751-800

Question 1

In which of the following scenarios is tokenization the best privacy technique to use?

A. Providing pseudo-anonymization for social media user accounts
B. Serving as a second factor for authentication requests
C. Enabling established customers to safely store credit card information
D. Masking personal information inside databases by segmenting data

Answer 1

C. Enabling established customers to safely store credit card information is the scenario where tokenization is the best privacy technique to use.

Here’s why:

Tokenization involves replacing sensitive data, such as credit card numbers, with a unique identifier (token) that has no exploitable value and can be used safely in place of the original data. The original sensitive data is stored securely in a tokenization system or vault.

In scenario C, enabling established customers to safely store credit card information, tokenization provides a secure method to store and process credit card data without exposing the actual card numbers to the organization's systems or databases.

Tokenization helps reduce the risk of data breaches because even if the tokenized data is intercepted, it cannot be used to derive the original credit card information without access to the tokenization system.

Let’s briefly consider the other options:

A. Providing pseudo-anonymization for social media user accounts typically involves anonymizing user data to protect identities but does not necessarily require tokenization.

B. Serving as a second factor for authentication requests relates to multi-factor authentication (MFA) where token-based authentication methods are used for security, but it does not involve tokenization of sensitive data like credit card information.

D. Masking personal information inside databases by segmenting data refers to data masking techniques to protect personal information within databases but is different from tokenization, which specifically addresses the secure storage of sensitive data like credit card numbers.

Therefore, C. Enabling established customers to safely store credit card information is the scenario where tokenization is the best privacy technique to use among the options provided.

Question 2

A new vulnerability enables a type of malware that allows the unauthorized movement of data from a system. Which of the following would detect this behavior?

A. Implementing encryption
B. Monitoring outbound traffic
C. Using default settings
D. Closing all open ports

Answer 2

B. Monitoring outbound traffic

Here’s why:

Monitoring outbound traffic involves inspecting and analyzing data leaving a network or system. This approach can detect anomalies such as large or unusual volumes of data being transferred, connections to suspicious or unauthorized destinations, or patterns indicative of data exfiltration by malware.

Malware that allows unauthorized movement of data often attempts to send stolen information or communicate with command-and-control servers outside the organization. Monitoring outbound traffic allows security teams to detect and investigate such activities in real-time.

Let’s briefly discuss the other options:

Implementing encryption (option A) helps protect data confidentiality but does not directly detect unauthorized data movement caused by malware. Encryption prevents unauthorized access to data if properly implemented, but it does not provide detection capabilities for data exfiltration.

Using default settings (option C) is not related to detecting or mitigating data exfiltration caused by malware. Default settings typically refer to initial configurations of software or devices, which may need to be changed for security reasons but do not directly address malware behavior.

Closing all open ports (option D) is a security measure to limit exposure to external threats, but it does not specifically detect unauthorized data movement. Malware can utilize legitimate communication channels or exploit vulnerabilities regardless of open ports.

Therefore, B. Monitoring outbound traffic is the option that would best detect the behavior of unauthorized data movement caused by a new malware vulnerability.

Question 3

A systems administrator is auditing all company servers to ensure they meet the minimum security baseline. While auditing a Linux server, the systems administrator observes the /etc/shadow file has permissions beyond the baseline recommendation. Which of the following commands should the systems administrator use to resolve this issue?

A. chmod
B. grep
C. dd
D. passwd

Answer 3

A. chmod

Question 4

A security team received the following requirements for a new BYOD program that will allow employees to use personal smartphones to access business email:

Sensitive customer data must be safeguarded.
Documents from managed sources should not be opened in unmanaged destinations.
Sharing of managed documents must be disabled.
Employees should not be able to download emailed images to their devices.
Personal photos and contact lists must be kept private.
IT must be able to remove data from lost/stolen devices or when an employee no longer works for the company.

Which of the following are the best features to enable to meet these requirements? (Choose two.)

A. Remote wipe
B. VPN connection
C. Biometric authentication
D. Device location tracking
E. Geofencing
F. Application approve list
G. Containerization

Answer 4

A. Remote wipe and G. Containerization.

Here’s how these features address the specified requirements:

Remote wipe (Option A):
    Allows IT to remove data from lost/stolen devices or when an employee no longer works for the company.
    This feature ensures that sensitive customer data and company documents can be erased remotely to prevent unauthorized access in case of device loss or employee departure.

Containerization (Option G):
    Keeps managed documents and data separate from unmanaged areas.
    Disables sharing of managed documents.
    Prevents downloading of emailed images to personal device storage.
    Helps maintain privacy of personal photos and contact lists.

Containerization achieves these by creating separate secure containers on the device for business applications and data. It ensures that business documents and data are encrypted and isolated from personal apps and content. IT can control and enforce policies within the container without affecting the user's personal apps and data.

Let’s briefly review the other options for clarity:

VPN connection (Option B): While VPNs provide secure access to corporate resources over the internet, they do not inherently address the specific requirements related to data segregation, device management, or privacy control on personal devices.

Biometric authentication (Option C): Enhances device security but does not directly address data segregation or management on personal devices as required.

Device location tracking (Option D) and Geofencing (Option E): Provide capabilities for tracking and restricting device location, but these features do not directly meet the specific data segregation and management requirements for BYOD.

Application approve list (Option F): Involves allowing specific applications on devices but does not inherently ensure data segregation or control over document sharing and data privacy on personal devices.

Therefore, A. Remote wipe and G. Containerization are the best features to enable to meet the requirements of the new BYOD program for securely accessing business email while safeguarding sensitive data and ensuring privacy controls.

Question 5

Which of the following security controls is used to isolate a section of the network and its externally available resources from the internal corporate network in order to reduce the number of possible attacks?

A. Faraday cages
B. Air gap
C. Vaulting
D. Proximity readers

Answer 5

B. Air gap

Here’s why:

Air gap refers to physically isolating a system or network from other networks, particularly from the internet or other potentially insecure networks. This isolation is achieved by ensuring there are no network connections or data transfers between the air-gapped network and other networks.

By implementing an air gap, organizations can significantly reduce the attack surface because external threats, such as internet-based attacks, cannot directly access the isolated network. This isolation helps protect critical systems or sensitive data that require high levels of security.

Let’s briefly cover the other options for clarity:

Faraday cages (Option A) are physical enclosures that block electromagnetic signals, typically used to shield electronic devices from external electromagnetic interference. They are not directly related to network isolation for security purposes.

Vaulting (Option C) refers to securely storing physical items, such as data tapes or sensitive documents, in secure facilities or vaults. It is not specifically related to network isolation.

Proximity readers (Option D) are devices used for physical access control, allowing entry based on the proximity of an authorized credential (such as an access card or badge). They are used for controlling physical access to buildings or areas, not for network isolation.

Therefore, B. Air gap is the security control used to isolate a section of the network and its externally available resources from the internal corporate network to reduce the number of possible attacks.

Question 6

A security analyst is responding to a malware incident at a company. The malware connects to a command-and-control server on the internet in order to function. Which of the following should the security analyst implement first?

A. Network segmentation
B. IP-based firewall rules
C. Mobile device management
D. Content filler

Answer 6

B. IP-based firewall rules
(Community B 57%, A 40%)

Here’s why:

IP-based firewall rules can be quickly implemented to block communication between the infected systems and the known command-and-control server IP addresses.
This action helps to contain the malware and prevent further communication, limiting its ability to exfiltrate data or receive additional commands from the attacker.
Implementing IP-based firewall rules is a rapid and effective measure to disrupt the malware's operations without significant infrastructure changes or delays.

Let’s briefly discuss the other options for clarity:

Network segmentation (Option A) involves dividing a network into smaller segments to restrict the spread of malware and limit its impact. While important for long-term security, it typically requires more planning and implementation time compared to immediate firewall rule changes.

Mobile device management (Option C) is a system that manages mobile devices in the corporate environment, ensuring they adhere to security policies. However, it is not directly related to blocking communication between malware and a C&C server on the internet.

Content filter (Option D), also known as content filtering, is used to control what content users can access on the internet, but it does not address the immediate need to block specific communication channels used by malware.

Therefore, B. IP-based firewall rules is the most appropriate initial action for the security analyst to implement in response to the malware incident connecting to a command-and-control server on the internet.

Question 7

QUESTION: 757
A company wants to begin taking online orders for products but has decided to outsource payment processing to limit risk. Which of the following best describes what the company should request from the payment processor?

A. ISO 27001 certification documents
B. Proof of PCI DSS compliance
C. A third-party SOC 2 Type 2 report
D. Audited GDPR policies

Answer 7

B. Proof of PCI DSS compliance

Here’s why:

PCI DSS (Payment Card Industry Data Security Standard) compliance is specifically designed to protect cardholder data and ensure secure payment processing. This standard is mandated for all organizations that handle, process, store, or transmit credit card information.

