Security+ Practice Flashcards
A user is attempting to navigate to a website from inside the company network using a desktop. When the user types in the URL, https://www.site.com, the user is presented with a certificate mismatching warning from the browser. The uses does not receive a warning when visiting http://www.anothersite.com. Which of the following describe this attack?
Domain hijacking - the practice of using ccTLDs in an unconventional way to create a domain name.
Which of the following tools is effective in preventing a user from accessing unauthorized removable media?
USB data blocker
A Chief Security Officer is looking for a solution that can provide increased scalability and flexibility for back-end infrastructure, allowing it to be updated and modified without disruption of services. The security architect would like the solution selected to reduce the back-end server resources and has highlighted that session persistence is not important for the applications running on the back-end servers. Which of the following would best meet the requirements.
Reverse Proxy - A reverse proxy server is a type of proxy server that typically sits behind the firewall in a private network and directs client requests to the appropriate backend server.
Which of the following describes a social engineering technique that seeks to exploit a person’s sense of urgency?
A phishing email stating a cash settlement has been awarded but will expire soon
A security analyst is reviewing application logs to determine the source of a break and locates the following log:
(Link start) https://www.compta.com/login.php?((Link end)id=’%20or%20’1’1=’1
Which of the following has been observed?
SQLi - SQL injection - a common attack vector that uses malicious SQL code for backend database manipulation to access information that was not intended to be displayed.
An audit identified PII being utilized in the development environment of a critical application. The Chief Privacy Officer (CPO) is adamant that this data must be removed; however, the developers are concerned that without real data they cannot perform functionality tests and search for specific data. Which of the following should a security professional implement the BEST to satisfy both the CPO’s and the development team’s requirements?
Data masking - creates fake versions of an organization’s data by changing confidential information.
A company is implementing a DLP solution on the file server. The file server has PII, financial information, and health information stored on it. Depending on what type of data that is hosted on the file server, the company wants different DLP rules assigned to the data. Which of the following should the company do to help accomplish this goal?
Classify the data
A forensics investigator is examining a number of unauthorized payments that were reported on the company’s website. Some unusual log entries show users received an email for an unwanted mailing list and clicked on a link to attempt to unsubscribe. One of the users reported the email to the phishing team, and the forwarded email revealed the link to be <a>Click here to unsubscribe</a> Which of the following will the forensics investigator MOST likely determine has occurred?
XSRF - Cross-site request forgery - an attack that forces authenticated users to submit a request to a Web application against which they are currently authenticated.
A report delivered to the Chief Information Security Office (CISO) shows that some users credentials could be exfiltrated. The report also indicates that users tend to choose the same credentials on different systems and applications. Which of the following policies should the CISO use to prevent someone from using the exfiltrated credentials
MFA - Multi Factor Authentication
A company wants to simply the certificate management process. The company has a single domain with several dozen subdomains, all of which are publicly accessible on the internet. Which of the following BEST describes the type of certificate the company should implement?
Wildcard - digital certs - a digital certificate that is applied to a domain and all its subdomains.
Which of the following is an effective tool to stop or prevent exfiltration of data from a network?
DLP - Data loss Prevention - a cybersecurity solution that detects and prevents data breaches.
Several attempts have been made to pick the door lock of a security facility. As a result, the security engineer has been assigned to implement a stronger preventative access control. Which of the following would BEST complete the engineer’s assignment?
Replacing the traditional key with an RFID key
Which of the following can be used by a monitoring tool to compare values and detect password leaks without providing the actual credentials?
Hashing - a data security technique used to convert data values into alternate, unique identifiers called hashes for quick and secure access.
A security engineer is building a file transfer solution to send files to a business partner. The user would like to drop off the files in a specific directory and have the server send the file to the business partner. The connection to the business partner is over the internet and needs to be secure. Which of the following can be used?
SSH - Secure Shell Protocol is a cryptographic network protocol for operating network services securely over an unsecured network.
An administrator needs to protect user passwords and has been advised to hash the passwords. Which of the following BEST describes what the administrator is being advised to do?
Perform a mathematical operation on the passwords that will convert them into unique strings.
Which of the following would be indicative of a hidden audio file found inside of a piece of source code?
Steganography - the practice of concealing messages or information within other non secret text or data
A user enters a username and password at the login screen for a web portal. A few seconds later the following message appears on the screen: Please use the combination of numbers, special characters, and letters in the password field. Which of the following concepts does this message describe?
Password complexity
A company recently experienced an inside attack using a corporate machine that resulted in data compromise. Analysis indicated an unauthorized change to the software circumvented technological protection measures. The analyst was tasked with determining the best method to ensure the integrity of the systems remains intact and local and remote boot attestation can take place. Which of the following would provide the BEST solution?
TPM - Trusted Platform Module - boot integrity - is a specialized chip on a laptop or desktop computer that is designed to secure hardware with integrated cryptographic keys.
Which of the following is a reason to publish files’ hashes?
To validate the integrity of the files
A security manager has tasked the security operations center with locating all web servers that respond to an unsecured protocol. Which of the following commands could an analyst run to find the requested servers?
nmap -p 80 10.10.10.0/24 - network scanning with Nmap. Nmap - network mapper - n open source Linux command-line tool—used for network exploration, host discovery, and security auditing.
Which biometric error would allow an unauthorized user to access a system?
False acceptance is an error in biometrics that causes an unauthorized person to be authenticated
A company is auditing the manner in which its European customers’ personal information is handled. Which of the following should the company consult?
GDPR - General Data Protection Regulation - governs the way in which we can use, process, and store personal data (information about an identifiable, living person).
Which of the following are common Voip-associated vulnerabilities? (Choose two).
- Vishing - over the phone - the fraudulent practice of making phone calls or leaving voice messages purporting to be from reputable companies in order to induce individuals to reveal personal information, such as bank details and credit card numbers.
- Credential harvesting - a form of cyberattack that involves the theft of personal or financial data such as usernames and passwords, typically carried out through phishing, malicious websites, email scams, or malware but not always.
Which of the following describes the exploration of an interactive process to gain access to restricted areas?
Privilege Escalation is a cyberattack designed to gain unauthorized privileged access into a system.
An organization is planning to open other data centers to sustain operations in the event of a natural disaster. Which of the following considerations would BEST support the organization’s resiliency?
Geographical dispersal - placing physical distances between duplicate systems so the organization can avoid damages to both the primary and alternate resources from the same disaster.
A security engineer is deploying a new wireless network for a company. The company shares office space with multiple tenants. Which of the following should the engineer configure on the wireless to ensure that the confidential data is not exposed to unauthorized users?
AES - Advanced Encryption Standard - an algorithm that uses the same key to encrypt and decrypt protected data.
The Chief Compliance Officer from a bank has approved a background check policy for new hires. Which of the following is the policy MOST likely protecting against?
Ensuring no new hires have worked at other banks that may be trying to steal customer information.
An engineer recently deployed a group of 100 web servers in a cloud environment. Per the security policy, all web-server ports except 443 should be disabled. Which of the following can be used to accomplish this task?
Host-based firewall - firewall software that is installed directly on a computer (rather than a network)
A technician was dispatched to complete repairs on a server in a data center. While locating the server, the technician entered a restricted area without authorization. Which of the following security controls would BEST prevent this in the future?
Implement access control vestibules - hall or lobby next to the outer door of a building.
Which of the following would BEST provide a systems administrator with the ability to more efficiently identify systems and manage permissions and policies based on location, role, and service level?
Domain services - Active Directory Domain Services (AD DS) is a server role in Active Directory that allows admins to manage and store information about resources from a network, as well as application data, in a distributed database.
Which of the following would best detect intrusions at the perimeter of an airport?
Motion sensors
A security analyst is concerned about critical vulnerabilities that have been detected on some applications running inside containers. Which of the following is the BEST remediation strategy?
Update the base container image and redeploy the environment
An organization has decided to purchase an insurance policy because a risk assessment determined that the cost to remediate the risk is greater than the five-year cost of the insurance policy. The organization is enabling risk
transference - a contractual shifting of a pure risk from one party to another.
A security analyst receives an alerts from the company’s SIEM that anomalous activity is coming from a local source IP address of 192.168.34.26. The Chief Information Security Officer asks the analyst to block the originating source. Several days later, another employee opens an internal ticket stating that vulnerability scans are no longer being performed properly. The IP address the employee provides is 192.168.34.26. Which of the following describes this type of alert?
False positive - a test result which incorrectly indicates that a particular condition or attribute is present
A security analyst wants to reference a standard to develop a risk management program. Which of the following is the BEST source for the analyst to use?
ISO 31000 - Risk management – Guidelines, provide principles, a framework and a process for managing risk.
