casp1

Question 1

1. An organization is referencing NIST best practices for BCP creation while reviewing current internal organizational processes for mission-essential items.
   Which of the following phases establishes the identification and prioritization of critical systems and functions?
   A. Review a recent gap analysis.
   B. Perform a cost-benefit analysis.
   C. Conduct a business impact analysis.
   D. Develop an exposure factor matrix

Answer 1

A. Review a recent gap analysis.

Question 2

2. During a remodel, a company’s computer equipment was moved to a secure storage room with cameras positioned on both sides of the door. The door is locked using a card reader issued by the security team, and only the security team and department managers have access to the room. The company wants to be able to identify any unauthorized individuals who enter the storage room by following an authorized employee.
   Which of the following processes would BEST satisfy this requirement?
   A. Monitor camera footage corresponding to a valid access request.
   B. Require both security and management to open the door.
   C. Require department managers to review denied-access requests.
   D. Issue new entry badges on a weekly basis.

Answer 2

A. Monitor camera footage corresponding to a valid access request.

Question 3

3. A company is preparing to deploy a global service.
   Which of the following must the company do to ensure GDPR compliance? (Choose two.)
   A. Inform users regarding what data is stored.
   B. Provide opt-in/opt-out for marketing messages.
   C. Provide data deletion capabilities.
   D. Provide optional data encryption
   E. Grant data access to third parties.
   F. Provide alternative authentication techniques

Answer 3

A. Inform users regarding what data is stored.
C. Provide data deletion capabilities.

Question 4

4. A SOC analyst is reviewing malicious activity on an external, exposed web server. During the investigation, the analyst determines specific traffic is not being logged, and there is no visibility from the WAF for the web application.
   A. The user agent client is not compatible with the WAF.
   B. A certificate on the WAF is expired.
   C. HTTP traffic is not forwarding to HTTPS to decrypt.
   D. Old, vulnerable cipher suites are still being used.

Answer 4

B. A certificate on the WAF is expired.

Question 5

5. Which of the following terms refers to the delivery of encryption keys to a CASB or a third-party entity?
   A. Key sharing
   B. Key distribution
   C. Key recovery
   D. Key escrow

Answer 5

D. Key escrow

Question 6

6. An organization is implementing a new identity and access management architecture with the following objectives:
   Supporting MFA against on-premises infrastructure
   Improving the user experience by integrating with SaaS applications Applying risk-based policies based on location
   Performing just-in-time provisioning
   Which of the following authentication protocols should the organization implement to support these requirements?
   A. Kerberos and TACACS
   B. SAML and RADIUS
   C. OAuth and OpenID
   D. OTP and 802.1X

Answer 6

D. OTP and 802.1X

Question 7

7. A company is looking to fortify its cybersecurity defenses and is focusing on its network infrastructure. The solution cannot affect the availability of the company’s services to ensure false positives do not drop legitimate traffic.
   Which of the following would satisfy the requirement?
   A. NIDS
   B. NIPS
   C. WAF
   D. Reverse proxy

Answer 7

A. NIDS

Question 8

8. A small company recently developed prototype technology for a military program. The company’s security engineer is concerned about potential theft of the newly developed, proprietary information.
   Which of the following should the security engineer do to BEST manage the threats proactively?
   A. Join an information-sharing community that is relevant to the company.
   B. Leverage the MITRE ATTACK framework to map the TTP
   C. Use OSINT techniques to evaluate and analyze the threats.
   D. Update security awareness training to address new threats, such as best practices for data security.

Answer 8

D. Update security awareness training to address new threats, such as best practices for data security.

Question 9

9. A security engineer has been asked to close all non-secure connections from the corporate network. The engineer is attempting to understand why the corporate UTM will not allow users to download email via IMAPS. The engineer formulates a theory and begins testing by creating the firewall ID 58, and users are able to download emails correctly by using IMAP instead. The network comprises three VLANs:

The security engineer looks at the UTM firewall rules and finds the following:

Which of the following should the security engineer do to ensure IMAPS functions properly on the corporate user network?
A. Contact the email service provider and ask if the company IP is blocked.
B. Confirm the email server certificate is installed on the corporate computers.
C. Make sure the UTM certificate is imported on the corporate computers.
D. Create an IMAPS firewall rule to ensure email is allowed.

Answer 9

B. Confirm the email server certificate is installed on the corporate computers

Question 10

10. A security analyst is reviewing network connectivity on a Linux workstation and examining the active TCP connections using the command line.
    Which of the following commands would be the BEST to run to view only active Internet connections?
    A. sudo netstat -antu | grep “LISTEN” | awk ‘{print$5}’
    B. sudo netstat -nlt -p | grep “ESTABLISHED”
    C. sudo netstat -plntu | grep -v “Foreign Address”
    D. sudo netstat -pnut -w | column -t -s $’\w’
    E. sudo netstat -pnut | grep -P ^tcp

