Security+ 701 Flashcards
Which of the following threat actors is the most likely to be hired by a foreign government to attack
critical systems located in other countries?
A. Hacktivist
B. Whistleblower
C. Organized crime
D. Unskilled attacker
Answer: C
Explanation:
Organized crime is a type of threat actor that is motivated by financial gain and often operates across
national borders. Organized crime groups may be hired by foreign governments to conduct
cyberattacks on critical systems located in other countries, such as power grids, military networks, or
financial institutions. Organized crime groups have the resources, skills, and connections to carry out
sophisticated and persistent attacks that can cause significant damage and
disruption12. Reference = 1: Threat Actors - CompTIA Security+ SY0-701 - 2.1 2:
Which of the following is used to add extra complexity before using a one-way data transformation
algorithm?
A. Key stretching
B. Data masking
C. Steganography
D. Salting
Answer: D
Explanation:
Salting is the process of adding extra random data to a password or other data before applying a one-
way data transformation algorithm, such as a hash function. Salting increases the complexity and
randomness of the input data, making it harder for attackers to guess or crack the original data using
precomputed tables or brute force methods. Salting also helps prevent identical passwords from
producing identical hash values, which could reveal the passwords to attackers who have access to
the hashed data. Salting is commonly used to protect passwords stored in databases or transmitted
over networks. Reference =
Passwords technical overview
Encryption, hashing, salting – what’s the difference?
Salt (cryptography)
An employee clicked a link in an email from a payment website that asked the employee to update
contact information. The employee entered the log-in information but received a “page not found”
error message. Which of the following types of social engineering attacks occurred?
A. Brand impersonation
B. Pretexting
C. Typosquatting
D. Phishin
Answer: D
Explanation:
Phishing is a type of social engineering attack that involves sending fraudulent emails that appear to
be from legitimate sources, such as payment websites, banks, or other trusted entities. The goal of
phishing is to trick the recipients into clicking on malicious links, opening malicious attachments, or
providing sensitive information, such as log-in credentials, personal data, or financial details. In this
scenario, the employee received an email from a payment website that asked the employee to
update contact information. The email contained a link that directed the employee to a fake website
that mimicked the appearance of the real one. The employee entered the log-in information, but
received a “page not found” error message. This indicates that the employee fell victim to a phishing
attack, and the attacker may have captured the employee’s credentials for the payment
website. Reference = Other Social Engineering Attacks – CompTIA Security+ SY0-701 – 2.2, CompTIA
Security+: Social Engineering Techniques & Other Attack … - NICCS, [CompTIA Sec
An enterprise is trying to limit outbound DNS traffic originating from its internal network. Outbound
DNS requests will only be allowed from one device with the IP address 10.50.10.25. Which of the
following firewall ACLs will accomplish this goal?
A. Access list outbound permit 0.0.0.0 0 0.0.0.0/0 port 53 Access list outbound deny 10.50.10.25 32
0.0.0.0/0 port 53
B. Access list outbound permit 0.0.0.0/0 10.50.10.25 32 port 53 Access list outbound deny 0.0.0.0 0
0.0.0.0/0 port 53
C. Access list outbound permit 0.0.0.0 0 0.0.0.0/0 port 53 Access list outbound deny 0.0.0.0/0
10.50.10.25 32 port 53
D. Access list outbound permit 10.50.10.25 32 0.0.0.0/0 port 53 Access list outbound deny
0.0.0.0.0.0.0.0.0/0 port 53
The correct answer is D because it allows only the device with the IP address 10.50.10.25 to send
outbound DNS requests on port 53, and denies all other devices from doing so. The other options are
incorrect because they either allow all devices to send outbound DNS requests (A and C), or they
allow no devices to send outbound DNS requests (B). Reference = You can learn more about firewall
ACLs and DNS in the following resources:
CompTIA Security+ SY0-701 Certification Study Guide, Chapter 4: Network Security1
Professor Messer’s CompTIA SY0-701 Security+ Training Course, Section 3.2: Firewall Rules2
TOTAL: CompTIA Security+ Cert (SY0-701) | Udemy, Section 6: Network Security, Lecture 28: Firewall
Rules3
A data administrator is configuring authentication for a SaaS application and would like to reduce the
number of credentials employees need to maintain. The company prefers to use domain credentials
to access new SaaS applications. Which of the following methods would allow this functionality?
A. SSO
B. LEAP
C. MFA
D. PEAP
Answer: A
Questions and Answers PDF 5/297
Explanation:
SSO stands for single sign-on, which is a method of authentication that allows users to access
multiple applications or services with one set of credentials. SSO reduces the number of credentials
employees need to maintain and simplifies the login process. SSO can also improve security by
reducing the risk of password reuse, phishing, and credential theft. SSO can be implemented using
various protocols, such as SAML, OAuth, OpenID Connect, and Kerberos, that enable the exchange of
authentication information between different domains or systems. SSO is commonly used for
accessing SaaS applications, such as Office 365, Google Workspace, Salesforce, and others, using
domain credentials123.
LEAP
Lightweight Extensible Authentication Protocol, which is a Cisco proprietary
protocol that provides authentication for wireless networks. LEAP is not related to SaaS applications
or domain credentials4.
MFA
multi-factor authentication, which is a method of authentication that requires
users to provide two or more pieces of evidence to prove their identity. MFA can enhance security by
adding an extra layer of protection beyond passwords, such as tokens, biometrics, or codes. MFA is
not related to SaaS applications or domain credentials, but it can be used in conjunction with SSO.
PEAP
Protected Extensible Authentication Protocol, which is a protocol that provides
secure authentication for wireless networks. PEAP uses TLS to create an encrypted tunnel between
the client and the server, and then uses another authentication method, such as MS-CHAPv2 or EAP-
GTC, to verify the user’s identity. PEAP is not related to SaaS applications or domain credentials.
Which of the following scenarios describes a possible business email compromise attack?
A. An employee receives a gift card request in an email that has an executive’s name in the display
field of the email.
B. Employees who open an email attachment receive messages demanding payment in order to
access files.
C. A service desk employee receives an email from the HR director asking for log-in credentials to a
cloud administrator account.
D. An employee receives an email with a link to a phishing site that is designed to look like the
company’s email portal.
Answer: A
A business email compromise (BEC) attack is a type of phishing attack that targets employees who
have access to company funds or sensitive information. The attacker impersonates a trusted person,
such as an executive, a vendor, or a client, and requests a fraudulent payment, a wire transfer, or
confidential data. The attacker often uses social engineering techniques, such as urgency, pressure,
or familiarity, to convince the victim to comply with the request12
A company prevented direct access from the database administrators’ workstations to the network
segment that contains database servers. Which of the following should a database administrator use
to access the database servers?
A. Jump server
B. RADIUS
C. HSM
D. Load balancer
Answer: A
Explanation:
A jump server is a device or virtual machine that acts as an intermediary between a user’s
workstation and a remote network segment. A jump server can be used to securely access servers or
devices that are not directly reachable from the user’s workstation, such as database servers. A jump
server can also provide audit logs and access control for the remote connections. A jump server is
also known as a jump box or a jump host12
RADIUS
protocol for authentication, authorization, and accounting of network access. RADIUS is
not a device or a method to access remote servers, but rather a way to verify the identity and
permissions of users or devices that request network access34.
HSM
acronym for Hardware Security Module, which is a physical device that provides secure
storage and generation of cryptographic keys. HSMs are used to protect sensitive data and
applications, such as digital signatures, encryption, and authentication. HSMs are not used to access
remote servers, but rather to enhance the security of the data and applications that reside on
them5
load balancer
device or software that distributes network traffic across multiple servers or
devices, based on criteria such as availability, performance, or capacity. A load balancer can improve
the scalability, reliability, and efficiency of network services, such as web servers, application servers,
or database servers. A load balancer is not used to access remote servers, but rather to optimize the
delivery of the services that run on them
An organization’s internet-facing website was compromised when an attacker exploited a buffer
overflow. Which of the following should the organization deploy to best protect against similar
attacks in the future?
A. NGFW
B. WAF
C. TLS
D. SD-WAN
Answer: B
Explanation:
A buffer overflow is a type of software vulnerability that occurs when an application writes more
data to a memory buffer than it can hold, causing the excess data to overwrite adjacent memory
locations. This can lead to unexpected behavior, such as crashes, errors, or code execution. A buffer
overflow can be exploited by an attacker to inject malicious code or commands into the application,
which can compromise the security and functionality of the system. An organization’s internet-facing
website was compromised when an attacker exploited a buffer overflow. To best protect against
similar attacks in the future, the organization should deploy a web application firewall (WAF). A WAF
is a type of firewall that monitors and filters the traffic between a web application and the internet. A
WAF can detect and block common web attacks, such as buffer overflows, SQL injections, cross-site
scripting (XSS), and more. A WAF can also enforce security policies and rules, such as input
validation, output encoding, and encryption. A WAF can provide a layer of protection for the web
application, preventing attackers from exploiting its vulnerabilities and compromising its
data. Reference = Buffer Overflows – CompTIA Security+ SY0-701 – 2.3, Web Application Firewalls –
CompTIA Security+ SY0-701 – 2.4,
An administrator notices that several users are logging in from suspicious IP addresses. After
speaking with the users, the administrator determines that the employees were not logging in from
those IP addresses and resets the affected users’ passwords. Which of the following should the
administrator implement to prevent this type of attack from succeeding in the future?
A. Multifactor authentication
B. Permissions assignment
C. Access management
D. Password complexity
Answer: A
Explanation:
The correct answer is A because multifactor authentication (MFA) is a method of verifying a user’s
identity by requiring more than one factor, such as something the user knows (e.g., password),
something the user has (e.g., token), or something the user is (e.g., biometric). MFA can prevent
unauthorized access even if the user’s password is compromised, as the attacker would need to
provide another factor to log in. The other options are incorrect because they do not address the root
cause of the attack, which is weak authentication. Permissions assignment (B) is the process of
granting or denying access to resources based on the user’s role or identity. Access management © is
the process of controlling who can access what and under what conditions. Password complexity (D)
is the requirement of using strong passwords that are hard to guess or crack, but it does not prevent
an attacker from using a stolen password.
An employee receives a text message that appears to have been sent by the payroll department and
is asking for credential verification. Which of the following social engineering techniques are being
attempted? (Choose two.)
A. Typosquatting
B. Phishing
C. Impersonation
D. Vishing
E. Smishing
F. Misinformation
Answer: B E
Explanation:
Smishing is a type of social engineering technique that uses text messages (SMS) to trick victims into
revealing sensitive information, clicking malicious links, or downloading malware. Smishing
messages often appear to come from legitimate sources, such as banks, government agencies, or
service providers, and use urgent or threatening language to persuade the recipients to take
action12. In this scenario, the text message that claims to be from the payroll department is an
example of smishing.
Impersonation is a type of social engineering technique that involves pretending to be someone else,
such as an authority figure, a trusted person, or a colleague, to gain the trust or cooperation of the
target. Impersonation can be done through various channels, such as phone calls, emails, text
messages, or in-person visits, and can be used to obtain information, access, or money from the
victim34. In this scenario, the text message that pretends to be from the payroll department is an
example of impersonation.
Typosquatting
type of cyberattack that involves registering domain names that are similar to
popular or well-known websites, but with intentional spelling errors or different extensions. Typosquatting aims to exploit the common mistakes that users make when typing web
addresses, and redirect them to malicious or fraudulent sites that may steal their information, install
malware, or display ads56. Typosquatting is not related to text messages or credential verification
Misinformation
type of social engineering technique that involves spreading false or
misleading information to influence the beliefs, opinions, or actions of the target. Misinformation
can be used to manipulate public perception, create confusion, damage reputation, or promote an
agenda . Misinformation is not related to text messages or credential verification.
Several employees received a fraudulent text message from someone claiming to be the Chief
Executive Officer (CEO). The message stated:
“I’m in an airport right now with no access to email. I need you to buy gift cards for employee
recognition awards. Please send the gift cards to following email address.”
Which of the following are the best responses to this situation? (Choose two).
A. Cancel current employee recognition gift cards.
B. Add a smishing exercise to the annual company training.
C. Issue a general email warning to the company.
D. Have the CEO change phone numbers.
E. Conduct a forensic investigation on the CEO’s phone.
F. Implement mobile device management
Answer: B, C
Explanation:
This situation is an example of smishing, which is a type of phishing that uses text messages (SMS) to
entice individuals into providing personal or sensitive information to cybercriminals. The best
responses to this situation are to add a smishing exercise to the annual company training and to issue
a general email warning to the company. A smishing exercise can help raise awareness and educate
employees on how to recognize and avoid smishing attacks. An email warning can alert employees to
the fraudulent text message and remind them to verify the identity and legitimacy of any requests
for information or money.
A company is required to use certified hardware when building networks. Which of the following
best addresses the risks associated with procuring counterfeit hardware?
A. A thorough analysis of the supply chain
B. A legally enforceable corporate acquisition policy
C. A right to audit clause in vendor contracts and SOWs
D. An in-depth penetration test of all suppliers and vendors
Answer: A
Explanation:
Questions and Answers PDF 13/297
Counterfeit hardware is hardware that is built or modified without the authorization of the original
equipment manufacturer (OEM). It can pose serious risks to network quality, performance, safety,
and reliability12. Counterfeit hardware can also contain malicious components that can compromise
the security of the network and the data that flows through it3. To address the risks associated with
procuring counterfeit hardware, a company should conduct a thorough analysis of the supply chain,
which is the network of entities involved in the production, distribution, and delivery of the
hardware. By analyzing the supply chain, the company can verify the origin, authenticity, and
integrity of the hardware, and identify any potential sources of counterfeit or tampered products. A
thorough analysis of the supply chain can include the following steps:
Establishing a trusted relationship with the OEM and authorized resellers
Requesting documentation and certification of the hardware from the OEM or authorized resellers
Inspecting the hardware for any signs of tampering, such as mismatched labels, serial numbers, or
components
Testing the hardware for functionality, performance, and security
Implementing a tracking system to monitor the hardware throughout its lifecycle
Which of the following provides the details about the terms of a test with a third-party penetration
tester?
A. Rules of engagement
B. Supply chain analysis
C. Right to audit clause
D. Due diligence
Rules of engagement are the detailed guidelines and constraints regarding the execution of
information security testing, such as penetration testing. They define the scope, objectives, methods,
and boundaries of the test, as well as the roles and responsibilities of the testers and the clients.
Rules of engagement help to ensure that the test is conducted in a legal, ethical, and professional
manner, and that the results are accurate and reliable. Rules of engagement typically include the
following elements:
The type and scope of the test, such as black box, white box, or gray box, and the target systems,
networks, applications, or data.
The client contact details and the communication channels for reporting issues, incidents, or
emergencies during the test.
The testing team credentials and the authorized tools and techniques that they can use.
The sensitive data handling and encryption requirements, such as how to store, transmit, or dispose
of any data obtained during the test.
The status meeting and report schedules, formats, and recipients, as well as the confidentiality and
non-disclosure agreements for the test results.
The timeline and duration of the test, and the hours of operation and testing windows.
The professional and ethical behavior expectations for the testers, such as avoiding unnecessary
damage, disruption, or disclosure of information
Supply chain analysis
Supply chain analysis is the process of evaluating the security
and risk posture of the suppliers and partners in a business network.
Right to audit clause
provision in a contract that gives one party the right to audit another party to verify their compliance
with the contract terms and conditions.
Due diligence
process of identifying and addressing the
cyber risks that a potential vendor or partner brings to an organization.
A penetration tester begins an engagement by performing port and service scans against the client
environment according to the rules of engagement. Which of the following reconnaissance types is
the tester performing?
A. Active
B. Passive
C. Defensive
D. Offensive
Answer: A
Explanation:
Active reconnaissance is a type of reconnaissance that involves sending packets or requests to a
target and analyzing the responses. Active reconnaissance can reveal information such as open ports,
services, operating systems, and vulnerabilities. However, active reconnaissance is also more likely to
be detected by the target or its security devices, such as firewalls or intrusion detection systems. Port
and service scans are examples of active reconnaissance techniques, as they involve probing the
target for specific information.
Which of the following is required for an organization to properly manage its restore process in the
event of system failure?