The Chief Information Security Office (CISO) requested a report on potential areas of improvement following a security incident. Which of the following incident response processes is the CISO requesting?
Root cause analysis - is the process of discovering the root causes of problems in order to identify appropriate solutions.
A company is providing security awareness training regarding the importance of not forwarding social media messages from unverified sources. Which of the following risks would this training help to prevent?
Hoaxes - believable stories or malicious deception
A security analyst is receiving numerous alerts reporting that the response time of an internet-facing application has been degraded. However, the internal network performance was not degraded. Which of the following MOST likely explains this behavior?
DDoS attack - an overload of traffic from a # of sources that makes resources unavailable for legitimate users.
Which of the following will increase cryptographic security?
High data entropy - a higher level of disorder or uncertainty in the data.
Which of the following statements BEST describes zero-day exploits?
zero-day exploit is initially undetectable, and no patch for it exists.
A company wants to restrict emailing of PHI documents. The company is implementing a DLP solution. In order to restrict PHI documents, which of the following should be performed FIRST?
Classification - is the process of identifying and and grouping objects or ideas into predetermined categories
A security analyst is investigating some users who are being redirected to be a fake website that resembles www.comptia.org. The following output was found on the naming server of the organization.
Name Type Data
WWW A 192.168.1.10
server1 A 10.10.10.10
server2 A 10.10.10.11
file A 10.10.10.12
DNS poisoning - hacker poisoning the DNS site. happens when fake information is entered into the cache of a domain name server, resulting in DNS queries producing an incorrect reply, sending users to the wrong website.
Which of the following describes the continuous delivery software development methodology?
Agile - having a comprehensive approach to identifying any gaps or concerns.
Which of the following is the BEST example of cost-effective physical control to enforce a USB removable media restriction policy?
Implementing a GPO that will restrict access to authorized USB removable media and regularly verifying that it is enforced.
A company suspects that some corporate accounts were compromised. The number of suspicious logins from locations not recognized by the users is increasing. Employees who travel need their accounts protected without the risk of blocking legitimate login requests that may be made over new sign-in properties. Which of the following security controls can be implemented?
Enforce MFA when an account request reaches a risk threshold.
An organization wants to participate in threat intelligence information sharing with peer groups. Which of the following would MOST likely meet the organizations requirement?
Subscribe to threat intelligence feeds
Which of the following is the MOST effective control against zero-day vulnerabilities?
Patch management - the process of applying updates to software, drivers, and firmware to protect against vulnerabilities.
Which of the following is the GREATEST security concern when outsourcing code development to third-party contractors for an internet-facing application?
Unknown backdoor - an undocumented way to bypass existing cybersecurity measures and gain access to the computer system or device.
An organization has hired a red team to simulate attacks on its security posture. Which of the following will the blue team do after detecting an IoC?
Activate runbooks for incident response. IoC - potential indicators of compromise
An amusement park is implementing a biometric system that validates customers’ fingerprints to ensure they are not sharing tickets. The park’s owner values customers above all and would prefer customers’ convenience over security. For this reason, which of the following features should the security team prioritize FIRST?
Low FRR - False Reject Rate (FRR) When you have a low FRR, it means that your biometric system is rejecting fewer people than it should be. Calculated by dividing the number of false rejects by the total number of transactions.
Which of the following organizations sets frameworks and controls for optimal security configuration on systems?
NIST - National Institute of Standards and Technology
An organization discovered files with proprietary financial data have been deleted. The files have been recovered from backup, but every time the Chief Financial Officer logs into the file server, the same files are deleted again. No other users are experiencing this issue. Which of the following types of malware is MOST likely causing this behavior?
Logic bomb - a set of instructions secretly incorporated into a program so that if a particular condition is satisfied they will be carried out, usually with harmful effects.
A security analyst has identified malware spreading through the corporate network and has activated the CSIRT. Which of the following should the analyst do NEXT?
Attempt to quarantine all infected hosts to limit further spread. CSIRT - Computer Security Incident Response Team
During an incident response, an analyst applied rules to all inbound traffic on the border firewall and implemented ACL’s on each critical server. Following an investigation, the company realizes it is still vulnerable because outbound traffic is not restricted, and the adversary is able to maintain a presence in the network. In which of the following stages of the Cyber Kill Chain is the adversary currently operating?
Command and control - attack refers to methods and tools used to communicate with and control an infected machine or network.
A recent security breach exploited software vulnerabilities in the firewall and within the network management solution. Which of the following will MOST likely be used to identify when the breach occurred through each device?
Firewall syslog events logs
Which of the following is the FIRST environment in which proper, secure coding should be practiced?
Development
A cloud service provider has created an environment where customers can connect existing local networks to the cloud additional computing resources and block internal HR applications from reaching the cloud. Which of the following cloud models is being used?
Hybrid
An organization has developed an application that needs a patch to fix a critical vulnerability. In which of the following environments should the patch be deployed LAST?
Production
An organization is building backup server rooms in geographically diverse locations. The Chief Information Security Officer implemented a requirement on the project that states the new hardware cannot be susceptible to the same vulnerabilities in the existing server room. Which of the following should the systems engineer consider? Select 1
Implementing a robust patch management solution
A security analyst is working on a project to implement a solution that monitors network communications and provides alerts when abnormal behavior is detected. Which of the following is the security analyst MOST likely implementing?
User behavior analysis - provides you with the data to identify trends and easily spot outliers, so you can more easily and quickly identify and investigate potential threats and break the attack chain.
Data exfiltration analysis indicates that an attacker managed to download system configuration notes from a web server. The web-server logs have been deleted, but analyst have determined that the system configurations notes were stored in the database administrator’s folder on the web server. Which of the following attacks explains what occurred?
Directory traversal - also known as path traversal or directory climbing, is a vulnerability in a web application server caused by a HTTP exploit. The exploit allows an attacker to access restricted directories, execute commands, and view data outside of the web root folder where application content is stored.
SQL injection - also known as SQLI, is a common attack vector that uses malicious SQL code for backend database manipulation to access information that was not intended to be displayed.
A junior security analyst is conducting an analysis after passwords were changed on multiple accounts without users’ interaction. The SIEM have multiple login entries with the following text:
suspicious event - user scheduledtasks successfully authenticate on AD on abnormal time
suspicious event - user scheduledtasks failed to execute c:
Privilege escalation - is a cyberattack designed to gain unauthorized privileged access into a system.
A customer server representative reported an unusual text message that was sent to the help desk. The message contained an unrecognized invoice number with a large balance due and a link to click for more details. Which of the following BEST describes this technique?
Phishing - the fraudulent practice of sending emails or other messages purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers.
Which of the following actions would be recommended to improve an incident response process? Select 1
Train the team to identify the difference between events and incidents.
A cybersecurity administrator needs to implement a Layer 7 security control on a network and block potential attacks. Which of the following can block an attack at the Layer 7? Choose two
WAF - Web Application Firewall
NAC - Network Access Control - ensures that only users who are authenticated and devices that are authorized and compliant with security policies can enter the network.
A business operations manager is concerned that a PC that is critical to business operations will have a costly hardware failure soon. The manager is looking for options to continue business operations without incurring large costs. Which of the following would mitigate the manager’s concerns?
Perform a physical-to-virtual migration
An organization has activated an incident response plan due to a malware outbreak on it’s network. The organization has brought in a forensics team that has identified an internet-facing Windows server as the likely point of initial compromise. The malware family that was detected is known to be distributed by manually logging on to servers and running the malicious code. Which of the following actions would be BEST to prevent reinfection from the infection vector?
Block port 3389 inbound from untrusted networks
Which of the following uses SAML for authentication?
Federation - Identity Federation - resources that will trust a single authentication source
The SOC for a large MSSP is meeting to discuss the lessons learned from a recent incident that took much too long to resolve. This type of incident has become more common in recent weeks and is consuming large amounts of the analysts’ time due to manual tasks being performed. Which of the following solutions should the SOC consider to BEST improve its response time?
Implement a SOAR with customizable playbooks. SOAR - Security, Orchestration, Automation, and Response. SOAR seeks to alleviate the strain on IT teams by incorporating automated responses to a variety of events. A SOAR system can also be programmed to custom-fit an organization’s needs. managed security service provider (MSSP)
Business partners are working on a security mechanism to validate transactions securely. The requirement is for one company to be responsible for deploying a trusted solution that will register and issue artifacts used to sign, encrypt, and decrypt transaction files. Which of the following is the BEST solution to adopt?
PKI - Public key infrastructure the set of hardware, software, policies, processes, and procedures required to create, manage, distribute, use, store, and revoke digital certificates and public-keys.
A security analyst has been asked by the Chief Information Security Officer to:
-develop a secure method of providing centralized management of infrastructure
-reduce the need to constantly replace aging end user machines
-provide a consistent user desktop experience
Which of the following BEST meets this requirement?
