Part 1

Question 1

While planning segmentation for an ICS environment, a security engineer determines IT resources will
need access to devices within the ICS environment without compromising security.
To provide the MOST secure access model in this scenario, the jumpbox should be…
A. placed in an isolated network segment, authenticated on the IT side, and forwarded into the ICS
network.
B. placed on the ICS network with a static firewall rule that allows IT network resources to authenticate.
C. bridged between the IT and operational technology networks to allow authenticated access.
D. placed on the IT side of the network, authenticated, and tunneled into the ICS environment.

Answer 1

D: placed on the IT side of the network, authenticated, and tunneled into the ICS environment.

Question 2

Which of the following secure coding techniques can be used to prevent cross-site request forgery
attacks?
A. Input validation
B. Output encoding
C. Parameterized queries
D. Tokenization

Answer 2

D: Tokenization

Question 3

3.Risk management wants IT to implement a solution that will permit an analyst to intercept, execute, and
analyze potentially malicious files that are downloaded from the Internet.
Which of the following would BEST provide this solution?
A. File fingerprinting
B. Decomposition of malware
C. Risk evaluation
D. Sandboxing

Answer 3

D: Sandboxing

Question 4

A web-based front end for a business intelligence application uses pass-through authentication to
authenticate users. The application then uses a service account, to perform queries and look up data in a database A security analyst discovers employees are accessing data sets they have not been authorized
to use.
Which of the following will fix the cause of the issue?
A. Change the security model to force the users to access the database as themselves
B. Parameterize queries to prevent unauthorized SQL queries against the database
C. Configure database security logging using syslog or a SIEM
D. Enforce unique session IDs so users do not get a reused session ID

Answer 4

A. Change the security model to force the users to access the database as themselves

Question 5

Clients are unable to access a company’s API to obtain pricing data. An analyst discovers sources other
than clients are scraping the API for data, which is causing the servers to exceed available resources.
Which of the following would be BEST to protect the availability of the APIs?
A. IP whitelisting
B. Certificate-based authentication
C. Virtual private network
D. Web application firewall

Answer 5

D: Web application firewall

Question 6

A security team is implementing a new vulnerability management program in an environment that has a
historically poor security posture. The team is aware of issues patch management in the environment and
expects a large number of findings.
Which of the following would be the MOST efficient way to increase the security posture of the
organization in the shortest amount of time?
A. Create an SLA stating that remediation actions must occur within 30 days of discovery for all levels of
vulnerabilities.
B. Incorporate prioritization levels into the remediation process and address critical findings first.
C. Create classification criteria for data residing on different servers and provide remediation only for
servers housing sensitive data.
D. Implement a change control policy that allows the security team to quickly deploy patches in the
production environment to reduce the risk of any vulnerabilities found.

Answer 6

B: Incorporate prioritization levels into the remediation process and address critical findings first.

Question 7

The computer incident response team at a multinational company has determined that a breach of
sensitive data has occurred in which a threat actor has compromised the organization’s email system. Per
the incident response procedures, this breach requires notifying the board immediately.
Which of the following would be the BEST method of communication?
A. Post of the company blog
B. Corporate-hosted encrypted email
C. VoIP phone call
D. Summary sent by certified mail
E. Externally hosted instant message

Answer 7

C: VoIP phone call

Question 8

.A security analyst for a large financial institution is creating a threat model for a specific threat actor that
is likely targeting an organization’s financial assets.
Which of the following is the BEST example of the level of sophistication this threat actor is using?
A. Social media accounts attributed to the threat actor
B. Custom malware attributed to the threat actor from prior attacks
C. Email addresses and phone numbers tied to the threat actor
D. Network assets used in previous attacks attributed to the threat actor
E. IP addresses used by the threat actor for command and control

Answer 8

D. Network assets used in previous attacks attributed to the threat actor

Question 9

During an investigation, an analyst discovers the following rule in an executive’s email client:
IF * TO THEN mailto:
SELECT FROM ‘sent’ THEN DELETE FROM
The executive is not aware of this rule.
Which of the following should the analyst do FIRST to evaluate the potential impact of this security
incident?

