SecurityX Practice Exam #5 (Dion)

Question 1

What type of wireless security measure can easily be defeated by a hacker by spoofing their network interface card’s hardware address?

WEP
MAC filtering
WPS
Disable SSID broadcast

Answer 1

MAC filtering

Explanation:
OBJ 2.3: Wireless access points can utilize MAC filtering to ensure only known network interface cards are allowed to connect to the network. If the hacker changes their MAC address to a trusted MAC address, they can easily bypass this security mechanism. MAC filtering is considered a good security practice as part of a larger defense-in-depth strategy, but it won’t stop a skilled hacker for long. MAC addresses are permanently burned into the network interface card by the manufacturer and serve as the device’s physical address. WEP is the Wired Equivalent Privacy encryption standard, which is considered obsolete in modern wireless networks. WEP can be broken using a brute force attack within just a few minutes by an attacker. Another security technique is to disable the SSID broadcast of an access point. While this prevents the SSID broadcast, a skilled attacker can still find the SSID using discovery scanning techniques. WPS is the WiFi Protected Setup. WPS is used to connect and configure wireless devices to an access point easily. For support or reporting issues, include Question ID: 63fe06c23b7322449ddbc579 in your ticket. Thank you.

Question 2

You are conducting an intensive vulnerability scan to detect which ports might be open to exploitation. During the scan, one of the network services becomes disabled and impacts the production server. Which of the following sources of information would provide you with the most relevant information for you to use in determining which network service was interrupted and why?

Syslog
NIDS
Firewall logs
Network mapping

Answer 2

Syslog

Explanation:
OBJ 4.1: The Syslog server is a centralized log management solution. By looking through the Syslog server’s logs, the technician could determine which service failed on which server since all the logs are retained on the Syslog server from all the network devices and servers. Network mapping is conducted using active and passive scanning techniques and could help determine which server was offline, but not what caused the interruption. Firewall logs would only help determine why the network connectivity between a host and destination may have been disrupted. A network intrusion detection system (NIDS) is used to detect hacking activities, denial of service attacks, and port scans on a computer network. It is unlikely to provide the details needed to identify why the network service was interrupted. For support or reporting issues, include Question ID: 63fe06bf3b7322449ddbc549 in your ticket. Thank you.

Question 3

Dion Training has recently set up some virtual servers in a virtual private cloud (VPC) with a cloud service provider. These servers need to connect to services outside the VPC while still preventing external services from initiating a connection with those virtual servers. Which of the following services should be implemented to meet these security requirements?

API gateway
XML gateway
VPN gateway
NAT gateway

Answer 3

NAT gateway

Explanation:
OBJ 2.5: A NAT Gateway within a cloud platform allows private subnets in a Virtual Private Cloud (VPC) access to the Internet. You can use a NAT gateway so that instances in a private subnet can connect to services outside your VPC but external services cannot initiate a connection with those instances. A VPN gateway is a type of networking device that connects two or more devices or networks in a VPN infrastructure. It is designed to bridge the connection or communication between two or more remote sites, networks, or devices and/or to connect multiple VPNs. An extensible markup language (XML) gateway acts as an application layer firewall specifically to monitor XML formatted messages as they enter or leave a network or system. An XML gateway is used for inbound pattern detection and the prevention of outbound data leaks. XML is a document structure that is both human and machine-readable. Information within an XML document is placed within tags that describe how the information within the document is structured. Application programming interface (API) gateway is a special cloud-based service that is used to centralize the functions provided by APIs. An API is a type of software interface that offers a service to other pieces of software to build or connect to specific functions or features. For support or reporting issues, include Question ID: 63fe06e73b7322449ddbc73e in your ticket. Thank you.

Question 4

The Pass Certs Fast corporation has recently been embarrassed by several high-profile data breaches. The CIO proposes improving the company’s cybersecurity posture by migrating images of all the current servers and infrastructure into a cloud-based environment. What, if any, is the flaw in moving forward with this approach?

This approach only changes the location of the network and not the network’s attack surface
This is a reasonable approach that will increase the security of the servers and infrastructure
The company has already paid for the physical servers and will not fully realize their ROI on them due to the migration
This approach assumes that the on-site administrators will provide better security than the cloud provider

Answer 4

This approach only changes the location of the network and not the network’s attack surface

Explanation:
OBJ 2.5: A poorly implemented security model at a physical location will still be a poorly implemented security model in a virtual location. Unless the fundamental causes of the security issues that caused the previous data breaches have been understood, mitigated, and remediated, then migrating the current images into the cloud will change where the processing occurs without improving the network’s security. While the statement concerning unrealized ROI may be accurate, it simply demonstrates the sunk cost argument’s fallacy. These servers were already purchased, and the money was spent. Regardless of whether we maintain the physical servers or migrate to the cloud, that money is gone. Those servers could also be repurposed, reused, or possibly resold to recoup some of the capital invested. While the company’s physical security will potentially improve in some regards, the physical security of the endpoints on-premises is still a concern that cannot be solved by this cloud migration. Additionally, the scenario never stated that physical security was an issue that required being addressed, so it is more likely that the data breach occurred due to a data exfiltration over the network. As a cybersecurity analyst, you must consider the business case and the technical accuracy of a proposed approach or plan to add the most value to your organization. For support or reporting issues, include Question ID: 63fe07f33b7322449ddbd45a in your ticket. Thank you.

Question 5

What should a vulnerability report include if a cybersecurity analyst wants it to reflect the assets scanned accurately?

Organizational governance
Processor utilization
Virtual hosts
Log disposition

Answer 5

Virtual hosts

Explanation:
OBJ 3.6: Vulnerability reports should include both the physical hosts and the virtual hosts on the target network. A common mistake of new cybersecurity analysts is to include physical hosts, thereby missing many network assets. For support or reporting issues, include Question ID: 63fe072e3b7322449ddbcab1 in your ticket. Thank you.

Question 6

A cybersecurity analyst is reviewing the logs of a proxy server and saw the following URL,

http://test.diontraining.com/?param=<data:text/html;base64,PHNjcmlwdD5hbGVydCgnSSBsb3ZlIERpb24gVHJhaW5pbmcnKTwvc2NyaXB0Pg==.

What type of attack was attempted?

Password spraying
SQL injection
XML injection
XSS

Answer 6

XSS

Explanation:
OBJ 4.2: This is an example of a URL-based XSS (cross-site scripting) attack. A cross-site scripting attack uses a specially crafted URL that includes attack code that will cause information that users enter into their web browser to be sent to the attacker. In this example, everything from ?param onward is part of the attack. You can see the base64 encoded string of PHNjcmlwdD5hbGVydCgnSSBsb3ZlIERpb24gVHJhaW5pbmcnKTwvc2NyaXB0Pg== being used. While you could not convert it during the exam without a base64 decoder, you should be able to tell that it is not a SQL injection nor an XML injection based on your studies. It is also not an attempt to conduct password spraying by logging into different usernames with the same password. So, by process of elimination, you can determine this is an XSS attack. If you did have a base64 decoder, you would have found that the parameter being passed would translate to , which is a simple method to cause your web browser to create a popup that displays the text “I love Dion Training.” If you attempt to load this URL in your browser, it may or may not function depending on your browser’s security. For support or reporting issues, include Question ID: 63fe07393b7322449ddbcb33 in your ticket. Thank you.

Question 7

In which phase of the security intelligence cycle is published information relevant to security issues provided to those who need to act on that information?

Feedback
Analysis
Collection
Dissemination

Answer 7

Dissemination

Explanation:
OBJ 4.3: The dissemination phase refers to publishing information produced by analysis to consumers who need to develop the insights. The collection phase is usually implemented by administrators using various software suites, such as security information and event management (SIEM). This software must be configured with connectors or agents that can retrieve data from sources such as firewalls, routers, IDS sensors, and servers. The analysis phase focuses on converting collected data into useful information or actionable intelligence. The final phase of the security intelligence cycle is feedback and review, which utilizes both intelligence producers’ and intelligence consumers’ input. This phase aims to improve the implementation of the requirements, collection, analysis, and dissemination phases as the life cycle is developed. For support or reporting issues, include Question ID: 63fe07643b7322449ddbcd4f in your ticket. Thank you.

Question 8

A system administrator wants to verify that external IP addresses cannot collect software versioning from servers on the network. Which of the following should the system administrator do to confirm the network is protected?

Utilize netstat to locate active connections
Use Nmap to query known ports
Review the ID3 logs on the network
Analyze packet captures

Answer 8

Analyze packet captures

Explanation:
OBJ 4.2: Packet captures contain every packet that is sent and received by the network. By using a program like Wireshark to analyze the packet captures, you can see what kind of information and metadata is contained within the packets. By conducting this type of packet analysis, an attacker (or cybersecurity analyst) can determine if software versions are being sent as part of the packets and their associated metadata. For support or reporting issues, include Question ID: 63fe06c83b7322449ddbc5bb in your ticket. Thank you.

Question 9

You are working as part of a penetration team that is assessing the security of a java-based practice exam application for Dion Training. You want to perform static code analysis on the application, but you don’t have the source code. Luckily, you were able to download a copy of the Java bytecode. Which of the following techniques should you utilize to get the bytecode ready for running through a static code analysis tool?

Decompile the application with JAD
Use a debugger like GDB to reverse engineer it
Brute force the source code using Hydra
Use Peach to conduct fuzzing

Answer 9

Decompile the application with JAD

Explanation:
OBJ 4.4: To conduct a static analysis, you need to have the source code. Since the company didn’t provide it, you can use the Java bytecode (binary) and a decompiler to create the source code. JAD is a Java Application Decompiler. Brute forcing the application with hydra wouldn’t provide you with the source code. It would only provide a password. Debuggers can be useful, but they will return bytecode level information and not source code. Peach is a great fuzzing tool, but fuzzing is a dynamic technique and not a static one. For support or reporting issues, include Question ID: 63fe07533b7322449ddbcc73 in your ticket. Thank you.

Question 10

You are working as a network administrator for Dion Training. The company has decided to allow employees to connect their devices to the corporate wireless network under a new BYOD policy. You have been asked to separate the corporate network into an administrative network (for corporate-owned devices) and an untrusted network (for employee-owned devices). Which of the following technologies should you implement to achieve this goal?

VLAN
WPA2
VPN
MAC filtering

Answer 10

VLAN

Explanation:
OBJ 2.6: A virtual local area network (VLAN) is a type of network segmentation configured in your network switches that prevent communications between different VLANs without using a router. This allows two virtually separated networks to exist on one physical network and separates the two virtual network’s data. A virtual private network (VPN) is a remote access capability to connect a trusted device over an untrusted network back to the corporate network. A VPN would not create the desired effect. WPA2 is a type of wireless encryption, but it will not create two different segmented networks on the same physical hardware. MAC filtering is used to allow or deny a device from connecting to a network, but it will not create two network segments, as desired. For support or reporting issues, include Question ID: 63fe06d83b7322449ddbc680 in your ticket. Thank you.

Question 11

Which of the following exploitation frameworks contain plugins that can trigger buffer overflows in SCADA systems, such as /exploit/windows/scada/daq_factory_bof that can trigger a stack overflow by sending excessive requests to a service port on the system?

Androzer
Nikto
Metasploit
Nessus

Answer 11

Metasploit

Explanation:
OBJ 3.5: Metasploit is an open-source exploitation framework that uses plugins to add different exploits and functionalities. They are always in the form of a directory structure, like /exploit/windows/scada/daq_factory_bof. This represents the plugin type (exploit), the operating system involved (windows), the service/program (scada), and the specific exploit (daq_factory_bof). If you see this format in a question, the answer is most likely related to Metasploit. For support or reporting issues, include Question ID: 63fe07763b7322449ddbce2b in your ticket. Thank you.