By requesting proof of PCI DSS compliance, the company ensures that the payment processor adheres to the necessary security standards to protect sensitive payment information, thereby limiting the risk associated with handling and processing payments.

Let’s briefly discuss the other options for clarity:

ISO 27001 certification documents (Option A) pertain to a comprehensive information security management system (ISMS). While important for overall security posture, it is not specifically tailored to payment card processing security requirements like PCI DSS.

A third-party SOC 2 Type 2 report (Option C) evaluates the effectiveness of an organization’s controls relevant to security, availability, processing integrity, confidentiality, and privacy. Although useful for understanding a service provider’s security posture, it does not specifically address payment card industry requirements.

Audited GDPR policies (Option D) ensure compliance with the General Data Protection Regulation, which focuses on protecting personal data and privacy of individuals in the EU. While important for privacy considerations, GDPR compliance does not specifically address the security requirements for payment card processing.

Therefore, B. Proof of PCI DSS compliance is the best request to make to the payment processor to ensure secure and compliant handling of payment information for online orders.

Question 8

An employee in the accounting department receives an email containing a demand for
payment for services performed by a vendor. However, the vendor is not in the vendor
management database. Which of the following is this scenario an example of?

A. Pretexting
B. Impersonation
C. Ransomware
D. Invoice scam

Answer 8

D. Invoice scam

Here’s why:

An invoice scam involves sending fraudulent invoices to a company, hoping that the recipient will process the payment without verifying the legitimacy of the invoice. In this case, the employee receives a demand for payment for services from a vendor not listed in the vendor management database, indicating that the invoice is likely fraudulent.

Let’s briefly discuss the other options for clarity:

Pretexting (Option A) is a form of social engineering where an attacker creates a fabricated scenario (pretext) to trick the victim into divulging information or performing an action. While this scam could involve some form of pretexting, the scenario specifically matches an invoice scam.

Impersonation (Option B) involves an attacker pretending to be someone else, such as a trusted person or organization, to deceive the victim. While invoice scams can involve impersonation, the specific act of sending a fake invoice for payment is best described as an invoice scam.

Ransomware (Option C) is a type of malware that encrypts a victim’s data and demands a ransom payment to restore access. This scenario does not involve any form of malware or encryption, so it does not fit the description of ransomware.

Therefore, the scenario is best described as D. Invoice scam.

Question 9

A company has had several malware incidents that have been traced back to users accessing personal SaaS applications on the internet from the company network. The company has a policy that states users can only access business-related cloud applications from within the company network. Which of the following technical solutions should be used to enforce the policy?

A. Implement single sign-on using an identity provider
B. Leverage a cloud access security broker.
C. Configure cloud security groups
D. Install a virtual private cloud endpoint

Answer 9

B. Leverage a cloud access security broker.

Here’s why:

Cloud Access Security Brokers (CASBs) provide visibility and control over cloud applications and can enforce security policies for cloud usage. A CASB can monitor and manage the use of cloud applications, allowing the company to enforce policies that restrict access to only approved business-related applications. This includes blocking access to unauthorized personal SaaS applications.

Let’s briefly discuss the other options for clarity:

Implement single sign-on using an identity provider (Option A): While single sign-on (SSO) can simplify user authentication and provide better control over application access, it primarily addresses authentication and access management. SSO alone may not effectively enforce restrictions on accessing personal SaaS applications.

Configure cloud security groups (Option C): Security groups are typically used within cloud environments to control inbound and outbound traffic to resources. However, they do not provide the comprehensive visibility and policy enforcement needed to restrict user access to specific cloud applications from the company network.

Install a virtual private cloud endpoint (Option D): A virtual private cloud (VPC) endpoint allows secure connection to cloud services without traversing the internet, but it does not provide the necessary functionality to enforce application-specific access policies.

Therefore, B. Leverage a cloud access security broker is the most appropriate technical solution to enforce the policy and prevent users from accessing personal SaaS applications on the internet from the company network.

Question 10

A security analyst is reviewing an IDS alert and sees the following:
C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe -noP -exe byPass -nonI -wind hidden -no1 -c dir;findstr /s maldinuv %USERPROFILE%\*.lnk >
%USERPROFILE%\Documents\iijlqe.ps1;%USERPROFILE%\Documents\iijlqe.psi;exit
Which of the following triggered the IDS alert?

A. Bluesnarfing attack
B. URL redirection attack
C. Fileless malware execution
D. Macro-based denial of service

Answer 10

C. Fileless malware execution

Here’s why:

The command shown in the alert involves PowerShell, which is a common tool used in fileless malware attacks. Fileless malware does not rely on traditional files stored on the disk but instead runs in memory, often leveraging legitimate system tools like PowerShell to execute malicious activities.

The command includes parameters such as -noP, -exe byPass, -nonI, -wind hidden, which are used to run PowerShell scripts with minimal visibility and bypass execution policies, indicating malicious intent.

The command also involves searching for and interacting with files (findstr /s maldinuv %USERPROFILE%\*.lnk > %USERPROFILE%\Documents\iijlqe.ps1), which is consistent with fileless malware behaviors that often involve scripting and in-memory execution.

Let’s briefly discuss why the other options are not correct:

Bluesnarfing attack (Option A): Bluesnarfing involves unauthorized access to a device via Bluetooth, which is unrelated to the PowerShell command shown.

URL redirection attack (Option B): URL redirection attacks involve redirecting users to malicious websites, which is not indicated by the PowerShell command provided.

Macro-based denial of service (Option D): This refers to using macros in documents (such as those in Microsoft Office) to execute malicious code and cause a denial of service. The command shown does not involve macros or suggest a denial of service attack.

Therefore, the alert was triggered by C. Fileless malware execution.

Question 11

A company wants to implement MFA. Which of the following enables the additional factor while using a smart card?

A. PIN
B. Hardware token
C. User ID
D. SMS

Answer 11

A. PIN

Here’s why:

PIN (Personal Identification Number): When using a smart card, a PIN is often required to authenticate the user and unlock the smart card. This combination of something the user has (the smart card) and something the user knows (the PIN) constitutes two-factor authentication (2FA).

Let’s briefly discuss why the other options are not correct in this context:

Hardware token (Option B): While a hardware token is another form of MFA, it is a separate physical device and is not typically used in conjunction with a smart card for a single authentication process.

User ID (Option C): A user ID is used to identify the user but does not serve as an authentication factor by itself. It is typically used alongside other authentication factors like passwords, PINs, or smart cards.

SMS (Option D): SMS-based authentication involves sending a code to the user’s phone, which can be used as a second factor in MFA. However, it is not directly related to the use of a smart card.

Therefore, A. PIN is the correct answer as it enables the additional factor of authentication when using a smart card.

Question 12

A server administrator is reporting performance issues when accessing all internal resources. Upon further investigation, the security team notices the following:

• A user’s endpoint has been compromised and is broadcasting its MAC as the default gateway’s MAC throughout the LAN.
• Traffic to and from that endpoint is significantly greater than all other similar endpoints on the LAN.
• Network ports on the LAN are not properly configured.
• Wired traffic is not being encrypted properly.

Which of the following attacks is most likely occurring?
A. DDoS
B. MAC flooding
C. ARP poisoning
D. DHCP snooping

Answer 12

C. ARP poisoning

Here’s why:

ARP poisoning (also known as ARP spoofing) involves an attacker sending falsified ARP (Address Resolution Protocol) messages over a local area network. This results in linking the attacker’s MAC address with the IP address of a legitimate computer or network gateway. In this scenario, the compromised endpoint is broadcasting its MAC address as the default gateway's MAC, which is a classic sign of ARP poisoning.

The significant traffic to and from the compromised endpoint suggests it is intercepting and possibly manipulating or eavesdropping on network traffic, which is common in ARP poisoning attacks.

The improper configuration of network ports and lack of encrypted wired traffic further exacerbate the vulnerability to ARP poisoning.

Let’s briefly discuss why the other options are not correct:

DDoS (Distributed Denial of Service) (Option A): This type of attack involves overwhelming a target with traffic from multiple sources to disrupt service. The scenario does not describe multiple sources of traffic targeting a single endpoint.

MAC flooding (Option B): This attack involves overwhelming a switch with fake MAC addresses to fill its CAM table and cause it to operate in broadcast mode. While this could lead to performance issues, it does not align with the specific behavior of broadcasting the default gateway’s MAC address.

DHCP snooping (Option D): This is a security feature that acts as a firewall between untrusted hosts and DHCP servers to prevent rogue DHCP server attacks. It does not align with the symptoms described in the scenario, such as broadcasting a MAC address.

Therefore, the most likely attack occurring is C. ARP poisoning.

Question 13

A security analyst is reviewing the following system command history on a computer that was recently utilized in a larger attack on the corporate infrastructure:

C:\sysadmin > whoami
domain\localuser

C:\sysadmin> psexec.exe -s cmd
PsExec v2.0 - Execute processes remotely
Microsoft Windows [Version 10]

C:\Windows\system32>whoami
nt authority\system

Which of the following best describes what the analyst has discovered?

