SecurityX Practice Exam #4 (Dion)

Question 1

Which of the following layers within software-defined networking determines how to route a data packet on the network?
Management plane
Control layer
Infrastructure layer
Application layer

Answer 1

Control layer

Explanation:
OBJ 2.3: The control layer uses the information from applications to decide how to route a data packet on the network and to make decisions about how traffic should be prioritized, how it should be secured, and where it should be forwarded to. The application layer focuses on the communication resource requests or information about the network. The infrastructure layer contains the physical networking devices that receive information from the control layer about where to move the data and then perform those movements. The management plane is used to monitor traffic conditions, the status of the network, and allows network administrators to oversee the network and gain insight into its operations. For support or reporting issues, include Question ID: 63fe06e43b7322449ddbc716 in your ticket. Thank you.

Question 2

A financial institution is deploying HIPS and HIDS across its endpoints and servers to enhance security. During a simulated attack, the SOC observes that some critical events were missed by HIDS due to insufficient visibility into encrypted network traffic. Which approach would best address this limitation while maintaining proactive protection?

Augment HIDS with HIPS to actively block threats and reduce reliance on event visibility
Configure HIPS to decrypt all network traffic for inspection on endpoints
Implement endpoint detection and response (EDR) solutions to supplement HIDS capabilities
Deploy a centralized SIEM system to analyze logs generated by the HIDS and HIPS

Answer 2

Augment HIDS with HIPS to actively block threats and reduce reliance on event visibility

Explanation:
OBJ 3.2 - While HIDS excels in monitoring and analyzing events for potential threats, it can struggle with visibility into encrypted traffic. Augmenting HIDS with EDR solutions enhances threat detection by analyzing behavioral patterns, memory, and endpoint activities, addressing blind spots like encrypted traffic. Adding HIPS helps with proactive blocking but does not solve the visibility issue. Centralizing logs with a SIEM improves analysis but does not enhance the HIDS detection capabilities. Configuring HIPS to decrypt traffic on endpoints is impractical and introduces risks of exposing sensitive data. For support or reporting issues, include Question ID: 675067683af44d9e9e56c771 in your ticket. Thank you.

Question 3

Which of the following practices best ensures interoperability when designing a system to enhance availability and integrity?

Implementing open standards and cross-platform compatibility
Using vendor-specific integrations to simplify implementation
Standardizing on proprietary protocols for all system components
Prioritizing performance optimization over compatibility testing

Answer 3

Implementing open standards and cross-platform compatibility

Explanation:
OBJ 2.1 - Interoperability ensures that different systems, applications, and devices can work seamlessly together. Using open standards and ensuring cross-platform compatibility support interoperability, which is critical for maintaining system availability and integrity in diverse environments. Proprietary protocols and vendor-specific integrations can limit compatibility and increase lock-in risks. Performance optimization is important but should not override thorough compatibility testing. For support or reporting issues, include Question ID: 674f6205a9b09ba6f669559b in your ticket. Thank you.

Question 4

A cybersecurity analyst is tasked with identifying and mitigating malware threats across the organization’s endpoints. The analyst decides to use YARA for this purpose. Which of the following best describes how YARA helps in detecting malware?
YARA provides a universal framework for converting malware signatures into platform-specific rules
YARA scans network traffic in real-time to block malicious activity before it reaches endpoint systems
YARA allows analysts to create flexible rules based on patterns and characteristics found in malware files
YARA leverages machine learning algorithms to predict future malware variants

Answer 4

YARA allows analysts to create flexible rules based on patterns and characteristics found in malware files

Explanation:
OBJ 4.3 - YARA is a rule-based language used for creating patterns or signatures that help in identifying malware based on specific attributes, such as file contents, strings, or behaviors. It is designed for scanning files and directories to detect known threats. While YARA helps identify malware, it does not provide real-time network traffic analysis, convert rules for specific platforms, or utilize machine learning for predictive analysis. For support or reporting issues, include Question ID: 67508be751d49058ffc6847a in your ticket. Thank you.

Question 5

What is the primary advantage of implementing a Secure Access Service Edge (SASE) framework in a deperimeterized network environment?

It eliminates the need for encryption by providing end-to-end segmentation
It enables secure access to resources regardless of user location or device type
It consolidates network security functions into a centralized on-premises appliance
It restricts access to cloud resources based solely on IP address allowlisting

Answer 5

It enables secure access to resources regardless of user location or device type

Explanation:
OBJ 2.6 - SASE integrates networking and security functions in a cloud-delivered framework, allowing users to securely access resources from any location or device while adhering to Zero Trust principles. It is not tied to centralized on-premises appliances, and encryption remains essential for secure communications. IP address-based access control is insufficient for SASE’s dynamic, identity-based approach. For support or reporting issues, include Question ID: 674f72ad25e0bdcbe9af8fa1 in your ticket. Thank you.

Question 6

During an investigation of a ransomware attack, a cybersecurity team obtains a malicious executable from an infected system. To understand the malware’s behavior, the team breaks down the executable to analyze its code, revealing a routine that encrypts user files and contacts a command-and-control (C2) server for instructions. What reverse engineering technique is being used in this scenario?

Dynamic analysis
Sandboxing
Disassembly
Behavioral analysis

Answer 6

Disassembly

Explanation:
OBJ 4.4: Disassembly involves converting executable code into a human-readable format to understand its logic and functionality, as demonstrated by analyzing the ransomware’s encryption routine and C2 communication. Dynamic analysis observes malware behavior during execution, behavioral analysis focuses on system changes caused by malware, and sandboxing isolates malware in a controlled environment for testing. For support or reporting issues, include Question ID: 6751b98772f8a45d44021760 in your ticket. Thank you.

Question 7

NA

Question 8

An online retailer experiences a sudden surge in traffic, causing its e-commerce platform to become unresponsive. After investigation, the IT team determined that the surge was due to a Distributed Denial of Service (DDoS) attack originating from a botnet targeting the application layer. The team must mitigate the attack while maintaining service availability for legitimate customers. Which of the following measures would most effectively mitigate this type of attack?

Disable access to the platform temporarily to reduce server load
Increase server capacity to handle the additional traffic from the botnet
Block all traffic from affected IP ranges to prevent further disruptions
Deploy rate-limiting rules to control the number of requests per client

Answer 8

Deploy rate-limiting rules to control the number of requests per client

Explanation:
OBJ 3.3 - Rate limiting is effective against application-layer DDoS attacks because it ensures that no single client can overwhelm the server, while legitimate users can still access the service. Temporarily disabling the platform disrupts all users, including legitimate ones. Increasing server capacity may mitigate the effects temporarily but does not address the root cause. Blocking IP ranges can result in overblocking, affecting legitimate users in shared IP spaces. For support or reporting issues, include Question ID: 6750731b3af44d9e9e56c801 in your ticket. Thank you.

Question 9

During an investigation into a suspected malware infection on an employee’s workstation, the security team analyzes the system logs and identifies unusual user account activity, including privilege escalation and unauthorized file access. They also examine installed programs and identify a recently added executable that matches known malware signatures. What type of incident response activity is the team performing?

Host analysis
Network analysis
Volatile memory analysis
Metadata analysis

Answer 9

Host analysis

Explanation:
OBJ 4.4: Host analysis involves examining a specific system for signs of compromise, such as log activity, installed programs, and unauthorized changes. Network analysis focuses on traffic patterns across systems; volatile memory analysis examines data in RAM; and metadata analysis evaluates file attributes like timestamps, not system-level activity. For support or reporting issues, include Question ID: 6751ba8072f8a45d44021798 in your ticket. Thank you.

Question 10

You are reviewing the latest list of important web application security controls published by OWASP. Which of these items is LEAST likely to appear on that list?

Implement identity and authentication controls
Leverage security frameworks and libraries
Obscure web interface locations
Implement appropriate access controls

Answer 10

Obscure web interface locations

Explanation:
OBJ 4.2: The least likely option to appear in the list is to obscure web interface locations. This recommendation is based on security through obscurity and is not considered a good security practice. The other options are all considered best practices in designing web application security controls and creating software assurance in our programs. For support or reporting issues, include Question ID: 63fe06e93b7322449ddbc757 in your ticket. Thank you.

Question 11

During the development of a cloud-based application, the security team integrates automated testing into the CI/CD pipeline. The team aims to detect potential vulnerabilities during runtime. Which type of testing should be implemented in this scenario?

Code linting
Unit testing
DAST
SAST

Answer 11

DAST

Explanation:
OBJ 2.2: Dynamic application security testing (DAST) analyzes an application during runtime to identify vulnerabilities, such as SQL injection and cross-site scripting (XSS). It is particularly effective in detecting issues that only manifest when the application is operational. Static application security testing (SAST) analyzes code before runtime, not during operation. Unit testing evaluates individual components, not runtime vulnerabilities. Code linting checks for coding standard compliance, not security vulnerabilities. For support or reporting issues, include Question ID: 6750fe7423df37e1b5ec5f96 in your ticket. Thank you.

Question 12

An organization implements a secrets management system to secure credentials used by applications. The security team notices that developers occasionally copy secrets from the management tool into their local code for easier testing. What is the most effective way to prevent this behavior?

Enforce a policy prohibiting secrets in code and conduct regular audits
Require developers to use shared credentials stored locally on their devices
Store secrets in plain text in a secure, isolated server
Remove all access to the secrets management tool from developers

Answer 12

Enforce a policy prohibiting secrets in code and conduct regular audits

Explanation:
OBJ 3.1: To maintain secure secrets management, it is critical to enforce policies that prevent developers from embedding secrets in code, as this introduces significant security risks. Regular audits help identify and address such violations. Removing access to secrets management or relying on insecure storage options undermines the purpose of secrets management, while shared credentials increase the risk of exposure and reduce accountability. For support or reporting issues, include Question ID: 67513d076a9dc9d16f2d02f4 in your ticket. Thank you.

Question 13

Which of the following is a primary benefit of implementing load balancing in an enterprise environment?

Enforces access controls to prevent unauthorized tampering and use
Scans the server infrastructure to detect vulnerabilities
Encrypts sensitive data to protect it during transmission throughout the network
Improves performance by distributing traffic across servers

Answer 13

Improves performance by distributing traffic across servers

Explanation:
OBJ 2.1 - Load balancing improves performance and availability by evenly distributing traffic across multiple servers, preventing overload and ensuring system reliability. Encryption, vulnerability detection, and access controls are vital for security but are not functions of load balancing. For support or reporting issues, include Question ID: 674f60fbd737cdb079388f0d in your ticket. Thank you.

Question 14

A company needs to implement stronger authentication by adding an authentication factor to its wireless system. The wireless system only supports WPA with pre-shared keys, but the back-end authentication system supports EAP and TTLS. What should the network administrator implement?

