A security administrator has generated an SSH key pair to authenticate to a new server. Which of the following should the security administrator do NEXT to use the keys securely for authentication? (Select TWO).

Install the public key on the server.

Install the private key on the server.

Install both keys on the server

Securely wipe the certificate signing request.

A security engineer wants to add SSL to the public web server. Which of the following would be the FIRST step to implement the SSL certificate?

Install the intermediate certificate.

An organization uses application whitelisting to help prevent zero-day attacks. Malware was recently identified on one client, which was able to run despite the organization's application whitelisting approach. The forensics team has identified the malicious file, conducted a post-incident analysis, and compared this with the original system baseline. The team sees the following output: filename hash original winSCP.exe 2d da b1 4a 98 fc f1 98 06 b1 e5 26 b2 df e5 5b 3e cb 83 e1 lastest winSCP.exe a3 4a c2 4b 85 fa f2 dd 0b ba f4 16 b2 df f2 4b 3f ac 4a e1 Which of the following identifies the flaw in the team's application whitelisting approach?

Their approach uses executable names and not hashes for the whitelist

SHA-1 has known collision vulnerabilities and should not be used

The original baseline never captured the lastest file signature

Zero-day attacks require the lastest fiel signatures, and they never updated these

A security analyst wants to ensure the integrity of a file downloaded from the Internet The name of the file is code.zip. The analyst uses the vendor website to determine the 160-bit fingerprint of the input, and then reviews the following output: 8532f8c0bcb335cf231ec09e02da8f77e921e4c0 code.zip Which of the following can be determined from this output?

A message digest of 160 bits should be SHA-1 hash. The message digest listed is for SHA-1.

A message digest of 160 bits should be SHA-1 hash. The message digest listed is for MD5.

A message digest of 160 bits should be MD5 hash. The message digest listed is for MD5.

A message digest of 160 bits should be MD5 hash. The message digest listed is for SHA-1.

A security analyst is trying to improve the security posture of an organization. The analyst has determined there is a significant risk of pass-the-hash attacks on the desktop computers within the company. Which of the following would help to reduce the risk of this type of attack?

Use salts on the password hashes to prevent offline cracking attempts.

Require the desktop OS to use a stronger password hash.

Prevent credentials from being cached on the desktops.

Use TLS encryption in which plain text credentials are transmitted.

Require that passwords meet high length and complexity requirements.

A forensics analyst is investigating a hard drive for evidence of suspected illegal activity. Which of the following should the analyst do FIRST?

Create a hash of the hard drive.

Save a copy of the case number and date as a text file in the root directory.

Back up the pictures directory for further inspection

A computer forensics team is performing an integrity check on key systems files. The team is comparing the signatures of original baseline files with the latest signatures. The original baseline was taken on March 2, 2016, and was established to be clean of malware and uncorrupted. The latest file signatures were generated yesterday. One file is known to be corrupted, but when the team compares the signatures of the original and latest files, the team sees the following: Original: 2d da b1 4a 98 fc f1 98 06 b1 e5 5b 3e cb 83 e1 Latest: 2d da b1 4a 98 fc f1 98 06 b1 e5 5b 3e cb 83 e1 Which of the following is MOST likely the situation?

The algorithm used to calculate the hash has a collision weakness, and an attacker has exploited it.

The forensics team must have reverted the system to the original [date] which resulted in an identical hash calculation.

The original baseline was compromised, so the corrupted file was [xxxx] on the system.

The signature comparison is using two different algorithms that happen to have generated the same values.

Which of the following is unique to a stream cipher?

It perform as bit-level encryption.

It encrypts 128 bytes at a time.

An accountant is attempting to log in to the internal accounting system and receives a message that the website's certificate is fraudulent. The accountant finds instructions for manually installing the new trusted root onto the local machine. Which of the following would be the company's BEST option for this situation in the future?

Implement certificate management

A company's bank has reported that multiple corporate credit cards have been stolen over the past several weeks. The bank has provided the names of the affected cardholders to the company's forensics team to assist in the cyber-incident investigation. An incident responder learns the following information: * The timeline of stolen card numbers corresponds closely with affected users making Internet-based purchases from diverse websites via enterprise desktop PCs. * All purchase connections were encrypted, and the company uses an SSL inspection proxy for the inspection of encrypted traffic of the hardwired network. * Purchases made with corporate cards over the corporate guest WiFi network, where no SSL inspection occurs, were unaffected. Which of the following is the MOST likely root cause?

