Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CyberSecurity > Final Test part 2 > Flashcards

Final Test part 2 Flashcards

1
Q

An organization implemented a process that compares the settings currently configured on systems against secure configuration guidelines in order to identify any gaps. Which of the following control types has the organization implemented?
A. Compensating
B. Corrective
C. Preventive
D. Detective

A

D. Detective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

The Chief Information Security Officer directed a risk reduction in shadow IT and created a policy requiring all unsanctioned high-risk SaaS applications to be blocked from user access. Which of the following is the BEST security solution to reduce this risk?
A. CASB
B. VPN concentrator
C. MFA
D. VPC endpoint

A

A. CASB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A technician enables full disk encryption on a laptop that will be taken on a business trip. Which of the following does this process BEST protect?
A. Data in transit
B. Data in processing
C. Data at rest
D. Data tokenization

A

C. Data at rest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A security analyst was called to investigate a file received directly from a hardware manufacturer. The analyst is trying to determine whether the file was modified in transit before installation on the user’s computer. Which of the following can be used to safely assess the file?
A. Check the hash of the installation file.
B. Match the file names.
C. Verify the URL download location.
D. Verify the code signing certificate.

A

A. Check the hash of the installation file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which of the following is a benefit of including a risk management framework into an organization’s security approach?
A. It defines expected service levels from participating supply chain partners to ensure system outages are remediated in a timely manner.
B. It identifies specific vendor products that have been tested and approved for use in a secure environment.
C. It provides legal assurances and remedies in the event a data breach occurs.
D. It incorporates control, development, policy, and management activities into IT operations.

A

D. It incorporates control, development, policy, and management activities into IT operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

An audit identified PII being utilized in the development environment of a critical application, the CPO is adamant that this data must be removed. However, the developers are concerned that without real data they cannot perform functionality tests and search for specific data. Which of the following should a security professional implement to BEST satisfy both the CPO’s and the development team’s requirements?
A. Data anonymization
B. Data Encryption
C. Data Masking
D. Data tokenization

A

Data Masking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which of the following tools is effective in preventing a user from accessing unauthorized removable media?
A. USB data blocker
B. Faraday cage
C. Proximity reader
D. Cable lock

A

A. USB data blocker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

A Chief Security Officer is looking for a solution that can provide increased scalability and flexibility for back-end infrastructure, allowing it to be updated and modified without disruption to services. The security architect would like the solution selected to reduce the back-end server resources and has highlighted that session persistence is not important for the applications running on the back-end servers. Which of the following would BEST meet the requirements?
A. Reverse proxy
B. Automated patch management
C. Snapshots
D. NIC teaming

A

A. Reverse proxy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A security analyst is reviewing application logs to determine the source of a breach and locates the following log: https://www.comptia.com/login.php?id=’%20or%20’1’1=’1
Which of the following has been observed?
A. DLL Injection
B. API attack
C. SQLi
D. XSS

A

C. SQLi

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A forensics investigator is examining a number of unauthorized payments that were reported on the company’s website. Some unusual log entries show users received an email for an unwanted mailing list and clicked on a link to attempt to unsubscribe. One of the users reported the email to the phishing team, and the forwarded email revealed the link to be:
<a>Click here to unsubscribe</a>
Which of the following will the forensics investigator MOST likely determine has occurred?
A. SQL injection
B. Broken authentication
C. XSS
D. XSRF

A

D. XSRF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

A report delivered to the Chief Information Security Officer (CISO) shows that some user credentials could be exfiltrated. The report also indicates that users tend to choose the same credentials on different systems and applications. Which of the following policies should the CISO use to prevent someone from using the exfiltrated credentials?
A. MFA
B. Lockout
C. Time-based logins
D. Password history

A

A. MFA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

A company wants to simplify the certificate management process. The company has a single domain with several dozen subdomains, all of which are publicly accessible on the internet. Which of the following BEST describes the type of certificate the company should implement?
A. Subject alternative name
B. Wildcard
C. Self-signed
D. Domain validation

A

B.Wildcard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

An amusement park is implementing a biometric system that validates customers’ fingerprints to ensure they are not sharing tickets. The park’s owner values customers above all and would prefer customers’ convenience over security. For this reason, which of the following features should the security team prioritize
FIRST?
A. Low FAR
B. Low efficacy
C. Low FRR
D. Low CER

A

C. Low FRR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A recent security breach exploited software vulnerabilities in the firewall and within the network management solution. Which of the following will MOST likely be used to identify when the breach occurred through each device?
A. SIEM correlation dashboards
B. Firewall syslog event logs
C. Network management solution login audit logs
D. Bandwidth monitors and interface sensors