MAC address filtering with IP filtering
802.1x using PAP
PKI with user authentication
WPA2 with a pre-shared key

Answer 14

802.1x using PAP

Explanation:
OBJ 2.4: The network administrator can utilize 802.1x using EAP-TTLS with PAP for authentication since the backend system supports it. Password Authentication Protocol (PAP) is a password-based authentication protocol used by Point to Point Protocol (PPP) to validate users. MAC address filtering does not filter based on IP addresses, but instead, it filters based on the hardware address of a network interface card, known as a MAC address. WPA2 is a secure method of wireless encryption that relies on the use of a pre-shared key or the 802.1x protocol. In the question, though, it states that the system only supports WPA, therefore WPA2 cannot be used. PKI with user authentication would be extremely secure, but it is only used with EAP-TLS, not EAP-TTLS. EAP-TTLS only works with credential-based authentication, such as a username and password. Therefore, 802.1x using PAP is the best answer. For support or reporting issues, include Question ID: 63fe06df3b7322449ddbc6da in your ticket. Thank you.

Question 15

What is a primary risk associated with model inversion attacks on an AI system?

Disruption of the AI’s computational processes
Exposure of sensitive data used during training
Introduction of noise into decision-making outputs
Increased latency in real-time predictions

Answer 15

Exposure of sensitive data used during training

Explanation:
OBJ 1.5: Model inversion attacks attempt to reverse-engineer an AI model to extract sensitive information from its training data. This poses a significant privacy risk, especially when the model is trained on personal or confidential data. Disruption of computational processes is more related to availability attacks, not model inversion. The introduction of noise could result from adversarial input attacks but is not specific to model inversion. Increased latency is unrelated to this type of attack. For support or reporting issues, include Question ID: 674fef1ddb3fddf57c662c75 in your ticket. Thank you.

Question 16

Which of the following classifications would apply to patents, copyrights, and trademarks?
Trade secrets
PHI
PII
Intellectual property

Answer 16

Intellectual property

Explanation:
OBJ 1.1: Patents, copyrights, and trademarks are all considered to be intellectual property. Trade secrets are considered proprietary and are not protected by governments. Personally identifiable information (PII) is any data that could be used to identify a particular person. Protected health information (PHI) is any information about health status, provision of health care, or payment for health care linked to a specific individual. For support or reporting issues, include Question ID: 63fe08103b7322449ddbd5bd in your ticket. Thank you.

Question 17

A penetration tester is emulating an insider threat during an engagement. The penetration tester was given access to a regular user account and a basic Windows 10 client on the network. The penetration tester did not receive any network diagrams, maps, or target IP address. Their goal is to identify any possible Windows domain controllers on the intranet.diontaining.com domain. Which of the following commands should they use from the command prompt to achieve their goal?

nslookup -type=any _ldap._tcp.intranet.diontraining.com
nslookup -type=any _lanman._tcp.intranet.diontraining.com
nslookup -type=any _kerberos._tcp.intranet.diontraining.com
nslookup -type=any _smtp._tcp.intranet.diontraining.com
nslookup -type=any _ntlm._tcp.intranet.diontraining.com

Answer 17

nslookup -type=any _ldap._tcp.intranet.diontraining.com
nslookup -type=any _kerberos._tcp.intranet.diontraining.com

Explanation:
OBJ 4.3: There are several methods for locating Domain Controllers, depending on what you know about the environment you are using. If you are using a Windows client, you can use the nslookup command. You need to specify which protocol you are searching for in the name. Since we are trying to identify domain controllers, we need to look for Kerberos and LDAP-based protocols on the intranet.diontraining.com domain. If you were using a Linux client, you could run a similar command syntax using dig. For support or reporting issues, include Question ID: 63fe07133b7322449ddbc961 in your ticket. Thank you.

Question 18

A new security appliance was installed on a network as part of a managed service deployment. The vendor controls the appliance, and the IT team cannot log in or configure it. The IT team is concerned about the appliance receiving the necessary updates. Which of the following mitigations should be performed to minimize the concern for the appliance and updates?
Scan and patch the device
Configuration management
Automatic updates
Vulnerability scanning

Answer 18

Vulnerability scanning

Explanation:
OBJ 3.6: The best option here is vulnerability scanning as this allows the IT team to know what risks their network is taking on and where subsequent mitigations may be possible. Configuration management, automatic updates, and patching could normally be possible solutions, but these are not viable options without gaining administrative access to the appliance. Therefore, the analyst should continue to conduct vulnerability scanning of the device to understand the risks associated with it and then make recommendations to add additional compensating controls like firewall configurations, adding a WAF, providing segmentation, and other configurations outside the appliance that could minimize the vulnerabilities it presents. For support or reporting issues, include Question ID: 63fe07353b7322449ddbcb01 in your ticket. Thank you.

Question 19

You are a cybersecurity analyst working for an accounting firm that manages the accounting for multiple smaller firms. You have successfully detected an APT operating in your company’s network that appears to have been there for at least 8 months. In conducting a qualitative assessment of the impact, which of the following factors should be most prominently mentioned in your report to your firm’s executives? (SELECT TWO)

Recovery time
Detection time
Economic
Downtime
Data integrity

Answer 19

Economic
Data integrity

Explanation:
OBJ 1.2: While all of the above options should be included in your report to management, due to the nature of your company’s work, the economic impact on the business should be your top factor. This would include any possible liability and damage that will be done to the company’s reputation. Data integrity would be the second most important factor to highlight in your report since an APT may have stolen significant amounts of money by altering your financial documentation and accounts’ data integrity. Downtime, recovery time, and detection time are important for understanding the broader cybersecurity concern and remediation steps but are not going to be the primary concern for your accounting firm’s executives. As a cybersecurity analyst, you often prioritize what will be highlighted to the executives and management. It is important to remember their perspective and priorities, which are usually focused on monetary cost/ROI and the business’s longevity over the technical details an analyst usually focuses on. To be successful in this career field, you need to learn to speak both languages (the technical details when working with the system administrators and the business impact when discussing with management/executives). For support or reporting issues, include Question ID: 63fe081a3b7322449ddbd644 in your ticket. Thank you.

Question 20

Dion Training has just installed a new security patch into their existing practice exam web application. Which of the following tests should be conducted to ensure that all of the previous system functionality still works as expected after installing the patch?

Unit testing
Integration testing
CI/CD
Regression testing

Answer 20

Regression testing

Explanation:
OBJ 2.1: Regression testing is the process of testing an application after changes are made to see if these changes have triggered problems in older areas of code. Continuous integration/continuous delivery (CI/CD) is a software development methodology in which code updates are tested and committed to a development or build server/code repository rapidly. Integration testing is used to test individual components of a system together to ensure that they interact as expected. Unit testing is used to test a particular block of code performs the exact action intended and provides the exact output expected. Normally, unit testing is coded into the software using simply pass/no pass tests for each block of code. For support or reporting issues, include Question ID: 63fe07013b7322449ddbc883 in your ticket. Thank you.

Question 21

NA

Question 22

A penetration tester has issued the following command on a victimized host: nc -l -p 8080 | nc 192.168.1.76 443. What will occur based on this command?

Netcat will listen on port 8080 and output anything received to a remote connection on 192.168.1.76 port 443
Netcat will listen for a connection from 192.168.1.76 on port 443 and output anything received to port 8080
Netcat will listen on port 8080 and then output anything received to local interface 192.168.1.76
Netcat will listen on the 192.168.1.76 interface for 443 seconds on port 8080

Answer 22

Netcat will listen on port 8080 and output anything received to a remote connection on 192.168.1.76 port 443

Explanation:
OBJ 4.1: The proper syntax for netcat (nc) is -l to signify listening and -p to specify the listening port. Then, the | character allows multiple commands to execute during a single command’s execution. Next, netcat sends the data to the given IP (192.168.1.76) over port 443. This is a common technique to bypass the firewall by sending traffic over port 443 (a secure SSL/TLS tunnel). For support or reporting issues, include Question ID: 63fe074c3b7322449ddbcc19 in your ticket. Thank you.

Question 23

An enterprise network requires a firewall configuration to secure a critical web application server hosted in a screened subnet. The web application needs to allow HTTPS traffic from external users while restricting all other types of incoming connections. Additionally, internal administrators need secure SSH access to the server from the corporate LAN. Which of the following firewall rules would best meet the requirements?
Block all incoming traffic to the server and allow only outgoing traffic from the server
Permit incoming HTTPS traffic to the server, restrict other incoming connections, and allow SSH traffic from the LAN to the server
Allow HTTP and HTTPS traffic from external users and permit SSH from the public IP addresses of the administrators
Allow all incoming traffic to the screened subnet and restrict outgoing traffic from the screened subnet

Answer 23

Permit incoming HTTPS traffic to the server, restrict other incoming connections, and allow SSH traffic from the LAN to the server

Explanation:
OBJ 2.1: The scenario involves securing a web application in the DMZ while allowing specific administrative access. “Permitting incoming HTTPS traffic to the server, restricting other incoming connections, and allowing SSH traffic from the LAN to the server” aligns with best practices: Permitting HTTPS ensures the server is accessible for web users securely. Restricting other incoming traffic minimizes attack vectors. Allowing SSH from the LAN provides secure management for administrators. Allowing all incoming traffic to the screened subnet is too permissive and exposes the application to unnecessary risks. Blocking all incoming traffic prevents the web application from serving external users. Allowing HTTP violates security by enabling unsecured communication, and permitting administrator access from public IPs is unsafe. For support or reporting issues, include Question ID: 6750eefbec280b7d2c7fa1c9 in your ticket. Thank you.

Question 24

A non-profit organization uses an identity and access management (IAM) system to control access to sensitive resources. A new employee is unable to access any of the tools needed for their job, even after being added to the correct groups. Which of the following is the most likely cause of the issue?

The IAM system does not support the RBAC required in the scenario
The tools are experiencing an unrelated outage that needs remediation
The employee’s account credentials have expired and need to be configured
The employee’s account has not been assigned a valid IAM policy

Answer 24

The employee’s account has not been assigned a valid IAM policy

Explanation:
OBJ 3.1: In IAM systems, access to resources is governed by policies that define permissions for users and groups. If the employee’s account has not been assigned a valid IAM policy, they will not have the necessary permissions to access tools, even if they are in the correct groups. While credential expiration or service outages could also block access, they would not specifically align with this scenario where group membership is correct but permissions are lacking. IAM systems generally support role-based access control (RBAC), so that is less likely the issue here. For support or reporting issues, include Question ID: 67513d806a9dc9d16f2d02f9 in your ticket. Thank you.