A. IRP
B. DRP
C. RPO
D. SDLC
Answer: B
Explanation:
A disaster recovery plan (DRP) is a set of policies and procedures that aim to restore the normal
operations of an organization in the event of a system failure, natural disaster, or other emergency. A
DRP typically includes the following elements:
A risk assessment that identifies the potential threats and impacts to the organization’s critical assets
and processes.
A business impact analysis that prioritizes the recovery of the most essential functions and data.
A recovery strategy that defines the roles and responsibilities of the recovery team, the resources
and tools needed, and the steps to follow to restore the system.
A testing and maintenance plan that ensures the DRP is updated and validated regularly. A DRP is
required for an organization to properly manage its restore process in the event of system failure, as
it provides a clear and structured framework for recovering from a disaster and minimizing the
downtime and data loss.
DRP
disaster recovery plan (DRP) is a set of policies and procedures that aim to restore the normal
operations of an organization in the event of a system failure, natural disaster, or other emergency.
Which of the following vulnerabilities is associated with installing software outside of a
manufacturer’s approved software repository?
A. Jailbreaking
B. Memory injection
C. Resource reuse
D. Side loading
Answer: D
Explanation:
Side loading is the process of installing software outside of a manufacturer’s approved software
repository. This can expose the device to potential vulnerabilities, such as malware, spyware, or
unauthorized access. Side loading can also bypass security controls and policies that are enforced by
the manufacturer or the organization. Side loading is often done by users who want to access
applications or features that are not available or allowed on their devices.
A security analyst is reviewing the following logs:
Which of the following attacks is most likely occurring?
A. Password spraying
B. Account forgery
C. Pass-t he-hash
D. Brute-force
Answer: A
Explanation:
Password spraying is a type of brute force attack that tries common passwords across several
Questions and Answers PDF 18/297
accounts to find a match. It is a mass trial-and-error approach that can bypass account lockout
protocols. It can give hackers access to personal or business accounts and information. It is not a
targeted attack, but a high-volume attack tactic that uses a dictionary or a list of popular or weak
passwords12.
The logs show that the attacker is using the same password (“password123”) to attempt to log in to
different accounts (“admin”, “user1”, “user2”, etc.) on the same web server. This is a typical pattern
of password spraying, as the attacker is hoping that at least one of the accounts has a weak password
that matches the one they are trying.
Pass-the-hash
involves stealing a hashed user credential and
using it to create a new authenticated session on the same network. Pass-the-hash does not require
the attacker to know or crack the password, as they use the stored version of the password to initiate
a new session4.
An analyst is evaluating the implementation of Zero Trust principles within the data plane. Which of
the following would be most relevant for the analyst to evaluate?
A. Secured zones
B. Subject role
C. Adaptive identity
D. Threat scope reduction
Answer: D
Explanation:
The data plane, also known as the forwarding plane, is the part of the network that carries user
traffic and data. It is responsible for moving packets from one device to another based on the routing
and switching decisions made by the control plane. The data plane is a critical component of the Zero
Trust architecture, as it is where most of the attacks and breaches occur. Therefore, implementing
Zero Trust principles within the data plane can help to improve the security and resilience of the
network.
One of the key principles of Zero Trust is to assume breach and minimize the blast radius and
segment access. This means that the network should be divided into smaller and isolated segments
or zones, each with its own security policies and controls. This way, if one segment is compromised,
the attacker cannot easily move laterally to other segments and access more resources or data. This
principle is also known as threat scope reduction, as it reduces the scope and impact of a potential
threat.
Secured zones
concept related to the control plane, which is the part of the network that makes routing and
switching decisions.
Subject role
concept related to the identity plane, which is the part of the
network that authenticates and authorizes users and devices
Adaptive identity
concept related
to the policy plane, which is the part of the network that defines and enforces the security policies
and rules.
An engineer needs to find a solution that creates an added layer of security by preventing
unauthorized access to internal company resources. Which of the following would be the best
solution?
A. RDP server
B. Jump server
C. Proxy server
D. Hypervisor
Answer: B
Explanation:
= A jump server is a server that acts as an intermediary between a user and a target system. A jump
server can provide an added layer of security by preventing unauthorized access to internal company
resources. A user can connect to the jump server using a secure protocol, such as SSH, and then
access the target system from the jump server. This way, the target system is isolated from the
external network and only accessible through the jump server. A jump server can also enforce
security policies, such as authentication, authorization, logging, and auditing, on the user’s
connection. A jump server is also known as a bastion host or a jump box.
A company’s web filter is configured to scan the URL for strings and deny access when matches are
found. Which of the following search strings should an analyst employ to prohibit access to non-
encrypted websites?
A. encryption=off\
B. http://
C. www.*.com
D. :443
Answer: B
Explanation:
A web filter is a device or software that can monitor, block, or allow web traffic based on predefined
rules or policies. One of the common methods of web filtering is to scan the URL for strings and deny
access when matches are found. For example, a web filter can block access to websites that contain
the words “gambling”, “porn”, or “malware” in their URLs. A URL is a uniform resource locator that
identifies the location and protocol of a web resource. A URL typically consists of the following
components: protocol://domain:port/path?query#fragment. The protocol specifies the
communication method used to access the web resource, such as HTTP, HTTPS, FTP, or SMTP. The
domain is the name of the web server that hosts the web resource, such as www.google.com or
www.bing.com. The port is an optional number that identifies the specific service or application
running on the web server, such as 80 for HTTP or 443 for HTTPS. The path is the specific folder or file
name of the web resource, such as /index.html or /images/logo.png. The query is an optional string
that contains additional information or parameters for the web resource, such as ?q=security or
?lang=en. The fragment is an optional string that identifies a specific part or section of the web
resource, such as #introduction or #summary.
To prohibit access to non-encrypted websites, an analyst should employ a search string that matches
the protocol of non-encrypted web traffic, which is HTTP. HTTP stands for hypertext transfer protocol,
and it is a standard protocol for transferring data between web servers and web browsers. However,
HTTP does not provide any encryption or security for the data, which means that anyone who
intercepts the web traffic can read or modify the data. Therefore, non-encrypted websites are
vulnerable to eavesdropping, tampering, or spoofing attacks. To access a non-encrypted website, the
URL usually starts with http://, followed by the domain name and optionally the port number. For
example, http://www.example.com or http://www.example.com:80. By scanning the URL for the
string http://, the web filter can identify and block non-encrypted websites.
During a security incident, the security operations team identified sustained network traffic from a
malicious IP address:
10.1.4.9. A security analyst is creating an inbound firewall rule to block the IP address from accessing
the organization’s network. Which of the following fulfills this request?
A. access-list inbound deny ig source 0.0.0.0/0 destination 10.1.4.9/32
B. access-list inbound deny ig source 10.1.4.9/32 destination 0.0.0.0/0
C. access-list inbound permit ig source 10.1.4.9/32 destination 0.0.0.0/0
D. access-list inbound permit ig source 0.0.0.0/0 destination 10.1.4.9/32
Answer: B
Explanation:
A firewall rule is a set of criteria that determines whether to allow or deny a packet to pass through
the firewall. A firewall rule consists of several elements, such as the action, the protocol, the source
address, the destination address, and the port number. The syntax of a firewall rule may vary
depending on the type and vendor of the firewall, but the basic logic is the same. In this question,
the security analyst is creating an inbound firewall rule to block the IP address 10.1.4.9 from
accessing the organization’s network. This means that the action should be deny, the protocol should
be any (or ig for IP), the source address should be 10.1.4.9/32 (which means a single IP address), the
destination address should be 0.0.0.0/0 (which means any IP address), and the port number should
be any. Therefore, the correct firewall rule is:
access-list inbound deny ig source 10.1.4.9/32 destination 0.0.0.0/0
A company needs to provide administrative access to internal resources while minimizing the traffic
allowed through the security boundary. Which of the following methods is most secure?
A. Implementing a bastion host
B. Deploying a perimeter network
C. Installing a WAF
D. Utilizing single sign-on
Answer: A
Explanation:
A bastion host is a special-purpose server that is designed to withstand attacks and provide secure
access to internal resources. A bastion host is usually placed on the edge of a network, acting as a
gateway or proxy to the internal network. A bastion host can be configured to allow only certain
types of traffic, such as SSH or HTTP, and block all other traffic. A bastion host can also run security
software such as firewalls, intrusion detection systems, and antivirus programs to monitor and filter
incoming and outgoing traffic. A bastion host can provide administrative access to internal resources
by requiring strong authentication and encryption, and by logging all activities for auditing
purposes12.
A bastion host is the most secure method among the given options because it minimizes the traffic
allowed through the security boundary and provides a single point of control and defense. A bastion
host can also isolate the internal network from direct exposure to the internet or other untrusted
networks, reducing the attack surface and the risk of compromise3
Deploying a perimeter network
a perimeter network is a network
segment that separates the internal network from the external network. A perimeter network
usually hosts public-facing services such as web servers, email servers, or DNS servers that need to
be accessible from the internet. A perimeter network does not provide administrative access to
internal resources, but rather protects them from unauthorized access. A perimeter network can also
increase the complexity and cost of network management and security4
WAF
WAF is a security tool that protects web
Questions and Answers PDF 24/297
applications from common web-based attacks by monitoring, filtering, and blocking HTTP traffic. A
WAF can prevent attacks such as cross-site scripting, SQL injection, or file inclusion, among others. A
WAF does not provide administrative access to internal resources, but rather protects them from
web application vulnerabilities. A WAF is also not a comprehensive solution for network security, as
it only operates at the application layer and does not protect against other types of attacks or
threats5
A security analyst is reviewing alerts in the SIEM related to potential malicious network traffic
coming from an employee’s corporate laptop. The security analyst has determined that additional
data about the executable running on the machine is necessary to continue the investigation. Which
of the following logs should the analyst use as a data source?
A. Application
B. IPS/IDS
C. Network
D. Endpoint
Answer: D
Explanation:
An endpoint log is a file that contains information about the activities and events that occur on an
end-user device, such as a laptop, desktop, tablet, or smartphone. Endpoint logs can provide
valuable data for security analysts, such as the processes running on the device, the network
connections established, the files accessed or modified, the user actions performed, and the
applications installed or updated. Endpoint logs can also record the details of any executable files
running on the device, such as the name, path, size, hash, signature, and permissions of the
executable
application log
file that contains information about the events that occur within a software
application, such as errors, warnings, transactions, or performance metrics. Application logs can help
developers and administrators troubleshoot issues, optimize performance, and monitor user
behavior. However, application logs may not provide enough information about the executable files
running on the device, especially if they are malicious or unknown
IPS/IDS log
file that contains information about the network traffic that is monitored and
analyzed by an intrusion prevention system (IPS) or an intrusion detection system (IDS). IPS/IDS logs
can help security analysts identify and block potential attacks, such as exploit attempts, denial-of-
service (DoS) attacks, or malicious scans. However, IPS/IDS logs may not provide enough information
about the executable files running on the device, especially if they are encrypted, obfuscated, or use
legitimate protocols
network log
file that contains information about the network activity and communication that
occurs between devices, such as IP addresses, ports, protocols, packets, or bytes. Network logs can
help security analysts understand the network topology, traffic patterns, and bandwidth usage.
However, network logs may not provide enough information about the executable files running on
the device, especially if they are hidden, spoofed, or use proxy servers
A cyber operations team informs a security analyst about a new tactic malicious actors are using to
compromise networks.
SIEM alerts have not yet been configured. Which of the following best describes what the security
analyst should do to identify this behavior?
A. [Digital forensics
B. E-discovery
C. Incident response
D. Threat hunting
Answer: D
Explanation:
Threat hunting is the process of proactively searching for signs of malicious activity or compromise in
a network, rather than waiting for alerts or indicators of compromise (IOCs) to appear. Threat
hunting can help identify new tactics, techniques, and procedures (TTPs) used by malicious actors, as
well as uncover hidden or stealthy threats that may have evaded detection by security tools. Threat
hunting requires a combination of skills, tools, and methodologies, such as hypothesis generation,
data collection and analysis, threat intelligence, and incident response. Threat hunting can also help
improve the security posture of an organization by providing feedback and recommendations for
security improvements.
A company purchased cyber insurance to address items listed on the risk register. Which of the
following strategies does this represent?
A. Accept
B. Transfer
C. Mitigate
D. Avoid
Answer: B
Cyber insurance is a type of insurance that covers the financial losses and liabilities that result from
cyberattacks, such as data breaches, ransomware, denial-of-service, phishing, or malware. Cyber
insurance can help a company recover from the costs of restoring data, repairing systems, paying
ransoms, compensating customers, or facing legal actions. Cyber insurance is one of the possible
strategies that a company can use to address the items listed on the risk register. A risk register is a
document that records the identified risks, their probability, impact, and mitigation strategies for a
project or an organization.
Accept risk mitigation strategy:
The company acknowledges the risk and decides to accept the consequences without taking
any action to reduce or eliminate the risk. This strategy is usually chosen when the risk is low or the
cost of mitigation is too high.
Mitigate risk mitigation strategy:
The company implements controls or measures to reduce the likelihood or impact of the
risk. This strategy is usually chosen when the risk is moderate or the cost of mitigation is reasonable
Avoid risk mitigation strategy:
The company eliminates the risk by changing the scope, plan, or design of the project or the
organization. This strategy is usually chosen when the risk is unacceptable or the cost of mitigation is
too high
A security administrator would like to protect data on employees’ laptops. Which of the following
encryption techniques should the security administrator use?
A. Partition
B. Asymmetric
C. Full disk
D. Database
Answer: C
Explanation:
Full disk encryption (FDE) is a technique that encrypts all the data on a hard drive, including the
operating system, applications, and files. FDE protects the data from unauthorized access in case the
laptop is lost, stolen, or disposed of without proper sanitization. FDE requires the user to enter a
password, a PIN, a smart card, or a biometric factor to unlock the drive and boot the system. FDE can
be implemented by using software solutions, such as BitLocker, FileVault, or VeraCrypt, or by using
hardware solutions, such as self-encrypting drives (SEDs) or Trusted Platform Modules (TPMs). FDE is
a recommended encryption technique for laptops and other mobile devices that store sensitive data.
Partition encryption
technique that encrypts only a specific partition or volume on a hard drive,
leaving the rest of the drive unencrypted. Partition encryption is less secure than FDE, as it does not
protect the entire drive and may leave traces of data on unencrypted areas. Partition encryption is
also less convenient than FDE, as it requires the user to mount and unmount the encrypted partition
manually
Asymmetric encryption
technique that uses a pair of keys, one public and one private, to encrypt
and decrypt data. Asymmetric encryption is mainly used for securing communication, such as email,
web, or VPN, rather than for encrypting data at rest. Asymmetric encryption is also slower and more
computationally intensive than symmetric encryption, which is the type of encryption used by FDE
and partition encryption.
Database encryption
technique that encrypts data stored in a database, such as tables, columns,
rows, or cells. Database encryption can be done at the application level, the database level, or the
file system level. Database encryption is useful for protecting data from unauthorized access by
database administrators, hackers, or malware, but it does not protect the data from physical theft or
loss of the device that hosts the database.
Which of the following security control types does an acceptable use policy best represent?
A. Detective
B. Compensating
C. Corrective
D. Preventive
Answer: D
Explanation:
An acceptable use policy (AUP) is a set of rules that govern how users can access and use a corporate
network or the internet. The AUP helps companies minimize their exposure to cyber security threats
and limit other risks. The AUP also serves as a notice to users about what they are not allowed to do
and protects the company against misuse of their network. Users usually have to acknowledge that
they understand and agree to the rules before accessing the network1.
An AUP best represents a preventive security control type, because it aims to deter or stop potential
security incidents from occurring in the first place. A preventive control is proactive and anticipates
possible threats and vulnerabilities, and implements measures to prevent them from exploiting or
harming the system or the data. A preventive control can be physical, technical, or administrative in
nature2.
Some examples of preventive controls are:
Locks, fences, or guards that prevent unauthorized physical access to a facility or a device
Firewalls, antivirus software, or encryption that prevent unauthorized logical access to a network or a
system
Policies, procedures, or training that prevent unauthorized or inappropriate actions or behaviors by
users or employees
An AUP is an example of an administrative preventive control, because it defines the policies and
procedures that users must follow to ensure the security and proper use of the network and the IT
resources. An AUP can prevent users from engaging in activities that could compromise the security,
performance, or availability of the network or the system, such as:
Downloading or installing unauthorized or malicious software Accessing or sharing sensitive or confidential information without authorization or encryption
Using the network or the system for personal, illegal, or unethical purposes
Bypassing or disabling security controls or mechanisms
Connecting unsecured or unapproved devices to the network
By enforcing an AUP, a company can prevent or reduce the likelihood of security breaches, data loss,
legal liability, or reputational damage caused by user actions or inactions3.