A. A successful privilege escalation attack by a local user
B. A user determining what level of permissions the user has
C. A systems administrator performing routine maintenance
D. An attempt to utilize living-off-the-land binaries

Answer 13

A. A successful privilege escalation attack by a local user

Here’s why:

The command history shows the initial user identity as domain\localuser, indicating the commands are being run by a standard user.
The user then runs psexec.exe -s cmd, which is a command to run the cmd process with the highest possible privileges (the -s switch runs the command in the System account context).
After this command, the whoami command returns nt authority\system, indicating the user has successfully escalated privileges to the highest level available on the system.

This sequence of commands strongly suggests that a local user has performed a privilege escalation attack to gain higher-level privileges on the system.

Let’s briefly discuss why the other options are not correct:

B. A user determining what level of permissions the user has: While the whoami command does determine the current user's permissions, the key detail here is the use of psexec.exe to escalate privileges, which goes beyond just checking permissions.

C. A systems administrator performing routine maintenance: While a system administrator might perform such actions, the initial identity (domain\localuser) does not match that of a typical system administrator, and the context implies unauthorized privilege escalation.

D. An attempt to utilize living-off-the-land binaries: While psexec.exe is indeed a living-off-the-land binary (a legitimate tool used for malicious purposes), the specific actions in this scenario best fit the definition of a privilege escalation attack.

Therefore, the most accurate description is A. A successful privilege escalation attack by a local user.

Question 14

During a forensic investigation, an analyst uses software to create a checksum of the affected subject’s email file. Which of the following is the analyst practicing?

A. Chain of custody
B. Data recovery
C. Non-repudiation
D. Integrity

Answer 14

D. Integrity

Here’s why:

Creating a checksum: The process of generating a checksum (or hash) for a file is a method used to ensure the integrity of the data. A checksum is a unique value derived from the contents of the file. If the file is altered in any way, the checksum will change. This allows the analyst to verify that the email file has not been tampered with during the investigation.

Let’s briefly discuss why the other options are not correct:

Chain of custody (Option A): This refers to the documentation and handling process that tracks the evidence from the time it is collected until it is presented in court. While maintaining integrity is part of the chain of custody, creating a checksum specifically addresses data integrity rather than the overall tracking process.

Data recovery (Option B): This involves restoring lost, corrupted, or deleted data. Creating a checksum does not recover data but rather ensures the data remains unaltered.

Non-repudiation (Option C): This ensures that a party cannot deny the authenticity of their signature on a document or the sending of a message that they originated. While checksums can contribute to non-repudiation, the primary purpose of creating a checksum in this context is to verify data integrity.

Therefore, D. Integrity is the most appropriate answer.

Question 15

A software company has a shared codebase for multiple projects using the following strategy:

• Unused features are deactivated but still present on the code.
• New customer requirements trigger additional development work.

Which of the following will most likely occur when the company uses this strategy?

A. Malicious code
B. Dead code
C. Outsourced code
D. Code obfuscation

Answer 15

B. Dead code

Here’s why:

Dead code: This refers to portions of the codebase that are no longer used or needed but still exist in the system. In this case, since unused features are deactivated but not removed from the code, they become dead code. This can lead to increased maintenance efforts and potential security vulnerabilities, but it doesn't necessarily imply immediate malicious intent.

Let’s briefly discuss why the other options are not correct:

Malicious code (Option A): Malicious code refers to software intentionally designed to cause harm, such as viruses or malware. The strategy described does not inherently suggest the presence or introduction of malicious code.

Outsourced code (Option C): This refers to code developed by an external party. The strategy mentioned does not indicate the use of external developers or third-party code.

Code obfuscation (Option D): This is the practice of making code difficult to understand on purpose to protect intellectual property or hinder reverse engineering. The described strategy does not involve making the code intentionally obscure.

Therefore, the most likely occurrence is B. Dead code.

Question 16

A security audit of an organization revealed that most of the IT staff members have domain administrator credentials and do not change the passwords regularly. Which of the following solutions should the security team propose to resolve the findings in the most complete way?

A. Creating group policies to enforce password rotation on domain administrator credentials
B. Reviewing the domain administrator group, removing all unnecessary administrators, and rotating all passwords
C. Integrating the domain administrator’s group with an IdP and requiring SSO with MFA for all access
D. Securing domain administrator credentials in a PAM vault and controlling access with
role-based access control

Answer 16

(Brain dump : B. Reviewing the domain administrator group, removing all unnecessary administrators, and rotating all passwords )

(Community : B 51%, D 49%)
It’s B. since the question said that “most of the IT staff members have domain administrator credentials and do not change the passwords regularly”. It probably means that there has not been an auditing to limit the access control and also passwords needs to be changed regularly. so. Option B fits perfect!

ChatGPT
D. Securing domain administrator credentials in a PAM vault and controlling access with role-based access control

Here’s why:

Privileged Access Management (PAM) vault: A PAM solution provides a secure vault for storing and managing privileged credentials. It can enforce policies for password rotation, ensuring that passwords are changed regularly and automatically.

Role-based access control (RBAC): By implementing RBAC, the organization can ensure that only authorized personnel have access to domain administrator credentials, reducing the number of people with such high-level access.

Audit and control: A PAM system can also provide detailed auditing and monitoring of all actions performed with privileged accounts, increasing security and accountability.

While the other options address some aspects of the issue, they do not provide a comprehensive solution:

Option A (Creating group policies to enforce password rotation): This is a good step for enforcing regular password changes, but it doesn't address the broader issue of excessive domain administrator access.

Option B (Reviewing the domain administrator group and rotating passwords): This addresses the immediate issue but does not provide an ongoing mechanism for managing and securing credentials.

Option C (Integrating with an IdP and requiring SSO with MFA): This enhances security through SSO and MFA but does not specifically address the management and rotation of domain administrator credentials.

Therefore, the most complete solution is D. Securing domain administrator credentials in a PAM vault and controlling access with role-based access control.

Question 17

Which of the following best describes a threat actor who is attempting to use commands found on a public code repository?

A. Script kiddie
B. State actor
C. Insider threat
D. Competitor espionage

Answer 17

A. Script kiddie

Here’s why:

Script kiddie: This term refers to individuals who lack deep technical understanding but attempt to exploit vulnerabilities using pre-existing tools or scripts developed by others. They often rely on easily accessible resources like public code repositories to carry out attacks without fully understanding the underlying mechanisms or coding involved.

In contrast, the other options are less suitable:

State actor (Option B): State actors are typically government-sponsored or affiliated entities conducting cyber operations for strategic or political purposes. They would generally have more sophisticated capabilities and resources than those typically associated with script kiddies.

Insider threat (Option C): An insider threat involves an individual within an organization who poses a risk, either intentionally or unintentionally. It doesn't specifically relate to using commands from public code repositories.

Competitor espionage (Option D): This involves malicious activities aimed at gaining competitive advantage through unauthorized access or information theft, which doesn't directly correlate with using public code repositories.

Therefore, the most appropriate term for a threat actor using commands from a public code repository is A. Script kiddie.

Question 18

While assessing the security of a web application, a security analyst was able to introduce unsecure strings through the application input fields by bypassing client-side controls. Which of the following solutions should the analyst recommend?

A. Code signing
B. Host-based intrusion detection system
C. Secure cookies
D. Server-side validation

Answer 18

D. Server-side validation

Here’s why:

Server-side validation: This involves validating input data on the server-side rather than relying solely on client-side validation. Client-side controls can be bypassed or manipulated by attackers, whereas server-side validation ensures that input data is validated and sanitized before processing. This helps prevent injection attacks, such as SQL injection or cross-site scripting (XSS), which can occur when malicious strings are passed through input fields.

Let’s briefly discuss why the other options are not suitable:

Code signing (Option A): Code signing is used to verify the authenticity and integrity of software. It does not address the issue of input validation for web applications.

Host-based intrusion detection system (Option B): An intrusion detection system monitors and analyzes network traffic for signs of unauthorized access or malicious activities. While important for overall security, it does not directly address input validation issues in web applications.

Secure cookies (Option C): Secure cookies are used to enhance the security of data transmitted between the client and server, but they do not address the issue of input validation. They are more focused on ensuring data confidentiality and integrity during transmission.

Therefore, to mitigate the risk of introducing unsecure strings through input fields, the most appropriate solution is D. Server-side validation. This ensures that all input data is properly validated and sanitized on the server before any further processing occurs.

Question 19

A vulnerability scan returned the following results:
* 2 Critical
* 5 High
* 15 Medium
* 98 Low

Which of the following would the information security team most likely use to decide if all discovered vulnerabilities must be addressed and the order in which they should be addressed?