Question 12

A new piece of malware attempts to exfiltrate user data by hiding the traffic and sending it over a TLS-encrypted outbound traffic over random ports. What technology would be able to detect and block this type of traffic?

Intrusion detection system
Stateless packet inspection
Stateful packet inspection
Application-aware firewall

Answer 12

Application-aware firewall

Explanation:
OBJ 4.2: A web application firewall (WAF) or application-aware firewall would detect both the accessing of random ports and TLS encryption and identify it as suspicious. An application-aware firewall can make decisions about what applications are allowed or blocked by a firewall, and TLS connections are created and maintained by applications. A stateless packet inspection firewall allows or denies packets into the network based on the source and destination IP address or the traffic type (TCP, UDP, ICMP, etc.). A stateful packet inspection firewall monitors the active sessions and connections on a network. The process of stateful inspection determines which network packets should be allowed through the firewall by utilizing the information it gathered regarding active connections as well as the existing ACL rules. Neither a stateless nor stateful inspection firewall operates at layer 6 or layer 7, so they cannot inspect TLS connections. An intrusion detection system (IDS) is a device or software application that monitors a network or systems for malicious activity or policy violations. An IDS only monitors the traffic on the network, it cannot block traffic. For support or reporting issues, include Question ID: 63fe06df3b7322449ddbc6d5 in your ticket. Thank you.

Question 13

The Security Operations Center Director for Dion Training received a pop-up message on his workstation that said, “You will regret firing me; just wait until Christmas!” He suspects the message came from a disgruntled former employee who may have set up a piece of software to create this pop-up on his machine. The director is now concerned that other code might be lurking within the network that could negatively affect Christmas. He directs his team of cybersecurity analysts to begin searching the network for this suspicious code. What type of malware should they be searching for?

Adware
Trojan
Logic bomb
Worm

Answer 13

Logic bomb

Explanation:
OBJ 1.4: A logic bomb is a piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met. For example, a programmer may hide a piece of code that starts deleting files should they ever be terminated from the company. The director is concerned that a logic bomb may have been created and installed on his system or across the network before the analyst was fired. For support or reporting issues, include Question ID: 63fe078a3b7322449ddbcf25 in your ticket. Thank you.

Question 14

An analyst reviews a triple-homed firewall configuration that connects to the internet, a private network, and one other network. Which of the following would best describe the third network connected to this firewall?

Staging environment
Availability zone
Data zone
Screened subnet

Answer 14

Screened subnet

Explanation:
OBJ 2.3: A triple-homed firewall connects to three networks internal (private), external (internet/public), and a screened subnet (formerly called a demilitarized zone or DMZ). The screened subnet is used to host systems that require access from external hosts. Data zones describe the state and location of data to help isolate and protect it from unauthorized/inappropriate use-for example, as data transitions from raw storage, processing, production, and analytical use. Data zones are associated with data lakes and designed to help manage big data used by analysts and scientists for data exploration and discovery tasks. An availability zone is an individual data center within a region of a cloud service provider’s network. A staging environment is a pre-production enclave used for testing and development. For support or reporting issues, include Question ID: 63fe06bd3b7322449ddbc535 in your ticket. Thank you.

Question 15

Which of the following vulnerabilities is the greatest threat to data confidentiality?

HTTP TRACE/TRACK methods enabled
Web application SQL injection vulnerability
phpinfo information disclosure vulnerability
Your answer is incorrect
SSL Server with SSLv3 enabled vulnerability

Answer 15

Web application SQL injection vulnerability

Explanation:
OBJ 1.2: Each vulnerability mentioned poses a significant risk, but the greatest threat comes from the SQL injection. An SQL injection could allow an attacker to retrieve our data from the backend database directly. Using this technique, the attacker could also alter the data and put it back, and nobody would notice everything that had been changed, thereby also affecting our data integrity. The HTTP TRACE/TRACK methods are normally used to return the full HTTP request to the requesting client for proxy-debugging purposes and allow the attacker to access sensitive information in the HTTP headers. Since this only exposes information in the headers, it minimizes the risk to our system’s data confidentiality. An SSL server with SSLv3 enabled is not ideal since this is an older encryption type, but it still provides some confidentiality. The phpinfo information disclosure vulnerability prints out detailed information on both the system and the PHP configuration. This information by itself doesn’t disclose any information about the data stored within the system, though, so it isn’t a great threat to our data’s confidentiality. For support or reporting issues, include Question ID: 63fe07813b7322449ddbceb2 in your ticket. Thank you.

Question 16

An organization is migrating critical workloads to a multi-cloud environment and seeks a framework to ensure consistent security practices across all cloud service providers. Which framework is BEST suited for this purpose?

CSA
NIST CSF
COBIT
ISO 27001

Answer 16

CSA

Explanation:
OBJ 1.3: The Cloud Security Alliance (CSA) framework provides specific standards and best practices tailored to securing cloud environments, making it ideal for organizations operating in multi-cloud scenarios. Control Objectives for Information and Related Technologies (COBIT) focuses on IT governance; International Organization for Standardization (ISO) 27001 emphasizes general information security management; and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) offers a broader cybersecurity framework; CSA uniquely addresses the challenges and requirements of cloud security. For support or reporting issues, include Question ID: 674ea7608e7b1e20aff2f095 in your ticket. Thank you.

Question 17

Dion Training has submitted a new application to the App Store for distribution. Before submitting the app, the developers conducted both static and dynamic analysis to reduce or eliminate the number of known vulnerabilities in the application. The application was completed and a digital certificate was attached to the application during distribution to signify that it was written and published by “Dion Training Solutions, LLC”. When the user downloads the app, their device will conduct an integrity check using a hash and comparing it to the one included in the digital certificate they received. Which of the following certificate use cases is described by this scenario?

Server authentication
Client authentication
Code signing
Digital signature

Answer 17

Code signing

Explanation:
OBJ 3.8: Code signing is a method of using a digital signature to ensure the source and integrity of programming code. If a valid code signature exists, this indicates that the code has not been changed or modified since being released by the code’s author or publisher. A digital signature is created by encrypting the hash digest with the sender’s private key. For example, when digitally signing an email, the email is first hashed and then the hash is encrypted with the private key of the sender to prove its integrity and non-repudiation when sent. Client authentication describes the mechanism by which a server can verify that a connection request is originating from a preauthorized endpoint. Client authorization is commonly used by SSH servers by storing a local copy of a client’s public SSH key on the SSH server and using this to authorize the client during a connection. Server authentication is utilized by a client device when the client establishes that the server is genuine. For example, when visiting a new website, a client will use the web server’s digital certificate and public key to authenticate that the server they connected to is legitimate. For support or reporting issues, include Question ID: 63fe07a63b7322449ddbd092 in your ticket. Thank you.

Question 18

A cybersecurity team discovers malware in their network that exploits a previously unknown software vulnerability. Further analysis reveals that the exploit was created by an AI tool capable of identifying weaknesses and generating attack code autonomously. What type of AI-enabled attack does this scenario represent?

AI pipeline injection compromising system defenses
AI-driven social engineering for network access
Deep fake automation designed for malware delivery
Automated exploit generation targeting zero-day vulnerabilities

Answer 18

Automated exploit generation targeting zero-day vulnerabilities

Explanation:
OBJ 1.5 - This scenario describes automated exploit generation, where AI tools are used to identify and exploit vulnerabilities, particularly zero-day flaws. Unlike social engineering or deep fakes, this approach focuses on creating attack code for system breaches. AI pipeline injection refers to disrupting AI workflows, which is unrelated to exploiting software vulnerabilities. For support or reporting issues, include Question ID: 674f5e5fbe11e784309a2989 in your ticket. Thank you.

Question 19

A financial services company wants to donate some old Self-Encrypting Drives (SEDs) from their servers to a local charity. Still, they are concerned about the possibility of residual data being left on the drives. Which of the following methods is the best and most efficient option you should recommend they use to ensure data is completely unrecoverable?

Zero-fill
Cryptographic erase
Secure erase
Overwrite

Answer 19

Cryptographic erase

Explanation:
OBJ 3.8: A cryptographic erase is the most efficient and secure method for sanitizing Self-Encrypting Drives (SEDs). This method involves changing the encryption key used to encrypt the data on the drive, making all existing data unreadable. It is quick and provides high assurance that no residual data remains accessible​​​​. Secure erase is an effective method for completely erasing data by overwriting every block, it is not specifically designed for SEDs and can be more time-consuming compared to cryptographic erase. Zero-filling, or writing zeros to all sectors of a drive, can make data recovery difficult, but it is not as secure as cryptographic erase for SEDs and can be a lengthy process. Overwriting data multiple times can reduce the risk of data recovery, but it is a less efficient and less secure method compared to cryptographic erase for SEDs. Multiple passes are often required to ensure data is unrecoverable, making this method time-consuming and less reliable for high-security needs​​. For support or reporting issues, include Question ID: 63fe07f13b7322449ddbd43c in your ticket. Thank you.

Question 20

What sanitization technique uses only logical techniques to remove data, such as overwriting a hard drive with a random series of ones and zeroes?

Purge
Degauss
Destroy
Clear

Answer 20

Clear

Explanation:
OBJ 2.4: Clear applies logical techniques to sanitize data in all user-addressable storage locations for protection against simple non-invasive data recovery techniques. Clearing involves overwriting data once (and seldom more than three times) with repetitive data (such as all zeros) or resetting a device to factory settings. Purging data is meant to eliminate information from being feasibly recovered even in a laboratory environment. Destroy requires physical destruction of the media, such as pulverization, melting, incineration, and disintegration. Degaussing is the process of decreasing or eliminating a remnant magnetic field. Degaussing is an effective method of sanitization for magnetic media, such as hard drives and floppy disks. For support or reporting issues, include Question ID: 63fe08103b7322449ddbd5c7 in your ticket. Thank you.

Question 21

Which of the following best describes the role of Security Assertions Markup Language (SAML) in an enterprise authentication and authorization system?

It enables SSO for secure authentication
It verifies devices using certificate-based authentication
It helps enforce MFA policies
It encrypts user credentials during transmission

Answer 21

It enables SSO for secure authentication

Explanation:
OBJ 3.1 - SAML facilitates single sign-on (SSO) by allowing authentication and authorization data to be securely exchanged between an identity provider (a central authentication system) and a service provider (a web application). While encryption, MFA, and certificate-based authentication are important for security, they are not specific to the role of SAML. Instead, SAML focuses on enabling seamless access to multiple services through a single authentication process. For support or reporting issues, include Question ID: 674f749a25e0bdcbe9af8fc2 in your ticket. Thank you.

Question 22

Jamie’s organization is attempting to budget for the next fiscal year. Jamie has calculated that the asset value of a database server is $120,000. Based on her analysis, she believes that a data breach to this server will occur once every four years and has a risk factor is 30%. What is the ALE for a data breach within Jamie’s organization?

$36,000
$360,000
$90,000
$9,000

Answer 22

$9,000

Explanation:
OBJ 1.2: The single loss expectancy (SLE) is the amount that would be lost in a single occurrence (AV) times the exposure factor (EF). The annual loss expectancy (ALE) is the total cost of a risk to an organization annually. This is determined by multiplying the SLE by the annual rate of occurrence (ARO).

SLE = AV x RF = $120,000 x 30% = $36,000
ALE = SLE x ARO = $36,000 x 0.25 = $9,000

For support or reporting issues, include Question ID: 63fe081a3b7322449ddbd63f in your ticket. Thank you.

Question 23

Which type of monitoring would utilize a network tap?