HTTPS sessions are being downgraded to insecure cipher suites

The SSL inspection proxy is feeding events to a compromised SIEM

The payment providers are insecurely processing credit card charges

The adversary has not yet established a presence on the guest WiFi network

A web server, which is configured to use TLS with AES-GCM-256, SHA-384, and ECDSA, recently suffered an information loss breach. Which of the following is MOST likely the cause?

Unauthenticated encryption method

A security analyst discovers that a company’s username and password database was posted on an Internet forum. The usernames and password are stored in plain text. Which of the following would mitigate the damage done by this type of data exfiltration in the future?

Create DLP controls that prevent documents from leaving the network.

Configure the web content filter to block access to the forum.

Increase password complexity requirements.

Quiz

Sec+

Andrew C 200 Fragen

Quiz starten

Dieses Quiz enthält Fragetypen, die sich im gewohnten Player öffnen.

Fragen in diesem Quiz (200)

1Which of the following is used to encrypt web application data?
1. AMD5
2. BAES
3. CSHA2
4. DSHA
5. ERSA
2A security administrator has generated an SSH key pair to authenticate to a new server. Which of the
following should the security administrator do NEXT to use the keys securely for authentication? (Select
TWO).
1. AInstall the public key on the server.
2. BInstall the private key on the server.
3. CEncrypt the public key.
4. DEncrypt the private key.
5. EInstall both keys on the server
6. FSecurely wipe the certificate signing request.
3A user needs to transmit confidential information to a third party. Which of the following should be used to
encrypt the message?
1. AAES
2. BSHA-2
3. CSSL
4. DRSA
4A company is executing a strategy to encrypt and sign all proprietary data in transit. The company recently
deployed PKI services to support this. Which of the following protocols supports the strategy and employs
certificates generated by the PKI? (Select THREE)
1. AS/MIME
2. BTLS
3. CHTTP-DIGEST
4. DSAML
5. ESIP
6. FIPSec
7. GKerberos
5A security engineer wants to add SSL to the public web server. Which of the following would be the FIRST
step to implement the SSL certificate?
1. ADownload the web certificate.
2. BInstall the intermediate certificate.
3. CGenerate a CSR.
4. DEncrypt the private key.
6A systems administrator has implemented multiple websites using host headers on the same server. The
server hosts two websites that require encryption and other websites where encryption is optional. Which of
the following should the administrator implement to encrypt web traffic for the require websites?
1. AExtended domain validation
2. BTLS host certificate
3. COCSP stapling
4. DWildcard certificate
7An organization uses application whitelisting to help prevent zero-day attacks. Malware was recently identified
on one client, which was able to run despite the organization's application whitelisting approach. The forensics
team has identified the malicious file, conducted a post-incident analysis, and compared this with the original
system baseline. The team sees the following output:
filename hash
original winSCP.exe 2d da b1 4a 98 fc f1 98 06 b1 e5 26 b2 df e5 5b 3e cb 83 e1
lastest winSCP.exe a3 4a c2 4b 85 fa f2 dd 0b ba f4 16 b2 df f2 4b 3f ac 4a e1

Which of the following identifies the flaw in the team's application whitelisting approach?
1. ATheir approach uses executable names and not hashes for the whitelist
2. BSHA-1 has known collision vulnerabilities and should not be used
3. CThe original baseline never captured the lastest file signature
4. DZero-day attacks require the lastest fiel signatures, and they never updated these
8A security analyst wants to ensure the integrity of a file downloaded from the Internet The name of the file is
code.zip. The analyst uses the vendor website to determine the 160-bit fingerprint of the input, and then
reviews the following output:
8532f8c0bcb335cf231ec09e02da8f77e921e4c0 code.zip
Which of the following can be determined from this output?
1. AA message digest of 160 bits should be SHA-1 hash. The message digest listed is for MD5.
2. BA message digest of 160 bits should be SHA-1 hash. The message digest listed is for SHA-1.
3. CA message digest of 160 bits should be MD5 hash. The message digest listed is for MD5.
4. DA message digest of 160 bits should be MD5 hash. The message digest listed is for SHA-1.
9A security analyst is trying to improve the security posture of an organization. The analyst has determined
there is a significant risk of pass-the-hash attacks on the desktop computers within the company. Which of
the following would help to reduce the risk of this type of attack?
1. ARequire the desktop OS to use a stronger password hash.
2. BPrevent credentials from being cached on the desktops.
3. CUse TLS encryption in which plain text credentials are transmitted.
4. DUse salts on the password hashes to prevent offline cracking attempts.
5. ERequire that passwords meet high length and complexity requirements.
10A forensics analyst is investigating a hard drive for evidence of suspected illegal activity. Which of the
following should the analyst do FIRST?
1. ACreate a hash of the hard drive.
2. BExport the Internet history
3. CSave a copy of the case number and date as a text file in the root directory.
4. DBack up the pictures directory for further inspection