A. Risk appetite
B. Risk register
C. Risk matrix
D. Risk acceptance

Answer 19

C. Risk Matrix

Here’s why:

Risk Matrix: A risk matrix categorizes risks based on their likelihood and impact. Vulnerabilities are typically assessed based on their severity (critical, high, medium, low) and the potential impact they could have on the organization if exploited. By using a risk matrix, the team can prioritize vulnerabilities for remediation based on their risk level, helping them decide which vulnerabilities need immediate attention and which ones can be addressed later.

Let’s briefly discuss why the other options are not as suitable:

Risk appetite (Option A): Risk appetite refers to the level of risk an organization is willing to accept. While it guides decisions on whether to accept, mitigate, or transfer risks, it does not directly determine the order of addressing vulnerabilities based on their severity.

Risk register (Option B): A risk register is a document used to record information about identified risks, including their description, likelihood, impact, and mitigation plans. While it provides a repository of risks, it does not inherently prioritize vulnerabilities based on severity.

Risk acceptance (Option D): Risk acceptance is the decision to accept the potential risk associated with a vulnerability without taking any further action. It is a decision made after assessing the risk, but it does not guide the prioritization of vulnerabilities.

Therefore, the Risk Matrix (Option C) is the tool that the information security team would most likely use to decide if all discovered vulnerabilities must be addressed and the order in which they should be addressed, based on their severity and potential impact.

Question 20

A company wants to ensure that all employees in a given department are trained on each job role to help with employee burnout and continuity of business operations in the event an employee leaves the company. Which of the following should the company implement?

A. Separation of duties
B. Job rotation
C. Mandatory vacations
D. Least privilege

Answer 20

B. Job rotation

Here’s why job rotation is the most suitable option:

Job rotation: This practice involves periodically rotating employees through different job roles within the department or organization. By rotating job roles, employees gain experience and proficiency in different tasks, reducing the risk of burnout from repetitive tasks. Additionally, it ensures that multiple employees are trained to handle various job responsibilities, thereby enhancing continuity of operations in case of employee turnover.

Let’s briefly discuss why the other options are less suitable:

Separation of duties (Option A): This principle aims to prevent fraud and errors by dividing responsibilities among different employees. While important for internal controls and security, it does not directly address employee burnout or continuity of operations in the same way as job rotation.

Mandatory vacations (Option C): While mandatory vacations can help prevent burnout and provide temporary coverage during absence, they do not ensure ongoing training across job roles as effectively as job rotation.

Least privilege (Option D): This principle limits access rights and permissions to the minimum necessary for employees to perform their job functions securely. While crucial for security, it does not directly address the need for cross-training and job role versatility.

Therefore, B. Job rotation is the best option to help with employee burnout and ensure continuity of business operations by ensuring that employees are trained in multiple job roles within the department.

Question 21

Various stakeholders are meeting to discuss their hypothetical roles and responsibilities in a specific situation, such as a security incident or major disaster. Which of the following best describes this meeting?

A. Penetration test
B. Continuity of operations planning
C. Tabletop exercise
D. Simulation

Answer 21

C. Tabletop exercise

Here’s why:

Tabletop exercise: This is a structured, discussion-based session where stakeholders gather to walk through a hypothetical scenario. The scenario typically involves a simulated incident or disaster to test and validate an organization's incident response plans, business continuity plans, or disaster recovery plans. Participants discuss their roles and responsibilities, identify gaps in procedures, and refine response strategies in a controlled environment.

Penetration test (Option A): This involves actively testing the security of systems and networks by simulating attacks to identify vulnerabilities that could be exploited by real attackers. It focuses on technical testing rather than discussing roles and responsibilities in a scenario.

Continuity of operations planning (Option B): This refers to the process of developing and implementing plans and procedures to ensure that essential functions can continue during and after a disaster or disruption. While related to business resilience, it does not specifically involve stakeholders discussing their roles in a simulated scenario.

Simulation (Option D): Simulations involve recreating real-world scenarios to understand the effects of certain decisions or actions. It can be broader in scope than a tabletop exercise and may involve more operational aspects rather than focusing specifically on roles and responsibilities.

Therefore, the meeting where stakeholders discuss their hypothetical roles and responsibilities in a specific scenario is most appropriately referred to as a tabletop exercise.

Question 22

Which of the following threat actors is most likely to use a high level of sophistication and potentially zero-day exploits to target organizations and systems?

A. APT groups
B. Script kiddies
C. Hacktivists
D. Ethical hackers

Answer 22

A. APT groups

Here’s why:

APT (Advanced Persistent Threat) groups: APT groups are typically well-funded and highly skilled adversaries, often state-sponsored or affiliated with nation-states. They employ sophisticated techniques, including zero-day exploits (exploits for vulnerabilities that are unknown to the software vendor), to infiltrate and compromise targeted organizations. APT groups are known for their persistence, stealth, and ability to conduct long-term, covert operations aimed at stealing sensitive information, disrupting operations, or achieving strategic objectives.

Script kiddies (Option B): Script kiddies lack technical expertise and rely on pre-existing tools or scripts developed by others to carry out attacks. They do not typically use sophisticated techniques or zero-day exploits.

Hacktivists (Option C): Hacktivists engage in hacking activities for political or social causes. While they may target organizations, they often use less sophisticated methods compared to APT groups and are more focused on making a public statement rather than maintaining stealth.

Ethical hackers (Option D): Ethical hackers, also known as white-hat hackers, use their skills to identify and fix security vulnerabilities in systems with the permission of the organization. They do not engage in malicious activities and do not use zero-day exploits unless authorized as part of their testing.

Therefore, APT groups (Option A) are the threat actors most likely to use a high level of sophistication and potentially zero-day exploits to target organizations and systems.

Question 23

A company is implementing a vendor’s security tool in the cloud. The security director does not want to manage users and passwords specific to this tool but would rather utilize the company’s standard user directory. Which of the following should the company implement?

A. 802.1X
B. SAML
C. RADIUS
D. CHAP

Answer 23

B. SAML (Security Assertion Markup Language)

Here’s why SAML is the appropriate choice:

SAML (Security Assertion Markup Language): SAML is a standard protocol for exchanging authentication and authorization data between identity providers (such as the company's user directory) and service providers (such as the vendor's security tool in the cloud). By implementing SAML, the company can enable single sign-on (SSO), allowing users to authenticate once with their standard credentials stored in the company's user directory. This eliminates the need for the security director to manage additional user accounts and passwords specific to the vendor's tool.

Let’s briefly discuss why the other options are not as suitable:

802.1X (Option A): 802.1X is an IEEE standard for network access control and does not directly address the integration of cloud-based security tools with user directories for authentication purposes.

RADIUS (Option C): RADIUS (Remote Authentication Dial-In User Service) is a protocol commonly used for network access authentication, authorization, and accounting. While it can integrate with user directories, it typically requires more configuration and is more commonly used for network access rather than cloud-based services.

CHAP (Challenge Handshake Authentication Protocol) (Option D): CHAP is a protocol used to authenticate a remote user or device to an authenticating entity. It is not typically used for integrating cloud-based services with user directories in the context described.

Therefore, B. SAML is the best choice for enabling the company to integrate the vendor’s security tool in the cloud with their standard user directory for authentication purposes, while maintaining ease of management and security.

Question 24

An organization wants to ensure it can track changes between software deployments. Which of the following concepts should the organization implement?

A. Continuous monitoring
B. Rights management
C. Non-repudiation
D. Version control

Answer 24

D. Version control

Here’s why version control is the correct choice:

Version control: Also known as source control or revision control, version control systems (VCS) track changes to files over time. They allow developers (or anyone working on the software) to manage and track changes made to code, documentation, configurations, and other files throughout the software development lifecycle. Version control systems help teams collaborate effectively, revert to previous versions if necessary, and maintain a history of changes made to the software.

Continuous monitoring (Option A): Continuous monitoring refers to the process of actively monitoring systems and networks for security threats and vulnerabilities. While important for overall security, it does not specifically address tracking changes between software deployments.

Rights management (Option B): Rights management involves controlling access to resources based on user roles and permissions. It focuses on managing user access rather than tracking changes to software deployments.

Non-repudiation (Option C): Non-repudiation ensures that a sender or recipient of information cannot deny having sent or received the information. It is typically related to authentication and integrity rather than tracking software changes.

Therefore, D. Version control is the concept that the organization should implement to effectively track changes between software deployments, ensuring transparency, collaboration, and control over software development activities.

Question 25

A company has implemented a policy that requires two people to agree in order to push any changes from the test codebase repository into production. Which of the following best describes this control type?

A. Detective
B. Technical
C. Physical
D. Operational

Answer 25

D. Operational

Here’s why:

Operational controls: These controls are put in place to manage and guide the conduct of people within an organization. They include policies, procedures, and standards that define acceptable behavior and practices. In this case, the policy requiring two people to agree before pushing changes to production is an operational control designed to ensure accountability and reduce the risk of unauthorized or erroneous changes being deployed.