Passive
SNMP
Router-based
Active

Answer 23

Passive

Explanation:
OBJ 4.1: Network taps are devices that allow a copy of network traffic to be captured for analysis. They conduct passive network monitoring and visibility without interfering with the network traffic itself. Active monitoring relies on scanning targeted systems, not a network tap. Router-based monitoring would involve looking over the router’s logs and configuration files. SNMP is used to monitor network devices but is considered active monitoring and doesn’t rely on network taps. For support or reporting issues, include Question ID: 63fe06ea3b7322449ddbc766 in your ticket. Thank you.

Question 24

Dion Training wants to implement a software-defined network while adding new devices to their enterprise network. The company doesn’t want to abandon its currently installed network devices as it expands its network, though. Which of the following approaches to implementing a software-defined network should Dion Training utilize to best combine their current and future networks using SDN?

Open SDN
SDN Overlay
Hybrid SDN
Peering SDN

Answer 24

Hybrid SDN

Explanation:
OBJ 2.5: Hybrid SDN uses a combination of traditional and software-defined networks in the same environment to achieve its objectives. Open SDN uses open standards and open-source software as a strategy to reduce the risks of vendor lock-in. SDN Overlay allows the use of software to create and manage new virtual networks which leverage your existing hardware. All network management and configuration is performed using software and new virtual networking devices are defined within that software. This virtualized overlay moves the data across the existing physical network devices, but that hardware no longer is directly configured or managed by administrators. Peering SDN is not a real type of SDN and is therefore incorrect. For support or reporting issues, include Question ID: 63fe06e43b7322449ddbc71b in your ticket. Thank you.

Question 25

During your review of the firewall logs, you notice that an IP address from within your company’s server subnet had been transmitting between 125 to 375 megabytes of data to a foreign IP address overnight each day. You have determined this has been occurring for approximately 5 days, and the affected server has since been taken offline for forensic review. Which of the following is MOST likely to increase the impact assessment of the incident? PII of company employees and customers was exfiltrated Forensic review of the server required fallback to a less efficient service IP addresses and other network-related configurations were exfiltrated Raw financial information about the company was accessed

Answer 25

PII of company employees and customers was exfiltrated Explanation: OBJ 1.2: If the PII (Personally Identifiable Information) of the company’s employees or customers were exfiltrated or stolen during the compromise, this would increase the incident's impact assessment. Loss of PII is a big issue for corporations and one that might garner media attention. While all of the options presented here are bad things that could increase the impact of the assessment, loss of PII is considered the MOST likely to increase the impact dramatically. Depending on the company's size or organization, there may also be mandatory reporting requirements, fines, or restitution that must be paid. For support or reporting issues, include Question ID: 63fe071b3b7322449ddbc9c4 in your ticket. Thank you.

Question 26

A healthcare organization must store large volumes of sensitive patient data in its on-premises database. Due to compliance requirements such as HIPAA, the data must be protected against unauthorized access and theft, even in the event of a physical breach of the servers. The IT team is tasked with implementing a cryptographic solution to ensure confidentiality while maintaining efficient access for authorized users. Which cryptographic technique should be applied? Symmetric encryption TLS Digital signatures Tokenization

Answer 26

Symmetric encryption Explanation: OBJ 3.8: Symmetric encryption is efficient and effective for securing data at rest by encrypting it with a single key that can be securely managed. Transport Layer Security (TLS) secures data in transit, not storage. Digital signatures provide data authenticity and integrity checks but do not encrypt the data. Tokenization replaces sensitive data with tokens but does not encrypt the underlying data. For support or reporting issues, include Question ID: 6751b350fd8b34c81216adbc in your ticket. Thank you.

Question 27

An independent cybersecurity researcher has contacted your company to prove a buffer overflow vulnerability exists in one of your applications. Which technique would have been most likely to identify this vulnerability in your application during development? Manual Peer Review Static code analysis Pair programming Dynamic code analysis

Answer 27

Static code analysis Explanation: OBJ 2.2: Buffer overflows are most easily detected by conducting a static code analysis. Manual peer review or pair programming methodologies might have been able to detect the vulnerability. Still, they do not have the same level of success as a static code analysis using proper tools. DevSecOps methodology would also improve the likelihood of detecting such an error but still rely on human-to-human interactions and human understanding of source code to detect the fault. Dynamic code analysis also may have detected this if the test found exactly the right condition. Still, again, a static code analysis tool is designed to find buffer overflows more effectively. For support or reporting issues, include Question ID: 63fe07073b7322449ddbc8c4 in your ticket. Thank you.

Question 28

Marta's organization is concerned with the vulnerability of a user's account being vulnerable for an extended period of time if their password was compromised. Which of the following controls should be configured as part of their password policy to minimize this vulnerability? Password expiration Minimum password length Password history Password complexity

Answer 28

Password expiration Explanation: OBJ 3.1: A password expiration control in the policy would force users to change their passwords at specific time intervals. This will then lock out a user who types in the incorrect password or create an alter that the user's account has been potentially compromised. While the other options are good components of password security to prevent an overall compromise, they are not effective against the vulnerability described in this particular scenario. It states the issue is based on time. Password history is used to determine the number of unique passwords a user must use before using an old password again. Passwords must meet complexity requirements. The policy setting determines whether passwords must meet a series of guidelines that are considered important for a strong password. Maximum password length creates a limit to how long the password can be, but a longer password is considered stronger against a brute force attack. For support or reporting issues, include Question ID: 63fe06ec3b7322449ddbc77f in your ticket. Thank you.

Question 29

A security team finds unauthorized devices connected to several workstations in their environment. These devices were identified as malicious tools capable of injecting keystrokes to execute commands on the systems. Which TTP best describes this attack? USB-based attack Lateral movement Shimming Credential dumping

Answer 29

USB-based attack Explanation: OBJ 3.4: USB-based attacks involve using malicious USB devices to exploit systems, such as injecting keystrokes or executing malware. Credential dumping targets stored credentials, not hardware interfaces. Shimming manipulates the communication between software and hardware, while lateral movement refers to spreading within a network after initial compromise. For support or reporting issues, include Question ID: 6751aef62f8fe131b6ff6d0e in your ticket. Thank you.

Question 30

Your company explicitly obtains permission from its customers to use their email address as an account identifier in its CRM. Max, who works at the marketing department in the company's German headquarters, just emailed all their customers to let them know about a new sales promotion this weekend. Which of the following privacy violations has occurred, if any? There was no privacy violation because only corporate employees had access to their email addresses There was a privacy violation since the customers explicitly gave permission to use the email address as an identifier and did not consent to receive marketing emails There was no privacy violation since the customers were emailed securely through the customer relationship management tool There was a privacy violation since data minimization policies were not followed properly

Answer 30

There was a privacy violation since the customers explicitly gave permission to use the email address as an identifier and did not consent to receive marketing emails Explanation: OBJ 1.3: According to the European Union's General Data Protection Regulation (GDPR), personal data collected can only be used for the exact purpose in which explicit consent was obtained. To use email addresses for marketing purposes, separate explicit consent should have been obtained. Since the company operates in Germany, it must follow the GDPR privacy standard. Even if a company doesn't operate within the European Union, its customers might be European Union citizens, and therefore the company should still optional follow the GDPR guidelines. While data minimization is a good internal policy to utilize, not following it doesn't equate to a privacy violation or breach. Data minimization is the principle that data should only be processed and stored, if necessary, to perform the purpose for which it is collected. The option concerning the customer relationship management (CRM) tool is a distractor since the issue is using the data in ways that were not consented to by the customer, not which system the email was sent through. A privacy violation can occur when corporate employees view data if those employees do not have a need to know, a valid business requirement to use the data, or consent from the customer to use the data for a specific purpose (as was the case in this scenario). For support or reporting issues, include Question ID: 63fe07f43b7322449ddbd45f in your ticket. Thank you.

Question 31

During the rollout of a NAC system, an organization discovers that many legacy devices cannot support the required agents for posture validation. The organization must maintain security while accommodating these devices. What is the most appropriate action to take in this scenario? Segment legacy devices into a separate network with restricted access Replace all legacy devices with compliant alternatives Use role-based NAC to authenticate legacy devices without validating posture Exclude legacy devices from NAC policies to avoid disruptions

Answer 31

Segment legacy devices into a separate network with restricted access Explanation: OBJ 2.1: Segmenting legacy devices into a restricted network ensures they do not pose a security risk to the main network while still allowing limited functionality. This approach balances security with the operational need to accommodate legacy systems. Excluding legacy devices from NAC policies exposes the network to potential risks. Replacing all legacy devices may be cost-prohibitive and impractical for many organizations. Role-based NAC does not address the security concerns posed by legacy devices' lack of posture validation. For support or reporting issues, include Question ID: 6750f4c6ec280b7d2c7fa257 in your ticket. Thank you.

Question 32

An enterprise plans to secure its network by defining security boundaries around critical system components. Which of the following actions best aligns with this goal? Allowing direct communication between system components to reduce latency Isolating components based on their function and sensitivity, with strict access controls between zones Assigning static IP addresses to all components for better visibility and control Consolidating all system components into a single virtual private network (VPN) for simplicity and better management

Answer 32

Isolating components based on their function and sensitivity, with strict access controls between zones Explanation: OBJ 2.6 - Creating security boundaries by isolating components based on their function and sensitivity ensures that access is limited to authorized users and systems. Consolidating components into a single VPN or allowing unrestricted communication increases the attack surface. Static IP addresses provide visibility but do not contribute to establishing security boundaries. For support or reporting issues, include Question ID: 674f721cbe598e99e87d620a in your ticket. Thank you.

Question 33

Holly Elves, an e-commerce company, experiences a sudden spike in traffic during a holiday sale event. Their current infrastructure is struggling to handle the load, leading to slow page load times and intermittent outages. The IT team is considering scaling the system to ensure availability and maintain performance. Which of the following approaches should the IT team implement to address the traffic surge while maintaining system availability and integrity? Implement a caching mechanism to delay request processing Add more powerful servers to the existing infrastructure (vertical scaling) Distribute the traffic across additional servers in a cluster (horizontal scaling) Redirect traffic to a centralized data center with higher capacity

Answer 33

Distribute the traffic across additional servers in a cluster (horizontal scaling) Explanation: OBJ 2.1 - Horizontal scaling, which involves adding more servers to distribute the traffic, is ideal for handling sudden spikes in demand. This approach enhances both availability and integrity by preventing overload on individual servers and providing redundancy. Vertical scaling (adding more powerful servers) has limitations due to hardware constraints and single points of failure. Redirecting traffic to a centralized data center does not address the scaling issue, and caching mechanisms can reduce load but do not ensure sustained availability under high traffic. For support or reporting issues, include Question ID: 674f681aaccd77bad2095011 in your ticket. Thank you.

Question 34

Sweet Technologies is a company that uses an alerting system integrated with its SIEM platform. Recently, their security team received hundreds of alerts, including several for low-priority issues, such as failed login attempts from internal IPs. Critical alerts, such as repeated login attempts from foreign IP addresses, were overlooked due to the sheer volume of notifications. What should the security team implement to address this problem? Automated alert suppression for low-priority events Increased frequency of system audits Extended retention of alert data Continuous logging of all user and network activity

Answer 34

Automated alert suppression for low-priority events Explanation: OBJ 4.1: Automated alert suppression filters out low-priority events, reducing alert fatigue and helping security teams focus on critical issues. Continuous logging is important for analysis but does not prioritize alerts. Extended retention of alert data is useful for historical analysis but does not address immediate prioritization. System audits help maintain security but do not directly resolve issues with alert management. For support or reporting issues, include Question ID: 6751b7ae9192dec49e1159c9 in your ticket. Thank you.

