Part 2 Flashcards
A cybersecurity analyst is contributing to a team hunt on an organization’s endpoints.
Which of the following should the analyst do FIRST?
A. Write detection logic.
B. Establish a hypothesis.
C. Profile the threat actors and activities.
D. Perform a process analysis.
B. Establish a hypothesis.
https://www.cybereason.com/blog/blog-the-eight-steps-to-threat-hunting
Which of the following software security best practices would prevent an attacker from being able to run arbitrary SQL commands within a web application? (Choose two.) A. Parameterized queries B. Session management C. Input validation D. Output encoding E. Data protection F. Authentication
A. Parameterized queries
C. Input validation
Reference:
https://www.ptsecurity.com/ww-en/analytics/knowledge-base/how-to-prevent-sql-injection-attacks/
A security analyst received an alert from the SIEM indicating numerous login attempts from users
outside their usual geographic zones, all of which were initiated through the web-based mail server. The
logs indicate all domain accounts experienced two login attempts during the same time frame.
Which of the following is the MOST likely cause of this issue?
A. A password-spraying attack was performed against the organization.
B. A DDoS attack was performed against the organization.
C. This was normal shift work activity; the SIEM’s AI is learning.
D. A credentialed external vulnerability scan was performed.
A: A password-spraying attack was performed against the organization.
For machine learning to be applied effectively toward security analysis automation, it requires. A. relevant training data. B. a threat feed API. C. a multicore, multiprocessor system. D. anomalous traffic signatures.
D. anomalous traffic signatures.
Which of the following BEST describes the primary role ol a risk assessment as it relates to
compliance with risk-based frameworks?
A. It demonstrates the organization’s mitigation of risks associated with internal threats.
B. It serves as the basis for control selection.
C. It prescribes technical control requirements.
D. It is an input to the business impact assessment.
A. It demonstrates the organization’s mitigation of risks associated with internal threats.
During an investigation, an incident responder intends to recover multiple pieces of digital media.
Before removing the media, the responder should initiate:
A. malware scans.
B. secure communications.
C. chain of custody forms.
D. decryption tools.
C. chain of custody forms.
Which of the following technologies can be used to house the entropy keys for task encryption on desktops and laptops? A. Self-encrypting drive B. Bus encryption C. TPM D. HSM
A. Self-encrypting drive
An organization wants to move non-essential services into a cloud computing environment.
Management has a cost focus and would like to achieve a recovery time objective of 12 hours.
Which of the following cloud recovery strategies would work BEST to attain the desired outcome?
A. Duplicate all services in another instance and load balance between the instances.
B. Establish a hot site with active replication to another region within the same cloud provider.
C. Set up a warm disaster recovery site with the same cloud provider in a different region
D. Configure the systems with a cold site at another cloud provider that can be used for failover.
C. Set up a warm disaster recovery site with the same cloud provider in a different region
A security architect is reviewing the options for performing input validation on incoming web form
submissions.
Which of the following should the architect as the MOST secure and manageable option?
A. Client-side whitelisting
B. Server-side whitelisting
C. Server-side blacklisting
D. Client-side blacklisting
Server-side whitelisting
An audit has revealed an organization is utilizing a large number of servers that are running
unsupported operating systems.
As part of the management response phase of the audit, which of the following would BEST demonstrate
senior management is appropriately aware of and addressing the issue?
A. Copies of prior audits that did not identify the servers as an issue
B. Project plans relating to the replacement of the servers that were approved by management
C. Minutes from meetings in which risk assessment activities addressing the servers were discussed
D. ACLs from perimeter firewalls showing blocked access to the
C. Minutes from meetings in which risk assessment activities addressing the servers were discussed
A security analyst wants to identify which vulnerabilities a potential attacker might initially exploit if the
network is compromised.
Which of the following would provide the BEST results?
A. Baseline configuration assessment
B. Uncredentialed scan
C. Network ping sweep
D. External penetration test
B. Uncredentialed scan
A security analyst has observed several incidents within an organization that are affecting one specific
piece of hardware on the network. Further investigation reveals the equipment vendor previously released
a patch.
Which of the following is the MOST appropriate threat classification for these incidents?
A. Known threat
B. Zero day
C. Unknown threat
D. Advanced persistent threat
C. Unknown threat
Which of the following software assessment methods would be BEST for gathering data related to an
application’s availability during peak times?
A. Security regression testing
B. Stress testing
C. Static analysis testing
D. Dynamic analysis testing
E. User acceptance testing
B. Stress testing
Bootloader malware was recently discovered on several company workstations. All the workstations
run Windows and are current models with UEFI capability.
Which of the following UEFI settings is the MOST likely cause of the infections?
A. Compatibility mode
B. Secure boot mode
C. Native mode
D. Fast boot mode
Compatibility mode
Which of the following policies would state an employee should not disable security safeguards, such
as host firewalls and antivirus on company systems?
A. Code of conduct policy
B. Account management policy
C. Password policy
D. Acceptable use policy
Acceptable use policy
Because some clients have reported unauthorized activity on their accounts, a security analyst is
reviewing network packet captures from the company’s API server.
A portion of a capture file is shown below:
POST /services/v1_0/Public/Members.svc/soap
192.168.1.22 - - api.somesite.com 200 0 1006 1001 0 192.168.1.22
POST /services/v1_0/Public/Members.svc/soap - can’t input code into brainscape-
Which of the following MOST likely explains how the clients’ accounts were compromised?
The clients’ authentication tokens were impersonated and replayed.
A Chief Information Security Officer (CISO) is concerned the development team, which consists of
contractors, has too much access to customer datA. Developers use personal workstations, giving the
company little to no visibility into the development activities.
Which of the following would be BEST to implement to alleviate the CISO’s concern?
A. DLP
B. Encryption
C. Test data
D. NDA
D: NDA (non disclosure agreement)
As part of an organization’s information security governance process, a Chief Information Security
Officer (CISO) is working with the compliance officer to update policies to include statements related to
new regulatory and legal requirements.
Which of the following should be done to BEST ensure all employees are appropriately aware of changes
to the policies?
A. Conduct a risk assessment based on the controls defined in the newly revised policies
B. Require all employees to attend updated security awareness training and sign an acknowledgement
C. Post the policies on the organization’s intranet and provide copies of any revised
policies to all active
vendors
D. Distribute revised copies of policies to employees and obtain a signed acknowledgement from them
B. Require all employees to attend updated security awareness training and sign an acknowledgement
A security analyst implemented a solution that would analyze the attacks that the organization’s
firewalls failed to prevent. The analyst used the existing systems to enact the solution and executed the
following command.
S sudo nc -1 -v -c maildemon . py 25 caplog, txt
Which of the following solutions did the analyst implement?
A. Log collector
B. Crontab mail script
C. Snikhole
D. Honeypot
A. Log collector
An organization that handles sensitive financial information wants to perform tokenization of data to
enable the execution of recurring transactions. The organization is most interested m a secure, built-in
device to support its solution.
Which of the following would MOST likely be required to perform the desired function?
A. TPM
B. eFuse
C. FPGA
D. HSM
E. UEFI
D: HSM