Let’s briefly touch on the other options to clarify why they are not as fitting:

Detective controls (Option A): Detective controls are designed to detect and react to security incidents after they have occurred. They include monitoring, logging, and auditing mechanisms rather than policies governing how changes are made.

Technical controls (Option B): Technical controls refer to security measures that are implemented through technology. Examples include access controls, encryption, firewalls, etc. The policy described in the question focuses more on human behavior and decision-making rather than technological implementation.

Physical controls (Option C): Physical controls are measures implemented to physically protect assets, facilities, or resources. They include items like locks, access badges, and security guards, which are not directly related to the policy regarding code deployment described in the question.

Therefore, the best description of the control type requiring two people to agree before pushing changes to production is Operational control, as it pertains to organizational policies and procedures governing how activities are performed within the company.

Question 26

A security administrator is reviewing reports about suspicious network activity occurring on a subnet. Users on the network report that connectivity to various websites is intermittent. The administrator logs in to a workstation and reviews the following command output:

? (192.168.1.7) at on enp0s25
www.routerlogin.com (192.168.1.1) at 08:03:ee:dd:fb:2b [ether] on enp0s25
? (192.168.1.4) at on enp0s25
server1 (192.168.1.8) at 08:03:ee:dd:fb:2b [ether] on enp0s25
? (192.168.1.5) at 08:03:ee:dd:fb:2b [ether] on enp0s25
? (192.168.1.2) at on enp0s25
server2 (192.168.1.6) at 08:03:ee:dd:fb:2b [ether] on enp0s25

Which of the following best describes what is occurring on the network?

A. ARP poisoning
B. On-path attack
C. URL redirection
D. IP address conflicts

Answer 26

A. ARP poisoning

Based on the provided command output, it appears that several entries in the ARP (Address Resolution Protocol) table are incomplete (). This is a key indicator of an ARP spoofing or ARP poisoning attack, which is often used to intercept traffic on a local network. Here’s how each option relates:

A. ARP poisoning: ARP poisoning involves manipulating ARP messages on a local network to associate the attacker’s MAC address with the IP address of another host (such as a gateway or server). This can lead to traffic being redirected through the attacker’s machine, causing intermittent connectivity issues and potentially allowing the attacker to intercept or modify network traffic.

B. On-path attack: While an on-path attack can encompass various methods, ARP poisoning specifically can be considered a form of on-path attack because it positions the attacker in the network path between two communication endpoints, allowing for traffic interception.

C. URL redirection: URL redirection typically refers to web traffic redirection from one URL to another, often through HTTP 3xx status codes. It is not directly related to the ARP table entries described in the scenario.

D. IP address conflicts: IP address conflicts occur when two devices on the same network have been assigned the same IP address, which results in connectivity problems. However, the ARP table entries in the scenario specifically indicate incomplete entries rather than conflicts between fully resolved IP addresses.

Therefore, based on the incomplete ARP entries and the symptoms described (intermittent connectivity and suspicious network activity), the most likely scenario occurring on the network is ARP poisoning (Option A). This attack should be mitigated promptly to restore normal network operations and prevent further potential security risks.

Question 27

A security analyst is looking for a way to categorize and share a threat actor’s TTPs with colleagues at a partner organization. Which of the following would be the best method to achieve this goal?

A. Releasing the lessons-learned report
B. Using the MITRE ATT&CK framework
C. Sharing the CVE IDs used in attacks
D. Sending relevant log files and pcaps

Answer 27

B. Using the MITRE ATT&CK framework

Here’s why:

MITRE ATT&CK framework: This framework provides a structured and standardized way to categorize and describe the behaviors of threat actors across various stages of an attack lifecycle. It covers tactics (high-level objectives of an attack) and techniques (specific methods used to achieve those objectives), providing a common language for describing and understanding cyber threats.

Benefits of using MITRE ATT&CK:
    Standardization: Ensures that TTPs are categorized consistently across different organizations.
    Granularity: Provides detailed descriptions of specific techniques used by threat actors.
    Sharing and collaboration: Facilitates sharing of threat intelligence between organizations, enabling them to understand and defend against similar attack patterns.
    Mapping and analysis: Allows analysts to map observed behaviors to known TTPs, aiding in threat hunting and incident response.

Option A (Releasing the lessons-learned report) may capture some aspects of TTPs, but it typically focuses more on internal organizational insights and responses rather than a standardized framework for describing attacker behaviors.

Option C (Sharing the CVE IDs used in attacks) is specific to vulnerabilities and does not comprehensively cover the broader set of TTPs used by threat actors.

Option D (Sending relevant log files and pcaps) provides raw data that can be analyzed but lacks the structured categorization and standardization provided by frameworks like MITRE ATT&CK.

Therefore, using the MITRE ATT&CK framework (Option B) would be the best method for the security analyst to categorize and share a threat actor’s TTPs with colleagues at a partner organization, ensuring clear communication and effective collaboration in threat intelligence sharing.

Question 28

A systems administrator wants to add a second factor to the single sign-on portal that the organization uses. Currently, only a username and password are required. Which of the following should the administrator implement to best meet this requirement?

A. Personal verification questions
B. Software-based TOTP
C. Log-in image checks
D. Secondary PIN code

Answer 28

B. Software-based TOTP (Time-based One-Time Password). Here’s why this option is the most appropriate:

Security Strength: TOTP generates a unique, time-sensitive code that users must enter along with their username and password. This significantly enhances security because even if someone obtains the username and password, they would also need the current TOTP code to gain access.

Convenience: TOTP codes can be generated using various authenticator apps on smartphones or through hardware tokens. This method is generally more convenient than alternatives like personal verification questions or image checks.

Implementation: TOTP is widely supported and relatively easy to implement compared to some other second-factor methods. It integrates well with most single sign-on systems and doesn't require additional hardware for most users.

Therefore, choosing software-based TOTP (option B) would best meet the requirement of adding a second factor to enhance the security of the organization’s single sign-on portal.

Question 29

A company needs to keep the fewest records possible, meet compliance needs, and ensure destruction of records that are no longer needed. Which of the following best describes the policy that meets these requirements?

A. Security policy
B. Classification policy
C. Retention policy
D. Access control policy

Answer 29

C. Retention policy.

Here’s why:

Minimizing Records: A retention policy specifies how long different types of records must be kept. By defining specific retention periods, the company can ensure it only retains records for as long as necessary, thereby keeping the fewest records possible.

Compliance Requirements: Many industries and jurisdictions have regulations that dictate how long certain types of records must be retained. A retention policy ensures that the company complies with these legal and regulatory requirements.

Destruction of Records: A retention policy also outlines procedures for the secure destruction of records once their retention period expires. This ensures that records are not kept longer than necessary and are properly disposed of when no longer needed.

Therefore, option C, a retention policy, is the most appropriate policy to meet the company’s requirements regarding records management, compliance, and record destruction.

Question 30

A systems administrator is considering switching from tape backup to an alternative backup solution that would allow data to be readily available in the event of a disaster. Which of the following backup types should the administrator implement?

A. Copy
B. Incremental
C. Cloud
D. Disk

Answer 30

C. Cloud
Explanation:

C. Cloud:

Readily Available Data: Cloud backup solutions often provide high availability and quick access to data, making it readily available in case of a disaster.
Disaster Recovery: Cloud backups are stored offsite, which is crucial for disaster recovery. This ensures that data is safe even if the physical location is compromised.
Scalability: Cloud storage solutions can easily scale to accommodate growing data needs without the need for additional physical infrastructure.
Automation: Cloud backups can often be automated, reducing the risk of human error and ensuring regular backups.
Accessibility: Data stored in the cloud can be accessed from anywhere, providing flexibility in recovery options.

While other options have their benefits, they may not offer the same level of availability and disaster recovery capability as cloud solutions:

A. Copy:

Copy backups create an exact duplicate of the data at a specific point in time. While useful, they don't inherently provide the disaster recovery benefits of offsite storage unless combined with another solution.

B. Incremental:

Incremental backups save changes made since the last backup. They are efficient in terms of storage and backup time but require a complete set of previous backups to restore, which can be time-consuming and complex in a disaster scenario.

D. Disk:

Disk-based backups provide faster recovery times compared to tape backups and can be accessed more quickly. However, without an offsite component, they do not provide the same level of disaster recovery protection as cloud solutions.

Therefore, cloud backups offer the best solution for readily available data in the event of a disaster

Question 31

A web application for a bank displays the following output when showing details about a customer’s bank account:

Bank’s account information
Account : 121406-850212-**
Client: J* E**
Amount: $1,000,000,00 USD
Date : 26-Apr-2021 02:00:00 CST

Which of the following techniques is most likely implemented in this web application?

A. Data minimization
B. Data scrambling
C. Data masking
D. Anonymization

Answer 31

C. Data masking.

Here’s why data masking (option C) is the likely technique:

Purpose: Data masking is used to obscure or hide specific portions of sensitive data while retaining its usability for certain purposes, such as display or testing.

