Quiz A Flashcards
During a trial, a judge determined evidence gathered from a hard drive was not admissible. Which of the following BEST explains this reasoning?
The forensic investigator forgot to run a checksum on the disk image after creation
Which of the following would most likely be identified by a credentialed scan but would be missed by an uncredentialed scan?
Missing patches for 3rd party software on Windows workstations and servers
An organization is concerned about intellectual property theft by employees who leave the organization. Which of the following should the organization most likely implement?
NDA
After generating a security report for management, it was recommended to disable all listening unencrypted services.
Given this output from Nmap
PORT STATE
21/tcp filtered
22/tcp open
23/tcp open
443/tcp open
Which of the following should the analyst recommend disabling?
23/tcp
A network manager is concerned that business may be negatively impacted if the firewall in its datacenter goes offline. The manager would like to implement a high availability pair to:
remove the single-point of failure
After multiple on premises security solutions were migrated to the cloud, the incident response time increased. The analysts are spending a long time trying to trace information on different cloud consoles and correlating data in different formats. Which of the following can be used to optimize the incident response time?
CASB
A security monitoring company offers a service that alerts its customers if their credit cards have been stolen. Which of the following is the MOST likely source of this info?
The dark web
An organization wants seamless authentication to its applications. Which of the following should the organization employ to meet this requirement?
SSO
A tech enables FDE on a laptop that will be taken on a business trip. WHich of the following does this process BEST protect?
Data at rest
A security admin needs to create a RAID configuration that is focused on high read/write speeds and fault tolerance. Its unlikely that multiple drives will fail simultaneously. Which of the following RAID configurations should the admin use?
RAID 5
An organization’s CISO is creating a position that will be responsible for implementing technical controls to protect data, including ensuring backups are properly maintained. Which of the following roles would MOST likely include these responsibilities?
Data custodian
A security analyst generated a file named host1.pcap and shared it with a team member who is going to use it for further incident analysis. Which of the following tools will the other team member MOST likely use to open this file?
Wireshark
Given the following command outputs: EXHIBIT A:
c:\Users\User1>ipconfig /all
Ethernet Adapter Ether
IPv4 Address 10.0.10.125 Subnet Mask 255.255.255.0 Default Gateway 10.0.10.1 DNS Servers 10.0.10.1
EXHIBIT B:
c:\Users\User1> ping wikipedia.org
Pinging wikipedia.org [10.0.10.150] with 32 bytes of data: Reply from 10.0.10.150: bytes=32 time<1ms TTL=64
EXHIBIT C:
c\Users\User1> nslookup wikipedia.org
Server: JohnsLaptop Address: 10.0.10.150
Non-Authoritative answer: Name: wikipedia.org Address: 10.0.10.150
c:\Users\User1> nslookup wikipedia.org 8.8.8.8 Server: dns.google
Address: 8.8.8.8
Non-Authoritative answer: Name: wikipedia.org Address: 208.80.154.224
Which of the following attacks does this output show?
/etc/hosts poisoning
Which of the following holds staff accountable for visitors while escorting them?
Cameras
Security analysts are conducting an investigation of an attack that occurred inside the orgs network. An attacker was able to collect network traffic between workstations throughout the network. The analysts review the following logs:
VLAN ADDRESS —————- 1 0007.1e5d.3213
1 002a.7d.44.8801
1 0011.aab4.344d
The layer 2 address table has hundreds of entries similar to the ones shown above. Which of the following attacks has occurred?
MAC flooding