VDI - Virtual desktop infrastructure
Which of the following terms describes a broad range of information that is sensitive to a specific organization?
Proprietary - is often transferred between companies after both sign a secrecy or confidentiality agreement.
A Chief Security Officer (CSO) is concerned that cloud-based services are not adequately protected from advanced threats and malware. The CSO believes there is a high risk that a data breach could occur in the near future due to the lack of detective and preventive controls. Which of the following should be implemented to the BEST address CSO’s concerns? (choose two).
An NG-SWG - Next Generation Secure Web Gateway (SWG) is a new cloud-native solution for protecting enterprises from the growing volume of sophisticated cloud enabled threats and data risks. It is the logical evolution of the traditional secure web gateway, also known as a web proxy or web filter.
Segmentation - is a network security technique that divides a network into smaller, distinct sub-networks that enable network teams to compartmentalize the sub-networks and deliver unique security controls and services to each sub-network.
An organization is planning to roll out a new mobile device policy and issue each employee a new laptop. These laptops would access the users’ corporate operating systems remotely and allow them to use the laptops for purposes outside of their job roles. Which of the following deployment models is being utilized?
COPE - Corporate-Owned Personally-Enabled (COPE) architectures provide the flexibility of allowing both enterprises and employees to install applications onto organization-owned mobile devices.
VDI
Certain users are reporting their accounts are being used to send unauthorized emails and conduct suspicious activities. After further investigation, a security analyst notices the following:
-All users share workstations throughout the day
-Endpoint protection was disabled on several workstations throughout the network
-Travel times on logins from the affected users are impossible
-Sensitive data is being uploaded to external sites
-All users account passwords were forced to be reset and the issue continued
Which of the following attacks is being used to compromise the user accounts?
Brute-force - a hacking method that uses trial and error to crack passwords, login credentials, and encryption keys. It is a simple yet reliable tactic for gaining unauthorized access to individual accounts and organizations’ systems and networks.
A security forensics analyst is examining a virtual server. The analyst wants to preserve the present state of the virtual server, including memory contents. Which of the following backup types should be used?
Snapshot
After returning from a conference, a user’s laptop has been operating slower than normal and overheating, and the fans have been running constantly. During the diagnosis process, an unknown piece of hardware is found connected to the laptop’s motherboard. Which of the following attack vectors was exploited to install the hardware?
Supply chain - The practice of identifying, assessing and managing cyber security risks in the supply chain, encompassing technological and human risk factors.
After a recent security breach, a security analyst reports that several administrative usernames and passwords are being sent via cleartext across the network to access network devices over port 23. Which of the following should be implemented so all credentials sent over the network are encrypted when remotely accessing and configuring network devices?
SSH - also known as Secure Shell or Secure Socket Shell, is a network protocol that gives users, particularly system administrators, a secure way to access a computer over an unsecured network. SSH also refers to the suite of utilities that implement the SSH protocol.
Which of the following provides a calculated value for known vulnerabilities so organizations can prioritize migration steps?
CVSS - Common Vulnerability Scoring System (CVSS) provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity.
Several universities are participating in a collaborative research project and needs to share compute and storage resources. Which of the following cloud deployment strategies would BEST meet this need?
Hybrid
A forensic analyst needs to prove that data has not been tampered with since it was collected. Which of the following methods with the analyst MOST likely use?
Calculate the checksum using a hashing algorithm
Multiple business accounts were compromised a few days after a public website had its credentials database leaked on the internet. No business emails were identified in the breach, but the security team thinks that the list of passwords exposed was later used to compromise business accounts. Which of the following would mitigate the issue? Select 1
complexity requirements
A security analyst wants to fingerprint a web server. Which of the following tools will the security analyst MOST likely use to accomplish this task?
nmap - p1-65535 192.168.0.10 - Nmap (“Network Mapper”) is a free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.
A penetration tester was able to compromise an internal server and is now trying to pivot the current session in a network lateral movement. Which of the following tools, if available on the server, will provide the MOST useful information for the next assessment step?
nmap - p1-65535 192.168.0.10 - Nmap (“Network Mapper”) is a free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.
Field workers in an organization are issued mobile phones on a daily basis. All the work is performed within one city, and the mobile phones are not used for any purpose other than work. The organization does not want these phones used for personal purposes. The organization would like to issue the phones to workers as the permanent devices so the phones do not need to be reissued every day. Given the conditions described, which of the following technologies would BEST meet these requirements?
Mobile device management
Which of the following control types is focused primarily on reducing risk before an incident occurs?
Preventive
A systems administrator reports degraded performance on a virtual server. The administrator increases the virtual memory allocation, which improves conditions, but performance degrades again after a few days. The administrator runs an analysis tool and sees the following output:
==3214== timeAttend.exe analyzed
==3214==ERROR SUMMARY:
==3214==mall/free: in use at exit: 4608 bytes in 18 blocks
==3214==checked 82116 bytes
==3214== definitely lost:4608 bytes in 18 blocks.
The administrator terminates the timeAttend.exe, observes system performance over the next few days, and notices that the system performance does not degrade. Which of the following issues is MOST likely occurring?
Memory leak - a common software issue that can lead to serious security vulnerabilities and performance issues.
An administrator is experiencing issues when trying to upload a support file to a vendor. A pop-up message reveals that a payment card number was found in the file, and the file uploaded was blocked. Which of the following controls is most likely causing this issue and should be check FIRST?
Content Filter is a process that manages or screens access to specific emails or webpages. The goal is to block content that contains harmful information. Content filtering programs are commonly used by organizations to control content access through their firewalls. They can also be used by home computer users.
Which of the following risk management strategies would an organization use to maintain a legacy system with known risk for operational purposes?
Mitigation - Mitigation, or Attack Mitigation, is the reduction in severity or seriousness of an event. In cybersecurity, mitigation is centered around strategies to limit the impact of a threat against data in custody. Threats against data can come from outside attackers motivated by profit, activism, retribution, or mischief.
Which of the following is the BEST action to foster a consistent and auditable incident response process?
Publish the document in a central repository that is easily accessible to the organization
During a recent penetration test, the tester discovers large amounts of data were exfiltrated over the course of 12 months via the internet. The penetration tester stops the test to the inform the client of the findings. Which of the following should be the client’s NEXT step to migrate the issue?
Perform containment on the critical servers and resources.
A security analyst is designing the appropriate controls to limit unauthorized access to a physical site. The analyst has a directive to utilize the lowest possible budget. Which of the following would BEST meet the requirements?
Preventive controls - security mechanisms, tools, or practices that can deter or mitigate undesired actions or events.
A company is looking to migrate some servers to the cloud to minimize its technology footprint. The company has 100 databases that are on premises. Which of the following solutions will require the LEAST management and support from the company.
IaaS - infrastructure as a Service (IaaS) is a cloud computing model in which a third-party cloud service provider (CSP) offers virtualized compute resources such as servers, data storage and network equipment on demand over the internet to clients.
Which of the following employee roles is responsible for protecting an organization’s collected personal information?
DPO - The primary role of the data protection officer (DPO) is to ensure that her organisation processes the personal data of its staff, customers, providers or any other individuals (also referred to as data subjects) in compliance with the applicable data protection rules.
Against the recommendation of the IT security analyst, a company set all user passwords on a server as “P@55w0rD?. Upon review of the /etc/passwd file, an attacker found the following:
alice:adlkajfljafkjdaflkadjsfasdj
bob:dadaldaflkjdasflkasjfldskjf
chris:daadfadsfadsfasdlkfj
Which of the following BEST explains why the encrypted passwords do not match?
Salting - With password salting, a random piece of data is added to the password before it runs through the hashing algorithm, making it unique and harder to crack. When using both hashing and salting, even if two users choose the same password, salting adds random characters to each password when the users enter them.
After gaining access to the dual-homed (ie wired and wireless) multifunctional device by exploiting a vulnerability in the device’s firmware, a penetration tester then gaines shell access on another networked asset. This technique is an example of
Pivoting - The act of an attacker moving from one compromised system to one or more other systems within the same or other organizations. Pivoting is fundamental to the success of advanced persistent threat (APT) attacks.
Which of the following should be monitored by threat intelligence researchers who search for leaked credentials?
Dark Web
A security analyst needs to be able to search and correlate logs from multiple sources in a single tool. Which of the following would BEST allow a security analyst to have this ability?
SIEM - Security information and event management (SIEM) is a security solution that helps organizations detect threats before they disrupt business.
A security analyst in investigating suspicious traffic on the web server located at IP address 10.10.1.1. A search of the WAF logs reveals the following output:
Source IP Destination IP Requested URL Action Taken
172.106.1.3 10.10.1.1 /web/cgi-bin/contract?category=custname’– permit and log
172.16.1.3 10.10.1.1 /web/cgi-bin/contract?category=custname+OR+1=1– permit and log
SQLi - SQL injection, also known as SQLI, is a common attack vector that uses malicious SQL code for backend database manipulation to access information that was not intended to be displayed. This information may include any number of items, including sensitive company data, user lists or private customer details.
Which of the following components can be used to consolidate and forward inbound internet traffic to multiple cloud environments through a single firewall?
Transit gateway - A transit gateway is a network transit hub that you can use to interconnect your virtual private clouds (VPCs) and on-premises networks. As your cloud infrastructure expands globally, inter-Region peering connects transit gateways together using the AWS Global Infrastructure.
A DBA reports that several production server hard drives were wiped over the weekend. The DBA also reports that several Linux servers were unavailable due to system files being deleted unexpectedly. A security analyst verified that software was configured to delete data deliberately from those servers. No backdoors to any servers were found. Which of the following attacks was MOST likely used to cause the data loss?
Logic bomb - A logic bomb is a set of instructions in a program carrying a malicious payload that can attack an operating system, program, or network. It only goes off after certain conditions are met. A simple example of these conditions is a specific date or time.
Digital signatures use asymmetric encryption. This means the message is encrypted with:
the sender’s private key and decrypted with the recipient’s public key
A security engineer was assigned to implement a solution to prevent attackers from gaining access by pretending to be authorized users. Which of the following technologies meets the requirement?
MFA - Multi Factor Authentication
The Chief Information Security Officer (CISO) has requested that a third-party vendor provide supporting documents that show proper controls are in place to protect customer data. Which of the following would be BEST for the third-party vendor to provide to the CISO?
SOC 2 Type 2 report - SOC 2, aka Service Organization Control Type 2, is a cybersecurity compliance framework developed by the American Institute of Certified Public Accountants (AICPA). The primary purpose of SOC 2 is to ensure that third-party service providers store and process client data in a secure manner.
Which of the following is assured when a user signs an email using a private key?
Authentication
A system administrator is troubleshooting a server’s connection to an internal web server. The administrator needs to determine the correct ports to use. Which of the following tools BEST shows which ports on the web server are in a listening state?
netstat - NetSTAT is a tool aimed at real-time network-based in-trusion detection. The NetSTAT approach extends the state transition analysis technique (STAT) [3] to network-based intrusion detection in order to represent attack scenarios in a networked environment.
Which of the following BEST reduces the security risks introduced when running systems that have expired vendor support and lack an immediate replacement?
Implement proper network access restrictions
Due to unexpected circumstances, an IT company must vacate its main office, forcing all operations to alternate, off-site locations. Which of the following with the company MOST likely reference for guidance during this change?
The business continuity plan - A business continuity plan (BCP) is a document that consists of the critical information an organization needs to continue operating during an unplanned event. The BCP states the essential functions of the business, identifies which systems and processes must be sustained, and details how to maintain them.
While reviewing an alert that shows a malicious request on one web application, a cybersecurity analyst is alerted to a subsequent token reuse moments later on a different service using the same single sign-on method. Which of the following would BEST detect a malicious actor?
Utilizing SIEM correlation engines - SIEM Security information and event management system - event correlation is an essential part of any SIEM solution. It aggregates and analyzes log data from across your network applications, systems, and devices, making it possible to discover security threats and malicious patterns of behaviors that otherwise go unnoticed and can lead to compromise or data loss.
Two organizations plan to collaborate on the evaluation of new SIEM solutions for their respective companies. A combined effort for both organizations’ SOC teams would speed up the effort. Which of the following can be written to document this agreement?
MOU
The Chief Information Security Officer wants to prevent the exfiltration of sensitive information from employee cell phones when using public USB power charging stations. Which of the following would be the BEST solution to implement?
USB data blocker - also known as a USB Condom, is a small device that you plug in between your device and a charging port to prevent data from being transferred from your device while still allowing it to charge.
The board of directors at a company contracted with an insurance firm to limit the organization’s liability. Which of the following risk management practices does this BEST describe?
Transference - Risk transference in information security is the act of shifting risks from one area (or organization) to another. This is typically done because the original company lacks expertise in a particular area, and finds it more effective to outsource the work to another company that understands it better.
Which of the following is a risk that is specifically associated with hosting applications in the public cloud?
Shared tenancy - A multi-tenant cloud is a cloud computing architecture that allows customers to share computing resources in a public or private cloud. Each tenant’s data is isolated and remains invisible to other tenants.
DDoS attacks are causing an overload on the cluster of cloud servers. A security architect is researching alternatives to make the cloud environment respond to load fluctuation in a cost-effective way. Which of the following options BEST fulfills the architect’s requirements?
An orchestration solution that can adjust scalability of cloud assets.
Which of the following documents provides expectations at a technical level for quality, availability, and responsibility?
SLA
Which of the following is an example of transference of risk?
Purchasing insurance
An employee received a word processing file that was delivered as an email attachment. The subject line and email content enticed the employee to open the attachment. Which of the following attack vectors BEST matches this malware?
Macro-enabled file - is a file extension used by Excel which allows you to save Excel documents with macros and Visual Basic for Applications (VBA) code.
A security proposal was set up to track requests for remote access by creating a baseline of the users’ common sign-in properties. When a baseline deviation is detected, an MFA challenge will be triggered. Which of the following should be configured in order to deploy the proposal?
Context-aware authentication - is the use of supplemental information to improve security decisions at the time they are made, resulting in more accurate security decisions capable of supporting dynamic business and IT environments
Which of the following secure coding techniques makes compromised code more difficult for hackers to use?
Obfuscation - Obfuscation means to make something difficult to understand. Programming code is often obfuscated to protect intellectual property or trade secrets, and to prevent an attacker from reverse engineering a proprietary software program. Encrypting some or all of a program’s code is one obfuscation method.
As part of a security compliance assessment, an auditor performs automated vulnerability scans. In addition, which of the following should the auditor do to complete the assessment?>
Log analysis
A database administrator wants to grant access to an application that will be reading and writing data to a database. The database is shared by other applications also used by the finance department. Which of the following account types is MOST appropriate for this purpose?
Generic
A security analyst generated a file named host1.pcap and shared it with a team member who is going to use it for further incident analysis. Which of the following tools will the other team member MOST likely use to open this file?
Wireshark - is a network protocol analyzer, or an application that captures packets from a network connection, such as from your computer to your home office or the internet. Packet is the name given to a discrete unit of data in a typical Ethernet network. Wireshark is the most often-used packet sniffer in the world.
An application developer accidentally uploaded a company’s code-signing certificate private key to a public web server. The company is concerned about the malicious use of its certificate. Which of the following should the company do FIRST?
Revoke the code-signing certificate
An organization implemented a process that compares the settings currently configured on systems against secure configuration guidelines in order to identify any gaps. Which of the following control types has the organization implemented?
Detective
The Chief Information Security Officer directed a risk reduction in shadow IT and created a policy requiring all unsanctioned high-risks SaaS applications to be blocked from user access. Which of the following is the BEST security solution to reduce the risk?
CASB - Cloud access security brokers (CASBs) are on-premises, or cloud-based security policy enforcement points, placed between cloud service consumers and cloud service providers to combine and interject enterprise security policies as the cloud-based resources are accessed.
A technician enables full disk encryption on a laptop that will be taken on a business trip. Which of the following does this process BEST protect?
Data at rest - is data that has reached a destination and is not being accessed or used. It typically refers to stored data and excludes data that is moving across a network or is temporarily in computer memory waiting to be read or updated.
A security analyst was called to investigate a file received directly from a hardware manufacturer. The analyst is trying to determine whether the file was modified in transit before installation on the user’s computer. Which of the following can be used to safely assess the file?
Check the hash of the installation file
A help desk technician receives a phone call from someone claiming to be a part of the organization’s cybersecurity incident response team. The caller asks the technician to verify the network’s internal firewall IP address. Which of the following is the technician’s BEST course of action?
Write down the phone number of the caller if possible, the name of the person requesting the information, hang up, and notify the organization’s cybersecurity officer.
Which of the following would BEST provide detective and corrective controls for thermal regulation?
An HVAC system - In computing and especially in enterprise data centers, HVAC systems control the ambient environment (temperature, humidity, air flow and air filtering) and must be planned for and operated along with other data center components such as computing hardware, cabling, data storage, fire protection, physical security
Which of the following is a benefit of including a risk management framework into an organization’s security approach?
It incorporates control, development, policy, and management activities into IT operations.
An organization maintains several environments in which patches are developed and tested before being deployed to an operational status. Which of the following is the environment in which patches will be deployed just prior to being put into an operational status?
Production
During a trial, a judge determined evidence gathered from a hard drive was not admissible. Which of the following BEST explains this reasoning?
The hard drive was not properly kept in an antistatic bag when it was moved.
An organization wants to implement a biometric system with the highest likelihood that an unauthorized users will be denied access. Which of the following should the organization use to compare biometric solutions?
FAR - False Acceptance Rate (FAR): the percentage of identification instances in which unauthorised persons are incorrectly accepted. False Rejection Rate (FRR): the percentage of identification instances in which authorised persons are incorrectly rejected.
A company recently experienced a significant data loss when proprietary information was leaked to a competitor. The company took special precautions by using proper labels’ however, email filter logs do not have any record of the incident. An investigation confirmed the corporate network was not breached, but documents were downloaded from an employee’s COPE tablet and passed to the competitor via cloud storage. Which of the following is the BEST remediation for this data leak?
DLP - DLP, or Data Loss Prevention, is a cybersecurity solution that detects and prevents data breaches. Since it blocks extraction of sensitive data, organizations use it for internal security and regulatory compliance.
An attacker was eavesdropping on a user who was shopping online. The attacker was able to spoof the IP address associated with the shopping site. Later, the user received an email regarding the credit card statement with unusual purchases. Which of the following attacks took place?
Domain hijacking - Domain Hijacking or Domain Spoofing is an attack where an organization’s web address is stolen by another party. The other party changes the enrollment of another’s domain name without the consent of its legitimate owner. This denies true owner administrative access.
A company is considering transitioning to the cloud. The company employs individuals from various locations around the world. The company does not want to increase its on premises infrastructure blueprint and only wants to pay for additional compute power required. Which of the following solutions would BEST meet the needs of the company?
Hybrid environment
After multiple on premises security solutions were migrated to the cloud, the incident response time increased. The analyst are spending a long time trying to trace information on different cloud consoles and correlating data in different formats. Which of the following can be used to optimize the incident response time?
CASB - Cloud access security brokers (CASBs) are on-premises, or cloud-based security policy enforcement points, placed between cloud service consumers and cloud service providers to combine and interject enterprise security policies as the cloud-based resources are accessed.
Which of the following control types would be BEST to use in an accounting department to reduce losses from fraudulent transactions?
Detective
A company is receiving emails with links to phishing sites that look very similar to the company’s own website address and content. Which of the following is the BEST way for the company to mitigate this attack?
Generate a list of domains similar to the company’s own and implement a DNS sinkhole for each. DNS Sinkholing is a mechanism aimed at protecting users by intercepting DNS request attempting to connect to known malicious or unwanted domains and returning a false, or rather controlled IP address. The controlled IP address points to a sinkhole server defined by the DNS sinkhole administrator.
A SOC operator is receiving continuous alerts from multiple Linux systems indicating that unsuccessful SSH attempts to a functional user ID have been attempted on each one of them in a short period of time. Which of the following BEST explains this behavior?
Password spraying - is a type of brute force attack where a malicious actor attempts the same password on many accounts before moving on to another one and repeating the process. This is effective because many users use simple, predictable passwords, such as “password123.”
SOC - Security Operation Center
A tax organization is working on a solution to validate the online submission of documents. The solution should be carried on a portable USB device that should be inserted on any computer that is transmitting a transaction securely. Which of the following is the BEST certificate for these requirements?
Root certificate - is the starting point of a chain of trust upon which an SSL certificate is issued. The root certificate belongs to the Certificate Authority. The root certificate is used to issue intermediate certificates, that in term make it possible to register SSL certificates for end users.
A routine audit of medical billing claims revealed that several claims were submitted without the subscriber’s knowledge. A review of the audit logs for the medical billing company’s system indicated a company employee downloaded customer records and adjusted the direct deposit information to a personal bank account. Which of the following does this action describe?
Insider threat
A recent audit cited a risk involving numerous low-criticality vulnerabilities created by a web application using a third-party library. The development staff state there are still customers using the application even though it is end of life and it would be substantial burden to update the application for the compatibility with more secure libraries. Which of the following would be the MOST prudent course of action?
Use containerization to segment the application from other applications to eliminate the risk
A security analyst is evaluating solutions to deploy an additional layer of protecting for a web application. The goal is to allow only encrypted communications without relying on network devices. Which of the following can be implemented?
SRTP - Secure Real-time Transport Protocol. An extension of Real-time Transport Protocol (RTP) that features enhanced security measures. The protocol provides encryption, confidentiality, message authentication, and replay protection to your transmitted audio and video traffic.
A company labeled some documents with the public sensitivity classification. This means the documents can be accessed by:
only the company’s employees and those listed in the document
Which of the following is the MOST relevant security check to be performed before embedding third-party libraries in developed code?
Assess existing vulnerabilities affecting the third-party code and the remediation efficiency of the libraries’ developers.
A help desk technician receives an email from the Chief Information Officer (CIO) asking for documents. The technician knows the CIO is on vacation for a few weeks. Which of the following should the technician do to validate the authenticity of the email?
Look at the metadata in the email header and verify the “From:? line matches the CIO’s email address.
A company needs to validate its updated incident response plan using a real-work scenario that will test decision points and relevant incident response actions without interrupting daily operations. Which of the following would BESt meet the company’s requirements?
Tabletop exercise - (TTX): A security incident preparedness activity, taking participants through the process of dealing with a simulated incident scenario and providing hands-on training for participants that can then highlight flaws in incident response planning.
A security policy states that common words should not be used as passwords. A security auditor was able to perform a dictionary attack against corporate credentials. Which of the following controls was being violated?
Password reuse - is a person’s tendency to use the same password across different online services. People reuse passwords in response to the poor usability of passwords.
A security incident has been resolved. Which of the following BEST describes the importance of the final phase of the incident response plan?
It examines and documents how well the team responded, discovers what caused the incident, and determines how the incident can be avoided in the future.
Which of the following is a cryptographic concept that operations on a fixed length of bits?
Block cipher is a method of encrypting data in blocks to produce ciphertext using a cryptographic key and algorithm. The block cipher processes fixed-size blocks simultaneously, as opposed to a stream cipher, which encrypts data one bit at a time.
Security analyst are conducting an investigation of an attack that occurred inside the organization’s network. An attacker was able to collect network traffic between workstations throughout the network. The layer 2 address table has hundreds of entries to the ones abvove
ARP poisoning - ARP spoofing, ARP cache poisoning, or ARP poison routing, is a technique by which an attacker sends Address Resolution Protocol messages onto a local area network.
Command injection and directory traversal attempts.
Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Directory traversal (path traversal) happens when the attacker is able to read files on the web server outside of the directory of the website.
A large bank with two geographically dispersed data centers is concerned about major power disruptions at both locations. Every day location experiences very brief outages that last a few seconds. However, during the summer a high risk of intentional brownouts that last up to an hour exists, particularly at one of the locations near an industrial smelter. Which of the following is the BEST solution to reduce the risk of data loss?
UPS - Uninterruptible Power Supply
A UPS is, essentially, a battery backup that supplies power to your system in order to provide enough time to properly power down your equipment when there is a failure in utility power. You may have a facility that already has a UPS (Uninterruptible Power Supply) or even a generator.
Which o the following would be the BEST way to analyze diskless malware that has infected a VDI?
Take a memory snapshot of the running system.
Users are presented with a banner upon each login to a workstation. The banner mentions that users are not entitled to any reasonable expectation of privacy and access is for authorized personnel only. In order to proceed past that banner, users must click the OK button. Which of the following is this an example of?
AUP - acceptable use policy
(AUP) is a document stipulating constraints and practices that a user must agree to for access to a corporate network, the internet or other resources.
The Chief Information Security Officer is concerned about employees using personal email rather than company email to communicate with clients and sending sensitive business information and PII. Which of the following would be the BEST solution to install on the employees’ workstations to prevent information from leaving the company’s network?
DLP - Data Loss Prevention
a cybersecurity solution that detects and prevents data breaches. Since it blocks extraction of sensitive data, organizations use it for internal security and regulatory compliance.
On the way into a secure building, an unknown individual strikes up a conversation with an employee. The employee scans the required badge at the door while the unknown individual holds the door open, seemingly out of courtesy, for the employee. Which of the following social engineering techniques is being utilized?
Tailgating - where an attacker follows an unaware user to gain access to an area without authorization.
Two hospitals merged into a single organization. The privacy officer required a review of all records to ensure encryption was used during record storage, in compliance with regulations. During the review, the officer discovered that medical diagnosis codes and patient names were left unsecured. Which of the following types of data does this combination BEST represent?
PII - Personally identifiable information
A company discovered that terabytes of data have been exfiltrated over the past year after an employee clicked on an email link. The threat continued to evolve and remain undetected until a security analyst noticed an abnormal amount of external connections when the employee was not working. Which of the following is the MOST likely threat actor?
Insider threat - rogue employees and contractors leaking confidential data or misusing their access to systems for personal gain and/or to inflict damage and disruption.
An untrusted SSL certificate was discovered during the most recent vulnerability scan. A security analyst determines the certificate is signed properly and is a valid wildcard. The same certificate is installed on the other company servers without issue. Which of the following is the MOST likely reason for this finding?
The scanner is incorrectly configured to not trust this certificate when detected on the server.
A company wants to improve end users’ experiences when they log in to a trusted partner website. The company does not want the users to be issued separate credentials for the partner website. Which of the following should be implemented to allow users to authenticate using their own credentials to log in to the trusted partner’s website.
Federation - A process that allows for the conveyance of identity and authentication information across a set of networked systems. Sources: FIPS 201-3 under Federation.
A company is under investigation for possible fraud. As part of the investigation, the authorities need to review all emails and ensure data is not deleted. Which of the following should the company implement to assist in the investigation?
Legal hold - A legal hold (also known as a litigation hold) is a notification sent from an organization’s legal team to employees instructing them not to delete electronically stored information (ESI) or discard paper documents that may be relevant to a new or imminent legal case.
A user wanted to catch up on some work over the weekend but had issues logging into the corporate networking using a VPN. On Monday, the user opened a ticket for this issue but was able to log in successfully. Which of the following BEST describes the policy that is being implemented?
Geofencing - allow a user to set up triggers so that when a device such as an internet-connected smartphone enters a defined geographical boundary, the user gets an alert.
A major political party experienced a server breach. The hacker then publicly posted stolen internal communications concerning campaign strategies to give the opposition party an advantage. Which of the following BEST describes these threat actors?
(APT) Advanced persistent threats - is a well-resourced adversary engaged in sophisticated malicious cyber activity that is targeted and aimed at prolonged network/system intrusion.
A company is required to continue using legacy software to support a critical service. Which of the following BEST explains a risk of this practice?
Lack of vendor support
A security analyst has been tasked with ensuring all programs that are deployed into the enterprise have been assessed in a runtime environment. Any critical issues found in the program must be sent back to the developer for verification and remediation. Which of the following BEST describes the type of assessment taking place?
Dynamic code analysis - Dynamic Application Security Testing (DAST) – is designed to test a running application for potentially exploitable vulnerabilities.
Which of the following can work as an authentication method and as an alerting mechanism for unauthorized access attempts?
HMAC-based, one-time password - Hash-based message authentication code (or HMAC) is a cryptographic authentication technique that uses a hash function and a secret key
A company has a flat network in the cloud. The company needs to implement a solution to segment its production and non-production servers without migrating servers to a new network. Which of the following solutions should the company implement?
VLAN segmentation - Networks are typically segmented with VLANs or subnets. VLANs create smaller network segments that connect hosts virtually. Subnets use IP addresses to segment the network, connected by networking devices.
The president of a regional bank likes to frequently provide SOC tours to potential investors. Which of the following policies BEST reduces the risk of malicious activity occurring after a tour?
Access control - a data security process that enables organizations to manage who is authorized to access corporate data and resources.
A Chief Information Security Officer has defined resiliency requirements for a new data center architecture. The requirements are as follows:
-Critical file shares will remain accessible during and after a natural disaster.
-Five percent of hard disks can fail at any given time without impacting the data.
-Systems will be forced to shut down gracefully when battery levels are below 20%.
Which of the following are required to BEST meet these objectives? ( choose 3)
RAID - (redundant array of independent disks) is a way of storing the same data in different places on multiple hard disks or solid-state drives (SSDs) to protect data in the case of a drive failure.
UPS - Uninterruptible Power Supply - A device with an internal battery that allows connected devices to run for at least a short time when the primary power source is lost.
Redundant power supplies - also known as dual power supplies, are essential for network infrastructure as they minimize the risk of power failure and help maintain uptime.
Which of the following is a security best practice that ensures the integrity of aggregated log files within a SIEM?
Write protect the aggregated log files and move them to an isolated server with limited access.
SIEM - Security information and event management - is a solution that helps organizations detect, analyze, and respond to security threats before they harm business operations.
A security analyst is evaluating the risks of authorizing multiple security solutions to collect data from the company’s cloud environment. Which of the following is an immediate consequence of these integrations?
Increase in the attack surface
Which of the following explains why RTO is included in a BIA?
It informs the backup approach so that the organization can recover data to a known time.
RTO - Recovery time objective - the maximum tolerable length of time that a computer, system, network or application can be down after a failure or disaster occurs.
BIA - Business impact analysis - provides invaluable insight into which assets are critical for core operations and how disruptions can be avoided
A security analyst is reviewing the vulnerability scan report for a web server following an incident. The vulnerability that was used to exploit the server is present in historical vulnerability scan reports, and a patch is available for the vulnerability. which is the following is the MOST likely cause?
The scan reported a false negative for the vulnerability.
False neg - problems aren’t picked up even though there are bugs or vulnerabilities in the application being tested.
False pos - security alerts incorrectly categorized as suggesting a threat when there is none.
Which of the following is a known security risk associated with data archives that contain financial information?
Data can become a liability if archived longer than required by regulatory guidance.
Which of the following BEST describes the process of documenting who has access to evidence?
chain of custody - A process that tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle by documenting each person who handled the evidence, the date/time it was collected or transferred, and the purpose for the transfer.
A systems engineer wants to leverage a cloud-based architecture with low latency between network-connected devices that also reduces the bandwidth that is required by performing analytics directly on the endpoints. Which of the following would BEST meet the requirements? (choose 2)
-IaaS - Infrastructure as a Service (IaaS) is a cloud computing model in which a third-party cloud service provider (CSP) offers virtualized compute resources such as servers, data storage and network equipment on demand over the internet to clients.
-Fog computing - a decentralized computing infrastructure in which data, compute, storage and applications are located somewhere between the data source and the cloud
Which of the following is a policy that provides a greater depth and breadth of knowledge across an organization?
Job rotation policy
A company is moving its retail website to a public cloud provider. The company wants to tokenize credit card data but not allow the cloud provider to see the credit card information. Which of the following would BEST meet these objectives?
TLS - Transport Layer Security, or TLS, is a widely adopted security protocol designed to facilitate privacy and data security for communications over the Internet.
A security analyst is tasked with defining the “something you are” factor of the company’s MFA settings. Which of the following BEST to use to complete the configuration?
(HOTP) HMAC-based, one-time password is an event-based OTP where the moving factor in each code is based on a counter.
Which of the following processes will eliminate data using a method that will allow the storage device to be reused after the process is complete?
Overwriting - a process where new data is written over the existing data in the same physical space, making the original data inaccessible.
A web server has been compromised due to ransomware attack. Further investigation reveals the ransomware has been in the servers for the past 72 hours. The systems administrator needs to get the services back up as soon as possible. Which of the following should the administrator use to restore services to secure state?
The last incremental backup that was conducted 72 hours ago.
A network engineer created two subnets that will be used for production and development servers. Per security policy production and development servers must each have a dedicated network that cannot communicate with one another directly. Which of the following should be deployed so that server administrators can access these devices?
Jump servers - is a hardened and monitored device that spans two dissimilar security zones and provides a controlled means of access between them.
A social media company based in North America is looking to expand into new, global markets and needs to maintain compliance with international standards. Which of the following is the company’s data protection officer MOST likely concerned?
General Data Protection Regulation (GDPR) - requires that personal data must be processed securely using appropriate technical and organisational measures.
A security architect is required to deploy to conference rooms some workstations that will allow sensitive data to be displayed on large screens. due to the nature of the data, it cannot be stored in the conference rooms. The file share is located in a local data center. Which of the following should the security architect recommend to BEST meet the requirements?
VDI and thin clients - a computer that uses resources housed inside a central server as opposed to a hard drive.
A Chief Security Officer wants to ensure the organization is validating and checking the integrity of zone transfers. Which of the following solutions should be implemented?
DNSSEC - a suite of extensions that improve Domain Name System (DNS) security by verifying that DNS results have not been tampered with.
Which of the following controls is used to make an organization initially aware of a data compromise?
Detective
An annual information security assessment has revealed that several OS-level configurations are not in compliance due to outdated hardening standards the company is using. Which of the following would BEST to use to update and reconfigure the OS-level security configurations?
CIS benchmarks - Center for Internet Security (CIS) are a set of globally recognized and consensus-driven best practices to help security practitioners implement and manage their cybersecurity defenses.
A company acquired several other small companies. The company that acquired the others in transitioning network servers to the cloud. The company wants to make sure that performance and security remain intact. Which of the following BEST meets both requirements?
Segmentation - to strengthen security, network segmentation is a physical or virtual architectural approach dividing a network into multiple segments, each acting as its own subnetwork providing additional security and control.
After a recent external audit, the compliance team provided a list of several non-compliant, in-scope hosts that were not encrypting cardholder data at rest. Which of the following compliance frameworks would address the compliance team’s greatest concern?
PCI DSS - The Payment Card Industry (PCI) Data Security Standard (DSS) is an information security standard developed to enhance cardholder data security for organizations that store, process or transmit credit card data.
A security analyst is receiving several alerts per user and is trying to determine if various logins are malicious. The security analyst would like to create a baseline of normal operations and reduce noise. Which of the following actions should the security analyst perform?
Adjust the sensitivity levels of the SIEM correlation engine.
SIEM correlation engine - compares sequences of activity based on a set of rules.
Which of the following is the MOST effective way to detect security flaws present on third-party libraries embedded on software before it is released to production?
Implement a vulnerability scan to assess dependencies earlier on SDLC
Which of the following prevents an employee from seeing a colleague who is visiting an inappropriate website?
AUP - acceptable use policy (AUP) is a business agreement between a computer resource user and the computer resource owner or administrator that addresses all of the rights, privileges, and rules that users must adhere to when using computer resources.
A user reports falling for a phishing email to an analyst. Which of the following system logs would the analyst check first?
Authentication
An attacker has determined the best way to impact operations is to infiltrate third-party software vendors. Which of the following vectors is being exploited?
Supply chain
An organization would like to give remote workers the ability to use applications hosted inside the corporate network. Users will be allowed to use their personal computers, or they will be provided organization assets. Either way, no data or applications will be installed locally on any user systems. Which of the following mobile solutions would accomplish these goals?
VDI
Which of the following is used to ensure that evidence is legal proceedings when it is collected and provided to the authorities?
Chain of custody - the sequential documentation or trail that accounts for the sequence of custody, control, transfer, analysis, and disposition of physical or electronic evidence.
The Chief Information Security Officer (CISO) of a bank recently updated the incident response policy. The CISO is concerned that members of the incident response team do not understand their roles. The bank wants to test the policy but with the least amount of resources or impact. Which of the following BEST meets the requirements?
Tabletop walk-through - simulations of real-world attacks that are designed to test the organization’s ability to respond to a cybersecurity incident. This exercise is a practice for responding to cyber incidents, with hypothetical cyber attacks launched at the organization.
Which of the following control types fixes a previously identified and mitigates a risk?
Corrective - minimize damage, facilitate recovery, and repair weaknesses so a similar attack doesn’t happen again.
An analyst is reviewing logs associated with an attack. The logs indicate an attacker downloaded a malicious file that was quarantined by the AV solution. The attacker utilized a local non-administrative account to restore the malicious file to a new location. The file was then used by another process to execute a payload. Which of the following attacks did the analyst observe?
Privilege escalation - a technique where a cyber attacker compromises a system to gain unauthorized access.
A security engineer must deploy two wireless routers in an office suite. Other tenants in the office building should not be able to connect to this wireless network. Which of the following protocols should the engineer implement to ensure the STRONGEST encryption?
WPA2
An attacker browses a company’s online job board attempting to find any relevant information regarding the technologies the company uses. Which of the following BEST describes this social engineering technique?
Reconnaissance - information-gathering stage of ethical hacking, where you collect data about the target system.
During an incident response process involving a laptop, a host was identified as the entry point for malware. The management team would like to have the laptop restored and given back to the user. The cybersecurity analyst would like to continue investigating the intrusion on the host. Which of the following would allow the analyst to continue the investigation and also return the laptop to the user as soon as possible?
tcpdump - a packet analyzer that is launched from the command line. It can be used to analyze network traffic by intercepting and displaying packets that are being created or received by the computer it’s running on.
An analyst is trying to identify insecure services that are running on the internal network. After performing a port scan, the analyst identifies that a server has some insecure services enabled on default ports. Which of the following BEST describes the services that are currently running and the secure alternatives for replacing them? (Choose 3)
HTTP, HTTPS, Telnet, SSH, TLS, SSL
A security analyst needs to produce a document that details how a security incident occurred, the steps that were taken for recovery, and how future incidents can be avoided. During which of the following stages of the response process will this activity take place?
Lesson learned
An administrator is configuring a firewall rule set for a subnet to only access DHCP, web pages, and SFTP, and to specifically block FTP. Which of the following would BEST accomplish this goal?
Deny: ANY ANY 67
While investigating a recent security incident, a security analyst decides to view all network connections on a particular server. Which of the following would provide the desired information?
netstat - a tool aimed at real-time network-based in- trusion detection.
A company recently decided to allow its employees to use their personally owned devices for tasks like checking email and messaging via mobile applications. The company would like to use MDM, but employees are concerned about the loss of personal data. Which of the following should the IT department implement to BEST protect the company against company data loss while still addressing the employee’s concerns?
Configure the MDM software to enforce the use of PINs to access the phone.
The concept of connecting a user account across the systems of multiple enterprises is BEST known as:
sing sign-on
A user received an SMS on a mobile phone that asked for bank details. Which of the following social-engineering techniques was used in this case?
Smishing - a combination of “SMS” and “phishing.” In a smishing attack, cybercriminals send deceptive text messages to lure victims into sharing personal or financial information, clicking on malicious links, or downloading harmful software or applications.
A company is working on a mobile device security after a report revealed that users granted non-verified software access to corporate data. Which of the following is the MOST effective security control to mitigate this risk?
Update the BYOD policy
A security analyst needs to implement security features across smartphones, laptops, and tablets. Which of the following would be the MOST effective heterogeneous platforms?
Applying MDM software
MDM - Mobile device management generates a centralized plan for managing multiple device types with varying operating systems such as iOS, Windows, Android, tvOS, Chrome OS, and macOS. Centralized management makes it easier to deploy MDM solutions in the cloud.
The new Chief Information Security Officer (CISO) at a company has asked the security team to implement stronger user account policies. The new policies require:
-Users to choose a pw unique to their last ten passwords
-Users to not log in from certain high-risk countries
Which of the following should the security team implement? (Choose 2)
Password history
Geolocation - is actually the position of a user’s device, whether that’s a home computer, laptop, smartphone, or fitness tracker. There are multiple ways for a device to determine its own position in the world, ranging from the most precise (GPS) to the least precise (IP-based geolocation).
Which of the following is MOST likely to outline the roles and responsibilities of data controllers and data processors?
GDPR - General Data Protection Regulation - requires that personal data must be processed securely using appropriate technical and organisational measures. The Regulation does not mandate a specific set of cyber security measures but rather expects you to take ‘appropriate’ action.
Which of the following is MOST likely to contain ranked and ordered information on the likelihood and potential impact of catastrophic events that may affect business processes and systems, while also highlighting the residual risks that need to be managed after mitigating controls have been implemented?
A risk register - is a log that lists all the potential risks that could impact your organization and how you plan to respond.
A worldwide manufacturing company has been experiencing email account compromises. In one incident, a user logged in from the corporate office in France, but then seconds later, the same user account attempted to login from Brazil. Which of the following account policies would BEST prevent this type of attack?
Geofencing - creates virtual boundaries in real-world geographical areas and can be drawn in a wide variety of shapes and sizes.
Which of the following TCP ports should be blocked for all external inbound connections to the perimeter network as a workaround to protect the servers? (choose 2)
port 135, 445
135 - RPC client-server communication
445 - are used for authentication and file sharing.
A recent phishing campaign resulted in several compromised user accounts. The security incident response team has been tasked with reducing the manual labor of filtering through all the phishing emails as they arrive and blocking the sender’s email address, along with other time-consuming mitigation actions. Which of the following can be configured to streamline those tasks?
SOAR playbook - Security Orchestration, Automation, and Response. It is a collection of integrated tools that enable automation and orchestration of various cybersecurity tasks. A playbook, on the other hand, is a component of SOAR which automates specific workflows or tasks within the security operations framework.
A chief Information Security Officer has defined resiliency requirements for a new data center architecture. The requirements are as follows:
- Critical file shares will remain accessible during and after a natural disaster
- Five percent of hard disk can fail at any given time without impacting the data
-Five percent of hard disk can fail at any given time without impacting the data- Systems will be forced to shut down gracefully when battery levels are below 20%.
Which of the following are required to best meet these objectives? Choose 3.
RAID - a way of storing the same data in different places on multiple hard disks or solid-state drives (SSDs) to protect data in the case of a drive failure.
UPS - Uninterruptible Power Supply - A device with an internal battery that allows connected devices to run for at least a short time when the primary power source is lost.