An IT manager informs the entire help desk staff that only the IT manager and the help desk lead will
have access to the administrator console of the help desk software. Which of the following security
techniques is the IT manager setting up?
A. Hardening
B. Employee monitoring
C. Configuration enforcement
D. Least privilege
Answer: D
Explanation:
The principle of least privilege is a security concept that limits access to resources to the minimum
level needed for a user, a program, or a device to perform a legitimate function. It is a cybersecurity
best practice that protects high-value data and assets from compromise or insider threat. Least
privilege can be applied to different abstraction layers of a computing environment, such as
processes, systems, or connected devices. However, it is rarely implemented in practice.
In this scenario, the IT manager is setting up the principle of least privilege by restricting access to
the administrator console of the help desk software to only two authorized users: the IT manager
and the help desk lead. This way, the IT manager can prevent unauthorized or accidental changes to
the software configuration, data, or functionality by other help desk staff. The other help desk staff
will only have access to the normal user interface of the software, which is sufficient for them to
perform their job functions
Hardening
process of securing a system by reducing its
surface of vulnerability, such as by removing unnecessary software, changing default passwords, or
disabling unnecessary services.
Employee monitoring
surveillance of workers’ activity, such as
by tracking web browsing, application use, keystrokes, or screenshots
Configuration enforcement
process of ensuring that a system adheres to a predefined set of security settings, such as by
applying a patch, a policy, or a template
Which of the following is the most likely to be used to document risks, responsible parties, and
thresholds?
A. Risk tolerance
B. Risk transfer
C. Risk register
D. Risk analysis
Answer: C
Explanation:
A risk register is a document that records and tracks the risks associated with a project, system, or
organization. A risk register typically includes information such as the risk description, the risk owner,
the risk probability, the risk impact, the risk level, the risk response strategy, and the risk status. A
risk register can help identify, assess, prioritize, monitor, and control risks, as well as communicate
them to relevant stakeholders. A risk register can also help document the risk tolerance and
thresholds of an organization, which are the acceptable levels of risk exposure and the criteria for
escalating or mitigating risks.
Which of the following should a security administrator adhere to when setting up a new set of
firewall rules?
A. Disaster recovery plan
B. Incident response procedure
C. Business continuity plan
D. Change management procedure
A change management procedure is a set of steps and guidelines that a security administrator should
adhere to when setting up a new set of firewall rules. A firewall is a device or software that can filter,
block, or allow network traffic based on predefined rules or policies. A firewall rule is a statement
that defines the criteria and action for a firewall to apply to a packet or a connection. For example, a
firewall rule can allow or deny traffic based on the source and destination IP addresses, ports,
protocols, or applications. Setting up a new set of firewall rules is a type of change that can affect the
security, performance, and functionality of the network. Therefore, a change management
procedure is necessary to ensure that the change is planned, tested, approved, implemented,
documented, and reviewed in a controlled and consistent manner. A change management procedure
typically includes the following elements
business continuity plan
set of strategies and actions that aim to maintain
the essential functions and operations of an organization during and after a disruptive event, such as
a pandemic, power outage, or civil unrest
company is expanding its threat surface program and allowing individuals to security test the
company’s internet-facing application. The company will compensate researchers based on the
vulnerabilities discovered. Which of the following best describes the program the company is setting
up?
A. Open-source intelligence
B. Bug bounty
C. Red team
D. Penetration testing
Answer: B
Explanation:
A bug bounty is a program that rewards security researchers for finding and reporting vulnerabilities
in an application or system. Bug bounties are often used by companies to improve their security
posture and incentivize ethical hacking. A bug bounty program typically defines the scope, rules, and
compensation for the researchers.
Which of the following threat actors is the most likely to use large financial resources to attack critical
systems located in other countries?
A. Insider
B. Unskilled attacker
C. Nation-state
D. Hacktivist
Answer: C
Explanation:
A nation-state is a threat actor that is sponsored by a government or a political entity to conduct
cyberattacks against other countries or organizations. Nation-states have large financial resources,
advanced technical skills, and strategic objectives that may target critical systems such as military,
energy, or infrastructure
Which of the following enables the use of an input field to run commands that can view or
manipulate data?
A. Cross-site scripting
B. Side loading
C. Buffer overflow
D. SQL injection
Answer: D
Explanation:
= SQL injection is a type of attack that enables the use of an input field to run commands that can
view or manipulate data in a database. SQL stands for Structured Query Language, which is a
language used to communicate with databases. By injecting malicious SQL statements into an input
field, an attacker can bypass authentication, access sensitive information, modify or delete data, or
execute commands on the server. SQL injection is one of the most common and dangerous web
application vulnerabilities.
Employees in the research and development business unit receive extensive training to ensure they
understand how to best protect company data. Which of the following is the type of data these employees are most likely to use in day-to-day
work activities?
A. Encrypted
B. Intellectual property
C. Critical
D. Data in transit
Answer: B
Explanation:
Intellectual property is a type of data that consists of ideas, inventions, designs, or other creative
works that have commercial value and are protected by law. Employees in the research and
development business unit are most likely to use intellectual property data in their day-to-day work
activities, as they are involved in creating new products or services for the company. Intellectual
property data needs to be protected from unauthorized use, disclosure, or theft, as it can give the
company a competitive advantage in the market. Therefore, these employees receive extensive
training to ensure they understand how to best protect this type of data
A company has begun labeling all laptops with asset inventory stickers and associating them with
employee IDs. Which of the following security benefits do these actions provide? (Choose two.)
A. If a security incident occurs on the device, the correct employee can be notified.
B. The security team will be able to send user awareness training to the appropriate device.
C. Users can be mapped to their devices when configuring software MFA tokens.
D. User-based firewall policies can be correctly targeted to the appropriate laptops.
E. When conducting penetration testing, the security team will be able to target the desired laptops.
F. Company data can be accounted for when the employee leaves the organization.
Answer: A, F
Explanation:
Labeling all laptops with asset inventory stickers and associating them with employee IDs can
provide several security benefits for a company. Two of these benefits are:
A . If a security incident occurs on the device, the correct employee can be notified. An asset
inventory sticker is a label that contains a unique identifier for a laptop, such as a serial number, a
barcode, or a QR code. By associating this identifier with an employee ID, the security team can
easily track and locate the owner of the laptop in case of a security incident, such as a malware
infection, a data breach, or a theft. This way, the security team can notify the correct employee about
the incident, and provide them with the necessary instructions or actions to take, such as changing
passwords, scanning for viruses, or reporting the loss. This can help to contain the incident, minimize
the damage, and prevent further escalation.
F . Company data can be accounted for when the employee leaves the organization. When an
employee leaves the organization, the company needs to ensure that all the company data and
assets are returned or deleted from the employee’s laptop. By labeling the laptop with an asset
inventory sticker and associating it with an employee ID, the company can easily identify and verify
the laptop that belongs to the departing employee, and perform the appropriate data backup, wipe,
or transfer procedures. This can help to protect the company data from unauthorized access,
disclosure, or misuse by the former employee or any other party.
A technician wants to improve the situational and environmental awareness of existing users as they
transition from remote to in-office work. Which of the following is the best option?
A. Send out periodic security reminders.
B. Update the content of new hire documentation.
C. Modify the content of recurring training.
D Implement a phishing campaign
Answer: C
Explanation:
Recurring training is a type of security awareness training that is conducted periodically to refresh
and update the knowledge and skills of the users. Recurring training can help improve the situational
and environmental awareness of existing users as they transition from remote to in-office work, as it
can cover the latest threats, best practices, and policies that are relevant to their work environment.
Modifying the content of recurring training can ensure that the users are aware of the current
security landscape and the expectations of their roles.
A newly appointed board member with cybersecurity knowledge wants the board of directors to
receive a quarterly report detailing the number of incidents that impacted the organization. The
systems administrator is creating a way to present the data to the board of directors. Which of the
following should the systems administrator use?
A. Packet captures
B. Vulnerability scans
C. Metadata
D. Dashboard
Answer: D
Explanation:
A dashboard is a graphical user interface that provides a visual representation of key performance
indicators, metrics, and trends related to security events and incidents. A dashboard can help the
board of directors to understand the number and impact of incidents that affected the organization
in a given period, as well as the status and effectiveness of the security controls and processes. A
dashboard can also allow the board of directors to drill down into specific details or filter the data by
various criteria12.
packet capture
A packet capture is a method of capturing and analyzing the network traffic that passes through a
device or a network segment. A packet capture can provide detailed information about the source,
destination, protocol, and content of each packet, but it is not a suitable way to present a summary
of incidents to the board of directors1
vulnerability scan
A vulnerability scan is a process of identifying and assessing the weaknesses and exposures in a
system or a network that could be exploited by attackers. A vulnerability scan can help the
organization to prioritize and remediate the risks and improve the security posture, but it is not a
relevant way to report the number of incidents that occurred in a quarter14
Metadata
Metadata is data that describes other data, such as its format, origin, structure, or context. Metadata
can provide useful information about the characteristics and properties of data, but it is not a
meaningful way to communicate the impact and frequency of incidents to the board of
directors
A systems administrator receives the following alert from a file integrity monitoring tool:
The hash of the cmd.exe file has changed.
The systems administrator checks the OS logs and notices that no patches were applied in the last
two months. Which of the following most likely occurred?
A. The end user changed the file permissions.
B. A cryptographic collision was detected.
C. A snapshot of the file system was taken.
D. A rootkit was deployed.
Answer: D
Explanation:
A rootkit is a type of malware that modifies or replaces system files or processes to hide its presence
and activity. A rootkit can change the hash of the cmd.exe file, which is a command-line interpreter
for Windows systems, to avoid detection by antivirus or file integrity monitoring tools. A rootkit can
also grant the attacker remote access and control over the infected system, as well as perform
malicious actions such as stealing data, installing backdoors, or launching attacks on other systems. A rootkit is one of the most difficult types of malware to remove, as it can persist even after rebooting
or reinstalling the OS.
Which of the following roles, according to the shared responsibility model, is responsible for securing
the company’s database in an IaaS model for a cloud environment?
A. Client
B. Third-party vendor
C. Cloud provider
D. DBA
Answer: A
Explanation:
According to the shared responsibility model, the client and the cloud provider have different roles
and responsibilities for securing the cloud environment, depending on the service model. In an IaaS
(Infrastructure as a Service) model, the cloud provider is responsible for securing the physical
infrastructure, such as the servers, storage, and network devices, while the client is responsible for
securing the operating systems, applications, and data that run on the cloud infrastructure.
Therefore, the client is responsible for securing the company’s database in an IaaS model for a cloud
environment, as the database is an application that stores data. The client can use various security
controls, such as encryption, access control, backup, and auditing, to protect the database from
unauthorized access, modification, or loss. The third-party vendor and the DBA (Database
Administrator) are not roles defined by the shared responsibility model, but they may be involved in
the implementation or management of the database security.
A client asked a security company to provide a document outlining the project, the cost, and the
Questions and Answers PDF 42/297
completion time frame. Which of the following documents should the company provide to the
client?
A. MSA
B. SLA
C. BPA
D. ISOW
Answer: D
Explanation:
An ISOW is a document that outlines the project, the cost, and the completion time frame for a
security company to provide a service to a client. ISOW stands for Information Security Operations
Work, and it is a type of contract that specifies the scope, deliverables, milestones, and payment
terms of a security project. An ISOW is usually used for one-time or short-term projects that have a
clear and defined objective and outcome. For example, an ISOW can be used for a security
assessment, a penetration test, a security audit, or a security training.
MSA
. A MSA is a
master service agreement, which is a type of contract that establishes the general terms and
conditions for a long-term or ongoing relationship between a security company and a client. A MSA
does not specify the details of each individual project, but rather sets the framework for future
projects that will be governed by separate statements of work (SOWs)
SLA
A SLA is a service level
agreement, which is a type of contract that defines the quality and performance standards for a
security service provided by a security company to a client. A SLA usually includes the metrics,
targets, responsibilities, and penalties for measuring and ensuring the service level.
BPA
A BPA is a
business partnership agreement, which is a type of contract that establishes the roles and
expectations for a strategic alliance between two or more security companies that collaborate to
provide a joint service to a client. A BPA usually covers the objectives, benefits, risks, and obligations
of the partnership.
A security team is reviewing the findings in a report that was delivered after a third party performed
a penetration test. One of the findings indicated that a web application form field is vulnerable to
cross-site scripting. Which of the following application security techniques should the security
analyst recommend the developer implement to prevent this vulnerability?
A. Secure cookies
B. Version control
C. Input validation
D. Code signing
Answer: C
Explanation:
Input validation is a technique that checks the user input for any malicious or unexpected data before
processing it by the web application. Input validation can prevent cross-site scripting (XSS) attacks,
which exploit the vulnerability of a web application to execute malicious scripts in the browser of a
victim. XSS attacks can compromise the confidentiality, integrity, and availability of the web
application and its users. Input validation can be implemented on both the client-side and the
server-side, but server-side validation is more reliable and secure. Input validation can use various
methods, such as whitelisting, blacklisting, filtering, escaping, encoding, and sanitizing the input
data.
Which of the following must be considered when designing a high-availability network? (Choose
two).
A. Ease of recovery
B. Ability to patch
C. Physical isolation
D. Responsiveness
E. Attack surface
F. Extensible authentication
Answer: A, E
Explanation:
A high-availability network is a network that is designed to minimize downtime and ensure
continuous operation even in the event of a failure or disruption. A high-availability network must
consider the following factors12:
Ease of recovery: This refers to the ability of the network to restore normal functionality quickly and
efficiently after a failure or disruption. Ease of recovery can be achieved by implementing backup
and restore procedures, redundancy and failover mechanisms, fault tolerance and resilience, and
disaster recovery plans.
Attack surface: This refers to the amount of exposure and vulnerability of the network to potential
threats and attacks. Attack surface can be reduced by implementing security controls such as
firewalls, encryption, authentication, access control, segmentation, and hardening.
A technician needs to apply a high-priority patch to a production system. Which of the following
steps should be taken first?
A. Air gap the system.
B. Move the system to a different network segment.
C. Create a change control request.
D. Apply the patch to the system
Answer: C
Explanation:
= A change control request is a document that describes the proposed change to a system, the
reason for the change, the expected impact, the approval process, the testing plan, the
implementation plan, the rollback plan, and the communication plan. A change control request is a best practice for applying any patch to a production system, especially a high-priority one, as it
ensures that the change is authorized, documented, tested, and communicated. A change control
request also minimizes the risk of unintended consequences, such as system downtime, data loss, or
security breaches.
Which of the following describes the reason root cause analysis should be conducted as part of
incident response?
A. To gather loCs for the investigation
B. To discover which systems have been affected
C. To eradicate any trace of malware on the network
D. To prevent future incidents of the same nature
Answer: D
Explanation:
Root cause analysis is a process of identifying and resolving the underlying factors that led to an
incident. By conducting root cause analysis as part of incident response, security professionals can
learn from the incident and implement corrective actions to prevent future incidents of the same
nature. For example, if the root cause of a data breach was a weak password policy, the security
team can enforce a stronger password policy and educate users on the importance of password
security. Root cause analysis can also help to improve security processes, policies, and procedures,
and to enhance security awareness and culture within the organization. Root cause analysis is not
meant to gather loCs (indicators of compromise) for the investigation, as this is a task performed
during the identification and analysis phases of incident response. Root cause analysis is also not
meant to discover which systems have been affected or to eradicate any trace of malware on the network, as these are tasks performed during the containment and eradication phases of incident
response.
Which of the following is the most likely outcome if a large bank fails an internal PCI DSS compliance
assessment?
A. Fines
B. Audit findings
C. Sanctions
D. Reputation damage
Answer: A
Explanation:
PCI DSS is the Payment Card Industry Data Security Standard, which is a set of security requirements
for organizations that store, process, or transmit cardholder data. PCI DSS aims to protect the
confidentiality, integrity, and availability of cardholder data and prevent fraud, identity theft, and
data breaches. PCI DSS is enforced by the payment card brands, such as Visa, Mastercard, American
Express, Discover, and JCB, and applies to all entities involved in the payment card ecosystem, such
as merchants, acquirers, issuers, processors, service providers, and payment applications.