A

A. SIEM correlation dashboards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

As part of a security compliance assessment, an auditor performs automated vulnerability scans. In addition, which of the following should the auditor do to complete the assessment?
A. User behavior analysis
B. Packet captures
C. Configuration reviews
D. Log analysis

A

C. Configuration reviews

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

An organization maintains several environments in which patches are developed and tested before being deployed to an operational status. Which of the following is the environment in which patches will be deployed just prior to being put into an operational status?
A. Development
B. Test
C. Production
D. Staging

A

D. Staging

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

An organization wants to implement a biometric system with the highest likelihood that an unauthorized user will be denied access. Which of the following should the organization use to compare biometric solutions?
A. FRR
B. Difficulty of use
C. Cost
D. FAR
E. CER

A

E. CER

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

A company recently experienced a significant data loss when proprietary information was leaked to a competitor. The company took special precautions by using proper labels; however, email filter logs do not have any record of the incident. An investigation confirmed the corporate network was not breached, but documents were downloaded from an employee’s COPE tablet and passed to the competitor via cloud storage. Which of the following is the BEST remediation for this data leak?
A. User training
B. CASB
C. MDM
D. DLP

A

D. DLP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

A tax organization is working on a solution to validate the online submission of documents. The solution should be carried on a portable USB device that should be inserted on any computer that is transmitting a transaction securely. Which of the following is the BEST certificate for these requirements?
A. User certificate
B. Self-signed certificate
C. Computer certificate
D. Root certificate

A

A. User certificate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

A recent audit cited a risk involving numerous low-criticality vulnerabilities created by a web application using a third-party library. The development staff state there are still customers using the application even though it is end of life and it would be a substantial burden to update the application for compatibility with more secure libraries. Which of the following would be the MOST prudent course of action?
A. Accept the risk if there is a clear road map for timely decommission.
B. Deny the risk due to the end-of-life status of the application.
C. Use containerization to segment the application from other applications to eliminate the risk.
D. Outsource the application to a third-party developer group.

A

A. Accept the risk if there is a clear road map for timely decommission.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

A security analyst is evaluating solutions to deploy an additional layer of protection for a web application. The goal is to allow only encrypted communications without relying on network devices. Which of the following can be implemented?
A. HTTP security header
B. DNSSEC implementation
C. SRTP
D. S/MIME

A

A. HTTP security header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

A company labeled some documents with the public sensitivity classification. This means the documents can be accessed by:
A. employees of other companies and the press.
B. all members of the department that created the documents.
C. only the company’s employees and those listed in the document.
D. only the individuals listed in the documents.

A

A. employees of other companies and the press.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which of the following is the MOST relevant security check to be performed before embedding third-party libraries in developed code?
A. Check to see if the third party has resources to create dedicated development and staging environments.
B. Verify the number of companies that downloaded the third-party code and the number of contributions on the code repository.
C. Assess existing vulnerabilities affecting the third-party code and the remediation efficiency of the libraries’ developers.
D. Read multiple penetration-testing reports for environments running software that reused the library.

A

C. Assess existing vulnerabilities affecting the third-party code and the remediation efficiency of the libraries’ developers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

During the onboarding process, an employee needs to create a password for an intranet account. The password must include ten characters, numbers, and letters, and two special characters. Once the password is created, the company will grant the employee access to other company-owned websites based on the intranet profile. Which of the following access management concepts is the company most likely using to safeguard intranet accounts and grant access to multiple sites based on a user’s intranet account? (Choose two.)

A. Federation
B. Identity proofing
C. Password complexity
D. Default password changes
E. Password manager
F. Open authentication

A

A. Federation
C. Password complexity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

A large bank with two geographically dispersed data centers is concerned about major power disruptions at both locations. Every day each location experiences very brief outages that last for a few seconds. However, during the summer a high risk of intentional brownouts that last up to an hour exists, particularly at one of the locations near an industrial smelter. Which of the following is the BEST solution to reduce the risk of data loss?
A. Dual supply
B. Generator
C. UPS
D. POU
E. Daily backups

A

C. UPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which of the following would be the BEST way to analyze diskless malware that has infected a VDI?
A. Shut down the VDI and copy off the event logs.
B. Take a memory snapshot of the running system.
C. Use NetFlow to identify command-and-control IPs.
D. Run a full on-demand scan of the root volume.