Question 35

A cybersecurity analyst has deployed a custom DLP signature to alert on any files that contain numbers in the format of a social security number (xxx-xx-xxxx). Which of the following concepts within DLP is being utilized? Exact data match Classification Statistical matching Document matching

Answer 35

Exact data match Explanation: OBJ 4.1: An exact data match (EDM) is a pattern matching technique that uses a structured database of string values to detect matches. For example, a company might have a list of actual social security numbers of its customers. But, since it is not appropriate to load these numbers into a DLP filter, they could use EDM to match the numbers' fingerprints instead based on their format or sequence. Document matching attempts to match a whole document or a partial document against a signature in the DLP. Statistical matching is a further refinement of partial document matching that uses machine learning to analyze various data sources using artificial intelligence or machine learning. Classification techniques use a rule based on a confidentiality classification tag or label attached to the data. For example, the military might use a classification-based DLP to search for any files labeled as secret or top secret. For support or reporting issues, include Question ID: 63fe06c23b7322449ddbc56f in your ticket. Thank you.

Question 36

Dion Training is trying to register for a new digital certificate for a newly deployed webserver. The technician has filled out the certificate enrollment template but each time they attempt to submit it they receive the “operation failed” error. Which of the following is MOST likely causing this error? Cipher mismatch error Incorrect permissions Wrong certificate type Chain issues

Answer 36

Incorrect permissions Explanation: OBJ 3.1: An incorrect permissions error is generated when a template is used for certificate enrollment but the template’s permissions are misconfigured. This can result in a “cannot enroll for this type of certificate” or an “operation failed” error. A cipher mismatch error is generated by a modern web browser if an old or deprecated cipher suite is being requested for use by the webserver. Alternatively, this error can also occur if the client is using an older operating system that doesn’t support a more modern cipher suite. Chain issues occur when the root, subordinate, or leaf certificate fails to pass a validity check. Since the certificate authorities must all pass the validity checks for the certification issued to be considered valid, if any of these are invalid then the entire chain is considered invalid, too. A wrong certificate type error is generated when a certificate designed for a specific use case is used for a different reason. For example, if a user attempts to log in to a website using an email certificate instead of an identification certificate, a wrong certificate type error will be generated. For support or reporting issues, include Question ID: 63fe07a83b7322449ddbd0ac in your ticket. Thank you.

Question 37

Which analysis framework provides the most explicit detail regarding how to mitigate or detect a given threat? OpenIOC Diamond Model of Intrusion Analysis Lockheed Martin cyber kill chain MITRE ATT&CK framework

Answer 37

MITRE ATT&CK framework Explanation: OBJ 1.4: The MITRE ATT&CK framework provides explicit pseudo-code examples for detecting or mitigating a given threat within a network and ties specific behaviors back to individual actors. The Diamond Model provides an excellent methodology for communicating cyber events and allowing an analyst to implicitly derive mitigation strategies. The Lockheed Martin cyber kill chain provides a general life cycle description of how attacks occur but does not deal with the specifics of how to mitigate them. OpenIOC contains a depth of research on APTs but does not integrate the detection and mitigation strategy. For support or reporting issues, include Question ID: 63fe07233b7322449ddbca25 in your ticket. Thank you.

Question 38

An increased amount of web traffic to an e-commerce server is observed by a network administrator but without increasing the number of financial transactions. Which kind of attack might the company be experiencing? ARP spoofing Phishing Bluejacking DoS

Answer 38

DoS Explanation: OBJ 4.2: A DoS attack or denial-of-service attack works by overloading a server with multiple requests (more than it can handle), thus eventually knocking the server offline. When a denial-of-service attack occurs, there will be an increase in the amount of web traffic on the server, but since that traffic is not being sent by legitimate customers there will be no financial transactions occurring. ARP spoofing is a type of attack in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network. This results in the linking of an attacker's MAC address with the IP address of a legitimate computer or server on the network. Phishing is a type of social engineering where an attacker sends a fraudulent email designed to trick a human victim into revealing sensitive information to the attacker or to deploy malicious software on the victim's infrastructure like ransomware. Bluejacking is the sending of unsolicited messages over Bluetooth to Bluetooth-enabled devices such as mobile phones, PDAs, or laptop computers, sending a vCard which typically contains a message in the name field to another Bluetooth-enabled device via the OBEX protocol. For support or reporting issues, include Question ID: 63fe078d3b7322449ddbcf48 in your ticket. Thank you.

Question 39

NA

Question 40

Dion Training is drafting a new business continuity plan and is trying to determine the appropriate metric to utilize in defining the recovery requirements for their practice exam web application. This application is used by all of Dion Training’s students to prepare for their upcoming certification exams. The Chief Operating Officer (COO) has decided that she can only accept a maximum downtime of 8 hours when an incident occurs. Which of the following metrics best defines this 8-hour timeframe? Mean time to recovery (MTTR) Recovery service level (RSL) Recovery point objective (RPO) Recovery time objective (RTO)

Answer 40

Recovery time objective (RTO) Explanation: OBJ 1.1: The COO has defined the recovery time objective as 8 hours. The recovery time objective defines the maximum amount of time that performing a recovery can take and the service can be offline. The recovery point objective defines the maximum amount of data that can be lost without irreparable harm to the operation of the business. The recovery service level is the minimum acceptable amount of services that must be restored for a given system to consider it recovered. For example, your organization may need to restore its databases and websites to meet its recovery service level objectives while leaving its print servers offline since they may not be considered a mission-essential function in your organization. The mean time to recovery is the average amount of downtime calculated based on when a service or device fails and when its functionality is restored. For support or reporting issues, include Question ID: 63fe07fc3b7322449ddbd4c8 in your ticket. Thank you.

Question 41

In 2014, Apple's implementation of SSL had a severe vulnerability that, when exploited, allowed an attacker to gain a privileged network position that would allow them to capture or modify data in an SSL/TLS session. This was caused by poor programming in which a failed check of the connection would exit the function too early. Based on this description, what is this an example of? Insufficient logging and monitoring Insecure object reference Use of insecure functions Improper error handling

Answer 41

Improper error handling Explanation: OBJ 4.2: This is an example of an improper error handling vulnerability. A well-written application must be able to handle errors and exceptions gracefully. The main goal must be for the application not to fail and allow the attacker to execute code or perform an injection attack. One famous example of an improper error handling vulnerability is Apple's GoTo bug, as described above. For more details on this particular vulnerability, please see CVE-2014-1266. Insecure object reference refers to when a reference to an internal implementation object, such as a file or database key, is exposed to users without any other access control. Insufficient logging and monitoring allow attackers to achieve their goals without being detected due to the lack of monitoring and timely response by defenders. The use of insecure functions occurs in the C language when legacy functions like strcpy() are used. These insecure functions can lead to buffer overflow and other exploits being successful against a program. For support or reporting issues, include Question ID: 63fe075c3b7322449ddbcce6 in your ticket. Thank you.

Question 42

Which party in a federation provides services to members of the federation? IdP SSO SAML RP

Answer 42

RP Explanation: OBJ 2.4: Relying parties (RPs) provide services to members of a federation. An identity provider (IdP) provides identities, makes assertions about those identities, and releases information about the identity holders. The Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties between an identity provider and a service provider (SP) or a relying party (RP). Single sign-on (SSO) is an authentication scheme that allows a user to log in with a single ID and password to any of several related yet independent software systems across a federation. SAML and SSO are not parties. Therefore, they cannot possibly be the right answer to this question. For support or reporting issues, include Question ID: 63fe06ed3b7322449ddbc789 in your ticket. Thank you.

Question 43

An organization is decommissioning several servers containing sensitive customer data. To prevent data recovery, the IT team plans to perform data sanitization before disposing of the hardware. When decommissioning sensitive data storage devices, which of the following methods should be considered first to ensure compliance with industry standards for secure data sanitization? Overwriting the drives with random data multiple times using a secure erasure tool Fully encrypting the drives before disposal to prevent unauthorized access Physically destroying the drives to render them inoperable Deleting all files and ensuring the drives are all reformatted before preparing them for reuse

Answer 43

Overwriting the drives with random data multiple times using a secure erasure tool Explanation: OBJ 3.8 - Overwriting data with random patterns multiple times using a secure erasure tool ensures that the original data cannot be reconstructed, aligning with industry standards for data sanitization. While physically destroying drives is effective, it is typically used when sanitization tools are unavailable. Deleting files and reformatting drives does not securely remove data, as it can still be recovered with specialized tools. Encrypting drives adds security but does not meet the requirements for complete sanitization prior to disposal. For support or reporting issues, include Question ID: 675084aff86f3d695e9ad0d2 in your ticket. Thank you.

Question 44

WebWare Merchandising is an e-commerce platform that allows users to log in, browse products, and make purchases through a web application. The company wants to protect customer login credentials, payment information, and other sensitive data transmitted between users' browsers and the server. After an internal audit revealed vulnerabilities in the current setup, the team was instructed to implement a widely accepted protocol for securing transmitted data. What cryptographic technique is most appropriate for this use case? Homomorphic encryption Asymmetric encryption Forward secrecy TLS

Answer 44

TLS Explanation: OBJ 3.8: Transport Layer Security (TLS) is a widely used protocol that encrypts data in transit, protecting it from interception during transmission between clients and servers. Asymmetric encryption is used within TLS for key exchange but cannot secure entire sessions independently. Homomorphic encryption allows operations on encrypted data but is not designed for securing transmitted data. Forward secrecy is a feature of TLS to protect session keys but is not a standalone protocol. For support or reporting issues, include Question ID: 6751b41bfd8b34c81216adc4 in your ticket. Thank you.

Question 45

Sarah is working at a startup that is focused on making secure banking apps for smartphones. Her company needs to select an asymmetric encryption algorithm to encrypt the data being used by the app. Due to the need for high security of the banking data, the company needs to ensure that whatever encryption they use is considered strong, but also needs to minimize the processing power required since it will be running on a mobile device with lower computing power. Which algorithm should Sarah choose to provide the same level of high encryption strength with a lower overall key length? Diffie-Hellman RSA ECC Twofish

Answer 45

ECC Explanation: OBJ 3.7: Elliptic curve cryptography (ECC) is an approach to public-key cryptography based on the algebraic structure of elliptic curves over finite fields. One of the main benefits of ECC over non-ECC cryptography is an application that can achieve the same level of security provided by non-ECC cryptography while using a shorter key length. For example, an ECC algorithm using a 256-bit key length is just as strong as an RSA or Diffie-Hellman algorithm using a 3072-bit key length. For support or reporting issues, include Question ID: 63fe07c63b7322449ddbd21e in your ticket. Thank you.