A. Check the server logs to evaluate which emails were sent to
B. Use the SIEM to correlate logging events from the email server and the domain server
C. Remove the rule from the email client and change the password
D. Recommend that management implement SPF and DKIM

Answer 9

Check the server logs to evaluate which emails were sent to

Question 10

A security analyst is supporting an embedded software team.
Which of the following is the BEST recommendation to ensure proper error handling at runtime?

A. Perform static code analysis.
B. Require application fuzzing.
C. Enforce input validation
D. Perform a code review

Answer 10

Require application fuzzing.

Question 11

During an investigation, a security analyst determines suspicious activity occurred during the night
shift over the weekend. Further investigation reveals the activity was initiated from an internal IP going to
an external website.
Which of the following would be the MOST appropriate recommendation to prevent the activity from
happening in the future?
A. An IPS signature modification for the specific IP addresses
B. An IDS signature modification for the specific IP addresses
C. A firewall rule that will block port 80 traffic
D. A firewall rule that will block traffic from the specific IP addresses

Answer 11

A firewall rule that will block traffic from the specific IP addresses

Question 12

The inability to do remote updates of certificates. keys software and firmware is a security issue
commonly associated with:
A. web servers on private networks.
B. HVAC control systems
C. smartphones
D. firewalls and UTM devices

Answer 12

D. firewalls and UTM devices

Question 13

A security analyst received an email with the following key:
Xj3XJ3LLc
A second security analyst received an email with following key:
3XJ3xjcLLC
The security manager has informed the two analysts that the email they received is a key that allows
access to the company’s financial segment for maintenance.
This is an example of:
A. dual control
B. private key encryption
C. separation of duties
D. public key encryption
E. two-factor authentication

Answer 13

dual control

Question 14

A security analyst is providing a risk assessment for a medical device that will be installed on the
corporate network. During the assessment, the analyst discovers the device has an embedded operating
system that will be at the end of its life in two years. Due to the criticality of the device, the security
committee makes a risk-based policy decision to review and enforce the vendor upgrade before the end
of life is reached.
Which of the following risk actions has the security committee taken?
A. Risk exception
B. Risk avoidance
C. Risk tolerance
D. Risk acceptance

Answer 14

Risk acceptance

Question 15

A security analyst is reviewing a web application. If an unauthenticated user tries to access a page in
the application, the user is redirected to the login page. After successful authentication, the user is then
redirected back to the original page. Some users have reported receiving phishing emails with a link that
takes them to the application login page but then redirects to a fake login page after successful
authentication.
Which of the following will remediate this software vulnerability?
A. Enforce unique session IDs for the application.
B. Deploy a WAF in front of the web application.
C. Check for and enforce the proper domain for the redirect.
D. Use a parameterized query to check the credentials.
E. Implement email filtering with anti-phishing protection.

Answer 15

A. Enforce unique session IDs for the application.

Question 16

A security analyst has received information from a third-party intelligence-sharing resource that
indicates employee accounts were breached.
Which of the following is the NEXT step the analyst should take to address the issue?
A. Audit access permissions for all employees to ensure least privilege.
B. Force a password reset for the impacted employees and revoke any tokens.
C. Configure SSO to prevent passwords from going outside the local network.
D. Set up privileged access management to ensure auditing is enabled.

Answer 16

Force a password reset for the impacted employees and revoke any tokens.