A

B. Take a memory snapshot of the running system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Users are presented with a banner upon each login to a workstation. The banner mentions that users are not entitled to any reasonable expectation of privacy and access is for authorized personnel only. In order to proceed past that banner, users must click the OK button. Which of the following is this an example of?
A. AUP
B. NDA
C. SLA
D. MOU

A

A. AUP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

The Chief Information Security Officer is concerned about employees using personal email rather than company email to communicate with clients and sending sensitive business information and PII. Which of the following would be the BEST solution to install on the employees’ workstations to prevent information from leaving the company’s network?
A. HIPS
B. DLP
C. HIDS
D. EDR

A

B. DLP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

A company discovered that terabytes of data have been exfiltrated over the past year after an employee clicked on an email link. The threat continued to evolve and remain undetected until a security analyst noticed an abnormal amount of external connections when the employee was not working. Which of the following is the MOST likely threat actor?
A. Shadow IT
B. Script kiddies
C. APT
D. Insider threat

A

C. APT

30
Q

A major political party experienced a server breach. The hacker then publicly posted stolen internal communications concerning campaign strategies to give the opposition party an advantage. Which of the following BEST describes these threat actors?
A. Semi-authorized hackers
B. State actors
C. Script kiddies
D. Advanced persistent threats

A

B. State actors

31
Q

A company is required to continue using legacy software to support a critical service. Which of the following BEST explains a risk of this practice?
A. Default system configuration
B. Unsecure protocols
C. Lack of vendor support
D. Weak encryption

A

C. Lack of vendor support

32
Q

Which of the following can work as an authentication method and as an alerting mechanism for unauthorized access attempts?
A. Smart card
B. Push notifications
C. Attestation service
D. HMAC-based
E. one-time password

A

B. Push notifications

33
Q

A Chief Information Security Officer has defined resiliency requirements for a new data center architecture. The requirements are as follows:
* Critical fileshares will remain accessible during and after a natural disaster.
* Five percent of hard disks can fail at any given time without impacting the data.
* Systems will be forced to shut down gracefully when battery levels are below 20%.
Which of the following are required to BEST meet these objectives? (Choose three.)
A. Fiber switching
B. IaC
C. NAS
D. RAID
E. UPS
F. Redundant power supplies
G. Geographic dispersal
H. Snapshots
I. Load balancing

A

D. RAID
E. UPS
G. Geographic dispersal

34
Q

A security analyst is evaluating the risks of authorizing multiple security solutions to collect data from the company’s cloud environment. Which of the following is an immediate consequence of these integrations?
A. Non-compliance with data sovereignty rules
B. Loss of the vendors interoperability support
C. Mandatory deployment of a SIEM solution
D. Increase in the attack surface

A

D. Increase in the attack surface

35
Q

Which of the following is a known security risk associated with data archives that contain financial information?
A. Data can become a liability if archived longer than required by regulatory guidance.
B. Data must be archived off-site to avoid breaches and meet business requirements.
C. Companies are prohibited from providing archived data to e-discovery requests.
D. Unencrypted archives should be preserved as long as possible and encrypted

A

A. Data can become a liability if archived longer than required by regulatory guidance.

36
Q

A systems engineer wants to leverage a cloud-based architecture with low latency between network-connected devices that also reduces the bandwidth that is required by performing analytics directly on the endpoints. Which of the following would BEST meet the requirements? (Choose two.)
A. Private cloud
B. SaaS
C. Hybrid cloud
D. IaaS
E. DRaaS
F. Fog computing

A

C. Hybrid cloud
F. Fog computing

37
Q

Which of the following is a policy that provides a greater depth and breadth of knowledge across an organization?
A. Asset management policy
B. Separation of duties policy
C. Acceptable use policy
D. Job rotation policy

A

D. Job rotation policy

38
Q

A company is moving its retail website to a public cloud provider. The company wants to tokenize credit card data but not allow the cloud provider to see the stored credit card information. Which of the following would BEST meet these objectives?
A. WAF
B. CASB
C. VPN
D. TLS

A

B. CASB

39
Q

A security analyst is tasked with defining the “something you are” factor of the company’s MFA settings. Which of the following is BEST to use to complete the configuration?
A. Gait analysis
B. Vein
C. Soft token
D. HMAC-based, one-time password

A

B. Vein

40
Q

A web server has been compromised due to a ransomware attack. Further investigation reveals the ransomware has been in the server for the past 72 hours. The systems administrator needs to get the services back up as soon as possible. Which of the following should the administrator use to restore services to a secure state?
A. The last incremental backup that was conducted 72 hours ago
B. The last known-good configuration
C. The last full backup that was conducted seven days ago
D. The baseline OS configuration