Question 46

NA

Question 47

Dion Training Solutions has an older DLP system that uses signature-based detection. These signatures must be constantly reviewed and updated manually by their team of cybersecurity analysts. Four suppliers have provided proposals for a new SaaS-based DLP platform that uses machine learning and artificial intelligence to significantly reduce Dion Training’s labor costs. The average salary of each full-time equivalent (FTE) position used to operate the current DLP is $75,000 per year. The prices quoted by each of the four suppliers would cover a five-year timeframe. Supplier Alpha’s system costs $1,000,000 and would replace 3 FTE positions. Supplier Bravo’s system costs $1,300,000 and would replace 4 FTE positions. Supplier Charlie’s system costs $1,700,000 and would replace 5 FTE positions. Supplier Delta’s system costs $2,000,000 and would replace 6 FTE positions. Which of the following suppliers would provide Dion Training with the lowest ROI based on the labor costs saved? Supplier Charlie Supplier Alpha Supplier Bravo Supplier Delta

Answer 47

Supplier Alpha Explanation: OBJ 1.2: Supplier Alpha will have the lowest return on investment. The return on investment (ROI) is the amount of money generated and/or saved after investing in an asset. To calculate the ROI for each supplier’s quote, you need to first calculate the labors costs of the FTEs (full-time equivalent positions) being replaced by the ML/AI system. Then, you will subtract the labor costs from the system cost to calculate the total ROI over the five-year timeframe. Supplier Alpha’s ROI would equal the cost of labor for 5 years (3 FTEs x $75,000/FTE x 5 years) minus the cost of the system ($1,000,000) which equals a labor savings of $125,000 ($1,125,000 – $1,000,000 = $125,000). Supplier Bravo’s ROI would equal the cost of labor for 5 years (4 FTEs x $75,000/FTE x 5 years) minus the cost of the system ($1,300,000) which equals a labor savings of $200,000 ($1,500,000 – $1,300,000 = $200,000). Supplier Charlie’s ROI would equal the cost of labor for 5 years (5 FTEs x $75,000/FTE x 5 years) minus the cost of the system ($1,700,000) which equals a labor savings of $175,000 ($1,875,000 – $1,700,000 = $175,000). Supplier Delta’s ROI would equal the cost of labor for 5 years (6 FTEs x $75,000/FTE x 5 years) minus the cost of the system ($2,000,000) which equals a labor savings of $250,000 ($2,250,000 – $2,000,000 = $250,000). For support or reporting issues, include Question ID: 63fe07ee3b7322449ddbd414 in your ticket. Thank you.

Question 48

Your Money Now is a financial services firm that is deploying a WAF to protect sensitive web applications. The security team wants the WAF to block attacks without impacting legitimate user traffic during the initial deployment phase. Which deployment mode should the security team use to achieve this goal? Inline mode with only default blocking rules enabled Transparent proxy mode with automated rule enforcement Active mode configured to log and block all traffic Passive mode to monitor and alert on potential threats

Answer 48

Passive mode to monitor and alert on potential threats Explanation: OBJ 2.1: Deploying the WAF in passive mode allows the security team to observe and refine detection rules by monitoring traffic and generating alerts without impacting legitimate users. This is critical during the initial deployment phase to fine-tune configurations. Inline mode with default blocking rules enabled may disrupt legitimate traffic due to misconfigured rules. Transparent proxy mode with automated enforcement could lead to false positives, impacting users. Active mode configured to log and block all traffic risks blocking legitimate traffic, especially during the initial phase. For support or reporting issues, include Question ID: 6750f6a9ec280b7d2c7fa261 in your ticket. Thank you.

Question 49

An organization needs to protect sensitive customer data stored in its database to comply with regulatory requirements. Which of the following methods best ensures the security of data at rest? Implementing regular data backups to a secure, offsite location, that has been preapproved by the organization Implementing and using a secure HTTPS connection to access the database remotely Enforcing strong passwords for database administrators to limit unauthorized access Encrypting the database with AES-256 and storing encryption keys in a secure hardware module

Answer 49

Encrypting the database with AES-256 and storing encryption keys in a secure hardware module Explanation: OBJ 3.8 - Encrypting data at rest with a robust encryption standard like AES-256 ensures the confidentiality of sensitive data, even if physical storage is compromised. Storing encryption keys in a secure hardware module, such as a Hardware Security Module (HSM), adds another layer of protection by preventing key exposure. HTTPS protects data in transit, not at rest. Strong passwords and regular backups are important but do not directly address the security of data at rest. For support or reporting issues, include Question ID: 67508653f86f3d695e9ad0eb in your ticket. Thank you.

Question 50

Dion Security Response Group is conducting an incident response on an ICS/SCADA network used to control an oil pipeline. When the incident responder arrives on the scene, she believes that the ICS/SCADA system may have been infected with malware that caused the pumps to continue pumping past their safe limits which resulted in an overflow of the holding tanks. To test this theory, she needs to check the logs from the ICS control loop. Which of the following operational technologies should she look at first? Safety instrumented system Data historian Ladder logic Human-machine interface

Answer 50

Data historian Explanation: OBJ 3.5: The data historian is a type of software that aggregates and catalogs data from multiple sources within an industrial control system’s control loop. Essentially, the data historian acts like a SIEM for ICS/SCADA systems and, therefore, the incident responders should review the data historian first. The human-machine interface (HMI) provides the input and output controls on a PLC to allow a user to configure and monitor the system. A Safety Instrumented System (SIS) is composed of sensors, logic solvers, and final control elements (devices like horns, flashing lights, and/or sirens) used to return an industrial process to a safe state after predetermined conditions are detected. Ladder Logic is a graphical, flowchart-like programming language used to program the special sequential control sequences used by a programmable logic controller (PLC). For support or reporting issues, include Question ID: 63fe07dc3b7322449ddbd336 in your ticket. Thank you.

Question 51

Fail to Pass operates a web-based learning management system for its students to utilize. The system uses a password-based authentication system and requires a password of at least 8 characters in length. The company does not have an account lockout policy in place and has been subject to brute force authentication attacks in the past. Which of the following cryptographic concepts would slow down a brute force attack by adding thousands of additional rounds of hashing to the authentication process? AEAD Forward secrecy Key stretching Cipher block chaining

Answer 51

Key stretching Explanation: OBJ 3.7: Key stretching is a technique that strengthens potentially weak input for cryptographic key generation, such as passwords or passphrases created by people, against brute force attacks. Key stretching will not stop a brute force attack, but it will slow it down since each password must still be put through thousands of rounds of hashing before being checked against the stored password in the database. Authenticated encryption with associated data (AEAD) is a form of encryption that provides confidentiality of the plaintext, a way to check its integrity, and a method of verifying its authenticity. Forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that session keys will not be compromised even if long-term secrets used in the session key exchange are compromised. Cipher block chaining (CBC) is a simple mode of enabling symmetric block ciphers to work with large sets of data. CBC is an older method that is vulnerable to the padding-oracle attack and should therefore not be used. For support or reporting issues, include Question ID: 63fe07d03b7322449ddbd29b in your ticket. Thank you.

Question 52

A development team is implementing branch protection rules in their CI/CD pipeline to improve the security and integrity of their codebase. Which of the following practices best aligns with branch protection for a secure deployment process? Requiring pull requests to be approved before merging into the main branch Allowing developers to merge changes directly into the main branch without requiring reviews Disabling version control to prevent unauthorized changes Allowing any of the contributors to push changes directly to all branches

Answer 52

Requiring pull requests to be approved before merging into the main branch Explanation: OBJ 2.2: Requiring pull request approval ensures that all changes are reviewed and tested before being merged into the main branch. This helps maintain code integrity, reduce security vulnerabilities, and enforce best practices. Allowing direct merges bypasses the review process, increasing the risk of introducing vulnerabilities. Disabling version control is impractical and undermines the CI/CD process. Allowing unrestricted pushes risks unauthorized changes, making the codebase vulnerable. For support or reporting issues, include Question ID: 6750fd2f23df37e1b5ec5f87 in your ticket. Thank you.

Question 53

What is the BEST explanation for why consumer-based IoT devices are less secure than traditional desktops and servers? IoT devices are unable to receive patches and updates IoT devices are only used in low-security use cases IoT devices focus on convenience more than security IoT devices are not powerful enough to support encryption

Answer 53

IoT devices focus on convenience more than security Explanation: OBJ 3.5: IoT device manufacturers are more focused on making the devices convenient to use instead of ensuring they have strong security. The other options are incorrect and not true. IoT devices can receive patches and updates through an over-the-air firmware update if a manufacturer creates the patches. IoT devices are powerful these days, and they can support encryption and other security features if manufacturers would add them to their code. IoT devices are not just used in low-security use cases, either. For example, IoT devices are often used as life-saving devices in hospitals or security systems in our homes. Unfortunately, IoT devices are notoriously lax when it comes to security. Some IoT systems may even allow a user full remote control of a device. For support or reporting issues, include Question ID: 63fe07b33b7322449ddbd133 in your ticket. Thank you.

Question 54

A developer working on a cloud-based application reports that API requests to a third-party service are failing with an "unauthorized" error. The application uses a secrets management tool to store and retrieve the API keys. What is the most likely cause of the issue? The secrets management tool does not support storing API keys Your answer is incorrect The secrets management tool is not configured to use encryption The application server lacks sufficient compute resources to process requests The API key in the secrets management tool has expired or been revoked

Answer 54

The API key in the secrets management tool has expired or been revoked Explanation: OBJ 3.1: Secrets management tools securely store sensitive credentials such as API keys, but these keys may expire or be revoked by the service provider, causing authorization errors. This scenario likely requires updating or revalidating the API key. While encryption and resource issues are important, they would not directly cause unauthorized errors. Additionally, secrets management tools commonly support storing API keys, making that option less likely. For support or reporting issues, include Question ID: 67513c8e59799a92e0afe5b1 in your ticket. Thank you.

Question 55

A vulnerability scanner has reported that a vulnerability exists in the system. Upon validating the report, the analyst determines that this reported vulnerability does not exist on the system. What is the proper term for this situation? False positive True negative False negative True positive

Answer 55

False positive Explanation: OBJ 3.3: A false positive occurs when a scanner detects a vulnerability, but the vulnerability does not exist on the scanned system. A true positive occurs when a scanner detects a vulnerability, and the vulnerability exists on the scanned system. A true negative occurs when a scanner does not detect a vulnerability because the vulnerability does not exist on the scanned system. A false negative occurs when a scanner does not detect a vulnerability, but the vulnerability exists on the scanned system. For support or reporting issues, include Question ID: 63fe07163b7322449ddbc97f in your ticket. Thank you.

Question 56

Susan is worried about the security of the master account associated with a cloud service and access to it. This service is used to manage payment transactions. She has decided to implement a new multifactor authentication process where one individual has the password to the account. Still, another user in the accounting department has a physical token to the account. To log in to the cloud service with this master account, both users would need to come together. What principle is Susan implementing by using this approach? Transitive trust Security through obscurity Least privilege Dual control authentication

Answer 56

Dual control authentication Explanation: OBJ 2.4: This approach is an example of dual control authentication. Dual control authentication is used when performing a sensitive action. It requires the participation of two different users to log in (in this case, one with the password and one with the token). Transitive trust is a technique via which a user/entity has already undergone authentication by one communication network to access resources in another communication network without having to undergo authentication a second time. Least privilege is the concept and practice of restricting access rights for users, accounts, and computing processes to only those resources required to perform routine, legitimate activities. Security through obscurity is the reliance on security engineering in the design or implementation of secrecy as the main method of providing security to a system or component. For support or reporting issues, include Question ID: 63fe07e73b7322449ddbd3bc in your ticket. Thank you.

Question 57

A cybersecurity analyst is working at a college that wants to increase its network's security by implementing vulnerability scans of centrally managed workstations, student laptops, and faculty laptops. Any proposed solution must scale up and down as new students and faculty use the network. Additionally, the analyst wants to minimize the number of false positives to ensure accuracy in their results. The chosen solution must also be centrally managed through an enterprise console. Which of the following scanning topologies would be BEST able to meet these requirements? Passive scanning engine located at the core of the network infrastructure Combination of cloud-based and server-based scanning engines Active scanning engine installed on the enterprise console Combination of server-based and agent-based scanning engines

Answer 57

Active scanning engine installed on the enterprise console Explanation: OBJ 3.6: Since the college wants to ensure a centrally-managed enterprise console, an active scanning engine installed on the enterprise console would best meet these requirements. The college’s cybersecurity analysts could then perform scans on any devices connected to the network using the active scanning engine at the desired intervals. Agent-based scanning would be ineffective since the college cannot force the agents' installation onto each of the personally owned devices brought in by the students or faculty. A cloud-based or server-based engine may be useful, but it won't address the centrally-managed requirement. Passive scanning is less intrusive but is subject to a high number of false positives. For support or reporting issues, include Question ID: 63fe077f3b7322449ddbce99 in your ticket. Thank you.