A company is developing a business continuity strategy and needs to determine how many staff
members would be required to sustain the business in the case of a disruption. Which of the
following best describes this step?
A. Capacity planning
B. Redundancy
C. Geographic dispersion
D. Tablet exercise
Answer: A
Explanation:
Capacity planning is the process of determining the resources needed to meet the current and
future demands of an organization. Capacity planning can help a company develop a business
continuity strategy by estimating how many staff members would be required to sustain the business
in the case of a disruption, such as a natural disaster, a cyberattack, or a pandemic. Capacity planning
can also help a company optimize the use of its resources, reduce costs, and improve
performance
A company’s legal department drafted sensitive documents in a SaaS application and wants to
ensure the documents cannot be accessed by individuals in high-risk countries. Which of the
following is the most effective way to limit this access?
A. Data masking
B. Encryption
C. Geolocation policy
D. Data sovereignty regulation
Answer: C
Explanation:
A geolocation policy is a policy that restricts or allows access to data or resources based on the
geographic location of the user or device. A geolocation policy can be implemented using various
methods, such as IP address filtering, GPS tracking, or geofencing. A geolocation policy can help the
company’s legal department to prevent unauthorized access to sensitive documents from individuals
in high-risk countries12
Which of the following is a hardware-specific vulnerability?
A. Firmware version
B. Buffer overflow
C. SQL injection
D. Cross-site scripting
Answer: A
Explanation:
Firmware is a type of software that is embedded in a hardware device, such as a router, a printer, or a
BIOS chip. Firmware controls the basic functions and operations of the device, and it can be updated
or modified by the manufacturer or the user. Firmware version is a hardware-specific vulnerability, as
it can expose the device to security risks if it is outdated, corrupted, or tampered with. An attacker
can exploit firmware vulnerabilities to gain unauthorized access, modify device settings, install
malware, or cause damage to the device or the network. Therefore, it is important to keep firmware
updated and verify its integrity and authenticity
While troubleshooting a firewall configuration, a technician determines that a “deny any” policy
should be added to the bottom of the ACL. The technician updates the policy, but the new policy
causes several company servers to become unreachable.
Which of the following actions would prevent this issue?
A. Documenting the new policy in a change request and submitting the request to change
management
B. Testing the policy in a non-production environment before enabling the policy in the production
network
C. Disabling any intrusion prevention signatures on the ‘deny any* policy prior to enabling the new
policy
D. Including an ‘allow any1 policy above the ‘deny any* policy
Answer: B
Explanation:
A firewall policy is a set of rules that defines what traffic is allowed or denied on a network. A firewall
policy should be carefully designed and tested before being implemented, as a misconfigured policy
can cause network disruptions or security breaches. A common best practice is to test the policy in a
non-production environment, such as a lab or a simulation, before enabling the policy in the
production network. This way, the technician can verify the functionality and performance of the
policy, and identify and resolve any issues or conflicts, without affecting the live network. Testing the
policy in a non-production environment would prevent the issue of the ‘deny any’ policy causing
several company servers to become unreachable, as the technician would be able to detect and
correct the problem before applying the policy to the production network
An organization is building a new backup data center with cost-benefit as the primary requirement
and RTO and RPO values around two days. Which of the following types of sites is the best for this
scenario?
A. Real-time recovery
B. Hot
C. Cold
D. Warm
Answer: C
Explanation:
A cold site is a type of backup data center that has the necessary infrastructure to support IT
operations, but does not have any pre-configured hardware or software. A cold site is the cheapest
option among the backup data center types, but it also has the longest recovery time objective (RTO) and recovery point objective (RPO) values. A cold site is suitable for scenarios where the cost-benefit
is the primary requirement and the RTO and RPO values are not very stringent. A cold site can take
up to two days or more to restore the normal operations after a disaster
A company requires hard drives to be securely wiped before sending decommissioned systems to
recycling. Which of the following best describes this policy?
A. Enumeration
B. Sanitization
C. Destruction
D. Inventory
Answer: B
Explanation:
Sanitization is the process of removing sensitive data from a storage device or a system before it is
disposed of or reused. Sanitization can be done by using software tools or hardware devices that
overwrite the data with random patterns or zeros, making it unrecoverable. Sanitization is different
from destruction, which is the physical damage of the storage device to render it unusable.
Sanitization is also different from enumeration, which is the identification of network resources or
devices, and inventory, which is the tracking of assets and their locations. The policy of securely
wiping hard drives before sending decommissioned systems to recycling is an example of
sanitization, as it ensures that no confidential data can be retrieved from the recycled
devices.
A systems administrator works for a local hospital and needs to ensure patient data is protected and
secure. Which of the following data classifications should be used to secure patient data?
A. Private
B. Critical
C. Sensitive
D. Public
Answer: C
Explanation:
Data classification is a process of categorizing data based on its level of sensitivity, value, and impact
to the organization if compromised. Data classification helps to determine the appropriate security
controls and policies to protect the data from unauthorized access, disclosure, or modification.
Different organizations may use different data classification schemes, but a common one is the four-
tier model, which consists of the following categories: public, private, sensitive, and critical.
A U.S.-based cloud-hosting provider wants to expand its data centers to new international locations.
Which of the following should the hosting provider consider first?
A. Local data protection regulations
B. Risks from hackers residing in other countries
C. Impacts to existing contractual obligations
D. Time zone differences in log correlation
Answer: A
Explanation:
Local data protection regulations are the first thing that a cloud-hosting provider should consider
before expanding its data centers to new international locations. Data protection regulations are
laws or standards that govern how personal or sensitive data is collected, stored, processed, and
transferred across borders.
Which of the following would be the best way to block unknown programs from executing?
A. Access control list
B. Application allow list.
C. Host-based firewall
D. DLP solution
Answer: B
Explanation:
An application allow list is a security technique that specifies which applications are permitted to run
on a system or a network. An application allow list can block unknown programs from executing by
only allowing the execution of programs that are explicitly authorized and verified. An application
allow list can prevent malware, unauthorized software, or unwanted applications from running and
compromising the security of the system or the network
Access control list
This is a security technique that specifies which users or groups are granted or
denied access to a resource or an object. An access control list can control the permissions and
privileges of users or groups, but it does not directly block unknown programs from executing
Host-based firewall
This is a security device that monitors and filters the incoming and outgoing
network traffic on a single host or system. A host-based firewall can block or allow network
connections based on predefined rules, but it does not directly block unknown programs from
executing1
DLP solution
This is a security system that detects and prevents the unauthorized transmission or
leakage of sensitive data. A DLP solution can protect the confidentiality and integrity of data, but it does not directly block unknown programs from executing
A company hired a consultant to perform an offensive security assessment covering penetration
testing and social engineering.
Which of the following teams will conduct this assessment activity?
A. White
B. Purple
C. Blue
D. Red
Answer: D
Explanation:
A red team is a group of security professionals who perform offensive security assessments covering
penetration testing and social engineering. A red team simulates real-world attacks and exploits the
vulnerabilities of a target organization, system, or network. A red team aims to test the effectiveness
of the security controls, policies, and procedures of the target, as well as the awareness and response
of the staff and the blue team. A red team can be hired as an external consultant or formed internally
within the organization.
A software development manager wants to ensure the authenticity of the code created by the
company. Which of the following options is the most appropriate?
A. Testing input validation on the user input fields
B. Performing code signing on company-developed software
C. Performing static code analysis on the software
D. Ensuring secure cookies are use
Answer: B
Explanation:
Code signing is a technique that uses cryptography to verify the authenticity and integrity of the code
created by the company. Code signing involves applying a digital signature to the code using a private
key that only the company possesses. The digital signature can be verified by anyone who has the
corresponding public key, which can be distributed through a trusted certificate authority. Code
signing can prevent unauthorized modifications, tampering, or malware injection into the code, and
it can also assure the users that the code is from a legitimate source.
Which of the following can be used to identify potential attacker activities without affecting
production servers?
A. Honey pot
B. Video surveillance
C. Zero Trust
D. Geofencing
Answer: A
Explanation:
A honey pot is a system or a network that is designed to mimic a real production server and attract
potential attackers. A honey pot can be used to identify the attacker’s methods, techniques, and
objectives without affecting the actual production servers. A honey pot can also divert the attacker’s
attention from the real targets and waste their time and resources
Zero Trust
This is a security strategy that assumes that no user, device, or network is trustworthy by
default and requires strict verification and validation for every request and transaction. Zero Trust can
help to improve the security posture and reduce the attack surface of an organization, but it does not
directly identify the attacker’s activities on the network or the servers
Geofencing
This is a security technique that uses geographic location as a criterion to restrict or
allow access to data or resources. Geofencing can help to protect the data sovereignty and
compliance of an organization, but it does not directly identify the attacker’s activities on the
network or the servers
During an investigation, an incident response team attempts to understand the source of an incident.
Which of the following incident response activities describes this process?
A. Analysis
B. Lessons learned
C. Detection
D. Containment
Answer: A
Explanation:
Questions and Answers PDF 60/297
Analysis is the incident response activity that describes the process of understanding the source of
an incident. Analysis involves collecting and examining evidence, identifying the root cause,
determining the scope and impact, and assessing the threat actor’s motives and capabilities. Analysis
helps the incident response team to formulate an appropriate response strategy, as well as to
prevent or mitigate future incidents. Analysis is usually performed after detection and before
containment, eradication, recovery, and lessons learned
A security practitioner completes a vulnerability assessment on a company’s network and finds
several vulnerabilities, which the operations team remediates. Which of the following should be
done next?
A. Conduct an audit.
B. Initiate a penetration test.
C. Rescan the network.
D. Submit a report.
Answer: C
Explanation:
After completing a vulnerability assessment and remediating the identified vulnerabilities, the next
step is to rescan the network to verify that the vulnerabilities have been successfully fixed and no
new vulnerabilities have been introduced. A vulnerability assessment is a process of identifying and evaluating the weaknesses and exposures in a network, system, or application that could be
exploited by attackers. A vulnerability assessment typically involves using automated tools, such as
scanners, to scan the network and generate a report of the findings. The report may include
information such as the severity, impact, and remediation of the vulnerabilities. The operations team
is responsible for applying the appropriate patches, updates, or configurations to address the vulnerabilities and reduce the risk to the network. A rescan is necessary to confirm that the remediation actions have been effective and that the network is secure.
An administrator was notified that a user logged in remotely after hours and copied large amounts of
data to a personal device.
Which of the following best describes the user’s activity?
A. Penetration testing
B. Phishing campaign
C. External audit
D. Insider threat
Answer: D
Questions and Answers PDF 62/297
Explanation:
An insider threat is a security risk that originates from within the organization, such as an employee,
contractor, or business partner, who has authorized access to the organization’s data and systems. An
insider threat can be malicious, such as stealing, leaking, or sabotaging sensitive data, or unintentional, such as falling victim to phishing or social engineering. An insider threat can cause
significant damage to the organization’s reputation, finances, operations, and legal compliance. The
user’s activity of logging in remotely after hours and copying large amounts of data to a personal
device is an example of a malicious insider threat, as it violates the organization’s security policies and compromises the confidentiality and integrity of the data.
Which of the following allows for the attribution of messages to individuals?
A. Adaptive identity
B. Non-repudiation
C. Authentication
D. Access logs
Answer: B
Explanation:
Non-repudiation is the ability to prove that a message or document was sent or signed by a
particular person, and that the person cannot deny sending or signing it. Non-repudiation can be
achieved by using cryptographic techniques, such as hashing and digital signatures, that can verify
the authenticity and integrity of the message or document. Non-repudiation can be useful for legal,
financial, or contractual purposes, as it can provide evidence of the origin and content of the
message or document.
Which of the following is the best way to consistently determine on a daily basis whether security
settings on servers have been modified?
A. Automation
B. Compliance checklist
C. Attestation
D. Manual audit
Answer: A
Explanation:
Automation is the best way to consistently determine on a daily basis whether security settings on servers have been modified. Automation is the process of using software, hardware, or other tools to
perform tasks that would otherwise require human intervention or manual effort. Automation can
help to improve the efficiency, accuracy, and consistency of security operations, as well as reduce human errors and costs. Automation can be used to monitor, audit, and enforce security settings on servers, such as firewall rules, encryption keys, access controls, patch levels, and configuration
files. Automation can also alert security personnel of any changes or anomalies that may indicate a
security breach or compromise
Compliance checklist:
This is a document that lists the security requirements, standards, or best practices that an organization must follow or adhere to. A compliance checklist can help to ensure that the security settings on servers are aligned with the organizational policies and regulations, but
it does not automatically detect or report any changes or modifications that may occur on a daily
basis
Attestation
This is a process of verifying or confirming the validity or accuracy of a statement, claim,
or fact. Attestation can be used to provide assurance or evidence that the security settings on servers
are correct and authorized, but it does not continuously monitor or audit any changes or
modifications that may occur on a daily basis
Manual audit:
This is a process of examining or reviewing the security settings on servers by human
inspectors or auditors. A manual audit can help to identify and correct any security issues or
discrepancies on servers, but it is time-consuming, labor-intensive, and prone to human errors. A
manual audit may not be feasible or practical to perform on a daily basis
Which of the following tools can assist with detecting an employee who has accidentally emailed a
file containing a customer’s PII?
A. SCAP
B. Net Flow
C. Antivirus
D. DLP
Answer: D
Explanation:
DLP stands for Data Loss Prevention, which is a tool that can assist with detecting and preventing the unauthorized transmission or leakage of sensitive data, such as a customer’s PII (Personally `Identifiable Information). DLP can monitor, filter, and block data in motion (such as emails), data at
rest (such as files), and data in use (such as applications). DLP can also alert the sender, the recipient,
or the administrator of the data breach, and apply remediation actions, such as encryption,
quarantine, or deletion. DLP can help an organization comply with data protection regulations, such
as GDPR, HIPAA, or PCI DSS, and protect its reputation and assets.
An organization recently updated its security policy to include the following statement:
Regular expressions are included in source code to remove special characters such as $, |, ;. &, `, and
? from variables set by forms in a web application.
Which of the following best explains the security technique the organization adopted by making this
addition to the policy?
A. Identify embedded keys
B. Code debugging
C. Input validation
D. Static code analysis
Answer: C
Explanation:
Input validation is a security technique that checks the user input for any malicious or unexpected
data before processing it by the application. Input validation can prevent various types of attacks,
such as injection, cross-site scripting, buffer overflow, and command execution, that exploit the
vulnerabilities in the application code. Input validation can be performed on both the client-side and
the server-side, using methods such as whitelisting, blacklisting, filtering, sanitizing, escaping, and
encoding. By including regular expressions in the source code to remove special characters from the
variables set by the forms in the web application, the organization adopted input validation as a
security technique. Regular expressions are patterns that match a specific set of characters or strings,
and can be used to filter out any unwanted or harmful input. Special characters, such as $, |, ;, &, `,
and ?, can be used by attackers to inject commands or scripts into the application, and cause damage
or data theft. By removing these characters from the input, the organization can reduce the risk of
such attacks
A security analyst and the management team are reviewing the organizational performance of a
recent phishing campaign. The user click-through rate exceeded the acceptable risk threshold, and
the management team wants to reduce the impact when a user clicks on a link in a phishing
message. Which of the following should the analyst do?
A. Place posters around the office to raise awareness of common phishing activities.
B. Implement email security filters to prevent phishing emails from being delivered
C. Update the EDR policies to block automatic execution of downloaded programs.
D. Create additional training for users to recognize the signs of phishing attempts.
Answer: C
Explanation:
An endpoint detection and response (EDR) system is a security tool that monitors and analyzes the
activities and behaviors of endpoints, such as computers, laptops, mobile devices, and servers. An
EDR system can detect, prevent, and respond to various types of threats, such as malware,
ransomware, phishing, and advanced persistent threats (APTs). One of the features of an EDR system
is to block the automatic execution of downloaded programs, which can prevent malicious code from running on the endpoint when a user clicks on a link in a phishing message. This can reduce the impact of a phishing attack and protect the endpoint from compromise. Updating the EDR policies to
block automatic execution of downloaded programs is a technical control that can mitigate the risk of
phishing, regardless of the user’s awareness or behavior. Therefore, this is the best answer among
the given options.