11A cryptographer has developed a new proprietary hash function for a company and solicited employees to test the function before recommending its implementation. An employee takes the plaintext version of a
document and hashes it, then changes the original plaintext document slightly and hashes it, and continues
repeating this process until two identical hash values are produced from two different documents. Which of
the following BEST describes this cryptographic attack?
1. ABrute force
2. BKnown plaintext
3. CReplay
4. DCollision
12A computer forensics team is performing an integrity check on key systems files. The team is comparing the
signatures of original baseline files with the latest signatures. The original baseline was taken on March 2,
2016, and was established to be clean of malware and uncorrupted. The latest file signatures were generated
yesterday. One file is known to be corrupted, but when the team compares the signatures of the original and
latest files, the team sees the following:

Original: 2d da b1 4a 98 fc f1 98 06 b1 e5 5b 3e cb 83 e1
Latest: 2d da b1 4a 98 fc f1 98 06 b1 e5 5b 3e cb 83 e1

Which of the following is MOST likely the situation?
1. AThe forensics team must have reverted the system to the original [date] which resulted in an identical hash calculation.
2. BThe original baseline was compromised, so the corrupted file was [xxxx] on the system.
3. CThe signature comparison is using two different algorithms that happen to have generated the same
  values.
4. DThe algorithm used to calculate the hash has a collision weakness, and an attacker has exploited it.
13A technician suspects that a desktop was compromised with a rootkit. After removing the hard drive from the
desktop and running an offline file integrity check, the technician reviews the following output:
File name Expected hash Installed hash
Available Installed
version version
notepad.exe 48D403AD1FAB103BD04732ACB4B3A922 48D403AD1FAB103BD04732ACB4B3A922
49.33.21 48.100.2
kernel.dll AB502DE1A78AD1FAB1010AB3AFD45021 1AC406DE49564AD1FAB1019DDA264120
1.01.200 1.01.200
lsass.exe 0987352AB3823AAD1FAB1083AB94D2EE 0987352AB3823AAD1FAB1083AB94D3EE
0.900.20 0.900.12
httpd.exe AD1FAB10492839FAB109283AA38549AA AD1FAB10492839FAB109283AA38549AA
10.200.1 10.200.0

Based on the above output, which of the following is the malicious file?
1. Anotepad.exe
2. Blsass.exe
3. Ckernel.dll
4. Dhttpd.exe
14Which of the following provides/supports PFS?
1. AAES
2. BRC4
3. CDHE
4. DHMAC
15Using an ROT13 cipher to protect confidential information for unauthorized access is known as:
1. Asteganography
2. Bobfuscation
3. Cnon-repudiation
4. Ddiffusion
16Which of the following provides the BEST protection for sensitive information and data stored in cloud-based
services but still allows for full functionality and searchability of data within the cloud-based services?
1. AData encryption
2. BData masking
3. CAnonymization
4. DTokenization
17Which of the following is unique to a stream cipher?
1. AIt encrypts 128 bytes at a time.
2. BIt uses AES encryption.
3. CIt perform as bit-level encryption.
4. DIt is used in HTTPS.
18An accountant is attempting to log in to the internal accounting system and receives a message that the
website's certificate is fraudulent. The accountant finds instructions for manually installing the new trusted root onto the local machine. Which of the following would be the company's BEST option for this situation in the future?
1. AUtilize a central CRL
2. BImplement certificate management
3. CEnsure access to KMS
4. DUse a stronger cipher suite
19Given the following:
> md5.exe file1.txt
> AD1FAB1033773DC6A1E6021B7F503A210
> md5.exe file2.txt
> AD1FAB1033773DC6A1E6021B7F503A210