Example: In the provided output:
    The account number is partially obscured (masked) to protect its confidentiality.
    The client's name is partially obscured, likely to maintain anonymity or privacy.

Implementation: Data masking allows applications to show relevant information to users while hiding or obfuscating parts of the data that are not necessary for the current context, thereby reducing the risk of unauthorized access or exposure.

Therefore, the technique most likely implemented in the web application displaying the customer’s bank account details is C. Data masking.

Question 32

The security team installed video cameras in a prominent location in the building lobby.
Which of the following best describe this type of control? (Choose two.)

A. Technical
B. Detective
C. Deterrent
D. Managerial
E. Compensating
F. Corrective

Answer 32

B. Detective
C. Deterrent
Explanation:

B. Detective:

Definition: Detective controls are designed to identify and alert about undesirable events that have occurred.
Application: Video cameras record activities and can be reviewed to detect unauthorized access or other security incidents.

C. Deterrent:

Definition: Deterrent controls are intended to discourage individuals from engaging in undesirable behavior by increasing the perceived risk of being caught.
Application: The presence of video cameras in a prominent location acts as a deterrent to potential intruders or wrongdoers by making them aware that their actions are being monitored and recorded.

Question 33

Which of the following is best to use when determining the severity of a vulnerability?

A. CVE
B. OSINT
C. SOAR
D. CVSS

Answer 33

D. CVSS (Common Vulnerability Scoring System)
Explanation:

D. CVSS (Common Vulnerability Scoring System):

Definition: CVSS is a standardized framework for rating the severity of security vulnerabilities. It provides a numerical score that reflects the severity of a vulnerability based on several factors, including the ease of exploitability and the potential impact on the system.
Application: CVSS scores help organizations prioritize vulnerabilities based on their severity and potential impact, making it a crucial tool for vulnerability management.

The other options are not as specifically designed for determining the severity of a vulnerability:

A. CVE (Common Vulnerabilities and Exposures):

Definition: CVE is a list of publicly disclosed information security vulnerabilities and exposures.
Application: CVE identifiers are used to uniquely identify vulnerabilities, but they do not provide a severity rating. They are often used in conjunction with CVSS scores to describe vulnerabilities.

B. OSINT (Open Source Intelligence):

Definition: OSINT involves collecting and analyzing publicly available information to support security efforts.
Application: While useful for gathering context and intelligence on threats, OSINT does not provide a standardized method for determining vulnerability severity.

C. SOAR (Security Orchestration, Automation, and Response):

Definition: SOAR platforms are designed to improve the efficiency and effectiveness of security operations by automating and orchestrating security tasks and responses.
Application: SOAR tools can help manage and respond to vulnerabilities, but they are not specifically used for determining the severity of a vulnerability.

Question 34

Which of the following best describes an environment where a business owns the application and operating system but requires the resources to host them in the cloud?

A. IaaS
B. XaaS
C. PaaS
D. SaaS

Answer 34

A. IaaS (Infrastructure as a Service).

Here’s why:

IaaS: Infrastructure as a Service provides virtualized computing resources over the internet. In this model, the cloud provider manages the infrastructure, including servers, storage, and networking. However, the business retains control over the operating systems, applications, and development frameworks that run on the infrastructure.

Ownership: In the described scenario, the business owns and manages the operating systems and applications. They are responsible for installing, configuring, and maintaining these components on the cloud-based infrastructure provided by the IaaS provider.

Flexibility: IaaS allows businesses to scale resources up or down as needed, pay only for what they use, and avoid the upfront costs and complexity of owning and maintaining physical hardware.

Therefore, A. IaaS (Infrastructure as a Service) is the best description of an environment where a business owns the application and operating system but leverages cloud resources for hosting.

Question 35

An organization wants to minimize the recovery time from backups in case of a disaster. Backups must be retained for one month, while minimizing the storage space used for backups. Which of the following is the best approach for a backup strategy?

A. Full monthly, incremental daily, and differential weekly
B. Full weekly and incremental daily
C. Full weekly and differential daily
D. Full daily

Answer 35

(Brain dump : C. Full weekly and differential daily)
(Community : C 45%, B 39%, A 16%)
Full weekly and differential daily. This option will minimize the recovery time, as you only need to restore the latest the latest full backup and latest differential backup to get the most recent data. It will also minimize the storage space, as differential backups only store the changes made since the last full backup, unlike incremental backups that store the changes made since the last backup of any type

ChatGPT
B. Full weekly and incremental daily

Here’s why this approach is suitable:

Full Weekly: Performing a full backup weekly ensures that all data is backed up completely once a week. This helps in quickly restoring data in case of a disaster because the most recent full backup is readily available.

Incremental Daily: Incremental backups capture only the changes made since the last backup, whether it was a full or incremental backup. This approach reduces the amount of data stored daily compared to full backups, thus minimizing storage space usage.

Advantages:

Recovery Time: With daily incremental backups, the recovery time can be minimized because only the full backup and the incremental backups since the last full backup need to be restored.

Storage Efficiency: Incremental backups are efficient in terms of storage because they only store changes, which are typically smaller than full backups. This helps in meeting the requirement to minimize storage space used for backups.

Therefore, B. Full weekly and incremental daily is the best approach for balancing quick recovery times and efficient use of storage space in the event of a disaster.

Question 36

An incident analyst finds several image files on a hard disk. The image files may contain geolocation coordinates. Which of the following best describes the type of information the analyst is trying to extract from the image files?

A. Log data
B. Metadata
C. Encrypted data
D. Sensitive data

Answer 36

B. Metadata.

Here’s why:

Metadata: Image files often contain metadata, which includes information about the file itself, such as the date and time the photo was taken, the camera settings, and sometimes geolocation coordinates (latitude and longitude) if the device that captured the image supports GPS tagging.

Geolocation Coordinates: Some image files, especially those taken with smartphones or GPS-enabled cameras, embed geolocation coordinates in the metadata. This can reveal where the photo was taken, which may be sensitive information if not handled appropriately.

Analyst's Role: The incident analyst is likely interested in extracting metadata from the image files to understand if they contain geolocation coordinates, as this information could potentially be sensitive or pose a security risk depending on the context.

Therefore, the analyst is primarily focused on extracting metadata from the image files to identify and potentially manage the presence of geolocation coordinates.

Question 37

A company uses a SaaS vendor to host its customer database. The company would like to reduce the risk of customer data exposure if the systems are breached. Which of the following risks should the company focus on to achieve this objective?

A. Access auditing
B. Outsourced code development
C. Supply chain
D. Open ports and services

Answer 37

Community : A 45%, C 33%, D 22%
A. Access auditing
The company has to depend on or trust the SaaS vendor concerning B-D. Worry all it wants to about that. Get a different vendor if you can’t trust it. A is the only one the company has control over to put focus upon

(ChatGPT)
A. Access auditing
Explanation:

Access auditing:

Purpose: Access auditing involves monitoring and reviewing who has access to sensitive data, how and when they access it, and ensuring that access controls are properly enforced.
Importance: By focusing on access auditing, the company can ensure that only authorized individuals have access to the customer data. This helps in detecting and responding to any unauthorized access attempts promptly, thus reducing the risk of data exposure.
Mitigation: Implementing stringent access control mechanisms, regular audits, and monitoring access logs can significantly reduce the likelihood of unauthorized data access and potential breaches.

Why Other Options Are Less Relevant in This Context:

B. Outsourced code development:

Focus: This relates to the security and quality of code developed by third-party vendors. While important, it is less directly related to mitigating the risk of data exposure in a SaaS environment compared to access auditing.

C. Supply chain:

Focus: Supply chain risk management addresses vulnerabilities that arise from third-party vendors and service providers. Although supply chain security is crucial, access auditing is more directly related to controlling and monitoring access to customer data.

D. Open ports and services:

Focus: This pertains to network security and ensuring that unnecessary ports and services are not exposed to potential attackers. While securing open ports and services is important, it is more relevant to network-level security rather than directly reducing the risk of customer data exposure in a SaaS environment.

Therefore, focusing on access auditing is the most effective way to reduce the risk of customer data exposure in a SaaS environment.

(Brain dump : D. Open ports and services)

Question 38

An employee finds a USB flash drive labeled “Salary Info” in an office parking lot. The employee picks up the USB flash drive, goes into the office, and plugs it into a laptop. Later, a technician inspects the laptop and realizes it has been compromised by malware. Which of the following types of social engineering attacks has occurred?

A. Smishing
B. Baiting
C. Tailgating
D. Pretexting

Answer 38

B. Baiting.

Here’s why:

Baiting: In baiting attacks, malicious actors leave physical devices like USB flash drives labeled with enticing names (such as "Salary Info") in locations where they are likely to be found by employees. The goal is to pique curiosity or appeal to the employee's interests, leading them to plug the device into a computer.