Question 17

An information security analyst on a threat-hunting team Is working with administrators to create a
hypothesis related to an internally developed web application.
The working hypothesis is as follows:
• Due to the nature of the industry, the application hosts sensitive data associated with many clients and Is
a significant target
•. The platform Is most likely vulnerable to poor patching and Inadequate server hardening, which expose
vulnerable services.
•. The application is likely to be targeted with SQL injection attacks due to the large number of reporting
capabilities within the application.
As a result, the systems administrator upgrades outdated service applications and validates the endpoint
configuration against an industry benchmark. The analyst suggests developers receive additional training
on implementing identity and access management, and also implements a WAF to protect against SOL
injection attacks.
Which of the following BEST represents the technique in use?
A. Improving detection capabilities
B. Bundling critical assets
C. Profiling threat actors and activities
D. Reducing the attack surface area

Answer 17

Reducing the attack surface area

Question 18

An incident response team is responding to a breach of multiple systems that contain PII and PHI.
Disclosing the incident to external entities should be based on:
A. the responder’s discretion
B. the public relations policy
C. the communication plan
D. senior management’s guidance

Answer 18

C. the communication plan

Question 19

A security analyst has a sample of malicious software and needs to know what the sample does. The
analyst runs the sample in a carefully controlled and monitored virtual machine to observe the software
behavior.
Which of the following malware analysis approaches is this?
A. White box testing
B. Fuzzing
C. Sandboxing
D. Static code analysis

Answer 19

Sandboxing

Question 20

A company’s Chief Information Security Officer (CISO) is concerned about the integrity of some highly
confidential files. Any changes to these files must be tied back to a specific authorized user’s activity
session.
Which of the following is the BEST technique to address the CISO’s concerns?
A. Configure DLP to reject all changes to the files without pre-authorization. Monitor the files for
unauthorized changes.
B. Regularly use SHA-256 to hash the directory containing the sensitive information.
Monitor the files for unauthorized changes.
C. Place a legal hold on the files. Require authorized users to abide by a strict time context access policy.
Monitor the files for unauthorized changes.
D. Use Wireshark to scan all traffic to and from the directory. Monitor the files for unauthorized changes.

Answer 20

A. Configure DLP to reject all changes to the files without pre-authorization. Monitor the files for
unauthorized changes.

Question 21

A team of security analysts has been alerted to potential malware activity. The initial examination
indicates one of the affected workstations is beaconing on TCP port 80 to five IP addresses and
attempting to spread across the network over port 445.
Which of the following should be the team’s NEXT step during the detection phase of this response
process?
A. Escalate the incident to management, who will then engage the network infrastructure team to keep
them informed.
B. Depending on system criticality, remove each affected device from the network by disabling wired and
wireless connections.
C. Engage the engineering team to block SMB traffic internally and outbound HTTP traffic to the five IP
addresses.
D. Identify potentially affected systems by creating a correlation search in the SIEM based on the network
traffic.

Answer 21

Identify potentially affected systems by creating a correlation search in the SIEM based on the network
traffic.

Question 22

A security analyst on the threat-hunting team has developed a list of unneeded, benign services that
are currently running as part of the standard OS deployment for workstations. The analyst will provide this
list to the operations team to create a policy that will automatically disable the services for all workstations
in the organization.
Which of the following BEST describes the security analyst’s goal?
A. To create a system baseline
B. To reduce the attack surface
C. To optimize system performance
D. To improve malware detection

Answer 22

To reduce the attack surface

Question 23

A developer wrote a script to make names and other Pll data unidentifiable before loading a
database export into the testing system.
Which of the following describes the type of control that is being used?
A. Data encoding
B. Data masking
C. Data loss prevention
D. Data classification

Answer 23

B. Data masking

Question 24

An executive assistant wants to onboard a new cloud based product to help with business analytics
and dashboarding. When of the following would be the BEST integration option for the service?
A. Manually log in to the service and upload data files on a regular basis.
B. Have the internal development team script connectivity and file translate to the new service.
C. Create a dedicated SFTP sue and schedule transfers to ensue file transport security
D. Utilize the cloud products API for supported and ongoing integrations

Answer 24

D. Utilize the cloud products API for supported and ongoing integrations

Question 25

Which of the following assessment methods should be used to analyze how specialized software
performs during heavy loads?
A. Stress test
B. API compatibility lest
C. Code review
D. User acceptance test
E. Input validation

