New Batch Flashcards
A user enters a password to log in to a workstation and is then prompted to enter an authentication code.
Which of the following MFA factors or attributes are being utilized in the authentication process. Select Two
Something you have
Something you are
A security assessment determines DES and 3DES at still being used on recently deployed production servers.
Which of the following did the assessment identify?
Weak Encryption
A chief information security officer (CISO) needs to create a policy set that meets international standards for data privacy and sharing.
Which of the following should the CISO read and understand before writing the policies?
GDPR
GDPR is an international standard for data protection and privacy.
A system administrator needs to implement an access control scheme that will allow an abjects access policy be determined by its owner.
Which of the following access control schemes BEST fits the requirements?
Discretionary Access control
The SOC is reviewing process and procedures after a recent incident. The review indicates it took more than 30 minutes to determine that quarentining an infected host was the best course of action. The allowed the malware to spread to additional hosts before it was contained.
Which of the following would be BEST to improve the incident response provess?
Updating the playbooks with better decisions points.
After reading a security bulletin, a network security manager is concerned that a malicious actor may have breached the network using the same software flaw. The exploit code is publicly available and has been reported as being used against other industries in the same vertical.
Which of the following should the network security manager consult FIRST to determine a priority list for forensic review?
The vulnerability Scan Output
In which of the following common use cases would steganography be employed?
Obfuscation
A company wants to deploy PKI on its internet-facing website. The applications that are currently deployed are:
www.company.com (Main Website)
Contactus.company.com (for locating a nearby location) quotes.company.com (for requesting a price quote)
The company wants to purchase one SSL certificate that will work for all the existing applications and any future applications that follow the dame naming conventions, such as store.company.com
which of the following certificate types would BEST meet the requirements?
Wildcard.
A host was infected with malware. During the incident response, Joe, a user, reported that he did not receive any emails with links, but he had been browsing the internet all day.
Which of the following would MOST likely show where the malware originated?
The DNS Logs
A company has drafted an insidedr-threat policy that prohibits the use of external storage devices.
Which of the following would BEST protect the compnay from data Exfilitration via removable media?
Blocking removable-media devices and write capabilities usinga host-based security tool
A security analyst is using a recently released security advisory to review historical logs, looking for the specific activity that was outlined in the advisory.
Which of the following is the analyst doing?
Threat hunting
Several employees return to work the day after attending an industry trade show. That same day, the security manager notices several malware alerts coming from each of the employee’s workstations. The security manager investigates but finds no signs of an attack on the perimeter firewall or the NIDS.
Which of the following is MOST likely causing the malware alerts?
A worm that has propagated itself across the intranet, which was initiated by presentation media.
Joe, a user at a company, clicked an email link led to a website that infected his workstation. Joe, was connected to the network, and the virus spread to the network shares. The protective measures failed to stop this virus, and it has continues to evade detection. Which of the following should administator implement to protect the environment from this malware?
Implement a heuristic behavior-detection solution.
Heuristic analysis is also one of the few methods capable of combating polymorphic viruses – the term for malicious code that constantly changes and adapts. Heuristic analysis is incorporated into advanced security solutions offered by companies like Kaspersky Labs to detect new threats before they cause harm, without the need for a specific signature.
An organization’s help desk is flooded with phone calls from users stating they can no longer access certain websites. The help desk escalates the issue to a security team, as these websites were accessible the previous day. The security analysts run the following command: ipconfig /flush dns, but the issue persist. Finally an analyst changes the DNS server for an impacted machine, and the issue goes away.
Which of the following attacks MOST likely occurred on the original DNS server?
Domain Hiijacking
The CSIRT is reviewing the lessons learned from a recent incident. A worm was able to spread unhindered throughout the network and infect a large number of computers and servers. Which of the following recommendations would BEST to mitigate the impacts of a similar incident in the futre?
Segment the network with firewalls.
A retail executive recently accepted a job with a major competitor. The following week, a security analyst reviews the security logs and identifies successful logon attempts to access the departed executive’s accounts.
Ofboarding
Users have been issued smart cards that provide physical access to a building. The cards also contain tokens that can be used to access information systems. Users can log into any thin client located througout the building and see the same desktop each time.
Which of the following technologies are being utilized to provide these capabilities? (Select TWO)
VDI
RFID
A company is adopting a BYOD policy and is looking fora comprehensive solution to protext company information on user devices.
Which of the following solutions would BEST support the policy?
Mobile Device management
A security analyst is reviewing a new website that will soon be made publicily available the analyst sees the following in the URL
HTTP://dev-site.comptia.org/home/show.php?sessionID+77276554&loc=us
The analyst the sends an internal user a link to the new website for testing purposes and when the user clicks the link, the analyst is able to browse the website with the following URL:
http;//dev-site.comptia.org/home/show.php?sessionID=98988475&loc=us
Which of the folowing aplication attacks is being tested?
Cross site Forgery
A user recently entered a username and password into a recruiting application website that had been forged to look like the legitimate site Upon investigation, a security analyst the identifies the following:
- The legitimate websites IP address is 10.1.1.20 and eRecruit local resolves to the IP
- The Forged websites IP address appears to be 10.2.12.99 based on NetFtow records
- AH three at the organization’s DNS servers show the website correctly resolves to the legitimate IP
- DNS query logs show one of the three DNS servers returned a result of 10.2.12.99 (cached) at the approximate time of the suspected compromise.
Which of the following MOST likely occurred?
An SSL strip MITM attack was performed.
A manufacturer creates designs for very high security products that are required to be protected and controlled by the government regulations. These designs are not accessible by corporate networks or the Internet.
Which of the following is the BEST solution to protect theses designs?
An air gap
A security analyst has received an alert about being sent via email. The analyst;s chief information Security Officer (CISO) has made it clear that PII must bew handled with extreme care.
From which of the following did the alert MOST likely origninate?
DLP
Network-based DLP monitors outgoing data looking for sensitive data. Network-based DLP systems monitor outgoing email to detect and block unauthorized data transfers ad monitor data stored in the cloud.
A commercial cyber-threat intelligence organization observes IoCs across a variety of unrelated customers. Prior to releasing specific threat intelligence to other paid subscribers, the organization is MOST likely obligated by contracts to:
anonymize any PII that is observed withing the IoC data
A security analyst has been asked to investigate a situation after the SOC started to receive alerts from the SIEM. The analyst first looks at the domain controller and finds the following events:
[A picture of usernames with a variuos bad password attempts ]
Spraying
A chief security officer (CSO) is concerned about the amount of PII that is stored locally on each salesperson’s laptop. The sales department has a higher-than average rate of lost equipment.
Which of the following recommendations would best addres the CSO’s concern?
Implement managed FDE