Which of the following concepts of cryptography is shown?
1. ACollision
2. BSalting
3. CSteganography
4. DStream cipher
20A company's bank has reported that multiple corporate credit cards have been stolen over the past several
weeks. The bank has provided the names of the affected cardholders to the company's forensics team to
assist in the cyber-incident investigation. An incident responder learns the following information:
* The timeline of stolen card numbers corresponds closely with affected users making Internet-based
purchases from diverse websites via enterprise desktop PCs.
* All purchase connections were encrypted, and the company uses an SSL inspection proxy for the inspection
of encrypted traffic of the hardwired network.
* Purchases made with corporate cards over the corporate guest WiFi network, where no SSL inspection
occurs, were unaffected.
Which of the following is the MOST likely root cause?
1. AHTTPS sessions are being downgraded to insecure cipher suites
2. BThe SSL inspection proxy is feeding events to a compromised SIEM
3. CThe payment providers are insecurely processing credit card charges
4. DThe adversary has not yet established a presence on the guest WiFi network
21Which of the following are used to substantially increase the computation time required to crack a password?
(Select TWO)
1. ABCRYPT
2. BSubstitution cipher
3. CECDHE
4. DPBKDF2
5. EDiffle-Hellman
22A web server, which is configured to use TLS with AES-GCM-256, SHA-384, and ECDSA, recently suffered
an information loss breach. Which of the following is MOST likely the cause?
1. AInsufficient key bit length
2. BWeak cipher suite
3. CUnauthenticated encryption method
4. DPoor implementation
23Which of the following implements a stream cipher?
1. AFile-level encryption
2. BIKEv2 exchange
3. CSFTP data transfer
4. DS/MIME encryption
24A security administrator is choosing an algorithm to generate password hashes. Which of the following would
offer the BEST protection against offline brute force attacks?
1. AMD5
2. B3DES
3. CAES
4. DSHA-1
25Which of the following categories would the use of proximity cards, smart cards, and RSA tokens be
considered when they are used together?
1. AMultifactor authenticatoin
2. BAdministrative control
3. CAccess control
4. DBiometrics
26A computer forensics analyst collected a flash drive that contained a single file with 500 pages of text. Which
of the following algorithms should the analyst use to validate the integrity of the file?
1. A3DES
2. BAES
3. CMD5
4. DRSA
27A user needs to transmit confidential information to a third party. Which of the following should be used to
encrypt the message?
1. AAES
2. BSHA-2
3. CSSL
4. DRSA
28Which of the following encryption algorithms is used primarily to secure data at rest?
1. AAES
2. BSSL
3. CTLS
4. DRSA
29Which of the following is an algorithm family that was developed for use cases in which power consumption
and lower computing power are constraints?
1. AElliptic curve
2. BRSA
3. CDiffie-Hellman
4. DSHA
30If two employees are encrypting traffic between them using a single encryption key, which of the following
algorithms are they using?
1. ARSA
2. B3DES
3. CDSA
4. DSHA-2
31Which of the following algorithms would be used to provide non-repudiation of a file transmission?
1. AAES
2. BRSA
3. CMD5
4. DSHA
32Which of the following algorithms has the SMALLEST key size?
1. ADES
2. BTwofish
3. CRSA
4. DAES
33A security analyst discovers that a company’s username and password database was posted on an Internet
forum. The usernames and password are stored in plain text. Which of the following would mitigate the
damage done by this type of data exfiltration in the future?
1. ACreate DLP controls that prevent documents from leaving the network.
2. BImplement salting and hashing.
3. CConfigure the web content filter to block access to the forum.
4. DIncrease password complexity requirements.
34After running an online password cracking tool, an attacker recovers the following password:
gh;jSKSTOi;618&
Based on the above information, which of the following technical controls have been implemented (Select
TWO).
1. AComplexity
2. BEncryption
3. CHashing
4. DLength
5. ESalting
6. FStretching
35Given the information below:

MD5HASH document.doc 049eab40fd36cabd1fab10b3cdf4a883
MD5HASH image.jpg 049eab40fd36cabd1fab10b3cdf4a883