Question 58

A network administrator is troubleshooting a critical service outage in a distributed environment. They find that records from various systems are inconsistent, making it difficult to identify the root cause. Upon further investigation, they discover that log timestamps are not synchronized across devices. What should the administrator implement to prevent this issue in the future? Centralized logging system Enhanced encryption protocols DNSSEC Network segmentation

Answer 58

Centralized logging system Explanation: OBJ 3.3: Centralized logging systems ensure consistent log collection and synchronization, improving observability across distributed environments. Enhanced encryption protocols focus on data security, not log consistency. Network segmentation improves security but does not address observability. DNSSEC secures DNS queries but is unrelated to logging. For support or reporting issues, include Question ID: 6751aaa197eb9dce4020fbff in your ticket. Thank you.

Question 59

Your organization has just migrated to provisioning its corporate desktops as virtual machines and accessing them using thin clients. The organization believes this will enhance security since the desktop can be rewritten with a new baseline image every time the user logs into it. Based on this scenario, which of the following technologies has the organization adopted? UEBA VPN VPC VDI

Answer 59

VDI Explanation: OBJ 2.5: Virtual desktop infrastructure (VDI) is a virtualization implementation that separates the personal computing environment from a user's physical computer. Virtual private cloud (VPC) is a private network segment made available to a single cloud consumer on a public cloud. A virtual private network (VPN) is a secure tunnel created between two endpoints connected via an insecure network, typically the internet. User and entity behavior analytics (UEBA) is a system that can provide automated identification of suspicious activity by user accounts and computer hosts. For support or reporting issues, include Question ID: 63fe06d03b7322449ddbc620 in your ticket. Thank you.

Question 60

Dion Training wants to test the power outage portion of its business continuity plan. The company has decided that they will disconnect their headquarters and datacenter from the power grid at 12:15 pm and leave it disconnected for seven days to validate their ability to continue operations using their backup batteries and generators. Which of the following types of tests are they planning to utilize to validate their BCP? Parallel test Tabletop exercise Full interruption test Walk-through

Answer 60

Full interruption test Explanation: OBJ 1.1: The organization is using a full interruption test to validate its BCP in this scenario. A full interruption test is used to take the primary site offline and shift operations to the alternate site. A parallel test occurs when the alternative site is brought online as if a real disaster occurred, but the primary site is not taken offline or affected, thereby keeping both the primary and alternate sites operating in parallel. A tabletop exercise will identify a specific objective or goal, provide injects or additional details, and then observe the actions that the participants would have taken to respond to a given incident or disaster scenario. A walk-through test typically occurs as a group conference where a representative from each business unit discusses the actions taken by their teams, reviews the plan, analyzes the plan’s effectiveness, and provides feedback or changes. For support or reporting issues, include Question ID: 63fe08193b7322449ddbd630 in your ticket. Thank you.

Question 61

In a Zero Trust architecture, a user begins accessing a critical resource from a previously trusted device. Mid-session, the device's security posture changes, and it fails compliance checks. What action should the system take to adhere to continuous authorization principles? Revoke access immediately and log the non-compliant activity Allow the session to continue and notify the security team for further analysis Block all future access requests but allow the current session to finish Trigger an alert but maintain the user's access to avoid potential disruption

Answer 61

Revoke access immediately and log the non-compliant activity Explanation: OBJ 2.6: Continuous authorization requires dynamic evaluation of user and device status. If a device becomes non-compliant mid-session, access should be revoked immediately to prevent unauthorized activity, with logging to provide a record for investigation. Allowing the session to continue violates Zero Trust principles by prioritizing convenience over security. Blocking future access but maintaining the current session fails to mitigate immediate risks. Triggering an alert without revoking access compromises security in favor of user convenience. For support or reporting issues, include Question ID: 6750ffb623df37e1b5ec5ff2 in your ticket. Thank you.

Question 62

Remote users are reporting frequent issues when attempting to access internal systems via the corporate VPN. The network team observes that encrypted traffic fails to route to its intended destination despite proper authentication. What should the administrator investigate first? Unpatched endpoint software Incorrect VPN tunnel configuration Expired certificates Insufficient bandwidth allocation

Answer 62

Incorrect VPN tunnel configuration Explanation: OBJ 3.3: VPN tunnel misconfiguration often causes routing issues in encrypted traffic. Unpatched endpoint software is endpoint-specific, insufficient bandwidth allocation impacts traffic handling, and expired certificates prevent connection establishment, not routing problems. For support or reporting issues, include Question ID: 6751aa1997eb9dce4020fbfa in your ticket. Thank you.

Question 63

Dion Training is evaluating the security of its database server’s configuration. During the evaluation, one of the analysts identifies that data can be decrypted outside of a dedicated section of memory. Which of the following endpoint security controls would eliminate this vulnerability by ensuring that sensitive information is only allowed to be decrypted within the CPU or a protected region of memory? Attestation services Local drive encryption Self-encrypting drive (SED) Secure encrypted enclaves

Answer 63

Secure encrypted enclaves Explanation: OBJ 3.4: Secure encrypted enclaves protect CPU instructions, dedicated secure subsystems in a system on a chip (SoC), or a protected region of memory in a database engine by only allowing data to be decrypted on the fly within the CPU, SoC, or protected region. A self-encrypting drive (SED) is a type of solid state device (SSD) or hard disk drive (HDD) that conducts transparent encryption of all data as it is written to the device using an embedded hardware cryptographic processor. Local drive encryption protects the contents of a solid state device (SSD) or hard disk drive (HDD) when the operating system is not running through the use of software-based encryption such as BitLocker, FileVault, or TrueCrypt. Attestation services are used to ensure the integrity of the computer’s startup and runtime operations. Hardware-based attestation is designed to protect against threats and malicious code that could be loaded before the operating system is loaded. For support or reporting issues, include Question ID: 63fe07a33b7322449ddbd06f in your ticket. Thank you.

Question 64

A development team implements automated testing into their CI/CD pipeline to validate new changes without affecting existing functionality. They want to confirm that the individual components of the application behave as expected when tested together. Which type of testing best meets this requirement? Regression testing Integration testing Canary testing Unit testing

Answer 64

Integration testing Explanation: OBJ 2.2: Integration testing evaluates how different components of an application work together. It ensures that new changes do not introduce issues when modules interact, making it crucial for validating interconnected functionality. Unit testing focuses on isolated components rather than their integration. Canary testing involves testing in a production-like environment, not component integration. Regression testing ensures existing functionality is preserved but does not focus on component interactions. For support or reporting issues, include Question ID: 6750fede52107569898127cf in your ticket. Thank you.

Question 65

A multinational corporation frequently sends sensitive contracts to partners in various countries. To ensure legal compliance and maintain trust, the company needs a method to verify that the documents have not been altered during transmission and that they originated from the correct sender. Additionally, the solution must be compatible with existing workflows and provide non-repudiation in case of disputes. Which cryptographic technique should be used? Hashing Symmetric encryption Key stretching Digital signatures

Answer 65

Digital signatures Explanation: OBJ 3.8: Digital signatures provide a way to verify the sender's authenticity and ensure the document has not been tampered with, meeting both integrity and non-repudiation requirements. Symmetric encryption protects confidentiality but does not verify origin or integrity. Hashing ensures integrity but does not authenticate the sender. Key stretching is used to strengthen weak passwords and is irrelevant to this scenario. For support or reporting issues, include Question ID: 6751b44bfd8b34c81216adc9 in your ticket. Thank you.

Question 66

Which of the following agreements is used between companies and employees, between companies and contractors, and between two companies to protect information assets? DSUA ISA SLA NDA

Answer 66

NDA Explanation: OBJ 1.1: Non-disclosure agreement (NDA) is the legal basis for protecting information assets. NDAs are used between companies and employees, between companies and contractors, and between two companies. If the employee or contractor breaks this agreement and shares such information, they may face legal consequences. NDAs are useful because they deter employees and contractors from violating the trust that an employee places in them. An interconnection security agreement (ISA) is defined by NIST's SP800-4 and is used by any federal agency interconnecting its IT system to a third party must create an ISA to govern the relationship. A service level agreement (SLA) is a contractual agreement that sets out the detailed terms under which a service is provided. A data sharing and use agreement (DSUA) states that personal data can only be collected for a specific purpose. A DSUA can specify how a dataset can be analyzed and proscribe the use of reidentification techniques. For support or reporting issues, include Question ID: 63fe07f13b7322449ddbd441 in your ticket. Thank you.

Question 67

Which of the following terms is used to describe the period of the time taken to correct a fault so that the system is restored to full operations after a failure or incident? MTTR RTO MTBF RPO

Answer 67

MTTR Explanation: OBJ 1.2: Mean time to repair (MTTR) is a measure of the time taken to correct a fault to restore the system to full operation. MTTR is often used to describe the average time to replace or recover a system or product. Recovery time objective (RTO) is when an individual IT system may remain offline following a disaster. This represents the amount of time it takes to identify that there is a problem and then perform recovery (restore from backup or switch in an alternative system, for instance). Recovery point objective (RPO) is the amount of data loss that a system can sustain, measured in time. That is, if a virus destroys a database, an RPO of 24 hours means that the data can be recovered (from a backup copy) to a point not more than 24 hours before the database was infected. Mean time between failure (MTBF) represents the expected lifetime of a product before it fails and must be replaced or repaired. For support or reporting issues, include Question ID: 63fe07f63b7322449ddbd47d in your ticket. Thank you.

Question 68

Dion Training is trying to define key performance indicators for their recently released voucher management system. The CIO has stated that the voucher management system must be able to provide at least a 99.999% uptime as one of the KPIs. To monitor this requirement, the analysts have created a metric to measure the uptime for the system and will generate a report weekly with the average uptime maintained. Which of the following types of key performance indicators would this metric be classified as? Availability Scalability Usability Reliability

Answer 68

Availability Explanation: OBJ 1.2: Availability metrics measure the probability that a system will be operating as expected at any given point in time. The most common availability metric used is known as uptime. Scalability metrics measure the ability of a system to handle an increase in workload while maintaining a consistent level of performance. Reliability metrics measure the ability of a system to perform without error or to avoid, detect, and/or repair component or integrity failures. Usability metrics measure the effectiveness, efficiency, and satisfaction of users working with a given system. For support or reporting issues, include Question ID: 63fe080e3b7322449ddbd5a9 in your ticket. Thank you.

Question 69

After analyzing and correlating activity from the firewall logs, server logs, and the intrusion detection system logs, a cybersecurity analyst has determined that a sophisticated breach of the company’s network security may have occurred from a group of specialized attackers in a foreign country over the past five months. Up until now, these cyberattacks against the company network had gone unnoticed by the company’s information security team. How would you best classify this threat? Privilege escalation Insider threat Advanced persistent threat (APT) Spear phishing

Answer 69

Advanced persistent threat (APT) Explanation: OBJ 1.4: An advanced persistent threat (APT) is a network attack in which an unauthorized person gains access to a network and stays there undetected for a long period of time. An APT attack intends to steal data rather than to cause damage to the network or organization. An APT refers to an adversary's ongoing ability to compromise network security, obtain and maintain access, and use various tools and techniques. They are often supported and funded by nation-states or work directly for a nation-states' government. Spear phishing is the fraudulent practice of sending emails ostensibly from a known or trusted sender to induce targeted individuals to reveal confidential information. An insider threat is a malicious threat to an organization from people within the organization, such as employees, former employees, contractors, or business associates, who have inside information concerning the organization's security practices, data, and computer systems. Privilege escalation is the act of exploiting a bug, design flaw, or configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user. While an APT may use spear phishing, privilege escalation, or an insider threat to gain access to the system, the scenario presented in this question doesn't specify what method was used. Therefore, APT is the best answer to select. For support or reporting issues, include Question ID: 63fe071c3b7322449ddbc9ca in your ticket. Thank you.