Which of the following has been implemented when a host-based firewall on a legacy Linux system
allows connections from only specific internal IP addresses?
A. Compensating control
B. Network segmentation
C. Transfer of risk
D. SNMP traps
Answer: A
Explanation:
A compensating control is a security measure that is implemented to mitigate the risk of a
vulnerability or a weakness that cannot be resolved by the primary control. A compensating control
does not prevent or eliminate the vulnerability or weakness, but it can reduce the likelihood or
impact of an attack. A host-based firewall on a legacy Linux system that allows connections from only specific internal IP addresses is an example of a compensating control, as it can limit the exposure of
the system to potential threats from external or unauthorized sources. A host-based firewall is a
software application that monitors and filters the incoming and outgoing network traffic on a single
host, based on a set of rules or policies.
The management team notices that new accounts that are set up manually do not always have
correct access or permissions.
Which of the following automation techniques should a systems administrator use to streamline
account creation?
A. Guard rail script
B. Ticketing workflow
C. Escalation script
D. User provisioning script
Answer: D
Explanation:
A user provisioning script is an automation technique that uses a predefined set of instructions or
commands to create, modify, or delete user accounts and assign appropriate access or
permissions. A user provisioning script can help to streamline account creation by reducing manual
errors, ensuring consistency and compliance, and saving time and resources
Guard rail script
This is a script that monitors and enforces the security policies and rules on a
system or a network. A guard rail script can help to prevent unauthorized or malicious actions, such
as changing security settings, accessing restricted resources, or installing unwanted software
Ticketing workflow
This is a process that tracks and manages the requests, issues, or incidents that
are reported by users or customers. A ticketing workflow can help to improve the communication,
collaboration, and resolution of problems, but it does not automate the account creation process
Escalation script
This is a script that triggers an alert or a notification when a certain condition or
threshold is met or exceeded. An escalation script can help to inform the relevant parties or
authorities of a critical situation, such as a security breach, a performance degradation, or a service
outage.
A company is planning to set up a SIEM system and assign an analyst to review the logs on a weekly
basis. Which of the following types of controls is the company setting up?
A. Corrective
B. Preventive
C. Detective
D. Deterrent
nswer: C
Explanation:
A detective control is a type of control that monitors and analyzes the events and activities in a system or a network, and alerts or reports when an incident or a violation occurs. A SIEM (Security Information and Event Management) system is a tool that collects, correlates, and analyzes the logs
from various sources, such as firewalls, routers, servers, or applications, and provides a centralized view of the security status and incidents. An analyst who reviews the logs on a weekly basis can
identify and investigate any anomalies, trends, or patterns that indicate a potential threat or a
breach. A detective control can help the company to respond quickly and effectively to the incidents, and to improve its security posture and resilience.
A systems administrator is looking for a low-cost application-hosting solution that is cloud-based.
Which of the following meets these requirements?
A. Serverless framework
B. Type 1 hvpervisor
C. SD-WAN
D. SDN
Answer: A
Explanation:
A serverless framework is a cloud-based application-hosting solution that meets the requirements of
low-cost and cloud-based. A serverless framework is a type of cloud computing service that allows
developers to run applications without managing or provisioning any servers. The cloud provider
handles the server-side infrastructure, such as scaling, load balancing, security, and maintenance,
and charges the developer only for the resources consumed by the application. A serverless
framework enables developers to focus on the application logic and functionality, and reduces the
operational costs and complexity of hosting applications. Some examples of serverless frameworks
are AWS Lambda, Azure Functions, and Google Cloud Functions.
type 1 hypervisor
a software layer that runs
directly on the hardware and creates multiple virtual machines that can run different operating
systems and applications. A type 1 hypervisor is not a cloud-based service, but a virtualization
technology that can be used to create private or hybrid clouds. A type 1 hypervisor also requires the
developer to manage and provision the servers and the virtual machines, which can increase the
operational costs and complexity of hosting applications. Some examples of type 1 hypervisors are
VMware ESXi, Microsoft Hyper-V, and Citrix XenServer.
SD-WAN (Software-Defined Wide Area Network)
network architecture that uses software to dynamically route traffic across multiple WAN connections, such as broadband, LTE, or MPLS. SD-WAN is not a cloud-based service, but a network optimization technology that can improve the performance, reliability, and security of WAN connections. SD-WAN can be used to connect remote sites or users to cloud-based applications, but it does not host the applications itself. Some examples
of SD-WAN vendors are Cisco, VMware, and Fortinet.
SDN (Software-Defined Networking)
network architecture that decouples the control plane from the data plane, and uses a centralized controller to programmatically manage and configure the
network devices and traffic flows. SDN is not a cloud-based service, but a network automation
technology that can enhance the scalability, flexibility, and efficiency of the network. SDN can be used to create virtual networks or network functions that can support cloud-based applications, but
it does not host the applications itself. Some examples of SDN vendors are OpenFlow, OpenDaylight,
and OpenStack.
A security operations center determines that the malicious activity detected on a server is normal.
Which of the following activities describes the act of ignoring detected activity in the future?
A. Tuning
B. Aggregating
C. Quarantining
D. Archiving
Answer: A
Explanation:
Tuning is the activity of adjusting the configuration or parameters of a security tool or system to
optimize its performance and reduce false positives or false negatives. Tuning can help to filter out
the normal or benign activity that is detected by the security tool or system, and focus on the
malicious or anomalous activity that requires further investigation or response. Tuning can also help to improve the efficiency and effectiveness of the security operations center by reducing the
workload and alert fatigue of the analysts. Tuning is different from aggregating, which is the activity
of collecting and combining data from multiple sources or sensors to provide a comprehensive view
of the security posture.
A security analyst reviews domain activity logs and notices the following:
Which of the following is the best explanation for what the security analyst has discovered?
A. The user jsmith’s account has been locked out.
B. A keylogger is installed on [smith’s workstation
C. An attacker is attempting to brute force ismith’s account.
D. Ransomware has been deployed in the domain.
Answer: C
Explanation:
Questions and Answers PDF 73/297
Brute force is a type of attack that tries to guess the password or other credentials of a user account
by using a large number of possible combinations. An attacker can use automated tools or scripts to perform a brute force attack and gain unauthorized access to the account. The domain activity logs show that the user ismith has failed to log in 10 times in a row within a short period of time, which is a strong indicator of a brute force attack. The logs also show that the source IP address of the failed logins is different from the usual IP address of ismith, which suggests that the attacker is using a different device or location to launch the attack. The security analyst should take immediate action to
block the attacker’s IP address, reset ismith’s password, and notify ismith of the
incident
A company is concerned about weather events causing damage to the server room and downtime.
Which of the following should the company consider?
A. Clustering servers
B. Geographic dispersion
C. Load balancers
D. Off-site backups
Answer: B
Explanation:
Geographic dispersion is a strategy that involves distributing the servers or data centers across
different geographic locations. Geographic dispersion can help the company to mitigate the risk of
weather events causing damage to the server room and downtime, as well as improve the
availability, performance, and resilience of the network.
Which of the following is a primary security concern for a company setting up a BYOD program?
A. End of life
B. Buffer overflow
C. VM escape
D. Jailbreaking
Answer: D
Explanation:
Jailbreaking is a primary security concern for a company setting up a BYOD (Bring Your Own Device)
program. Jailbreaking is the process of removing the manufacturer’s or the carrier’s restrictions on a
device, such as a smartphone or a tablet, to gain root access and install unauthorized or custom software. Jailbreaking can compromise the security of the device and the data stored on it, as well as
expose it to malware, viruses, or hacking. Jailbreaking can also violate the warranty and the terms of
service of the device, and make it incompatible with the company’s security policies and standards.
Therefore, a company setting up a BYOD program should prohibit jailbreaking and enforce device compliance and encryption.
A company decided to reduce the cost of its annual cyber insurance policy by removing the coverage
for ransomware attacks.
Which of the following analysis elements did the company most likely use in making this decision?
A. IMTTR
B. RTO
C. ARO
D. MTBF
Answer: C
Explanation:
ARO (Annualized Rate of Occurrence) is an analysis element that measures the frequency or
likelihood of an event happening in a given year. ARO is often used in risk assessment and
management, as it helps to estimate the potential loss or impact of an event. A company can use
ARO to calculate the annualized loss expectancy (ALE) of an event, which is the product of ARO and
the single loss expectancy (SLE). ALE represents the expected cost of an event per year, and can be
used to compare with the cost of implementing a security control or purchasing an insurance policy.
Which of the following is the most likely to be included as an element of communication in a security
awareness program?
A. Reporting phishing attempts or other suspicious activities
B. Detecting insider threats using anomalous behavior recognition
C. Verifying information when modifying wire transfer data
D. Performing social engineering as part of third-party penetration testing
Answer: A
Explanation:
A security awareness program is a set of activities and initiatives that aim to educate and inform the users and employees of an organization about the security policies, procedures, and best practices. A security awareness program can help to reduce the human factor in security risks, such as social engineering, phishing, malware, data breaches, and insider threats. A security awareness program should include various elements of communication, such as newsletters, posters, videos, webinars,
quizzes, games, simulations, and feedback mechanisms, to deliver the security messages and reinforce the security culture. One of the most likely elements of communication to be included in a
security awareness program is reporting phishing attempts or other suspicious activities, as this can help to raise the awareness of the users and employees about the common types of cyberattacks and
how to respond to them. Reporting phishing attempts or other suspicious activities can also help to alert the security team and enable them to take appropriate actions to prevent or mitigate the impact of the attacks
Which of the following vulnerabilities is exploited when an attacker overwrites a register with a
malicious address?
A. VM escape
B. SQL injection
C. Buffer overflow
D. Race condition
Answer: C
Explanation:
A buffer overflow is a vulnerability that occurs when an application writes more data to a memory
buffer than it can hold, causing the excess data to overwrite adjacent memory locations. A register is
a small storage area in the CPU that holds temporary data or instructions. An attacker can exploit a
buffer overflow to overwrite a register with a malicious address that points to a shellcode, which is a
piece of code that gives the attacker control over the system.
Which of the following would be the best way to handle a critical business application that is running
on a legacy server?
A. Segmentation
B. Isolation
C. Hardening
D. Decommissioning
Answer: B
Explanation:
A legacy server is a server that is running outdated or unsupported software or hardware, which may
pose security risks and compatibility issues. A critical business application is an application that is
essential for the operation and continuity of the business, such as accounting, payroll, or inventory
management. A legacy server running a critical business application may be difficult to replace or
upgrade, but it should not be left unsecured or exposed to potential threats.
Which of the following describes the process of concealing code or text inside a graphical image?
A. Symmetric encryption
B. Hashing
C. Data masking
D. Steganography
Answer: D
Explanation:
Steganography is the process of hiding information within another medium, such as an image, audio,
video, or text file. The hidden information is not visible or noticeable to the casual observer, and can only be extracted by using a specific technique or key. Steganography can be used for various
purposes, such as concealing secret messages, watermarking, or evading detection by antivirus software
After a company was compromised, customers initiated a lawsuit. The company’s attorneys have
requested that the security team initiate a legal hold in response to the lawsuit. Which of the
following describes the action the security team will most likely be required to take?
A. Retain the emails between the security team and affected customers for 30 days.
B. Retain any communications related to the security breach until further notice.
C. Retain any communications between security members during the breach response.
D. Retain all emails from the company to affected customers for an indefinite period of time
Answer: B
Explanation:
A legal hold (also known as a litigation hold) is a notification sent from an organization’s legal team
to employees instructing them not to delete electronically stored information (ESI) or discard paper
documents that may be relevant to a new or imminent legal case. A legal hold is intended to
preserve evidence and prevent spoliation, which is the intentional or negligent destruction of
evidence that could harm a party’s case. A legal hold can be triggered by various events, such as a
lawsuit, a regulatory investigation, or a subpoena
A network manager wants to protect the company’s VPN by implementing multifactor
authentication that uses:
. Something you know
. Something you have
. Something you are
Which of the following would accomplish the manager’s goal?
A. Domain name, PKI, GeolP lookup
B. VPN IP address, company ID, facial structure
C. Password, authentication token, thumbprint
D. Company URL, TLS certificate, home address
Answer: C
Explanation:
The correct answer is C. Password, authentication token, thumbprint. This combination of
authentication factors satisfies the manager’s goal of implementing multifactor authentication that
uses something you know, something you have, and something you are.
Something you know is a type of authentication factor that relies on the user’s knowledge of a secret
or personal information, such as a password, a PIN, or a security question. A password is a common
example of something you know that can be used to access a VPN12
Questions and Answers PDF 93/297
Something you have is a type of authentication factor that relies on the user’s possession of a
physical object or device, such as a smart card, a token, or a smartphone. An authentication token is
a common example of something you have that can be used to generate a one-time password (OTP)
or a code that can be used to access a VPN12
Something you are is a type of authentication factor that relies on the user’s biometric
characteristics, such as a fingerprint, a face, or an iris. A thumbprint is a common example of
something you are that can be used to scan and verify the user’s identity to access a VPN
A security manager created new documentation to use in response to various types of security
incidents. Which of the following is the next step the manager should take?
A. Set the maximum data retention policy.
B. Securely store the documents on an air-gapped network.
C. Review the documents’ data classification policy.
D. Conduct a tabletop exercise with the team
Answer: D
Explanation:
A tabletop exercise is a simulated scenario that tests the effectiveness of a security incident response
plan. It involves gathering the relevant stakeholders and walking through the steps of the plan,
identifying any gaps or issues that need to be addressed. A tabletop exercise is a good way to
validate the documentation created by the security manager and ensure that the team is prepared
for various types of security incidents.
Users at a company are reporting they are unable to access the URL for a new retail website because
it is flagged as gambling and is being blocked.
Which of the following changes would allow users to access the site?
A. Creating a firewall rule to allow HTTPS traffic
B. Configuring the IPS to allow shopping
C. Tuning the DLP rule that detects credit card data
D. Updating the categorization in the content filter
Answer: D
Explanation:
A content filter is a device or software that blocks or allows access to web content based on
predefined rules or categories. In this case, the new retail website is mistakenly categorized as
gambling by the content filter, which prevents users from accessing it. To resolve this issue, the
content filter’s categorization needs to be updated to reflect the correct category of the website,
such as shopping or retail. This will allow the content filter to allow access to the website instead of
blocking it.
An administrator discovers that some files on a database server were recently encrypted. The
administrator sees from the security logs that the data was last accessed by a domain user. Which of
the following best describes the type of attack that occurred?
A. Insider threat
B. Social engineering
C. Watering-hole
D. Unauthorized attacker
Answer: A
Explanation:
An insider threat is a type of attack that originates from someone who has legitimate access to an
organization’s network, systems, or data. In this case, the domain user who encrypted the files on the database server is an example of an insider threat, as they abused their access privileges to cause harm to the organization. Insider threats can be motivated by various factors, such as financial gain, revenge, espionage, or sabotage
Which of the following automation use cases would best enhance the security posture of an
organization by rapidly updating permissions when employees leave a company?
A. Provisioning resources
B. Disabling access
C. Reviewing change approvals
D. Escalating permission requests
Answer: B
Explanation:
Disabling access is an automation use case that would best enhance the security posture of an
organization by rapidly updating permissions when employees leave a company. Disabling access is
the process of revoking or suspending the access rights of a user account, such as login credentials,
email, VPN, cloud services, etc. Disabling access can prevent unauthorized or malicious use of the
account by former employees or attackers who may have compromised the account. Disabling access
can also reduce the attack surface and the risk of data breaches or leaks. Disabling access can be
automated by using scripts, tools, or workflows that can trigger the action based on predefined events, such as employee termination, resignation, or transfer. Automation can ensure that the access is disabled in a timely, consistent, and efficient manner, without relying on manual
intervention or human error.
Which of the following must be considered when designing a high-availability network? (Select two).
A. Ease of recovery
B. Ability to patch
C. Physical isolation
D. Responsiveness
E. Attack surface
F. Extensible authentication
Answer: AE
Explanation:
A high-availability network is a network that is designed to minimize downtime and ensure
continuous operation of critical services and applications. To achieve this goal, a high-availability
network must consider two important factors: ease of recovery and attack surface.
Ease of recovery refers to the ability of a network to quickly restore normal functionality after a
failure, disruption, or disaster. A high-availability network should have mechanisms such as
redundancy, failover, backup, and restore to ensure that any single point of failure does not cause a
complete network outage. A high-availability network should also have procedures and policies for incident response, disaster recovery, and business continuity to minimize the impact of any network
issue on the organization’s operations and reputation.
Which of the following methods to secure credit card data is best to use when a requirement is to
see only the last four numbers on a credit card?
A. Encryption
B. Hashing
C. Masking
D. Tokenization
Answer: C
Explanation:
Masking is a method to secure credit card data that involves replacing some or all of the digits with symbols, such as asterisks, dashes, or Xs, while leaving some of the original digits visible. Masking is best to use when a requirement is to see only the last four numbers on a credit card, as it can prevent
unauthorized access to the full card number, while still allowing identification and verification of the
cardholder. Masking does not alter the original data, unlike encryption, hashing, or tokenization,
which use algorithms to transform the data into different formats.
An administrator finds that all user workstations and servers are displaying a message that is
associated with files containing an extension of .ryk. Which of the following types of infections is
present on the systems?
A. Virus
B. Trojan
C. Spyware
D. Ransomware
Answer: D
Explanation:
Ransomware is a type of malware that encrypts the victim’s files and demands a ransom for the
decryption key. The ransomware usually displays a message on the infected system with instructions
on how to pay the ransom and recover the files. The .ryk extension is associated with a ransomware
variant called Ryuk, which targets large organizations and demands high ransoms
A healthcare organization wants to provide a web application that allows individuals to digitally
report health emergencies.
Which of the following is the most important consideration during development?
A. Scalability
B. Availability
C. Cost
D. Ease of deployment
Answer: B
Explanation:
Availability is the ability of a system or service to be accessible and usable when needed. For a web
application that allows individuals to digitally report health emergencies, availability is the most important consideration during development, because any downtime or delay could have serious
consequences for the health and safety of the users. The web application should be designed to handle high traffic, prevent denial-of-service attacks, and have backup and recovery plans in case of
failures
An organization wants a third-party vendor to do a penetration test that targets a specific device. The
organization has provided basic information about the device. Which of the following best describes
this kind of penetration test?
A. Partially known environment
B. Unknown environment
C. Integrated
D. Known environment
Answer: A
Explanation:
A partially known environment is a type of penetration test where the tester has some information
about the target, such as the IP address, the operating system, or the device type. This can help the
tester focus on specific vulnerabilities and reduce the scope of the test. A partially known
environment is also called a gray box test
An attacker posing as the Chief Executive Officer calls an employee and instructs the employee to
buy gift cards. Which of the following techniques is the attacker using?
A. Smishing
B. Disinformation
C. Impersonating
D. Whaling
Answer: D
Explanation:
Whaling is a type of phishing attack that targets high-profile individuals, such as executives,
celebrities, or politicians. The attacker impersonates someone with authority or influence and tries
to trick the victim into performing an action, such as transferring money, revealing sensitive
information, or clicking on a malicious link. Whaling is also called CEO fraud or business email
compromise
An analyst is evaluating the implementation of Zero Trust principles within the data plane. Which of
the following would be most relevant for the analyst to evaluate?
A. Secured zones
B. Subject role
C. Adaptive identity
D. Threat scope reduction
Answer: D
An organization is leveraging a VPN between its headquarters and a branch location. Which of the
following is the VPN protecting?
A. Data in use
B. Data in transit
C. Geographic restrictions
D. Data sovereignty
Answer: B
Explanation:
Data in transit is data that is moving from one location to another, such as over a network or through
the air. Data in transit is vulnerable to interception, modification, or theft by malicious actors. A VPN
(virtual private network) is a technology that protects data in transit by creating a secure tunnel
between two endpoints and encrypting the data that passes through it
The marketing department set up its own project management software without telling the
appropriate departments. Which of the following describes this scenario?
A. Shadow IT
B. Insider threat
C. Data exfiltration
D. Service disruption
Answer: A
Explanation:
Shadow IT is the term used to describe the use of unauthorized or unapproved IT resources within an
organization. The marketing department set up its own project management software without telling
the appropriate departments, such as IT, security, or compliance. This could pose a risk to the
organization’s security posture, data integrity, and regulatory compliance1
An enterprise is trying to limit outbound DNS traffic originating from its internal network. Outbound
DNS requests will only be allowed from one device with the IP address 10.50.10.25. Which of the
following firewall ACLs will accomplish this goal?
A. Access list outbound permit 0.0.0.0/0 0.0.0.0/0 port 53
Access list outbound deny 10.50.10.25/32 0.0.0.0/0 port 53
B. Access list outbound permit 0.0.0.0/0 10.50.10.25/32 port 53
Access list outbound deny 0.0.0.0/0 0.0.0.0/0 port 53
C. Access list outbound permit 0.0.0.0/0 0.0.0.0/0 port 53
Access list outbound deny 0.0.0.0/0 10.50.10.25/32 port 53
D. Access list outbound permit 10.50.10.25/32 0.0.0.0/0 port 53
Access list outbound deny 0.0.0.0/0 0.0.0.0/0 port 53
Answer: D
Explanation:
A firewall ACL (access control list) is a set of rules that determines which traffic is allowed or denied
by the firewall. The rules are processed in order, from top to bottom, until a match is found. The
syntax of a firewall ACL rule is:
Access list <direction> <action> <source></source> <destination> <protocol> <port>
To limit outbound DNS traffic originating from the internal network, the firewall ACL should allow
only the device with the IP address 10.50.10.25 to send DNS requests to any destination on port 53,
and deny all other outbound traffic on port 53. The correct firewall ACL is:
Access list outbound permit 10.50.10.25/32 0.0.0.0/0 port 53 Access list outbound deny 0.0.0.0/0
0.0.0.0/0 port 53
The first rule permits outbound traffic from the source address 10.50.10.25/32 (a single host) to any
destination address (0.0.0.0/0) on port 53 (DNS). The second rule denies all other outbound traffic on
port 53</port></protocol></destination></action></direction>
After a security incident, a systems administrator asks the company to buy a NAC platform. Which of
the following attack surfaces is the systems administrator trying to protect?
A. Bluetooth
B. Wired
C. NFC
D. SCADA
Answer: B
Explanation:
A NAC (network access control) platform is a technology that enforces security policies on devices
that attempt to access a network. A NAC platform can verify the identity, role, and compliance of the
devices, and grant or deny access based on predefined rules. A NAC platform can protect both wired
and wireless networks, but in this scenario, the systems administrator is trying to protect the wired
attack surface, which is the set of vulnerabilities that can be exploited through a physical connection
to the network
Which of the following factors are the most important to address when formulating a training
curriculum plan for a security awareness program? (Select two).
A. Channels by which the organization communicates with customers
B. The reporting mechanisms for ethics violations
C. Threat vectors based on the industry in which the organization operates
D. Secure software development training for all personnel
E. Cadence and duration of training events
F. Retraining requirements for individuals who fail phishing simulations
Answer: CE
Explanation:
A training curriculum plan for a security awareness program should address the following factors:
The threat vectors based on the industry in which the organization operates. This will help the
employees to understand the specific risks and challenges that their organization faces, and how to
protect themselves and the organization from cyberattacks. For example, a healthcare organization
may face different threat vectors than a financial organization, such as ransomware, data breaches,
or medical device hacking.
The cadence and duration of training events. This will help the employees to retain the information
and skills they learn, and to keep up with the changing security landscape. The training events should
be frequent enough to reinforce the key concepts and behaviors, but not too long or too short to lose
the attention or interest of the employees.
An organization disabled unneeded services and placed a firewall in front of a business-critical legacy
system. Which of the following best describes the actions taken by the organization?
A. Exception
B. Segmentation
C. Risk transfer
D. Compensating controls
Answer: D
Which of the following is the best reason to complete an audit in a banking environment?
A. Regulatory requirement
B. Organizational change
C. Self-assessment requirement
D. Service-level requirement
Answer: A
Explanation:
A regulatory requirement is a mandate imposed by a government or an authority that must be
followed by an organization or an individual. In a banking environment, audits are often required by
regulators to ensure compliance with laws, standards, and policies related to security, privacy, and
financial reporting. Audits help to identify and correct any gaps or weaknesses in the security posture
and the internal controls of the organization.
A security administrator is deploying a DLP solution to prevent the exfiltration of sensitive customer
dat
a. Which of the following should the administrator do first?
A. Block access to cloud storage websites.
B. Create a rule to block outgoing email attachments.
C. Apply classifications to the data.
D. Remove all user permissions from shares on the file server.
Answer: C
Explanation:
Data classification is the process of assigning labels or tags to data based on its sensitivity, value, and
risk. Data classification is the first step in a data loss prevention (DLP) solution, as it helps to identify
what data needs to be protected and how. By applying classifications to the data, the security
administrator can define appropriate policies and rules for the DLP solution to prevent the
exfiltration of sensitive customer data
Which of the following describes a security alerting and monitoring tool that collects system,
application, and network logs from multiple sources in a centralized system?
A. SIEM
B. DLP
C. IDS
D. SNMP
Answer: A
Explanation:
SIEM stands for Security Information and Event Management. It is a security alerting and monitoring
tool that collects system, application, and network logs from multiple sources in a centralized
system. SIEM can analyze the collected data, correlate events, generate alerts, and provide reports
and dashboards. SIEM can also integrate with other security tools and support compliance
requirements. SIEM helps organizations to detect and respond to cyber threats, improve security
posture, and reduce operational costs
Which of the following are cases in which an engineer should recommend the decommissioning of a
network device? (Select two).
A. The device has been moved from a production environment to a test environment.
B. The device is configured to use cleartext passwords.
C. The device is moved to an isolated segment on the enterprise network.
D. The device is moved to a different location in the enterprise.
E. The device’s encryption level cannot meet organizational standards.
F. The device is unable to receive authorized updates.
Answer: EF
Explanation:
An engineer should recommend the decommissioning of a network device when the device poses a
security risk or a compliance violation to the enterprise environment. A device that cannot meet the
encryption standards or receive authorized updates is vulnerable to attacks and breaches, and may
expose sensitive data or compromise network integrity. Therefore, such a device should be removed
from the network and replaced with a more secure and updated one.
An administrator assists the legal and compliance team with ensuring information about customer
transactions is archived for the proper time period. Which of the following data policies is the
administrator carrying out?
A. Compromise
B. Retention
C. Analysis
D. Transfer
E. Inventory
Answer: B
Explanation:
A data retention policy is a set of rules that defines how long data should be stored and when it
should be deleted or archived. An administrator assists the legal and compliance team with ensuring
information about customer transactions is archived for the proper time period by following the data retention policy of the organization. This policy helps the organization to comply with legal and
regulatory requirements, optimize storage space, and protect data privacy and security
A systems administrator is working on a solution with the following requirements:
* Provide a secure zone.
* Enforce a company-wide access control policy.
* Reduce the scope of threats.
Which of the following is the systems administrator setting up?
A. Zero Trust
B. AAA
C. Non-repudiation
D. CIA
Answer: A
Explanation:
Zero Trust is a security model that assumes no trust for any entity inside or outside the network
perimeter and requires continuous verification of identity and permissions. Zero Trust can provide a
secure zone by isolating and protecting sensitive data and resources from unauthorized access. Zero
Trust can also enforce a company-wide access control policy by applying the principle of least
privilege and granular segmentation for users, devices, and applications. Zero Trust can reduce the
scope of threats by preventing lateral movement and minimizing the attack surface.
A security administrator needs a method to secure data in an environment that includes some form
of checks so that the administrator can track any changes. Which of the following should the
administrator set up to achieve this goal?
A. SPF
B. GPO
C. NAC
D. FIM
Answer: D
Explanation:
FIM stands for File Integrity Monitoring, which is a method to secure data by detecting any changes
or modifications to files, directories, or registry keys. FIM can help a security administrator track any
unauthorized or malicious changes to the data, as well as verify the integrity and compliance of the
data. FIM can also alert the administrator of any potential breaches or incidents involving the data.
Some of the benefits of FIM are:
It can prevent data tampering and corruption by verifying the checksums or hashes of the files.
It can identify the source and time of the changes by logging the user and system actions.
It can enforce security policies and standards by comparing the current state of the data with the
baseline or expected state.
It can support forensic analysis and incident response by providing evidence and audit trails of the changes.
Which of the following is the phase in the incident response process when a security analyst reviews
roles and responsibilities?
A. Preparation
B. Recovery
C. Lessons learned
D. Analysis
Answer: A
Explanation:
Preparation is the phase in the incident response process when a security analyst reviews roles and
responsibilities, as well as the policies and procedures for handling incidents. Preparation also involves gathering and maintaining the necessary tools, resources, and contacts for responding to incidents. Preparation can help a security analyst to be ready and proactive when an incident occurs,
as well as to reduce the impact and duration of the incident
A company is discarding a classified storage array and hires an outside vendor to complete the
disposal. Which of the following should the company request from the vendor?
A. Certification
B. Inventory list
C. Classification
D. Proof of ownership
Answer: A
Explanation:
The company should request a certification from the vendor that confirms the storage array has been
disposed of securely and in compliance with the company’s policies and standards. A certification
provides evidence that the vendor has followed the proper procedures and methods to destroy the classified data and prevent unauthorized access or recovery
Which of the following would be the best ways to ensure only authorized personnel can access a
secure facility? (Select two).
A. Fencing
B. Video surveillance
C. Badge access
D. Access control vestibule
E. Sign-in sheet
F. Sensor
Answer: CD
Explanation:
Badge access and access control vestibule are two of the best ways to ensure only authorized
personnel can access a secure facility. Badge access requires the personnel to present a valid and authenticated badge to a reader or scanner that grants or denies access based on predefined rules and permissions. Access control vestibule is a physical security measure that consists of a small room or chamber with two doors, one leading to the outside and one leading to the secure area. The personnel must enter the vestibule and wait for the first door to close and lock before the second door can be opened. This prevents tailgating or piggybacking by unauthorized individuals.
A company’s marketing department collects, modifies, and stores sensitive customer dat
a. The infrastructure team is responsible for securing the data while in transit and at rest. Which of
the following data roles describes the customer?
A. Processor
B. Custodian
C. Subject
D. Owner
Answer: C
Explanation:
According to the CompTIA Security+ SY0-701 Certification Study Guide, data subjects are the
individuals whose personal data is collected, processed, or stored by an organization. Data subjects
have certain rights and expectations regarding how their data is handled, such as the right to access,
correct, delete, or restrict their data. Data subjects are different from data owners, who are the
individuals or entities that have the authority and responsibility to determine how data is classified,
protected, and used. Data subjects are also different from data processors, who are the individuals or
entities that perform operations on data on behalf of the data owner, such as collecting, modifying,
storing, or transmitting data. Data subjects are also different from data custodians, who are the
individuals or entities that implement the security controls and procedures specified by the data
owner to protect data while in transit and at rest.
Malware spread across a company’s network after an employee visited a compromised industry blog.
Which of the following best describes this type of attack?
A. Impersonation
B. Disinformation
C. Watering-hole
D. Smishing
Answer: C
Explanation:
A watering-hole attack is a type of cyberattack that targets groups of users by infecting websites that
they commonly visit. The attackers exploit vulnerabilities to deliver a malicious payload to the
organization’s network. The attack aims to infect users’ computers and gain access to a connected
corporate network. The attackers target websites known to be popular among members of a
particular organization or demographic. The attack differs from phishing and spear-phishing attacks,
which typically attempt to steal data or install malware onto users’ devices
After a recent ransomware attack on a company’s system, an administrator reviewed the log files.
Which of the following control types did the administrator use?
A. Compensating
B. Detective
C. Preventive
D. Corrective
Answer: B
Explanation:
Detective controls are security measures that are designed to identify and monitor any malicious
activity or anomalies on a system or network. They can help to discover the source, scope, and
impact of an attack, and provide evidence for further analysis or investigation. Detective controls
include log files, security audits, intrusion detection systems, network monitoring tools, and antivirus
software. In this case, the administrator used log files as a detective control to review the
ransomware attack on the company’s system. Log files are records of events and activities that occur
on a system or network, such as user actions, system errors, network traffic, and security alerts. They
can provide valuable information for troubleshooting, auditing, and forensics
Which of the following agreement types defines the time frame in which a vendor needs to respond?
