Attacks, Threats, and Vulnerabilities

Question 1

A vulnerability assessment report will include the CVSS score of the discovered vulnerabilities because the score allows the organization to better:

Answer 1

prioritize remediation of vulnerabilities based on the possible impact

Question 2

A security analyst is investigating an incident that was first reported as an issue connecting to network shares and the Internet. While reviewing logs and tool output, the analyst sees the following:

Answer 2

ARP poisoning

Question 3

A security administrator checks the table of a network switch, which shows the following output:

Answer 3

MAC flooding

Question 4

A company’s public-facing website, https://www.organization.com, has an IP address of 166.18.75.6. However, over the past hour the SOC has received reports of the site’s homepage displaying incorrect information. A quick nslookup search shows https://www.organization.com is pointing to 151.191.122.115. Which of the following is occurring?

Answer 4

DNS spoofing

Question 5

A security monitoring company offers a service that alerts its customers if their credit cards have been stolen. Which of the following is the MOST likely source of this information?

Answer 5

The dark web

Question 6

A security administrator manages five on-site APs. Each AP uses different channels on a 5GHz network. The administrator notices that another access point with the same corporate SSID on an overlapping channel was created. Which of the following attacks most likely occurred?

Answer 6

Evil twin

Question 7

A local business was the source of multiple instances of credit card theft. Investigators found that most payments at this business were made at self-service kiosks. Which of the following is the most likely cause of the exposed credit card Information?

Answer 7

NFC attack

Question 8

An employee receives an email stating the employee won the lottery. The email includes a link that requests a name, mobile phone number, address, and date of birth be provided to confirm employee’s identity before sending the prize. Which of the following best describes this type of email?

Answer 8

Phishing

Question 9

Which of the following is most likely associated with introducing vulnerabilities on a corporate network by the deployment of unapproved software?

Answer 9

Shadow IT

Question 10

The most recent vulnerability scan flagged the domain controller with a critical vulnerability. The systems administrator researched the vulnerability and discovered the domain controller does not run the associated application with the vulnerability. Which of the following steps should the administrator take next?

Answer 10

Document this as a false positive

Question 11

Which of the following describes the exploitation of an interactive process to gain access to restricted areas?

Answer 11

Privilege escalation

Question 12

Travis, a penetration tester, heard about a new vulnerability that affects many modern platforms. Which of the following would be BEST to consult in order to determine exactly which platforms have been affected?

Answer 12

CVE

Notably, we are asking about PLATFORMS here and not individual systems on a network. A platform is generally just the types of OSs that would be potentially compromised by this new vulnerability.

CVEs (Common Vulnerabilities and Exposures) is a database of known vulnerabilities as well as their attributes, including affected platform.

Question 13

A security administrator received an alert for a user account with the following log activity:

Answer 13

Impossible travel time

Question 14

Which of the following are common VoIP-associated vulnerabilities? (Choose two).

Answer 14

SPIM
Vishing

SPIM messages use on a DoS or DDoS attack can degrade the quality of VoIP calls, overload servers, and serve as a platform for social engineering attacks, jeopardizing the security of VoIP users

Question 15

A hosting provider needs to prove that its security controls have been in place over the last six months and have sufficiently protected customer data. Which of the following would provide the best proof that the hosting provider has met the requirements?

Answer 15

SOC 2 Type 2 report

Question 16

An enterprise has hired an outside security firm to conduct penetration testing on its network and applications. The firm has been given all the developer’s documentation about the internal architecture. Which of the following best represents the type of testing that will occur?

Answer 16

White-box

Question 17

A security engineer is working to address the growing risks that shadow IT services are introducing to the organization. The organization has taken a cloud-first approach and does not have an on-premises IT infrastructure. Which of the following would best secure the organization?

Answer 17

Deploying an appropriate in-line CASB solution

Question 18

A company wants to pragmatically grant access to users who have the same job. Which of the following access controls should the company most likely use?

