Exam Topics Security +

Question 1

Which of the following threat actors is the most likely to be hired by a foreign government to attack critical systems located in other countries?
A. Hacktivist
B. Whistleblower
C. Organized crime
D. Unskilled attacker

Answer 1

C. Organized crime. These groups often possess the sophistication and resources needed to conduct cyber attacks on behalf of foreign governments.

Question 2

Which of the following is used to add extra complexity before using a one-way data transformation algorithm?
A. Key stretching
B. Data masking
C. Steganography
D. Salting

Answer 2

D. Salting. This adds extra complexity to data before applying a one-way transformation algorithm, making it harder for attackers to crack hashed passwords.

Question 3

An employee clicked a link in an email from a payment website that asked the employee to update contact information. The employee entered the log-in information but received a “page not found” error message. Which of the following types of social engineering attacks occurred?
A. Brand impersonation
B. Pretexting
C. Typosquatting
D. Phishing

Answer 3

D. Phishing. This type of attack tricks individuals into providing sensitive information by impersonating legitimate entities, like a payment website. Classic case of “too good to be true.”

Question 4

An enterprise is trying to limit outbound DNS traffic originating from its internal network. Outbound DNS requests will only be allowed from one device with the IP address 10.50.10.25. Which of the following firewall ACLs will accomplish this goal?
A. Access list outbound permit 0.0.0.0/0 0.0.0.0/0 port 53
Access list outbound deny 10.50.10.25/32 0.0.0.0/0 port 53
B. Access list outbound permit 0.0.0.0/0 10.50.10.25/32 port 53
Access list outbound deny 0.0.0.0/0 0.0.0.0/0 port 53
C. Access list outbound permit 0.0.0.0/0 0.0.0.0/0 port 53
Access list outbound deny 0.0.0.0/0 10.50.10.25/32 port 53
D. Access list outbound permit 10.50.10.25/32 0.0.0.0/0 port 53
Access list outbound deny 0.0.0.0/0 0.0.0.0/0 port 53

Answer 4

D. Access list outbound permit 10.50.10.25/32 0.0.0.0/0 port 53. Access list outbound deny 0.0.0.0/0 0.0.0.0/0 port 53. This configuration permits DNS requests only from the specified IP address and denies all other outbound DNS traffic.

Question 5

A data administrator is configuring authentication for a SaaS application and would like to reduce the number of credentials employees need to
maintain. The company prefers to use domain credentials to access new SaaS applications. Which of the following methods would allow this
functionality?
A. SSO
B. LEAP
C. MFA
D. PEAP

Answer 5

A. SSO (Single Sign-On). This allows users to access multiple applications with a single set of credentials, streamlining the login process.

Question 6

Which of the following scenarios describes a possible business email compromise attack?
A. An employee receives a gift card
B. Employees who open an email attachment receive messages demanding payment in order to access files.
C. A service desk employee receives an email from the HR director asking for log-in credentials to a cloud administrator account.
D. An employee receives an email with a link to a phishing site that is designed to look like the company’s email portal.

Answer 6

C. A service desk employee receives an email from the HR director asking for log-in credentials to a cloud administrator account. Classic example of impersonation to gain sensitive information.

Question 7

A company prevented direct access from the database administrators’ workstations to the network segment that contains database servers. Which of the following should a database administrator use to access the database servers?
A. Jump server
B. RADIUS
C. HSM
D. Load balancer

Answer 7

A. Jump server. It’s a secure way to provide access to sensitive segments while controlling and auditing that access.

Question 8

An organization’s internet-facing website was compromised when an attacker exploited a buffer overflow. Which of the following should the organization deploy to best protect against similar attacks in the future?
A. NGFW
B. WAF
C. TLS
D. SD-WAN

Answer 8

B. WAF (Web Application Firewall). A WAF is designed to protect web applications by filtering and monitoring HTTP traffic, and it can help prevent attacks such as buffer overflows.

Question 9

An administrator notices that several users are logging in from suspicious IP addresses. After speaking with the users, the administrator determines that the employees were not logging in from those IP addresses and resets the affected users’ passwords. Which of the following should the administrator implement to prevent this type of attack from succeeding in the future?
A. Multifactor authentication
B. Permissions assignment
C. Access management
D. Password complexity

Answer 9

A. Multifactor authentication. Implementing MFA adds an extra layer of security by requiring users to provide two or more verification factors to gain access, making it much harder for attackers to exploit stolen credentials.

Question 10

An employee receives a text message that appears to have been sent by the payroll department and is asking for credential verification. Which of the following is social engineering techniques are being attempted? (Choose two).
A. Typosquatting
B. Phishing
C. Impersonation
D. Vishing
E. Smishing
F. Misinformation

Answer 10

C. Impersonation and E. Smishing. Impersonation because the message appears to be from the payroll department, and smishing because it’s a phishing attack delivered through SMS.