Question 70

Which software development model emphasizes individuals and interactions over processes and tools, customer collaboration over contract negotiation, and working software over comprehensive documentation? Agile Waterfall Spiral RAD

Answer 70

Agile Explanation: OBJ 2.2: The principles of the Agile Manifesto characterize agile software development. The Agile Manifesto emphasizes individuals and interactions over the processes and tools that Spiral and Waterfall rely on. It also focuses on working software, customer collaboration, and responding to change as key elements of the Agile process. The waterfall model is a breakdown of project activities into linear sequential phases. Each phase depends on the deliverables of the previous one and corresponds to a specialization of tasks. Rapid Application Development (RAD) is a form of agile software development methodology that prioritizes rapid prototype releases and iterations. Unlike the Waterfall method, RAD emphasizes software and user feedback over strict planning and requirements recording. Spiral development is a risk-driven software development model that guides a team to adopt elements of one or more process models, such as incremental, waterfall, or evolutionary prototyping. For support or reporting issues, include Question ID: 63fe06ed3b7322449ddbc784 in your ticket. Thank you.

Question 71

Which of the following cryptographic protocols provides comparable levels of protection to RSA but with smaller key sizes? DSA ECDSA ChaCha Salsa20

Answer 71

ECDSA Explanation: OBJ 3.7: Elliptic-Curve Digital Signature Algorithm (ECDSA) is an asymmetric algorithm that utilizes the properties of elliptic curves to provide comparable levels of protection as RSA with a much smaller key size. The digital signature algorithm (DSA) is a cryptographic algorithm that uses logarithmic and modulus math to generate and verify digital signatures. The DSA is faster than RSA at generating digital signatures, but it is slower than RSA when verifying them. Salsa20 is a modern and efficient symmetric stream cipher that uses a 128-bit or 256-bit encryption key. Salsa20 is not used in many cryptographic implementations, but a variant of Salsa20 known as ChaCha is widely adopted by Google for use in Android devices and the Google Chrome browser. ChaCha is a variant of Salsa20 that is a modern and efficient symmetric stream cipher that uses a 128-bit or 256-bit encryption key. ChaCha is widely used in combination with the Poly1305 hashing algorithm in the TLS implementation of the Google Chrome browser and the Android operating system. ChaCha is also used by OpenSSH and the random number generator in BSD operating systems as a replacement to the older RC4 algorithm. For support or reporting issues, include Question ID: 63fe07d33b7322449ddbd2c3 in your ticket. Thank you.

Question 72

What type of technique does exploit chaining often implement? Adding multiple parameters with the same name in HTTP requests Inserting malicious JavaScript code into input parameters Injecting parameters into a connection string using semicolons as a separator Setting a user's session identifier (SID) to an explicit known value

Answer 72

Injecting parameters into a connection string using semicolons as a separator Explanation: OBJ 4.2: Connection String Parameter Pollution (CSPP) exploits specifically the semicolon-delimited database connection strings that are constructed dynamically based on the user inputs from web applications. CSPP, if carried out successfully, can be used to steal user identities and hijack web credentials. CSPP is a high-risk attack because of the relative ease with which it can be carried out (low access complexity) and the potential results it can have (high impact). Exploit chaining involves multiple commands and exploits being conducted in a series to fully attack or exploit a given target. For support or reporting issues, include Question ID: 63fe07283b7322449ddbca61 in your ticket. Thank you.

Question 73

Richard attempted to visit a website and received a DNS response from the DNS cache server pointing to the wrong IP address. Which of the following attacks has occurred? DNS poisoning DNS brute-forcing ARP spoofing MAC spoofing

Answer 73

DNS poisoning Explanation: OBJ 4.2: DNS poisoning (also known as DNS cache poisoning or DNS spoofing) is a type of attack which uses security gaps in the Domain Name System (DNS) protocol to redirect internet traffic to malicious websites. MAC spoofing is a technique for changing a factory-assigned Media Access Control (MAC) address of a network interface on a networked device. ARP spoofing is a type of attack in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network using layer 2 address information. DNS brute-forcing is used to check for wildcard entries using a dictionary or wordlist. This technique is used when a DNS zone transfer is not allowed by a system. For support or reporting issues, include Question ID: 63fe06eb3b7322449ddbc76b in your ticket. Thank you.

Question 74

Which of the following access control models is the most flexible and allows the resource owner to control the access permissions? RBAC MAC ABAC DAC

Answer 74

DAC Explanation: https://ibm-learning.udemy.com/course/comptia-securityx-cas-005-6-practice-exams/learn/quiz/6689175/test#overview:~:text=OBJ%202.4%3A%C2%A0Discretionary,ticket.%20Thank%20you.

Question 75

Dion Training is creating a new mobile application and needs to select an appropriate encryption algorithm to protect the user’s data transmitted by the app to the company’s remote servers. The company wants to choose an asymmetric encryption algorithm that supports fast key agreements and provides extremely high levels of security using only a 384-bit key. Which of the following encryption algorithms should be selected to meet these requirements? AES RSA ChaCha ECC

Answer 75

ECC Explanation: OBJ 3.7: Elliptic curve cryptography is a public-key cryptographic algorithm based on the algebraic structure of elliptic curves over finite fields. ECC allows smaller key sizes compared to non-elliptic curve cryptography methods while still providing the equivalent level of security. ECC is heavily used in mobile devices and low-powered device encryption. For example, the P384 curve uses a 384-bit key and is approved for the encryption of data up to the Top Secret level by the National Security Agency. Rivest, Shamir, and Adleman (RSA) is an asymmetric algorithm that uses the complexity of factoring large prime numbers to provide security. RSA requires a larger key size of 7680-bit to have the equivalent protection of ECC encrypted data using a 384-bit key. The Advanced Encryption Standard (AES) is the current standard for the U.S. federal government’s symmetric block encryption cipher. AES can use a key size of 128-bits, 192-bits, or 256-bits with a 128-bit block size. ChaCha is a variant of Salsa20 that is a modern and efficient symmetric stream cipher that uses a 128-bit or 256-bit encryption key. ChaCha is widely used in combination with the Poly1305 hashing algorithm in the TLS implementation of the Google Chrome browser and the Android operating system. ChaCha is also used by OpenSSH and the random number generator in BSD operating systems as a replacement to the older RC4 algorithm. For support or reporting issues, include Question ID: 63fe07d43b7322449ddbd2d2 in your ticket. Thank you.

Question 76

Dion Consulting Group is helping an organization build a new Security Operations Center. The organization wants to create a centralized repository that contains logs from all the network devices, servers, and endpoints so cybersecurity analysts can search the repository and conduct threat hunting. Which of the following types of sensors or systems should you implement to centralize the logging and event data from across the enterprise network into one place? Host-based intrusion detection (HIDS) File Integrity Monitoring (FIM) Data loss prevention (DLP) Security and information event management (SIEM)

Answer 76

Security and information event management (SIEM) Explanation: https://ibm-learning.udemy.com/course/comptia-securityx-cas-005-6-practice-exams/learn/quiz/6689175/test#overview:~:text=OBJ%204.1%3A%C2%A0While,ticket.%20Thank%20you.

Question 77

Dion Training allows its visiting business partners from CompTIA to use an available Ethernet port in their conference room to establish a VPN connection back to the CompTIA internal network. The CompTIA employees should obtain internet access from the Ethernet port in the conference room, but nowhere else in the building. Additionally, if any of the Dion Training employees use the same Ethernet port in the conference room, they should access Dion Training's secure internal network. Which of the following technologies would allow you to configure this port and support both requirements? Configure a SIEM Create an ACL to allow access Implement NAC MAC filtering

Answer 77

Implement NAC Explanation: OBJ 2.4: Network Access Control (NAC) uses a set of protocols to define and implement a policy that describes how to secure access to network nodes whenever a device initially attempts to access the network. NAC can utilize an automatic remediation process by fixing non-compliant hosts before allowing network access. Network Access Control can control access to a network with policies, including pre-admission endpoint security policy checks and post-admission controls over where users and devices can go on a network and what they can do. In this scenario, implementing NAC can identify which machines are known and trusted Dion Training assets and provide them with access to the secure internal network. NAC could also determine unknown machines (assumed to be those of CompTIA employees) and provide them with direct internet access only by placing them on a guest network or VLAN. While MAC filtering could be used to allow or deny access to the network, it cannot by itself control which set of network resources could be utilized from a single ethernet port. A security information and event management (SIEM) system provides real-time analysis of security alerts generated by applications and network hardware. An access control list could define what ports, protocols, or IP addresses the ethernet port could be utilized. Still, it would be unable to distinguish between a Dion Training employee's laptop and a CompTIA employee's laptop like a NAC implementation could. For support or reporting issues, include Question ID: 63fe07053b7322449ddbc8b0 in your ticket. Thank you.

Question 78

A web developer wants to protect their new web application from an on-path attack. Which of the following controls would best prevent an attacker from stealing tokens stored in cookies? Setting the secure attribute on the cookie Forcing the use of SSL for the web application Forcing the use of TLS for the web application Hashing the cookie value

Answer 78

Setting the secure attribute on the cookie Explanation: OBJ 2.4: When a cookie has the Secure attribute, the user agent includes the cookie in an HTTP request only if transmitted over a secure channel (typically HTTPS). Although seemingly useful for protecting cookies from active network attackers, the Secure attribute protects only the cookie’s confidentiality. Forcing the web application to use TLS or SSL does not force the cookie to be sent over TLS/SSL, so you still need to set the cookie's Secure attribute. Hashing the cookie provides the cookie's integrity, not confidentiality; therefore, it will not solve the issue presented by this question. For support or reporting issues, include Question ID: 63fe06ec3b7322449ddbc77a in your ticket. Thank you.

Question 79

An organization relies on legacy systems for critical operations that cannot be replaced or upgraded. To mitigate security risks, the IT team disables all unnecessary services, applies strong access controls, and implements logging to monitor activity. What approach is the organization using to secure these systems? Patching Network segmentation EDR Hardening

Answer 79

Hardening Explanation: OBJ 3.5: Hardening involves disabling unnecessary services, applying strict access controls, and enabling logging to reduce the attack surface of legacy systems. Endpoint detection and response (EDR) focuses on detection and response but does not directly reduce vulnerabilities. Network segmentation isolates systems but is not the same as hardening. Patching is often not feasible for unsupported legacy systems. For support or reporting issues, include Question ID: 6751b0b28e62d8320cd6bbb7 in your ticket. Thank you.

Question 80

You are attempting to prioritize your vulnerability scans based on the data's criticality. This will be determined by the asset value of the data contained in each system. Which of the following would be the most appropriate metric to use in this prioritization? The depreciated hardware cost of the system The cost of hardware replacement of the system The type of data processed by the system The cost of acquisition of the system

Answer 80

The type of data processed by the system Explanation: OBJ 1.2: The data's asset value is a metric or classification that an organization places on data stored, processed, and transmitted by an asset. Different data types, such as regulated data, intellectual property, and personally identifiable information, can determine its value. The cost of acquisition, cost of hardware replacement, and depreciated costs refer to the financial value of the hardware or system itself. This can be significantly different from the value of the information and data that the system stores and processes. For support or reporting issues, include Question ID: 63fe08023b7322449ddbd513 in your ticket. Thank you.