Answer 18

Role-based

Question 19

A company wants to reconfigure an existing wireless infrastructure. The company needs to ensure the projected WAP placement will provide proper signal strength to all workstations. Which of the following should the company use to best fulfill the requirements?

Answer 19

Heat map

Question 20

A security team created a document that details the order in which critical systems should be brought back online after a major outage. Which of the following documents did the team create?

Answer 20

Disaster recovery plan

Question 21

In a rush to meet an end-of-year business goal, the IT department was told to implement a new business application. The security engineer reviews the attributes of the application and decides the time needed to perform due diligence is insufficient from a cybersecurity perspective. Which of the following BEST describes the security engineer’s response?

Answer 21

Risk acceptance

Question 22

Which of the following ensures an organization can continue to do business with minimal interruption in the event of a major disaster?

Answer 22

Continuity of operations plan

Question 23

Following a recent security breach, an analyst discovered that user permissions were added when joining another part of the organization but were not removed from existing groups. Which of the following policies would help to correct these issues in the future?

Answer 23

Account audits

Question 24

An employee recently resigned from a company. The employee was responsible for managing and supporting weekly batch jobs over the past five years. A few weeks after the employee resigned, one of the batch jobs failed and caused a major disruption. Which of the following would work best to prevent this type of incident from reoccurring?

Answer 24

Job rotation

Question 25

A security analyst is assessing several company firewalls. Which of the following tools would the analyst most likely use to generate custom packets to use during the assessment?

Answer 25

hping

Question 26

The local administrator account for a company’s VPN appliance was unexpectedly used to log in to the remote management interface. Which of the following would have prevented this from happening?

Answer 26

Implementing multifactor authentication

Question 27

A newly identified network access vulnerability has been found in the OS of legacy IoT devices. Which of the following would best mitigate this vulnerability quickly?

Answer 27

Segmentation

Question 28

Which of the following would be best suited for constantly changing environments?

Answer 28

Containers

Question 29

A data administrator is configuring authentication for a SaaS application and would like to reduce the number of credentials employees need to maintain. The company prefers to use domain credentials to access new SaaS applications. Which of the following methods would allow this functionality?

Answer 29

SSO

Question 30

A security team has been alerted to a flood of incoming emails that have various subject lines and are addressed to multiple email inboxes. Each email contains a URL shortener link that is redirecting to a dead domain. Which of the following is the best step for the security team to take?

Answer 30

Block the URL shortener domain in the web proxy

Question 31

An administrator receives the following network requirements for a data integration with a third-party vendor:

Which of the following is the most appropriate response for the administrator to send?

Answer 31

FTP is an insecure protocol and should not be used

Question 32

A cybersecurity incident response team at a large company receives notification that malware is present on several corporate desktops. No known indicators of compromise have been found on the network. Which of the following should the team do first to secure the environment?

Answer 32

Contain the impacted hosts

Question 33

The Chief Technology Officer of a local college would like visitors to utilize the school’s Wi-Fi but must be able to associate potential malicious activity to a specific person. Which of the following would best allow this objective to be met?

Answer 33

Deploying a captive portal to capture visitors’ MAC addresses and names

Question 34

A company currently uses passwords for logging in to company-owned devices and wants to add a second authentication factor. Per corporate policy, users are not allowed to have smartphones at their desks. Which of the following would meet these requirements?

Answer 34

Smart card

Question 35

Local guidelines require that all information systems meet a minimum security baseline to be compliant. Which of the following can security administrators use to assess their system configurations against the baseline?

Answer 35

Benchmarks

Question 36

A privileged user at a company stole several proprietary documents from a server. The user also went into the log files and deleted all records of the incident. The systems administrator has just informed investigators that other log files are available for review. Which of the following did the administrator most likely configure that will assist the investigators?

Answer 36

The syslog server

Question 37

A company is designing the layout of a new data center so it will have an optimal environmental temperature. Which of the following must be included? (Choose two.)

Answer 37

A cold aisle

A hot aisle

Question 38

Which of the following is a common source of unintentional corporate credential leakage in cloud environments?