Question 11

Several employees received a fraudulent text message from someone claiming to be the Chief Executive Officer (CEO). The message started: “I’m in an airport right now with no access to email. I need you to buy gift cards for employee awards. Please send the gift cards to following email address”. Which of the following are the best responses to this situation? (Choose two).
A. Cancel current employee recognition gift cards.
B. Add a smishing exercise to the annual company training.
C. Issue a general email warning to the company.
D. Have the CEO change phone numbers.
E. Conduct a forensic investigation on the CEO’s phone.
F. Implement mobile device management.

Answer 11

B. Add a smishing exercise to the annual company training. C. Issue a general email warning to the company.

These steps address the immediate threat and help prevent future occurrences by raising awareness and training employees to recognize and handle such scams.

Question 12

A company is required to use certified hardware when building networks. Which of the following best addresses the risks associated with procuring counterfeit hardware?
A. A thorough analysis of the supply chain.
B. A legally enforceable corporate acquisition policy.
C. A right to audit clause in vendor contracts and SOWs.
D. An in-depth penetration test of all suppliers and vendors.

Answer 12

C. A right to audit clause in vendor contracts and SOWs. This allows the company to ensure the authenticity of the hardware by conducting audits on their vendors, verifying that the supplied hardware meets the required standards and certifications.

Question 13

Which of the following provides the details about the terms of a test with a third-party penetration tester?
A. Rules of engagement
B. Supply chain analysis
C. Right to audit clause
D. Due diligence

Answer 13

A. Rules of engagement. This document outlines the terms, conditions, scope, and boundaries of a penetration test conducted by a third party, ensuring that all parties are aware of the expectations and limitations of the test.

Question 14

A penetration tester begins an engagement by performing port and service scans against the client environment according to the rules of engagement. Which of the following reconnaissance types is the tester performing?
A. Active
B. Passive
C. Defensive
D. Offensive

Answer 14

A. Active reconnaissance. This involves actively engaging with the target system through techniques like port and service scanning to gather information.

Question 15

Which of the following is required for an organization to properly manage its restore process in the event of system failure?
A. IRP
B. DRP
C. RPO
D. SDLC

Answer 15

B. DRP (Disaster Recovery Plan). A comprehensive DRP is essential for an organization to manage and execute the restore process effectively in the event of system failure, ensuring minimal downtime and data loss.

Question 16

Which of the following vulnerabilities is associated with installing software outside of a manufacturer’s approved software repository?
A. Jailbreaking
B. Memory injection
C. Resource reuse
D. Side loading

Answer 16

D. Side loading. It’s the process of installing software from sources other than the official app store or repository, which can introduce vulnerabilities and security risks.

Question 17

(10:00:00 AM) Login rejected - username administrator - password Spring2023
(10:00:01 AM) Login rejected - username jsmith - password Spring2023
(10:00:01 AM) Login rejected - username guest - password Spring2023
(10:00:02 AM) Login rejected - username cpolk - password Spring2023
(10:00:03 AM) Login rejected - username fmartin - password Spring2023
A. Password spraying
B. Account forgery
C. Pass-the-hash
D. Brute-force

Answer 17

A. Password spraying. This attack uses a common password across many accounts, rather than brute-forcing a single account with many passwords.

Question 18

An analyst is evaluating the implementation of Zero Trust principles within the data plane. Which of the following would be most relevant for the analyst to evaluate?
A. Secured zones
B. Subject role
C. Adaptive identity
D. Threat scope reduction

Answer 18

A. Secured zones. Evaluating secured zones within the data plane aligns closely with Zero Trust principles, emphasizing strict access controls and segmentation.

Question 19

An engineer needs to find a solution that creates an added layer of security by preventing unauthorized access to internal company resources. Which of the following would be the best solution?
A. RDP server
B. Jump server
C. Proxy server
D. Hypervisor

Answer 19

B. Jump server. This creates an added layer of security by acting as an intermediary device that authorized users must access before reaching internal company resources, enhancing overall access control.

Question 20

A company’s web filter is configured to scan the URL for strings and deny access when matches are found. Which of the following search strings should an analyst employ to prohibit access to non-encrypted websites?
A. encryption=off
B. http://
C. www.*.com
D. :443

Answer 20

To block access to non-encrypted websites, the analyst should use B. http://. This string targets URLs that start with “http://” indicating they are not using HTTPS encryption.