Answer 25

A. Stress test

Question 26

A threat feed notes malicious actors have been infiltrating companies and exfiltration data to a specific
set of domains Management at an organization wants to know if it is a victim.
Which of the following should the security analyst recommend to identity this behavior without alerting any
potential malicious actors?
A. Create an IPS rule to block these domains and trigger an alert within the SIEM tool when these
domains are requested
B. Add the domains to a DNS sinkhole and create an alert m the SIEM toot when the domains are queried
C. Look up the IP addresses for these domains and search firewall logs for any traffic being sent to those
IPs over port 443
D. Query DNS logs with a SIEM tool for any hosts requesting the malicious domains and create alerts
based on this information

Answer 26

B. Add the domains to a DNS sinkhole and create an alert m the SIEM toot when the domains are queried

Question 27

A cybersecurity analyst is responding to an incident. The company’s leadership team wants to attribute
the incident to an attack group.
Which of the following models would BEST apply to the situation?
A. Intelligence cycle
B. Diamond Model of Intrusion Analysis
C. Kill chain
D. MITRE ATT&CK

Answer 27

B. Diamond Model of Intrusion Analysis

Question 28

A cybersecurity analyst is dissecting an intrusion down to the specific techniques and wants to
organize them in a logical manner.
Which of the following frameworks would BEST apply in this situation?
A. Pyramid of Pain
B. MITRE ATT&CK
C. Diamond Model of Intrusion Analysts
D. CVSS v3.0

Answer 28

MITRE ATT&CK

Question 29

Ann, a user, reports to the security team that her browser began redirecting her to random sites while
using her Windows laptop. Ann further reports that the OS shows the C: drive is out of space despite
having plenty of space recently. Ann claims she not downloaded anything.
The security team obtains the laptop and begins to investigate, noting the following:
✑ File access auditing is turned off.
✑ When clearing up disk space to make the laptop functional, files that appear to be cached web pages
are immediately created in a temporary directory, filling up the available drive space.
✑ All processes running appear to be legitimate processes for this user and machine.
✑ Network traffic spikes when the space is cleared on the laptop.
✑ No browser is open.
Which of the following initial actions and tools would provide the BEST approach to determining what is
happening?
A. Delete the temporary files, run an Nmap scan, and utilize Burp Suite.
B. Disable the network connection, check Sysinternals Process Explorer, and review netstat output.
C. Perform a hard power down of the laptop, take a dd image, and analyze with FTK.
D. Review logins to the laptop, search Windows Event Viewer, and review Wireshark captures.

Answer 29

Disable the network connection, check Sysinternals Process Explorer, and review netstat output.

Question 30

Which of the following technologies can be used to store digital certificates and is typically used in
high-security implementations where integrity is paramount?
A. HSM
B. eFuse
C. UEFI
D. Self-encrypting drive

Answer 30

A: HSM

Question 31

A company’s modem response team is handling a threat that was identified on the network Security
analysts have as at remote sites.
Which of the following is the MOST appropriate next step in the incident response plan?
A. Quarantine the web server
B. Deploy virtual firewalls
C. Capture a forensic image of the memory and disk
D. Enable web server containerization

Answer 31

B. Deploy virtual firewalls

Question 32

It is important to parameterize queries to prevent:
A. the execution of unauthorized actions against a database.
B. a memory overflow that executes code with elevated privileges.
C. the establishment of a web shell that would allow unauthorized access.
D. the queries from using an outdated library with security vulnerabilities.

Answer 32

A. the execution of unauthorized actions against a database.

Question 33

Which of the following is the MOST important objective of a post-incident review?
A. Capture lessons learned and improve incident response processes
B. Develop a process for containment and continue improvement efforts
C. Identify new technologies and strategies to remediate
D. Identify a new management strategy

Answer 33

A. Capture lessons learned and improve incident response processes

Question 34

Which of me following BEST articulates the benefit of leveraging SCAP in an organization’s
cybersecurity analysis toolset?
A. It automatically performs remedial configuration changes lo enterprise security services
B. It enables standard checklist and vulnerability analysis expressions for automaton
C. It establishes a continuous integration environment for software development operations
D. It provides validation of suspected system vulnerabilities through workflow orchestration

Answer 34

B. It enables standard checklist and vulnerability analysis expressions for automaton

Question 35

A security analyst suspects a malware infection was caused by a user who downloaded malware after
clicking http:///A.php in a phishing email.
To prevent other computers from being infected by the same malware variation, the analyst should create
a rule on the.
A. email server that automatically deletes attached executables.
B. IDS to match the malware sample.
C. proxy to block all connections to the malwaresource.
D. firewall to block connection attempts to dynamic DNS hosts.