Redundant power supplies - also known as dual power supplies, are essential for network infrastructure as they minimize the risk of power failure and help maintain uptime.
Which of the following is a security best practice that ensures the integrity of aggregated log files within the SIEM?
Right protect the aggregated log files and move them to an isolated server with limited access.
SIEM - Security Information and event management.
Security analyst is evaluating the risk of authorizing multiple security solutions to collect data from the company’s cloud environment. Which of the following is an immediate consequence of these integrations?
Increase in the attack surface
Which of the following explains why RTO is included in a BIA?
It informs the backup approach so that the organization can recover data to a known time.
RTO - recovery time objective (RTO) is the maximum tolerable length of time that a computer, system, network or application can be down after a failure or disaster occurs.
BIA - Business Impact Analysis - process that assesses the security risks associated with potential system breakdowns and identifies resiliency strategies that ensure business continuity during an incident or natural disaster.
Which of the following concepts best describes tracking and documenting changes to software managing access to files and systems?
version control - keeps track of every modification to the code in a special kind of database.
A penetration tester is brought on site to conduct a full attack simulation at a hospital. the penetration tester notices WAP that is hanging from the drop ceiling by its cabling and is reachable. Which of the following recommendations would the penetration tester most likely make given this observation?
Secure the access point and cabling inside the drop ceiling.
WAP - Wireless Application Protocol - A standard that defines the way in which Internet communications and other advanced services are provided on wireless mobile devices.
Which of the following techniques eliminates the use of rainbow tables for password cracking?
Salting - a concept that typically pertains to password hashing. Essentially, it’s a unique value that can be added to the end of the password to create a different hash value. This adds a layer of security to the hashing process, specifically against brute force attacks.
Rainbow Table - a precomputed table that contains the password hash value for each plain text character used during the authentication process.
During a security assessment, a security analyst finds a file with overly permissive permissions. Which of the following tools will allow the analysts to reduce the permissions for the existing users and groups and remove the set-user-ID bit from the file?
chmod - or change mode, command allows an administrator to set or modify a file’s permissions.
The security analyst is revealing the vulnerability scan report for a Web Server falling in incident. The vulnerability that was used to exploit the server is present in historical vulnerability scan reports, and a patch is also available for the vulnerability. Which of the following is most likely the cause?
The scam reported a false negative for the vulnerability.
False Negative - false alarm.
Which of the following is a known security risk associated with data archives that contain financial information?
Data can become a liability of archive longer than required by regulatory guidance. A false negative state is the most serious and dangerous state. This is when the IDS identifies an activity as acceptable when the activity is actually an attack.
Which of the following is a known security risk associated with data archives that contain financial information?
Data can become a liability if archived longer than required by regulatory guidance.
Which of the following BEST describes the process of documenting who has access to evidence?
Chain of custody - A process that tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle by documenting each person who handled the evidence, the date/time it was collected or transferred, and the purpose for the transfer.
A systems engineer wants to leverage a cloud based architecture with low latency between network connected devices that also reduce the bandwidth that is required by performing analytics directly on the endpoints. which of the following would best meet the requirements choose 2
IaaS - Infrastructure-as-a-Service (IaaS) enables enterprises to lease or rent servers to use for storage and computation in the cloud.
Fog computing - a form of distributed computing that brings computation and data storage closer to the network edge, where many IoT devices are located.
Which of the following is a policy that provides a greater depth and breadth of knowledge across an organization
Job rotation policy - ob rotation serves two functions. First, it provides a type of knowledge redundancy. Second, moving personnel around reduces the risk of fraud, data modification, theft, sabotage, and misuse of information.
The company is moving its retail website to a public cloud provider. The company wants to tokenize credit card data, but not allow the cloud provider to see the credit card information. what is the following would be best meet these objectives
TLS - Transport Layer Security - a widely adopted security protocol designed to facilitate privacy and data security for communications over the Internet.
Can an administrator assist legal in compliance team with ensuring information about customer transactions is archived for the proper time. Which of the following data policies is the administrator carrying out?
Retention - refers to the regular archiving of event logs, particularly those significant to cyber security.
The company is moving its retail website to a public cloud provider. The company wants to tokenize credit card data, but not allow the cloud provider to see the store credit card information. Which of the following would best meet these objectives?
TLS - Transport Layer Security, or TLS, is a widely adopted security protocol designed to facilitate privacy and data security for communications over the Internet. A primary use case of TLS is encrypting the communication between web applications and servers, such as web browsers loading a website.
A security analyst is tasked with defining the “something you are” factor the companies MFA settings. Which of the following is best to use to complete the configuration?
HMAC-based, one-time password
Hash-based message authentication code (or HMAC) is a cryptographic authentication technique that uses a hash function and a secret key.
MFA - Multi Factor Authentication -
Which of the following processes will eliminate data using a method that will allow the storage device to be reused after the process is complete?
Overwriting - a process where new data is written over the existing data in the same physical space, making the original data inaccessible. On the other hand, when data is deleted, it’s removed from the file system, but the actual data may still exist on the storage device until it’s overwritten by new data.
A Web Server has been compromised due to a ransomware attack. Further investigation reveals the ransomware has been in the server for the past 72 hours. The system administrator needs to get the service back up as soon as possible. Which of the following should the administrator use to restore services to a secure state?
The last incremental backup that was conducted seventy two hours ago
A network engineer created two subnets that will be used for production and development servers. Per security policy, production and development servers, much each have a dedicated network that cannot communicate with one another directly. Which of the following should be deployed so that the server administrators can access these devices?
Jump servers - refers to a secure computer that spans two or more networks, allowing users to connect to it from one network, and then “jump“ to another network. It’s also known as a jump host or a jump box.
NOT VLAN - Network segmentation with virtual local area networks (VLANs) creates a collection of isolated networks within the data center. Each network is a separate broadcast domain. When properly configured, VLAN segmentation severely hinders access to system attack surfaces.
A Chief Information Security officer (CISO) wants to ensure the organization is validating and checking the integrity of zone transfers. Which of the following solutions would be implemented?
DNSSEC - is a suite of extensions that improve Domain Name System (DNS) security by verifying that DNS results have not been tampered with. Enterprises can use DNSSEC to improve their DNS security. DNS technology wasn’t designed with security in mind. One example of an attack on DNS infrastructure is DNS spoofing.
DNS - Domain Name System
A security architect is required to deploy to conference rooms, some workstations that will allow sensitive data to be displayed on large screens. Due to the nature of the data, it cannot be stored in the conference rooms. The file share is located in a local data center. Which of the following should the security analysts recommend to best meet the requirement?
VDI and thin clients
VDI - Virtual Desktop Infrastructure
thin clients - is a computer that uses resources housed inside a central server as opposed to a hard drive. A thin client connects to a server-based environment that hosts the majority of applications, memory, and sensitive data the user needs.
Which of the following controls is used to make an organization initially aware of a data compromise?
Detective - A cybercrime investigator is responsible for investigating and analyzing cybercrime incidents, such as hacking, identity theft, fraud, and other types of cyber-related crimes. Their primary goal is to identify the culprits and gather evidence that can be used to prosecute them in court.
An annual information security assessment has revealed that several OS-level configurations are not in compliance due to outdated hardening standards the company is using. Which of the following would best to use to update and reconfigure the OS-level security configurations?
CIS benchmarks - The Center for Internet Security (CIS) publishes the CIS Critical Security Controls (CSC) to help organizations better defend against known attacks by distilling key security concepts into actionable controls to achieve greater overall cybersecurity defense.
CIS - Center for Internet Security
A company acquired several other small companies. The company that acquired the others is transitioning network services to the cloud. The company wants to make sure that performance and security remain intact. Which of the following best meets both requirements?
Segmentation - Network segmentation is a network security technique that divides a network into smaller, distinct sub-networks that enable network teams to compartmentalize the sub-networks and deliver unique security controls and services to each sub-network.
After a recent external audit, the compliance team provides a list of several noncompliant, in scope hosts that were not encrypting cardholder of data at rest. Which of the following compliance frameworks would address the compliance teams greatest concern?
PCI DSS - The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards formed in 2004 by Visa, MasterCard, Discover Financial Services, JCB International and American Express.
A security analyst is receiving several alerts per user and is trying to determine if various logins are malicious. The security analyst would like to create a baseline of normal operations and reduce noise. Which of the following actions should the security analyst perform?
Adjust the sensitivity levels of the SIEM correlation engine.
SIEM - Security Information and event management - is a solution that helps organizations detect, analyze, and respond to security threats before they harm business operations.
Which of the following is most effective way to detect security flaws present on third-party libraries embedded on software before it is released into production?
Implement a vulnerability scan to assess dependencies earlier on SDLC.