Question 21

During a security incident, the security operations team identified sustained network traffic from a malicious IP address: 10.1.4.9. A security analyst is creating an inbound firewall rule to block the IP address from accessing the organization’s network. Which of the following fulfills this request?
A. access-list inbound deny ip source 0.0.0/0 destination 10.1.4.9/32
B. access-list inbound deny ip source 10.1.4.9/32 destination
C. access-list inbound permit ip source 10.1.4.9/32 destination 0.0.0.0/0
D. access-list inbound permit ip source 0.0.0.0/0 destination 10.1.4.9/32

Answer 21

B: access-list inbound deny ip source 10.1.4.9/32 destination. This command denies traffic from the specific malicious IP address 10.1.4.9, effectively blocking it from accessing the organization’s network.

Question 22

A company needs to provide administrative access to internal resources while minimizing the traffic allowed through the security boundary. Which of the following methods is most secure?
A. Implementing a bastion host
B. Deploying a perimeter network
C. Installing a WAF
D. Utilizing single sign-on

Answer 22

A: Implementing a bastion host. A bastion host is a hardened system specifically designed to withstand attacks and provide secure administrative access to internal resources. It minimizes the traffic allowed through the security boundary by acting as a controlled gateway for accessing sensitive systems.

Question 23

A security analyst is reviewing alerts in the SIEM related to potential malicious network traffic coming from an employee’s corporate laptop. The security analyst has determined that additional data about the executable running on the machine is necessary to continue the investigation. Which of the following logs should the analyst use as a data source?
A. Application
B. IPS/IDS
C. Network
D. Endpoint

Answer 23

D: Endpoint. Endpoint logs would provide detailed information about the executable running on the employee’s laptop, including its behaviors and activities. This data is crucial for analyzing and understanding any potential malicious actions taken by the executable.

Question 24

A cyber operations team informs a security analyst about a new tactic malicious actors are using to compromise networks. SIEM alerts have not yet been configured. Which of the following best describes what the security analyst should do to identify this behavior?
A. Digital forensics
B. E-discovery
C. Incident response
D. Threat hunting

Answer 24

D: Threat hunting. Threat hunting involves proactively searching through networks or datasets to detect and isolate advanced threats that evade traditional security solutions. Since the SIEM alerts aren’t yet set up, threat hunting would be the proactive approach to identify and understand this new tactic.

Question 25

A company purchased cyber insurance to address items listed on the risk register. Which of the following strategies does this represent?
A. Accept
B. Transfer
C. Mitigate
D. Avoid

Answer 25

B: Transfer. By purchasing cyber insurance, the company is transferring the financial risk of potential cyber incidents to the insurance provider. This approach helps manage the impact of risks by shifting some of the burden to an external party.

Question 26

A security administrator would like to protect data on employee’s laptops. Which of the following encryption techniques should the security administrator use?
A. Partition
B. Asymmetric
C. Full disk
D. Database

Answer 26

C: Full disk. Full disk encryption (FDE) protects all data on a laptop by encrypting the entire drive, ensuring that data is secure even if the laptop is lost or stolen.

Question 27

Which of the following security control types does an acceptable use policy best represent?
A. Detective
B. Compensating
C. Corrective
D. Preventive

Answer 27

D: Preventive. An acceptable use policy (AUP) is designed to prevent misuse of an organization’s resources by setting clear guidelines and expectations for acceptable behavior. It acts as a preventive measure to reduce the risk of inappropriate or malicious actions.

Question 28

An IT manager informs the entire help desk staff that only the IT manager and the help desk lead will have access to the administrator console of the help desk software. Which of the following security techniques is the IT manager setting up?
A. Hardening
B. Employee monitoring
C. Configuration enforcement
D. Least privilege

Answer 28

D: Least privilege. By limiting access to the administrator console to only the IT manager and the help desk lead, the IT manager is ensuring that only those who absolutely need access have it, thereby minimizing potential security risks and adhering to the principle of least privilege.

Question 29

Which of the following is the most likely to be used to document risks, responsible parties, and thresholds?
A. Risk tolerance
B. Risk transfer
C. Risk register
D. Risk analysis

Answer 29

C: Risk register. A risk register is a tool used to document potential risks, responsible parties, and thresholds. It serves as a comprehensive record of risks and helps in tracking and managing them throughout a project or operation.

Question 30

Which of the following should a security administrator adhere to when setting up a new set of firewall rules?
A. Disaster recovery plan
B. Incident response procedure
C. Business continuity plan
D. Change management procedure

Answer 30

D: Change management procedure. When setting up new firewall rules, it’s essential to follow a change management procedure to ensure that the changes are documented, reviewed, tested, and approved before being implemented. This helps maintain system stability and security while preventing unintended disruptions.