Answer 35

C. proxy to block all connections to the maleware source.

Question 36

An analyst is performing penetration testing and vulnerability assessment activities against a new
vehicle automation platform.
Which of the following is MOST likely an attack vector that is being utilized as part of the testing and
assessment?
A. FaaS
B. RTOS
C. SoC
D. GPS
E. CAN bus

Answer 36

B. RTOS (real time OS)

IoT devices also often run real-time operating systems (RTOS). These are either special purpose operating systems or variants of standard operating systems designed to process data rapidly as it arrives from sensors or other IoT components.

Question 37

During a review of vulnerability scan results an analyst determines the results may be flawed because
a control-baseline system which is used to evaluate a scanning tools effectiveness was reported as not
vulnerable Consequently, the analyst verifies the scope of the scan included the control-baseline host
which was available on the network during the scan. The use of a control-baseline endpoint in this
scenario assists the analyst in confirming.
A. verification of mitigation
B. false positives
C. false negatives
D. the criticality index
E. hardening validation.

Answer 37

A. verification of mitigation

Question 38

As part of a review of incident response plans, which of the following is MOST important for an
organization to understand when establishing the breach notification period?
A. Organizational policies
B. Vendor requirements and contracts
C. Service-level agreements
D. Legal requirements

Answer 38

Legal requirements

Question 39

A new on-premises application server was recently installed on the network. Remote access to the
server was enabled for vendor support on required ports, but recent security reports show large amounts
of data are being sent to various unauthorized networks through those ports.
Which of the following configuration changes must be implemented to resolve this security issue while still
allowing remote vendor access?
A. Apply a firewall application server rule.
B. Whitelist the application server.
C. Sandbox the application server.
D. Enable port security.
E. Block the unauthorized networks.

Answer 39

Whitelist the application server.

Question 40

A pharmaceutical company’s marketing team wants to send out notifications about new products to
alert users of recalls and newly discovered adverse drug reactions. The team plans to use the names and
mailing addresses that users have provided.
Which of the following data privacy standards does this violate?
A. Purpose limitation
B. Sovereignty
C. Data minimization
D. Retention

Answer 40

Purpose limitation

Question 41

An organization suspects it has had a breach, and it is trying to determine the potential impact.
The organization knows the following:
✑. The source of the breach is linked to an IP located in a foreign country.
✑ The breach is isolated to the research and development servers.
✑. The hash values of the data before and after the breach are unchanged.
✑ The affected servers were regularly patched, and a recent scan showed no vulnerabilities.
Which of the following conclusions can be drawn with respect to the threat and impact? (Choose two.)
A. The confidentiality of the data is unaffected.
B. The threat is an APT.
C. The source IP of the threat has been spoofed.
D. The integrity of the data is unaffected.
E. The threat is an insider.

Answer 41

B. The threat is an APT.

D. The integrity of the data is unaffected.

Question 42

A security analyst has discovered trial developers have installed browsers on all development servers
in the company’s cloud infrastructure and are using them to browse the Internet.
Which of the following changes should the security analyst make to BEST protect the environment?
A. Create a security rule that blocks Internet access in the development VPC
B. Place a jumpbox m between the developers’ workstations and the development VPC
C. Remove the administrator profile from the developer user group in identity and access management
D. Create an alert that is triggered when a developer installs an application on a server