Answer 38

Code repositories

Developers sometimes inadvertently include sensitive information, such as API keys, passwords, and other credentials, in their code. When this code is pushed to public repositories (e.g., GitHub, GitLab), those credentials can be exposed to the world, leading to potential credential leakage.

Question 39

An employee fell for a phishing scam, which allowed an attacker to gain access to a company PC. The attacker scraped the PC’s memory to find other credentials. Without cracking these credentials, the attacker used them to move laterally through the corporate network. Which of the following describes this type of attack?

Answer 39

Pass-the-hash

Question 40

A recent vulnerability scan revealed multiple servers have non-standard ports open for applications that are no longer in use. The security team is working to ensure all devices are patched and hardened. Which of the following would the security team perform to ensure the task is completed with minimal impact to production?

Answer 40

Disable unnecessary services

Question 41

A certificate vendor notified a company that recently invalidated certificates may need to be updated. Which of the following mechanisms should a security administrator use to determine whether the certificates installed on the company’s machines need to be updated?

Answer 41

CRL

If OCSP was in place and functioning correctly, the revocation status would be determined in real-time, reducing the need for manual intervention from the admin upon vendor notification.
The scenario described—where the certificate vendor notifies the company about invalidated certificates—does suggest a more manual or batch process of checking revocation, which aligns with the use of CRLs

Question 42

A security analyst is reviewing SIEM logs during an ongoing attack and notices the following:

Which of the following best describes the type of attack?

Answer 42

Directory traversal

Question 43

A penetration-testing firm is working with a local community bank to create a proposal that best fits the needs of the bank. The bank’s information security manager would like the penetration test to resemble a real attack scenario, but it cannot afford the hours required by the penetration-testing firm. Which of the following would best address the bank’s desired scenario and budget?

Answer 43

Provide limited networking details in a partially known-environment test to reduce reconnaissance efforts.

Question 44

A security analyst needs to harden access to a network. One of the requirements is to authenticate users with smart cards. Which of the following should the analyst enable to best meet this requirement?

Answer 44

EAP-TLS

EAP-TLS is a robust authentication protocol that utilizes digital certificates, typically stored on smart cards, to authenticate users within a network.

Question 45

A software company adopted the following processes before releasing software to production:

* Peer review
* Static code scanning
* Signing

A considerable number of vulnerabilities are still being detected when code is executed on production. Which of the following security tools can improve vulnerability detection on this environment?

Answer 45

Dynamic code analysis tool

Question 46

The following IP information was provided to internal auditors to help assess organizational security:

Which of the following tools would most likely be used to perform network reconnaissance and help understand what is accessible to all users? (Choose two.)

Answer 46

ping

traceroute

Question 47

A new company wants to avoid channel interference when building a WLAN. The company needs to know the radio frequency behavior, identify dead zones, and determine the best place for access points. Which of the following should be done first?

Answer 47

Conduct a site survey

While a Wi-Fi analyzer is a valuable tool and will likely be used during the site survey and subsequent optimization steps, starting with a site survey provides a holistic view of the environment before focusing on specific aspects like channel selection and interference analysis

Question 48

An organization is building a single virtual environment that will host customer applications and data that require availability at all times. The data center that is hosting the environment will provide generator power and ISP services. Which of the following is the best solution to support the organization’s requirement?

Answer 48

UPS

Question 49

A recent malware outbreak across a subnet included successful rootkit installations on many PCs, ensuring persistence by rendering remediation efforts ineffective. Which of the following would best detect the presence of a rootkit in the future?

Answer 49

EDR

Question 50

Following a prolonged data center outage that affected web-based sales, a company has decided to move its operations to a private cloud solution. The security team has received the following requirements:

-There must be visibility into how teams are using cloud-based services.
-The company must be able to identify when data related to payment cards is being sent to the cloud.
-must be available regardless of the end user’s geographic location.
-Administrators need a single pane-of-glass view into traffic and trends.