Which of the following concepts are described above? (Select TWO).
1. ASalting
2. BCollision
3. CSteganography
4. DHashing
5. EKey stretching
36A database administrator needs to ensure all passwords are stored in a secure manner, so the administrator
adds randomly generated data to each password before string. Which of the following techniques BEST
explains this action?
1. APredictability
2. BKey stretching
3. CSalting
4. DHashing
37Which of the following is a random value appended to a credential that makes the credential less susceptible
to compromise when hashed?
1. ANonce
2. BSalt
3. COTP
4. DBlock cipher
38An attachment that was emailed to finance employees contained an embedded message. The security
administrator investigates and finds the intent was to conceal the embedded information from public view.
Which of the following BEST describes this type of message?
1. AObfuscation
2. BSteganography
3. CDiffusion
4. DBCRYPT
39A user wants to send a confidential message to a customer to ensure unauthorized users cannot access the
information. Which of the following can be used to ensure the security of the document while is transit and at
rest?
1. ABCRYPT
2. BPGP
3. CFTPS
4. DS/MIME
40Which of the following can be used to increase the time needed to brute force a hashed password?
1. ABCRYPT
2. BECDHE
3. CElliptic curve
4. DDiffie-Hellman
41Which of the following encryption algorithms require one encryption key? (Select TWO).
1. AMD5
2. B3DES
3. CBCRYPT
4. DRC4
5. EDSA
42A security engineer wants to introduce key stretching techniques to the account database to make password
guessing attacks more difficult. Which of the following should be considered to achieve this? (Select TWO).
1. ADigital signature
2. Bbcrypt
3. CPerfect forward secrecy
4. DSHA-256
5. EP-384
6. FPBKDF2
7. GRecord-level encryption
43A security administrator is hardening a VPN connection. Recently, company pre-shared keys were hijacked
during an MITM attack and reused to breach the VPN connection. Which of the following should the security
administrator do to BEST address this issue?
1. AImplement PKI
2. BImplement IPSec
3. CImplement TLS
4. DImplement PFS
44An analyst needs to set up a method for securely transferring files between systems. One of the requirements
is to authenticate the IP header and the payload. Which of the following services would BEST meet the
criteria?
1. ATLS
2. BPFS
3. CESP
4. DAH
45A computer incident first responder collected a flash drive that contained a single file with 500 pages of text. Which of the following algorithms should they use to validate the integrity of the file?
1. A3DES
2. BAES
3. CMD5
4. DRSA
46If two employees are encrypting traffic between them using a single encryption key, which of the following algorithms are they using?
1. ARSA
2. B3DES
3. CDSA
4. DSHA-2
47Which of the following algorithms is used to provide non-repudiation of a file transmission?
1. AAES
2. BRSA
3. CMD5
4. DSHA
48Mike is sending David an encrypted message using a symmetric encryption algorithm. What key should he use to encrypt the message?
1. AMike's public key
2. BMike's private key
3. CDavid's public key
4. DShared secret key
49Alan's team needs to perform computations on sensitive personal information but does not need access to the underlying data. What technology can the team use to perform these calculations without accessing the data?
1. AQuantum computing
2. BBlockchain
3. CHomomorphic encryption
4. DCertificate pinning
50Norm is using full-disk encryption technology to protect the contents of laptops against theft. What goal of cryptography is he attempting to achieve?
1. AIntegrity
2. BNonrepudiation
3. CAuthentication
4. DConfidentiality
51Brian discovers that a user suspected of stealing sensitive information is posting many image files to a message board. What technique might the individual be using to hide sensitive information in those images?
1. ASteganography
2. BHomomorphic encryption
3. CReplay attack
4. DBirthday attack
52Which one of the following statements about cryptographic keys is incorrect?
1. AAll cryptographic keys should be kept secret.
2. BLonger keys are better than shorter keys when the same algorithm is used.
3. CAsymmetric algorithms generally use longer keys than symmetric algorithms.
4. DDigital certificates are designed to share public keys.
53What type of cipher operates on one character of text at a time?
1. ABlock cipher
2. BBit cipher
3. CStream cipher
4. DBalanced cipher
54Vince is choosing a symmetric encryption algorithm for use in his organization. He would like to choose the strongest algorithm from the choices below. What algorithm should he choose?
1. ADES
2. B3DES
3. CRSA
4. DAES
55Acme Widgets has 10 employees and they all need the ability to communicate with one another using a symmetric encryption system. The system should allow any two employees to securely communicate without other employees eavesdropping. If an 11th employee is added to the organization, how many new keys must be added to the system?
1. A1
2. B2
3. C10
4. D11
56Glenn recently obtained a wildcard certificate for *. mydomain.com. Which one of the following domains would not be covered by this certificate?
1. Amydomain.com
2. Bcore.mydomain.com
3. Cdev.www.mydomain.com
4. Dmail.mydomain.com
57Which one of the following servers is almost always an offline CA in a large PKI deployment?
1. ARoot CA
2. BIntermediate CA
3. CRA
4. DInternal CA
58Which one of the following certificate formats is closely associated with Windows binary certificate files?
1. ADER
2. BPEM
3. CPFX
4. DP7B
59David would like to send Mike a message using an asymmetric encryption algorithm. What key should he use to encrypt the message?
1. ADavid's public key
2. BDavid's private key
3. CMike's public key
4. DMike's private key
60When Mike receives the message that David encrypted for him, what key should he use to decrypt the message?
1. ADavid's public key
2. BDavid's private key
3. CMike's public key
4. DMike's private key
61If David wishes to digitally sign the message that he is sending Mike, what key would he use to create the digital signature?
1. ADavid's public key
2. BDavid's private key
3. CMike's public key
4. DMike's private key
62When Mike receives the digitally signed message from David, what key should he use to verify the digital signature?
1. ADavid's public key
2. BDavid's private key
3. CMike's public key
4. DMike's private key
63A cybersecurity administrator has a reduced team and needs to operate an on-premises network and security infrastructure efficiently. To help with the situation, the administrator decides to hire a service provider. Which of the following should the administrator use?
1. ASDP
2. BAAA
3. CIaaS
4. DMSSP
5. EMicroservices
64A security engineer needs to Implement the following requirements:
- All Layer 2 switches should leverage Active Directory tor authentication.
- All Layer 2 switches should use local fallback authentication If Active Directory Is offline.
- All Layer 2 switches are not the same and are manufactured by several vendors.

