that the security team initiate a legal hold in response to the lawsuit. Which of the following describes the action the security team will most likely be required to take?
Retain any communications related to the security breach until further notice.
NO.75 Which of the following should a security administrator adhere to when setting up a new set of firewall rules?
Change management procedure
NO.76 During a penetration test, a vendor attempts to enter an unauthorized area using an access badge. Which of the following types of tests does this represent?
Physical
NO.77 A newly appointed board member with cybersecurity knowledge wants the board of directors to receive a quarterly report detailing the number of incidents that impacted the organization. The systems administrator is creating a way to present the data to the board of directors. Which of the following should the systems administrator use?
Dashboard
NO.78 Which of the following allows for the attribution of messages to individuals?
Non-repudiation
NO.79 Local guidelines require that all information systems meet a minimum security baseline to be compliant. Which of the following can security administrators use to assess their system configurations against the baseline?
Benchmarks
NO.80 Which of the following scenarios describes a possible business email compromise attack?
A service desk employee receives an email from the HR director asking for log-in credentials to a cloud administrator account.
NO.81 Which of the following is the most likely to be included as an element of communication in a security awareness program?
Reporting phishing attempts or other suspicious activities
NO.82 A company is developing a critical system for the government and storing project information on a fileshare. Which of the following describes how this data will most likely be classified? (Select two).
Confidential
Restricted
NO.83 Which of the following has been implemented when a host-based firewall on a legacy Linux system allows connections from only specific internal IP addresses?
Compensating control
NO.84 A company’s marketing department collects, modifies, and stores sensitive customer data. The infrastructure team is responsible for securing the data while in transit and at rest. Which of the following data roles describes the customer?
Subject
NO.85 Which of the following should a systems administrator set up to increase the resilience of an application by splitting the traffic between two identical sites?
Load balancing
NO.86 A company is adding a clause to its AUP that states employees are not allowed to modify the operating system on mobile devices. Which of the following vulnerabilities is the organization addressing?
Jailbreaking
NO.87 After reviewing the following vulnerability scanning report:
Compensating controls exist.
NO.88 A security operations center determines that the malicious activity detected on a server is normal. Which of the following activities describes the act of ignoring detected activity in the future?
Tuning
NO.89 A data administrator is configuring authentication for a SaaS application and would like to reduce the number of credentials employees need to maintain. The company prefers to use domain credentials to access new SaaS applications. Which of the following methods would allow this functionality?
SSO
SSO stands for single sign-on, which is a method of authentication that allows users to access multiple applications or services with one set of credentials.
NO.90 A company is expanding its threat surface program and allowing individuals to security test the company’s internet-facing application. The company will compensate researchers based on the vulnerabilities discovered. Which of the following best describes the program the company is setting up?
Bug bounty
NO.91 Which of the following is the most likely to be used to document risks, responsible parties, and thresholds?
Risk register
NO.92 A security administrator needs a method to secure data in an environment that includes some form of checks so that the administrator can track any changes. Which of the following should the administrator set up to achieve this goal?
FIM
FIM stands for File Integrity Monitoring, which is a method to secure data by detecting any changes or modifications to files, directories, or registry keys.
NO.93 Which of the following threat actors is the most likely to be hired by a foreign government to attack critical systems located in other countries?
Organized crime
NO.94 Which of the following factors are the most important to address when formulating a training curriculum plan for a security awareness program? (Select two).
Threat vectors based on the industry in which the organization operates
Cadence and duration of training events
NO.95 During an investigation, an incident response team attempts to understand the source of an incident. Which of the following incident response activities describes this process?
Analysis
NO.96 A company requires hard drives to be securely wiped before sending decommissioned systems to recycling. Which of the following best describes this policy?
Sanitization
NO.97 Which of the following are cases in which an engineer should recommend the decommissioning of a network device? (Select two).
E. The device’s encryption level cannot meet organizational standards.
F. The device is unable to receive authorized updates.
NO.98 department is not using the company VPN when accessing various company-related services and systems. Which of the following scenarios describes this activity?
Shadow IT
NO.99 A Chief Information Security Officer wants to monitor the company’s servers for SQLi attacks and allow for comprehensive investigations if an attack occurs. The company uses SSL decryption to allow traffic monitoring. Which of the following strategies would best accomplish this goal?
Enabling full packet capture for traffic entering and exiting the servers
NO.172 A systems administrator is advised that an external web server is not functioning property. The administrator reviews the following firewall logs containing traffic going to the web server:
Which of the following attacks is likely occurring?
DDoS
NO.189 A security analyst reviews domain activity logs and notices the following:
Which of the following is the best explanation for what the security analyst has discovered?
An attacker is attempting to brute force jsmith’s account.
NO.199 A security analyst is reviewing the following logs:
Which of the following attacks is most likely occurring?
Password spraying
NO.231 An administrator is reviewing a single server’s security logs and discovers the following;
Which of the following best describes the action captured in this log file?
Brute-force attack
