Part 3 Flashcards
An analyst has been asked to provide feedback regarding the control required by a revised regulatory
framework. At this time, the analyst only needs to focus on the technical controls.
Which of the following should the analyst provide an assessment of?
A. Tokenization of sensitive data
B. Establishment o’ data classifications
C. Reporting on data retention and purging activities
D. Formal identification of
Tokenization of sensitive data
An analyst is participating in the solution analysis process for a cloud-hosted SIEM platform to centralize log monitoring and alerting capabilities in the SOC.
Which of the following is the BEST approach for supply chain assessment when selecting a vendor?
A. Gather information from providers, including datacenter specifications and copies of audit reports.
B. Identify SLA requirements for monitoring and logging.
C. Consult with senior management for recommendations.
D. Perform a proof of concept to identify possible solutions.
Identify SLA requirements for monitoring and logging.
Which of the following would MOST likely be included in the incident response procedure after a security breach of customer PII? A. Human resources B. Public relations C. Marketing D. Internal network operations center
B. Public relations
The Cruel Executive Officer (CEO) of a large insurance company has reported phishing emails that
contain malicious links are targeting the entire organza lion.
Which of the following actions would work BEST to prevent against this type of attack?
A. Turn on full behavioral analysis to avert an infection
B. Implement an EOR mail module that will rewrite and analyze email links.
C. Reconfigure the EDR solution to perform real-time scanning of all files
D. Ensure EDR signatures are updated every day to avert infection.
E. Modify the EDR solution to use heuristic analysis techniques for malware.
B. Implement an EOR mail module that will rewrite and analyze email links.
A cybersecurity analyst is reading a daily intelligence digest of new vulnerabilities. The type of
vulnerability that should be disseminated FIRST is one that:
A. enables remote code execution that is being exploited in the wild.
B. enables data leakage but is not known to be in the environment
C. enables lateral movement and was reported as a proof of concept
D. affected the organization in the past but was probably contained and eradicated
A. enables remote code execution that is being exploited in the wild.
A cybersecurity analyst is supposing an incident response effort via threat intelligence.
Which of the following is the analyst MOST likely executing?
A. Requirements analysis and collection planning
B. Containment and eradication
C. Recovery and post-incident review
D. Indicator enrichment and research pivoting
A. Requirements analysis and collection planning
In system hardening, which of the following types of vulnerability scans would work BEST to verify the scanned device meets security policies? A. SCAP B. Burp Suite C. OWASP ZAP D. Unauthenticated
D. Unauthenticated
Which of the following sets of attributes BEST illustrates the characteristics of an insider threat from a security perspective? A. Unauthorized, unintentional, benign B. Unauthorized, intentional, malicious C. Authorized, intentional, malicious D. Authorized, unintentional, benign
C. Authorized, intentional, malicious
Which of the following BEST describes the process by which code is developed, tested, and deployed in small batches? A. Agile B. Waterfall C. SDLC D. Dynamic code analysis
C. SDLC
Employees of a large financial company are continuously being Infected by strands of malware that are not detected by EDR tools.
When of the following Is the BEST security control to implement to reduce corporate risk while allowing
employees to exchange files at client sites?
A. MFA on the workstations
B. Additional host firewall rules
C. VDI environment
D. Hard drive encryption
E. Network access control
F. Network segmentation
C. VDI environment
The inability to do remote updates of certificates, keys, software, and firmware is a security issue commonly associated with: A. web servers on private networks B. HVAC control systems C. smartphones D. firewalls and UTM devices
D. firewalls and UTM devices
An analyst identifies multiple instances of node-to-node communication between several endpoints
within the 10.200.2.0/24 network and a user machine at the IP address 10.200.2.5. This user machine at
the IP address 10.200.2.5 is also identified as initiating outbound communication during atypical business
hours with several IP addresses that have recently appeared on threat feeds.
Which of the following can be inferred from this activity?
A. 10.200.2.0/24 is infected with ransomware.
B. 10.200.2.0/24 is not routable address space.
C. 10.200.2.5 is a rogue endpoint.
D. 10.200.2.5 is exfiltrating datA.
D. 10.200.2.5 is exfiltrating datA.
Which of the following would a security engineer recommend to BEST protect sensitive system data from being accessed on mobile devices? A. Use a UEFl boot password. B. Implement a self-encrypted disk. C. Configure filesystem encryption D. Enable Secure Boot using TPM
C. Configure filesystem encryption
A security analyst has discovered suspicious traffic and determined a host is connecting to a known
malicious website. The MOST appropriate action for the analyst to take would be lo implement a change
request to:
A. update the antivirus software
B. configure the firewall to block traffic to the domain
C. add the domain to the blacklist
D. create an IPS signature for the domain
B. configure the firewall to block traffic to the domain
A security analyst is responding to an incident on a web server on the company network that is
making a large number of outbound requests over DNS.
Which of the following is the FIRST step the analyst should take to evaluate this potential indicator of
compromise’?
A. Run an anti-malware scan on the system to detect and eradicate the current threat
B. Start a network capture on the system to look into the DNS requests to validate command and control
traffic.
C. Shut down the system to prevent further degradation of the company network
D. Reimage the machine to remove the threat completely and get back to a normal running state.
E. Isolate the system on the network to ensure it cannot access other systems while evaluation is
underway.
E. Isolate the system on the network to ensure it cannot access other systems while evaluation is
underway.
A human resources employee sends out a mass email to all employees that contains their personnel
records. A security analyst is called in to address the concern of the human resources director on how to
prevent this from happening in the future.
Which of the following would be the BEST solution to recommend to the director?
A. Install a data loss prevention system, and train human resources employees on its use.
Provide PII training to all employees at the company. Encrypt PII information.
B. Enforce encryption on all emails sent within the company. Create a PII program and policy on how to
handle datA. Train all human resources employees.
C. Train all employees. Encrypt data sent on the company network. Bring in privacy personnel to present
a plan on how PII should be handled.
D. Install specific equipment to create a human resources policy that protects PII datA. Train company
employees on how to handle PII datA. Outsource all PII to another company. Send the human resources
director to training for PII handling.
A. Install a data loss prevention system, and train human resources employees on its use.
Provide PII training to all employees at the company. Encrypt PII information.
An information security analyst is reviewing backup data sets as part of a project focused on
eliminating archival data sets.
Which of the following should be considered FIRST prior to disposing of the electronic data?
A. Sanitization policy
B. Data sovereignty
C. Encryption policy
D. Retention standards
A. Sanitization policy
A critical server was compromised by malware, and all functionality was lost. Backups of this server
were taken; however, management believes a logic bomb may have been injected by a rootkit.
Which of the following should a security analyst perform to restore functionality quickly?
A. Work backward, restoring each backup until the server is clean
B. Restore the previous backup and scan with a live boot anti-malware scanner
C. Stand up a new server and restore critical data from backups
D. Offload the critical data to a new server and continue operations
C. Stand up a new server and restore critical data from backups
146.An analyst is searching a log for potential credit card leaks. The log stores all data encoded in
hexadecimal.
Which of the following commands will allow the security analyst to confirm the incident?
A. cat log xxd -r -p | egrep ‘ [0-9] {16}
B. egrep ‘(3(0-9)) (16) ‘ log
C. cat log | xxd -r -p egrep ‘(0-9) (16)’
D. egrep ‘(0-9) (16) ‘ log | xxdc
C. cat log | xxd -r -p egrep ‘(0-9) (16)’
Which of the following are components of the intelligence cycle? (Select TWO.) A. Collection B. Normalization C. Response D. Analysis E. Correction F. Dissension
A. Collection
D. Analysis