Which of the following actions should the engineer take to meet these requirements? (Select TWO).
1. AImplement RADIUS.
2. BConfigure AAA on the switch the local login as secondary.
3. CConfigure port security on the switch with the secondary login method.
4. DImplement TACACS+
5. EEnable the local firewall on the Active Directory server.
6. FImplement a DHCP server.
65A company is upgrading its wireless infrastructure to WPA2-Enterprise using EAP-TLS. Which of the following must be part of the security architecture to achieve AAA? (Select TWO)
1. ADNSSEC
2. BReverse proxy
3. CVPN Concentrator
4. DPKI
5. EActive Directory
6. FRADIUS
66A company is launching a new internet platform for its clients. The company does not want to implement its own authorization solution but instead wants to rely on the authorization provided by another platform. Which of the following is the BEST approach to implement the desired solution?
1. AOAuth
2. BTACACS+
3. CSAML
4. DRADIUS
67A consultant is configuring a vulnerability scanner for a large, global organization in multiple countries. The consultant will be using a service account to scan systems with administrative privileges on a weekly basis, but there is a concern that hackers could gain access to the account and pivot through the global network. Which of the following would be BEST to help mitigate this concern?
1. ACreate consultant accounts for each region, each configured with push MFA notifications.
2. BCreate one global administrator account and enforce Kerberos authentication
3. CCreate different accounts for each region. limit their logon times, and alert on risky logins
4. DCreate a guest account for each region. remember the last ten passwords, and block password reuse
68A security analyst receives the configuration of a current VPN profile and notices the authentication is only applied to the IP datagram portion of the packet. Which of the following should the analyst implement to authenticate the entire packet?
1. AAH
2. BESP
3. CSRTP
4. DLDAP
69The Chief Security Officer (CSO) at a major hospital wants to implement SSO to help improve in the
environment patient data, particularly at shared terminals. The Chief Risk Officer (CRO) is concerned that training and guidance have been provided to frontline staff, and a risk analysis has not been performed. Which of the following is the MOST likely cause of the CRO's concerns?
1. ASSO would simplify username and password management, making it easier for hackers to pass guess accounts.
2. BSSO would reduce password fatigue, but staff would still need to remember more complex passwords.
3. CSSO would reduce the password complexity for frontline staff.
4. DSSO would reduce the resilience and availability of system if the provider goes offline.
70A cybersecurity analyst needs to implement secure authentication to third-party websites without users'
passwords. Which of the following would be the BEST way to achieve this objective?
1. AOAuth
2. BSSO
3. CSAML
4. DPAP
71An organization needs to implement more stringent controls over administrator/root credentials and service accounts. Requirements for the project include:
* Check-in/checkout of credentials
* The ability to use but not know the password
* Automated password changes
* Logging of access to credentials
Which of the following solutions would meet the requirements?
1. AOAuth 2.0
2. BSecure Enclave
3. CA privileged access management system
4. DAn OpenID Connect authentication system
72A company uses wireless for all laptops and keeps a very detailed record of its assets, along with a
comprehensive list of devices that are authorized to be on the wireless network. The Chief Information Officer (CIO) is concerned about a script kiddie potentially using an unauthorized device to brute force the wireless PSK and obtain access to the internal network. Which of the following should the company implement to BEST prevent this from occurring?