Answer 42

A. Create a security rule that blocks Internet access in the development VPC

Question 43

A security manager has asked an analyst to provide feedback on the results of a penetration lest.
After reviewing the results the manager requests information regarding the possible exploitation of
vulnerabilities Much of the following information data points would be MOST useful for the analyst to
provide to the security manager who would then communicate the risk factors to senior management?
(Select TWO)
A. Probability
B. Adversary capability
C. Attack vector
D. Impact
E. Classification
F. Indicators of compromise

Answer 43

A. Probability

D. Impact

Question 44

A cyber-incident response analyst is investigating a suspected cryptocurrency miner on a company’s
server.
Which of the following is the FIRST step the analyst should take?
A. Create a full disk image of the server’s hard drive to look for the file containing the malware.
B. Run a manual antivirus scan on the machine to look for known malicious software.
C. Take a memory snapshot of the machine to capture volatile information stored in memory.
D. Start packet capturing to look for traffic that could be indicative of command and control from the miner.

Answer 44

D. Start packet capturing to look for traffic that could be indicative of command and control from the miner

Question 45

A web developer wants to create a new web part within the company website that aggregates sales
from individual team sites. A cybersecurity analyst wants to ensure security measurements are
implemented during this process.
Which of the following remediation actions should the analyst take to implement a vulnerability
management process?
A. Personnel training
B. Vulnerability scan
C. Change management
D. Sandboxing

Answer 45

C. Change management

Question 46

A development team is testing a new application release. The team needs to import existing client PHI
data records from the production environment to the test environment to test accuracy and functionality.
Which of the following would BEST protect the sensitivity of this data while still allowing the team to
perform the testing?
A. Deidentification
B. Encoding
C. Encryption
D. Watermarking

Answer 46

C. Encryption

Question 47

A storage area network (SAN) was inadvertently powered off while power maintenance was being
performed in a datacenter. None of the systems should have lost all power during the maintenance. Upon
review, it is discovered that a SAN administrator moved a power plug when testing the SAN’s fault
notification features.
Which of the following should be done to prevent this issue from reoccurring?
A. Ensure both power supplies on the SAN are serviced by separate circuits, so that if one circuit goes
down, the other remains powered.
B. Install additional batteries in the SAN power supplies with enough capacity to keep the system
powered on during maintenance operations.
C. Ensure power configuration is covered in the datacenter change management policy and have the
SAN administrator review this policy.
D. Install a third power supply in the SAN so loss of any power intuit does not result in the SAN completely
powering off.

Answer 47

A. Ensure both power supplies on the SAN are serviced by separate circuits, so that if one circuit goes
down, the other remains powered.

Question 48

A security analyst is investigating a malware infection that occurred on a Windows system. The system
was not connected to a network and had no wireless capability Company policy prohibits using portable
media or mobile storage. The security analyst is trying to determine which user caused the malware to get
onto the system.
Which of the following registry keys would MOST likely have this information?
A. HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run
B. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
C. HKEY_USERS\Software\Microsoft\Windows\explorer\MountPoints2
D. HKEY_USERS\Software\Microsoft\Internet Explorer\Typed URLs
E. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\System\iusb3hub

Answer 48

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\System\iusb3hub

Question 49

Which of the following attacks can be prevented by using output encoding?
A. Server-side request forgery
B. Cross-site scripting
C. SQL injection
D. Command injection
E. Cross-site request forgery

Answer 49

B. Cross-site scripting

Question 50

A security analyst recently discovered two unauthorized hosts on the campus’s wireless network
segment from a man-m-the-middle attack. The security analyst also verified that privileges were not
escalated, and the two devices did not gain access to other network devices.
Which of the following would BEST mitigate and improve the security posture of the wireless network for
this type of attack?
A. Enable MAC filtering on the wireless router and suggest a stronger encryption for the wireless network,
B. Change the SSID, strengthen the passcode, and implement MAC filtering on the wireless router.
C. Enable MAC filtering on the wireless router and create a whitelist that allows devices on the network
D. Conduct a wireless survey to determine if the wireless strength needs to be reduced.

Answer 50

B. Change the SSID, strengthen the passcode, and implement MAC filtering on the wireless router.