A

C. The last full backup that was conducted seven days ago

41
Q

A network engineer created two subnets that will be used for production and development servers. Per security policy production and development servers must each have a dedicated network that cannot communicate with one another directly. Which of the following should be deployed so that server administrators can access these devices?
A. VLANs
B. Internet proxy servers
C. NIDS
D. Jump servers

A

D. Jump servers

42
Q

A social media company based in North America is looking to expand into new global markets and needs to maintain compliance with international standards.
With which of the following is the company’s data protection officer MOST likely concerned?
A. NIST Framework
B. ISO 27001
C. GDPR
D. PCI-DSS

A

C. GDPR

43
Q

A Chief Information Security Officer wants to ensure the organization is validating and checking the integrity of zone transfers. Which of the following solutions should be implemented?
A. DNSSEC
B. LDAPS
C. NGFW
D. DLP

A

A. DNSSEC

44
Q

A company acquired several other small companies. The company that acquired the others is transitioning network services to the cloud. The company wants to make sure that performance and security remain intact. Which of the following BEST meets both requirements?
A. High availability
B. Application security
C. Segmentation
D. Integration and auditing

A

C. Segmentation

45
Q

Which of the following is the MOST effective way to detect security flaws present on third-party libraries embedded on software before it is released into production?
A. Employ different techniques for server- and client-side validations
B. Use a different version control system for third-party libraries
C. Implement a vulnerability scan to assess dependencies earlier on SDLC
D. Increase the number of penetration tests before software release

A

C. Implement a vulnerability scan to assess dependencies earlier on SDLC

46
Q

A user reports falling for a phishing email to an analyst. Which of the following system logs would the analyst check FIRST?
A. DNS
B. Message gateway
C. Network
D. Authentication

A

B. Message gateway

47
Q

Which of the following is used to ensure that evidence is admissible in legal proceedings when it is collected and provided to the authorities?
A. Chain of custody
B. Legal hold
C. Event log
D. Artifacts

A

A. Chain of custody

48
Q

A security engineer must deploy two wireless routers in an office suite. Other tenants in the office building should not be able to connect to this wireless network.
Which of the following protocols should the engineer implement to ensure the STRONGEST encryption?
A. WPS
B. WPA2
C. WAP
D. HTTPS

A

B. WPA2

49
Q

During an incident response process involving a laptop, a host was identified as the entry point for malware. The management team would like to have the laptop restored and given back to the user. The cybersecurity analyst would like to continue investigating the intrusion on the host. Which of the following would allow the analyst to continue the investigation and also return the laptop to the user as soon as possible?
A. dd
B. memdump
C. tcpdump
D. head

A

A. dd

50
Q

An analyst is trying to identify insecure services that are running on the internal network. After performing a port scan, the analyst identifies that a server has some insecure services enabled on default ports. Which of the following BEST describes the services that are currently running and the secure alternatives for replacing them? (Choose three.)

A. SFTP, FTPS
B. SNMPv2, SNMPv3
C. HTTP, HTTPS
D. TFTP, FTP
E. SNMPv1, SNMPv2
F. Telnet, SSH
G. TLS, SSL
H. POP, IMAP
I. Login, rlogin

A

B. SNMPv2, SNMPv3
C. HTTP, HTTPS
F. Telnet, SSH

51
Q

A security analyst needs to produce a document that details how a security incident occurred, the steps that were taken for recovery, and how future incidents can be avoided. During which of the following stages of the response process will this activity take place?

A. Recovery
B. Identification
C. Lessons learned
D. Preparation

A

C. Lessons learned

52
Q

While investigating a recent security incident, a security analyst decides to view all network connections on a particular server. Which of the following would provide the desired information?

A. arp
B. nslookup
C. netstat
D. nmap

A

C. netstat

53
Q

A company recently decided to allow its employees to use their personally owned devices for tasks like checking email and messaging via mobile applications. The company would like to use MDM, but employees are concerned about the loss of personal data. Which of the following should the IT department implement to BEST protect the company against company data loss while still addressing the employees’ concerns?

A. Enable the remote-wiping option in the MDM software in case the phone is stolen.
B. Configure the MDM software to enforce the use of PINs to access the phone.
C. Configure MDM for FDE without enabling the lock screen.
D. Perform a factory reset on the phone before installing the company’s applications.

A

B. Configure the MDM software to enforce the use of PINs to access the phone.

54
Q

The concept of connecting a user account across the systems of multiple enterprises is BEST known as:

A. federation.
B. a remote access policy.
C. multifactor authentication.
D. single sign-on.

A

A. federation.

55
Q

A company is working on mobile device security after a report revealed that users granted non-verified software access to corporate data. Which of the following is the MOST effective security control to mitigate this risk?