Question 25

An IDS is being implemented in an organization that handles sensitive financial data. The security team has the following goals: Monitor traffic for unauthorized access attempts without disrupting legitimate business processes Identify threats by analyzing patterns of network traffic Generate alerts for detected anomalies and potential attacks Given these requirements, which IDS deployment strategy is most appropriate? Configuring the IDS as a default gateway for all network traffic Out-of-band deployment to passively monitor and alert on suspicious activity Provide inline deployment to block malicious traffic in real-time Your answer is incorrect Combining IDS with endpoint detection tools for proactive blocking

Answer 25

Out-of-band deployment to passively monitor and alert on suspicious activity Explanation: OBJ 2.1: An out-of-band deployment enables the IDS to monitor traffic passively, analyzing patterns and generating alerts without affecting the flow of legitimate business traffic. This setup aligns with the goal of non-intrusive monitoring. Inline deployment is characteristic of an IPS, which actively blocks traffic and does not align with IDS functionality. Configuring the IDS as a gateway is impractical, as it may introduce latency and is more suited to firewalls or proxies. Combining IDS with endpoint tools focuses on active blocking, which goes beyond the traditional scope of IDS. For support or reporting issues, include Question ID: 6750f114ec280b7d2c7fa1d8 in your ticket. Thank you.

Question 26

NA

Question 27

Which of the following authentication protocols was developed by Cisco to provide authentication, authorization, and accounting services? TACACS+ CHAP Kerberos RADIUS

Answer 27

TACACS+ Explanation: OBJ 2.4: TACACS+ is an extension to TACACS (Terminal Access Controller Access Control System) and was developed as a proprietary protocol by Cisco. The Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that operates on port 1812 and provides centralized Authentication, Authorization, and Accounting management for users who connect and use a network service, but Cisco did not develop it. Kerberos is a network authentication protocol designed to provide strong mutual authentication for client/server applications using secret-key cryptography developed by MIT. Challenge-Handshake Authentication Protocol (CHAP) is used to authenticate a user or network host to an authenticating entity. CHAP is an authentication protocol but does not provide authorization or accounting services. For support or reporting issues, include Question ID: 63fe06ee3b7322449ddbc78e in your ticket. Thank you.

Question 28

Dion Consulting group is conducting an initial inventory of their client’s workstations and servers to better understand the attack surface exposed to an external threat actor. What phase of the risk management lifecycle is Dion Training currently operating in? Identify Review Control Assess

Answer 28

Identify Explanation: OBJ 1.2: This is the identify phase. The identify phase is used to inventory assets and for the identification of all risk items in an organization. The assess phase is used to analyze identified risks to determine their associated level of risk before any mitigations or controls are implemented. The control phase is used to identify effective methods for risk reduction for identified risks in an organization. The review phase is used to periodically re-evaluate the risks in an organization by determining if the risk level has changed and identified controls are still effective. For support or reporting issues, include Question ID: 63fe07f03b7322449ddbd432 in your ticket. Thank you.

Question 29

Which of the following will an adversary do during the installation phase of the Lockheed Martin kill chain? (SELECT FOUR) Timestomp a malware file to make it appear as if it is part of the operating system Create a point of presence by adding services, scheduled tasks, or AutoRun keys Install a backdoor/implant on a client victim Open two-way communications channel to an established C2 infrastructure Install a webshell on a server Collect user credentials

Answer 29

Timestomp a malware file to make it appear as if it is part of the operating system Create a point of presence by adding services, scheduled tasks, or AutoRun keys Install a backdoor/implant on a client victim Install a webshell on a server Explanation: OBJ 1.4: During the installation phase, the adversary is taking actions to establish a footprint on the target system and is attempting to make it difficult for a defender to detect their presence. The attack may also attempt to confuse any attempts to remove the adversary from the system if the detection of their presence occurs. Due to this, an attacker will attempt to install multiple backdoors, implants, web shells, scheduled tasks, services, or AutoRun keys to maintain their access to the target. Timestomping is also conducted to hide the presence of malware on the system. Opening up two-way communication with an established C2 infrastructure occurs in the command and control phase. Collecting user credentials occurs in the actions on objectives phase. For support or reporting issues, include Question ID: 63fe07943b7322449ddbcfa0 in your ticket. Thank you.

Question 30

Which type of personnel control is being implemented if Kirsten must receive and inventory any items that her coworker, Bob, orders? Dual control Background checks Separation of duties Mandatory vacation

Answer 30

Separation of duties Explanation: OBJ 1.2: This organization uses separation of duties to ensure that neither Kirsten nor Bob can exploit the organization’s ordering processes for their gain. Separation of duties is the concept of having more than one person required to complete a particular task to prevent fraud and error. Dual control, instead, requires both people to act together. For example, a nuclear missile system uses dual control and requires two people to each turn a different key simultaneously to allow for a missile launch to occur. Mandatory vacation policies require employees to take time away from their job and detect fraud or malicious activities. A background check is a process a person or company uses to verify that a person is who they claim to be and provides an opportunity for someone to check a person's criminal record, education, employment history, and other past activities to confirm their validity. For support or reporting issues, include Question ID: 63fe07e83b7322449ddbd3d1 in your ticket. Thank you.

Question 31

Which of the following features of homomorphic encryption allows two parties to jointly evaluate a private function without revealing their respective inputs? Secure Function Evaluation Private Function Evaluation Private Information Retrieval Secure Multi-Party Computation

Answer 31

Private Function Evaluation Explanation: OBJ 3.7: Private Function Evaluation (PFE) allows two parties to jointly evaluate a private function without revealing their respective inputs. Secure Function Evaluation (SFE) allows two parties to jointly evaluate a publicly known function without revealing their respective inputs. Private Information Retrieval (PIR) retrieves an item from a service in possession of a database without revealing which item is retrieved. Secure Multi-Party Computation creates methods for parties to jointly compute a function over their inputs while keeping those inputs private. For support or reporting issues, include Question ID: 63fe06ff3b7322449ddbc86a in your ticket. Thank you.

Question 32

Why are injection vulnerabilities considered one of the most dangerous attack vectors in application security from a theoretical and strategic perspective? They allow attackers to exploit trust relationships within an application’s architecture They require highly sophisticated tools, making them accessible to only advanced threat actors They primarily target hardware flaws, making software-level defenses ineffective They are limited to specific programming languages, reducing their prevalence across systems

Answer 32

They allow attackers to exploit trust relationships within an application’s architecture Explanation: OBJ 3.2 - Injection vulnerabilities are dangerous because they exploit the inherent trust applications place in user input, manipulating this trust to execute unauthorized actions or access sensitive data. This strategic exploitation undermines the fundamental security assumptions of an application. These attacks are pervasive across various programming languages and systems, targeting software logic and often requiring minimal resources to execute. For support or reporting issues, include Question ID: 675064363af44d9e9e56c75d in your ticket. Thank you.

Question 33

Which of the following features of homomorphic encryption allows two parties to jointly evaluate a publicly known function without revealing their respective inputs? Private Information Retrieval Secure Function Evaluation Secure Multi-Party Computation Your answer is incorrect Private Function Evaluation

Answer 33

Secure Function Evaluation Explanation: OBJ 3.7: Secure Function Evaluation (SFE) allows two parties to jointly evaluate a publicly known function without revealing their respective inputs. Private Information Retrieval (PIR) retrieves an item from a service in possession of a database without revealing which item is retrieved. Private Function Evaluation (PFE) allows two parties to jointly evaluate a private function without revealing their respective inputs. Secure Multi-Party Computation creates methods for parties to jointly compute a function over their inputs while keeping those inputs private. For support or reporting issues, include Question ID: 63fe06e63b7322449ddbc734 in your ticket. Thank you.

Question 34

An organization reports a series of highly tailored phishing emails that reference specific employee roles, projects, and personal details sourced from public platforms. Further investigation reveals that these emails were created using advanced AI tools to enhance their credibility. Which type of AI-enabled attack does this scenario describe? Automated exploit crafting for targeted attacks Deepfake-assisted phishing schemes AI-driven pipeline manipulation Social engineering leveraging AI-based customization

Answer 34

Social engineering leveraging AI-based customization Explanation: OBJ 1.5 - This attack demonstrates social engineering augmented by AI, where artificial intelligence is used to analyze publicly available information and create highly personalized phishing messages. While deep fakes involve fabricated media and automated exploit crafting focuses on technical vulnerabilities, AI-driven pipeline manipulation pertains to internal AI workflow disruptions, none of which apply in this context. For support or reporting issues, include Question ID: 674ea9b1f0442e03b476b702 in your ticket. Thank you.

Question 35

You are investigating traffic involving three separate IP addresses (192.168.66.6, 10.66.6.10, and 172.16.66.1). Which REGEX expression would you use to be able to capture ONLY those three IP addresses in a single statement? \b(192\.168\.66\.6)+(10\.66\.6\.10)+(172\.16\.66\.1)\b \b[192\.168\.66\.6]+[10\.66\.6\.10]+[172\.16\.66\.1]\b \b[192\.168\.66\.6]|[10\.66\.6\.10]|[172\.16\.66\.1]\b \b(192\.168\.66\.6)|(10\.66\.6\.10)|(172\.16\.66\.1)\b

Answer 35

\b(192\.168\.66\.6)|(10\.66\.6\.10)|(172\.16\.66\.1)\b Explanation: OBJ 4.1: The correct option is \b(192\.168\.66\.6)|(10\.66\.6\.10)|(172\.16\.66\.1)\b, which uses parenthesis and "OR" operators (|) to delineate the possible whole-word variations of the three IP addresses. Using square braces indicates that any of the letters contained in the square braces are matching criteria. Using the + operator indicates an allowance for one more instance of the preceding element. In all cases, the period must have an escape (\) sequence preceding it as the period is a reserved operator internal to REGEX. For support or reporting issues, include Question ID: 63fe07423b7322449ddbcba1 in your ticket. Thank you.

Question 36

An organization migrates its applications to a multi-cloud environment and deploys a CWPP to enhance security. Which of the following best demonstrates how CWPP improves the security of cloud workloads? It manages encryption keys for all cloud services to ensure data protection It monitors the organization’s entire cloud infrastructure for compliance and access violations It automates the backup of workloads to prevent data loss in case of attacks or outages It provides runtime protection for workloads by detecting and blocking malicious activity

Answer 36

It provides runtime protection for workloads by detecting and blocking malicious activity Explanation: OBJ 4.4 - A Cloud Workload Protection Platform (CWPP) secures cloud workloads by providing visibility, runtime protection, and threat detection across containers, virtual machines, and serverless environments. While compliance monitoring and key management are important cloud security practices, they are not primary CWPP functions. Automating backups ensures availability but is unrelated to runtime protection and threat detection. For support or reporting issues, include Question ID: 67508d0a00440144bc05ee3a in your ticket. Thank you.