Question 81

Your company was recently the victim of a cross-site scripting attack. The system administrators claim this wasn't possible since they performed input validation using REGEX to alert on any strings that contain the term "[Ss]cript" in them. Which of the following statements concerning this attack is true? The REGEX expression to filter using "[Ss]cript" is insufficient since an attacker could use SCRIPT or SCRipt or %53CrIPT to evade it The attacker has modified the logs to cover their tracks and prevent a successful investigation An SQL injection must have occurred since their input validation would have prevented The server has insufficient logging and monitoring configured

Answer 81

The REGEX expression to filter using "[Ss]cript" is insufficient since an attacker could use SCRIPT or SCRipt or %53CrIPT to evade it Explanation: OBJ 4.2: The most likely explanation is that the REGEX filter was insufficient to eliminate every single possible cross-site scripting attack that could occur. Since cross-site scripting relies on the HTML tags to launch, the system administrators had a good idea of creating input validation using a REGEX for those keywords. Unfortunately, they forgot to include a more inclusive version of this REGEX to catch all variants. For example, simply using [Ss][Cc][Rr][Ii][Pp][Tt] would have been much more secure, but even this would miss %53CrIPT would evade this filter. To catch all the letter S variants, you would need to use [%53%%73Ss], which includes the capital S in hex code, the lower case s in hex code, the capital S, and the lowercase s. While using a SQL injection is possible, their REGEX input validation would still have allowed a cross-site scripting attack to occur, so this option must be eliminated. As for the logging options, both are possible in the real world, but they do not adequately answer this scenario. The obvious flaw in their input validation is their REGEX filter. For support or reporting issues, include Question ID: 63fe07683b7322449ddbcd81 in your ticket. Thank you.

Question 82

You are planning to exploit a network-based vulnerability against an organization as part of a penetration test. You attempted to connect your laptop to the network jack in their conference room. You found yourself in the highly restricted VLAN that the organization allows its visitors to connect to when conducting presentations. This VLAN only allows you to access the internet, not the internal network. You decide you need to conduct VLAN hopping. Which of the following methods would be MOST likely to succeed? Connect a wireless access point to the conference room's network jack Harvest the user credentials of an employee and use those to connect Poison or overflow the MAC table of the switch Spoof the MAC address of the room's VOIP phone to your laptop

Answer 82

Poison or overflow the MAC table of the switch Explanation: OBJ 4.2: VLAN hopping is the act of illegally moving from one VLAN to another. A VLAN (virtual LAN) is a logical grouping of switch ports extending across any number of switches on an Ethernet network. One of the most common VLAN hopping methods is to overflow the MAC table on a vulnerable switch. When this occurs, the switch defaults to operating as a hub and repeats all frames being received through all of its ports. This "fail open" method ensures the network can continue to operate, but it is a security risk that can be exploited by the penetration tester. For support or reporting issues, include Question ID: 63fe07523b7322449ddbcc64 in your ticket. Thank you.

Question 83

What type of cloud service provides instant access to servers and switches, quickly provisioned, and available for management over the internet? DaaS IaaS SaaS PaaS

Answer 83

IaaS Explanation: OBJ 2.5: Infrastructure as a service (IaaS) is an instant computing infrastructure, provisioned, and managed over the internet. Infrastructure as a Service (IaaS) is a cloud computing service that enables a consumer to outsource computing equipment purchases and running their own data center. IaaS quickly scales up and down with demand, letting you pay only for what you use. It helps you avoid the expense and complexity of buying and managing your physical servers and other data center infrastructure. Each resource is offered as a separate service component, and you only need to rent a particular one for as long as you need it. A cloud computing service provider manages the infrastructure while you purchase, install, configure, and manage your software. Platform as a Service (PaaS) is a cloud computing service that enables consumers to rent fully configured systems that are set up for specific purposes. Software as a Service (SaaS) is a cloud computing service that enables a service provider to make applications available over the Internet to end-users. This can be a calendar, scheduling, invoicing, word processor, database, or other programs. For example, Google Docs and Office 365 are both word processing SaaS solutions. Desktop as a Service (DaaS) provides a full virtualized desktop environment from within a cloud-based service. This is also known as VDI (Virtualized Desktop Infrastructure) and is coming in large enterprise businesses focused on increasing their security and minimizing their operational expenses. For support or reporting issues, include Question ID: 63fe06dd3b7322449ddbc6c1 in your ticket. Thank you.

Question 84

Dion Training is updating its disaster recovery plan. Currently, the company has a small office building that contains both its offices and its data center. The company cannot afford to purchase a second location. Instead, the CEO has negotiated an MOU with Fuller Solutions to use three empty server cabinets in their data center as an alternate location for recovery from a disaster. The CEO has also approved a reserved line of accounting in the budget each year to purchase the necessary servers and equipment to restore operations at the alternate site, but this money cannot be accessed until a disaster occurs. Which of the following recovery site strategies would you recommend to BEST meet these requirements? Hot site Mobile site Warm site Cold site

Answer 84

Cold site Explanation: OBJ 1.1: A cold site is a predetermined alternative location where a network can be rebuilt after a disaster. A cold site does not have a pre-established information systems capability, but it is open and available for building out an alternate site after the disaster occurs. A warm site is an alternate processing location that is dormant or performs noncritical functions under normal conditions, but which can be rapidly converted to a key operations site when needed. A warm site typically includes a data center that is typically scaled down from the primary site to include the capacity and throughput needed to run critical systems and software. A hot site is a fully configured alternate processing site that can be brought online either instantly or very quickly after a disaster. A hot site requires specialized knowledge, sophisticated automation capabilities, and platforms that are designed to operate as a fully redundant and ready alternate site. A mobile site is essentially a data center in a container or trailer that can be rapidly deployed to a given location. A mobile site is best categorized as a mixture of a cold site and a warm site which can also be relocated when needed. For support or reporting issues, include Question ID: 63fe07ef3b7322449ddbd423 in your ticket. Thank you.

Question 85

Dion Training is conducting its quarterly PCI-DSS internal assessment to determine if their risk level has changed since the last quarter. What phase of the risk management lifecycle is Dion Training currently operating in? Identify Control Assess Review

Answer 85

Review Explanation: OBJ 1.2: This is the review phase. The identify phase is used to inventory assets and for the identification of all risk items in an organization. The assess phase is used to analyze identified risks to determine their associated level of risk before any mitigations or controls are implemented. The control phase is used to identify effective methods for risk reduction for identified risks in an organization. The review phase is used to periodically re-evaluate the risks in an organization by determining if the risk level has changed and identified controls are still effective. For support or reporting issues, include Question ID: 63fe08193b7322449ddbd635 in your ticket. Thank you.

Question 86

An organization discovers that malware was installed on a critical server, enabling the execution of unauthorized scripts that bypass security controls and exfiltrate sensitive data. Which of the following best describes the attacker's tactic? Credential dumping to obtain authentication details for accessing sensitive data Privilege escalation to obtain higher-level permissions on the server and access restricted data Unauthorized execution to gain control over system processes and execute malicious commands Using gained access to perform lateral movement and propagate the malware across the network

Answer 86

Unauthorized execution to gain control over system processes and execute malicious commands Explanation: OBJ 3.2 - Unauthorized execution occurs when an attacker or malware gains the ability to run unauthorized code or commands on a system, often leading to actions such as bypassing security mechanisms, exfiltrating data, or compromising system integrity. While privilege escalation and lateral movement may occur in tandem, they describe different tactics. Credential dumping involves extracting stored authentication information and is unrelated to the execution of malicious scripts. For support or reporting issues, include Question ID: 67506557b4d0b28795afb914 in your ticket. Thank you.

Question 87

During a forensic investigation, security analysts discovered that a malware sample on a compromised server actively disabled antivirus software and modified system logs to remove traces of its activity. Which of the following best describes the attacker’s tactic? Privilege escalation to disable security controls on the server Defensive evasion to avoid detection and maintain stealth Lateral movement to spread the malware to additional systems Persistence to ensure continued access to the server over time

Answer 87

Defensive evasion to avoid detection and maintain stealth Explanation: OBJ 3.2 - Defensive evasion is a tactic where attackers actively work to avoid detection by security tools or forensic investigations. This can involve disabling antivirus software, modifying or deleting logs, or using encryption and obfuscation techniques to hide their activity. While privilege escalation and persistence may be parts of an attack chain, defensive evasion specifically focuses on hiding the attacker’s presence. Lateral movement describes spreading across systems, not avoiding detection. For support or reporting issues, include Question ID: 67506657b4d0b28795afb948 in your ticket. Thank you.

Question 88

Dion Training has recently developed some new serverless functions in AWS Lambda. To allow the Dion Training website to connect to these backend applications, which of the following should be configured to accept and process inbound requests to the new service? API gateway XML gateway NAT gateway VPN gateway

Answer 88

API gateway Explanation: OBJ 2.5: Application programming interface (API) gateway is a special cloud-based service that is used to centralize the functions provided by APIs. An API is a type of software interface that offers a service to other pieces of software to build or connect to specific functions or features. A NAT Gateway within a cloud platform allows private subnets in a Virtual Private Cloud (VPC) access to the Internet. A VPN gateway is a type of networking device that connects two or more devices or networks in a VPN infrastructure. It is designed to bridge the connection or communication between two or more remote sites, networks, or devices and/or to connect multiple VPNs. An extensible markup language (XML) gateway acts as an application layer firewall specifically to monitor XML formatted messages as they enter or leave a network or system. An XML gateway is used for inbound pattern detection and the prevention of outbound data leaks. XML is a document structure that is both human and machine-readable. Information within an XML document is placed within tags that describe how the information within the document is structured. For support or reporting issues, include Question ID: 63fe06cc3b7322449ddbc5ee in your ticket. Thank you.

Question 89

A retail company is deploying a web app for online transactions and must meet security and compliance requirements. After unit testing and static analysis, the team needs to identify runtime vulnerabilities (SQL injection, XSS). However, runtime scans caused significant performance drops, raising concerns about delaying deployment. How can the team effectively perform DAST while managing performance issues? Replace DAST with static application security testing (SAST) to minimize runtime performance issues Perform DAST in a staging environment with production-like conditions and scheduled testing windows Use DAST tools in a production environment with actual user traffic for realistic results Limit DAST to testing only critical application functions to reduce performance impact

Answer 89

Perform DAST in a staging environment with production-like conditions and scheduled testing windows Explanation: OBJ 2.2: DAST is designed to test an application for vulnerabilities during runtime, making it critical for identifying issues like SQL injection and XSS that occur during execution. Conducting DAST in a staging environment with production-like conditions allows the team to simulate real-world usage without impacting live user traffic, and scheduled testing windows help manage resource allocation to address performance concerns. Limiting DAST to critical functions risks missing vulnerabilities in non-critical areas, while conducting tests in a live production environment could disrupt users and compromise sensitive data. Replacing DAST with SAST is inappropriate because SAST cannot identify runtime vulnerabilities. For support or reporting issues, include Question ID: 674f6cac7a4b195c66838b37 in your ticket. Thank you.

Question 90

What tool can be used to scan a network to perform vulnerability checks and compliance auditing? Metasploit Nessus Nmap BeEF

Answer 90

Nessus Explanation: OBJ 1.4: Nessus is a popular vulnerability scanner. It can be used to check how vulnerable your network is by using various plugins to test for vulnerabilities. Also, Nessus can perform compliance auditing, like internal and external PCI DSS audit scans. The nmap tool is a port scanner. The Metasploit Project is a computer security project that provides information about security vulnerabilities and aids in penetration testing and IDS signature development. BeEF is short for The Browser Exploitation Framework. It is a penetration testing tool that focuses on the web browser. For support or reporting issues, include Question ID: 63fe076f3b7322449ddbcdd6 in your ticket. Thank you.