Which of the following should the security analyst recommend?

Answer 50

Implement a CASB solution

Question 51

An internet company has created a new collaboration application. To expand the user base, the company wants to implement an option that allows users to log in to the application with the credentials of other popular websites. Which of the following should the company implement?

Answer 51

OpenID

Question 52

A company has decided to move its operations to the cloud. It wants to utilize technology that will prevent users from downloading company applications for personal use, restrict data that is uploaded, and have visibility into which applications are being used across the company. Which of the following solutions will best meet these requirements?

Answer 52

A CASB

Question 53

During an investigation, events from two affected servers in the same subnetwork occurred at the same time:

Server 1: 192.168.10.1 [01/Apr/2021:06:00:00 PST] SAN access denied for user ‘admin’
Server 2: 192.168.10.6 [01/Apr/2021:06:01:01 CST] SAN access successful for user ‘admin’

Which of the following should be consistently configured to prevent the issue seen in the logs?

Answer 53

NTP

Question 54

Which of the following best represents an application that does not have an on-premises requirement and is accessible from anywhere?

Answer 54

SaaS

Question 55

A security architect at a large, multinational organization is concerned about the complexities and overhead of managing multiple encryption keys securely in a multicloud provider environment. The security architect is looking for a solution with reduced latency to allow the incorporation of the organization’s existing keys and to maintain consistent, centralized control and management regardless of the data location. Which of the following would best meet the architect’s objectives?

Answer 55

HSMaaS

HSMaaS is a cloud service that offers dedicated cryptographic processing and key management. It’s designed to protect sensitive data and allows for centralized management and storage of encryption keys.

Question 56

Which of the following best describes the risk that is present once mitigations are applied?

Answer 56

Residual risk

Question 57

While investigating a recent security breach, an analyst finds that an attacker gained access by SQL injection through a company website. Which of the following should the analyst recommend to the website developers to prevent this from reoccurring?

Answer 57

Input sanitization

Question 58

Historically, a company has had issues with users plugging in personally owned removable media devices into corporate computers. As a result, the threat of malware incidents is almost constant. Which of the following would best help prevent the malware from being installed on the computers?

Answer 58

EDR

Question 59

A company reduced the area utilized in its data center by creating virtual networking through automation and by creating provisioning routes and rules through scripting. Which of the following does this example describe?

Answer 59

IaC

Question 60

Which of the following explains why an attacker cannot easily decrypt passwords using a rainbow table attack?

Answer 60

Salting

Question 61

Which of the following best describes a use case for a DNS sinkhole?

Answer 61

A DNS sinkhole can be used to capture traffic to known-malicious domains used by attackers

A DNS sinkhole redirects traffic destined for a malicious domain to a safe IP address or server under the control of security defenders. This allows security teams to analyze traffic intended for malicious domains or prevent attacks by blocking access to those domains.

Question 62

An attacker posing as the Chief Executive Officer calls an employee and instructs the employee to buy gift cards. Which of the following techniques is the attacker using?

Answer 62

Vishing

Question 63

A company requires hard drives to be securely wiped before sending decommissioned systems to recycling. Which of the following best describes this policy?

Answer 63

Sanitization

Question 64

After a recent vulnerability scan, a security engineer needs to harden the routers within the corporate network. Which of the following is the most appropriate to disable?

Answer 64

Web-based administration

Question 65

A bank insists all of its vendors must prevent data loss on stolen laptops. Which of the following strategies is the bank requiring?

Answer 65

Encryption at rest

Question 66

Which of the following tools can assist with detecting an employee who has accidentally emailed a file containing a customer’s PII?

Answer 66

DLP

Question 67

Which of the following roles, according to the shared responsibility model, is responsible for securing the company’s database in an IaaS model for a cloud environment?

Answer 67

Client

Question 68

A manufacturing organization wants to control and monitor access from the internal business network to the segregated production network, while ensuring minimal exposure of the production network to devices. Which of the following solutions would best accomplish this goal?

Answer 68

Jump server

Question 69

During an engagement, penetration testers left USB keys that contained specially crafted malware in the company’s parking lot. A couple days later, the malware contacted the command-and-control server, giving the penetration testers unauthorized access to the company endpoints. Which of the following will most likely be a recommendation in the engagement report?

Answer 69

Conduct an awareness campaign on the usage of removable media.

Question 70

Which of the following should a security administrator adhere to when setting up a new set of firewall rules?

Answer 70

Change management procedure

Question 71

An organization that is located in a flood zone is MOST likely to document the concerns associated with the restoration of IT operations in a:

Answer 71

disaster recovery plan

Question 72

An organization has hired a security analyst to perform a penetration test. The analyst captures 1Gb worth of inbound network traffic to the server and transfers the pcap back to the machine for analysis. Which of the following tools should the analyst use to further review the pcap?

Answer 72

Wireshark

Question 73

A security analyst is reviewing the following attack log output:

Which of the following types of attacks does this MOST likely represent?

Answer 73

Password-spraying

Question 74

A network administrator is setting up wireless access points in all the conference rooms and wants to authenticate devices using PKI. Which of the following should the administrator configure?

Answer 74

802.1X

Question 75

After a ransomware attack, a forensics company needs to review a cryptocurrency transaction between the victim and the attacker. Which of the following will the company MOST likely review to trace this transaction?

Answer 75

The public ledger

Question 76

A company has drafted an insider-threat policy that prohibits the use of external storage devices. Which of the following would BEST protect the company from data exfiltration via removable media?

Answer 76

Blocking removable-media devices and write capabilities using a host-based security tool

Question 77

A security analyst has received an alert about PII being sent via email. The analyst’s Chief Information Security Officer (CISO) has made it clear that PII must be handled with extreme care. From which of the following did the alert MOST likely originate?

Answer 77

DLP

Question 78

A document that appears to be malicious has been discovered in an email that was sent to a company’s Chief Financial Officer (CFO). Which of the following would be BEST to allow a security analyst to gather information and confirm it is a malicious document without executing any code it may contain?

Answer 78

Search for matching file hashes on malware websites

Question 79

A security audit has revealed that a process control terminal is vulnerable to malicious users installing and executing software on the system. The terminal is beyond end-of-life support and cannot be upgraded, so it is placed on a protected network segment. Which of the following would be MOST effective to implement to further mitigate the reported vulnerability?

Answer 79

Application whitelisting

Question 80

During an incident response, a security analyst observes the following log entry on the web server:

Which of the following BEST describes the type of attack the analyst is experiencing?

Answer 80

Directory traversal

Question 81

Which of the following algorithms has the SMALLEST key size?

Answer 81

DES

A. DES - 56 bits
B. Twofish - Twofish supports key sizes of 128, 192, or 256 bits.
C. RSA - RSA key sizes start at 1024 bits.
D. AES - AES supports key sizes of 128, 192, or 256 bits.

Question 82

A security administrator needs to create a RAID configuration that is focused on high read speeds and fault tolerance. It is unlikely that multiple drives will fail simultaneously. Which of the following RAID configurations should the administrator use?

Answer 82

RAID 10

Question 83

A security engineer at an offline government facility is concerned about the validity of an SSL certificate. The engineer wants to perform the fastest check with the least delay to determine if the certificate has been revoked. Which of the following would BEST meet these requirements?

Answer 83

CRL

Question 84

A security incident may have occurred on the desktop PC of an organization’s Chief Executive Officer (CEO). A duplicate copy of the CEO’s hard drive must be stored securely to ensure appropriate forensic processes and the chain of custody are followed. Which of the following should be performed to accomplish this task?

Answer 84

Connect a write blocker to the hard drive. Then, leveraging a forensic workstation, utilize the dd command in a live Linux environment to create a duplicate copy

Question 85

A network administrator would like to configure a site-to-site VPN utilizing IPSec. The administrator wants the tunnel to be established with data integrity, encryption, authentication, and anti-replay functions. Which of the following should the administrator use when configuring the VPN?

Answer 85

ESP

Question 86

In the middle of a cyberattack, a security engineer removes the infected devices from the network and locks down all compromised accounts. In which of the following incident response phases is the security engineer currently operating?

Answer 86

Containment

Question 87

A company uses wireless for all laptops and keeps a very detailed record of its assets, along with a comprehensive list of devices that are authorized to be on the wireless network. The Chief Information Officer (CIO) is concerned about a script kiddie potentially using an unauthorized device to brute force the wireless PSK and obtain access to the internal network. Which of the following should the company implement to BEST prevent this from occurring?

Answer 87

WPA-EAP

Question 88

Company engineers regularly participate in a public Internet forum with other engineers throughout the industry. Which of the following tactics would an attacker MOST likely use in this scenario?

Answer 88

Watering-hole attack

Question 89

A security analyst is performing a forensic investigation involving compromised account credentials. Using the Event Viewer, the analyst was able to detect the following message: “Special privileges assigned to new logon.” Several of these messages did not have a valid logon associated with the user before these privileges were assigned. Which of the following attacks is MOST likely being detected?

Answer 89

Pass-the-hash

Question 90

The cost of removable media and the security risks of transporting data have become too great for a laboratory. The laboratory has decided to interconnect with partner laboratories to make data transfers easier and more secure. The Chief Security Officer (CSO) has several concerns about proprietary data being exposed once the interconnections are established. Which of the following security features should the network administrator implement to prevent unwanted data exposure to users in partner laboratories?

Answer 90

VLAN zoning with a file-transfer server in an external-facing zone

Question 91

A security assessment determines DES and 3DES are still being used on recently deployed production servers. Which of the following did the assessment identify?

Answer 91

Weak encryption

Question 92

Which of the following is a team of people dedicated to testing the effectiveness of organizational security programs by emulating the techniques of potential attackers?

Answer 92

Red team

Question 93

A recent audit uncovered a key finding regarding the use of a specific encryption standard in a web application that is used to communicate with business customers. Due to the technical limitations of its customers, the company is unable to upgrade the encryption standard. Which of the following types of controls should be used to reduce the risk created by this scenario?

Answer 93

Compensating

Question 94

A user recently entered a username and password into a recruiting application website that had been forged to look like the legitimate site. Upon investigation, a security analyst identifies the following:

-The legitimate website’s IP address is 10.1.1.20 and eRecruit.local resolves to this IP.
-The forged website’s IP address appears to be 10.2.12.99, based on NetFlow records.
-All three of the organization’s DNS servers show the website correctly resolves to the legitimate IP.
-DNS query logs show one of the three DNS servers returned a result of 10.2.12.99 (cached) at the approximate time of the suspected compromise.

Which of the following MOST likely occurred?

Answer 94

An attacker temporarily poisoned a name server.

Question 95

A security engineer is reviewing log files after a third party discovered usernames and passwords for the organization’s accounts. The engineer sees there was a change in the IP address for a vendor website one week earlier. This change lasted eight hours. Which of the following attacks was MOST likely used?

Answer 95

DNS poisoning

Question 96

Joe, a user at a company, clicked an email link that led to a website that infected his workstation. Joe was connected to the network, and the virus spread to the network shares. The protective measures failed to stop this virus, and it has continued to evade detection. Which of the following should a security administrator implement to protect the environment from this malware?

Answer 96

Implement a heuristic behavior-detection solution

Question 97

A software developer needs to perform code-execution testing, black-box testing, and non-functional testing on a new product before its general release. Which of the following BEST describes the tasks the developer is conducting?

Answer 97

Validation

The tests mentioned - code-execution, black-box, and non-functional - are types of validation testing. They check aspects like usability, performance, and security from the user’s perspective.
Validation testing evaluates if the product meets the intended needs of the user. Verification testing focuses on checking if the product was built correctly according to specifications.
Normalization and staging do not describe software testing methodologies.

Question 98

The Chief Security Officer (CSO) at a major hospital wants to implement SSO to help improve security in the environment and protect patient data, particularly at shared terminals. The Chief Risk Officer (CRO) is concerned that training and guidance have not been provided to frontline staff, and a risk analysis has not been performed. Which of the following is the MOST likely cause of the CRO’s concerns?

Answer 98

SSO would simplify username and password management, making it easier for hackers to guess accounts.

Question 99

A root cause analysis reveals that a web application outage was caused by one of the company’s developers uploading a newer version of the third-party libraries that were shared among several applications. Which of the following implementations would be BEST to prevent this issue from reoccurring?

Answer 99

Containerization

Question 100

An analyst visits an Internet forum looking for information about a tool. The analyst finds a thread that appears to contain relevant information. One of the posts says the following:

Which of the following BEST describes the attack that was attempted against the forum readers?

Answer 100

XSS attack

Question 101

After entering a username and password, an administrator must draw a gesture on a touch screen. Which of the following demonstrates what the administrator is providing?

Answer 101

Something you can do

Question 102

A small business just recovered from a ransomware attack against its file servers by purchasing the decryption keys from the attackers. The issue was triggered by a phishing email and the IT administrator wants to ensure it does not happen again. Which of the following should the IT administrator do FIRST after recovery?

Answer 102

Scan the NAS for residual or dormant malware and take new daily backups that are tested on a frequent basis

Question 103

Which of the following describes the BEST approach for deploying application patches?

Answer 103

Apply the patches to systems in a testing environment, then to systems in a staging environment, and finally to production systems.

Question 104

When selecting a technical solution for identity management, an architect chooses to go from an in-house solution to a third-party SaaS provider. Which of the following risk management strategies is this an example of?

Answer 104

Transference

Question 105

A security analyst needs to generate a server certificate to be used for 802.1X and secure RDP connections. The analyst is unsure what is required to perform the task and solicits help from a senior colleague. Which of the following is the FIRST step the senior colleague will most likely tell the analyst to perform to accomplish this task?

Answer 105

Generate a CSR

Question 106

Which of the following BEST explains the reason why a server administrator would place a document named password.txt on the desktop of an administrator account on a server?

Answer 106

The document is a honeyfile and is meant to attract the attention of a cyberintruder

Question 107

A public relations team will be taking a group of guests on a tour through the facility of a large e- commerce company. The day before the tour, the company sends out an email to employees to ensure all whiteboards are cleaned and all desks are cleared. The company is MOST likely trying to protect against:

Answer 107

loss of proprietary information

Question 108

A company recently moved sensitive videos between on-premises, company-owned websites. The company then learned the videos had been uploaded and shared to the Internet. Which of the following would MOST likely allow the company to find the cause?

Answer 108

A log analysis

Question 109

Which of the following allows for functional test data to be used in new systems for testing and training purposes to protect the real data?

Answer 109

Data masking

Question 110

A company recently set up an e-commerce portal to sell its products online. The company wants to start accepting credit cards for payment, which requires compliance with a security standard. Which of the following standards must the company comply with before accepting credit cards on its e-commerce platform?

Answer 110

PCI DSS

Question 111

A smart switch has the ability to monitor electrical levels and shut off power to a building in the event of power surge or other fault situation. The switch was installed on a wired network in a hospital and is monitored by the facilities department via a cloud application. The security administrator isolated the switch on a separate VLAN and set up a patching routine. Which of the following steps should also be taken to harden the smart switch?

Answer 111

Change the default password for the switch

Question 112

An organization just experienced a major cyberattack incident. The attack was well coordinated, sophisticated, and highly skilled. Which of the following targeted the organization?

Answer 112

An advanced persistent threat

Question 113

The SOC is reviewing processes and procedures after a recent incident. The review indicates it took more than 30 minutes to determine that quarantining an infected host was the best course of action. This allowed the malware to spread to additional hosts before it was contained. Which of the following would be BEST to improve the incident response process?