Question 37

LeFlore’s financial services company stores sensitive customer data on a server valued at $50,000. The company estimates that in the event of a data breach, approximately 40% of the data would likely be compromised. Additionally, the potential incident could result in a 10% loss of business revenue for the month, estimated at $200,000. Given these factors, what is the Single Loss Expectancy (SLE) associated with the loss of data stored on the server? $40,000 $70,000 $20,000 $25,000

Answer 37

$20,000 Explanation: OBJ 4.1: The single loss expectancy (SLE) is the amount that would be lost in a single occurrence of a particular risk factor. To calculate the single loss expectancy (SLE), you will multiple the asset value (AV) times the exposure factor (EF). Since you are asked to calculate the single loss expectancy, you do not need to calculate the annual rate of occurrence nor the annualized loss expectancy. SLE = AV x EF. Here, the SLE would be $50,000 (asset value) × 40% (exposure factor), which equals $20,000. The loss of business revenue serves as a distractor to add complexity as it is used in finding other factors not required in this question. For support or reporting issues, include Question ID: 6709aa6d12632274bc4072cd in your ticket. Thank you.

Question 38

A data center implements tamper-resistant enclosures for its server racks to protect against unauthorized physical access. During a security incident, it is discovered that an attacker disabled the tamper detection system by cutting power to the racks, allowing access to critical hardware without triggering alerts. What is the most effective countermeasure to address this vulnerability? Deploy backup power supplies to ensure continuous operation Use tamper-evident stickers on server racks to visually indicate unauthorized access Increase physical surveillance to monitor access to server racks in real time Require dual-factor authentication for all physical access to the data center

Answer 38

Deploy backup power supplies to ensure continuous operation Explanation: OBJ 3.4 - Backup power ensures that the tamper detection system remains operational even if the primary power source is cut, addressing the root cause of the vulnerability. Increasing surveillance or requiring dual-factor authentication enhances security but does not directly resolve the power issue. Tamper-evident stickers provide visual cues but do not prevent or detect tampering in real-time. For support or reporting issues, include Question ID: 675082f5dfd365846f56357a in your ticket. Thank you.

Question 39

You are conducting an incident response and have traced the attack source to some compromised user credentials. After performing log analysis, you discover that the attack was successfully authenticated from an unauthorized foreign country. Your management is now asking for you to implement a solution to help mitigate this type of attack from occurring again. Which of the following should you implement? Password complexity Context-based authentication Self-service password reset Single sign-on

Answer 39

Context-based authentication Explanation: OBJ 4.1: Context-based authentication can consider several factors before permitting access to a user, including their location (e.g., country, GPS location, etc.), the time of day, and other key factors to minimize the threat of compromised credentials from being utilized by an attacker. A self-service password reset is defined as any process or technology that allows users who have either forgotten their password or triggered an intruder lockout to authenticate with an alternate factor and repair their problem without calling the help desk. While helpful, this alone would not help prevent an attacker from using the compromised credentials. Single sign-on (SSO) is an authentication scheme that allows a user to log in with a single ID and password to any of several related yet independent software systems. Again, this is helpful since it will minimize the number of usernames and passwords that a user must remember. Still, if their credentials are stolen, then the attacker can now access every system the user had access to, extending the problem. Password complexity is also a good thing to use, but it won't address the challenge presented in how to prevent the use of compromised credentials. If the password complexity is increased, this will prevent a brute force credential compromise. However, if the credentials are compromised any other way, the attacker could still log in to our systems and cause trouble. For support or reporting issues, include Question ID: 63fe06ea3b7322449ddbc75c in your ticket. Thank you.

Question 40

A company needs to implement stronger authentication by adding an authentication factor to its wireless system. The wireless system only supports WPA with pre-shared keys, but the backend authentication system supports EAP and TTLS. What should the network administrator implement? WPA2 with a complex shared key PKI with user authentication MAC address filtering with IP filtering 802.1x using EAP with MSCHAPv2

Answer 40

802.1x using EAP with MSCHAPv2 Explanation: OBJ 2.4: Since the backend uses a RADIUS server for back-end authentication, the network administrator can install 802.1x using EAP with MSCHAPv2 for authentication. The Extensible Authentication Protocol (EAP) is a framework in a series of protocols that allows for numerous different mechanisms of authentication, including things like simple passwords, digital certificates, and public key infrastructure. Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2) is a password-based authentication protocol that is widely used as an authentication method in PPTP-based (Point to Point Tunneling Protocol) VPNs and can be used with EAP. For support or reporting issues, include Question ID: 63fe06dc3b7322449ddbc6b2 in your ticket. Thank you.

Question 41

A user reports being unable to access a critical application despite entering the correct credentials. Upon investigation, the system logs show successful authentication but denied authorization. What is the most likely cause of the issue? The application server is offline and not responding to access requests The user’s account is locked due to multiple failed login attempts The authentication mechanism is misconfigured, causing incorrect credential validation The user is assigned a role that lacks the necessary permissions for the application

Answer 41

The user is assigned a role that lacks the necessary permissions for the application Explanation: OBJ 3.1: Successful authentication indicates that the user’s identity was verified, but authorization failure means the user lacks the required permissions to access the application. This typically results from misconfigured roles or permissions. Account locks or offline servers would prevent authentication, not cause authorization failure, while misconfigured authentication mechanisms would prevent successful login altogether. For support or reporting issues, include Question ID: 67513dc26a9dc9d16f2d02fe in your ticket. Thank you.

Question 42

Which of the following is usually not considered when evaluating the attack surface of an organization? External and internal users Software applications Websites and cloud entities Software development lifecycle model

Answer 42

Software development lifecycle model Explanation: OBJ 4.2: The software development lifecycle model used by a company is purely an internal function relevant only to the development of custom software within the organization. Regardless of whether a waterfall or agile methodology is chosen, it does not directly affect the organization's attack surface. The attack surface represents the set of things that could be attacked by an adversary. External and internal users, websites, cloud entities, and software applications used by an organization are all possible entry points that an adversary could attempt an attack upon. For support or reporting issues, include Question ID: 63fe07063b7322449ddbc8bf in your ticket. Thank you.

Question 43

Mimicry Labs is concerned about the security of sensitive data processed on its employee laptops. They implement a solution that isolates encryption keys and sensitive computations from the main operating system using dedicated hardware. What technology is most likely being used? TPM Secure enclave vTPM HSM

Answer 43

Secure enclave Explanation: OBJ 3.4: Secure enclaves isolate sensitive data and computations from the main system, enhancing security by reducing exposure to threats. Trusted Platform Modules (TPMs) are used for secure key storage and cryptographic operations but are not specifically designed for isolated computations. Virtual Trusted Platform Modules (vTPMs) are virtualized versions of TPMs, lacking the dedicated hardware isolation of secure enclaves. Hardware Security Modules (HSMs) focus on high-security cryptographic key management rather than computation isolation. For support or reporting issues, include Question ID: 6751ac6597eb9dce4020fc0e in your ticket. Thank you.

Question 44

Dion Training wants to transform protected data into an unreadable format before storing it in their database. The CTO wants to utilize a technology like those used to protect the local user passwords in the /etc/shadow file of a Linux system. Which of the following cryptographic techniques should the company utilize to meet this requirement? Crypto shredding Cryptographic obfuscation Rekeying Key rotation

Answer 44

Cryptographic obfuscation Explanation: OBJ 3.8: Cryptographic obfuscation is used to transform protected data into an unreadable format. For example, the Linux user passwords stored in the /etc/shadow file are obfuscated to protect them. Crypto shredding is used to destroy a decryption key to effectively destroy the data that key was used to protect. This technique ensures that the data will remain encrypted if the key is fully destroyed and the encryption algorithm itself remains secure. Key rotation is the process of purposely changing keys periodically to mitigate against brute force attacks and key disclosure compromises. During key rotation, the previous key is also revoked and invalidated. Rekeying is the process of changing an individual key during a communication session. Most communication protocols use session key rekeying to protect the data being transmitted. A rekeying is normally triggered based on the volume of data communicated or the amount of time since the last rekeying. For support or reporting issues, include Question ID: 63fe07d23b7322449ddbd2b9 in your ticket. Thank you.

Question 45

You are applying for a job at a cybersecurity firm. The application requests you enter your social security number, date of birth, and email address to conduct a background check as part of the hiring process. Which of the following types of information have you been asked to provide? PHI IP PII CUI

Answer 45

PII Explanation: OBJ 1.3: Personally identifiable information (PII) is data used to identify, contact, or locate an individual. Information such as social security number (SSN), name, date of birth, email address, telephone number, street address, and biometric data is considered PII. Protected health information (PHI) refers to medical and insurance records, plus associated hospital and laboratory test results. Proprietary information or intellectual property (IP) is information created and owned by the company, typically about the products or services that they make or perform. Controlled Unclassified Information (CUI) is federal non-classified information that must be safeguarded by implementing a uniform set of requirements and information security controls to secure sensitive government information. For support or reporting issues, include Question ID: 63fe08053b7322449ddbd53b in your ticket. Thank you.

Question 46

A network technician is using telnet to connect to a router on a network that has been compromised. A new user and password have been added to the router with full rights. The technician is concerned that the regularly used administrator account has been compromised. After changing the password on all the networking devices, which of the following should the technician do to prevent the password from being sniffed on the network again? Ensure the password is 10 characters, containing letters and numbers Only allow administrators to access routers using port 22 Use SNMPv1 for all configurations involving the router Copy all configurations to routers using TFTP for security

Answer 46

Only allow administrators to access routers using port 22 Explanation: OBJ 3.2: Port 22 uses SSH to authenticate a remote computer or user, or in this case, an administrator. Even if the router has been compromised, the new full rights user will not access their new account without the SSH key, which could only be provided by a true administrator. Telnet uses port 23 and passes all information as unencrypted traffic on the network. Telnet should always be disabled for security reasons, and SSH (which uses encryption) should be used instead. For support or reporting issues, include Question ID: 63fe070e3b7322449ddbc91e in your ticket. Thank you.

Question 47

A utility company uses SCADA systems to monitor and control its infrastructure. These systems cannot be frequently updated due to operational constraints. To secure them, the company implements intrusion detection systems and conducts regular traffic analysis to detect anomalies. What security practice is being applied? Continuous monitoring Secure boot implementation Environmental hardening Firmware updates

Answer 47

Continuous monitoring Explanation: OBJ 3.5: Continuous monitoring uses tools like IDS and traffic analysis to detect anomalies and potential threats in operational technology systems. Environmental hardening involves physical protections, not network activity monitoring. Firmware updates are not frequent in Supervisory Control and Data Acquisition (SCADA) systems due to operational constraints. Secure boot ensures trusted software at startup but does not monitor ongoing activity. For support or reporting issues, include Question ID: 6751b1368e62d8320cd6bbbc in your ticket. Thank you.

Question 48

A zero-trust architecture requires all devices accessing the corporate network to undergo a validation process. A company wants to ensure that only secure, managed devices are granted access to sensitive resources. Which of the following is the best approach to achieving this? Allow unmanaged devices to connect only after the user credentials are validated Assign a static IP address to every managed device and block others Use basic network monitoring tools to log device connections Implement device attestation to verify integrity before access is granted

Answer 48

Implement device attestation to verify integrity before access is granted Explanation: OBJ 2.6: Device attestation ensures that hardware and software are validated for integrity and compliance with security policies before granting access to sensitive resources. This aligns with Zero Trust principles of continuous verification. Assigning static IP addresses does not confirm device integrity or compliance. Allowing unmanaged devices based solely on user credentials introduces significant security risks and violates Zero Trust principles. Basic network monitoring provides visibility but does not actively enforce access controls or verify device integrity. For support or reporting issues, include Question ID: 6751037123df37e1b5ec6041 in your ticket. Thank you.

Question 49

Dion Training utilizes DevSecOps in its software development methodology. The company has a goal of releasing code updates at least twice a day. The company believes that by releasing code updates more frequently, they can increase the security of their application since software bugs can be patched and rectified faster. Which of the following development techniques should Dion Training implement to reach their goal? Spiral CI/CD Waterfall Middleware

Answer 49

CI/CD Explanation: OBJ 2.2: Continuous integration/continuous delivery (CI/CD) is a software development methodology in which code updates are tested and committed to a development or build server/code repository rapidly. Waterfall is a software development model where the phases of the SDLC cascade so that each phase will start only when all tasks identified in the previous phase are complete. Spiral development allows the modification of the development repeatedly in response to stakeholder feedback and input but still follows an overall beginning-to-end structure. Both waterfall and spiral development are too slow to support code deployments multiple times per day, so agile development must be utilized. Middleware generally describes more comprehensive software applications designed to integrate two systems. Middleware can perform more sophisticated mechanisms and include multiple APIs to connect to various sources, enabling more feature-rich operations or to detach features from individual systems so they can be separately managed and controlled. Middleware is not a development technique. For support or reporting issues, include Question ID: 63fe07123b7322449ddbc950 in your ticket. Thank you.

Question 50

When your credit card data is written to the customer invoicing system at Dion Training, the first 12 digits are replaced with an x before storing the data. Which of the following privacy methods is being used? Tokenization Data masking Anonymization Data minimization

Answer 50

Data masking Explanation: OBJ 3.8: Data masking can mean that all or part of a field's contents is redacted, by substituting all character strings with x, for example. Tokenization means that all or part of data in a field is replaced with a randomly generated token. The token is stored with the original value on a token server or token vault, separate from the production database. An authorized query or app can retrieve the original value from the vault, if necessary, so tokenization is a reversible technique. Data minimization involves limiting data collection to only what is required to fulfill a specific purpose. Reducing what information is collected reduces the amount and type of information that must be protected. Data anonymization is the process of removing personally identifiable information from a data set so that the people whom the data describe remain anonymous. For support or reporting issues, include Question ID: 63fe06c43b7322449ddbc58e in your ticket. Thank you.

Question 51

A financial institution implements application control on its endpoints to enhance security. The team notices that some legitimate business applications are being blocked, disrupting user productivity. What is the most effective way to resolve this issue while maintaining strong security controls? Switch to monitoring mode to gather more data without enforcing restrictions Disable application control for the affected endpoints Create a denylist of known malicious applications to reduce false positives Add the legitimate applications to an allowlist based on a thorough review

Answer 51

Add the legitimate applications to an allowlist based on a thorough review Explanation: OBJ 3.2: Application allowlisting improves security by permitting only approved applications to run. When legitimate applications are blocked, adding them to the allowlist after careful verification ensures they can function without weakening the overall security posture. Disabling application control or switching to monitoring mode compromises security, while a denylist alone does not provide the proactive protection of an allowlist. For support or reporting issues, include Question ID: 67513f8113c8d9f38d27de06 in your ticket. Thank you.

Question 52

Telecosos is a company that has decided to deploy a Mobile Device Management (MDM) solution to enhance the security of corporate-owned devices. Employees report issues accessing corporate resources when their devices are not on the corporate network. The IT team wants to ensure secure access regardless of the network. Which MDM feature best addresses this requirement? Configuring secure VPN profiles for all managed devices Using geofencing to restrict access to corporate networks Enforcing application allowlisting to limit installed apps Requiring multifactor authentication for all device logins

Answer 52

Configuring secure VPN profiles for all managed devices Explanation: OBJ 3.2: Secure VPN profiles allow devices to access corporate resources securely from any network by creating an encrypted connection to the corporate environment. Application allowlisting and MFA enhance device security but do not address the issue of accessing resources off the corporate network. Geofencing is not suitable for enabling secure access in this scenario. For support or reporting issues, include Question ID: 6751470fee759eace74d72dc in your ticket. Thank you.

Question 53

Dion Training wants to implement an endpoint security control that will monitor indicators and logs from various systems and endpoints to identify anomalous or malicious behavior. The organization wants to ensure the tool utilizes machine learning or artificial intelligence due to the volume of indicators and logs collected across the network. This security control should monitor and identify activity across user accounts, workstations, servers, and virtual machines. Which of the following endpoint security controls would BEST meet these requirements? User and entity behavior analytics (UEBA) Endpoint detection and response (EDR) Host-based firewall Host-based intrusion detection system (HIDS)

Answer 53

User and entity behavior analytics (UEBA) Explanation: OBJ 3.4: User and entity behavior analytics (UEBA) is a type of cybersecurity application or appliance that identifies anomalous or malicious behavior by using machine learning and statistical analysis to identify deviations from normally established baselines and patterns of activity. Endpoint detection and response (EDR) is a software agent that collects system data and logs for analysis by a monitoring system to provide early detection of threats. A host-based intrusion detection system (HIDS) is a type of IDS that monitors a computer system for unexpected behavior or drastic changes to the system's state. A host-based firewall is a firewall implemented as application software running on the host that provides sophisticated filtering of network traffic as well as block processes at the application level. For support or reporting issues, include Question ID: 63fe07da3b7322449ddbd318 in your ticket. Thank you.

Question 54

Which protocol relies on mutual authentication of the client and the server for its security? Two-factor authentication LDAPS RADIUS CHAP

Answer 54

LDAPS Explanation: OBJ 2.4: The Lightweight Directory Access Protocol (LDAP) uses a client-server model for mutual authentication. LDAP is used to enable access to a directory of resources (workstations, users, information, etc.). TLS provides mutual authentication between clients and servers. Since Secure LDAP (LDAPS) uses TLS, it provides mutual authentication. For support or reporting issues, include Question ID: 63fe06f43b7322449ddbc7de in your ticket. Thank you.

Question 55

Which of the following scenarios most effectively demonstrates privilege escalation as part of an attacker’s tactics, techniques, and procedures (TTPs)? An unauthorized user intercepts network traffic to gather sensitive information and uses that information to perform an attack An attacker exploits a misconfigured application to gain administrative rights from a standard user account A threat actor uses a phishing email to steal a user's login credentials and uses them to access their network A malicious actor overwhelms a server with traffic, causing it to become unavailable

Answer 55

An attacker exploits a misconfigured application to gain administrative rights from a standard user account Explanation: OBJ 3.2 - Privilege escalation occurs when an attacker exploits a vulnerability, misconfiguration, or flaw to gain higher-level permissions than initially granted. For example, moving from a standard user account to administrative access enables the attacker to execute more harmful actions. Credential theft, denial-of-service (DoS) attacks, and interception of network traffic represent other tactics but do not specifically demonstrate privilege escalation. For support or reporting issues, include Question ID: 675064833af44d9e9e56c762 in your ticket. Thank you.

Question 56

You are conducting threat hunting for an online retailer. Upon analyzing their web server, you identified that a single HTML response returned as 45 MB in size, but an average response is normally only 275 KB. Which of the following categories of potential indicators of compromise would you classify this as? Introduction of new accounts Unauthorized privilege Beaconing Data exfiltration

Answer 56

Data exfiltration Explanation: OBJ 4.2: If attackers use SQL injection to extract data through a Web application, the requests issued by them will usually have a larger HTML response size than a normal request. For example, if the attacker extracts the full credit card database, then a single response for that attacker might be 20 to 50 MB, where a normal response is only 200 KB. Therefore, this scenario is an example of a data exfiltration indicator of compromise. Based on the scenario, there is no evidence that a user is conducting a privilege escalation or using unauthorized privileges. There is also no evidence of a new account having been created or beaconing occurring over the network. For support or reporting issues, include Question ID: 63fe07463b7322449ddbcbce in your ticket. Thank you.

Question 57

You are developing your vulnerability scanning plan and attempting to scope your scans properly. You have decided to focus on the criticality of a system to the organization's operations when prioritizing the system in the scope of your scans. Which of the following would be the best place to gather the criticality of a system? Scope the scan based on IP subnets Ask the CEO for a list of the critical systems Review the asset inventory and BCP Conduct a nmap scan of the network to determine the OS of each system

Answer 57

Review the asset inventory and BCP Explanation: OBJ 4.1: To best understand a system's criticality, you should review the asset inventory and the BCP. Most organizations classify each asset in its inventory based on its criticality to the organization's operations. This helps to determine how many spare parts to have, the warranty requirements, service agreements, and other key factors to help keep these assets online and running at all times. Additionally, you can review the business continuity plan (BCP) since this will provide the organization's plan for continuing business operations in the event of a disaster or other outage. Generally, the systems or operations listed in a BCP are the most critical ones to support business operations. While the CEO may be able to provide a list of the most critical systems in a large organization, it isn't easy to get them to take the time to do it, even if they did know the answer. Worse, in most large organizations, the CEO isn't going to know what systems he relies on, but instead just the business functions they serve, again making this a bad choice. While conducting a nmap scan may help you determine what OS is being run on each system, this information doesn't help you determine criticality to operations. The same is true of using IP subnets since a list of subnets by itself doesn't provide criticality or prioritization of the assets. For support or reporting issues, include Question ID: 63fe07803b7322449ddbcead in your ticket. Thank you.

Question 58

An administrator has implemented new network routes to support his company's growing internal infrastructure. Users report that connectivity between certain segments is inconsistent, with some packets being dropped. What is the most likely cause? Switch misconfigurations Routing errors Faulty NICs DNS misalignment

Answer 58

Routing errors Explanation: OBJ 3.3: Routing errors cause improper packet forwarding, leading to connectivity issues. Faulty NICs are hardware-related, not configuration issues. Switch misconfigurations impact local network data switching, not routing. DNS misalignment is unrelated to internal routing paths. For support or reporting issues, include Question ID: 6751a8edccca116cc0eb3b85 in your ticket. Thank you.