A. Block access to application stores
B. Implement OTA updates
C. Update the BYOD policy
D. Deploy a uniform firmware

A

A. Block access to application stores

56
Q

A new vulnerability in the SMB protocol on the Windows systems was recently discovered, but no patches are currently available to resolve the issue. The security administrator is concerned that servers in the company’s DMZ will be vulnerable to external attack; however, the administrator cannot disable the service on the servers, as SMB is used by a number of internal systems and applications on the LAN. Which of the following TCP ports should be blocked for all external inbound connections to the DMZ as a workaround to protect the servers? (Choose two.)

A. 135
B. 139
C. 143
D. 161
E. 443
F. 445

A

B. 139
F. 445

57
Q

Which of the following techniques eliminates the use of rainbow tables for password cracking?

A. Hashing
B. Tokenization
C. Asymmetric encryption
D. Salting

A

D. Salting

58
Q

A network administrator is concerned about users being exposed to malicious content when accessing company cloud applications. The administrator wants to be able to block access to sites based on the AUP. The users must also be protected because many of them work from home or at remote locations, providing on-site customer support. Which of the following should the administrator employ to meet these criteria?

A. Implement NAC.
B. Implement an SWG.
C. Implement a URL filter.
D. Implement an MDM.

A

B. Implement an SWG.

59
Q

Which of the following supplies non-repudiation during a forensics investigation?

A. Dumping volatile memory contents first
B. Duplicating a drive with dd
C. Using a SHA-2 signature of a drive image
D. Logging everyone in contact with evidence
E. Encrypting sensitive data

A

C. Using a SHA-2 signature of a drive image

60
Q

An organization’s Chief Security Officer (CSO) wants to validate the business’s involvement in the incident response plan to ensure its validity and thoroughness. Which of the following will the CSO MOST likely use?

A. An external security assessment
B. A bug bounty program
C. A tabletop exercise
D. A red-team engagement

A

C. A tabletop exercise

61
Q

Which of the following documents provides guidance regarding the recommended deployment of network security systems from the manufacturer?

A. Cloud control matrix
B. Reference architecture
C. NIST RMF
D. CIS Top 20

A

B. Reference architecture

62
Q

An organization just implemented a new security system. Local laws state that citizens must be notified prior to encountering the detection mechanism to deter malicious activities. Which of the following is being implemented?

A. Proximity cards with guards
B. Fence with electricity
C. Drones with alarms
D. Motion sensors with signage

A

D. Motion sensors with signage

63
Q

When implementing automation with IoT devices, which of the following should be considered FIRST to keep the network secure?

A. Z-Wave compatibility
B. Network range
C. Zigbee configuration
D. Communication protocols

A

D. Communication protocols

64
Q

A news article states hackers have been selling access to IoT camera feeds. Which of the following is the MOST likely reason for this issue?

A. Outdated software
B. Weak credentials
C. Lack of encryption
D. Backdoors

A

B. Weak credentials

65
Q

A company wants to build a new website to sell products online. The website will host a storefront application that will allow visitors to add products to a shopping cart and pay for the products using a credit card. Which of the following protocols would be the MOST secure to implement?

A. SSL
B. SFTP
C. SNMP
D. TLS

A

D. TLS

66
Q

An IT manager is estimating the mobile device budget for the upcoming year. Over the last five years, the number of devices that were replaced due to loss, damage, or theft steadily increased by 10%. Which of the following would BEST describe the estimated number of devices to be replaced next year?

A. ALE
B. ARO
C. RPO
D. SLE

A

B. ARO

67
Q

Which of the following typically uses a combination of human and artificial intelligence to analyze event data and take action without intervention?

A. TTP
B. OSINT
C. SOAR
D. SIEM

A

C. SOAR

68
Q

A Chief Security Officer is looking for a solution that can reduce the occurrence of customers receiving errors from back-end infrastructure when systems go offline unexpectedly. The security architect would like the solution to help maintain session persistence. Which of the following would BEST meet the requirements?

A. Reverse proxy
B. NIC teaming
C. Load balancer
D. Forward proxy

A

C. Load balancer

69
Q

A company is implementing BYOD and wants to ensure all users have access to the same cloud-based services. Which of the following would BEST allow the company to meet this requirement?

A. IaaS
B. PaaS
C. MaaS
D. SaaS

A

D. SaaS

70
Q

An organization is tuning SIEM rules based off of threat intelligence reports. Which of the following phases of the incident response process does this scenario represent?

A. Lessons learned
B. Eradication
C. Recovery
D. Preparation

A

D. Preparation

CyberSecurity (17 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions