Security+ Practice Flashcards
(634 cards)
1
Q
A user is attempting to navigate to a website from inside the company network using a desktop. When the user types in the URL, https://www.site.com, the user is presented with a certificate mismatching warning from the browser. The uses does not receive a warning when visiting http://www.anothersite.com. Which of the following describe this attack?
A
Domain hijacking - the practice of using ccTLDs in an unconventional way to create a domain name.
2
Q
Which of the following tools is effective in preventing a user from accessing unauthorized removable media?
A
USB data blocker
3
Q
A Chief Security Officer is looking for a solution that can provide increased scalability and flexibility for back-end infrastructure, allowing it to be updated and modified without disruption of services. The security architect would like the solution selected to reduce the back-end server resources and has highlighted that session persistence is not important for the applications running on the back-end servers. Which of the following would best meet the requirements.
A
Reverse Proxy - A reverse proxy server is a type of proxy server that typically sits behind the firewall in a private network and directs client requests to the appropriate backend server.
4
Q
Which of the following describes a social engineering technique that seeks to exploit a person’s sense of urgency?
A
A phishing email stating a cash settlement has been awarded but will expire soon
5
Q
A security analyst is reviewing application logs to determine the source of a break and locates the following log:
(Link start) https://www.compta.com/login.php?((Link end)id=’%20or%20’1’1=’1
Which of the following has been observed?
A
SQLi - SQL injection - a common attack vector that uses malicious SQL code for backend database manipulation to access information that was not intended to be displayed.
6
Q
An audit identified PII being utilized in the development environment of a critical application. The Chief Privacy Officer (CPO) is adamant that this data must be removed; however, the developers are concerned that without real data they cannot perform functionality tests and search for specific data. Which of the following should a security professional implement the BEST to satisfy both the CPO’s and the development team’s requirements?
A
Data masking - creates fake versions of an organization’s data by changing confidential information.
7
Q
A company is implementing a DLP solution on the file server. The file server has PII, financial information, and health information stored on it. Depending on what type of data that is hosted on the file server, the company wants different DLP rules assigned to the data. Which of the following should the company do to help accomplish this goal?
A
Classify the data
8
Q
A forensics investigator is examining a number of unauthorized payments that were reported on the company’s website. Some unusual log entries show users received an email for an unwanted mailing list and clicked on a link to attempt to unsubscribe. One of the users reported the email to the phishing team, and the forwarded email revealed the link to be <a>Click here to unsubscribe</a> Which of the following will the forensics investigator MOST likely determine has occurred?
A
XSRF - Cross-site request forgery - an attack that forces authenticated users to submit a request to a Web application against which they are currently authenticated.
9
Q
A report delivered to the Chief Information Security Office (CISO) shows that some users credentials could be exfiltrated. The report also indicates that users tend to choose the same credentials on different systems and applications. Which of the following policies should the CISO use to prevent someone from using the exfiltrated credentials
A
MFA - Multi Factor Authentication
10
Q
A company wants to simply the certificate management process. The company has a single domain with several dozen subdomains, all of which are publicly accessible on the internet. Which of the following BEST describes the type of certificate the company should implement?
A
Wildcard - digital certs - a digital certificate that is applied to a domain and all its subdomains.
11
Q
Which of the following is an effective tool to stop or prevent exfiltration of data from a network?
A
DLP - Data loss Prevention - a cybersecurity solution that detects and prevents data breaches.
12
Q
Several attempts have been made to pick the door lock of a security facility. As a result, the security engineer has been assigned to implement a stronger preventative access control. Which of the following would BEST complete the engineer’s assignment?
A
Replacing the traditional key with an RFID key
13
Q
Which of the following can be used by a monitoring tool to compare values and detect password leaks without providing the actual credentials?
A
Hashing - a data security technique used to convert data values into alternate, unique identifiers called hashes for quick and secure access.
14
Q
A security engineer is building a file transfer solution to send files to a business partner. The user would like to drop off the files in a specific directory and have the server send the file to the business partner. The connection to the business partner is over the internet and needs to be secure. Which of the following can be used?
A
SSH - Secure Shell Protocol is a cryptographic network protocol for operating network services securely over an unsecured network.
15
Q
An administrator needs to protect user passwords and has been advised to hash the passwords. Which of the following BEST describes what the administrator is being advised to do?
A
Perform a mathematical operation on the passwords that will convert them into unique strings.
16
Q
Which of the following would be indicative of a hidden audio file found inside of a piece of source code?
A
Steganography - the practice of concealing messages or information within other non secret text or data
17
Q
A user enters a username and password at the login screen for a web portal. A few seconds later the following message appears on the screen: Please use the combination of numbers, special characters, and letters in the password field. Which of the following concepts does this message describe?
A
Password complexity
18
Q
A company recently experienced an inside attack using a corporate machine that resulted in data compromise. Analysis indicated an unauthorized change to the software circumvented technological protection measures. The analyst was tasked with determining the best method to ensure the integrity of the systems remains intact and local and remote boot attestation can take place. Which of the following would provide the BEST solution?
A
TPM - Trusted Platform Module - boot integrity - is a specialized chip on a laptop or desktop computer that is designed to secure hardware with integrated cryptographic keys.
19
Q
Which of the following is a reason to publish files’ hashes?
A
To validate the integrity of the files
20
Q
A security manager has tasked the security operations center with locating all web servers that respond to an unsecured protocol. Which of the following commands could an analyst run to find the requested servers?
A
nmap -p 80 10.10.10.0/24 - network scanning with Nmap. Nmap - network mapper - n open source Linux command-line tool—used for network exploration, host discovery, and security auditing.
21
Q
Which biometric error would allow an unauthorized user to access a system?
A
False acceptance is an error in biometrics that causes an unauthorized person to be authenticated
22
Q
A company is auditing the manner in which its European customers’ personal information is handled. Which of the following should the company consult?
A
GDPR - General Data Protection Regulation - governs the way in which we can use, process, and store personal data (information about an identifiable, living person).
23
Q
Which of the following are common Voip-associated vulnerabilities? (Choose two).
A
- Vishing - over the phone - the fraudulent practice of making phone calls or leaving voice messages purporting to be from reputable companies in order to induce individuals to reveal personal information, such as bank details and credit card numbers.
- Credential harvesting - a form of cyberattack that involves the theft of personal or financial data such as usernames and passwords, typically carried out through phishing, malicious websites, email scams, or malware but not always.
24
Q
Which of the following describes the exploration of an interactive process to gain access to restricted areas?
A
Privilege Escalation is a cyberattack designed to gain unauthorized privileged access into a system.
25
An organization is planning to open other data centers to sustain operations in the event of a natural disaster. Which of the following considerations would BEST support the organization's resiliency?
Geographical dispersal - placing physical distances between duplicate systems so the organization can avoid damages to both the primary and alternate resources from the same disaster.
26
A security engineer is deploying a new wireless network for a company. The company shares office space with multiple tenants. Which of the following should the engineer configure on the wireless to ensure that the confidential data is not exposed to unauthorized users?
AES - Advanced Encryption Standard - an algorithm that uses the same key to encrypt and decrypt protected data.
27
The Chief Compliance Officer from a bank has approved a background check policy for new hires. Which of the following is the policy MOST likely protecting against?
Ensuring no new hires have worked at other banks that may be trying to steal customer information.
28
An engineer recently deployed a group of 100 web servers in a cloud environment. Per the security policy, all web-server ports except 443 should be disabled. Which of the following can be used to accomplish this task?
Host-based firewall - firewall software that is installed directly on a computer (rather than a network)
29
A technician was dispatched to complete repairs on a server in a data center. While locating the server, the technician entered a restricted area without authorization. Which of the following security controls would BEST prevent this in the future?
Implement access control vestibules - hall or lobby next to the outer door of a building.
30
Which of the following would BEST provide a systems administrator with the ability to more efficiently identify systems and manage permissions and policies based on location, role, and service level?
Domain services - Active Directory Domain Services (AD DS) is a server role in Active Directory that allows admins to manage and store information about resources from a network, as well as application data, in a distributed database.
31
Which of the following would best detect intrusions at the perimeter of an airport?
Motion sensors
32
A security analyst is concerned about critical vulnerabilities that have been detected on some applications running inside containers. Which of the following is the BEST remediation strategy?
Update the base container image and redeploy the environment
33
An organization has decided to purchase an insurance policy because a risk assessment determined that the cost to remediate the risk is greater than the five-year cost of the insurance policy. The organization is enabling risk
transference - a contractual shifting of a pure risk from one party to another.
34
A security analyst receives an alerts from the company's SIEM that anomalous activity is coming from a local source IP address of 192.168.34.26. The Chief Information Security Officer asks the analyst to block the originating source. Several days later, another employee opens an internal ticket stating that vulnerability scans are no longer being performed properly. The IP address the employee provides is 192.168.34.26. Which of the following describes this type of alert?
False positive - a test result which incorrectly indicates that a particular condition or attribute is present
35
A security analyst wants to reference a standard to develop a risk management program. Which of the following is the BEST source for the analyst to use?
ISO 31000 - Risk management – Guidelines, provide principles, a framework and a process for managing risk.
36
The Chief Information Security Office (CISO) requested a report on potential areas of improvement following a security incident. Which of the following incident response processes is the CISO requesting?
Root cause analysis - is the process of discovering the root causes of problems in order to identify appropriate solutions.
37
A company is providing security awareness training regarding the importance of not forwarding social media messages from unverified sources. Which of the following risks would this training help to prevent?
Hoaxes - believable stories or malicious deception
38
A security analyst is receiving numerous alerts reporting that the response time of an internet-facing application has been degraded. However, the internal network performance was not degraded. Which of the following MOST likely explains this behavior?
DDoS attack - an overload of traffic from a # of sources that makes resources unavailable for legitimate users.
39
Which of the following will increase cryptographic security?
High data entropy - a higher level of disorder or uncertainty in the data.
40
Which of the following statements BEST describes zero-day exploits?
zero-day exploit is initially undetectable, and no patch for it exists.
41
A company wants to restrict emailing of PHI documents. The company is implementing a DLP solution. In order to restrict PHI documents, which of the following should be performed FIRST?
Classification - is the process of identifying and and grouping objects or ideas into predetermined categories
42
A security analyst is investigating some users who are being redirected to be a fake website that resembles www.comptia.org. The following output was found on the naming server of the organization.
Name Type Data
WWW A 192.168.1.10
server1 A 10.10.10.10
server2 A 10.10.10.11
file A 10.10.10.12
DNS poisoning - hacker poisoning the DNS site. happens when fake information is entered into the cache of a domain name server, resulting in DNS queries producing an incorrect reply, sending users to the wrong website.
43
Which of the following describes the continuous delivery software development methodology?
Agile - having a comprehensive approach to identifying any gaps or concerns.
44
Which of the following is the BEST example of cost-effective physical control to enforce a USB removable media restriction policy?
Implementing a GPO that will restrict access to authorized USB removable media and regularly verifying that it is enforced.
45
A company suspects that some corporate accounts were compromised. The number of suspicious logins from locations not recognized by the users is increasing. Employees who travel need their accounts protected without the risk of blocking legitimate login requests that may be made over new sign-in properties. Which of the following security controls can be implemented?
Enforce MFA when an account request reaches a risk threshold.
46
An organization wants to participate in threat intelligence information sharing with peer groups. Which of the following would MOST likely meet the organizations requirement?
Subscribe to threat intelligence feeds
47
Which of the following is the MOST effective control against zero-day vulnerabilities?
Patch management - the process of applying updates to software, drivers, and firmware to protect against vulnerabilities.
48
Which of the following is the GREATEST security concern when outsourcing code development to third-party contractors for an internet-facing application?
Unknown backdoor - an undocumented way to bypass existing cybersecurity measures and gain access to the computer system or device.
49
An organization has hired a red team to simulate attacks on its security posture. Which of the following will the blue team do after detecting an IoC?
Activate runbooks for incident response. IoC - potential indicators of compromise
50
An amusement park is implementing a biometric system that validates customers' fingerprints to ensure they are not sharing tickets. The park's owner values customers above all and would prefer customers' convenience over security. For this reason, which of the following features should the security team prioritize FIRST?
Low FRR - False Reject Rate (FRR) When you have a low FRR, it means that your biometric system is rejecting fewer people than it should be. Calculated by dividing the number of false rejects by the total number of transactions.
51
Which of the following organizations sets frameworks and controls for optimal security configuration on systems?
NIST - National Institute of Standards and Technology
52
An organization discovered files with proprietary financial data have been deleted. The files have been recovered from backup, but every time the Chief Financial Officer logs into the file server, the same files are deleted again. No other users are experiencing this issue. Which of the following types of malware is MOST likely causing this behavior?
Logic bomb - a set of instructions secretly incorporated into a program so that if a particular condition is satisfied they will be carried out, usually with harmful effects.
53
A security analyst has identified malware spreading through the corporate network and has activated the CSIRT. Which of the following should the analyst do NEXT?
Attempt to quarantine all infected hosts to limit further spread. CSIRT - Computer Security Incident Response Team
54
During an incident response, an analyst applied rules to all inbound traffic on the border firewall and implemented ACL's on each critical server. Following an investigation, the company realizes it is still vulnerable because outbound traffic is not restricted, and the adversary is able to maintain a presence in the network. In which of the following stages of the Cyber Kill Chain is the adversary currently operating?
Command and control - attack refers to methods and tools used to communicate with and control an infected machine or network.
55
A recent security breach exploited software vulnerabilities in the firewall and within the network management solution. Which of the following will MOST likely be used to identify when the breach occurred through each device?
Firewall syslog events logs
56
Which of the following is the FIRST environment in which proper, secure coding should be practiced?
Development
57
A cloud service provider has created an environment where customers can connect existing local networks to the cloud additional computing resources and block internal HR applications from reaching the cloud. Which of the following cloud models is being used?
Hybrid
58
An organization has developed an application that needs a patch to fix a critical vulnerability. In which of the following environments should the patch be deployed LAST?
Production
59
An organization is building backup server rooms in geographically diverse locations. The Chief Information Security Officer implemented a requirement on the project that states the new hardware cannot be susceptible to the same vulnerabilities in the existing server room. Which of the following should the systems engineer consider? Select 1
Implementing a robust patch management solution
60
A security analyst is working on a project to implement a solution that monitors network communications and provides alerts when abnormal behavior is detected. Which of the following is the security analyst MOST likely implementing?
User behavior analysis - provides you with the data to identify trends and easily spot outliers, so you can more easily and quickly identify and investigate potential threats and break the attack chain.
61
Data exfiltration analysis indicates that an attacker managed to download system configuration notes from a web server. The web-server logs have been deleted, but analyst have determined that the system configurations notes were stored in the database administrator's folder on the web server. Which of the following attacks explains what occurred?
Directory traversal - also known as path traversal or directory climbing, is a vulnerability in a web application server caused by a HTTP exploit. The exploit allows an attacker to access restricted directories, execute commands, and view data outside of the web root folder where application content is stored.
SQL injection - also known as SQLI, is a common attack vector that uses malicious SQL code for backend database manipulation to access information that was not intended to be displayed.
62
A junior security analyst is conducting an analysis after passwords were changed on multiple accounts without users' interaction. The SIEM have multiple login entries with the following text:
suspicious event - user scheduledtasks successfully authenticate on AD on abnormal time
suspicious event - user scheduledtasks failed to execute c:
Privilege escalation - is a cyberattack designed to gain unauthorized privileged access into a system.
63
A customer server representative reported an unusual text message that was sent to the help desk. The message contained an unrecognized invoice number with a large balance due and a link to click for more details. Which of the following BEST describes this technique?
Phishing - the fraudulent practice of sending emails or other messages purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers.
64
Which of the following actions would be recommended to improve an incident response process? Select 1
Train the team to identify the difference between events and incidents.
65
A cybersecurity administrator needs to implement a Layer 7 security control on a network and block potential attacks. Which of the following can block an attack at the Layer 7? Choose two
WAF - Web Application Firewall
NAC - Network Access Control - ensures that only users who are authenticated and devices that are authorized and compliant with security policies can enter the network.
66
A business operations manager is concerned that a PC that is critical to business operations will have a costly hardware failure soon. The manager is looking for options to continue business operations without incurring large costs. Which of the following would mitigate the manager's concerns?
Perform a physical-to-virtual migration
67
An organization has activated an incident response plan due to a malware outbreak on it's network. The organization has brought in a forensics team that has identified an internet-facing Windows server as the likely point of initial compromise. The malware family that was detected is known to be distributed by manually logging on to servers and running the malicious code. Which of the following actions would be BEST to prevent reinfection from the infection vector?
Block port 3389 inbound from untrusted networks
68
Which of the following uses SAML for authentication?
Federation - Identity Federation - resources that will trust a single authentication source
69
The SOC for a large MSSP is meeting to discuss the lessons learned from a recent incident that took much too long to resolve. This type of incident has become more common in recent weeks and is consuming large amounts of the analysts' time due to manual tasks being performed. Which of the following solutions should the SOC consider to BEST improve its response time?
Implement a SOAR with customizable playbooks. SOAR - Security, Orchestration, Automation, and Response. SOAR seeks to alleviate the strain on IT teams by incorporating automated responses to a variety of events. A SOAR system can also be programmed to custom-fit an organization's needs. managed security service provider (MSSP)
70
Business partners are working on a security mechanism to validate transactions securely. The requirement is for one company to be responsible for deploying a trusted solution that will register and issue artifacts used to sign, encrypt, and decrypt transaction files. Which of the following is the BEST solution to adopt?
PKI - Public key infrastructure the set of hardware, software, policies, processes, and procedures required to create, manage, distribute, use, store, and revoke digital certificates and public-keys.
71
A security analyst has been asked by the Chief Information Security Officer to:
-develop a secure method of providing centralized management of infrastructure
-reduce the need to constantly replace aging end user machines
-provide a consistent user desktop experience
Which of the following BEST meets this requirement?
VDI - Virtual desktop infrastructure
72
Which of the following terms describes a broad range of information that is sensitive to a specific organization?
Proprietary - is often transferred between companies after both sign a secrecy or confidentiality agreement.
73
A Chief Security Officer (CSO) is concerned that cloud-based services are not adequately protected from advanced threats and malware. The CSO believes there is a high risk that a data breach could occur in the near future due to the lack of detective and preventive controls. Which of the following should be implemented to the BEST address CSO's concerns? (choose two).
An NG-SWG - Next Generation Secure Web Gateway (SWG) is a new cloud-native solution for protecting enterprises from the growing volume of sophisticated cloud enabled threats and data risks. It is the logical evolution of the traditional secure web gateway, also known as a web proxy or web filter.
Segmentation - is a network security technique that divides a network into smaller, distinct sub-networks that enable network teams to compartmentalize the sub-networks and deliver unique security controls and services to each sub-network.
74
An organization is planning to roll out a new mobile device policy and issue each employee a new laptop. These laptops would access the users' corporate operating systems remotely and allow them to use the laptops for purposes outside of their job roles. Which of the following deployment models is being utilized?
COPE - Corporate-Owned Personally-Enabled (COPE) architectures provide the flexibility of allowing both enterprises and employees to install applications onto organization-owned mobile devices.
VDI
75
Certain users are reporting their accounts are being used to send unauthorized emails and conduct suspicious activities. After further investigation, a security analyst notices the following:
-All users share workstations throughout the day
-Endpoint protection was disabled on several workstations throughout the network
-Travel times on logins from the affected users are impossible
-Sensitive data is being uploaded to external sites
-All users account passwords were forced to be reset and the issue continued
Which of the following attacks is being used to compromise the user accounts?
Brute-force - a hacking method that uses trial and error to crack passwords, login credentials, and encryption keys. It is a simple yet reliable tactic for gaining unauthorized access to individual accounts and organizations' systems and networks.
76
A security forensics analyst is examining a virtual server. The analyst wants to preserve the present state of the virtual server, including memory contents. Which of the following backup types should be used?
Snapshot
77
After returning from a conference, a user's laptop has been operating slower than normal and overheating, and the fans have been running constantly. During the diagnosis process, an unknown piece of hardware is found connected to the laptop's motherboard. Which of the following attack vectors was exploited to install the hardware?
Supply chain - The practice of identifying, assessing and managing cyber security risks in the supply chain, encompassing technological and human risk factors.
78
After a recent security breach, a security analyst reports that several administrative usernames and passwords are being sent via cleartext across the network to access network devices over port 23. Which of the following should be implemented so all credentials sent over the network are encrypted when remotely accessing and configuring network devices?
SSH - also known as Secure Shell or Secure Socket Shell, is a network protocol that gives users, particularly system administrators, a secure way to access a computer over an unsecured network. SSH also refers to the suite of utilities that implement the SSH protocol.
79
Which of the following provides a calculated value for known vulnerabilities so organizations can prioritize migration steps?
CVSS - Common Vulnerability Scoring System (CVSS) provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity.
80
Several universities are participating in a collaborative research project and needs to share compute and storage resources. Which of the following cloud deployment strategies would BEST meet this need?
Hybrid
81
A forensic analyst needs to prove that data has not been tampered with since it was collected. Which of the following methods with the analyst MOST likely use?
Calculate the checksum using a hashing algorithm
82
Multiple business accounts were compromised a few days after a public website had its credentials database leaked on the internet. No business emails were identified in the breach, but the security team thinks that the list of passwords exposed was later used to compromise business accounts. Which of the following would mitigate the issue? Select 1
complexity requirements
83
A security analyst wants to fingerprint a web server. Which of the following tools will the security analyst MOST likely use to accomplish this task?
nmap - p1-65535 192.168.0.10 - Nmap ("Network Mapper") is a free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.
84
A penetration tester was able to compromise an internal server and is now trying to pivot the current session in a network lateral movement. Which of the following tools, if available on the server, will provide the MOST useful information for the next assessment step?
nmap - p1-65535 192.168.0.10 - Nmap ("Network Mapper") is a free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.
85
Field workers in an organization are issued mobile phones on a daily basis. All the work is performed within one city, and the mobile phones are not used for any purpose other than work. The organization does not want these phones used for personal purposes. The organization would like to issue the phones to workers as the permanent devices so the phones do not need to be reissued every day. Given the conditions described, which of the following technologies would BEST meet these requirements?
Mobile device management
86
Which of the following control types is focused primarily on reducing risk before an incident occurs?
Preventive
87
A systems administrator reports degraded performance on a virtual server. The administrator increases the virtual memory allocation, which improves conditions, but performance degrades again after a few days. The administrator runs an analysis tool and sees the following output:
==3214== timeAttend.exe analyzed
==3214==ERROR SUMMARY:
==3214==mall/free: in use at exit: 4608 bytes in 18 blocks
==3214==checked 82116 bytes
==3214== definitely lost:4608 bytes in 18 blocks.
The administrator terminates the timeAttend.exe, observes system performance over the next few days, and notices that the system performance does not degrade. Which of the following issues is MOST likely occurring?
Memory leak - a common software issue that can lead to serious security vulnerabilities and performance issues.
88
An administrator is experiencing issues when trying to upload a support file to a vendor. A pop-up message reveals that a payment card number was found in the file, and the file uploaded was blocked. Which of the following controls is most likely causing this issue and should be check FIRST?
Content Filter is a process that manages or screens access to specific emails or webpages. The goal is to block content that contains harmful information. Content filtering programs are commonly used by organizations to control content access through their firewalls. They can also be used by home computer users.
89
Which of the following risk management strategies would an organization use to maintain a legacy system with known risk for operational purposes?
Mitigation - Mitigation, or Attack Mitigation, is the reduction in severity or seriousness of an event. In cybersecurity, mitigation is centered around strategies to limit the impact of a threat against data in custody. Threats against data can come from outside attackers motivated by profit, activism, retribution, or mischief.
90
Which of the following is the BEST action to foster a consistent and auditable incident response process?
Publish the document in a central repository that is easily accessible to the organization
91
During a recent penetration test, the tester discovers large amounts of data were exfiltrated over the course of 12 months via the internet. The penetration tester stops the test to the inform the client of the findings. Which of the following should be the client's NEXT step to migrate the issue?
Perform containment on the critical servers and resources.
92
A security analyst is designing the appropriate controls to limit unauthorized access to a physical site. The analyst has a directive to utilize the lowest possible budget. Which of the following would BEST meet the requirements?
Preventive controls - security mechanisms, tools, or practices that can deter or mitigate undesired actions or events.
93
A company is looking to migrate some servers to the cloud to minimize its technology footprint. The company has 100 databases that are on premises. Which of the following solutions will require the LEAST management and support from the company.
IaaS - infrastructure as a Service (IaaS) is a cloud computing model in which a third-party cloud service provider (CSP) offers virtualized compute resources such as servers, data storage and network equipment on demand over the internet to clients.
94
Which of the following employee roles is responsible for protecting an organization's collected personal information?
DPO - The primary role of the data protection officer (DPO) is to ensure that her organisation processes the personal data of its staff, customers, providers or any other individuals (also referred to as data subjects) in compliance with the applicable data protection rules.
95
Against the recommendation of the IT security analyst, a company set all user passwords on a server as "P@55w0rD?. Upon review of the /etc/passwd file, an attacker found the following:
alice:adlkajfljafkjdaflkadjsfasdj
bob:dadaldaflkjdasflkasjfldskjf
chris:daadfadsfadsfasdlkfj
Which of the following BEST explains why the encrypted passwords do not match?
Salting - With password salting, a random piece of data is added to the password before it runs through the hashing algorithm, making it unique and harder to crack. When using both hashing and salting, even if two users choose the same password, salting adds random characters to each password when the users enter them.
96
After gaining access to the dual-homed (ie wired and wireless) multifunctional device by exploiting a vulnerability in the device's firmware, a penetration tester then gaines shell access on another networked asset. This technique is an example of
Pivoting - The act of an attacker moving from one compromised system to one or more other systems within the same or other organizations. Pivoting is fundamental to the success of advanced persistent threat (APT) attacks.
97
Which of the following should be monitored by threat intelligence researchers who search for leaked credentials?
Dark Web
98
A security analyst needs to be able to search and correlate logs from multiple sources in a single tool. Which of the following would BEST allow a security analyst to have this ability?
SIEM - Security information and event management (SIEM) is a security solution that helps organizations detect threats before they disrupt business.
99
A security analyst in investigating suspicious traffic on the web server located at IP address 10.10.1.1. A search of the WAF logs reveals the following output:
Source IP Destination IP Requested URL Action Taken
172.106.1.3 10.10.1.1 /web/cgi-bin/contract?category=custname'-- permit and log
172.16.1.3 10.10.1.1 /web/cgi-bin/contract?category=custname+OR+1=1-- permit and log
SQLi - SQL injection, also known as SQLI, is a common attack vector that uses malicious SQL code for backend database manipulation to access information that was not intended to be displayed. This information may include any number of items, including sensitive company data, user lists or private customer details.
100
Which of the following components can be used to consolidate and forward inbound internet traffic to multiple cloud environments through a single firewall?
Transit gateway - A transit gateway is a network transit hub that you can use to interconnect your virtual private clouds (VPCs) and on-premises networks. As your cloud infrastructure expands globally, inter-Region peering connects transit gateways together using the AWS Global Infrastructure.
101
A DBA reports that several production server hard drives were wiped over the weekend. The DBA also reports that several Linux servers were unavailable due to system files being deleted unexpectedly. A security analyst verified that software was configured to delete data deliberately from those servers. No backdoors to any servers were found. Which of the following attacks was MOST likely used to cause the data loss?
Logic bomb - A logic bomb is a set of instructions in a program carrying a malicious payload that can attack an operating system, program, or network. It only goes off after certain conditions are met. A simple example of these conditions is a specific date or time.
102
Digital signatures use asymmetric encryption. This means the message is encrypted with:
the sender's private key and decrypted with the recipient's public key
103
A security engineer was assigned to implement a solution to prevent attackers from gaining access by pretending to be authorized users. Which of the following technologies meets the requirement?
MFA - Multi Factor Authentication
104
The Chief Information Security Officer (CISO) has requested that a third-party vendor provide supporting documents that show proper controls are in place to protect customer data. Which of the following would be BEST for the third-party vendor to provide to the CISO?
SOC 2 Type 2 report - SOC 2, aka Service Organization Control Type 2, is a cybersecurity compliance framework developed by the American Institute of Certified Public Accountants (AICPA). The primary purpose of SOC 2 is to ensure that third-party service providers store and process client data in a secure manner.
105
Which of the following is assured when a user signs an email using a private key?
Authentication
106
A system administrator is troubleshooting a server's connection to an internal web server. The administrator needs to determine the correct ports to use. Which of the following tools BEST shows which ports on the web server are in a listening state?
netstat - NetSTAT is a tool aimed at real-time network-based in-trusion detection. The NetSTAT approach extends the state transition analysis technique (STAT) [3] to network-based intrusion detection in order to represent attack scenarios in a networked environment.
107
Which of the following BEST reduces the security risks introduced when running systems that have expired vendor support and lack an immediate replacement?
Implement proper network access restrictions
108
Due to unexpected circumstances, an IT company must vacate its main office, forcing all operations to alternate, off-site locations. Which of the following with the company MOST likely reference for guidance during this change?
The business continuity plan - A business continuity plan (BCP) is a document that consists of the critical information an organization needs to continue operating during an unplanned event. The BCP states the essential functions of the business, identifies which systems and processes must be sustained, and details how to maintain them.
109
While reviewing an alert that shows a malicious request on one web application, a cybersecurity analyst is alerted to a subsequent token reuse moments later on a different service using the same single sign-on method. Which of the following would BEST detect a malicious actor?
Utilizing SIEM correlation engines - SIEM Security information and event management system - event correlation is an essential part of any SIEM solution. It aggregates and analyzes log data from across your network applications, systems, and devices, making it possible to discover security threats and malicious patterns of behaviors that otherwise go unnoticed and can lead to compromise or data loss.
110
Two organizations plan to collaborate on the evaluation of new SIEM solutions for their respective companies. A combined effort for both organizations' SOC teams would speed up the effort. Which of the following can be written to document this agreement?
MOU
111
The Chief Information Security Officer wants to prevent the exfiltration of sensitive information from employee cell phones when using public USB power charging stations. Which of the following would be the BEST solution to implement?
USB data blocker - also known as a USB Condom, is a small device that you plug in between your device and a charging port to prevent data from being transferred from your device while still allowing it to charge.
112
The board of directors at a company contracted with an insurance firm to limit the organization's liability. Which of the following risk management practices does this BEST describe?
Transference - Risk transference in information security is the act of shifting risks from one area (or organization) to another. This is typically done because the original company lacks expertise in a particular area, and finds it more effective to outsource the work to another company that understands it better.
113
Which of the following is a risk that is specifically associated with hosting applications in the public cloud?
Shared tenancy - A multi-tenant cloud is a cloud computing architecture that allows customers to share computing resources in a public or private cloud. Each tenant's data is isolated and remains invisible to other tenants.
114
DDoS attacks are causing an overload on the cluster of cloud servers. A security architect is researching alternatives to make the cloud environment respond to load fluctuation in a cost-effective way. Which of the following options BEST fulfills the architect's requirements?
An orchestration solution that can adjust scalability of cloud assets.
115
Which of the following documents provides expectations at a technical level for quality, availability, and responsibility?
SLA
116
Which of the following is an example of transference of risk?
Purchasing insurance
117
An employee received a word processing file that was delivered as an email attachment. The subject line and email content enticed the employee to open the attachment. Which of the following attack vectors BEST matches this malware?
Macro-enabled file - is a file extension used by Excel which allows you to save Excel documents with macros and Visual Basic for Applications (VBA) code.
118
A security proposal was set up to track requests for remote access by creating a baseline of the users' common sign-in properties. When a baseline deviation is detected, an MFA challenge will be triggered. Which of the following should be configured in order to deploy the proposal?
Context-aware authentication - is the use of supplemental information to improve security decisions at the time they are made, resulting in more accurate security decisions capable of supporting dynamic business and IT environments
119
Which of the following secure coding techniques makes compromised code more difficult for hackers to use?
Obfuscation - Obfuscation means to make something difficult to understand. Programming code is often obfuscated to protect intellectual property or trade secrets, and to prevent an attacker from reverse engineering a proprietary software program. Encrypting some or all of a program's code is one obfuscation method.
120
As part of a security compliance assessment, an auditor performs automated vulnerability scans. In addition, which of the following should the auditor do to complete the assessment?>
Log analysis
121
A database administrator wants to grant access to an application that will be reading and writing data to a database. The database is shared by other applications also used by the finance department. Which of the following account types is MOST appropriate for this purpose?
Generic
122
A security analyst generated a file named host1.pcap and shared it with a team member who is going to use it for further incident analysis. Which of the following tools will the other team member MOST likely use to open this file?
Wireshark - is a network protocol analyzer, or an application that captures packets from a network connection, such as from your computer to your home office or the internet. Packet is the name given to a discrete unit of data in a typical Ethernet network. Wireshark is the most often-used packet sniffer in the world.
123
An application developer accidentally uploaded a company's code-signing certificate private key to a public web server. The company is concerned about the malicious use of its certificate. Which of the following should the company do FIRST?
Revoke the code-signing certificate
124
An organization implemented a process that compares the settings currently configured on systems against secure configuration guidelines in order to identify any gaps. Which of the following control types has the organization implemented?
Detective
125
The Chief Information Security Officer directed a risk reduction in shadow IT and created a policy requiring all unsanctioned high-risks SaaS applications to be blocked from user access. Which of the following is the BEST security solution to reduce the risk?
CASB - Cloud access security brokers (CASBs) are on-premises, or cloud-based security policy enforcement points, placed between cloud service consumers and cloud service providers to combine and interject enterprise security policies as the cloud-based resources are accessed.
126
A technician enables full disk encryption on a laptop that will be taken on a business trip. Which of the following does this process BEST protect?
Data at rest - is data that has reached a destination and is not being accessed or used. It typically refers to stored data and excludes data that is moving across a network or is temporarily in computer memory waiting to be read or updated.
127
A security analyst was called to investigate a file received directly from a hardware manufacturer. The analyst is trying to determine whether the file was modified in transit before installation on the user's computer. Which of the following can be used to safely assess the file?
Check the hash of the installation file
128
A help desk technician receives a phone call from someone claiming to be a part of the organization's cybersecurity incident response team. The caller asks the technician to verify the network's internal firewall IP address. Which of the following is the technician's BEST course of action?
Write down the phone number of the caller if possible, the name of the person requesting the information, hang up, and notify the organization's cybersecurity officer.
129
Which of the following would BEST provide detective and corrective controls for thermal regulation?
An HVAC system - In computing and especially in enterprise data centers, HVAC systems control the ambient environment (temperature, humidity, air flow and air filtering) and must be planned for and operated along with other data center components such as computing hardware, cabling, data storage, fire protection, physical security
130
Which of the following is a benefit of including a risk management framework into an organization's security approach?
It incorporates control, development, policy, and management activities into IT operations.
131
An organization maintains several environments in which patches are developed and tested before being deployed to an operational status. Which of the following is the environment in which patches will be deployed just prior to being put into an operational status?
Production
132
During a trial, a judge determined evidence gathered from a hard drive was not admissible. Which of the following BEST explains this reasoning?
The hard drive was not properly kept in an antistatic bag when it was moved.
133
An organization wants to implement a biometric system with the highest likelihood that an unauthorized users will be denied access. Which of the following should the organization use to compare biometric solutions?
FAR - False Acceptance Rate (FAR): the percentage of identification instances in which unauthorised persons are incorrectly accepted. False Rejection Rate (FRR): the percentage of identification instances in which authorised persons are incorrectly rejected.
134
A company recently experienced a significant data loss when proprietary information was leaked to a competitor. The company took special precautions by using proper labels' however, email filter logs do not have any record of the incident. An investigation confirmed the corporate network was not breached, but documents were downloaded from an employee's COPE tablet and passed to the competitor via cloud storage. Which of the following is the BEST remediation for this data leak?
DLP - DLP, or Data Loss Prevention, is a cybersecurity solution that detects and prevents data breaches. Since it blocks extraction of sensitive data, organizations use it for internal security and regulatory compliance.
135
An attacker was eavesdropping on a user who was shopping online. The attacker was able to spoof the IP address associated with the shopping site. Later, the user received an email regarding the credit card statement with unusual purchases. Which of the following attacks took place?
Domain hijacking - Domain Hijacking or Domain Spoofing is an attack where an organization's web address is stolen by another party. The other party changes the enrollment of another's domain name without the consent of its legitimate owner. This denies true owner administrative access.
136
A company is considering transitioning to the cloud. The company employs individuals from various locations around the world. The company does not want to increase its on premises infrastructure blueprint and only wants to pay for additional compute power required. Which of the following solutions would BEST meet the needs of the company?
Hybrid environment
137
After multiple on premises security solutions were migrated to the cloud, the incident response time increased. The analyst are spending a long time trying to trace information on different cloud consoles and correlating data in different formats. Which of the following can be used to optimize the incident response time?
CASB - Cloud access security brokers (CASBs) are on-premises, or cloud-based security policy enforcement points, placed between cloud service consumers and cloud service providers to combine and interject enterprise security policies as the cloud-based resources are accessed.
138
Which of the following control types would be BEST to use in an accounting department to reduce losses from fraudulent transactions?
Detective
139
A company is receiving emails with links to phishing sites that look very similar to the company's own website address and content. Which of the following is the BEST way for the company to mitigate this attack?
Generate a list of domains similar to the company's own and implement a DNS sinkhole for each. DNS Sinkholing is a mechanism aimed at protecting users by intercepting DNS request attempting to connect to known malicious or unwanted domains and returning a false, or rather controlled IP address. The controlled IP address points to a sinkhole server defined by the DNS sinkhole administrator.
140
A SOC operator is receiving continuous alerts from multiple Linux systems indicating that unsuccessful SSH attempts to a functional user ID have been attempted on each one of them in a short period of time. Which of the following BEST explains this behavior?
Password spraying - is a type of brute force attack where a malicious actor attempts the same password on many accounts before moving on to another one and repeating the process. This is effective because many users use simple, predictable passwords, such as "password123."
SOC - Security Operation Center
141
A tax organization is working on a solution to validate the online submission of documents. The solution should be carried on a portable USB device that should be inserted on any computer that is transmitting a transaction securely. Which of the following is the BEST certificate for these requirements?
Root certificate - is the starting point of a chain of trust upon which an SSL certificate is issued. The root certificate belongs to the Certificate Authority. The root certificate is used to issue intermediate certificates, that in term make it possible to register SSL certificates for end users.
142
A routine audit of medical billing claims revealed that several claims were submitted without the subscriber's knowledge. A review of the audit logs for the medical billing company's system indicated a company employee downloaded customer records and adjusted the direct deposit information to a personal bank account. Which of the following does this action describe?
Insider threat
143
A recent audit cited a risk involving numerous low-criticality vulnerabilities created by a web application using a third-party library. The development staff state there are still customers using the application even though it is end of life and it would be substantial burden to update the application for the compatibility with more secure libraries. Which of the following would be the MOST prudent course of action?
Use containerization to segment the application from other applications to eliminate the risk
144
A security analyst is evaluating solutions to deploy an additional layer of protecting for a web application. The goal is to allow only encrypted communications without relying on network devices. Which of the following can be implemented?
SRTP - Secure Real-time Transport Protocol. An extension of Real-time Transport Protocol (RTP) that features enhanced security measures. The protocol provides encryption, confidentiality, message authentication, and replay protection to your transmitted audio and video traffic.
145
A company labeled some documents with the public sensitivity classification. This means the documents can be accessed by:
only the company's employees and those listed in the document
146
Which of the following is the MOST relevant security check to be performed before embedding third-party libraries in developed code?
Assess existing vulnerabilities affecting the third-party code and the remediation efficiency of the libraries' developers.
147
A help desk technician receives an email from the Chief Information Officer (CIO) asking for documents. The technician knows the CIO is on vacation for a few weeks. Which of the following should the technician do to validate the authenticity of the email?
Look at the metadata in the email header and verify the "From:? line matches the CIO's email address.
148
A company needs to validate its updated incident response plan using a real-work scenario that will test decision points and relevant incident response actions without interrupting daily operations. Which of the following would BESt meet the company's requirements?
Tabletop exercise - (TTX): A security incident preparedness activity, taking participants through the process of dealing with a simulated incident scenario and providing hands-on training for participants that can then highlight flaws in incident response planning.
149
A security policy states that common words should not be used as passwords. A security auditor was able to perform a dictionary attack against corporate credentials. Which of the following controls was being violated?
Password reuse - is a person's tendency to use the same password across different online services. People reuse passwords in response to the poor usability of passwords.
150
A security incident has been resolved. Which of the following BEST describes the importance of the final phase of the incident response plan?
It examines and documents how well the team responded, discovers what caused the incident, and determines how the incident can be avoided in the future.
151
Which of the following is a cryptographic concept that operations on a fixed length of bits?
Block cipher is a method of encrypting data in blocks to produce ciphertext using a cryptographic key and algorithm. The block cipher processes fixed-size blocks simultaneously, as opposed to a stream cipher, which encrypts data one bit at a time.
152
Security analyst are conducting an investigation of an attack that occurred inside the organization's network. An attacker was able to collect network traffic between workstations throughout the network. The layer 2 address table has hundreds of entries to the ones abvove
ARP poisoning - ARP spoofing, ARP cache poisoning, or ARP poison routing, is a technique by which an attacker sends Address Resolution Protocol messages onto a local area network.
153
Command injection and directory traversal attempts.
Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Directory traversal (path traversal) happens when the attacker is able to read files on the web server outside of the directory of the website.
154
155
156
157
158
159
A large bank with two geographically dispersed data centers is concerned about major power disruptions at both locations. Every day location experiences very brief outages that last a few seconds. However, during the summer a high risk of intentional brownouts that last up to an hour exists, particularly at one of the locations near an industrial smelter. Which of the following is the BEST solution to reduce the risk of data loss?
UPS - Uninterruptible Power Supply
A UPS is, essentially, a battery backup that supplies power to your system in order to provide enough time to properly power down your equipment when there is a failure in utility power. You may have a facility that already has a UPS (Uninterruptible Power Supply) or even a generator.
160
Which o the following would be the BEST way to analyze diskless malware that has infected a VDI?
Take a memory snapshot of the running system.
161
Users are presented with a banner upon each login to a workstation. The banner mentions that users are not entitled to any reasonable expectation of privacy and access is for authorized personnel only. In order to proceed past that banner, users must click the OK button. Which of the following is this an example of?
AUP - acceptable use policy
(AUP) is a document stipulating constraints and practices that a user must agree to for access to a corporate network, the internet or other resources.
162
The Chief Information Security Officer is concerned about employees using personal email rather than company email to communicate with clients and sending sensitive business information and PII. Which of the following would be the BEST solution to install on the employees' workstations to prevent information from leaving the company's network?
DLP - Data Loss Prevention
a cybersecurity solution that detects and prevents data breaches. Since it blocks extraction of sensitive data, organizations use it for internal security and regulatory compliance.
163
On the way into a secure building, an unknown individual strikes up a conversation with an employee. The employee scans the required badge at the door while the unknown individual holds the door open, seemingly out of courtesy, for the employee. Which of the following social engineering techniques is being utilized?
Tailgating - where an attacker follows an unaware user to gain access to an area without authorization.
164
Two hospitals merged into a single organization. The privacy officer required a review of all records to ensure encryption was used during record storage, in compliance with regulations. During the review, the officer discovered that medical diagnosis codes and patient names were left unsecured. Which of the following types of data does this combination BEST represent?
PII - Personally identifiable information
165
A company discovered that terabytes of data have been exfiltrated over the past year after an employee clicked on an email link. The threat continued to evolve and remain undetected until a security analyst noticed an abnormal amount of external connections when the employee was not working. Which of the following is the MOST likely threat actor?
Insider threat - rogue employees and contractors leaking confidential data or misusing their access to systems for personal gain and/or to inflict damage and disruption.
166
An untrusted SSL certificate was discovered during the most recent vulnerability scan. A security analyst determines the certificate is signed properly and is a valid wildcard. The same certificate is installed on the other company servers without issue. Which of the following is the MOST likely reason for this finding?
The scanner is incorrectly configured to not trust this certificate when detected on the server.
167
A company wants to improve end users' experiences when they log in to a trusted partner website. The company does not want the users to be issued separate credentials for the partner website. Which of the following should be implemented to allow users to authenticate using their own credentials to log in to the trusted partner's website.
Federation - A process that allows for the conveyance of identity and authentication information across a set of networked systems. Sources: FIPS 201-3 under Federation.
168
A company is under investigation for possible fraud. As part of the investigation, the authorities need to review all emails and ensure data is not deleted. Which of the following should the company implement to assist in the investigation?
Legal hold - A legal hold (also known as a litigation hold) is a notification sent from an organization's legal team to employees instructing them not to delete electronically stored information (ESI) or discard paper documents that may be relevant to a new or imminent legal case.
169
A user wanted to catch up on some work over the weekend but had issues logging into the corporate networking using a VPN. On Monday, the user opened a ticket for this issue but was able to log in successfully. Which of the following BEST describes the policy that is being implemented?
Geofencing - allow a user to set up triggers so that when a device such as an internet-connected smartphone enters a defined geographical boundary, the user gets an alert.
170
A major political party experienced a server breach. The hacker then publicly posted stolen internal communications concerning campaign strategies to give the opposition party an advantage. Which of the following BEST describes these threat actors?
(APT) Advanced persistent threats - is a well-resourced adversary engaged in sophisticated malicious cyber activity that is targeted and aimed at prolonged network/system intrusion.
171
A company is required to continue using legacy software to support a critical service. Which of the following BEST explains a risk of this practice?
Lack of vendor support
172
A security analyst has been tasked with ensuring all programs that are deployed into the enterprise have been assessed in a runtime environment. Any critical issues found in the program must be sent back to the developer for verification and remediation. Which of the following BEST describes the type of assessment taking place?
Dynamic code analysis - Dynamic Application Security Testing (DAST) – is designed to test a running application for potentially exploitable vulnerabilities.
173
Which of the following can work as an authentication method and as an alerting mechanism for unauthorized access attempts?
HMAC-based, one-time password - Hash-based message authentication code (or HMAC) is a cryptographic authentication technique that uses a hash function and a secret key
174
A company has a flat network in the cloud. The company needs to implement a solution to segment its production and non-production servers without migrating servers to a new network. Which of the following solutions should the company implement?
VLAN segmentation - Networks are typically segmented with VLANs or subnets. VLANs create smaller network segments that connect hosts virtually. Subnets use IP addresses to segment the network, connected by networking devices.
175
The president of a regional bank likes to frequently provide SOC tours to potential investors. Which of the following policies BEST reduces the risk of malicious activity occurring after a tour?
Access control - a data security process that enables organizations to manage who is authorized to access corporate data and resources.
176
A Chief Information Security Officer has defined resiliency requirements for a new data center architecture. The requirements are as follows:
-Critical file shares will remain accessible during and after a natural disaster.
-Five percent of hard disks can fail at any given time without impacting the data.
-Systems will be forced to shut down gracefully when battery levels are below 20%.
Which of the following are required to BEST meet these objectives? ( choose 3)
RAID - (redundant array of independent disks) is a way of storing the same data in different places on multiple hard disks or solid-state drives (SSDs) to protect data in the case of a drive failure.
UPS - Uninterruptible Power Supply - A device with an internal battery that allows connected devices to run for at least a short time when the primary power source is lost.
Redundant power supplies - also known as dual power supplies, are essential for network infrastructure as they minimize the risk of power failure and help maintain uptime.
177
Which of the following is a security best practice that ensures the integrity of aggregated log files within a SIEM?
Write protect the aggregated log files and move them to an isolated server with limited access.
SIEM - Security information and event management - is a solution that helps organizations detect, analyze, and respond to security threats before they harm business operations.
178
A security analyst is evaluating the risks of authorizing multiple security solutions to collect data from the company's cloud environment. Which of the following is an immediate consequence of these integrations?
Increase in the attack surface
179
Which of the following explains why RTO is included in a BIA?
It informs the backup approach so that the organization can recover data to a known time.
RTO - Recovery time objective - the maximum tolerable length of time that a computer, system, network or application can be down after a failure or disaster occurs.
BIA - Business impact analysis - provides invaluable insight into which assets are critical for core operations and how disruptions can be avoided
180
A security analyst is reviewing the vulnerability scan report for a web server following an incident. The vulnerability that was used to exploit the server is present in historical vulnerability scan reports, and a patch is available for the vulnerability. which is the following is the MOST likely cause?
The scan reported a false negative for the vulnerability.
False neg - problems aren't picked up even though there are bugs or vulnerabilities in the application being tested.
False pos - security alerts incorrectly categorized as suggesting a threat when there is none.
181
Which of the following is a known security risk associated with data archives that contain financial information?
Data can become a liability if archived longer than required by regulatory guidance.
182
Which of the following BEST describes the process of documenting who has access to evidence?
chain of custody - A process that tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle by documenting each person who handled the evidence, the date/time it was collected or transferred, and the purpose for the transfer.
183
A systems engineer wants to leverage a cloud-based architecture with low latency between network-connected devices that also reduces the bandwidth that is required by performing analytics directly on the endpoints. Which of the following would BEST meet the requirements? (choose 2)
-IaaS - Infrastructure as a Service (IaaS) is a cloud computing model in which a third-party cloud service provider (CSP) offers virtualized compute resources such as servers, data storage and network equipment on demand over the internet to clients.
-Fog computing - a decentralized computing infrastructure in which data, compute, storage and applications are located somewhere between the data source and the cloud
184
Which of the following is a policy that provides a greater depth and breadth of knowledge across an organization?
Job rotation policy
185
A company is moving its retail website to a public cloud provider. The company wants to tokenize credit card data but not allow the cloud provider to see the credit card information. Which of the following would BEST meet these objectives?
TLS - Transport Layer Security, or TLS, is a widely adopted security protocol designed to facilitate privacy and data security for communications over the Internet.
186
A security analyst is tasked with defining the "something you are" factor of the company's MFA settings. Which of the following BEST to use to complete the configuration?
(HOTP) HMAC-based, one-time password is an event-based OTP where the moving factor in each code is based on a counter.
187
Which of the following processes will eliminate data using a method that will allow the storage device to be reused after the process is complete?
Overwriting - a process where new data is written over the existing data in the same physical space, making the original data inaccessible.
188
A web server has been compromised due to ransomware attack. Further investigation reveals the ransomware has been in the servers for the past 72 hours. The systems administrator needs to get the services back up as soon as possible. Which of the following should the administrator use to restore services to secure state?
The last incremental backup that was conducted 72 hours ago.
189
A network engineer created two subnets that will be used for production and development servers. Per security policy production and development servers must each have a dedicated network that cannot communicate with one another directly. Which of the following should be deployed so that server administrators can access these devices?
Jump servers - is a hardened and monitored device that spans two dissimilar security zones and provides a controlled means of access between them.
190
A social media company based in North America is looking to expand into new, global markets and needs to maintain compliance with international standards. Which of the following is the company's data protection officer MOST likely concerned?
General Data Protection Regulation (GDPR) - requires that personal data must be processed securely using appropriate technical and organisational measures.
191
A security architect is required to deploy to conference rooms some workstations that will allow sensitive data to be displayed on large screens. due to the nature of the data, it cannot be stored in the conference rooms. The file share is located in a local data center. Which of the following should the security architect recommend to BEST meet the requirements?
VDI and thin clients - a computer that uses resources housed inside a central server as opposed to a hard drive.
192
A Chief Security Officer wants to ensure the organization is validating and checking the integrity of zone transfers. Which of the following solutions should be implemented?
DNSSEC - a suite of extensions that improve Domain Name System (DNS) security by verifying that DNS results have not been tampered with.
193
Which of the following controls is used to make an organization initially aware of a data compromise?
Detective
194
An annual information security assessment has revealed that several OS-level configurations are not in compliance due to outdated hardening standards the company is using. Which of the following would BEST to use to update and reconfigure the OS-level security configurations?
CIS benchmarks - Center for Internet Security (CIS) are a set of globally recognized and consensus-driven best practices to help security practitioners implement and manage their cybersecurity defenses.
195
A company acquired several other small companies. The company that acquired the others in transitioning network servers to the cloud. The company wants to make sure that performance and security remain intact. Which of the following BEST meets both requirements?
Segmentation - to strengthen security, network segmentation is a physical or virtual architectural approach dividing a network into multiple segments, each acting as its own subnetwork providing additional security and control.
196
After a recent external audit, the compliance team provided a list of several non-compliant, in-scope hosts that were not encrypting cardholder data at rest. Which of the following compliance frameworks would address the compliance team's greatest concern?
PCI DSS - The Payment Card Industry (PCI) Data Security Standard (DSS) is an information security standard developed to enhance cardholder data security for organizations that store, process or transmit credit card data.
197
A security analyst is receiving several alerts per user and is trying to determine if various logins are malicious. The security analyst would like to create a baseline of normal operations and reduce noise. Which of the following actions should the security analyst perform?
Adjust the sensitivity levels of the SIEM correlation engine.
SIEM correlation engine - compares sequences of activity based on a set of rules.
198
Which of the following is the MOST effective way to detect security flaws present on third-party libraries embedded on software before it is released to production?
Implement a vulnerability scan to assess dependencies earlier on SDLC
199
Which of the following prevents an employee from seeing a colleague who is visiting an inappropriate website?
AUP - acceptable use policy (AUP) is a business agreement between a computer resource user and the computer resource owner or administrator that addresses all of the rights, privileges, and rules that users must adhere to when using computer resources.
200
A user reports falling for a phishing email to an analyst. Which of the following system logs would the analyst check first?
Authentication
201
An attacker has determined the best way to impact operations is to infiltrate third-party software vendors. Which of the following vectors is being exploited?
Supply chain
202
An organization would like to give remote workers the ability to use applications hosted inside the corporate network. Users will be allowed to use their personal computers, or they will be provided organization assets. Either way, no data or applications will be installed locally on any user systems. Which of the following mobile solutions would accomplish these goals?
VDI
203
Which of the following is used to ensure that evidence is legal proceedings when it is collected and provided to the authorities?
Chain of custody - the sequential documentation or trail that accounts for the sequence of custody, control, transfer, analysis, and disposition of physical or electronic evidence.
204
The Chief Information Security Officer (CISO) of a bank recently updated the incident response policy. The CISO is concerned that members of the incident response team do not understand their roles. The bank wants to test the policy but with the least amount of resources or impact. Which of the following BEST meets the requirements?
Tabletop walk-through - simulations of real-world attacks that are designed to test the organization's ability to respond to a cybersecurity incident. This exercise is a practice for responding to cyber incidents, with hypothetical cyber attacks launched at the organization.
205
Which of the following control types fixes a previously identified and mitigates a risk?
Corrective - minimize damage, facilitate recovery, and repair weaknesses so a similar attack doesn't happen again.
206
An analyst is reviewing logs associated with an attack. The logs indicate an attacker downloaded a malicious file that was quarantined by the AV solution. The attacker utilized a local non-administrative account to restore the malicious file to a new location. The file was then used by another process to execute a payload. Which of the following attacks did the analyst observe?
Privilege escalation - a technique where a cyber attacker compromises a system to gain unauthorized access.
207
A security engineer must deploy two wireless routers in an office suite. Other tenants in the office building should not be able to connect to this wireless network. Which of the following protocols should the engineer implement to ensure the STRONGEST encryption?
WPA2
208
An attacker browses a company's online job board attempting to find any relevant information regarding the technologies the company uses. Which of the following BEST describes this social engineering technique?
Reconnaissance - information-gathering stage of ethical hacking, where you collect data about the target system.
209
During an incident response process involving a laptop, a host was identified as the entry point for malware. The management team would like to have the laptop restored and given back to the user. The cybersecurity analyst would like to continue investigating the intrusion on the host. Which of the following would allow the analyst to continue the investigation and also return the laptop to the user as soon as possible?
tcpdump - a packet analyzer that is launched from the command line. It can be used to analyze network traffic by intercepting and displaying packets that are being created or received by the computer it's running on.
210
An analyst is trying to identify insecure services that are running on the internal network. After performing a port scan, the analyst identifies that a server has some insecure services enabled on default ports. Which of the following BEST describes the services that are currently running and the secure alternatives for replacing them? (Choose 3)
HTTP, HTTPS, Telnet, SSH, TLS, SSL
211
A security analyst needs to produce a document that details how a security incident occurred, the steps that were taken for recovery, and how future incidents can be avoided. During which of the following stages of the response process will this activity take place?
Lesson learned
212
An administrator is configuring a firewall rule set for a subnet to only access DHCP, web pages, and SFTP, and to specifically block FTP. Which of the following would BEST accomplish this goal?
Deny: ANY ANY 67
213
While investigating a recent security incident, a security analyst decides to view all network connections on a particular server. Which of the following would provide the desired information?
netstat - a tool aimed at real-time network-based in- trusion detection.
214
A company recently decided to allow its employees to use their personally owned devices for tasks like checking email and messaging via mobile applications. The company would like to use MDM, but employees are concerned about the loss of personal data. Which of the following should the IT department implement to BEST protect the company against company data loss while still addressing the employee's concerns?
Configure the MDM software to enforce the use of PINs to access the phone.
215
The concept of connecting a user account across the systems of multiple enterprises is BEST known as:
sing sign-on
216
A user received an SMS on a mobile phone that asked for bank details. Which of the following social-engineering techniques was used in this case?
Smishing - a combination of “SMS” and “phishing.” In a smishing attack, cybercriminals send deceptive text messages to lure victims into sharing personal or financial information, clicking on malicious links, or downloading harmful software or applications.
217
A company is working on a mobile device security after a report revealed that users granted non-verified software access to corporate data. Which of the following is the MOST effective security control to mitigate this risk?
Update the BYOD policy
218
A security analyst needs to implement security features across smartphones, laptops, and tablets. Which of the following would be the MOST effective heterogeneous platforms?
Applying MDM software
MDM - Mobile device management generates a centralized plan for managing multiple device types with varying operating systems such as iOS, Windows, Android, tvOS, Chrome OS, and macOS. Centralized management makes it easier to deploy MDM solutions in the cloud.
219
The new Chief Information Security Officer (CISO) at a company has asked the security team to implement stronger user account policies. The new policies require:
-Users to choose a pw unique to their last ten passwords
-Users to not log in from certain high-risk countries
Which of the following should the security team implement? (Choose 2)
Password history
Geolocation - is actually the position of a user's device, whether that's a home computer, laptop, smartphone, or fitness tracker. There are multiple ways for a device to determine its own position in the world, ranging from the most precise (GPS) to the least precise (IP-based geolocation).
220
Which of the following is MOST likely to outline the roles and responsibilities of data controllers and data processors?
GDPR - General Data Protection Regulation - requires that personal data must be processed securely using appropriate technical and organisational measures. The Regulation does not mandate a specific set of cyber security measures but rather expects you to take 'appropriate' action.
221
Which of the following is MOST likely to contain ranked and ordered information on the likelihood and potential impact of catastrophic events that may affect business processes and systems, while also highlighting the residual risks that need to be managed after mitigating controls have been implemented?
A risk register - is a log that lists all the potential risks that could impact your organization and how you plan to respond.
222
A worldwide manufacturing company has been experiencing email account compromises. In one incident, a user logged in from the corporate office in France, but then seconds later, the same user account attempted to login from Brazil. Which of the following account policies would BEST prevent this type of attack?
Geofencing - creates virtual boundaries in real-world geographical areas and can be drawn in a wide variety of shapes and sizes.
223
Which of the following TCP ports should be blocked for all external inbound connections to the perimeter network as a workaround to protect the servers? (choose 2)
port 135, 445
135 - RPC client-server communication
445 - are used for authentication and file sharing.
224
A recent phishing campaign resulted in several compromised user accounts. The security incident response team has been tasked with reducing the manual labor of filtering through all the phishing emails as they arrive and blocking the sender's email address, along with other time-consuming mitigation actions. Which of the following can be configured to streamline those tasks?
SOAR playbook - Security Orchestration, Automation, and Response. It is a collection of integrated tools that enable automation and orchestration of various cybersecurity tasks. A playbook, on the other hand, is a component of SOAR which automates specific workflows or tasks within the security operations framework.
225
A chief Information Security Officer has defined resiliency requirements for a new data center architecture. The requirements are as follows:
- Critical file shares will remain accessible during and after a natural disaster
- Five percent of hard disk can fail at any given time without impacting the data
-Five percent of hard disk can fail at any given time without impacting the data- Systems will be forced to shut down gracefully when battery levels are below 20%.
Which of the following are required to best meet these objectives? Choose 3.
RAID - a way of storing the same data in different places on multiple hard disks or solid-state drives (SSDs) to protect data in the case of a drive failure.
UPS - Uninterruptible Power Supply - A device with an internal battery that allows connected devices to run for at least a short time when the primary power source is lost.
Redundant power supplies - also known as dual power supplies, are essential for network infrastructure as they minimize the risk of power failure and help maintain uptime.
226
Which of the following is a security best practice that ensures the integrity of aggregated log files within the SIEM?
Right protect the aggregated log files and move them to an isolated server with limited access.
SIEM - Security Information and event management.
227
Security analyst is evaluating the risk of authorizing multiple security solutions to collect data from the company's cloud environment. Which of the following is an immediate consequence of these integrations?
Increase in the attack surface
228
Which of the following explains why RTO is included in a BIA?
It informs the backup approach so that the organization can recover data to a known time.
RTO - recovery time objective (RTO) is the maximum tolerable length of time that a computer, system, network or application can be down after a failure or disaster occurs.
BIA - Business Impact Analysis - process that assesses the security risks associated with potential system breakdowns and identifies resiliency strategies that ensure business continuity during an incident or natural disaster.
229
Which of the following concepts best describes tracking and documenting changes to software managing access to files and systems?
version control - keeps track of every modification to the code in a special kind of database.
230
A penetration tester is brought on site to conduct a full attack simulation at a hospital. the penetration tester notices WAP that is hanging from the drop ceiling by its cabling and is reachable. Which of the following recommendations would the penetration tester most likely make given this observation?
Secure the access point and cabling inside the drop ceiling.
WAP - Wireless Application Protocol - A standard that defines the way in which Internet communications and other advanced services are provided on wireless mobile devices.
231
Which of the following techniques eliminates the use of rainbow tables for password cracking?
Salting - a concept that typically pertains to password hashing. Essentially, it's a unique value that can be added to the end of the password to create a different hash value. This adds a layer of security to the hashing process, specifically against brute force attacks.
Rainbow Table - a precomputed table that contains the password hash value for each plain text character used during the authentication process.
232
During a security assessment, a security analyst finds a file with overly permissive permissions. Which of the following tools will allow the analysts to reduce the permissions for the existing users and groups and remove the set-user-ID bit from the file?
chmod - or change mode, command allows an administrator to set or modify a file's permissions.
233
The security analyst is revealing the vulnerability scan report for a Web Server falling in incident. The vulnerability that was used to exploit the server is present in historical vulnerability scan reports, and a patch is also available for the vulnerability. Which of the following is most likely the cause?
The scam reported a false negative for the vulnerability.
False Negative - false alarm.
234
Which of the following is a known security risk associated with data archives that contain financial information?
Data can become a liability of archive longer than required by regulatory guidance. A false negative state is the most serious and dangerous state. This is when the IDS identifies an activity as acceptable when the activity is actually an attack.
235
Which of the following is a known security risk associated with data archives that contain financial information?
Data can become a liability if archived longer than required by regulatory guidance.
236
Which of the following BEST describes the process of documenting who has access to evidence?
Chain of custody - A process that tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle by documenting each person who handled the evidence, the date/time it was collected or transferred, and the purpose for the transfer.
237
A systems engineer wants to leverage a cloud based architecture with low latency between network connected devices that also reduce the bandwidth that is required by performing analytics directly on the endpoints. which of the following would best meet the requirements choose 2
IaaS - Infrastructure-as-a-Service (IaaS) enables enterprises to lease or rent servers to use for storage and computation in the cloud.
Fog computing - a form of distributed computing that brings computation and data storage closer to the network edge, where many IoT devices are located.
238
Which of the following is a policy that provides a greater depth and breadth of knowledge across an organization
Job rotation policy - ob rotation serves two functions. First, it provides a type of knowledge redundancy. Second, moving personnel around reduces the risk of fraud, data modification, theft, sabotage, and misuse of information.
239
The company is moving its retail website to a public cloud provider. The company wants to tokenize credit card data, but not allow the cloud provider to see the credit card information. what is the following would be best meet these objectives
TLS - Transport Layer Security - a widely adopted security protocol designed to facilitate privacy and data security for communications over the Internet.
240
Can an administrator assist legal in compliance team with ensuring information about customer transactions is archived for the proper time. Which of the following data policies is the administrator carrying out?
Retention - refers to the regular archiving of event logs, particularly those significant to cyber security.
241
The company is moving its retail website to a public cloud provider. The company wants to tokenize credit card data, but not allow the cloud provider to see the store credit card information. Which of the following would best meet these objectives?
TLS - Transport Layer Security, or TLS, is a widely adopted security protocol designed to facilitate privacy and data security for communications over the Internet. A primary use case of TLS is encrypting the communication between web applications and servers, such as web browsers loading a website.
242
A security analyst is tasked with defining the "something you are" factor the companies MFA settings. Which of the following is best to use to complete the configuration?
HMAC-based, one-time password
Hash-based message authentication code (or HMAC) is a cryptographic authentication technique that uses a hash function and a secret key.
MFA - Multi Factor Authentication -
243
Which of the following processes will eliminate data using a method that will allow the storage device to be reused after the process is complete?
Overwriting - a process where new data is written over the existing data in the same physical space, making the original data inaccessible. On the other hand, when data is deleted, it's removed from the file system, but the actual data may still exist on the storage device until it's overwritten by new data.
244
A Web Server has been compromised due to a ransomware attack. Further investigation reveals the ransomware has been in the server for the past 72 hours. The system administrator needs to get the service back up as soon as possible. Which of the following should the administrator use to restore services to a secure state?
The last incremental backup that was conducted seventy two hours ago
245
A network engineer created two subnets that will be used for production and development servers. Per security policy, production and development servers, much each have a dedicated network that cannot communicate with one another directly. Which of the following should be deployed so that the server administrators can access these devices?
Jump servers - refers to a secure computer that spans two or more networks, allowing users to connect to it from one network, and then “jump“ to another network. It's also known as a jump host or a jump box.
NOT VLAN - Network segmentation with virtual local area networks (VLANs) creates a collection of isolated networks within the data center. Each network is a separate broadcast domain. When properly configured, VLAN segmentation severely hinders access to system attack surfaces.
246
A Chief Information Security officer (CISO) wants to ensure the organization is validating and checking the integrity of zone transfers. Which of the following solutions would be implemented?
DNSSEC - is a suite of extensions that improve Domain Name System (DNS) security by verifying that DNS results have not been tampered with. Enterprises can use DNSSEC to improve their DNS security. DNS technology wasn't designed with security in mind. One example of an attack on DNS infrastructure is DNS spoofing.
DNS - Domain Name System
247
A security architect is required to deploy to conference rooms, some workstations that will allow sensitive data to be displayed on large screens. Due to the nature of the data, it cannot be stored in the conference rooms. The file share is located in a local data center. Which of the following should the security analysts recommend to best meet the requirement?
VDI and thin clients
VDI - Virtual Desktop Infrastructure
thin clients - is a computer that uses resources housed inside a central server as opposed to a hard drive. A thin client connects to a server-based environment that hosts the majority of applications, memory, and sensitive data the user needs.
248
Which of the following controls is used to make an organization initially aware of a data compromise?
Detective - A cybercrime investigator is responsible for investigating and analyzing cybercrime incidents, such as hacking, identity theft, fraud, and other types of cyber-related crimes. Their primary goal is to identify the culprits and gather evidence that can be used to prosecute them in court.
249
An annual information security assessment has revealed that several OS-level configurations are not in compliance due to outdated hardening standards the company is using. Which of the following would best to use to update and reconfigure the OS-level security configurations?
CIS benchmarks - The Center for Internet Security (CIS) publishes the CIS Critical Security Controls (CSC) to help organizations better defend against known attacks by distilling key security concepts into actionable controls to achieve greater overall cybersecurity defense.
CIS - Center for Internet Security
250
A company acquired several other small companies. The company that acquired the others is transitioning network services to the cloud. The company wants to make sure that performance and security remain intact. Which of the following best meets both requirements?
Segmentation - Network segmentation is a network security technique that divides a network into smaller, distinct sub-networks that enable network teams to compartmentalize the sub-networks and deliver unique security controls and services to each sub-network.
251
After a recent external audit, the compliance team provides a list of several noncompliant, in scope hosts that were not encrypting cardholder of data at rest. Which of the following compliance frameworks would address the compliance teams greatest concern?
PCI DSS - The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards formed in 2004 by Visa, MasterCard, Discover Financial Services, JCB International and American Express.
252
A security analyst is receiving several alerts per user and is trying to determine if various logins are malicious. The security analyst would like to create a baseline of normal operations and reduce noise. Which of the following actions should the security analyst perform?
Adjust the sensitivity levels of the SIEM correlation engine.
SIEM - Security Information and event management - is a solution that helps organizations detect, analyze, and respond to security threats before they harm business operations.
253
Which of the following is most effective way to detect security flaws present on third-party libraries embedded on software before it is released into production?
Implement a vulnerability scan to assess dependencies earlier on SDLC.
254
Which of the following prevents an employee from seeing a colleague who is visiting an inappropriate website?
AUP - acceptable use policy (AUP) is a document stipulating constraints and practices that a user must agree to for access to a corporate network, the internet or other resources.
255
A user reports falling for a phishing email to an analyst. Which of the following system logs would the analyst check first?
Authentication - records of system activity involving logging in and out. High-level security events are logged for auditing purposes.
256
An hacker has determined the best way to impact operations is to infiltrate 3rd party software vendors. Which of the following vectors is being exploited?
Supply chain
Supply Chain Cyber Security: The practice of identifying, assessing and managing cyber security risks in the supply chain, encompassing technological and human risk factors.
257
An organization would like to give remote workers the ability to use applications hosted inside the corporate network. Users will be allowed to use their personal computers, or they will be provided organization assets. Either way, no data or applications will be installed locally on any user systems. Which of the following mobile solutions would accomplish these goals?
VDI - Virtual Desktop Infrastructure
258
Which of the following used to ensure that evidence is admissible in legal proceedings when it is collected and provided to authorities?
Chain of custody - The chain of custody is the most critical process of evidence documentation. It is a must to assure the court of law that the evidence is authentic
259
The chief information security officer (CISO) of a bank recently updated the incident response policy. The CISO is concerned that members of the incident response team do not understand their roles. The banks wants to test the policy, but with the least amount of resources or impact, which is the following best meets this requirement?
Tabletop walk-through - Tabletop exercises are meant to help organizations consider different risk scenarios and prepare for potential cyber threats.
260
Which of the following control types fixes a previously identified issue and mitigates a risk?
Corrective - Corrective controls are designed to correct errors or irregularities that have been detected. Preventive controls, on the other hand, are designed to keep errors and irregularities from occurring in the first place. Controls may be automated, manual or hybrid.
261
Analyst is reviewing logs associated with an attack. The logs indicate an attacker downloaded a malicious file that was quarantined by the AV solution. The attacker utilized a local non-administrative account to restore the malicious file to a new location. The file was then used by another process to execute a payload. Which of the following attacks did the analysts observe?
Privilege escalation - A privilege escalation attack is a cyberattack to gain illicit access of elevated rights, permissions, entitlements, or privileges beyond what is assigned for an identity, account, user, or machine. This attack can involve an external threat actor or an insider threat.
262
A security engineer must deploy two wireless routers in an office suite. Other tenants in the office building should not be able to connect to this wireless network. Which of the following protocols should the engineering implement to ensure the strongest encryption?
WPA2 - (Wi-Fi Protected Access 2) is an encrypted security protocol that protects internet traffic on wireless networks.
263
An attacker browses the company's online job board, attempting to find any relevant information regarding the technologies the company uses. Which of the following best describes this social engineering technique?
Reconnaissance - Reconnaissance, often referred to as 'cyber reconnaissance' or 'cyber intelligence gathering', is the process of collecting information about potential targets, vulnerabilities, and attack vectors.
264
During an incident response process involving a laptop, a host was identified as the entry point for malware. The management team would like to have the laptop restored and given back to the user. The cybersecurity analyst would like to continue investigating the intrusion on the host. Which of the following would allow the analysts to continue the investigation and also return the laptop to the user as soon as possible?
tcpdump - is used to capture and analyze network traffic. Sysadmins can use it to view real-time traffic or save the output to a file and analyze it later.
265
An analyst is trying to identify insecure services that are running on the internal network. After performing a port scan, the analysis identifies that a server has some insecure services enabled on the default port. Which of the following best describes the services that are currently running and the secure alternatives for replacing them? (choose three)
HTTP, HTTPS
Telnet, SSH
TLS, SSL
266
A security analyst needs to produce a document that details how a security incident occurred, the steps that were taken for recovery, and how future incidents can be avoided. During which of the falling stages of the response process will this activity take place?
Lessons learned - A Vital Component of Incident Response. Once a cybersecurity incident has been resolved, the incident response team convenes for a post-incident review. During this crucial stage, the team examines each aspect of the response process, leaving no stone unturned.
267
Well investigating a recent security incident, a security analyst decides to view all network connections on a particular server. Which of the following would provide the desired information?
netstat - is a common command line TCP/IP networking utility available in most versions of Windows, Linux, UNIX and other operating systems. Netstat provides information and statistics about protocols in use and current TCP/IP network connections. (The name derives from the words network and statistics.)
268
The company recently decided to allow its employees to use their personal owned devices for tasks like checking email and messaging via mobile applications. The company would like to use MDM, but employees are concerned about the loss of personal data. Which of the following should the IT department implement to best protect the company against company data loss while still addressing that employee's concerns?
Configure the MDM software to enforce the use of PINs to access the phone.
MDM - Mobile Device Management is any software that allows IT to automate, control, and secure administrative policies on laptops, smartphones, tablets, or any other device connected to an organization's network.
269
The concept of connecting a user account across the systems of multiple enterprises is best known as?
Single sign-on (SSO) - is an authentication method that lets users access multiple applications and services using a single set of login credentials.
270
A user received an SMS on a mobile phone that asked for bank details. Which of the following social engineering techniques was used in this case?
Smishing - The term is a combination of “SMS” and “phishing.” In a smishing attack, cybercriminals send deceptive text messages to lure victims into sharing personal or financial information, clicking on malicious links, or downloading harmful software or applications.
271
A company is working on mobile device security after a report revealed that users granted non-verified software access to corporate data. Which of the following is the most effective security controls to mitigate this risk?
Update the BYOD policy - Bring your own device (BYOD) means that employees use personal devices to connect to an organization's network, accessing work-related systems and possibly, sensitive data. Personal devices may include smartphones, personal computers, tablets or USB drives.
272
The security analyst needs to implement security features across smartphones, laptops, and tablets. Which of the following would be the most effective across heterogeneous platforms?
Applying MDM software - Mobile Device Management is any software that allows IT to automate, control, and secure administrative policies on laptops, smartphones, tablets, or any other device connected to an organization's network.
273
The new Chief Information Security Officer (CISO) at a company has asked the security team to implement stronger user acceptance policies. The new policies require:
-users choose a password unique to their last 10 passwords to
-users to not log in from certain high risk countries.
Which of the following should the security team implement? (Choose two)
Password history
Geolocation - is the identification of the geographic location of a user or computing device via an array of data collection processes (Device/Server based and Combined data collection). The most commonly used Geo-location service is a GPS device to determine a precise location of a person.
274
Which of the following is most likely to outline the roles and responsibility of data controllers and data processors?
GDPR - General Data Protection Regulation - The GDPR requires that personal data must be processed securely using appropriate technical and organisational measures. The Regulation does not mandate a specific set of cyber security measures but rather expects you to take 'appropriate' action.
275
Which of the following is most likely to contain ranked and ordered information on the likelihood potential impact of catastrophic events that may affect business processes and systems, while also highlighting the residual risk that need to be managed after mitigating controls have been implemented?
A risk register - is a specialized tool used to identify and organize the risks unique to cybersecurity.
276
A worldwide manufacturing company has been experiencing email account compromises. In one incident's, a user logged in from the corporate office in France, but then seconds later, the same user account attempted a login from Brazil. Which of the following account policies would best prevent this type of attack?
Geofencing - Geofencing technology creates virtual boundaries in real-world geographical areas and can be drawn in a wide variety of shapes and sizes. Users can fully customise them to suit specific needs, like monitoring select rooms in the home or the perimeter around an entire property.
277
A new vulnerability in the SMB protocol of the windows systems was recently discovered, but no patches are currently available to resolve the issue. The security administrator is concerned that the servers in the companies perimeter network will be vulnerable to external attack: however, the administrator cannot disable the service of the servers, as the SMB is used by a number of internal systems and applications on the LAN. Which of the following TCP ports should be blocked for all external inbound connections to the perimeter network as a workaround to protect the servers? choose two.
135 - RPC client-server communication - allows remote connections
445 - 139 and 445 are used for authentication and file sharing
UDP ports 137 and 138 are used for local NetBIOS browser, naming, and lookup functions.
278
A recent phishing campaign resulted in several compromise user counts. The security incident response team has been tasked with reducing the manual labor of filtering through all the phishing emails as they have arrive and blocking the sender's email address, along with the one time consuming my mitigation actions. Which of the following can be configured to streamline those tasks?
SOAR playbook - stands for Security Orchestration, Automation, and Response. It is a collection of integrated tools that enable automation and orchestration of various cybersecurity tasks. A playbook, on the other hand, is a component of SOAR which automates specific workflows or tasks within the security operations framework.
279
Which of the following concepts best describes tracking and documenting changes to software and managing access to files and systems?
Version control - keeps track of every modification to the code in a special kind of database. If a mistake is made, developers can turn back the clock and compare earlier versions of the code to help fix the mistake while minimizing disruption to all team members.
280
A penetration tester is brought on site to conduct a full attack simulation at a hospital. The penetration tester noticed a WAP that is hanging from the drop ceiling by its cabling and is reachable. Which of the following recommendations would the penetration testers most likely make given this observation?
Secure the access point and cabling inside the drop ceiling.
WAP - Wireless Application Protocol - A standard that defines the way in which Internet communications and other advanced services are provided on wireless mobile devices.
281
Which of the following techniques eliminates the use of rainbow tables for password cracking?
Salting - In cryptography, a salt is random data fed as an additional input to a one-way function that hashes data, a password or passphrase. Salting helps defend against attacks that use precomputed tables (e.g. rainbow tables), by vastly growing the size of table needed for a successful attack.
282
During a security assessment, a security analyst finds a file with overly permissive permissions. Which of the following tools will allow the analyst to reduce the permissions for the existing users and groups and remove the set-user-ID bit from the file?
chmod or change mode, command allows an administrator to set or modify a file's permissions. Every UNIX/Linux file has an owner user and an owner group attached to it, and every file has permissions associated with it. The permissions are as follows: read, write, or execute.
283
A network administrator is concerned about users being exposed to malicious content when accessing company cloud applications. The administrator wants to be able to block access to sites based on the AUP. The users must also be protected because many of them work from home or at remote locations, providing on site customer support. Which of the following should the administrator employ to meet this criteria?
Implement an SWG
SWG - secure web gateway (SWG) - A secure web gateway protects an organization from online security threats and infections by enforcing company policy and filtering Internet-bound traffic. A secure web gateway is an on-premise or cloud-delivered network security service.
AUP - acceptable use policy (AUP) is a document stipulating constraints and practices that a user must agree to for access to a corporate network, the internet or other resources.
284
A website developers working on a new ecommerce website that has asked for an information security expert for most appropriate way to store credit card numbers to create an easy recording process. Which of the best following methods would best accomplish this goal?
Tokenizing the credit cards in the database.
Tokenization refers to a process by which a piece of sensitive data, such as a credit card number, is replaced by a surrogate value known as a token. The sensitive data still generally needs to be stored securely at one centralized location for subsequent reference and requires strong protections around it.
285
Which of the following supplies non-repudiation during a forensics investigation?
Using a SHA-2 signature of a drive image
SHA-2 is a family of hashing algorithms to replace the SHA-1 algorithm. SHA-2 features a higher level of security than its predecessor. It was designed through The National Institute of Standards and Technology (NIST) and the National Security Agency (NSA).
Nonrepudiation provides proof of the origin, authenticity and integrity of data. It provides assurance to the sender that its message was delivered, as well as proof of the sender's identity to the recipient. This way, neither party can deny that a message was sent, received and processed.
286
A security analyst is tasked with classifying data to be stored on company servers. Which of the following should be classified as proprietary?
Marketing strategies
What is proprietary in cyber security?
Anything regarded as extremely valuable that an individual or a firm created and that is not permitted to be transmitted or exhibited publicly is termed proprietary knowledge. That information is regarded as a valuable asset. Companies must generally handle information as a secret to be considered proprietary.
287
Which of the following hold staff accountable while escorting unauthorized personnel?
Visitor logs
The purpose of a visitor log book is to have a record of people's names, contact information, and reasons for visiting. With a guest registry, you can monitor people's safety as well as gather useful data.
288
An organization's chief security officer (CSO) wants to validate the business involvement in the incident response plan due to ensure its validity and thoroughness. Which of the following is the CSO most likely use?
A tabletop exercise - discussion-based sessions where team members meet in an informal, classroom setting to discuss their roles during an emergency and their responses to a particular emergency situation. A facilitator guides participants through a discussion of one or more scenarios.
289
Which of the following documents provides guidance regarding the recommended deployment of network security systems from the manufacturer?
Reference architecture - is a document or set of documents that provides recommended structures and integrations of IT products and services to form a solution. The reference architecture embodies accepted industry best practices, typically suggesting the optimal delivery method for specific technologies.
290
During a recent security assessment, a vulnerability was found in a common OS. The OS vendor was unaware of the issue and promised to release a patch within the next quarter. Which of the following best describes this type of vulnerability?
Zero day - signifies that from the moment the vulnerability is discovered, there are zero days of protection, making it ripe for exploitation. Hackers can exploit these vulnerabilities to compromise systems, steal data, launch attacks, or disrupt operations.
291
Which of the following is a targeted attack aimed at compromising users with a specific industry or group?
Watering hole - a targeted attack designed to compromise users within a specific industry or group of users by infecting websites they typically visit and luring them to a malicious site. The end goal is to infect the user's computer with malware and gain access to the organization's network.
292
To reduce and limit software and infrastructure costs, the chief information officer has requested to move email services to the cloud. The cloud provider and the organization must have security controls to protect sensitive data. Which of the following cloud services would best accommodate the request?
SaaS - (Software as a Service) security refers to the measures and processes implemented to protect the data and applications hosted by a SaaS provider. This typically includes measures such as encryption, authentication, access controls, network security, and data backup and recovery.
293
A security engineer is concerned that the strategy for detection on endpoints is too heavy dependent on previously defined attacks. The engineer would like a tool to monitor for changes to key files and network traffic on the device. Which of the following tools best addresses both detection and prevention?
HIPS - A host intrusion prevention system (HIPS) is an approach to security that relies on third-party software tools to identify and prevent malicious activities. Host-based intrusion prevention systems are typically used to protect endpoint devices.
294
During a recent incident, an external hacker was able to exploit an SMB vulnerability over the Internet. Which of the following action items should the security analysts performed first to prevent this from occurring again?
block unneeded TCP 445 connections
SMB - The SMB protocol enables applications and their users to access files on remote servers, as well as connect to other resources, including printers, mailslots and named pipes. SMB provides client applications with a secure and controlled method for opening, reading, moving, creating and updating files on remote servers.
port 445 - Microsoft networking port which is also linked to the NetBIOS service present in earlier versions of Microsoft Operating Systems. It runs Server Message Block (SMB), which allows systems of the same network to share files and printers over TCP/IP. This port shouldn't be opened for external network.
295
A penetration tester is fuzzing an application to identify where the EIP of the stack is located on memory. Which of the following attacks is the penetration tester planning to execute?
Buffer overflow - A buffer overflow attack typically involves violating programming languages and overwriting the bounds of the buffers they exist on. Most buffer overflows are caused by the combination of manipulating memory and mistaken assumptions around the composition or size of data.
Buffers are memory storage regions that temporarily hold data while it is being transferred from one location to another. A buffer overflow (or buffer overrun) occurs when the volume of data exceeds the storage capacity of the memory buffer.
296
Server administrators want to configure a cloud solution so that computing memory and processor usage is maximized, most officially across the number of virtual servers. They also need to avoid potential denial of service situations caused by availability. Which of the following should administrators configure to maximize system availability while the efficiency utilizing available computing power?
High availability - High availability means that an IT system, component, or application can operate at a high level, continuously, without intervention, for a given time period. High-availability infrastructure is configured to deliver quality performance and handle different loads and failures with minimal or zero downtime.
297
A security analysts in a SOC has been tasked with onboarding a new network into the SIEM, Which of the following best describes the information that should feed into a SIEM solution in order to adequately support an investigation?
Logs from each device type and security layer to provide correlation of events.
SOC - Security Operation Center (SOC) is a centralized function within an organization employing people, processes, and technology to continuously monitor and improve an organization's security posture while preventing, detecting, analyzing, and responding to cybersecurity incidents.
SIEM - Security information and event management (SIEM) technology supports threat detection, compliance and security incident management through the collection and analysis (both near real time and historical) of security events, as well as a wide variety of other event and contextual data sources.
298
An organization just implemented a new security system. Local laws state that citizens must be notified prior to encountering the detection mechanism to deter malicious activities. Which of the following is being implemented?
Motion sensors with signage
signage - Digital signage is a centrally controlled content distribution platform to playback digital content to one or many displays or screens. Digital signage screens are used for the relaying of any number of types of information, such as text, video, images, live weather, news, TV, menus, flights, calendars, and adverts.
299
An IT security manager requests a report on a company information that is publicly available. The manager's concern is that malicious actors will be able to access the data without engaging in active reconnaissance Which of the following is most efficient approach to perform the analysis?
Provide a domain parameter to theHarvester tool.
A domain parameter can be defined for a specific domain, or can be defined “system-wide,” which means defined for all current and future domains in the current namespace. Domain parameters are divided into two groups, Basic and Advanced. Basic parameters are useful for customizing NLP default behavior.
theHarvester is a command-line tool included in Kali Linux that acts as a wrapper for a variety of search engines and is used to find email accounts, subdomain names, virtual hosts, open ports / banners, and employee names related to a domain from different public sources (such as search engines and PGP key servers).
NLP - NLP is the ability of machines to understand human language, including speech and text. Natural Language Processing (NLP), a subfield of artificial intelligence (AI) that holds the promise of reshaping the landscape of cybersecurity.
300
Which of the following environments utilizes dummy data and is most likely to be installed locally on a system that allows code to be accessed directly and modified easily with each build?
Development
301
An analyst receives multiple alerts for beaconing activity for a host on the network. After analyzing the activity, the analyst observes the following activity
- The user enters Comptia.org into a web browser
- The website that appears is not the Comptia.org site
- The website is a malicious site from the attacker
- Users in a different office are not having the same issue
Which of the following types of attacks was observed?
Locator (URL) redirection - is a vulnerability which allows an attacker to force users of your application to an untrusted external site. The attack is most often performed by delivering a link to the victim, who then clicks the link and is unknowingly redirected to the malicious website.
Beaconing - beaconing is a term used to describe a continuous cadence of communication between two systems. In the context of malware, beaconing is when malware periodically calls out to the attacker's C2 server to get further instructions on tasks to perform on the victim machine.
302
Which of the following in the incident response process is the best approach to improve the speed of the identification phase?
Tune monitoring in order to reduce false positive rates.
Tuning is a combination of reducing false positives, working with alerts, and correlating events and trends to ensure greater accuracy.
False positive - a person or test result that is incorrectly classified as positive
303
The Security Administrator is analyzing the corporate wireless network. The network only has two access points running on channels 1 and 11. While using airodump-ng, the administrator notices other access points are running with the same corporate ESSID on all available channels and with the same BSSID of one of the legitimate access points. Which of the following attacks is happening on the corporate network?
Rogue access point - is an unauthorized Wi-Fi access point that is added to a network without the knowledge or permission of the network administrator. How can I detect rogue access points? Wi-Fi scanning tools and network monitoring tools can be used to detect rogue access points.
ESSID - (Extended Service Set IDentifier) is a collection of Access Points (or Virtual Access Points) sharing the same SSID.
BSSID - stands for Basic Service Set Identifier, and it's the MAC (Media Access Control) physical address of the access point or wireless router that is used to connect to the WiFi.
Airodump-ng is a packet capture utility that captures and saves raw data packets for further analysis. If you have a GPS receiver connected to your computer, airodump-ng can fetch the coordinates of the access points as well. After enabling monitor mode using airmon-ng, you can start capturing packets using airodump.
304
When implementing automation with IoT devices, which of the following should be considered first to keep the network secure?
Communication protocols - A communication protocol that provides the appropriate confidentiality, authentication, and content-integrity protection
305
An organization is concerned that it's hosted web servers are not running the most updated version of the software. Which of the following would work best to help identify potential vulnerabilities?
nmap comptia.org -p 80 -sv
nmap - ("Network Mapper") is a free and open source utility for network discovery and security auditing.
306
A news article states hackers have been selling access to IoT camera feeds. Which of the following is most likely reason for this issue?
Weak credentials - The password contains fewer than eight characters. The password is a word found in a dictionary (English or foreign). Names of family, pets, friends, coworkers, fantasy characters, etc.
307
The company wants to build a new website to sell products online. The website will host a storefront application that will allow visitors to add products to a shopping cart and pay for the products using a credit card. Which of the following protocols would be the most secure to implement?
TLS - Transport Layer Security, or TLS, is a widely adopted security protocol designed to facilitate privacy and data security for communications over the Internet.
308
An IT manager is estimating the mobile device budget for the upcoming year. Over the last five years, the number of devices that were replaced due to lost damage or theft steadily increased by 10%. Which of the following would best describe the estimated number of devices to be replaced next year?
ARO - is the estimated number of times a security incident is expected to occur in a year, and SLE is the estimated monetary value of a single incident.
SLE - Single Loss Expectancy (SLE) tells us what kind of monetary loss we can expect if an asset is compromised because of a risk.
309
An organization is repairing the damage after an incident. Which of the following controls is being implemented?
Corrective - Corrective controls are designed to correct errors or irregularities that have been detected. Preventive controls, on the other hand, are designed to keep errors and irregularities from occurring in the first place.
310
Achieve executive officers personal information was stolen in a social engineering attack. Which of the following sources would reveal if the CEO personal information is for sale?
the dark web
311
Which of the following typically uses a combination of human and artificial intelligence to analyze event data and take action without intervention?
SOAR - Security orchestration, automation, and response (SOAR) primarily focuses on threat management, security operations automation, and security incident responses. SOAR platforms can instantly assess, detect, intervene, or search through incidents and processes without the consistent need for human interaction.
312
A security analyst has been tasked with creating a new wifi network for the company. the requirements received by the analyst are as follows:
- Must be able to differentiate between users connected to Wifi
- The encryption keys need to change routinely without interrupting the users or forcing reauthentication
- Must be able to integrate with RADIUS
- Must not have any open SSIDs
Which of the following best accommodates these requirements?
WPA2-Enterprise
RADIUS - Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that authorizes and authenticates users who access a remote network. A protocol is a collection of rules that control how something communicates or operates.
313
The Chief Security officer is looking for a solution that can reduce the occurrence of customers receiving errors from back end infrastructure when systems go offline unexpectedly. The security architect would like the solution to help maintain session persistence. Which of the following would best meet the requirements?
Load balancer - Load balancers improve application performance by increasing response time and reducing network latency. They perform several critical tasks such as the following: Distribute the load evenly between servers to improve application performance. Redirect client requests to a geographically closer server to reduce latency.
314
Which of the following should an organization consider implementing in the event executives need to speak to the media after a publicized data breach?
Communication plan
315
A well known organization has been experiencing attacks from APTs. The organization is concerned that custom malware is being created and emailed into the company or installed on USB sticks that are dropped into parking lots. Which of the following is the best defense against this scenario?
Enforcing S/MIME for email and automatically encrypting USB drives upon insertion.
(Secure/Multipurpose internet Mail Extensions) is a widely accepted protocol for sending digitally signed and encrypted messages
APTs - An advanced persistent threat (APT) is a well-resourced adversary engaged in sophisticated malicious cyber activity that is targeted and aimed at prolonged network/system intrusion. APT objectives could include espionage, data theft, and network/system disruption or destruction.
316
The company is implementing BYOD and wants to ensure all users have access to the same cloud based services. Which of the following would best allow the company to meet this requirement?
Saas - SaaS (Software as a Service) security refers to the measures and processes implemented to protect the data and applications hosted by a SaaS provider. This typically includes measures such as encryption, authentication, access controls, network security, and data backup and recovery.
317
An organization is tuning SIEM rules based off threat intelligence reports. Which of the following phases of the incident response process does this scenario represent?
Preparation
Incident response is a structured process organizations use to identify and deal with cybersecurity incidents. The NIST framework for incident response includes four stages: preparation and prevention; detection and analysis; containment, eradication, and recovery; and post-incident activity.
318
The database administration team is requesting guidance for a secure solution that will ensure confidentiality of card holder data at rest only in certain fields in the database schema. The requirement is to sustain a sensitive data field with a nonsensitive field that is rendered useless if it dated rates occurs. Which of the following is the best solution to meet this requirement?
Tokenization - Tokenization refers to a process by which a piece of sensitive data, such as a credit card number, is replaced by a surrogate value known as a token. The sensitive data still generally needs to be stored securely at one centralized location for subsequent reference and requires strong protections around it.
319
Company security team receives a notice of critical vulnerability affecting a high profile device within the web infrastructure. The vendor patch was just made available online but has not yet been regression tested and developed in environments. In the interim firewall rules were implemented to reduce that access to the interface affected by the vulnerability. Which of the following controls did this scenario describe?
Preventive
Incident response is a structured process organizations use to identify and deal with cybersecurity incidents. The NIST framework for incident response includes four stages: preparation and prevention; detection and analysis; containment, eradication, and recovery; and post-incident activity.
320
The company was recently breached, part of the company's new cybersecurity strategy is to centralize the logs from all security devices. Which of the following components forwards allows to the central source?
Log collector - A log collector is a tool that aggregates the logs from different sources across your system, normalizes them, and offers a way to view the logs more easily.
321
Which of the following is most likely reason for securing an air gap laboratory HVAC system?
To ensure availability
322
The user forwarded a suspicious email to the security team. Upon investigation a malicious URL was discovered. Which of the following should be done first to prevent others using users from from accessing the malicious URL?
configure the web content filter for the web address
is a process that manages or screens access to specific emails or webpages. The goal is to block content that contains harmful information. Content filtering programs are commonly used by organizations to control content access through their firewalls. They can also be used by home computer users.
323
They system analyst is responsible for generating a new digital forensics chain of custody form. Which of the following should the analysts include in the documentation? (choose 2)
the provenance of the artifacts
the date and time
Provenance - The chronology of the origin, development, ownership, location, and changes to a system or system component and associated data. It may also include personnel and processes used to interact with or make modifications to the system, component, or associated data.
324
An organization is migrating several SaaS applications that support SSO. The security manager wants to ensure the migration is completed securely. Which of the following application integration aspects should the organization consider before focusing into underlying implementation details? Choose two
the identity of federation protocol
the registration authority
In a federation protocol, a three-party relationship is formed between the subscriber, the IdP, and the RP, as shown in Figure 1. Figure 1. Federation Overview. A federation relationship between an IdP and RP is established in a multi-stage process: First, the IdP and RP agree to enter into a trust agreement.
registration authority - An entity authorized by the certification authority system (CAS) to collect, verify, and submit information provided by potential Subscribers which is to be entered into public key certificates. The term RA refers to hardware, software, and individuals that collectively perform this function.
IdP - An identity provider (IdP) is a service that stores and verifies user identity. IdPs are typically cloud-hosted services, and they often work with single sign-on (SSO) providers to authenticate users. Authentication.
RP - Relying Party (RP) is a server that processes requests for access into online resources. Web applications are one kind of RP. RPs are also called “claims-aware” or “claims-based” applications since they support a device or person's claim to be the legitimate party requesting access.
325
The security analyst has been tasked with finding the maximum amount of data loss that it can occur before ongoing business operations will be impacted. Which of the following terms best defined this metric?
RPO - Recovery Point Objective (RPO) describes the interval of time that might pass during a disruption before the quantity of data lost during that period exceeds the Business Continuity Plan's maximum allowable threshold or “tolerance.”
326
The IT departments on site developer has been with a team for many years. Each time an application is released, the security team is able to identify multiple vulnerabilities. Which of the following would best help the team to ensure the application is ready to be released to production?
Submit the application to QA before releasing it
327
During a security incident investigation with an analyst consults the company's SIEM and sees an event concerning high traffic to a known malicious command and control server. The analysts would like to determine the number of company workstations that may be impacted by this issue. Which of the following can provide this information?
DNS Logs
DNS refers to your domain name server, which ensures that users can connect to the right IP address when they type in a URL, such as Google.com. DNS security is different. Unlike DNSSEC, which involves a specific method, protocol, or extension, DNS security is a concept.
SIEM - Security information and event management (SIEM) technology supports threat detection, compliance and security incident management through the collection and analysis (both near real time and historical) of security events, as well as a wide variety of other event and contextual data sources.
328
The company has a flat network that is deployed in the cloud. Security policy states that all production and development servers must be segmented. Which of the following should be used to design the network to meet the security requirements?
VPC - Virtual Private Cloud
Security between resources in shared VPCs is managed using security groups, network access control lists (NACLs), or through a firewall between the subnets. VPC sharing benefits: Simplified design — no complexity around inter-VPC connectivity. Fewer managed VPCs.
Flat networks are designed to reduce the number of routers and switches on a computer network by connecting the devices to a single switch instead of separate switches. Unlike a hierarchical network design, the network is not physically separated using different switches.
329
A new plug and play storage device was installed on the PC in the corporate environment. Which of the following safeguards will best help to protect the PC from malicious files on the storage device?
Encrypt the disk on the storage device
330
The company is adopting a BYOD policy is looking for comprehensive solution to protect company information. I need your device, which of the following solutions would best support the policy?
mobile device management
Mobile device management (MDM) is security software that enables IT departments to implement policies that secure, monitor, and manage end-user mobile devices.
331
The company wants to modify its current backup strategy to minimize the number of backups that would be need to be restored in case of data loss. Which of the following would be the best backup strategy to implement?
Full backups followed by differential backups
A differential backup strategy copies only newly added and changed data since the last full backup.
332
The compliance team requires an annual recertification of privilege and non privileged user access. However, multiple users who left the company six months ago still have access, which of the following would have prevented this compliance violation?
Account audits
333
The company recently experienced a data breach, and the source was determined to be an executive who was charging a phone in a public area. Which of the following would most likely have prevented this briefs?
A USB data blocker
334
The manager who is responsible for a data set has asked a security engineer to apply encryption to the data on a hard disk. The security engineer is an example of a _______?
Data processor - is a natural person, agency, public authority, or any other body that holds personal data on behalf of a controller. Your staff is processing the data according to your instructions.
335
An organization with a low tolerance for user inconvenience wants to protect laptop hard drives against lost or data theft. Which of the following would be most acceptable?
SED - self-encrypting devices / self-encrypting drives
336
After segmenting the network, the network manager wants to control the traffic between the segments. Which of the following should the manager use to control the network traffic?
ACL - Network Access Control List Meaning. A network access control list (ACL) is made up of rules that either allow access to a computer environment or deny it. In a way, an ACL is like a guest list at an exclusive club. Only those on the list are allowed in the doors.
337
Which of the following best describes when an organization utilizes a ready to use application from a cloud provider?
SaaS - SaaS (Software as a Service) security refers to the measures and processes implemented to protect the data and applications hosted by a SaaS provider. This typically includes measures such as encryption, authentication, access controls, network security, and data backup and recovery.
338
Which of the following best helps to demonstrate integrity during a forensics investigation?
Hashing - Hashing is a technique or process of mapping keys, and values into the hash table by using a hash function. It is done for faster access to elements.
339
Which of the following would be most effective to contain a rapidly spreading attack that is affecting a large number of organizations?
DNS sinkhole
DNS Sinkholing is a mechanism aimed at protecting users by intercepting DNS request attempting to connect to known malicious or unwanted domains and returning a false, or rather controlled IP address. The controlled IP address points to a sinkhole server defined by the DNS sinkhole administrator.
340
The chief executive officer of an organization would like staff members to have the flexibility to work from home anytime during business hours, including. during a pandemic or crisis. However, the CEO is concerned that some staff members may take advantage of the flexibility work from high risk countries with while on holiday or outsource work to a 3rd party organization in another country. The chief information officer believes the company can implement some basic controls to mitigate the majority of the risk, which is the following would be best to mitigate the CEO's concerns? (Choose two)
Geolocation
Time of day restrictions
Geo-location is the identification of the geographic location of a user or computing device via an array of data collection processes (Device/Server based and Combined data collection). The most commonly used Geo-location service is a GPS device to determine a precise location of a person.
341
While checking logs, a security engineer notices a number of end users suddenly downloading files from the .tar.gz extension. Closer examination of the files reveals that they are PE32 files. The end user state that they did not initiate any of the downloads. Further investigation reveals the end user all clicked on an external email containing an infected MHT file within href link a week prior. Which of the following is most likely occurring?
The workstations are beaconing to a command-and-control server
MHT - Mht exploit is embedded to HTML web pages. It attempts to download and install a malicious program on your computer by using a security vulnerability in Internet Explorer.
342
A business is looking for a cloud service provider that offers a ala carte services, including cloud product backups, vm elasticity, and secure networking. Which of the following cloud service providers should the business engage?
IaaS - Infrastructure-as-a-service (IaaS) provides virtualized computing resources, virtual networking, virtual storage, and virtual machines accessible over the internet.
343
A research company discovering that an unauthorized piece of software has been detected on a small number of machines in its lab. The researchers collaborate with other machines using port 445 and on the Internet, using port 443. The unauthorized software is starting to be seen on additional machines outside of the lab that is making outbound communications using https and smb. The security team has been instructed to resolve the problem as quickly as possible while causing minimal disruption to researchers. Which of the following contains the best course of action in this scenario?
Place the machines with the unapproved software in containment
344
The security analyst has been reading about a newly discovered cyber attack from a known threat actor. Which of the following would best support the analyst review of tactics, techniques, tactics, and protocols that the threat actor was observed using in previous campaigns?
The MITRE ATT&CK framework - The MITRE ATTACK Framework is a curated knowledge base that tracks cyber adversary tactics and techniques used by threat actors across the entire attack lifecycle. The framework is meant to be more than a collection of data: it is intended to be used as a tool to strengthen an organization's security posture.
345
A security analyst is hardening a network infrastructure. The analyst is giving the following requirements:
- Preserve the use of public IP addresses assigned to the equipment on the core router.
- Enable "in transport" encryption protection to the Web server with the strongest ciphers.
Which of the following should be the analysts implement to meet these requirements? (choose 2)
Configure NAT on the core router
Enable TLSv2 encryption on the web server
346
The security analyst discovers that a company's username and password database was posted on an Internet Forum. The usernames and passwords are stored in plain text. Which of the following would mitigate the damage done by this type of data exfiltration in the future?
Implement salting and hashing
Salting - Salting is a concept that typically pertains to password hashing. Essentially, it's a unique value that can be added to the end of the password to create a different hash value. This adds a layer of security to the hashing process, specifically against brute force attacks.
Hashing - Hashing is a data security technique used to convert data values into alternate, unique identifiers called hashes for quick and secure access. Hashing can be used for data security because the one-way process prevents access to or tampering with the source data.
347
Joe an employee receives an email stating he won the lottery. The email includes a link that requests a name, mobile phone number, address, and date of birth be provided to confirm Joe's identity before sending him the prize. Which of the following best describes this type of email?
Phishing
348
The companies deploy their wifi access point in a public area and wants to harden the configuration to make it more secure. After performing an assessment, an analyst identifies that the access point is configured to use a WPA3, AES, WPS and RADIUS. Which of the following should the analyst disable to enhance the access point security?
WPS - WPS stands for WiFi Protected Setup. A router with a WPS button can allow any device to automatically connect to your router when the WPS button is pressed. When you press the WPS button, your router looks for compatible devices right away and allows those devices automatically connect.
349
Which of the following would be used to find the most common web application vulnerability?
OWASP - The Open Web Application Security Project (OWASP) is a nonprofit foundation that provides guidance on how to develop, purchase and maintain trustworthy and secure software applications. OWASP is noted for its popular Top 10 list of web application security vulnerabilities.
350
A network engineers is troubleshooting wireless network connectivity issues that were reported by users. The issues are occurring only in a section of the building that is closest to the parking lot. Users are intermittently experiencing self speeds when accessing websites in our unable to connect to network drives. The issues appear to increase when laptop users return to their desk after using their devices in the areas of the building. There have been reports of users being required to enter their credentials on web pages in order to gain access to that area. Which of the following is the most likely cause of the issue?
The signal on the WAP needs to be increased in that section of the building.
351
A security administrator suspects that there may be unnecessary services running on a server. Which of the following tools would the administrator most likely use to confirm the suspicions?
Nmap - Nmap ("Network Mapper") is a free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.
352
A vulnerability has been discovered in a known patch to address the vulnerability does not exist. Which of the following controls would best work best until a proper fix is released?
Compensating - a compensating control would be required: A single employee has the duties of accepting cash payments, recording the deposit, and reconciling the monthly financial reports. To prevent errors and/or fraud, additional oversight is required.
353
While reviewing pcap data, a network security analyst is able to locate plain text usernames and passwords being sent from workstations to network switches. Which of the following is a security analyst most likely observing?
A Telnet session
Packet capture is a networking practice involving the interception of data packets travelling over a network.
354
An attacker replaces a digitally signed document with another version that goes unnoticed. Upon reviewing the document's content, the author notices some additional verbiage that was not originally in the document but cannot validate an integrity issue. Which of the following attacks was used?
Hash substitution - Hash substitution In a hash substitution attack, an attacker modifies the content of a file while keeping the same hash value (checksum). This allows them to replace a legitimate file with a malicious or modified version without changing the hash value, making it appear as if the file has not been tampered with.
355
A security analyst notices that specific file would be deleted each time a system administrators on vacation. Which of the following best describes the type of malware that is running?
Logic bomb - a type of malicious code embedded in software that remains dormant until specific conditions are met. When triggered, a logic bomb virus executes a destructive action, such as deleting files or disrupting critical systems.
356
Which of the following involves the inclusion of code in the main code base as soon as it's written?
Continuous integration - Continuous integration (CI) involves developers frequently merging code changes into. a central repository where automated builds and tests run. Build is the process of. converting the source code to executable code for the platform on which it is intended to.
357
Which of the following can reduce vulnerabilities by avoiding code reuse?
Code obfuscation - Obfuscation in computer code uses complex roundabout phrases and redundant logic to make the code difficult for the reader to understand. The goal is to distract the reader with the complicated syntax of what they are reading and make it difficult for them to determine the true content of the message.
358
The Technology Department of a large global company is expanding its wifi network infrastructure at the headquarters building. Which of the following should be closely coordinated between the technology, cybersecurity, and physical security department?
WAP placement - Wireless Access Point (WAP) placement is an important aspect of setting up and maintaining a wireless network. Proper placement of WAPs ensures good coverage, capacity, and performance.
359
Which of the following is an example of risk avoidance?
Not installing new software to prevent compatibility errors
360
A security administrator needs to block a TCP connection using the corporate firewall. Because this connection is potentially a threat, the administrator does not want to send back an RST. Which of the following actions is in the firewall rule would work best?
Drop
DROP (aka DENY, BLACKHOLE) Prohibit a packet from passing. Send no response. In the rules there is a choice of whether to REJECT or to DROP unwanted packets.
361
The security team discovered a large number of companies issued devices with non-work related software installed. which of the following policies would those likely contain language that would prohibit this activity?
AUP - acceptable use policy (AUP) is a document stipulating constraints and practices that a user must agree to for access to a corporate network, the internet or other resources.
362
Which of the following best describes data streams that are compiled through artificial intelligence that provides insight on current cyber intrusions, fishing, and other malicious cyber activity?
Threat feeds - Threat feeds are a mechanism for users to receive current data on cyber intrusions, phishing and other types of fresh information on malicious activity.
363
Which of the following would be the best resource for a software developer who is looking to improve secure coding practices for web applications?
OWASP - The Open Web Application Security Project (OWASP) is a nonprofit foundation that provides guidance on how to develop, purchase and maintain trustworthy and secure software applications. OWASP is noted for its popular Top 10 list of web application security vulnerabilities.
364
Ann, a customer, received a notification from her mortgage company stating her PII may be shared with partners, affiliates, and associates to maintain day to day business operations. which of the following documents did Anne receive?
an annual privacy notice
365
A chief information security officer (CISO) is evaluating, evaluating the dangers involved in deploying a newly ERP system for the company. The CISO categorized a system, selects the controls that apply to the system, implements the controls, and then assesses the success of the controls before authorizing the system. Which of the following is the CISO using to evaluate the environment for this new ERP system?
NIST Risk Management Framework - The NIST RMF links to a suite of NIST standards and guidelines to support implementation of risk management programs to meet the requirements of the Federal Information Security Modernization Act (FISMA), including control selection, implementation, assessment, and continuous monitoring.
366
The manufacturing company has several one off legacy information systems that cannot be migrated to a new os due to the software compounded ability issues. the os are still supported by the vendor, but the industrial software is no longer supported. the chief information security officer has created a resilient sea plan for these types that will allow us patching to be installed in a non production. environment, while also creating backups of the systems recovery. Which of the following resiliency techniques will provide these capabilities?
Virtual machines
367
A retail store has a business requirement to deploy a kiosk computer in an open area. The kiosk computers operating system has been hardened and tested. A security engineer is concerned that someone could use removable media to install a rootkit. Which of the following should the security engineer configure to best protect the kiosk computer?
Boot attestation - a secure mechanism to verify the integrity of an IoT gateway during boot time. Boot attestation enables the detection of gateway file tampering every time the gateway boots.
368
The company is implementing MFA for all applications that store sensitive data. The IT manager wants MFA to be non disruptive and user friendly. Which of the following technology should the I T Manager use when implementing MFA?
Push notifications
369
The security engineer is reviewing the logs from a SAML application that is configured to use MFA. During this review, the engineer notices that high volume of successful volumes that did not require MFA from users who were traveling internationally. The application, which couldn't be accessed without a VPN, has a policy that allows time based tokens to be generated. Users who change location should be required to reauthenticate, but have been able to log in without doing so. Which of the following statements best explains the issue?
The user's IP address is changing between logins, but the application is not invalidating the token.
SAML - Security Assertion Markup Language (SAML) is an open federation standard that allows an identity provider (IdP) to authenticate users and then pass an authentication token to another application known as a service provider (SP).
370
An organization wants to enable built-in FDE on all laptops. Which of the following should the organization ensure is installed on all laptops?
TPM - A Trusted Platform Module (TPM) is a specialized chip on a laptop or desktop computer that is designed to secure hardware with integrated cryptographic keys. A TPM helps prove a user's identity and authenticates their device. A TPM also helps provide security against threats like firmware and ransomware attacks.
371
A security analyst needs to centrally manage credentials and permissions to the company's network devices. The following security requirements must be met:
- All actions performed by the network staff must be logged
- Per-command permissions must be possible
-The authentication server and the devices must communicate through TCP
Which of the following authentication protocols should the analysts choose?
TACACAS+ - TACACS+ which stands for Terminal Access Controller Access Control Server is a security protocol used in the AAA framework to provide centralized authentication for users who want to gain access to the network.
372
An organization recently released a software assurance policy that requires developers to run code scans each night on the repository. After the first night, the security team alerted the developers that more than 2,000 findings were reported and need to be addressed. Which of the following is most likely cause for the high number of findings?
The vulnerability scanner was not properly configured and generated a high number of false positives.
373
An organization is concerned about intellectual property theft by employees who leave the organization. Which of the following should the organization most likely implement?
NDA - A non-disclosure agreement is a legal document which sets rules and principles for the confidentiality of the information to be exchanged.
374
The network manager is concerned that business may be negatively impacted if the firewall in it's data center goes offline. The manager would like to implement a high availability pair to:
remove the single point of failure
375
A major manufacturing company updated its internal infrastructure and just recently started to allow OAuth applications to access corporate data. Data leakage is now being reported. Which of the following most likely caused the issue?
Unmodified default settings
OAuth - OAuth2 allows authorization without the external application getting the user's email address or password. Instead, the external application gets a token that authorizes access to the user's account. The user can revoke the token for one application without affecting access by any other application.
376
While preparing a software inventory report, a security analyst discovers an unauthorized program installed on most of the company's servers. The program utilizes the same code signing certificate as an application deployed to only the accounting team. After removing the unauthorized program, which of the following mitigation should the analysts implement to best secure the server environment?
Revoke the code signing certificate used by both programs.
377
A security analyst is reviewing the latest vulnerability scan report for a Web Server following an incident. The vulnerability report showed no concerning findings. The vulnerability that was used to exploit the server is present in historical vulnerability scan reports, and a patch is available for the vulnerability. Which of the following is most likely caused?
A zero-day vulnerability was used to exploit the web server.
A zero-day vulnerability is a vulnerability in a system or device that has been disclosed but is not yet patched. An exploit that attacks a zero-day vulnerability is called a zero-day exploit.
378
The help desk has received calls from users in multiple locations who are unable to access core network services. The network team has identified and turned off the network switches using remote commands. Which of the following action should the network team take next?
Initiate the organization's incident response plan.
379
An attacker is trying to gain access by installing malware on a website that is known to be visited by target victims. Which is the following, is the attacker most likely attempting?
A watering-hole attack - A watering hole attack works by identifying a website that's frequented by users within a targeted organisation, or even an entire sector, such as defence, government or healthcare. That website is then compromised to enable the distribution of malware.
380
An organization is moving away from the use of client side and server side certificates for EAP. The company would like the new EAP solution to have the ability to detect rogue access points. Which of the following would accomplish these requirements?
EAP-FAST - Extensible Authentication protocol (EAP)
EAP-FAST (Flexible Authentication via Secure Tunneling) was developed by Cisco*. Instead of using a certificate to achieve mutual authentication. EAP-FAST authenticates by means of a PAC (Protected Access Credential) which can be managed dynamically by the authentication server.
381
State security team is engaging a 3rd Party vendor to do a penetration test of a new proprietary application prior to its release. Which of the following documents would the 3rd party vendor most likely be required to review and sign?
NDA - Non disclosure agreement
382
Which of the following is an administrative control that would be most effective to reduce the occurrence of malware execution?
Change control procedures
Change Control is the process that management uses to identify, document and authorize changes to an IT environment. It minimizes the likelihood of disruptions, unauthorized alterations and errors. The change control procedures should be designed with the size and complexity of the environment in mind.
383
Employees at a company are receiving unsolicited text message on their corporate cell phones. The unsolicited text message contain a password reset link. Which of the following attacks is being used to target the company?
Smishing - Smishing is a form of phishing that uses mobile phones as the attack platform. The criminal executes the attack with an intent to gather personal information, including social insurance and/or credit card numbers. Smishing is implemented through text messages or SMS, giving the attack the name “SMiShing.”
384
During a chief information security officer (CISO) convention to discuss security awareness, the attendees are provided with a network connection to use as a secure resource. As the convention progresses, one of the attendees starts to notice delays in the connection, and the HTTPS site requests are reverting to http. Which of the following best describes what is happening?
A SSL/TLS downgrade
A downgrade attack is an attack in which the attacker tries to force two hosts on a network (for example, a client (browser) and a website server) to use an insecure or weakly protected data transmission protocol (such as HTTP instead of HTTPS, or SSL instead of TLS). It is a type of man-in-the-middle attack.
385
A user enters a password to log into a workstation that is then prompted to enter an authentication code. Which of the following MFA factors or attributes are being utilized in the authentication process? Choose 2
Something you know
Something you have
386
The company uses specifically configured workstations for any work that requires administrative privileges to its tier zero and tier 1 systems. The company follows a strict process to harden systems immediately upon delivery. Even with these strict security measures in place, and incident occurred from one of the workstations. The root cause appears to be the SoC was tampered with or replaced. Which of the following most likely occurred?
A supply-chain attack - A supply chain attack, which is also known as a third-party attack, value-chain attack or backdoor breach, is when a cybercriminal accesses a business's network via third-party vendors or through the supply chain.
A security operations center, or SOC, is a team of IT security professionals that protects the organization by monitoring, detecting, analyzing, and investigating cyber threats.
387
Audit logs indicate an administrative account that belongs to a security engineer has been locked out multiple times during the day. The security engineer has been on vacation for a few days. Which of the following tax can the account lockout be attributed to?
Brute-force
A brute force attack is a hacking method that uses trial and error to crack passwords, login credentials, and encryption keys. It is a simple yet reliable tactic for gaining unauthorized access to individual accounts and organizations' systems and networks.
388
After installing a patch of a security appliance, an organization realizes a massive data exfiltration has occurred. Which of the following best describes the incident?
Supply chain attack
A supply chain attack, which is also known as a third-party attack, value-chain attack or backdoor breach, is when a cybercriminal accesses a business's network via third-party vendors or through the supply chain.
389
An information security manager for an organization is completing a PCI DSS Self Assessment for its first time. Which of the following is most likely reason for this type of assessment?
The organization is expecting to process credit card information.
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards formed in 2004 by Visa, MasterCard, Discover Financial Services, JCB International and American Express.
390
Physical access to the organization servers in the data center requires entry and exit through multiple access points: A lobby, an access control vestibule, three doors leading to the server floor, a door to the server floor itself, and eventually to a caged area solely for the organization's hardware. Which of the following controls is described in this scenario?
Preventive
391
New security engineer has started hardening systems. One of the hardening techniques the engineer is using involves disabling remote logins to the NAS. Users are now reporting that inability to use SCP to transfer files to the NAS, even though the data is still viewable from the user's PC's. Which of the following is most likely cause of this issue?
SSH was turned off instead of modifying the configuration file
SCP, or Secure Copy Protocol, is a method based on (Secure Shell) SSH for safely transferring computer files between a local host and a remote host, or between two remote hosts.
392
An enterprise has hired an outside security firm to conduct a penetration testing on its network and applications. The firm has been given the documentation only available to the customers of the applications. Which of the following best represents the type of testing that will occur?
Gray-box
Gray box refers to the testing of software where there is some limited knowledge of its internal workings. Gray box testing is an ethical hacking technique where the hacker has to use limited information to identify the strengths and weaknesses of a target's security network.
393
A network engineer and a security engineer are discussing ways to monitor network operations. Which of the following is the best method?
Utilize an agentless monitor
Agentless monitoring allows you to seamlessly observe your infrastructure components' overall health and performance without installing the agent software. It helps you retrieve the performance metrics from various network components quickly.
394
The security analyst is looking for a solution to help communicate to the leadership team the severity levels of the organization's vulnerabilities. Which of the following would best meet his need?
CVSS
The Common Vulnerability Scoring System (CVSS) provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity.
395
A company is switching to a remote work model for all employees. All company and employee resources will be in the cloud. Employees must use their personal computers to access the clouds competing environment. Company will manage operating system. Which of the following deployment models is the company implementing?
COPE - Corporate-Owned Personally-Enabled (COPE) architectures provide the flexibility of allowing both enterprises and employees to install applications onto organization-owned mobile devices.
396
A security administrator needs to inspect in-transit files on the enterprise network to search for PII, credit card data, and classify words. Which of the following would be the best to use?
Network DLP Solution
Data Loss Prevention (DLP) is the practice of detecting and preventing data breaches, exfiltration, or unwanted destruction of sensitive data. Organizations use DLP to protect and secure their data and comply with regulations.
397
The chief executive officer announced a new partnership with the strategic vendor and asked the Chief Information Security Officer (CISO) to federate user digital identities using SAML based protocol. Which of the following will this enable?
SSO - Single Sign ON
SAML - Security Assertion Markup Language (SAML) is an open federation standard that allows an identity provider (IdP) to authenticate users and then pass an authentication token to another application known as a service provider (SP)
398
Can employees company account was using a data breach. Interviews with employee revealed:
- The employee was able to avoid changing password by using a previous password
- The account was accessed from a hostile, foreign nation, but the employee has never traveled to any other countries
Which of the following can be implemented to prevent these issues from recurring? (Choose 2)
Password complexity
Password history
399
A large industrial system's smart generator monitors the system status and sends alerts to a 3rd party maintenance personnel when critical failures occur. While reviewing the network logs, the company's security manager noticed the generator's IP is sending packets to an internal file server's IP. Which of the following mitigations would best for security manager to implement while maintaining a learning capabilities?
Firewall allow list
400
Which of the following technologies is used to actively monitor for specific file types being transmitted on the network?
Data loss prevention
401
As part of the building process for a web application, the compliance team requires that all PKI certificates are rotated annually and can only contain wildcards at the secondary subdomain level. Which of the following certificate properties will meet these requirements?
HTTPS://*.app1.comptia.org, Valid from April 10 00:00:00 2021 - April 8 12:00:00 2022
402
The global pandemic is forcing a private organization to close some business units and reduce staffing at others. Which of the following would be best to help the organizations executives determine their next course of action?
A business continuity plan
In essence, business continuity planning (BCP) involves preparing for and avoiding potential disruptions to your business operations.
403
A server security analyst reviews the log files from a Web server and sees a series of files that indicate a directory traversal attack has occurred. Which of the following is the analyst most likely seen?
http://sample.url.com/someotherpageonsite/./././etc/shadow
404
The candidate attempts to go to HTTP://comptia.org, but accidentally visits http:\ \comptiia.org. The malicious website looks exactly like the legitimate website. Which of the following best describes this type of attack?
Typosquatting
Typosquatting, also known as URL hijacking, is a form of cybersquatting (sitting on sites under someone else's brand or copyright) that targets Internet users who incorrectly type a website address into their web browser (e.g., “Gooogle.com” instead of “Google.com”).
405
The marketing department at a retail company wants to publish an internal website to the Internet. So it is reachable by limited number of specific, external service providers in a secure manner. Which of the following configurations would be best to fulfill this requirement?
ACL
Network Access Control List Meaning. A network access control list (ACL) is made up of rules that either allow access to a computer environment or deny it. In a way, an ACL is like a guest list at an exclusive club. Only those on the list are allowed in the doors.
406
A retail executive recently accepted a job with a major competitor. The following week, a security analyst reviews the security logs and identifies successful logon attempts to access the departed executives accounts. Which of the following security practices would have have addressed this issue?
Offboarding
Offboarding is the process that leads to the formal separation between an employee and a company through resignation, termination, or retirement. It encompasses all the decisions and processes that take place when an employee leaves. This may include: Transferring that employee's job responsibilities.
407
A network connected magnetic resonance imaging (MRI) scanner at a hospital controlled and operated by an outdated and unsupported specialized Windows OS. which is the following is most likely preventing the IT manager at the hospital from upgrading the specialized OS?
The MRI vendor does not support new versions of the OS
408
The company received a "right to be forgotten" request. To legally comply, the company must remove data related to the requesters from its systems. Which of the following is the company most likely complying with?
GDPR
The General Data Protection Regulation (GDPR), which came into effect on 25th May 2018, provides a legal framework for keeping everyone's personal data safe by requiring companies to have robust processes in place for handling and storing personal information.
409
The security team suspects that the cause of the recent power consumption overloads is the unauthorized use of empty power outlets in the network rack. Which of the following options will mitigate this issue without compromising the number of outlets available?
Installing a managed PDU
PDU - a protocol data unit (PDU) is the basic unit of exchange between entities that communicate using a specified networking protocol. When working with a multilayer protocol stack, like the TCP/IP networking suite, use of the correct PDU is important when discussing protocol interactions.
410
An engineer wants to inspect traffic to a cluster web servers in a cloud environment. Which of the following solutions would the engineer implement?
Load balancer - Load balancers improve application performance by increasing response time and reducing network latency. They perform several critical tasks such as the following: Distribute the load evenly between servers to improve application performance. Redirect client requests to a geographically closer server to reduce latency.
411
A security analyst needs to implement an MDM solution for BYOD users that will allow the company to retain control over company emails residing on the devices and limit data exfiltration that might occur if the devices are lost or stolen. Which of the following best meets these requirements? Choose 2
Containerization - Containerization is a type of virtualization in which all the components of an application are bundled into a single container image and can be run in isolated user space on the same shared operating system.
Remote control
MDM Solution - Mobile device management (MDM) is security software that lets your business implement policies to secure, monitor, and manage your end-user mobile devices.
412
A security administrator is evaluating remote access solutions for employees who are geographically dispersed. which of the following would best provide the most secure remote access?
IPSec - IPSec encryption is a software function that scrambles data to protect its content from unauthorized parties. Data is encrypted by an encryption key, and a decryption key is needed to unscramble the information. IPSec supports various types of encryptions, including AES, Blowfish, Triple DES, ChaCha, and DES-CBC.
SSL VPN
413
A malicious actor recently penetrated a company's network and moved laterally to the data center. Upon investigation, a forensics firm, wants to know what was in the memory on the compromise server. Which of the following files should be given to the forensics firm?
Dump
A copy or “snapshot” of data stored in memory at any given moment. A memory dump is often created when a program crashes in order to analyze the causes. A database dump is made to back up the information it contains.
414
A company is looking to migrate some servers to the cloud to minimize its technology footprint. The company has a customer's relationship management system on premises. Which of the following solutions will require the least infrastructure and application support from the company?
SaaS
SaaS (Software as a Service) security refers to the measures and processes implemented to protect the data and applications hosted by a SaaS provider. This typically includes measures such as encryption, authentication, access controls, network security, and data backup and recovery.
415
A network administrator needs to determine the sequence of a server farm's logs. Which of the following should they administrator consider? Choose 2
Time stamps
Hash values
The most common hash functions are MD5, SHA-1, SHA-256, and SHA-512. Their main purpose in cybersecurity is to generate unique identifiers for their inputs, such as malware files, that can be cataloged, shared or (re)searched with relative ease.
416
Which of the following is the best reason to maintain a functional and effective asset management policy that aids in assuring the security of an organization?
To only allow approved, organization-owned devices onto the business network
417
A security administrator, who is working for a government organization, would like to utilize classification and granular planning to secure top secret data and grant access on a need to know basis. Which of the following access control schemas would the administrator consider?
Role-based
Role-based access control schemas are often similar to organizational hierarchies. Role-based access control (RBAC) uses roles and user groups to determine access privileges. With RBAC, system administrators assign roles to subjects and configure access permissions to apply at the role level.
418
An organization is outlighting data stewardship roles and responsibilities. Which of the following employee roles would determine the purpose of data and how to process it?
Data controller
The data controller determines the purposes for which and the means by which personal data is processed. So, if your company/organisation decides 'why' and 'how' the personal data should be processed it is the data controller.
419
Multiple beaconing activities to a malicious domain have been observed. The malicious domain is hosting malware from various endpoints on the network. Which of the following technologies would be best to correlate the activities between the different endpoints?
SIEM - Security information and event management, SIEM for short, is a solution that helps organizations detect, analyze, and respond to security threats before they harm business operations.
420
Which of the following types of controls is a turnstile?
Physical
421
Users report access to the application from an internal workstation is still unavailable to a specific server, even after a recent firewall rule implementation that was requested for this access. ICMP traffic is successfully between the two devices. Which of the following tools should the security analysts use to help identify if the traffic is being blocked?
tracert
The TRACERT diagnostic utility determines the route to a destination by sending Internet Control Message Protocol (ICMP) echo packets to the destination. In these packets, TRACERT uses varying IP Time-To-Live (TTL) values.
422
As part of annual audit requirements, the security team performed a review of expectations to the company policy to allow specific users the ability to use USB storage devices on their laptops. The review yielded the following results:
- The exception process and policies have been correctly followed by the majority of users.
- A small number of users did not create tickets for the request, but were granted access.
- All access had been approved by supervisors
- Valid request for the access sporadically occurred across multiple departments
- Access, in most cases, had not been removed when it was no longer needed
Which of the following should the company do to ensure that appropriate access is not distributed but unneeded access is removed in a reasonable time frame?
Perform a quarterly audit of all user accounts that have been granted access and verify the exceptions with the management team.
423
A financial institution would like to store its customer data in a cloud, but still allow the data to be accessed and manipulated while encrypted. Doing so would prevent the cloud service provider from being able to decipher the data due to its sensitivity. The financial institution is not concerned about computational overheads and slow speeds. Which of the following cryptographic techniques would best meet this requirement
Asymmetric
In cybersecurity, an asymmetric attack might involve a perpetrator attacking security measures that have been put in place, such as the firewall or intrusion detection system, by capitalizing on the weakest link (such as a user on the network who has not updated to the latest security patch or uses a low strength
424
A crypto mining company recently deployed a new antivirus application to all its mining systems. The installation of the antivirus application was tested on many personal devices, and no issues were observed. Once the antivirus application was rolled out to the servers, constant issues were reported. As a result, the company decided to remove the mining software. The antivirus application was most likely causing the software as:
a PUP - Potentially unwanted program
425
A cybersecurity administrator is using iptables as an enterprise firewall. The administrator created some rules, but the network now seems to be unresponsive. All connections are being dropped by the firewall. Which of the following would be the best option to move the rules?
#iptables -F
426
An incident response technician collected a mobile device during an investigation. Which of the following should the technician do to maintain chain of custody?
Document the collection and require a sign-off when possession changes.
427
My company recently implemented a patch management policy, However, vulnerability scanners have still been flagging several hosts, even after the completion of the patch process. Which of the following is most likely cause of the issue?
Third-party applications are not being patched.
428
Which of the following controls would provide the best protection against tailgating?
Proximity card reader
429
A penetration tester executes the command chrontab -I while working in a Linux server environment. The penetration tester observes the following string in the current users list of crown jobs:
*/10**** root /writable/update.sh
Which of the following action should the penetration test perform next?
Privilege escalation
Privilege escalation refers to a network attack aiming to gain unauthorized higher-level access within a security system. It typically starts with attackers exploiting vulnerabilities to access a system with limited privileges.
430
An organization's chief information security officer is creating a position that will be responsible for implementing technical controls to protect data, including ensuring backups are properly maintained. Which of the following roles would most likely include these responsibility?
Backup administrator
431
Which of the following best describes the team that acts as a referee during a penetration testing exercise?
Purple team
432
Much of the following would most likely be identified by a credentialed scan, but would be missed by an uncredentialed scan?
Missing patches for third-party software on Windows workstations and servers.
433
Is security administrator seeking a solution to prevent unauthorized access to the internal network. Which of the following security solutions should the administrator choose?
VPN
434
The host was infected with malware. During the incident response, Joe, a user, reported that he did not receive any emails with links, but he had been browsing the Internet all day. Which of the following would most likely show where the malware originated?
The web server logs
435
The third party asked a user to share a public key for secure communication. Which of the following file formats should the user choose to share the key?
.cer
436
The Security Administrator is working on the solution to protect passwords stored in a database against Rainbow Table attacks. Which of the following should the administrator consider?
Salting
Salting is a concept that typically pertains to password hashing. Essentially, it's a unique value that can be added to the end of the password to create a different hash value. This adds a layer of security to the hashing process, specifically against brute force attacks.
437
Big company wants to deploy PKI on its Internet facing website. The applications that are currently deployed are:
-www.company.com (website)
-contactus.company.com (for locating a nearby location)
-quotes.company.com (for requesting a price quote)
The company wants to purchase one ssl certificate that will work for all the existing applications and any feature applications that follow the same name and conventions, such as store.company.com. Which of the following certificate types would best meet this requirement?
Wildcard
A wildcard certificate is a digital certificate that is applied to a domain and all its subdomains. Wildcard notation consists of an asterisk and a period before the domain name. Secure Sockets Layer (SSL) certificates often use wildcards to extend SSL encryption to subdomains.
438
The security analyst is concerned about traffic initiated to the dark web from the corporate land. Which of the following networks should the analysts monitor.
Tor
Tor is a network of virtual tunnels that allows you to improve your privacy and security on the Internet. Tor works by sending your traffic through three random servers (also known as relays) in the Tor network. The last relay in the circuit (the "exit relay") then sends the traffic out onto the public Internet.
439
The company is launching a website in a different country in order to capture user information that a marketing business can use. The company itself will not be using the information. Which of the following roles is the company assuming?
Data collector
The data collector is the application that collects and delivers the metadata that is analyzed and presented in the GUI. The data collector is a light-weight application that is installed on a server in your data center.
440
An organization like to remediate the risk associated with its cloud service provider, not meeting its advertised 99.99% availability metrics. which of the following should the organization consult for the exact requirement for the cloud provider?
SLA
441
Which of the following secure application development concepts aims to block verbose error messages from being shown in their users interface?
Prevention of information exposure
442
If a current private key is compromised, which of the following would ensure it cannot be used to decrypt all historical data question?
Perfect forward secrecy
Perfect Forward Secrecy (PFS), also called forward secrecy (FS), refers to an encryption system that changes the keys used to encrypt and decrypt information frequently and automatically. This ongoing process ensures that even if the most recent key is hacked, a minimal amount of sensitive data is exposed.
443
And then organization has expanded its operations by opening a remote office. The new office is fully furnished with office resources to support up to 50 employees working on any given Sunday. Which of the following VPN solutions would best support the new office?
Site to Site
A site-to-site virtual private network (VPN) refers to a connection set up between multiple networks. This could be a corporate network where multiple offices work in conjunction with each other or a branch office network with a central office and multiple branch locations.
444
Which of the following scenarios best describes a risk reduction technique?
A security control objective cannot be met through a technical change, so the company implements a policy to train users on a more secure method of operation.
445
Which of the following social engineering attacks best describes an email that is primarily intended to mislead recipients into forwarding the email to others?
Phishing
446
Which of the following will provide the best physical security countermeasures to stop intruders? (choose 2)
Access control vestibules
Fencing
447
An organization is concerned about hackers potentially entering a facility and plugging into a remotely accessible Kali Linux box. Which of the following should be the first lines of defense against such an attack? choose 2
MAC filtering - MAC address filtering allows you to block traffic coming from certain known machines or devices. The router uses the MAC address of a computer or device on the network to identify it and block or permit the access. Traffic coming in from a specified MAC address will be filtered depending upon the policy.
Network access control - Network access control (NAC), also known as network admission control, is the process of restricting unauthorized users and devices from gaining access to a corporate or private network.
448
An employee used a corporate mobile device during a vacation. Multiple contacts were modified in the device during the employees vacation. Which of the following attack methods did an attacker use to insert the contact without having physical access to the device?
Bluejacking
Bluejacking is a Bluetooth attack in which a hacker spams your device with unsolicited phishing messages. When it comes to wirelessly pairing two devices, it's tough to beat the convenience of Bluetooth.
449
A security administrator wants to implement a program that tests the user's ability to recognize attacks over the organization's email system. Which of the following would be the best suited for this task?
Phishing campaign
450
A security analyst is reviewing packet capture data from a compromise host on the network. In the packet capture, the analyst locates packets that contain large amounts of text. Which of the following is most likely installed on a the compromised host?
Keylogger
A keylogger or keystroke logger/keyboard capturing is a form of malware or hardware that keeps track of and records your keystrokes as you type. It takes the information and sends it to a hacker using a command-and-control (C&C) server.
451
An organization needs to implement more stringent controls over administrators/root credentials and service accounts. Requirements for the project include:
-Check-in/checkout of credentials
- The ability to use but not know the password
- Automated password changes
- Logging of access to credentials
Which of the following solutions would be the requirements?
Secure Enclave
Secure Enclaves are sets of security-related instruction codes built into new CPUs. They protect data in use, because the enclave is decrypted on the fly only within the CPU, and then only for code and data running within the enclave itself.
452
A systems analyst is responsible for generating a new digital forensics chain of custody form. Which of the following should the analysts include in this documentation (choose 2)
The order of volatility - In digital forensics, the order of volatility categorizes data based on its volatility, moving from the most ephemeral to relatively stable forms. These categories encompass registers and cache, RAM, temporary file systems, disk storage, and archival media.
The date and time
453
Which of the following is a physical security control that ensures only the authorized user is present when gaining access to a secured area?
a biometric scanner
454
The company is moving to new location. the system administrator has provided the following server room requirements to the facilities staff:
- Consistent power levels in case of brownouts or voltage
- A minimum of thirty minutes runtime following a power outage
- Ability to trigger graceful shutdowns of critical systems
Which of the following best meets the requirements?
Deploying an appropriately sized, network-connected UPS device
455
Which of the following would provide guidelines on how to label new network devices as part of the initial configuration?
standard naming convention policy
456
A Systems Engineer thinks a business system has been compromised and is being used to exfiltrate data to a competitor. The engineer contacts the CSIRT. The CSIRT tells the engineer to immediately disconnect the network cable and to not do anything else. Which of the following is most likely a reason for this request?
Memory contents, including fireless malware, are lost when the power is turned off
457
Which of the following best describes the situation where a successfully onboarded employee who is using a fingerprint reader is denied access at the company's main gate?
False rejection
458
Which of the following should customers who are involved with UI developer agreements be concerned with when considering the use of these products on highly sensitive projects?
Unsecure user accounts
459
Which of the following identifies the point in time when an organization will recover data in the event of an average?
RPO - Recovery point objective (RPO) describes a period of time in which an enterprise's operations must be restored following a disruptive event, e.g., a cyberattack, natural disaster or communications failure.
460
The police department is using the cloud to share information with city officials. Which of the following cloud models describes a scenario?
Community
461
The user reports that a bank's website no longer displays a padlock symbol. A security analyst views the user secure screen and notices the connection is using HTTP instead of HTTPS. Which of the following attacks is most likely occurring?
SSL stripping
SSL stripping is a technique by which a website is downgraded from https to http. In other words, the attack is used to circumvent the security which is enforced by SSL certificates on https sites. This is also known as SSL downgrading.
462
The data center has experienced an increase in under voltage events following electrical grid maintenance outside the facility. These events are leading to occasional losses of system availability. Which of the following would be the most cost effective solution for the data center to implement?
Uninterruptible power supplies with battery backup
463
A security architect is designing a remote access solution for a business partner. The business partner needs access to one server at the company. The business partner wants to avoid managing a password for authentication and additional software installation. Which of the following should the architect recommend?
SSH Key
SSH or Secure Shell is a network communication protocol that enables two computers to communicate (c.f http or hypertext transfer protocol, which is the protocol used to transfer hypertext such as web pages) and share data.
464
The security analyst is assisting a team of developed various work best practices for coding. The security analyst would like to defend against the use of sql injection attacks. Which of the following, should the security analysts recommend first?
Input validation
Input validation is a crucial security measure to prevent a variety of common injection attacks, such as SQL Injection, Command Injection, and Cross-Site Scripting (XSS). Input validation verifies that values provided by a user match a programmer's expectations before allowing any further processing.
465
Cloud security engineers are planning to allow and deny access to specific features in order to increase data security. which of the following cloud features is the most appropriate to ensure access is great to properly?
API integrations
466
A security operations technician is searching a log named /var/messages for any events that were associated with a workstation with the IP address 10.1 .1 .1. Which of the following would provide this information?
cat /var/messages | grep 10.1.1.1
467
Which of the following processes would most likely help an organization that has conducted an incident response exercise to improve performance and identity challenges?
Simulation
468
Which of the following control types is patch management classified under?
Corrective
469
A company that provides an online streaming service, made its customers personal data, including names and email addresses, publicly available in a cloud service storage service. As a result, the company experienced an increase in the number of requests to delete user accounts. which is the following best describes the consequence of this data disclosure?
Reputation damage
470
An organization has been experiencing outages during holiday sales and needs to ensure availability of its point of sale systems. the IT administrator has been asked to improve both server data fault tolerance and site availability under high consumer load. which of the following are the best options to accomplish this objective? Choose 2
Load balancing
RAID
RAID (/reɪd/; "redundant array of inexpensive disks" or "redundant array of independent disks") is a data storage virtualization technology that combines multiple physical disk drive components into one or more logical units for the purposes of data redundancy, performance improvement, or both.
471
Which of the following can be used to detect a hacker who is stealing company data over port 80?
Packet capture
Packet capturing helps to analyze networks, identify network performance issues and manage network traffic. It allows IT teams to detect intrusion attempts, security issues, network misuse, packet loss, and network congestion. It enables network managers to capture data packets directly from the computer network.
472
The company recently enhanced mobile device configuration by implementing a set of security controls, biometrics, context aware authentication and full device encryption. Even with these settings in place, and unintended phone was used by a malicious actor to access corporate data. Which of the following additional controls should be put in place?
screen lock timer
473
An organization wants to quickly assess how effectively the IT team hardened new laptops. Which of the following would be the best solution to perform this assessment?
Load current baselines into the existing vulnerability scanner
474
A user is trying to upload a text document, which the corporate finance department requested, but a security programmer is prohibiting the upload. A security analyst determines the file contains PII. which of the following steps can the analysts take to correct the issue?
Modify the exception list on the DLP to allow the upload
Data Loss prevention (DLP)
475
A cybersecurity analyst at company A, is working to establish a secure communication channel with a counterpart at Company B, which is 3000 miles away. which of the following concepts would help the analysts meet this goal in a secure manner?
Key exchange
Key exchange (also key establishment) is a method in cryptography by which cryptographic keys are exchanged between two parties, allowing use of a cryptographic algorithm.
476
Security analyst is revealing computer logs because a host was compromised by malware. after the computer was infected, it displayed an air screen and shut down. which of the following should the analyst review first to determine more information?
Dump file
A dump file is a snapshot that shows the process that was executing and modules that were loaded for an app at a point in time. A dump with heap information also includes a snapshot of the app's memory at that point.
477
A security architect is working on an email solution that will send sensitive data. However, funds are not currently available in the budget for building additional infrastructure. Which of the following should the architect choose?
PGP
PGP stands for pretty good privacy, an encryption system used for sending and managing encrypted emails and files. Encrypting the data and content of emails makes this method of communication more private, which is why PGP is used by those dealing with sensitive information.
478
The user resets the password for a laptop, but has been unable to log in to it since then. In addition, several unauthorized emails were sent on the user's behalf recently. The security team investigates the issue and identifies the following findings:
- Firewall logs show excessive traffic from the laptop to an external site
- Unknown processes were running on the laptop
- RDP connections that appeared to be authorized were made to other network devices from the laptop
- High bandwidth utilization alerts from the users username
Which of the following is most likely installed on my laptop?
Trojan
A Trojan Horse Virus is a type of malware that downloads onto a computer disguised as a legitimate program. The delivery method typically sees an attacker use social engineering to hide malicious code within legitimate software to try and gain users' system access with their software.
479
A systems administrator is required to enforce MFA for corporate email account access, relying on. relying on the possession factor. which of the following authentication methods should the systems administrator choose? Choose two
B - Time based one time password
E - Hardware token
480
Which of the following best describes a technique that compensates researchers for finding vulnerabilities?
Bug bounty
481
Which of the following biometric authentication methods is the most accurate?
Retina
482
A security team will be outsourcing several key functions to a 3rd party, and will require that:
- Several of the functions will carry an audit burden
- Attestations will be performed several times a year
- Reports will be generated on a monthly basis
Which of the following best describes the document that is used to define these requirements and stipulate how and when they are performed by a third party?
SLA
483
A small local company experiences a ransomware attack. The company has one web facing server and a few workstations. Everything is behind an ISP firewall. A single web facing server is set up on the router to forward all polls so that the server is viewable from the Internet. the company uses an older version of third-party software to manage the website. The assets were never patched. Which of the following should be done to prevent an attack like this from happening again? Choose three
B - Use the latest version of software
E - Implement a screened subnet for the web server
F - Install an endpoint security solution
484
A security investigation revealed that malicious software was installed on a server using a servers administrators credentials. During the investigation, the server administrator explained that telnet was regularly used to log in. Which of the following most likely occurred?
B - A packet capture tool was used to steal the password
485
Which of the following roles would most likely have direct access to the senior management team?
D - Data controller
486
Stakeholders at an organization must be kept aware of any incidents and receive updates on status changes as they occur. Which of the following plans would fulfill this requirement?
A - Communication plan
487
An employee who is using a mobile device for work, is required to use a fingerprint to unlock the device. Which of the following is this an example of?
B - Something you are
488
Which of the following security controls can be used to prevent multiple people from using a unique card swipe and being admitted to a secure entrance?
C - Access control vestibules
489
Which of the following security controls can be used to prevent multiple people from using a unique card swipe and being admitted to a secure entrance?
Access control vestibules
490
Unauthorized devices have been detected on the internal network. The devices locations were traced to Ethernet ports located in conference rooms. Which of the following would be the technical controls to implement to prevent these devices from accessing the internal network?
NAC
Network access control (NAC), also known as network admission control, is the process of restricting unauthorized users and devices from gaining access to a corporate or private network.
491
A Chief information Security Officer (CISO) wants to implement a new solution that can protect against certain categories of websites, whether the employee is in the office or away, which is the following solution should this CISO implement?
SWG
A secure web gateway (SWG) is a security solution that prevents unsecured internet traffic from entering an organization's internal network
492
A security analyst is using OSINT to gather information to verify whether company data is available publicly. which of the following is the best application for the analyst to use?
A - theHarvester
theHarvester is a command-line tool included in Kali Linux that acts as a wrapper for a variety of search engines and is used to find email accounts, subdomain names, virtual hosts, open ports / banners, and employee names related to a domain from different public sources (such as search engines and PGP key servers).
Open Source Intelligence (OSINT) is a method of gathering information from public or other open sources, which can be used by security experts, national intelligence agencies, or cybercriminals.
493
The Security Administrator needs to add fault tolerance and load balancing to the connection from the file server to the backup storage. Which of the following is the best choice to achieve that objective?
Multipath
Multipath routing is a routing technique simultaneously using multiple alternative paths through a network. This can yield a variety of benefits such as fault tolerance, increased bandwidth, and improved security.
494
Which of the following incident response phases should the proper collection of the dedicated IoCs and establishment of a chain of custody be performed before?
B - Identification
Indicators of compromise (IOCs) refer to data that indicates a system may have been infiltrated by a cyber threat. They provide cybersecurity teams with crucial knowledge after a data breach or another breach in security.
495
Which of the following measures the average time that equipment will operate before it breaks?
B - MTBF
MTBF (mean time between failures) is the average time between repairable failures of a technology product. The metric is used to track both the availability and reliability of a product. The higher the time between failure, the more reliable the system.
496
Which of the following documents specifies what to do in the event of catastrophic loss of physical or virtual systems?
Disaster Recovery Plan
497
Which of the following rales is responsible for defining the protection type and classification type for a given set of files?
Data owner
498
And employees company email is configured with conditional access and required that MFA is enabled and used. An example of MFA is a phone call.?
An authentication application
499
Which of the following is a security implication of newer ICS devices that are becoming more common in corporations?
A - Devices with cellular communication capabilities bypass traditional network security controls
500
Which of the following is required in order for an IDS and a WAF to be effective on HTTPS traffic?
C - TLS inspection
Why is TLS Inspection necessary for network security? TSL inspection decrypts and inspects the traffic that is encrypted between the user and the host to be able to identify malicious activity that uses encrypted communication routes.
IDS - Intrusion Detection Systems - works by looking for the signature of known attack types or detecting activity that deviates from a prescribed normal. It then alerts or reports these anomalies and potentially malicious actions to administrators so they can be examined at the application and protocol layers.
WAF or web application firewall helps protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet.
501
A company policy requires 3rd party suppliers to self report data breaches within a specific amount of time, which of the following 3rd party risk manager policies is the company complying with?
SLA
502
While troubleshooting service disruption on a mission critical server, a technician discovered the user account that was configuring to run automated processes was disabled because the password failed to meet password complexity requirements. Which of the following would be the best solution to securely prevent future issues?
C - Configuring a server account to run the processes
503
A security analyst is assessing a newy developed web application by testing SQL injection, CSRF, and xml injection. Which of the following NG framework should be the analysts choice?
OWASP
The Open Worldwide Application Security Project (OWASP) is a nonprofit foundation dedicated to improving software security. It operates under an “open community” model, which means that anyone can participate in and contribute to OWASP-related online chats, projects, and more.
504
The user's laptop constantly disconnects from the wifi network. Once a laptop reconnects, the user can reach the Internet, but cannot access shared folders or other network resources. Which of the following types of attacks is the user most likely experiencing?
Rogue access point
What Are Rogue Access Points? A rogue access point — or rogue AP — is a wireless access point plugged into an organization's network that the security team does not know exists. While rogue access points can be used as part of a coordinated attack, employees unaware of proper cybersecurity protocol often install them.
505
Which of the following procedures would be performed after the root cause of a security incident has been identified to help avoid future incidents from occurring?
Lessons learned
506
A security administrator is integrating several segments onto a single network. One of the segments, which includes legacy devices, presents a significant amount of risk to the network. Which of the following would allow users to access the to the legacy devices without compromising the security of the entire network?
Jump Server
Jump server refers to a secure computer that spans two or more networks, allowing users to connect to it from one network, and then “jump“ to another network. It's also known as a jump host or a jump box.
507
Which of the following would a security analyst use to determine if other companies in the same sector have seen similar militias activity against the system?
D - Threat feeds
508
Which of the following types of disaster recovery plan exercise requires the latest interruption to IT operations?
C - Tabletop
A tabletop exercise, or TTX, is a role-playing activity in which players respond to scenarios presented by one or more facilitators.
509
Which of the following disaster recovery sites is the most cost effective to operate?
Cold site
A backup facility that has the necessary electrical and physical components of a computer facility, but does not have the computer equipment in place.
510
State security operations center wants to implement a solution that can execute files to test for malicious activity. The solution should provide a report of files activity against known threats. Which of the following should the security operations center implement?
C - Cuckoo
Cuckoo is an open source automated malware analysis system. It's used to automatically run and analyze files and collect comprehensive analysis results that outline what the malware does while running inside an isolated operating system.
511
The security administrator would like to ensure all cloud servers will have software pre-installed first facilitating vulnerability, scanning and continuous monitoring. Which of the following. concepts should the administrator utilize?
A - Provisioning
Provisioning is the process of creating and setting up IT infrastructure, and includes the steps required to manage user and system access to various resources. Provisioning is an early stage in the deployment of servers, applications, network components, storage, edge devices, and more.
512
A network architect wants a server to have the ability to retain network availability, even if one of the network switches is connected to goes down. which of the following should the architect implement on the server to achieve this goal?
Load balancing
513
An employee receives multiple messages on a mobile device. The messages were instructing the employee to pair the device to an unknown device. Which of the following best describes what a malicious person might be doing to cause this to occur?
Bluesnarfing
Bluesnarfing”, a portmanteau of the words “Bluetooth” and “snarf” (meaning "to steal"), is accessing data through an unauthorized wireless connection. Cyber criminals can hack into your mobile phone, tablet, smartwatch and other wearables to steal passwords, emails and photos without you even realizing.
514
A Security Administrator installed a new web server. the administrator did this to increase the capacity for an application due to resource exhaustion on another server. which of the following algorithms should the administrator use to split the number of connections on each server in half?
B - Round-robin
Round-robin (RR) is one of the algorithms employed by process and network schedulers in computing. As the term is generally used, time slices (also known as time quanta) are assigned to each process in equal portions and in circular order, handling all processes without priority (also known as cyclic executive).
515
Security analyst have noticed the network becomes flooded with malicious packets at specific times of the day. which of the following should the analysts use to investigate this question?
Correlation dashboards
The Correlation Dashboards display correlations between events and Recorded Future Risk Lists. The Risk List used for the correlation depend on which type of Correlation Dashboard is chosen. By default only the events of the last 24 hours are used.
516
A security administrator performs weekly vulnerability scans on all cloud asset and provides a detailed report. which is the following describes the administrators activities?
D - Data processor
517
An attacker is targeting a company. the attacker notices that the company's employees frequently access a particular website. the attacker decides to infect the website with malware hopes the employees devices will also become infected. which of the following techniques is the attacker using?
Watering-hole attack
518
A digital forensics team and a large company is investigating a case in malicious code was loaded over an HTTPS connection and was running in memory but was never compiled to disk. which of the following technique should the team use to obtain a sample of the malware binary?
image volatile memory
519
The website visitor is required to provide properly formatted information in a specific field on a website forum. which of the following security measures is most likely used for this manner?
A - input validation
520
A Big technician is setting up a new firewall on a network segment to allow web traffic to the Internet while hardening the network. After the firewall is configured, users receive errors stating website could not be located. Which of the following would best correct this issue?
Ensuring that port 53 has been explicitly allowed in the rule set
Port 53 is used by DNS (Domain Name System). DNS takes care of recolving human readable 'host names' into numeric IP addresses.
521
A Systems Administrator works for a local hospital and needs to ensure patient data is protected and secure. which of the following data classification should be used to secure patient data?
Sensitive
522
A small business uses kiosks on the sales floor to disable display product information for customers. A security team discovers the kiosks use end of life operating systems. Which of the following list security team most likely to document as a security implication of the current architecture?
Patch availability
523
During that security incident, the security operations team identified sustained network traffic from a malicious IP address, 10.1 .4 .9. It's security analyst is creating an inbound firewall firewall rule to disabled the IP address from accessing the organization's network. Which of the following fulfills this request?
access-list inbound deny ip source 10.1.4.9/32 destination 0.0.0.0/0
524
Which of the following is the the phrase to the incident response process when a security analysis reviews roles and responsibilities?
A - Preparation
525
Which of the following can be used to identify potential attacker activities without affecting production servers?
Honeypot
526
The company wants the ability to restrict web access and monitor the websites that employees visit. which of the following would best meet these requirements?
A - internet proxy
527
A security analyst notices an unusual amount of traffic hitting the edge of the network. Upon examining the logs, the analysts identifies a source IP address and blocks that address from communicating with the network. Even though an analyst is blocking this address The attack is still ongoing and coming from a large number of different source IP addresses. Which of the following describes this type of attack?
DDoS
A distributed denial-of-service (DDoS) attack occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. A DDoS attack uses more than one unique IP address or machines, often from thousands of hosts infected with malware.
528
The company needs to centralize its logs to create a baseline and have visibility on its security events. wish of the following technologies will accomplish this objective?
Security information and event management
529
Two organizations are discussing a possible merger. Both organizations chief financial officers would like to safely share payroll data with each other to determine if the pay scales for different roles are similar at both organizations. which of the following techniques would be the best to protect employee data while allowing the companies to successfully share this information?
C - Data masking
Data masking creates fake versions of an organization's data by changing confidential information. Various techniques are used to create realistic and structurally similar changes. Once data is masked, you can't reverse engineer or track back to the original data values without access to the original dataset.
530
The large retail stores network was breached recently. And this news made public. The store did not lose any intellectual property and no customer information was stolen. although no where, known were incurred as a result. The store lost revenue after the breach. Which of the following most likely reason for this issue?
C - Reputation damage
531
The government organization is developing and enhance AI defense system. developers are using information collected from third-party providers. analysts are noticing inconsistencies in expected progress of the AI learning and the attribute, the outcome to a recent attack on one of the suppliers. which of the following most likely reason for the inconsistency of the system?
B - Tainted training data
532
The companies has received calls about the wireless network being down, and these are being unable to connect to it. The network administrator says all access points are up and running. One of the help desk technicians notices the affected users are working in a building near the parking lot. Which of the following is most likely reasons for the outage?
A - Someone near the building is jamming the signal
533
Which of the following can best protect against an employee inadvertently installing malware on a company system?
Application allow list
534
A information security officer at a credit card transaction company is conducting a framework mapping exercise with the internal controls. The company recently established a new office in Europe. To which of the following framework should the Security Officer map the existing controls (pick two)
B - PCIDSS - The PCI DSS (Payment Card Industry Data Security Standard) is an information security standard designed to reduce payment card fraud by increasing security controls around cardholder data.
D - GDPR - General Data Protection Regulation - The GDPR requires that personal data must be processed securely using appropriate technical and organisational measures. The Regulation does not mandate a specific set of cyber security measures but rather expects you to take 'appropriate' action.
535
The customer called a company security team to report that all invoices the customer has received over the last five days from the company appeared to have fraudulent bank details Investigate into the matter reveals the follow:
- The manager of the accounts payable department is using the same password across multiple external websites and the corporate account
- One of the websites the manager used recently experienced a data breach
- The managers corporate email account was successfully accessed in the last five days by an IP address located in a foreign country
Which of the following attacks has most likely been used to compromise the manager's corporate account?
D - Credential stuffing
Credential stuffing is a cyber attack in which credentials obtained from a data breach on one service are used to attempt to log in to another unrelated service.
536
In the organization's corporate offices were destroyed due to a natural disaster. So the organization is now setting up offices in a temporary workspace. Which of the following well organizations most likely consult?
The business continuity plan
537
A security analyst is taking part in in an evaluation process that analyzes and categorizes threat actors of real world events in order to improve the incident response teams process, which of the following is the analyst smokes likely participating in?
Mitre Attack
MITRE ATT&CK® stands for MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK). The MITRE ATT&CK framework is a curated knowledge base and model for cyber adversary behavior, reflecting the various phases of an adversary's attack lifecycle and the platforms they are known to target.
538
Play network manager wants to protect the company's VPN by multi factor authentication that uses:
- Something you know
- Something you have
- Something you are
Which of the following would accomplish the manager's goal?
A - Domain name, PKI, GeoIP lookup
539
Which of the following terms should be included in a contract to help a company monitor the ongoing security maturity of a new vendor?
A - A right to audit clause allowing for annual security audits
540
Which of the following cloud models, provides clients with servers, storage, and networks, but nothing else?
IaaS
541
The marketing coordinator is trying to access a social media application on a company laptop, but it's getting blocked. the coordinator opens a help desk ticket to report the issue, which of the following documents should a security analyst review to determine whether accessing social media applications on a company device is permitted?
D - Acceptable use policy
542
Law enforcement official sent a company in notification that states electronically stored information and paper documents cannot be destroyed. Which of the following explains this procedure?
C - Legal hold
A legal hold, also known as a litigation hold, is the process by which organizations preserve potentially relevant information when litigation is pending or reasonably anticipated. By issuing a legal hold, organizations notify custodians about their duty not to delete ESI or physical documents relevant to a case.
543
The company wants to deploy decoy systems alongside production systems in order to entice threat actors and to learn more about attackers. which of the following best describes the system
Honeypots
544
The companies help desk received several AV alerts, indicating Mimikatz attempted to run on a remote systems. Several users also reported that the need company flash drives that they picked in the break room only have 512 gigabytes of storage. Which of the following is most likely the cause?
The GPO blocking the flash drives is being bypassed by a malicious flash drive that is attempting to harvest plaintext credentials from memory.
545
The company has installed bad readers for building access, but it's finding unauthorized individuals roaming hallways which of the following is most likely to cause?
Tailgtating
546
An organization routes all of its traffic through a VPN. Most users are remote and connect into a corporate data center that houses confidential information. There is a firewall at the internal border, followed by a DLP appliance, the VPN server and the data center itself. Which of the following is the weakest design element?
C - Encrypted VPN traffic will not be inspected when entering or leaving the network
547
Which of the following is the best method for ensuring non-repudiation?
Digital certificate
548
Which of the following methods is the most effective for reducing vulnerabilities?
B - Using a scan-patch-scan process
549
And organizations struggling with scaling issues on his vpn concentrator and Internet circuit due to remote work. the organization is looking for a software solution that will allow data to reduce traffic on the VPN and the internal circuit while still providing encrypted tunnel access to the data center and monitoring of remote employee Internet traffic. Which of the following will help achieve these objectives?
A - Deploying a SASE solution to remote employees
Secure access service edge (SASE) is an architecture that delivers converged network and security as a service capabilities including SD-WAN and cloud native security functions such as secure web gateways, cloud access security brokers, firewall as-a-service, and zero-trust network access.
550
Which of the following is the best reason to complete and audit in a banking environment?
A - Regulatory requirement
551
After a recent ransomware attack on a company system and administrator reviewed the log files. which of the following control types did the administrator use?
Detective
552
The technician needs to apply a high priority patch to a production system. which of the following steps should be taken first?
C- Create a change control request
553
A security analyst reports a company policy violation in a case in which a large amount of sensitive data is being downloaded after hours from various mobile devices to an external site. Upon further investigation, the analyst notices that successful login attempts are being conducted with impossible travel times during the same time periods when the unauthorized downloads are occurring. the analysts also discovers a couple of WIPS are using the same SSID, but they have non standard DHCP configurations and an overlapping channel. Which of the following attacks is being conducted?
A - Evil twin
554
An engineer needs to deploy security measure to identify and prevent data tampering within the enterprise. which of the following will accomplish this goal?
D - FIM
File Integrity Monitoring (FIM) is a security practice which consists of verifying the integrity of operating systems and application software files to determine if tampering or fraud has occurred by comparing them to a trusted "baseline."
555
Which of the following mitigation techniques places physically or logically separated networks and leveraged policies to limit the types of communication that are allowed?
A - Host-based firewalls
A host-based firewall is a piece of firewall software that runs on an individual computer or device connected to a network. These types of firewalls are a granular way to protect the individual hosts from viruses and malware, and to control the spread of these harmful infections throughout the network.
556
All security analysts and workstations at a company have network asset access to critical servers VLAN. The information security manager wants to further enhance the controls by requiring that access to the secure VLAN by authorized only from a given single location. which of the following will the information security manager most likely implement?
B - A jump server
557
Which of the following best describes why a company would erase a newly purchased device and install its own image with an operating system and applications?
B - Removing unneeded applications reduces the system's attack surface
558
A back door was detected on the containerized application environment. The investigation detected that a zero day vulnerability was introduced when the latest container image was downloaded from hit public registry. Which of the following is the best solution to prevent this type of incident from occurring again?
A - Enforce the use of a controlled trusted source of container images
559
An external forensics investigator has been hired to investigate a data breach at a large enterprise with numerous assets. it is known that the breach started in the perimeter network. moved to the sensitive information, generating multiple logs as the attacker transversed through the network. which of the following will best assist with this investigation?
C - Check the SIEM to review the correlated logs
560
Developers are running code and merging it into shared repository several times a day, where it is tested automatically. Which of the following concepts does this best represent?
D - Continuous integration
561
A large Financial Services term recently released information regarding its security breach within its corporate networks that began several years ago. during the time frame in which the breach occurred, indicators show an attacker gained administrative access to the network through a file download from my social media site and subsequently installed it without the user's knowledge. Since the compromise, the attacker was able to take command and control the computer systems anonymously while obtaining sensitive corporate and personal employee information. which of the following methods did the attacker most likely to use to gain access?
D - A RAT
Remote access trojans (RATs) are malware designed to allow an attacker to remotely control an infected computer. Once the RAT is running on a compromised system, the attacker can send commands to it and receive data back in response. 2022 Security Report Demo Endpoint RAT Protection.
562
Recent changes to accompanies BYOD policy require all personal mobile devices to use a two factor authentication method that is not something you know or have. Which of the following methods requirement?
A - Facial recognition
563
A critical file server is being upgraded, and the system's administrator must determine which RAID level the new server will need to achieve parity and handle two simultaneous disk failures, which of the following raid levels meet this requirement?
RAID 6
RAID 6, also known as double-parity RAID, is one of several RAID schemes that work by placing data on multiple disks and enabling I/O operations to overlap in a balanced way, improving performance. Not all types of RAID, or redundant array of independent disks, offer redundancy, although RAID 6 does.
564
Company must ensure sense of Jedi resident rendered unreadable. Which of the following will the company most likely use?
Encryption
565
A security assessment found that several embedded systems were running unsecured protocols buried. These systems were purchased two years ago, and the company that developed them no longer in business. Which of the following constraints best describes the reason the findings cannot be remediated?
Unavailable patch
566
An administrator assist the legal and compliance team with ensuring information about customer transaction is achieved for the proper time period. which of the following data policies administrator carried out?
Retention
567
An organization experiences a cybersecurity incident involving a command and a control server. Which of the following logs should be analyzed to identify the impacted hosts? Choose 2
D - Network
E - Firewall
568
Can you pick somebody's experience against that surface program and allowing the individuals to securely test the company's Internet facing application? The company will compensate researchers based on vulnerability to discover which of the following best describes the program by the company is setting up?
Bug bounty
569
The company is adding a clause to its AUP that states employees are not allowed to modify the operating system on mobile devices. which is the following vulnerabilities. Is the organization addressing?
C - Jailbreaking
570
An organization would like to store customer data on a spreadsheet part of the network that is not accessible to users on the main corporate network, which of the following should the administrator use to accomplish this goal?
B - Isolation
571
Which of the following examples would be best mitigated by input sanitation?
A -
572
A security engineer is concerned about using an agent on devices that relies completely on defined known bad signatures. The security engineer wants to implement a tool with component including the ability to track, analyze and monitor devices without reliance on definitions alone. Which of the following solutions best fits this use case?
A - EDR
Endpoint Detection and Response (EDR), also referred to as endpoint detection and threat response (EDTR), is an endpoint security solution that continuously monitors end-user devices to detect and respond to cyber threats like ransomware and malware.Oct 26, 2023
573
The users login credentials were recently compromised during the investigation. The security analyst determined the user input credentials into a pop up window when prompted to confirm user name and password. However, the trusted website does not use a pop up for entering user credentials Which of the following attacks occurred?
A - Cross-site scripting
Cross-site scripting (XSS) is an attack in which an attacker injects malicious executable scripts into the code of a trusted application or website. Attackers often initiate an XSS attack by sending a malicious link to a user and enticing the user to click it.
574
To reduce costs and overhead, an organization wants to move from an on premise email solution to a cloud based email solution At this time, no other services will be moving, which is. the following cloud models would best meet the needs of the organization?
SaaS
575
A software developer manager wants to ensure the authenticity of the code created by the company Which of the following options is the most appropriate?
B - Performing code signing on company developed software
576
An organization is having difficulty correlating events from its individual AV, EDR,DLP, SWG, WAF, MDM, HPS and CASB system. Which of the following is the best to improve the situation?
C - Utilize a SIEM to centralize logs and dashboards
577
A companies and users are reporting that they are unable to reach external websites at. After reviewing the performance data from the DNS servers, the analyst discovers that the CPU disk memory usage are minimal, but the network interface is flooded with inbound traffic. Network logs only show a small number of DNS queries sent to the server, which of the following best describes what the security analysis is seeing?
D - Reflected denial of service
578
Pam audit identified PII being utilized in the development environment of a critical application. The chief privacy officer is. a damage that this must be removed. However, the developers are concerned that without real data, they cannot perform functionality tests and search for specific data Which of the following should a security professional implement to satisfy both the CPOS and the development team's requirements?
C - Data masking
Deterministic data masking maps original values to masked values, ensuring that data is always replaced consistently in all tables. This can be important to retain data integrity. For example, if the data contains names, the name “John” will always be replaced with “Samuel” in all relevant tables.
579
A security analyst is investigating a malware incident at a company. The malware is assessing and command and control website at www.comptia.com. All outbound Internet traffic is logged syslog server and stored in /logfiles/messages. Which of the following commands would be best for the analysts to use on the syslog server to search for recent traffic to be to the command and control website?
C - tail-500 /logfiles/messages | grep www.comptia.com
580
A systems administrator set up an automated process that checks for vulnerabilities across the entire environment every morning. Which of the following activities is the system administrator conducting?
A - scanning
581
When the engineer is setting up VDI environment for a factory location, and the business wants to deploy a low cost solution to enable users on the shop floor to log in to the VDI environment directly. Which of the following should the engineer select to meet these requirements?
Thin clients
Thin clients and other lean devices rely on a constant network connection to a central server for full computing and don't do much processing on the hardware itself. The term is derived from the fact that small computers in networks tend to be clients and not servers.
582
A systems administrator receives the following alert from a file integrity monitoring tool: The hash of the cmd.Exe file has changed. The system administrator checks the OS logs and notices that no patches were applied in the last too much, which of the following most likely occurred?
D - A rootkit was deployed
A common rootkit definition is a type of malware program that enables cyber criminals to gain access to and infiltrate data from machines without being detected. It covers software toolboxes designed to infect computers, give the attacker remote control, and remain hidden for a long period of time.
583
A company's Chief information security officer (CISO) recently warned the security manager that the company's chief executive officer is planning to publish a controversial article in a national newspaper, which may result in new new cyberattacks. which of the following would be the best for the security manager to use in a threat model?
A - Hacktivists
A hacktivist is a hacker activist, someone who attacks computer systems for political reasons. “Hacktivism” is hacking activism.
584
Which of the following provides a catalog of security and privacy controls related to the United States Federal Information Systems?
D - NIST 800-53The NIST 800-53 is a cybersecurity standard and compliance framework developed by the National Institute of Standards in Technology. It's a continuously updated framework that tries to flexibly define standards, controls, and assessments based on risk, cost-effectiveness, and capabilities.
585
And analyst is concerned about data leaks and wants to restrict access to Internet services to authorized users only. the analyst also wants to control the actions each user can perform service. which of the following would be the best technology for the analyst to consider implementing?
CASB
A Cloud Access Security Broker (CASB) implements zero-trust access control and policy enforcement for these cloud environments. Traffic to the cloud flows through the CASB solution, enabling it to enforce corporate security policies.
586
The grocery store is expressing security and reliability concerns regarding the on-site backup strategy currently being performed by locally attached disks. The main concerns are that the security of the backup media and the durability of the data stored on these devices. which of the following is a cost effective approach to address these concerns?
D - Migrate to the cloud backup solution
587
A security engineer needs to recommend that a solution to defend against malicious actors misusing protocols and being allowed through network defenses. Which of the following engineer most likely recommend?
C - A next-generation firewall
588
The company's legal department drafted sensitive documents in a sas application and wants to ensure the documents cannot be accessed by individuals in high risk countries. Which of the following is the most effective way to limit the access?
C - Geolocation policy
The geolocation of a user is actually the position of a user's device, whether that's a home computer, laptop, smartphone, or fitness tracker. There are multiple ways for a device to determine its own position in the world, ranging from the most precise (GPS) to the least precise (IP-based geolocation).
589
An organization suffered numerous multi-day power outages at its current location. The chief executive officer wants to create a disaster recovery strategy to resolve this issue. Which of the following options offer low cost solutions? Choose 2
D - Cold Site
Cold Site. Cold sites which are empty facilities, such as trailers, warehouses, open space in existing data centers specially equipped for emergency use; or simply empty buildings that are wired for power, communications and HVAC but are empty. The cost model for each is quite different.
E - Cloud backups
590
A security analyst discovers that one of the web apis is being abused by an unknown 3rd party. Logs indicate that the 3rd party is attempting to manipulate the parameters being passed through the API endpoint. Which of the following solutions would best help to protect against the attack?
D - WAF
web application firewall helps protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet.
591
An application owner reports suspicious activity on the internal financial application from various internal users within the past 14 days. A security analyst notices the following:
-Financial transactions were occurring during irregular timeframes and outside business hours by unauthorized users
- Internal users in question were changing their passwords frequently during the that time.
- They jump box that's several domain administrator users used to connect to remote devices where recently compromised
- The authentication method used in the environment is NTLM
Which of the following types of attacks is most likely being used to gain unauthorized access
A - pass the hash
Pass the hash (PtH) is a type of cybersecurity attack in which an adversary steals a “hashed” user credential and uses it to create a new user session on the same network.
592
During an incident, an EDR system detects an increase in the number of encrypted, outbound connections from multiple hosts. A firewall is also reporting an increase in the outbound connection that uses random high ports. an analysts of plans to review the correlated logs to find the source of the incident. which of the following tools will best assist the analyst?
D - A SIEM
Security information and event management (SIEM) technology supports threat detection, compliance and security incident management through the collection and analysis (both near real time and historical) of security events, as well as a wide variety of other event and contextual data sources.
593
The company recently suffered a breach in which an attacker was able to access the internal mail servers and directly access several user inboxes. A large number of email messages later posted online. which of the following would best prevent email contents from being released should another breach occur?
A - Implement a S/MIME to encrypt the emails at rest
S/MIME encryption muddles emails so that they can only be viewed by receivers who have a private key to decrypt them. It prevents others, particularly malicious actors, from intercepting and reading email messages as they are sent from senders to recipients.
594
The company hired a consultant to perform an offensive security assessment covering penetration testing and social engineering. Which of the following terms will conduct this assessment activity?
D - RED
595
Which of the following exercises should an organization use to improve its incident response process?
A - Tabletop
596
An attacker is attempting to harvest user credentials on a client's website. A security analyst notices multiple attempts to use random usernames and passwords. when the analysts typed typically random username and password the login screen displays the following.:
The username you enter does not exist.
Which of the following should the analyst recommend be enabled?
C - Error Handling
597
An organization disabled unneeded services and placed a firewall in front of a business critical legacy system. which of the following best describes the action taken by the organization?
D - compensating controls
598
Which of the following describes the ability of code to target a hypervisor from inside a guest OS?
B - VM escape
Virtual machine escape is an exploit in which the attacker runs code on a VM that allows an operating system running within it to break out and interact directly with the hypervisor. Such an exploit could give the attacker access to the host operating system and all other virtual machines (VMs) running on that host.
599
A local server recently crashed, and the team is attempting to restore the server for my backup. During the restore process, the team notices the file size of each daily backup is large. or run out of space at the current rate. The current solution appears to do a backup full backup every night.
Which of the following would use the the least amount of storage space for backup?
D - A weekly, full backup with daily incremental backups
600
Take security analysts discover several jpeg photos from a cellular phone during a forensics investigation involving a compromise system. the analyst runs a forensics tool to gather file. information. Which of the following would be part of the images if all the metadata is still intact?
A - The GPS Location
601
A financial analyst is expecting an email containing sensitive information from a client. when the email arrives, the analyst receives an error and is unable to open the encrypted mail, which of the following is most likely the cause of the issue?
A - The S/MIME plug-in is not enable
S/MIME (Secure/Multipurpose internet Mail Extensions) is a widely accepted protocol for sending digitally signed and encrypted messages. S/MIME in Exchange Online provides the following services for email messages: Encryption: Protects the content of email messages.
602
603
The company develops a complex platform that is composed of a single application. After several issues with the upgrades, the system administrator recommends breaking down the application into unique independent modules. Which of the following best identifies this systems administrators recommendation?
C - Microservices
A microservice-based architecture is a modern approach to software development that breaks down complex applications — sometimes called monolithic applications — into smaller components that are independent of each other and more manageable.
604
Which of the following would be the best way to block unknown programs from executing?
B - Application allow list
605
The company is planning to install a guest wireless network to so visitors will be able to access the Internet. The stakeholders want the network to be easy to connect to, so time is not wasted in meetings. The WAPs are configured so that the power levels and attendance cover only the conference room where visitors will attend meetings. which of the following would best protect the company's internal wireless network against visitors accessing company resources?
A - Configure the guest wireless network to be on a seperate VLAN from the company's internal wireless network.
606
An organization relies on 3rd party video conferencing to conduct daily business. Recent security changes now require all remote workers to utilize A VPN to corporate resources. Which of the following would best maintain a high quality videoconferencing while minimizing latency when connected to the VPN?
B - Utilizing split tunneling, so only traffic for corporate resources is encrypted
607
A security analysts scanning a company's public network and discovers a host is running a remote desktop that can be used to access the production network. Which of the following should the security analyst recommend?
B - Setting up a VPN and placing the jump server inside the firewall
Jump server refers to a secure computer that spans two or more networks, allowing users to connect to it from one network, and then “jump“ to another network. It's also known as a jump host or a jump box.
608
A company recently experienced a major breach. An investigation concludes that the customer credit card data was stolen and exfiltrated through a dedicated business partner connection vendor who is not held to the same security control standards. Which of the following is most likely source of the breach?
B - Supply Chain
609
The company would like to provide flexibility for employees on device preferences. however, the company is concerned about supporting too many different types of hardware. which of the following deployment models will provide the needed flexibility with the greatest amount of control and security of our company data and infrastructure?
B - VDI
610
Which of the following threat actors is most likely to be motivated by ideology?
B - Hacktivist
611
The user would like to install software and features that are not available with a mobile devices default software. Which of the following would all would all the users to install unauthorized software and enable new features?
C - Jailbreaking
612
An organization recently acquired an ISO 27001 certification. which of the following would most likely be considered a benefit of the certification?
E - It assures customers that the organization meets security standards
613
A junior security analyst is reviewing web server logs and identifies the following pattern in the log file:
http://comptia.org/./././etc/passwd
Which of the following types of attacks is being attempted? And how can it be mitigated?
C - Directory traversal; implement a WAF
614
615
A security professional wants to enhance the protection of a critical environment that is used to store and manage companies' encryption keys. The selected technology should be resistant. which of the following should the security professional implement to achieve the goal?
HSM
Hardware security modules (HSMs) are hardened, tamper-resistant hardware devices that secure cryptographic processes by generating, protecting, and managing keys used for encrypting and decrypting data and creating digital signatures and certificates.
616
Which of the following is the correct order of validity from most to least volatile
B - Cache memory, temporary filesystems, disk, archival media
617
The chief information security officer wants to explicitly raise awareness about the increase of ransomware as a service in a report to the management team, which of the following describes the threat actor in the Cisco report?
D - Organized crim
618
Which of the following agreements defines response time, escalation points, and performance metrics?
D - SLA
619
A bakery has a secret recipe that it wants to protect. which of the following objectives should be added to the company's security awareness training?
A - Insider threat detection
620
Which of the following must be considered when designing a high availability network? Choose two.
A - Ease of recovery
D - Responsiveness
621
Which of the following strategies shifts risk that are not covered in an organization's risk strategy?
A - Risk transference
Risk transference in information security is the act of shifting risks from one area (or organization) to another. This is typically done because the original company lacks expertise in a particular area, and finds it more effective to outsource the work to another company that understands it better.
622
Big Security Administrator needs a method to secure data in an environment that includes some form of check so that the administrator can track any changes. Which of the following should the administrator set up to achieve this goal?
D - FIM
File Integrity Monitoring (FIM) is a security practice which consists of verifying the integrity of operating systems and application software files to determine if tampering or fraud has occurred by comparing them to a trusted "baseline"
623
The analyst is working on an email security incident in which the target opened an attachment containing a worm. The analyst wants to implement mitigation techniques to prevent spread. which of the following is the best course of action that analysts to take?
B - implement network segmentation
An effective technique to strengthen security, network segmentation is a physical or virtual architectural approach dividing a network into multiple segments, each acting as its own subnetwork providing additional security and control.
624
Sales team members have been receiving threatening voicemail messages and have been reporting these incidents to the IT security team. which of the following would be most appropriate The IT security team to analyze?
C - Session initiation protocol traffic logs
625
Put the following can be used to calculate the total loss expected per year due to a threat targeting an asset?
D - SLE x ARO
Annualized Rate of Occurrence, also known as ARO, refers to the expected frequency with which a risk or a threat is expected to occur.
626
Take security engineers hardening existing solutions to reduce application vulnerabilities. which of the following solutions would the engineer implement first? Choose 2
A - Auto-update
F - Sandboxing
Sandboxing is a cybersecurity practice where you run code, observe and analyze and code in a safe, isolated environment on a network that mimics end-user operating environments. Sandboxing is designed to prevent threats from getting on the network and is frequently used to inspect untested or untrusted code.
627
Which of the following authentication methods is considered to be the least secure?
B - SMS
628
Employees in the research and development business unit receive extensive training to ensure they understand how to best protect company data. which is the following is the type of these employees are most likely to use in day-to-day work activities?
B - intellectual property
629
An auto report indicates multiple suspicious attempts to access company resources were made. these attempts were not detected by the company. Which of the following would be the solution to implement on the companies network?
A - intrusion prevention system
630
An administrator identifies some locations on the 3rd floor of the building that have a poor wireless signal. Multiple users confirm the incident and report it is done and isolated of that. Which of the following should the administrator use to find the areas with a poor or nonexistent wireless signal?
C - Site survey
631
Which of the following has been implemented when a host-based firewall on a legacy Linux system allows connections from only specific internal IP addresses?
B - Network segmentation
Network segmentation is a network security technique that divides a network into smaller, distinct sub-networks that enable network teams to compartmentalize the sub-networks and deliver unique security controls and services to each sub-network.
632
An attacker tricks a user into providing confidential information. which of the following describes this form of malicious reconnaissance?
B - Social engineering
633
A large bank with two geographically dispersed data centers is concerned about major power disruptions at both locations. every day each location experience is very brief outages that last a few seconds. However, during the summer, a high risk of intentional under-voltage events that could last up to an hour exist, particularly at one of the locations near an industrial smelts, which is the following is the best solution to reduce the risk of data loss?
B - Generator
634