A. SOW
B. SLA
C. MOA
D. MOU
Answer: B
Explanation:
A service level agreement (SLA) is a type of agreement that defines the expectations and
responsibilities between a service provider and a customer. It usually includes the quality,
availability, and performance metrics of the service, as well as the time frame in which the provider
needs to respond to service requests, incidents, or complaints. An SLA can help ensure that the
customer receives the desired level of service and that the provider is accountable for meeting the
agreed-upon standards.
A Chief Information Security Officer wants to monitor the company’s servers for SQLi attacks and
allow for comprehensive investigations if an attack occurs. The company uses SSL decryption to allow
traffic monitoring. Which of the following strategies would best accomplish this goal?
A. Logging all NetFlow traffic into a SIEM
B. Deploying network traffic sensors on the same subnet as the servers
C. Logging endpoint and OS-specific security logs
D. Enabling full packet capture for traffic entering and exiting the servers
Answer: D
Explanation:
Questions and Answers PDF 118/297
Full packet capture is a technique that records all network traffic passing through a device, such as a router or firewall. It allows for detailed analysis and investigation of network events, such as SQLi attacks, by providing the complete content and context of the packets. Full packet capture can help
identify the source, destination, payload, and timing of an SQLi attack, as well as the impact on the server and database. Logging NetFlow traffic, network traffic sensors, and endpoint and OS-specific security logs can provide some information about network activity, but they do not capture the full content of the packets, which may limit the scope and depth of the investigation.
A client demands at least 99.99% uptime from a service provider’s hosted security services. Which of
the following documents includes the information the service provider should return to the client?
A. MOA
B. SOW
C. MOU
D. SLA
Answer: D
Explanation:
A service level agreement (SLA) is a document that defines the level of service expected by a
customer from a service provider, indicating the metrics by which that service is measured, and the
remedies or penalties, if any, should the agreed-upon levels not be achieved. An SLA can specify the
minimum uptime or availability of a service, such as 99.99%, and the consequences for failing to
meet that standard. A memorandum of agreement (MOA), a statement of work (SOW), and a
memorandum of understanding (MOU) are other types of documents that can be used to establish a
relationship between parties, but they do not typically include the details of service levels and
performance metrics that an SLA does.
A company is adding a clause to its AUP that states employees are not allowed to modify the
operating system on mobile devices. Which of the following vulnerabilities is the organization
addressing?
A. Cross-site scripting
B. Buffer overflow
C. Jailbreaking
D. Side loading
Answer: C
Explanation:
Jailbreaking is the process of removing the restrictions imposed by the manufacturer or carrier on a
mobile device, such as an iPhone or iPad. Jailbreaking allows users to install unauthorized
applications, modify system settings, and access root privileges. However, jailbreaking also exposes
the device to potential security risks, such as malware, spyware, unauthorized access, data loss, and
voided warranty. Therefore, an organization may prohibit employees from jailbreaking their mobile
devices to prevent these vulnerabilities and protect the corporate data and network.
Which of the following practices would be best to prevent an insider from introducing malicious code
into a company’s development process?
A. Code scanning for vulnerabilities
B. Open-source component usage
C. Quality assurance testing
D. Peer review and approval
Answer: D
Explanation:
Peer review and approval is a practice that involves having other developers or experts review the
code before it is deployed or released. Peer review and approval can help detect and prevent
malicious code, errors, bugs, vulnerabilities, and poor quality in the development process. Peer
review and approval can also enforce coding standards, best practices, and compliance
requirements. Peer review and approval can be done manually or with the help of tools, such as code
analysis, code review, and code signing.
A systems administrator is creating a script that would save time and prevent human error when
performing account creation for a large number of end users. Which of the following would be a
good use case for this task?
A. Off-the-shelf software
B. Orchestration
C. Baseline
D. Policy enforcement
Answer: B
Explanation:
Orchestration is the process of automating multiple tasks across different systems and applications. It
can help save time and reduce human error by executing predefined workflows and scripts. In this
case, the systems administrator can use orchestration to create accounts for a large number of end
users without having to manually enter their information and assign
permissions.
After an audit, an administrator discovers all users have access to confidential data on a file server.
Which of the following should the administrator use to restrict access to the data quickly?
A. Group Policy
B. Content filtering
C. Data loss prevention
D. Access control lists
Answer: D
Explanation:
Access control lists (ACLs) are rules that specify which users or groups can access which resources on a file server. They can help restrict access to confidential data by granting or denying permissions
based on the identity or role of the user. In this case, the administrator can use ACLs to quickly
modify the access rights of the users and prevent them from accessing the data they are not
authorized to see.
A Chief Information Security Officer (CISO) wants to explicitly raise awareness about the increase of
ransomware-as-a-service in a report to the management team. Which of the following best describes
the threat actor in the CISO’s report?
A. Insider threat
B. Hacktivist
C. Nation-state
D. Organized crime
Answer: D
Explanation:
Ransomware-as-a-service is a type of cybercrime where hackers sell or rent ransomware tools or
services to other criminals who use them to launch attacks and extort money from victims. This is a
typical example of organized crime, which is a group of criminals who work together to conduct
illegal activities for profit. Organized crime is different from other types of threat actors, such as
insider threats, hacktivists, or nation-states, who may have different motives, methods, or
targets
A small business uses kiosks on the sales floor to display product information for customers. A
security team discovers the kiosks use end-of-life operating systems. Which of the following is the
security team most likely to document as a security implication of the current architecture?
A. Patch availability
B. Product software compatibility
C. Ease of recovery
D. Cost of replacement
Answer: A
Explanation:
End-of-life operating systems are those that are no longer supported by the vendor or manufacturer,
meaning they do not receive any security updates or patches. This makes them vulnerable to exploits and attacks that take advantage of known or unknown flaws in the software. Patch availability is the
security implication of using end-of-life operating systems, as it affects the ability to fix or prevent security issues. Other factors, such as product software compatibility, ease of recovery, or cost of replacement, are not directly related to security, but rather to functionality, availability, or budget.
A company is developing a critical system for the government and storing project information on a
fileshare. Which of the following describes how this data will most likely be classified? (Select two).
A. Private
B. Confidential
C. Public
D. Operational
E. Urgent
F. Restricted
Answer: BF
Explanation:
Data classification is the process of assigning labels to data based on its sensitivity and business
impact. Different organizations and sectors may have different data classification schemes, but a
common one is the following1:
Public: Data that can be freely disclosed to anyone without any harm or risk.
Private: Data that is intended for internal use only and may cause some harm or risk if disclosed.
Confidential: Data that is intended for authorized use only and may cause significant harm or risk if
disclosed.
Restricted: Data that is intended for very limited use only and may cause severe harm or risk if
disclosed
After reviewing the following vulnerability scanning report:
Server:192.168.14.6
Service: Telnet
Port: 23 Protocol: TCP
Status: Open Severity: High
Vulnerability: Use of an insecure network protocol
A security analyst performs the following test:
nmap -p 23 192.168.14.6 —script telnet-encryption
PORT STATE SERVICE REASON
23/tcp open telnet syn-ack
I telnet encryption:
| _ Telnet server supports encryption
Which of the following would the security analyst conclude for this reported vulnerability?
A. It is a false positive.
B. A rescan is required.
C. It is considered noise.
D. Compensating controls exist.
Answer: A
Explanation:
Questions and Answers PDF 125/297
A false positive is a result that indicates a vulnerability or a problem when there is none. In this case,
the vulnerability scanning report shows that the telnet service on port 23 is open and uses an
insecure network protocol. However, the security analyst performs a test using nmap and a script
that checks for telnet encryption support. The result shows that the telnet server supports
encryption, which means that the data transmitted between the client and the server can be
protected from eavesdropping. Therefore, the reported vulnerability is a false positive and does not
reflect the actual security posture of the server. The security analyst should verify the encryption
settings of the telnet server and client and ensure that they are configured properly
A security consultant needs secure, remote access to a client environment. Which of the following
should the security consultant most likely use to gain access?
A. EAP
B. DHCP
C. IPSec
D. NAT
Answer: C
Explanation:
IPSec is a protocol suite that provides secure communication over IP networks. IPSec can be used to
create virtual private networks (VPNs) that encrypt and authenticate the data exchanged between
two or more parties. IPSec can also provide data integrity, confidentiality, replay protection, and
access control. A security consultant can use IPSec to gain secure, remote access to a client
environment by establishing a VPN tunnel with the client’s network.
Which of the following best practices gives administrators a set period to perform changes to an
operational system to ensure availability and minimize business impacts?
A. Impact analysis
B. Scheduled downtime
C. Backout plan
D. Change management boards
Answer: B
Explanation:
Scheduled downtime is a planned period of time when a system or service is unavailable for
maintenance, updates, upgrades, or other changes. Scheduled downtime gives administrators a set
period to perform changes to an operational system without disrupting the normal business
operations or affecting the availability of the system or service. Scheduled downtime also allows
administrators to inform the users and stakeholders about the expected duration and impact of the
changes.
Which of the following actions could a security engineer take to ensure workstations and servers are
properly monitored for unauthorized changes and software?
A. Configure all systems to log scheduled tasks.
B. Collect and monitor all traffic exiting the network.
C. Block traffic based on known malicious signatures.
D. Install endpoint management software on all systems.
Answer: D
Explanation:
Endpoint management software is a tool that allows security engineers to monitor and control the
configuration, security, and performance of workstations and servers from a central console.
Endpoint management software can help detect and prevent unauthorized changes and software
installations, enforce policies and compliance, and provide reports and alerts on the status of the
endpoints. The other options are not as effective or comprehensive as endpoint management
software for this purpose.
After a security awareness training session, a user called the IT help desk and reported a suspicious
call. The suspicious caller stated that the Chief Financial Officer wanted credit card information in
order to close an invoice. Which of the following topics did the user recognize from the training?
A. Insider threat
B. Email phishing
C. Social engineering
D. Executive whaling
Answer: C
Explanation:
Social engineering is the practice of manipulating people into performing actions or divulging
confidential information, often by impersonating someone else or creating a sense of urgency or
trust. The suspicious caller in this scenario was trying to use social engineering to trick the user into
giving away credit card information by pretending to be the CFO and asking for a payment. The user
recognized this as a potential scam and reported it to the IT help desk.
Which of the following exercises should an organization use to improve its incident response
process?
A. Tabletop
B. Replication
C. Failover
D. Recovery
Answer: A
Explanation:
A tabletop exercise is a simulated scenario that tests the organization’s incident response plan and
procedures. It involves key stakeholders and decision-makers who discuss their roles and actions in
response to a hypothetical incident. It can help identify gaps, weaknesses, and improvement areas in
the incident response process.
Which of the following is used to validate a certificate when it is presented to a user?
A. OCSP
B. CSR
C. CA
D. CRC
Answer: A
Explanation:
OCSP stands for Online Certificate Status Protocol. It is a protocol that allows applications to check
the revocation status of a certificate in real-time. It works by sending a query to an OCSP responder,
which is a server that maintains a database of revoked certificates. The OCSP responder returns a
response that indicates whether the certificate is valid, revoked, or unknown.
A newly identified network access vulnerability has been found in the OS of legacy loT devices.
Which of the following would best mitigate this vulnerability quickly?
A. Insurance
B. Patching
C. Segmentation
D. Replacement
Answer: C
Explanation:
Segmentation is a technique that divides a network into smaller subnetworks or segments, each with
its own security policies and controls. Segmentation can help mitigate network access vulnerabilities
in legacy loT devices by isolating them from other devices and systems, reducing their attack surface
and limiting the potential impact of a breach.
A bank insists all of its vendors must prevent data loss on stolen laptops. Which of the following
strategies is the bank requiring?
A. Encryption at rest
B. Masking
C. Data classification
D. Permission restrictions
Answer: A
Explanation:
Encryption at rest is a strategy that protects data stored on a device, such as a laptop, by converting it
into an unreadable format that can only be accessed with a decryption key or password. Encryption
at rest can prevent data loss on stolen laptops by preventing unauthorized access to the data, even if
the device is physically compromised. Encryption at rest can also help comply with data privacy
regulations and standards that require data protection.
Which of the following would be best suited for constantly changing environments?
A. RTOS
B. Containers
C. Embedded systems
D. SCADA
Answer: B
Explanation:
Containers are a method of virtualization that allows applications to run in isolated environments
with their own dependencies, libraries, and configurations. Containers are best suited for constantly
changing environments because they are lightweight, portable, scalable, and easy to deploy and
update.
A security analyst scans a company’s public network and discovers a host is running a remote
desktop that can be used to access the production network. Which of the following changes should
the security analyst recommend?
A. Changing the remote desktop port to a non-standard number
B. Setting up a VPN and placing the jump server inside the firewall
C. Using a proxy for web connections from the remote desktop server
D. Connecting the remote server to the domain and increasing the password length
Answer: B
Explanation:
A VPN is a virtual private network that creates a secure tunnel between two or more devices over a
public network. A VPN can encrypt and authenticate the data, as well as hide the IP addresses and
locations of the devices.
Which of the following involves an attempt to take advantage of database misconfigurations?
A. Buffer overflow
B. SQL injection
C. VM escape
D. Memory injection
Answer: B
Explanation:
SQL injection is a type of attack that exploits a database misconfiguration or a flaw in the application
code that interacts with the database. An attacker can inject malicious SQL statements into the user
input fields or the URL parameters that are sent to the database server. These statements can then
execute unauthorized commands, such as reading, modifying, deleting, or creating data, or even
taking over the database server
An organization would like to store customer data on a separate part of the network that is not
accessible to users on the main corporate network. Which of the following should the administrator
use to accomplish this goal?
A. Segmentation
B. Isolation
C. Patching
D. Encryption
Answer: A
Explanation:
Segmentation is a network design technique that divides the network into smaller and isolated
segments based on logical or physical boundaries. Segmentation can help improve network security
by limiting the scope of an attack, reducing the attack surface, and enforcing access control policies.
Segmentation can also enhance network performance, scalability, and manageability.
Which of the following is used to quantitatively measure the criticality of a vulnerability?
A. CVE
B. CVSS
C. CIA
D. CERT
Answer: B
Explanation:
CVSS stands for Common Vulnerability Scoring System, which is a framework that provides a
standardized way to assess and communicate the severity and risk of vulnerabilities. CVSS uses a set of metrics and formulas to calculate a numerical score ranging from 0 to 10, where higher scores indicate higher criticality. CVSS can help organizations prioritize remediation efforts and compare vulnerabilities across different systems and vendors.
A technician is opening ports on a firewall for a new system being deployed and supported by a SaaS
provider. Which of the following is a risk in the new system?
A. Default credentials
B. Non-segmented network
C. Supply chain vendor
D. Vulnerable software
Answer: C
Explanation:
A supply chain vendor is a third-party entity that provides goods or services to an organization, such
as a SaaS provider. A supply chain vendor can pose a risk to the new system if the vendor has poor security practices, breaches, or compromises that could affect the confidentiality, integrity, or
availability of the system or its data.
Which of the following security concepts is the best reason for permissions on a human resources
fileshare to follow the principle of least privilege?
A. Integrity
B. Availability
C. Confidentiality
D. Non-repudiation
Answer: C
Explanation:
Confidentiality is the security concept that ensures data is protected from unauthorized access or disclosure. The principle of least privilege is a technique that grants users or systems the minimum level of access or permissions that they need to perform their tasks, and nothing more. By applying the principle of least privilege to a human resources fileshare, the permissions can be restricted to
only those who have a legitimate need to access the sensitive data, such as HR staff, managers, or
auditors.
Security controls in a data center are being reviewed to ensure data is properly protected and that
human life considerations are included. Which of the following best describes how the controls
should be set up?
A. Remote access points should fail closed.
B. Logging controls should fail open.
C. Safety controls should fail open.
D. Logical security controls should fail closed.
Answer: C
Explanation:
Safety controls are security controls that are designed to protect human life and physical assets from
harm or damage. Examples of safety controls include fire alarms, sprinklers, emergency exits, backup
generators, and surge protectors. Safety controls should fail open, which means that they should
remain operational or allow access when a failure or error occurs. Failing open can prevent or
minimize the impact of a disaster, such as a fire, flood, earthquake, or power outage, on human life and physical assets. For example, if a fire alarm fails, it should still trigger the sprinklers and unlock
the emergency exits, rather than remain silent and locked.
