Sec+ Flashcards
A security analyst needs to find real time data on the latest malware and IoCs. Which of the following best describes the solution the analyst should pursue?
Threat feeds
The security analyst is investigating a phishing email that contains a malicious document directed to the company’s CEO. Which of the following should the analyst perform to understand the threat and retrieve possible IoCs?
Install a sandbox to run the malicious payload in a safe envrionment
A cybersecurity administrator needs to harden a server after installing Windows. Which of the following best practices should the administrator do to achieve his goal? (Select TWO)
Disabling NetBIOS over TCP/IP
Disabling guest accounts
Which of the following corporate policies is used to help prevent employee fraud and to detect system log modifications or other malicious activity based on tenure?
Mandatory vacation
After scamming a user’s credentials, the red team was able to craft a payload to deploy on a server. The attack allowed the installation of malicious software that initiates a new remote session. Which type of attack has occurred?
Privilege escalation
A company just implemented a new telework policy that allows employees to use personal devices for official email and file sharing while working from home. Some of the requirements are:
Employees must provide an alternate work location
Employees must install software on the device that will prevent the loss of proprietary data but willnot restrict any other software from being installed.
Which of the following BEST describes the MDM options the company is using?
Remote wipe, geolocation, screen locks, storage segmentation, and full-device encryption
A new PnP storage device was installed on a PC in the corporate environment. Which of the following safeguards will BEST defend the PC from malicious files on the storage device?
Change the default setting on the PC
A user has concerns that a web app will not handle unexpected or random inputs without crashing. Which of the following types of testing should the user perform?
Fuzzing
A security admin is analyzing the corporate wireless network. The network only has two access points running on channels 1 and 11. While using airdump-ng, the admin notices other access points are running with the same corporate ESSID on all available channels and with the same BSSID of one of the legitimate APs. What attack is being performed on the corporate network?
Evil Twin
A network administrator is concerned about users being exposed to malicious content when accessing the company cloud applications. The administrator wants to be able to block access to sites based on the AUP. The users must also be protected because many of them work from home or at remote locations, providing on-site customer support. Which of the following should the administrator employ to meet these criteria?
SWG
Following a prolonged datacenter outage that affected web based sales, a company has decided to move its operations to a private cloud solution. The security team has received the following requirements:
Must be visibility into how teams are using CBS
The company must be able to identify when data related to payment cards is being sent to the cloud.
Data must be available regardless of the end user’s geographical location
Admin need a single pane of glass view into traffic and trends
Which of the following should the security analyst recommend?
Implement a CASB solution
An anlyst notices several attacks are being blocked by the NIPS but does not see anything on the boundary FW logs. The attack seems to have stopped. Which of the following resiliency techniques was applied to the network to prevent this attack?
Defense in depth
A government agency just acquired a new web application. The app must be assessed and authorized before being deployed. Which of the following is required to assess the vulnerabilities resident in the application?
Common vulnerability and exposures
An organization with a large number of mobile devices is exploring enhanced security controls to manage unauthorized access if a device is lost or stolen. Specifically, if mobile devices from more than 3 miles from the building, the management team would like to have the security team alerted and server resources restricted on those devices. Which of the following controls should the organization implement?
Geofencing
A small business office is setting up a wireless infrastructure with primary requirements centered on protecting customer information and preventing unauthorized access to the business network. Which of the following would BEST support the office’s business needs? (Select TWO)
Configuring access using WPA3-Enterprise
Enabling 802.1X
A security administrator needs to inspect in-transit files to the enterprise network to search for PII, cc data, and classification words. Which of the following would be the BEST to use?
Network DLP
A security analyst has been reading about a new cyberattack from a know threat actor. Which of the following would BEST support the analyst’s review of the tactics, techniques, and protocols the threat actor was observed using in previous campaigns?
MITRE ATT&CK framework
Which of the following is the most secure but LEAST expensive data destruction method for data that is stored on hard drives?
Degaussing
Which of the following is the correct order of volatility from most to least likely volatile?
Cache, memory, temp filesystems, disk, archival media
The security engineer installs a WAF to protect the company’s website from malicious web requests over SSL. Which of the following is needed to meet the objective?
Reverse proxy
