Test Dump Flashcards
Which of the following will MOST likely adversely impact the operations of unpatched traditional
programmable-logic controllers, running a back-end LAMP server and OT systems with human-management
interfaces that are accessible over the Internet via a web interface? (Choose two.)
A. Cross-site scripting
B. Data exfiltration
C. Poor system logging
D. Weak encryption
E. SQL injection
F. Server-side request forgery
D. Weak encryption
F. Server-side request forgery
A company recently transitioned to a strictly BYOD culture due to the cost of replacing lost or damaged
corporate-owned mobile devices. Which of the following technologies would be BEST to balance the BYOD
culture while also protecting the company’s data?
A. Containerization
B. Geofencing
C. Full-disk encryption
D. Remote wipe
C. Full-disk encryption
A Chief Security Office’s (CSO’s) key priorities are to improve preparation, response, and recovery practices to
minimize system downtime and enhance organizational resilience to ransomware attacks. Which of the
following would BEST meet the CSO’s objectives?
A. Use email-filtering software and centralized account management, patch high-risk systems, and restrict
administration privileges on fileshares.
B. Purchase cyber insurance from a reputable provider to reduce expenses during an incident.
C. Invest in end-user awareness training to change the long-term culture and behavior of staff and executives,
reducing the organization’s susceptibility to phishing attacks.
D. Implement application whitelisting and centralized event-log management, and perform regular testing and
validation of full backups.
D. Implement application whitelisting and centralized event-log management, and perform regular testing and
validation of full backups.
A network engineer has been asked to investigate why several wireless barcode scanners and wireless
computers in a warehouse have intermittent connectivity to the shipping server. The barcode scanners and
computers are all on forklift trucks and move around the warehouse during their regular use. Which of the
following should the engineer do to determine the issue? (Choose two.)
A. Perform a site survey
B. Deploy an FTK Imager
C. Create a heat map
D. Scan for rogue access points
E. Upgrade the security protocols
A. Perform a site survey
C. Create a heat map
A security administrator suspects an employee has been emailing proprietary information to a competitor.
Company policy requires the administrator to capture an exact copy of the employee’s hard disk. Which of the
following should the administrator use?
A. dd
B. chmod
C. dnsenum
D. logger
A. dd
Which of the following is MOST likely to outline the roles and responsibilities of data controllers and data
processors?
A. SSAE SOC 2
B. PCI DSS
C. GDPR
D. ISO 31000
C. GDPR
Phishing and spear-phishing attacks have been occurring more frequently against a company’s staff. Which of
the following would MOST likely help mitigate this issue?
A. DNSSEC and DMARC
B. DNS query logging
C. Exact mail exchanger records in the DNS
D. The addition of DNS conditional forwarders
C. Exact mail exchanger records in the DNS
On which of the following is the live acquisition of data for forensic analysis MOST dependent? (Choose two.)
A. Data accessibility
B. Legal hold
C. Cryptographic or hash algorithm
D. Data retention legislation
E. Value and volatility of data
F. Right-to-audit clauses
E. Value and volatility of data
F. Right-to-audit clauses
Which of the following incident response steps involves actions to protect critical systems while maintaining
business operations?
A. Investigation
B. Containment
C. Recovery
D. Lessons learned
B. Containment
A security auditor is reviewing vulnerability scan data provided by an internal security team. Which of the
following BEST indicates that valid credentials were used?
A. The scan results show open ports, protocols, and services exposed on the target host
B. The scan enumerated software versions of installed programs
C. The scan produced a list of vulnerabilities on the target host
D. The scan identified expired SSL certificates
Correct Answer: B
B. The scan enumerated software versions of installed programs
Which of the following BEST explains the difference between a data owner and a data custodian?
A. The data owner is responsible for adhering to the rules for using the data, while the data custodian is responsible for determining the corporate governance regarding the data
B. The data owner is responsible for determining how the data may be used, while the data custodian is
responsible for implementing the protection to the data
C. The data owner is responsible for controlling the data, while the data custodian is responsible for
maintaining the chain of custody when handling the data
D. The data owner grants the technical permissions for data access, while the data custodian maintains the
database access controls to the data
Correct Answer: B
B. The data owner is responsible for determining how the data may be used, while the data custodian is
responsible for implementing the protection to the data
A network engineer needs to build a solution that will allow guests at the company’s headquarters to access
the Internet via WiFi. This solution should not allow access to the internal corporate network, but it should
require guests to sign off on the acceptable use policy before accessing the Internet. Which of the following
should the engineer employ to meet these requirements?
A. Implement open PSK on the APs
B. Deploy a WAF
C. Configure WIPS on the APs
D. Install a captive portal
D. Install a captive portal
A captive portal is a customized login page that users must address before connecting to a public (or free) Wi-Fi network
Which of the following cloud models provides clients with servers, storage, and networks but nothing else?
A. SaaS
B. PaaS
C. IaaS
D. DaaS
C. IaaS
A network administrator needs to build out a new datacenter, with a focus on resiliency and uptime. Which of
the following would BEST meet this objective? (Choose two.)
A. Dual power supply
B. Off-site backups
C. Automatic OS upgrades
D. NIC teaming
E. Scheduled penetration testing
F. Network-attached storage
A. Dual power supply
B. Off-site backups
An organization is developing an authentication service for use at the entry and exit ports of country borders.
The service will use data feeds obtained from passport systems, passenger manifests, and high-definition
video feeds from CCTV systems that are located at the ports. The service will incorporate machine-learning
techniques to eliminate biometric enrollment processes while still allowing authorities to identify passengers
with increasing accuracy over time. The more frequently passengers travel, the more accurately the service will
identify them. Which of the following biometrics will MOST likely be used, without the need for enrollment?
(Choose two.)
A. Voice
B. Gait
C. Vein
D. Facial
E. Retina
F. Fingerprint
B. Gait
D. Facial
An organization needs to implement more stringent controls over administrator/root credentials and service
accounts. Requirements for the project include:
Check-in/checkout of credentials
The ability to use but not know the password
Automated password changes
Logging of access to credentials
Which of the following solutions would meet the requirements?
A. OAuth 2.0
B. Secure Enclave
C. A privileged access management system
D. An OpenID Connect authentication system
D. An OpenID Connect authentication system
Several employees return to work the day after attending an industry trade show. That same day, the security
manager notices several malware alerts coming from each of the employee’s workstations. The security
manager investigates but finds no signs of an attack on the perimeter firewall or the NIDS. Which of the
following is MOST likely causing the malware alerts?
A. A worm that has propagated itself across the intranet, which was initiated by presentation media
B. A fileless virus that is contained on a vCard that is attempting to execute an attack
C. A Trojan that has passed through and executed malicious code on the hosts
D. A USB flash drive that is trying to run malicious code but is being blocked by the host firewall
A. A worm that has propagated itself across the intranet, which was initiated by presentation media
An attacker sends multiple syn packets from multiple sources
Target: Web server
(answer format: attack identified, Remediation Action)
Botnet, enable DDoS protection
The attack is self propogating and compromises a SQL database using well-known credentials as it moves through the network
Target: Database Server
(answer format: attack identified, Remediation Action)
Worm, change the default application password
The Attacker establishes a connection which allows remote commands to be executed
Target: User
(answer format: attack identified, Remediation Action)
RAT, implement a host based IPS