Question 59

Christina is auditing the security procedures related to the use of a cloud-based online payment service. She notices that the access permissions are set so that some transfers require two people to conduct. One person handles transfers into the accounts and another handles the transfers out of the account. This process helps prevent fraud. What security principle is most closely related to this scenario? Dual control authentication Least privilege Separation of duties Security through obscurity

Answer 59

Separation of duties Explanation: OBJ 1.2: Separation of duties is the concept of having more than one person required to complete a task. In business, the separation by sharing more than one individual in a single task is an internal control intended to prevent fraud and error. In this case, one person can transfer money in, while another must transfer money out. Dual control authentication is used when performing a sensitive action and requires two different users to log in. Least privilege is the concept and practice of restricting access rights for users, accounts, and computing processes to only those resources required to perform routine, legitimate activities. Security through obscurity is the reliance on security engineering in design or implementation by using secrecy as the main method of providing security to a system or component. For support or reporting issues, include Question ID: 63fe07ff3b7322449ddbd4f0 in your ticket. Thank you.

Question 60

Which of the following protocols is commonly used to collect information about CPU utilization and memory usage from network devices? MIB SNMP NetFlow SMTP

Answer 60

SNMP Explanation: OBJ 4.1: Simple Network Management Protocol (SNMP) is commonly used to gather information from routers, switches, and other network devices. It provides information about a device's status, including CPU and memory utilization, and many other useful details about the device. NetFlow provides information about network traffic. A management information base (MIB) is a database used for managing the entities in a communication network. The Simple Mail Transfer Protocol (SMTP) is a communication protocol for electronic mail transmission. For support or reporting issues, include Question ID: 63fe07033b7322449ddbc892 in your ticket. Thank you.

Question 61

Dion Training is drafting a new business continuity plan and is trying to determine the appropriate metric to utilize in defining the recovery requirements for their practice exam web application. This application is used by all of Dion Training’s students to prepare for their upcoming certification exams. The Chief Operating Officer (COO) has decided that she can only accept a loss of up to 2 hours of student practice exam results after an incident occurs. Which of the following metrics best defines this 2-hour timeframe? Recovery time objective (RTO) Recovery service level (RSL) Recovery point objective (RPO) Mean time to recovery (MTTR)

Answer 61

Recovery point objective (RPO) Explanation: OBJ 1.1: The COO has defined the recovery point objective as 2 hours. The recovery point objective defines the maximum amount of data that can be lost without irreparable harm to the operation of the business. The recovery time objective defines the maximum amount of time that performing a recovery can take and the service can be offline. The recovery service level is the minimum acceptable amount of services that must be restored for a given system to consider it recovered. For example, your organization may need to restore its databases and websites to meet its recovery service level objectives while leaving its print servers offline since they may not be considered a mission-essential function in your organization. The mean time to recovery is the average amount of downtime calculated based on when a service or device fails and when its functionality is restored. For support or reporting issues, include Question ID: 63fe07ef3b7322449ddbd41e in your ticket. Thank you.

Question 62

An organization has decided to implement browser isolation to protect its endpoints from web-based threats. Which of the following best describes how browser isolation enhances security? It requires all web traffic to pass through a WAF that inspects for malicious activity and blocks harmful requests It executes browser sessions in a secure environment to prevent threats from interacting with endpoints directly It blocks all traffic to potentially malicious websites using predefined URL filtering rules, reducing exposure to threats It disables scripting and plugins in the browser to reduce vulnerabilities from certain types of attacks, such as XSS

Answer 62

It executes browser sessions in a secure environment to prevent threats from interacting with endpoints directly Explanation: OBJ 3.2: Browser isolation enhances security by running browser sessions in a secure, isolated environment, such as a virtual container or cloud-based sandbox. This approach prevents malicious web content, including exploits and drive-by downloads, from directly impacting the endpoint. Blocking traffic with URL filtering reduces risk but does not isolate threats. Disabling browser features like scripting and plugins is limited to specific types of vulnerabilities, and while a web application firewalls (WAF) inspect web traffic, they do not directly isolate browser activity. For support or reporting issues, include Question ID: 67514432b702e8776b8d552a in your ticket. Thank you.

Question 63

An international organization processes customer data across multiple regions, each with its own legal and regulatory requirements for data protection. To ensure compliance, which of the following strategies should the organization prioritize? Centralize all customer data in a single jurisdiction to simplify compliance and access restrictions Encrypt all customer data and rely on encryption as the primary compliance measure Implement a unified global data protection policy that meets the strictest regional regulation Delegate compliance responsibility to individual regional offices to address local regulations

Answer 63

Implement a unified global data protection policy that meets the strictest regional regulation Explanation: https://ibm-learning.udemy.com/course/comptia-securityx-cas-005-6-practice-exams/learn/quiz/6689173/test#overview:~:text=OBJ%203.8%20%2D%20Implementing,ticket.%20Thank%20you.

Question 64

An enterprise is designing an internal web application for employees to access sensitive data. The security team proposes mandatory multifactor authentication (MFA) at every login. However, employees complain that constant MFA requests hinder productivity. What is the best approach to balance the security vs. usability trade-off in this scenario? Implement single sign-on (SSO) alone Disable MFA for internal applications Use MFA only for risky actions Require periodic password changes

Answer 64

Use MFA only for risky actions Explanation: OBJ 2.2: Adaptive MFA balances security and usability by triggering authentication only for high-risk situations, improving the user experience without compromising protection. Disabling MFA sacrifices security entirely. SSO alone is user-friendly but insufficient for sensitive data. Password changes alone weaken security and do not address usability complaints. For support or reporting issues, include Question ID: 6750fbdd23df37e1b5ec5f7d in your ticket. Thank you.

Question 65

During the design phase of a new enterprise application, the security team is tasked with defining functional security requirements. These requirements must address the following objectives: Prevent unauthorized users from accessing sensitive application features Ensure user credentials are securely stored and validated Allow integration with MFA systems Which of the following functional requirements best aligns with these objectives? Define RBAC and use hashed passwords for credential storage Encrypt all traffic using TLS and implement regular vulnerability scans Use anomaly-based intrusion detection and endpoint protection systems Require end-user training programs on secure application usage

Answer 65

Define RBAC and use hashed passwords for credential storage Explanation: OBJ 2.2: Functional security requirements focus on specific features and functionalities within a system that address security needs: Role-based access control (RBAC) ensures only authorized users can access specific application features, Hashed passwords provide secure storage for credentials, meeting the requirement to secure user credentials. Multifactor authentication (MFA) integration can be seamlessly incorporated into these functional requirements for additional security. Encrypting traffic and vulnerability scans are essential but pertain to operational or non-functional requirements. User training addresses awareness, not system functionality. Intrusion detection and endpoint protection are external measures not directly tied to application design. For support or reporting issues, include Question ID: 6750fa3323df37e1b5ec5f6c in your ticket. Thank you.

Question 66

Michelle has just finished installing a new database application on her server. She then proceeds to uninstall the sample configuration files, properly configure the application settings, and update the software to the latest version according to her company's policy. What best describes the actions Michelle just took? Patch management Application hardening Vulnerability scanning Input validation

Answer 66

Application hardening Explanation: OBJ 2.3: Application hardening involves taking actions to best secure the application from attack. This involves removing any default or sample configurations, properly configuring settings, and updating the application to the latest and more secure version. Patch management is incorrect because only updating the software falls under patch management, not the configuration portions of her actions. Vulnerability scanning involves scanning a device for known vulnerabilities to update the device and prevent a future attack. Input validation is a technique to verify user-provided data meets the expected length and type before allowing a program to utilize it. For support or reporting issues, include Question ID: 63fe07c63b7322449ddbd219 in your ticket. Thank you.

Question 67

Which of the following is the biggest weakness with ICS and SCADA systems in a network? These systems are difficult to retrofit with modern security Cybersecurity experts don't know how to secure ICS/SCADA They are patched using standard vendor OS patches ICS/SCADA must be connected to the internet to function

Answer 67

These systems are difficult to retrofit with modern security Explanation: OBJ 3.5: Industrial control system (ICS) and supervisory control and data acquisition (SCADA) systems were developed many years before security standards were established and integrated into their design. Many of these older systems date back to the 1970s and are still in use today. Over time, these systems were incorporated into the organization's TCP/IP data networks, which provides a huge exploitation area by penetration testers and attackers alike. Many ICS and SCADA vendors are slow to implement security measures since they cannot be easily retrofitted with the newer security required. Therefore, ICS and SCADA systems should ALWAYS be isolated from production networks and segmented into their logical network. For example, some ICS/SCADA systems use a proprietary operating system. More modern ICS/SCADA operates using a version of Windows. However, many still use Windows XP, making them much more vulnerable since they cannot be upgraded to Windows 10 without hardware replacement. For support or reporting issues, include Question ID: 63fe07b33b7322449ddbd12e in your ticket. Thank you.

Question 68

Which of the following features of homomorphic encryption creates methods for parties to jointly compute a function over their inputs while keeping those inputs private? Private Information Retrieval Secure Function Evaluation Private Function Evaluation Secure Multi-Party Computation

Answer 68

Secure Multi-Party Computation Explanation: OBJ 3.8: Secure Multi-Party Computation creates methods for parties to jointly compute a function over their inputs while keeping those inputs private. Private Function Evaluation (PFE) allows two parties to jointly evaluate a private function without revealing their respective inputs. Secure Function Evaluation (SFE) allows two parties to jointly evaluate a publicly known function without revealing their respective inputs. Private Information Retrieval (PIR) retrieves an item from a service in possession of a database without revealing which item is retrieved. For support or reporting issues, include Question ID: 63fe07113b7322449ddbc941 in your ticket. Thank you.

Question 69

Dion Training has a $15,000 server that has frequently been crashing. Over the past 12 months, the server has crashed 10 times, requiring the server to be rebooted to recover from the crash. Each time, this has resulted in a 5% loss of functionality or data. Based on this information, what is the Annual Loss Expectancy (ALE) for this server? $7,500 $15,000 $2,500 $1,500

Answer 69

$7,500 Explanation: OBJ 1.2: To calculate the ALE, you need to multiple the Single Loss Expectancy (SLE) by the Annual Rate of Occurrence (ARO). The SLE is calculated by multiplying the Exposure Factor (EF) by the Asset Value (AV). Therefore, SLE = EF x AV, and ALE = SLE x ARO. For this scenario, the asset value is $15,000, the annual rate of occurrence is 10 times per year, and the exposure factor is 5% (or 0.05). To calculate the SLE, SLE = 0.05 x $15,000 = $750. Therefore, the ALE = SLE x ARO = $750 x 10 = $7,500. For support or reporting issues, include Question ID: 63fe08053b7322449ddbd531 in your ticket. Thank you.