Answer 10

B. sudo netstat -nlt -p | grep “ESTABLISHED”

Question 11

11. A security analyst receives an alert from the SIEM regarding unusual activity on an authorized public SSH jump server. To further investigate, the analyst pulls the event logs directly from /var/log/auth.log: graphic.ssh_auth_log.
    Which of the following actions would BEST address the potential risks by the activity in the logs?
    A. Alerting the misconfigured service account password
    B. Modifying the AllowUsers configuration directive
    C. Restricting external port 22 access
    D. Implementing host-key preferences

Answer 11

C. Restricting external port 22 access

Question 12

12. A university issues badges through a homegrown identity management system to all staff and students. Each week during the summer, temporary summer school students arrive and need to be issued a badge to access minimal campus resources. The security team received a report from an outside auditor indicating the homegrown system is not consistent with best practices in the security field and leaves the institution vulnerable.
    Which of the following should the security team recommend FIRST?
    A. Investigating a potential threat identified in logs related to the identity management system
    B. Updating the identity management system to use discretionary access control
    C. Beginning research on two-factor authentication to later introduce into the identity management system
    D. Working with procurement and creating a requirements document to select a new IAM system/vendor

Answer 12

A. Investigating a potential threat identified in logs related to the identity management system

Question 13

13. A customer reports being unable to connect to a website at www.test.com to consume services. The customer notices the web application has the following published cipher suite:

Which of the following is the MOST likely cause of the customer’s inability to connect?
A. Weak ciphers are being used.
B. The public key should be using ECDSA.
C. The default should be on port 80.
D. The server name should be test.com.

Answer 13

B. The public key should be using ECDSA.

Question 14

14. An IT administrator is reviewing all the servers in an organization and notices that a server is missing crucial practice against a recent exploit that could gain root access.
    Which of the following describes the administrator’s discovery?
    A. A vulnerability
    B. A threat
    C. A breach
    D. A risk

Answer 14

A. A vulnerability

Question 15

15. A security analyst is performing a vulnerability assessment on behalf of a client. The analyst must define what constitutes a risk to the organization.
    Which of the following should be the analyst’s FIRST action?
    A. Create a full inventory of information and data assets.
    B. Ascertain the impact of an attack on the availability of crucial resources.
    C. Determine which security compliance standards should be followed.
    D. Perform a full system penetration test to determine the vulnerabilities.

Answer 15

A. Create a full inventory of information and data assets.

Question 16

16. A company plans to build an entirely remote workforce that utilizes a cloud-based infrastructure. The Chief Information Security Officer asks the security engineer to design connectivity to meet the following requirements:

Only users with corporate-owned devices can directly access servers hosted by the cloud provider. The company can control what SaaS applications each individual user can access.
User browser activity can be monitored.

Which of the following solutions would BEST meet these requirements?
A. IAM gateway, MDM, and reverse proxy
B. VPN, CASB, and secure web gateway
C. SSL tunnel, DLP, and host-based firewall
D. API gateway, UTM, and forward proxy

Answer 16

A. IAM gateway, MDM, and reverse proxy

Question 17

17. During a system penetration test, a security engineer successfully gained access to a shell on a Linux host as a standard user and wants to elevate the privilege levels.
    Which of the following is a valid Linux post-exploitation method to use to accomplish this goal?
    A. Spawn a shell using sudo and an escape string such as sudo vim -c ‘!sh’.
    B. Perform ASIC password cracking on the host.
    C. Read the /etc/passwd file to extract the usernames.
    D. Initiate unquoted service path exploits.
    E. Use the UNION operator to extract the database schema.

Answer 17

A. Spawn a shell using sudo and an escape string such as sudo vim -c ‘!sh’.

Question 18

19. A company hired a third party to develop software as part of its strategy to be quicker to market. The company’s policy outlines the following requirements:
    The credentials used to publish production software to the container registry should be stored in a secure location.
    Access should be restricted to the pipeline service account, without the ability for the third-party developer to read the credentials directly.
    Which of the following would be the BEST recommendation for storing and monitoring access to these shared credentials?
    A. TPM
    B. Local secure password file
    C. MFA
    D. Key vault

Answer 18

D. Key vault

Question 19

20. A company is migrating from company-owned phones to a BYOD strategy for mobile devices. The pilot program will start with the executive management team and be rolled out to the rest of the staff in phases. The company’s Chief Financial Officer loses a phone multiple times a year.
    Which of the following will MOST likely secure the data on the lost device?
    A. Require a VPN to be active to access company data.
    B. Set up different profiles based on the person’s risk.
    C. Remotely wipe the device.
    D. Require MFA to access company applications.

Answer 19

C. Remotely wipe the device.

Question 20

21. After a security incident, a network security engineer discovers that a portion of the company’s sensitive external traffic has been redirected through a secondary ISP that is not normally used.
    Which of the following would BEST secure the routes while allowing the network to function in the event of a single provider failure?
    A. Disable BGP and implement a single static route for each internal network.
    B. Implement a BGP route reflector.
    C. Implement an inbound BGP prefix list.
    D. Disable BGP and implement OSPF

Answer 20

A. Disable BGP and implement a single static route for each internal network.