Scenario Explanation: In this case, the employee found a USB flash drive labeled "Salary Info" in the office parking lot. This label was designed to attract attention and induce the employee to connect the USB drive to a laptop. Unfortunately, this action led to the laptop becoming compromised with malware.

Outcome: By plugging in the USB drive, the employee unknowingly introduced malware into the corporate network, demonstrating the effectiveness of the baiting tactic.

Therefore, the social engineering attack described in the scenario is B. Baiting.

Question 39

The primary goal of the threat-hunting team at a large company is to identify cyberthreats that the SOC has not detected. Which of the following types of data would the threat-hunting team primarily use to identify systems that are exploitable?

A. Vulnerability scan
B. Packet capture
C. Threat feed
D. User behavior

Answer 39

Community : C 37%, B 37%, A 23%
C. Threat feed
COMPTIA says “Where vulnerability scanning uses lists of patches and standard definitions of baseline configurations, threat hunting is an assessment technique that utilizes insights
gained from threat intelligence to proactively discover whether there is evidence of
TTPs already present within the network or system”.

This eliminates option A. Vulnerability scan.

Darril Gibson mentions the tools used for threat hunting include OSINT, threat feeds, intelligence fusion (which combines all this data to create a picture of likely threats and risks for an organization. This helps the cybersecurity analysts understand how threat actors may maneuver through the network, how to detect them, and how to mitigate their efforts once they’re discovered)

Within the Darril Gibson Sec+ SY0-601 Study Guide it identifies and lists Threat Feeds within its Threat Hunting section.

Threat Hunting is the process of actively looking for threats within a network before an automated tool detects and reports on the threat. An important part of Threat Hunting is gathering data on the threat through threat intelligence. This knowledge comes from both internal and external sources.

Threat Feeds provide subscribers with up-to-date information on current threats. Threat Feeds use both structured data reports and unstructured reports.

(Brain dump & ChatGPT)
A. Vulnerability scan

Here’s why:

Vulnerability Scan: A vulnerability scan involves scanning systems and networks to identify known vulnerabilities that could be exploited by attackers. By regularly conducting vulnerability scans, the threat-hunting team can identify systems that have vulnerabilities that could potentially be exploited.

Exploitability: Vulnerability scan results provide information on specific vulnerabilities present in systems, including their severity and potential impact. This helps the threat-hunting team prioritize and investigate systems that are at higher risk of being exploited.

Complementing SOC: While the SOC focuses on monitoring and detecting known threats and suspicious activities in real-time, the threat-hunting team's role often involves proactive searching for potential threats and weaknesses that might not have been previously identified by automated systems or alerts.

Therefore, to identify systems that are exploitable and to fulfill their goal of discovering cyberthreats that the SOC may have missed, the threat-hunting team would primarily use A. Vulnerability scan data.

Question 40

Which of the following best describes the process of adding a secret value to extend the length of stored passwords?

A. Hashing
B. Quantum communications
C. Salting
D. Perfect forward secrecy

Answer 40

C. Salting.

Here’s why salting is the correct answer:

Salting: Salting is the technique of adding a unique, random value (known as a salt) to each password before hashing it. This salt value ensures that even if two users have the same password, their hashed passwords stored in the database will be different. Salting helps defend against attacks like rainbow table attacks, where attackers precompute hashes for common passwords.

Purpose: Salting extends the effective length of stored passwords by making each password unique when hashed with its salt. This enhances the security of stored passwords because it prevents attackers from easily using precomputed hash tables to crack passwords.

Comparison with Other Options:
    Hashing (option A): Hashing alone does not involve adding a salt. It converts a password into a fixed-length hash value.
    Quantum communications (option B): This refers to secure communication methods using principles of quantum mechanics, not related to password storage.
    Perfect forward secrecy (option D): This ensures that session keys are not compromised even if long-term keys are compromised, not directly related to password hashing.

Therefore, the process described, where a secret value is added to passwords to extend their length in storage, is best represented by C. Salting.

Question 41

Adding a value to the end of a password to create a different password hash is called:

A. salting.
B. key stretching.
C. steganography.
D. MD5 checksum

Answer 41

A. salting
Explanation:

Salting:

Definition: Salting involves adding a unique value (known as a salt) to the end (or beginning) of a password before hashing it. This salt ensures that even if two users have the same password, their hashes will be different because each hash incorporates a unique salt.
Purpose: The primary purpose of salting is to protect against rainbow table attacks and ensure that identical passwords do not result in identical hashes, thus enhancing security.

Why Other Options Are Incorrect:

B. Key stretching:

Definition: Key stretching is a technique used to make brute-force attacks more difficult by applying a hash function multiple times. While related to password security, it does not specifically involve adding a value to the end of a password.

C. Steganography:

Definition: Steganography is the practice of hiding data within other data, such as embedding a hidden message within an image. It is not related to password hashing.

D. MD5 checksum:

Definition: MD5 is a cryptographic hash function that produces a 128-bit hash value. An MD5 checksum is the result of hashing data with MD5. It does not involve adding a value to a password, and MD5 is generally not recommended for password hashing due to its vulnerabilities.

Therefore, the correct term for adding a value to the end of a password to create a different password hash is salting.

Question 42

An organization is concerned about hackers bypassing MFA through social engineering of phone carriers. Which of the following would most likely protect against such an attack?

A. Receiving alerts about unusual log-in activity
B. Receiving a six-digit code via SMS
C. Receiving a push notification to a mobile application
D. Receiving a phone call for automated approval

Answer 42

C. Receiving a push notification to a mobile application

The organization’s concern about hackers bypassing Multi-Factor Authentication (MFA) through social engineering of phone carriers suggests a need for an MFA method that is less vulnerable to SIM swapping or phone number porting attacks, which are common in such social engineering tactics.

Among the options provided:

A. Receiving alerts about unusual log-in activity: While this can help detect unauthorized access attempts, it does not directly prevent or protect against SIM swapping attacks.

B. Receiving a six-digit code via SMS: This method is vulnerable to SIM swapping attacks because attackers can intercept SMS messages containing the verification code if they successfully transfer the victim’s phone number to their own device.

C. Receiving a push notification to a mobile application: This method is generally more secure than SMS because push notifications are not vulnerable to SIM swapping attacks. They are sent directly to the registered mobile device and cannot be intercepted by attackers who have only taken control of the victim’s phone number.

D. Receiving a phone call for automated approval: This method, while potentially secure if implemented properly, can also be vulnerable to SIM swapping attacks if the attacker has control over the victim’s phone number.

Therefore, the option that would most likely protect against hackers bypassing MFA through social engineering of phone carriers is C. Receiving a push notification to a mobile application. This method is less vulnerable to SIM swapping attacks compared to SMS-based authentication methods.

Question 43

A security analyst is working with a vendor to get a new SaaS application deployed to an enterprise. The analyst wants to ensure role-based security policies are correctly applied as users access the application. Which of the following is most likely to solve the issue?

A. CASB
B. AUP
C. NG-SWG
D. VPC endpoint

Answer 43

A. CASB (Cloud Access Security Broker).

Here’s why CASB is the correct choice:

CASB: CASBs are cloud-native security tools that sit between users and cloud service providers to enforce security policies. They provide visibility into cloud usage, data protection, and threat protection across SaaS applications. CASBs can enforce role-based access controls (RBAC) by integrating with identity and access management (IAM) systems, ensuring that only authorized users with specific roles have appropriate access to the SaaS application.

Role-Based Security Policies: CASBs can enforce policies based on user roles, ensuring that users are granted the correct permissions and access levels according to their roles within the organization.

Other Options:
    AUP (Acceptable Use Policy): AUP defines acceptable behavior when using IT resources but does not enforce role-based security policies.
    NG-SWG (Next-Generation Secure Web Gateway): NG-SWG primarily focuses on web traffic security, filtering, and monitoring rather than role-based access controls for SaaS applications.
    VPC endpoint (Virtual Private Cloud endpoint): VPC endpoints are used to connect privately to AWS services without traversing the internet, but they do not directly address role-based security policies for SaaS applications.

Therefore, A. CASB (Cloud Access Security Broker) is the most likely solution to ensure role-based security policies are correctly applied as users access the SaaS application in the enterprise environment.

Question 44

A municipality implements an IoT device discovery scanner and finds a legacy controller for a critical internal utility SCADA service that is running firmware with multiple vulnerabilities. Unfortunately, the controller cannot be upgraded, and a replacement for it is not available for at least a year. Which of the following is the best action to take to mitigate the risk posed by this controller in the meantime?

A. Isolate the controller from the rest of the network and constrain connectivity.
B. Remove the controller from the network altogether.
C. Quarantine the controller in a VLAN used for device patching from the internet.
D. Configure the internet firewall to deny any internet access to or from the controller.

Answer 44

A. Isolate the controller from the rest of the network and constrain connectivity.

Here’s why this is the best choice:

Isolation: By isolating the controller from the rest of the network, you reduce the attack surface and limit the potential pathways for attackers to exploit vulnerabilities in the firmware.