Question 31

A company is expanding its threat surface program and allowing individuals to security test the company’s internet-facing application. The company will compensate researchers based on the vulnerabilities discovered. Which of the following best describes the program the company is setting up?
A. Open-source intelligence
B. Bug bounty
C. Red team
D. Penetration testing

Answer 31

B: Bug bounty. This program incentivizes security researchers to find and report vulnerabilities by offering rewards. It’s an effective way to leverage the collective skills of the security community to enhance the company’s cybersecurity.

Bug bounty programs are all about turning potential threats into allies.

Question 32

Which of the following enables the use of an input field to run commands that can view or manipulate data?
A. Cross-site scripting
B. Side loading
C. Buffer overflow
D. SQL injection

Answer 32

D: SQL injection. This attack takes advantage of input fields to insert malicious SQL commands, which can then be used to view or manipulate data within the database.

Question 33

Which of the following threat actors is the most likely to use large financial resources to attack critical systems located in other countries?
A. Insider
B. Unskilled attacker
C. Nation-state
D. Hacktivist

Answer 33

C: Nation-state. Nation-states are typically well-funded and have the resources to carry out sophisticated attacks on critical systems in other countries, often for strategic, political, or economic purposes.

Question 34

Employees in the research and development business unit receive extensive training to ensure they understand how to best protect company data. Which of the following is the type of data these employees are most likely to use in day-to-day work activities?
A. Encrypted
B. Intellectual property
C. Critical
D. Data in transit

Answer 34

B: Intellectual property. Employees in the research and development business unit are typically focused on creating and managing innovative products, designs, and technologies. This kind of data is highly valuable and requires strong protection to maintain the company’s competitive edge.

Question 35

A company has begun labeling all laptops with asset inventory stickers and associating them with employee IDs. Which of the following security benefits do these actions provide? Choose two.
A. If a security incident occurs on the device, the correct employee can be notified
B. The security team will be able to send user awareness training to the appropriate device
C. Users can be mapped to their devices when configuring software MFA tokens
D. User-based firewall policies can be correctly targeted to the appropriate laptops
E. When conducting penetration testing, the security team will be able to target the desired laptops
F. Company data can be accounted for when the employee leaves the organization

Answer 35

A. If a security incident occurs on the device, the correct employee can be notified. C. Users can be mapped to their devices when configuring software MFA tokens.

These actions ensure that incidents are accurately traced back to the responsible employee and enable proper configuration of multi-factor authentication for individual devices.

Question 36

A technician wants to improve the situational and environmental awareness of existing users as they transition from remote to in-office work. Which of the following is the best option?
A. Send out periodic security reminders
B. Update the content of new hire documentation
C. Modify the content of recurring training
D. Implement a phishing campaign

Answer 36

C: Modify the content of recurring training. Adapting training to address the new situational and environmental factors that users will encounter can ensure they remain vigilant and aware of potential security threats as they transition back to the office. This proactive approach keeps security top of mind and tailored to the current context.

Question 37

A newly appointed board member with cybersecurity knowledge wants the board of directors to receive a quarterly report detailing the number of incidents that impacted the organization. The systems administrator is creating a way to present the data to the board of directors. Which following should the systems administrator use?
A. Packet captures
B. Vulnerability scans
C. Metadata
D. Dashboard

Answer 37

D: Dashboard. A dashboard can effectively present the data in a clear and concise manner, making it easy for the board of directors to understand the number of incidents and their impact on the organization. Dashboards can be customized to highlight key metrics and trends, providing a comprehensive overview.

Question 38

A systems administrator receives the following alert from a file integrity monitoring tool: The hash of the cmd.exe file has changed.
The systems administrator checks the OS logs and notices that no patches were applied in the last two months. Which of the following most likely occurred?
A. The end user changed the file permissions
B. A cryptographic collision was detected
C. a snapshot of the file system was taken
D. a rootkit was deployed

Answer 38

D: A rootkit was deployed. The change in the hash of the cmd.exe file suggests that the file has been altered. Since no patches were applied recently, the most likely cause is a rootkit, which is designed to covertly alter system files and avoid detection, thereby compromising the system.

Question 39

Which of the following roles, according to the shared responsibility model, is responsible for securing the company’s database in the IaaS model for a cloud environment?
A. Client
B. Third-party vendor
C. Cloud provider
D. DBA

Answer 39

A: Client. In the Infrastructure as a Service (IaaS) model, the cloud provider is responsible for the underlying infrastructure, but the client is responsible for managing and securing their own databases, applications, and data.

Question 40

A client asked a security company to provide a document outlining the project, the cost, and the completion time frame. Which of the following documents should the company provide to the client?
A. MSA
B. SLA
C. BPA
D. SOW

Answer 40

D: SOW (Statement of Work). This document outlines the project’s scope, objectives, cost, and completion time frame, providing a clear framework for the client and the security company.