Question 70

Dion Training is building a new learning management system that will require its students to access the system through a webpage. To create a secure communication channel between the student’s system and the learning management system, the programmers have decided to use ephemeral session keys without the use of the server’s digital certificate and instead relying on a Diffie-Hellman key agreement. The programmer states that in his implementation, even if the server’s private key is exposed, the ephemeral session keys would remain secure. Which cryptographic concept is the programmer referring to in his implementation? Forward secrecy AEAD Key stretching Cipher block chaining

Answer 70

Forward secrecy Explanation: OBJ 3.7: Forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that session keys will not be compromised even if long-term secrets that were used in the session key exchange are compromised. Key stretching is a technique that strengthens potentially weak input for cryptographic key generation, such as passwords or passphrases created by people, against brute force attacks. Authenticated encryption with associated data (AEAD) is a form of encryption that provides confidentiality of the plaintext, a way to check its integrity, and a method of verifying its authenticity. Cipher block chaining (CBC) is a simple mode of enabling symmetric block ciphers to work with large sets of data. CBC is an older method that is vulnerable to the padding-oracle attack and should therefore not be used. For support or reporting issues, include Question ID: 63fe07ba3b7322449ddbd18d in your ticket. Thank you.

Question 71

A multinational corporation is redesigning its network after a security incident involving lateral movement due to a flat structure. Attackers accessed critical systems like the financial database and employee workstations. To prevent future breaches and maintain efficiency across global sites, which segmentation strategy would best mitigate lateral movement risks? Using micro-segmentation to isolate workloads and enforce strict access policies between network segments Deploying a flat network structure with intrusion detection systems (IDS) to monitor lateral movement Implementing a single virtual local area network (VLAN) for all systems on the network to simplify management Grouping all critical systems into a single secure zone and restricting access to it using firewalls

Answer 71

Using micro-segmentation to isolate workloads and enforce strict access policies between network segments Explanation: OBJ 2.6 - Micro-segmentation divides the network into smaller, isolated segments, allowing strict access controls and policies to be applied at the workload level. This strategy effectively prevents lateral movement by attackers while maintaining flexibility for operational needs. Implementing a single VLAN oversimplifies management and leaves the network vulnerable to unrestricted movement. A flat network structure with IDS monitoring does not stop lateral movement, it only detects it. Grouping all critical systems into a single secure zone provides some protection but does not address the broader risks associated with unrestricted access across other parts of the network. For support or reporting issues, include Question ID: 674f6f1170de25277ff862a8 in your ticket. Thank you.

Question 72

FinBlend is an organization that is deploying a vulnerability scanner to assess the security posture of its network. The scanner must meet the following requirements: Identify known vulnerabilities in operating systems, applications, and configurations Minimize disruption to critical production systems during scans Provide detailed reports for compliance audits Which of the following configurations best fulfills these requirements? Deploy uncredentialed scans to reduce the scanning overhead on production systems Enable intrusive scans during peak business hours to maximize vulnerability discovery Use credentialed scans during maintenance windows to gather in-depth information Configure the scanner for continuous scanning to ensure real-time vulnerability updates

Answer 72

Use credentialed scans during maintenance windows to gather in-depth information Explanation: OBJ 2.1: Credentialed scans allow the scanner to authenticate with target systems and provide more accurate and detailed results without causing significant disruptions. Scheduling scans during maintenance windows minimizes the impact on critical systems. Intrusive scans during peak hours risk disrupting production systems, violating the requirement to minimize disruption. Uncredentialed scans may reduce overhead but provide less comprehensive results. Continuous scanning increases system load and is not suitable for minimizing disruption in critical environments. For support or reporting issues, include Question ID: 6750f262ec280b7d2c7fa23e in your ticket. Thank you.

Question 73

Susan, a help desk technician at Dion Training, has received several trouble tickets today related to employees receiving the same email as part of a phishing campaign. She has determined that the email's malicious link is not being blocked by the company's security suite when a user clicks the link. Susan asked you what action can be performed to prevent a user from reaching the website associated with the phishing email's malicious link. What action do you recommend she utilize? Block the IP address of the malicious domain in your firewall's ACL Add the malicious domain name to your content filter and web proxy's block list Forward this phishing email to all employees with a warning not to click on the embedded links Enable TLS on your organization's mail server

Answer 73

Add the malicious domain name to your content filter and web proxy's block list Explanation: OBJ 4.2: To prevent a user from accessing the malicious website when the link is clicked, the malicious domain name should be added to the blocklist of the company's content filter and web proxy. This will ensure that no devices on the network can reach the malicious domain name. While blocking the IP address associated with the domain name might help for a short period of time, the malicious domain's owner could quickly redirect the DNS to point to a different IP. Then the users would still be able to access the malicious domain and its contents. Enabling TLS on the mail server will only encrypt the connection between the email server and its clients. Still, it will not prevent the users from clicking on the malicious link and accessing the malicious content. While informing the users that there is an active attempt at phishing being conducted against the organization is a good idea, forwarding the phishing email with the malicious link will generally cause more users to accidentally click on the malicious link, which further exacerbates the issue. For support or reporting issues, include Question ID: 63fe06d73b7322449ddbc676 in your ticket. Thank you.

Question 74

An e-commerce platform must ensure that customers cannot deny making purchase orders processed through its online system. Which of the following mechanisms best ensures non-repudiation in this scenario? Storing customer IP addresses and timestamps for each transaction Generating digital signatures for each purchase order made by customers Requiring customers to authenticate using a password before purchases are complete Encrypting customer payment information using secure protocols

Answer 74

Generating digital signatures for each purchase order made by customers Explanation: OBJ 3.8 - Non-repudiation ensures that a transaction cannot be denied by the involved parties. Digital signatures provide proof of the origin and integrity of the purchase order, binding the customer to the transaction. Storing IP addresses and timestamps aids in auditing but does not ensure non-repudiation. Encrypting payment information ensures confidentiality but does not prevent denial of the transaction. Requiring authentication verifies the user's identity but does not tie the user to a specific transaction in a non-repudiable way. For support or reporting issues, include Question ID: 675085c8f86f3d695e9ad0e1 in your ticket. Thank you.

Question 75

Dion Training's new COO is reviewing the organization's current information security policy. She notices that it was first created three years ago. Since that time, the organization has undergone multiple audits and assessments that required revisions to the policy. Which of the following is the most reasonable frequency to conduct a formal review of the organization's policies to ensure they remain up to date? Quarterly Every five years Monthly Annually

Answer 75

Annually Explanation: OBJ 1.2: Annual reviews are an industry standard and are typically sufficient unless circumstances happen that might require an update or revision sooner. Waiting five years between policy reviews is too long and would leave the organization with constantly outdated policies. Similarly, conducting quarterly or monthly reviews is too frequent, and there will not be enough time for substantial changes to have occurred. Additionally, most formal audits and assessments are undertaken annually. Therefore, this is a reasonable frequency to use without overburdening your staff. For support or reporting issues, include Question ID: 63fe08013b7322449ddbd509 in your ticket. Thank you.

Question 76

Aymen is creating a procedure for the remediation of vulnerabilities discovered within his organization. He wants to ensure that any vendor patches are tested before deploying them into the production environment. What type of environment should his organization establish? Development Honeypot Honeynet Staging

Answer 76

Staging Explanation: OBJ 3.2: Deploying changes in a staging or sandbox environment provides the organization with a safe, isolated place for testing changes without interfering with production systems. Staging environments can mimic the actual production environment, leading to a realistic test environment that minimizes the risk of failure during a push to the production environment. Honeypots/Honeynets are not considered a testing environment. Instead, they are designed to attract attackers. The organization should not use the development environment to test the patches since a development environment does not mimic the real production environment. For support or reporting issues, include Question ID: 63fe06bd3b7322449ddbc53a in your ticket. Thank you.

Question 77

LedgersRus is an enterprise that is implementing an IPS to protect its e-commerce platform. The platform experiences high traffic volumes, and the organization is concerned about potential performance degradation caused by the IPS. To optimize both performance and security, the IPS configuration should: Use signature-based detection for all traffic to maximize accuracy Deploy the IPS in passive mode to avoid performance degradation Enable anomaly-based detection with threshold adjustments for high traffic Set the IPS to block all traffic by default and manually allowlist e-commerce requests

Answer 77

Enable anomaly-based detection with threshold adjustments for high traffic Explanation: OBJ 2.1: Anomaly-based detection is effective for identifying unusual patterns in traffic, which is crucial for dynamic environments like e-commerce. Adjusting thresholds reduces the risk of false positives while maintaining security. Signature-based detection for all traffic can lead to delays due to the need for extensive rule matching, impacting performance. Blocking all traffic by default is too restrictive for a customer-facing platform and may disrupt legitimate traffic. Passive mode eliminates performance concerns but does not actively prevent malicious traffic. For support or reporting issues, include Question ID: 6750f0b8ec280b7d2c7fa1d3 in your ticket. Thank you.

Question 78

A cybersecurity analyst is tasked with identifying the threat actor behind a newly discovered piece of malware. They decide to use code stylometry for malware attribution. Which of the following best explains how code stylometry assists in this process? It matches the malware’s hash to a repository of known malicious files and signatures for potential attribution It identifies unique coding styles and patterns within the malware’s code to link it to a specific developer or group It analyzes the network communication patterns and connection attempts of the malware to trace its origin It executes the malware in a sandbox environment to observe its behavior and determine its source and use cases

Answer 78

It identifies unique coding styles and patterns within the malware’s code to link it to a specific developer or group Explanation: OBJ 4.4 - It identifies unique coding styles and patterns within the malware’s code to link it to a specific developer or group. Code stylometry analyzes distinct coding habits, styles, and patterns in the malware’s code, helping to attribute it to a specific threat actor or group. Analyzing network communication patterns helps trace the malware’s origin or track its actions, but it doesn’t directly identify the developer or group behind it. Matching the malware’s hash can identify known malware but doesn’t provide insight into the specific author. Executing the malware in a sandbox reveals its behavior but doesn’t directly connect the code to its creator. Therefore, code stylometry focuses on identifying unique patterns in the code itself for attribution. For support or reporting issues, include Question ID: 67508ed3f94527ffaf8d225d in your ticket. Thank you.

