SY 51-100 Flashcards
A Chief Security Officer (CSO) is concerned about the amount of PII that is stored locally on each
salesperson’s laptop. The sales department has a higher-than-average rate of lost equipment.
Which of the following recommendations would BEST address the CSO’s concern?
A. Deploy an MDM solution. B. Implement managed FDE. C. Replace all hard drives with SEDs. D. Install DLP agents on each laptop. Answer: B
An attacker is attempting, to harvest user credentials on a client’s website. A security analyst notices
multiple attempts of random usernames and passwords. When the analyst types in a random username
and password. the logon screen displays the following message:
Which of the following should the analyst recommend be enabled?
A. Input validation B. Obfuscation C. Error handling D. Username lockout Answer: B
A cybersecurity analyst reviews the log files from a web server and sees a series of files that indicates
a directory-traversal attack has occurred.
Which of the following is the analyst MOST likely seeing?
PIC
A. Option A B. Option B C. Option C D. Option D Answer: B
A commercial cyber-threat intelligence organization observes IoCs across a variety of unrelated
customers.
Prior to releasing specific threat intelligence to other paid subscribers, the organization is MOST likely
obligated by contracts to:
A. perform attribution to specific APTs and nation-state actors.
B. anonymize any PII that is observed within the IoC data.
C. add metadata to track the utilization of threat intelligence reports.
D. assist companies with impact assessments based on the observed data.
Answer: B
A security administrator is analyzing the corporate wireless network. The network only has two access
points running on channels 1 and 11. While using airodump-ng. the administrator notices other access
points are running with the same corporate ESSID on all available channels and with the same BSSID of
one of the legitimate access ports.
Which erf the following attacks in happening on the corporate network?
A. Man in the middle B. Evil twin C. Jamming D. Rogue access point E. Disassociation Answer: B
A network engineer needs to create a plan for upgrading the wireless infrastructure in a large office
Priority must be given to areas that are currently experiencing latency and connection issues.
Which of the following would be the BEST resource for determining the order of priority?
A. Nmapn B. Heat maps C. Network diagrams D. Wireshark Answer: C
A document that appears to be malicious has been discovered in an email that was sent to a
company’s Chief Financial Officer (CFO).
Which of the following would be BEST to allow a security analyst to gather information and confirm it is a
malicious document without executing any code it may contain?
A. Open the document on an air-gapped network
B. View the document’s metadata for origin clues
C. Search for matching file hashes on malware websites
D. Detonate the document in an analysis sandbox
Answer: D
A company has determined that if its computer-based manufacturing is not functioning for 12
consecutive hours, it will lose more money that it costs to maintain the equipment.
Which of the following must be less than 12 hours to maintain a positive total cost of ownership?
A. MTBF B. RPO C. RTO D. MTTR Answer: C
An analyst needs to identify the applications a user was running and the files that were open before
the user’s computer was shut off by holding down the power button.
Which of the following would MOST likely contain that information?
A. NGFW B. Pagefile C. NetFlow D. RAM Answer: B
A network administrator needs to build out a new datacenter, with a focus on resiliency and uptime.
Which of the following would BEST meet this objective? (Choose two.)
A. Dual power supply B. Off-site backups C. Automatic OS upgrades D. NIC teaming E. Scheduled penetration testing F. Network-attached storage Answer: A,B
The Chief Executive Officer (CEO) of an organization would like staff members to have the flexibility to
work from home anytime during business hours, incident during a pandemic or crisis, However, the CEO
is concerned that some staff members may take advantage of the of the flexibility and work from high-risk
countries while on holidays work to a third-party organization in another country. The Chief information
Officer (CIO) believes the company can implement some basic to mitigate the majority of the risk.
Which of the following would be BEST to mitigate CEO’s concern? (Select TWO).
A. Geolocation B. Time-of-day restrictions C. Certificates D. Tokens E. Geotagging F. Role-based access controls Answer: A,E
Given the following logs:
Which of the following BEST describes the type of attack that is occurring?
A. Rainbow table B. Dictionary C. Password spraying D. Pass-the-hash Answer: C
An organization is having difficulty correlating events from its individual AV. EDR. DLP. SWG. WAF.
MOM. HIPS, and CASB systems.
Which of the following is the BEST way to improve the situation?
A. Remove expensive systems that generate few alerts.
B. Modify the systems to alert only on critical issues.
C. Utilize a SIEM to centralize togs and dashboards.
D. Implement a new syslog/NetFlow appliance.
Answer: C
A security analyst is investigation an incident that was first reported as an issue connecting to network
shares and the internet, while reviewing logs and tool output, the analyst sees the following:
Which of the following attacks has occurred?
A. IP conflict B. Pass-the-hash C. MAC flooding D. Directory traversal E. ARP poisoning Answer: E
A security analyst is performing a packet capture on a series of SOAP HTTP requests for a security
assessment. The analyst redirects the output to a file After the capture is complete, the analyst needs to
review the first transactions quickly and then search the entire series of requests for a particular string.
Which of the following would be BEST to use to accomplish the task? (Select TWO).
A. head B. Tcpdump C. grep D. rail E. curl F. openssi G. dd Answer: A,B
Which of the following will MOST likely adversely impact the operations of unpatched traditional
programmable-logic controllers, running a back-end LAMP server and OT systems with
human-management interfaces that are accessible over the Internet via a web interface? (Choose two.)
A. Cross-site scripting B. Data exfiltration C. Poor system logging D. Weak encryption E. SQL injection F. Server-side request forgery Answer: D,F
A symmetric encryption algorithm Is BEST suited for:
A. key-exchange scalability. B. protecting large amounts of data. C. providing hashing capabilities, D. implementing non-repudiation. Answer: D
A company’s Chief Information Security Officer (CISO) recently warned the security manager that the
company’s Chief Executive Officer (CEO) is planning to publish a controversial option article in a national
newspaper, which may result in new cyberattacks.
Which of the following would be BEST for the security manager to use in a threat mode?
A. Hacktivists B. White-hat hackers C. Script kiddies D. Insider threats Answer: A
In which of the following common use cases would steganography be employed?
A. Obfuscation B. Integrity C. Non-repudiation D. Blockchain Answer: A
A security analyst receives the configuration of a current VPN profile and notices the authentication is
only applied to the IP datagram portion of the packet.
Which of the following should the analyst implement to authenticate the entire packet?
A. AH B. ESP C. SRTP D. LDAP Answer: B