Constrain Connectivity: Restricting connectivity means ensuring that only necessary communication paths are allowed to and from the controller. This can involve implementing firewall rules or network segmentation to control which devices or systems can communicate with the controller.

Considerations:
    Option B (Removing the controller): This may not be feasible if the controller is critical to the SCADA service and no immediate replacement is available.
    Option C (Quarantine in a VLAN): While VLAN quarantine is useful for patching devices, it may not fully mitigate risks if the vulnerabilities are severe and can be exploited locally within the network.
    Option D (Deny internet access): This is important but may not be sufficient if the vulnerabilities could be exploited internally within the network.

Therefore, A. Isolate the controller from the rest of the network and constrain connectivity is the best immediate action to reduce the risk until a replacement or upgrade for the controller becomes available.

Question 45

Which of the following types of data are most likely to be subject to regulations and laws? (Choose two.)

A. PHI
B. Trade secrets
C. Proprietary
D. OSINT
E. PII
F. Public

Answer 45

A. PHI (Protected Health Information) - PHI refers to any health information that can be linked to a specific individual, which is protected by laws such as the Health Insurance Portability and Accountability Act (HIPAA) in the United States. Regulations ensure that PHI is handled securely and confidentially to protect individuals’ privacy and rights.

E. PII (Personally Identifiable Information) - PII includes any information that can be used to identify an individual, such as their name, address, Social Security number, or biometric data. Laws and regulations worldwide, such as the General Data Protection Regulation (GDPR) in the European Union and various data protection laws in different countries, govern the collection, use, and protection of PII to prevent unauthorized access and misuse.

Explanation:

Trade secrets (option B) and proprietary (option C) information can be protected through contractual agreements and intellectual property laws, but they are not typically subject to the same regulatory requirements as PHI and PII.

OSINT (option D) refers to information gathered from publicly available sources and is not subject to specific privacy laws but may be subject to ethical considerations and terms of service agreements.

Public (option F) data is information that is freely accessible and generally not subject to privacy laws, as it does not contain sensitive personal or confidential information.

Therefore, the types of data most likely to be subject to regulations and laws are A. PHI and E. PII.

Question 46

An analyst is reviewing an incident in which a user clicked on a link in a phishing email. Which of the following log sources would the analyst utilize to determine whether the connection was successful?

A. Network
B. System
C. Application
D. Authentication

Answer 46

A. Network logs.

Here’s why:

Network Logs: Network logs capture information about network traffic, including connections made from endpoints (like a user's computer) to external servers or websites. When a user clicks on a link in a phishing email, the associated network logs can provide details such as:
    Destination IP address and domain name.
    Port numbers used for the connection.
    Protocol (e.g., HTTP, HTTPS) used for the connection.
    Timestamps of the connection attempts.

Detection: By examining network logs, the analyst can determine if the user's computer attempted to establish a connection to a suspicious or malicious external server or website after clicking on the phishing link. This can help in understanding the potential impact and scope of the incident.

Other Options:

System Logs (option B): While system logs might capture some information about user activity on the local machine, they typically do not provide detailed information about external network connections initiated by clicking a link.

Application Logs (option C): Application logs focus on activities within specific applications or services running on the system and may not directly capture external network connection attempts.

Authentication Logs (option D): Authentication logs track user login and authentication events but do not provide information about network connections initiated from clicking on a link.

Therefore, A. Network logs are the most relevant log source for determining whether a connection was successful after a user clicked on a link in a phishing email.

Question 47

Which of the following, if compromised, can indirectly impact systems’ availability by imposing inadequate environmental conditions for the hardware to operate properly?

A. SCADA
B. TPM
C. HSM
D. HVAC

Answer 47

D. HVAC.

Here’s why:

HVAC (Heating, Ventilation, and Air Conditioning) systems are critical for maintaining appropriate environmental conditions (temperature, humidity, airflow) in data centers and other facilities where hardware systems operate.

Impact on Availability: If the HVAC system is compromised or malfunctions, it can lead to inadequate environmental conditions:
    Temperature: High temperatures can cause overheating and hardware failure, while low temperatures can lead to operational issues.
    Humidity: Incorrect humidity levels can cause condensation or static electricity, affecting hardware components.
    Airflow: Inadequate airflow can lead to hotspots or uneven cooling, impacting hardware performance and reliability.

Indirect Impact: While SCADA (Supervisory Control and Data Acquisition), TPM (Trusted Platform Module), and HSM (Hardware Security Module) are critical for managing and securing systems, they do not directly control environmental conditions. Compromising HVAC systems indirectly impacts the availability of hardware by creating unfavorable environmental conditions that can lead to system downtime or reduced performance.

Therefore, D. HVAC is the correct choice as it can indirectly impact system availability by imposing inadequate environmental conditions necessary for hardware to operate properly.

Question 48

An audit report showed that a former employee saved the following files to an external USB drive before the employee’s termination date:

• annual_tax_form.pdf
• encrypted_passwords.db
• team_picture.jpg
• contact_list.db
• human_resources.txt

Which of the following could the former employee do to potentially compromise corporate credentials?

A. Perform an offline brute-force attack
B. Use the files to create a rainbow table.
C. Conduct a token replay.
D. Release a network dictionary attack

Answer 48

A. Perform an offline brute-force attack

Here’s the reasoning:

encrypted_passwords.db: This file likely contains passwords that are encrypted. If the encryption method is weak or if the passwords are not properly protected, the former employee could attempt to perform an offline brute-force attack. In this attack, the encrypted passwords would be systematically decrypted using various techniques, such as trying different password combinations, until the correct one is found.

Other Options:
    Use the files to create a rainbow table (option B): Rainbow tables are precomputed tables used for reversing cryptographic hash functions to crack passwords. However, this requires specific hashes and is less likely with the files listed.
    Conduct a token replay (option C): Token replay attacks involve capturing and replaying valid authentication tokens to gain unauthorized access. None of the listed files directly suggest a token-based authentication method.
    Release a network dictionary attack (option D): This involves using a list of known words or commonly used passwords to attempt unauthorized access. The files listed do not necessarily facilitate this type of attack directly.

Therefore, A. Perform an offline brute-force attack is the most plausible method the former employee could use to potentially compromise corporate credentials based on the files saved to the USB drive.

Question 49

Which of the following best describes a legal hold?

A. It occurs during litigation and requires retention of both electronic and physical documents.
B. It occurs during a risk assessment and requires retention of risk-related documents.
C. It occurs during incident recovery and requires retention of electronic documents.
D. It occurs during a business impact analysis and requires retention of documents categorized as personally identifiable information

Answer 49

A. It occurs during litigation and requires retention of both electronic and physical documents.

Here’s why:

Legal Hold: A legal hold, also known as a litigation hold or preservation order, is a directive to preserve all forms of relevant information (both electronic and physical documents) that may be related to a legal proceeding or investigation. It is issued to prevent the destruction, alteration, or loss of potentially relevant evidence.

Litigation Context: Legal holds are typically issued when litigation or a legal dispute is anticipated or already in progress. They require organizations to retain documents and data that may be pertinent to the case, ensuring that all relevant information is preserved for potential discovery and review by the opposing party.

Other Options:
    Option B: Risk assessments focus on evaluating risks and their impacts, not legal holds.
    Option C: Incident recovery involves restoring systems and data after an incident, not necessarily related to legal holds.
    Option D: Business impact analysis assesses the potential consequences of disruptions to business operations, not related to legal holds.

Therefore, A. It occurs during litigation and requires retention of both electronic and physical documents accurately describes the purpose and context of a legal hold.

Question 50

A company wants to move one of its environments to the cloud. The biggest requirement is to have as much control as possible regarding the environment. Which of the following would most likely satisfy this requirement?

A. SaaS
B. IaaS
C. PaaS
D. MaaS

Answer 50

B. IaaS (Infrastructure as a Service).

Here’s why:

IaaS: Infrastructure as a Service provides the highest level of control among the options listed. With IaaS, the company has control over the virtualized infrastructure components, such as virtual machines, storage, and networking resources. This allows them to install, configure, and manage operating systems, applications, and middleware on the cloud infrastructure.

Control: Companies opting for IaaS can choose the operating systems, applications, and configurations that best suit their needs. They have flexibility in scaling resources up or down based on demand and can implement security measures and access controls tailored to their requirements.

Other Options:
    SaaS (Software as a Service): Provides the least amount of control as the company only uses the provider's applications running on the cloud infrastructure.
    PaaS (Platform as a Service): Provides a platform and environment for developing, testing, and managing applications, but with less control over the underlying infrastructure compared to IaaS.
    MaaS (Monitoring as a Service): Typically refers to cloud-based monitoring services, not related to infrastructure control.

Therefore, B. IaaS (Infrastructure as a Service) is the option that would most likely satisfy the company’s requirement for having as much control as possible regarding the environment when moving to the cloud.