Question 79

Your company has recently migrated much of your data center to the cloud. Now, your boss needs a method to monitor all services used in supporting your customers to be properly billed based on their usage. Which of the following cloud computing concepts is your boss describing? Measured services Resource pooling Rapid elasticity On-demand

Answer 79

Measured services Explanation: OBJ 2.5: Measured service is a term that IT professionals apply to cloud computing that references services where the cloud provider measures or monitors the provision of services for various reasons, including billing, effective use of resources, or overall predictive planning. Rapid elasticity is used to describe scalable provisioning or the capability to provide scalable cloud computing services. Rapid elasticity is very critical to meet the fluctuating demands of cloud users. The downside of rapid elasticity implementations is that they can cause significant loading of the system due to the high resource number of allocation and deallocation requests. On-demand refers to the fact that a consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider. Resource pooling refers to the concept that allows a virtual environment to allocate memory and processing capacity for a VMs use. For support or reporting issues, include Question ID: 63fe070c3b7322449ddbc900 in your ticket. Thank you.

Question 80

John is a cybersecurity consultant that wants to sell his services to an organization. In preparation for his first meeting with the client, John wants to conduct a vulnerability scan of their network to show the client how much they need his services. What is the most significant issue with John conducting this scan of the organization’s network? The IP range of the client systems is unknown by John The client’s infrastructure design is unknown to John John does not have permission to perform the scan John does not know what operating systems and applications are in use

Answer 80

John does not have permission to perform the scan Explanation: OBJ 1.1: All options listed are an issue, but the most significant issue is that John does not have the client’s permission to perform the scan. A vulnerability scan may be construed as a form of reconnaissance, penetration testing, or even an attack on the organization’s systems. A cybersecurity analyst should never conduct a vulnerability scan on another organization’s network without explicit written permission. In some countries, a vulnerability scan against an organization’s network without their permission is considered a cybercrime and could result in jail time for the consultant. For support or reporting issues, include Question ID: 63fe07303b7322449ddbcaca in your ticket. Thank you.

Question 81

James, a programmer at Apple Computers, is surfing the internet on his lunch break. He comes across a rumor site focused on providing details of the upcoming iPhone being released in a few months. James knows that Apple likes to keep its product details a secret until it is publicly announced. As James is looking over the website, he sees a blog post with an embedded picture of a PDF containing detailed specifications for the next iPhone and labeled “Proprietary Information – Internal Use Only.” The new iPhone is still several months away from release. What should James do next? Contact the website's owner and request they take down the PDF Contact the service desk or incident response team to determine what to do next Reply to the blog post and deny the accuracy of the specifications Your answer is incorrect Contact his team lead and ask what he should do next

Answer 81

Contact the service desk or incident response team to determine what to do next Explanation: OBJ 1.2: This is an example of either a data leak or a data breach. James is not sure how the website got the details of the product's specifications. Therefore, he should follow his organizational procedures for notification that internal company information has been leaked to the internet. In most organizations, the service desk acts as the single point of contact for all IT issues (even possible data breaches), and they can refer James to the incident response team (if one is currently stood up). Since James works as a programmer, it is unlikely that his team lead is responsible for handling a data leak or data breach, so it is better to contact the service desk first. James should not contact the website directly nor reply to the blog post. Instead, he should leave the response actions to the security team and the incident response team. For support or reporting issues, include Question ID: 63fe06f53b7322449ddbc7ed in your ticket. Thank you.

Question 82

Which of the following threats involves overwhelming an AI model to prevent it from making timely decisions? Prompt injection Model denial of service Training data poisoning Model inversion

Answer 82

Model denial of service Explanation OBJ 1.5: A model denial of service (DoS) attack overwhelms the AI system with excessive requests or computational tasks, rendering it unable to process legitimate inputs effectively. This impacts availability and performance. Prompt injection involves feeding malicious input to manipulate the model's output, not its availability. Training data poisoning corrupts the training data but does not directly overload the model. Model inversion focuses on extracting sensitive data, not on denial of service. For support or reporting issues, include Question ID: 674fef8fdb3fddf57c662ca3 in your ticket. Thank you.

Question 83

A cloud service provider needs to optimize its data center network for high scalability and automation. The provider requires a network design that separates the control plane from the data plane, enabling centralized management and programmability. Which of the following approaches should the provider adopt? Using a software-defined architecture to manage network traffic centrally Deploying network segmentation through virtual private networks (VPNs) Establishing dedicated hardware routes for each data flow Configuring each switch manually for specific application needs

Answer 83

Using a software-defined architecture to manage network traffic centrally Explanation: OBJ 2.6 - SDN separates the control plane from the data plane, enabling centralized management and programmability of network traffic. This makes it ideal for scalable and automated environments. VPNs and manual configurations are less efficient, and dedicated hardware routes do not provide the flexibility needed for dynamic cloud environments. For support or reporting issues, include Question ID: 674f73f425e0bdcbe9af8fb7 in your ticket. Thank you.

Question 84

Which operating system feature is designed to detect malware that is loaded early in the system startup process or before the operating system can load itself? Advanced anti-malware Startup Control Measured boot Master Boot Record analytics

Answer 84

Measured boot Explanation: OBJ 3.4: Measured boot is a feature where a log of all boot actions is taken and stored in a trusted platform module for later retrieval and analysis by anti-malware software on a remote server. Master boot record analysis is used to capture the hard disk's required information to support a forensic investigation. It would not detect malware during the system's boot-up process. Startup control would be used to determine which programs will be loaded when the operating system is initially booted, but this would be too late to detect malware loaded during the pre-startup and boot process. Advanced anti-malware solutions are programs that are loaded within the operating system. Therefore, they are loaded too late in the startup process to be effective against malicious boot sector viruses and other BIOS/UEFI malware variants. For support or reporting issues, include Question ID: 63fe07c33b7322449ddbd1fb in your ticket. Thank you.

Question 85

Tierra works as a cybersecurity analyst for a large multi-national oil and gas company. She responds to an incident at her company in which their public-facing web server has been defaced with the words, “Killers of the Arctic.” She believes this was done in response to her company’s latest oil drilling project in the Arctic Circle. Which threat actor is most likely to blame for the website defacement? APT Organized crime Hacktivist Script kiddie

Answer 85

Hacktivist Explanation: OBJ 1.4: It appears this hack was motivated by a pro-environmentalist agenda based on the message of the website defacement. This is an example of hacktivism. In 2012, five top multi-national oil companies were targeted by members of Anonymous as a form of digital protest against drilling in the Arctic, a practice that these hacktivists believe has contributed to the melting of the ice caps in that region. For support or reporting issues, include Question ID: 63fe078a3b7322449ddbcf2a in your ticket. Thank you.

Question 86

A global manufacturing company uses VPNs for remote access but faces issues with excessive trust, limited visibility, and scalability for a growing workforce. To align with Zero Trust principles and maintain secure, efficient connectivity for employees and contractors, which strategy best addresses these challenges? Use IP-based rules to manage access to internal resources after VPN authentication Replace the VPN entirely with a flat network structure to simplify remote access Enforce network access controls based solely on pre-shared keys for VPN authentication Implement always-on VPN with user and device identity verification for every session

Answer 86

Implement always-on VPN with user and device identity verification for every session Explanation: OBJ 2.6 - An always-on VPN ensures that all traffic is encrypted and connected to the enterprise network, while user and device identity verification adds an additional layer of security, aligning with Zero Trust principles. This approach addresses the excessive trust issue by validating users and devices continuously, ensuring only authorized access. Pre-shared keys lack scalability and do not provide dynamic user verification. Replacing the VPN with a flat network undermines security by removing encrypted remote access. IP-based rules are static and do not adapt to dynamic user behavior or device compliance, leaving the network vulnerable. For support or reporting issues, include Question ID: 674f6fae8a43941b3453845e in your ticket. Thank you.

Question 87

A cybersecurity analyst is reviewing the logs of a proxy server and saw the following URL: http://test.diontraining.com/../../../../etc/shadow. What type of attack has likely occurred? Directory traversal SQL injection Buffer overflow XML injection

Answer 87

Directory traversal Explanation: OBJ 4.2: This is an example of a directory traversal. A directory traversal attack aims to access files and directories that are stored outside the webroot folder. By manipulating variables or URLs that reference files with “dot-dot-slash (../)” sequences and its variations or using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code or configuration and critical system files. A buffer overflow is an exploit that attempts to write data to a buffer and exceed that buffer's boundary to overwrite an adjacent memory location. XML Injection is an attack technique used to manipulate or compromise an XML application or service's logic. SQL injection is the placement of malicious code in SQL statements via web page input. For support or reporting issues, include Question ID: 63fe07603b7322449ddbcd13 in your ticket. Thank you.

Question 88

You have been contracted to conduct a penetration test on a regional hospital chain to validate their compliance with industry standards. Which of the following should you scan for when performing this compliance-based assessment? (Select TWO) Lack of digital code signing Cookie manipulation on the client's web browser Tailgating or piggybacking into the waiting room Cleartext credentials in LDAP PHI being transmitted over HTTP Data at rest improperly configured on the database

Answer 88

PHI being transmitted over HTTP Data at rest improperly configured on the database Explanation: OBJ 1.1: While all of these may pose valid threats, this scenario is conducting a compliance-based assessment. Since this organization is a hospital, it falls under the health care industry. Health care is regulated in terms of patient privacy and the protection of their records under HIPAA. Therefore, your assessment should prioritize the PHI (personal health information) data being insecurely transmitted over HTTP and the database not properly using data at rest to protect patient data. For support or reporting issues, include Question ID: 63fe081b3b7322449ddbd651 in your ticket. Thank you.

Question 89

Raj is working to deploy a new vulnerability scanner for an organization. He wants to verify the information he gets is the most accurate view of the configurations on the organization's traveling salespeople's laptops to determine if any configuration issues could lead to new vulnerabilities. Which of the following technologies would work BEST to collect the configuration information in this situation? Non-credentialed scanning Passive network monitoring Agent-based scanning Server-based scanning

Answer 89

Agent-based scanning Explanation: OBJ 2.3: Using agent-based scanning, you typically get the most reliable results for systems that are not connected to the network, as well as the ones that are connected. This is ideal for traveling salespeople since their laptops are not constantly connected to the organization’s network. These agent-based scans can be conducted when the laptop is offline and then sent to a centralized server the next time it is connected to the network. Server-based scanning, non-credentialed scanning, and passive network monitoring require a continuous network connection to collect the devices' configurations accurately. For support or reporting issues, include Question ID: 63fe07153b7322449ddbc96f in your ticket. Thank you.

Question 90

Which of the protocols listed is NOT likely to trigger a vulnerability scan alert when used to support a virtual private network (VPN)? PPTP SSLv3 SSLv2 IPsec

Answer 90

IPsec Explanation: OBJ 4.1: IPsec is the most secure protocol that works with VPNs. The use of PPTP and SSL is discouraged for VPN security. Due to this, PPTP and SSL for a VPN will likely alert during a vulnerability scan as an issue to be remediated. For support or reporting issues, include Question ID: 63fe071a3b7322449ddbc9b9 in your ticket. Thank you.