Answer 113

Updating the playbooks with better decision points

Question 114

Which of the following threat vectors would appear to be the most legitimate when used by a malicious actor to impersonate a company?

Answer 114

Email

Question 115

A cybersecurity administrator has a reduced team and needs to operate an on-premises network and security infrastructure efficiently. To help with the situation, the administrator decides to hire a service provider. Which of the following should the administrator use?

Answer 115

MSSP

Question 116

A company’s Chief Information Officer (CIO) is meeting with the Chief Information Security Officer (CISO) to plan some activities to enhance the skill levels of the company’s developers. Which of the following would be MOST suitable for training the developers?

Answer 116

A capture-the-flag competition

Question 117

A network administrator needs to build out a new datacenter, with a focus on resiliency and uptime. Which of the following would BEST meet this objective? (Choose two.)

Answer 117

Dual power supply

Off-site backups

Question 118

Which of the following security concepts should an e-commerce organization apply for protection against erroneous purchases?

Answer 118

Integrity

Question 119

A systems administrator needs to implement an access control scheme that will allow an object’s access policy to be determined by its owner. Which of the following access control schemes BEST fits the requirements?

Answer 119

Discretionary access control

Question 120

A security engineer needs to implement an MDM solution that complies with the corporate mobile device policy. The policy states that in order for mobile users to access corporate resources on their devices, the following requirements must be met:

-Mobile device OSs must be patched up to the latest release.
-A screen lock must be enabled (passcode or biometric).
-Corporate data must be removed if the device is reported lost or stolen.

Which of the following controls should the security engineer configure? (Choose two.)

Answer 120

Posturing

Remote wipe

Question 121

Users have been issued smart cards that provide physical access to a building. The cards also contain tokens that can be used to access information systems. Users can log in to any thin client located throughout the building and see the same desktop each time. Which of the following technologies are being utilized to provide these capabilities? (Choose two.)

Answer 121

VDI

RFID

Question 122

Which of the following is a reason to publish files’ hashes?

Answer 122

To validate the integrity of the files

Question 123

An enterprise has hired an outside security firm to conduct penetration testing on its network and applications. The firm has agreed to pay for each vulnerability that is discovered. Which of the following BEST represents the type of testing that will occur?

Answer 123

Bug bounty

Question 124

A security analyst needs to be proactive in understanding the types of attacks that could potentially target the company’s executives. Which of the following intelligence sources should the security analyst review?

Answer 124

Industry information-sharing and collaboration groups

Question 125

An organization suffered an outage, and a critical system took 90 minutes to come back online. Though there was no data loss during the outage, the expectation was that the critical system would be available again within 60 minutes. Which of the following is the 60-minute expectation an example of?

Answer 125

RTO

Question 126

Which of the following ISO standards is certified for privacy?

Answer 126

ISO 27701

Question 127

A network technician is installing a guest wireless network at a coffee shop. When a customer purchases an item, the password for the wireless network is printed on the receipt so the customer can log in. Which of the following will the technician MOST likely configure to provide the highest level of security with the least amount of overhead?

Answer 127

WPA-PSK

Question 128

While troubleshooting a firewall configuration, a technician determines that a “deny any” policy should be added to the bottom of the ACL. The technician updates the policy, but the new policy causes several company servers to become unreachable. Which of the following actions would prevent this issue?

Answer 128

Testing the policy in a non-production environment before enabling the policy in the production network

Question 129

A consultant is configuring a vulnerability scanner for a large, global organization in multiple countries. The consultant will be using a service account to scan systems with administrative privileges on a weekly basis, but there is a concern that hackers could gain access to the account and pivot throughout the global network. Which of the following would be BEST to help mitigate this concern?

Answer 129

Create different accounts for each region, limit their logon times, and alert on risky logins.

Question 130

Which of the following technical controls is BEST suited for the detection and prevention of buffer overflows on hosts?

Answer 130

EDR