Which of the following is the most common data loss path for an air-gapped network?
A. Bastion host
B. Unsecured Bluetooth
C. Unpatched OS
D. Removable devices
Answer: D
Explanation:
An air-gapped network is a network that is physically isolated from other networks, such as the
internet, to prevent unauthorized access and data leakage. However, an air-gapped network can still be compromised by removable devices, such as USB drives, CDs, DVDs, or external hard drives, that are used to transfer data between the air-gapped network and other networks.
Which of the following can best protect against an employee inadvertently installing malware on a
company system?
A. Host-based firewall
B. System isolation
C. Least privilege
D. Application allow list
Answer: D
Explanation:
An application allow list is a security technique that specifies which applications are authorized to
run on a system and blocks all other applications. An application allow list can best protect against an
employee inadvertently installing malware on a company system because it prevents the execution
of any unauthorized or malicious software, such as viruses, worms, trojans, ransomware, or
spyware.
An organization is struggling with scaling issues on its VPN concentrator and internet circuit due to
remote work. The organization is looking for a software solution that will allow it to reduce traffic on
the VPN and internet circuit, while still providing encrypted tunnel access to the data center and
monitoring of remote employee internet traffic. Which of the following will help achieve these
objectives?
A. Deploying a SASE solution to remote employees
B. Building a load-balanced VPN solution with redundant internet
C. Purchasing a low-cost SD-WAN solution for VPN traffic
D. Using a cloud provider to create additional VPN concentrators
Answer: A
Explanation:
SASE stands for Secure Access Service Edge. It is a cloud-based service that combines network and
security functions into a single integrated solution. SASE can help reduce traffic on the VPN and
internet circuit by providing secure and optimized access to the data center and cloud applications for remote employees. SASE can also monitor and enforce security policies on the remote employee
internet traffic, regardless of their location or device
A company’s end users are reporting that they are unable to reach external websites. After reviewing
the performance data for the DNS severs, the analyst discovers that the CPU, disk, and memory
usage are minimal, but the network interface is flooded with inbound traffic. Network logs show only
a small number of DNS queries sent to this server. Which of the following best describes what the
security analyst is seeing?
A. Concurrent session usage
B. Secure DNS cryptographic downgrade
C. On-path resource consumption
D. Reflected denial of service
Answer: D
Explanation:
A reflected denial of service (RDoS) attack is a type of DDoS attack that uses spoofed source IP
addresses to send requests to a third-party server, which then sends responses to the victim server. The attacker exploits the difference in size between the request and the response, which can amplify the amount of traffic sent to the victim server. The attacker also hides their identity by using the victim’s IP address as the source. A RDoS attack can target DNS servers by sending forged DNS queries that generate large DNS responses.
A systems administrator wants to prevent users from being able to access data based on their
responsibilities. The administrator also wants to apply the required access structure via a simplified
format. Which of the following should the administrator apply to the site recovery resource group?
A. RBAC
B. ACL
C. SAML
D. GPO
Answer: A
Explanation:
RBAC stands for Role-Based Access Control, which is a method of restricting access to data and resources based on the roles or responsibilities of users. RBAC simplifies the management of
permissions by assigning roles to users and granting access rights to roles, rather than to individual
users. RBAC can help enforce the principle of least privilege and reduce the risk of unauthorized
access or data leakage.
One of a company’s vendors sent an analyst a security bulletin that recommends a BIOS update.
Which of the following vulnerability types is being addressed by the patch?
A. Virtualization
B. Firmware
C. Application
D. Operating system
Answer: B
Explanation:
Firmware is a type of software that is embedded in hardware devices, such as BIOS, routers, printers,
or cameras. Firmware controls the basic functions and operations of the device, and can be updated or patched to fix bugs, improve performance, or enhance security. Firmware vulnerabilities are flaws
or weaknesses in the firmware code that can be exploited by attackers to gain unauthorized access,
modify settings, or cause damage to the device or the network.
A security analyst locates a potentially malicious video file on a server and needs to identify both the
creation date and the file’s creator. Which of the following actions would most likely give the security
analyst the information required?
A. Obtain the file’s SHA-256 hash.
B. Use hexdump on the file’s contents.
C. Check endpoint logs.
D. Query the file’s metadata.
Answer: D
Explanation:
Metadata is data that describes other data, such as its format, origin, creation date, author, and
other attributes. Video files, like other types of files, can contain metadata that can provide useful
information for forensic analysis. For example, metadata can reveal the camera model, location, date and time, and software used to create or edit the video file.
After a recent vulnerability scan, a security engineer needs to harden the routers within the
corporate network. Which of the following is the most appropriate to disable?
A. Console access
B. Routing protocols
C. VLANs
D. Web-based administration
Answer: D
Explanation:
Web-based administration is a feature that allows users to configure and manage routers through a
web browser interface. While this feature can provide convenience and ease of use, it can also pose a security risk, especially if the web interface is exposed to the internet or uses weak authentication or encryption methods. Web-based administration can be exploited by attackers to gain unauthorized access to the router’s settings, firmware, or data, or to launch attacks such as cross-site scripting (XSS) or cross-site request forgery (CSRF)
Which of the following should a systems administrator use to ensure an easy deployment of
resources within the cloud provider?
A. Software as a service
B. Infrastructure as code
C. Internet of Things
D. Software-defined networking
Answer: B
Explanation:
Infrastructure as code (IaC) is a method of using code and automation to manage and provision cloud resources, such as servers, networks, storage, and applications. IaC allows for easy deployment,
scalability, consistency, and repeatability of cloud environments. IaC is also a key component of
DevSecOps, which integrates security into the development and operations processes
An enterprise has been experiencing attacks focused on exploiting vulnerabilities in older browser
versions with well-known exploits. Which of the following security solutions should be configured to
best provide the ability to monitor and block these known signature-based attacks?
A. ACL
B. DLP
C. IDS
D. IPS
Answer: D
Explanation:
An intrusion prevention system (IPS) is a security device that monitors network traffic and blocks or modifies malicious packets based on predefined rules or signatures. An IPS can prevent attacks that
exploit known vulnerabilities in older browser versions by detecting and dropping the malicious
packets before they reach the target system. An IPS can also perform other functions, such as rate
limiting, encryption, or redirection.
During the onboarding process, an employee needs to create a password for an intranet account. The
password must include ten characters, numbers, and letters, and two special characters. Once the password is created, the company will grant the employee access to other company-owned websites based on the intranet profile. Which of the following access management concepts is the company most likely using to safeguard intranet accounts and grant access to multiple sites based on a user’s
intranet account? (Select two).
A. Federation
B. Identity proofing
C. Password complexity
D. Default password changes
E. Password manager
F. Open authentication
Answer: AC
Explanation:
Federation is an access management concept that allows users to authenticate once and access multiple resources or services across different domains or organizations. Federation relies on a
trusted third party that stores the user’s credentials and provides them to the requested resources or services without exposing them. Password complexity is a security measure that requires users to
create passwords that meet certain criteria, such as length, character types, and uniqueness. Password complexity can help prevent brute-force attacks, password guessing, and
credential stuffing by making passwords harder to crack or guess.
An administrator is reviewing a single server’s security logs and discovers the following;
Which of the following best describes the action captured in this log file?
A. Brute-force attack
B. Privilege escalation
C. Failed password audit
D. Forgotten password by the user
Answer: A
Explanation:
A brute-force attack is a type of attack that involves systematically trying all possible combinations of
passwords or keys until the correct one is found. The log file shows multiple failed login attempts in a
short amount of time, which is a characteristic of a brute-force attack. The attacker is trying to guess
the password of the Administrator account on the server. The log file also shows the event ID 4625,
which indicates a failed logon attempt, and the status code 0xC000006A, which means the user
name is correct but the password is wrong. These are indicators of compromise (IoC) that suggest a brute-force attack is taking place
A security engineer is implementing FDE for all laptops in an organization. Which of the following are
the most important for the engineer to consider as part of the planning process? (Select two).
A. Key escrow
B. TPM presence
C. Digital signatures
D. Data tokenization
E. Public key management
F. Certificate authority linking
Answer: AB
Explanation:
Key escrow is a method of storing encryption keys in a secure location, such as a trusted third party
or a hardware security module (HSM). Key escrow is important for FDE because it allows the recovery of encrypted data in case of lost or forgotten passwords, device theft, or hardware failure. Key
escrow also enables authorized access to encrypted data for legal or forensic purposes.
TPM presence is a feature of some laptops that have a dedicated chip for storing encryption keys and other security information. TPM presence is important for FDE because it enhances the security and performance of encryption by generating and protecting the keys within the chip, rather than relying
on software or external devices. TPM presence also enables features such as secure boot, remote
attestation, and device authentication.
A hacker gained access to a system via a phishing attempt that was a direct result of a user clicking a
suspicious link. The link laterally deployed ransomware, which laid dormant for multiple weeks,
across the network. Which of the following would have mitigated the spread?
A. IPS
B. IDS
C. WAF
D. UAT
Answer: A
Explanation:
IPS stands for intrusion prevention system, which is a network security device that monitors and
blocks malicious traffic in real time. IPS is different from IDS, which only detects and alerts on
malicious traffic, but does not block it. IPS would have mitigated the spread of ransomware by
preventing the hacker from accessing the system via the phishing link, or by stopping the
ransomware from communicating with its command and control server or encrypting the files.
A user is attempting to patch a critical system, but the patch fails to transfer. Which of the following
access controls is most likely inhibiting the transfer?
A. Attribute-based
B. Time of day
C. Role-based
D. Least privilege
Answer: D
Explanation:
The least privilege principle states that users and processes should only have the minimum level of
access required to perform their tasks. This helps to prevent unauthorized or unnecessary actions
that could compromise security. In this case, the patch transfer might be failing because the user or
process does not have the appropriate permissions to access the critical system or the network
resources needed for the transfer. Applying the least privilege principle can help to avoid this issue
by granting the user or process the necessary access rights for the patching activity.
Which of the following is used to protect a computer from viruses, malware, and Trojans being
installed and moving laterally across the network?
A. IDS
B. ACL
C. EDR
D. NAC
Answer: C
Explanation:
Endpoint detection and response (EDR) is a technology that monitors and analyzes the activity and behavior of endpoints, such as computers, laptops, mobile devices, and servers. EDR can help to detect and prevent malicious software, such as viruses, malware, and Trojans, from infecting the
endpoints and spreading across the network. EDR can also provide visibility and response capabilities
to contain and remediate threats
A systems administrator set up a perimeter firewall but continues to notice suspicious connections between internal endpoints. Which of the following should be set up in order to mitigate the threat posed by the suspicious activity?
A. Host-based firewall
B. Web application firewall
C. Access control list
D. Application allow list
Answer: A
Explanation:
A host-based firewall is a software application that runs on an individual endpoint and filters the
incoming and outgoing network traffic based on a set of rules. A host-based firewall can help to
mitigate the threat posed by suspicious connections between internal endpoints by blocking or
allowing the traffic based on the source, destination, port, protocol, or application. A host-based
firewall is different from a web application firewall, which is a type of firewall that protects web
applications from common web-based attacks, such as SQL injection, cross-site scripting, and session
hijacking
A business received a small grant to migrate its infrastructure to an off-premises solution. Which of the following should be considered first?
A. Security of cloud providers
B. Cost of implementation
C. Ability of engineers
D. Security of architecture
Answer: D
Explanation:
Security of architecture is the process of designing and implementing a secure infrastructure that
meets the business objectives and requirements. Security of architecture should be considered first
when migrating to an off-premises solution, such as cloud computing, because it can help to identify
and mitigate the potential risks and challenges associated with the migration, such as data security,
compliance, availability, scalability, and performance.
SIMULATION
A systems administrator is configuring a site-to-site VPN between two branch offices. Some of the
settings have already been configured correctly. The systems administrator has been provided the
following requirements as part of completing the configuration:
* Most secure algorithms should be selected
* All traffic should be encrypted over the VPN
* A secret password will be used to authenticate the two VPN concentrators
To configure the site-to-site VPN between the two branch offices according to the provided
requirements, here are the detailed steps and settings that need to be applied to the VPN
concentrators:
Requirements:
Most secure algorithms should be selected.
All traffic should be encrypted over the VPN.
A secret password will be used to authenticate the two VPN concentrators.
VPN Concentrator 1 Configuration:
Questions and Answers PDF 168/297
Phase 1:
Peer IP address: 5.5.5.10 (The IP address of VPN Concentrator 2)
Auth method: PSK (Pre-Shared Key)
Negotiation mode: MAIN
Encryption algorithm: AES256
Hash algorithm: SHA256
DH key group: 14
Phase 2:
Mode: Tunnel
Protocol: ESP (Encapsulating Security Payload)
Encryption algorithm: AES256
Hash algorithm: SHA256
Local network/mask: 192.168.1.0/24
Remote network/mask: 192.168.2.0/24
VPN Concentrator 2 Configuration:
Phase 1:
Peer IP address: 5.5.5.5 (The IP address of VPN Concentrator 1)
Auth method: PSK (Pre-Shared Key)
Negotiation mode: MAIN
Encryption algorithm: AES256
Hash algorithm: SHA256
DH key group: 14
Phase 2:
Mode: Tunnel
Protocol: ESP (Encapsulating Security Payload)
Encryption algorithm: AES256
Hash algorithm: SHA256
Local network/mask: 192.168.2.0/24
Remote network/mask: 192.168.1.0/24
Summary:
Peer IP Address: Set to the IP address of the remote VPN concentrator.
Auth Method: PSK for using a pre-shared key.
Negotiation Mode: MAIN for the initial setup.
Encryption Algorithm: AES256, which is a strong and secure algorithm.
Hash Algorithm: SHA256, which provides strong hashing.
DH Key Group: 14 for strong Diffie-Hellman key exchange.
Phase 2 Protocol: ESP for encryption and integrity.
Local and Remote Networks: Properly configure the local and remote network addresses to match
each branch office subnet.
By configuring these settings on both VPN concentrators, the site-to-site VPN will meet the
requirements for strong security algorithms, encryption of all traffic, and authentication using a pre-
shared key.
A security administrator recently reset local passwords and the following values were recorded in the
system:
Which of the following in the security administrator most likely protecting against?
A. Account sharing
B. Weak password complexity
C. Pass-the-hash attacks
D. Password compromise
Answer: C
Explanation:
The scenario shows MD5 hashed password values. The most likely reason the security administrator is focusing on these values is to protect against pass-the-hash attacks. In this type of attack, an
attacker can use a captured hash to authenticate without needing to know the actual plaintext password. By managing and monitoring these hashes, the administrator can implement strategies to
mitigate this type of threat
A security analyst finds a rogue device during a monthly audit of current endpoint assets that are
connected to the network. The corporate network utilizes 002.1X for access control. To be allowed on
the network, a device must have a Known hardware address, and a valid user name and password
must be entered in a captive portal. The following is the audit report:
Which of the following is the most likely way a rogue device was allowed to connect?
A. A user performed a MAC cloning attack with a personal device.
B. A DMCP failure caused an incorrect IP address to be distributed
C. An administrator bypassed the security controls for testing.
D. DNS hijacking let an attacker intercept the captive portal traffic.
Answer: A
Explanation:
The most likely way a rogue device was able to connect to the network is through a MAC cloning
attack. In this attack, a personal device copies the MAC address of an authorized device, bypassing the 802.1X access control that relies on known hardware addresses for network access. The matching
MAC addresses in the audit report suggest that this technique was used to gain unauthorized
network access.
An administrator is reviewing a single server’s security logs and discovers the following:
Which of the following best describes the action captured in this log file?
A. Brute-force attack
B. Privilege escalation
C. Failed password audit
D. Forgotten password by the user
Answer A
A security analyst is reviewing logs and discovers the following:
Which of the following should be used to best mitigate this type of attack?
A. Input sanitization
B. Secure cookies
C. Static code analysis
D. Sandboxing
A. Input sanitization
A security administrator documented the following records during an assessment of network services:
Two weeks later, the administrator performed a log review and noticed the records were changed as follows:
When consulting the service owner, the administrator validated that the new address was not part of the company network. Which of the following was the company most likely experiencing?
A. DDoS attack
B. DNS poisoning
C. Ransomware compromise
D. Spyware infection
B. DNS poisoning
C. Footprinting the internal network
A. DDoS
D. Resource consumption