1. ABDU Guard
2. BWPA-EAP
3. CIP filtering
4. DA WIDS
73A network technician is installing a guest wireless network at a coffee shop. When a customer purchases an Item, the password for the wireless network is printed on the recent so the customer can log in. Which of the following will the technician MOST likely configure to provide the highest level of security with the least amount of overhead?
1. AWPA-EAP
2. BWEP-TKIP
3. CWPA-PSK
4. DWPS-PIN
74After entering a username and password, and administrator must gesture on a touch screen. Which of the following demonstrates what the administrator is providing?
1. AMultifactor authentication
2. BSomething you can do
3. CBiometric
4. DTwo-factor authentication
75An organization wants to implement a third factor to an existing multifactor authentication. The organization already uses a smart card and password. Which of the following would meet the organization's needs for a third factor?
1. ADate of birth
2. BFingerprint
3. CPIN
4. DTPM
76A security administrator currently spends a large amount of time on common security tasks, such aa report generation, phishing investigations, and user provisioning and deprovisioning This prevents the administrator from spending time on other security projects. The business does not have the budget to add more staff members. Which of the following should the administrator implement?
1. ADAC
2. BABAC
3. CSCAP
4. DSOAR
77An organization is developing an authentication service for use at the entry and exit ports of country borders. The service will use data feeds obtained from passport systems, passenger manifests, and high- definition video feeds from CCTV systems that are located at the ports. The service will incorporate machine-learning techniques to eliminate biometric enrollment processes while still allowing authorities to identify passengers with increasing accuracy over time. The more frequently passengers travel, the more accurately the service will identify them. Which of the following biometrics will MOST likely be used, without the need for enrollment? (Choose two.)
1. AVoice
2. BGait
3. CVein
4. DFacial
5. ERetina
6. FFingerprinting
78A company wants to provide centralized authentication for its wireless system. The wireless authentication
system must integrate with the directory back end. Which of the following is a AAA solution that will provide
the required wireless authentication?
1. ATACACS+
2. BMSCHAPv2
3. CRADIUS
4. DLDAP
79Which of the following is an example of federated access management?
1. AWindows passing user credentials on a peer-to-peer network
2. BApplying a new user account with a complex password
3. CImplementing a AAA framework from network access
4. Dusing a popular website login to provide access to another website
80A technician has installed a new AAA server, which will be used by the network team to control access to a
company's routers and switches. The technician completes the configuration by adding the network team
members to the NETWORK_TEAM group, and then adding the NETWORK_TEAM group to the appropriate
ALLOW_ACCESS access list. Only members of the network team should have access to the company's
routers and switches.

NETWORK_TEAM
Lee
Andrea
Pete

ALLOW_ACCESS
DOMAIN_USERS
AUTHENTICATED_USERS
NETWORK_TEAM

Members of the network team successfully test their ability to log on to various network devices configured to
use the AAA server. Weeks later, an auditor asks to review the following access log sample:
5/26/2017 10:20 PERMIT: LEE
5/27/2017 13:45 PERMIT: ANDREA
5/27/2017 09:12 PERMIT: LEE
5/28/2017 16:37 PERMIT: JOHN
5/29/2017 08:53 PERMIT: LEE
1. AConfigure the ALLOW_ACCESS group logic to use AND rather than OR.
2. BMove the NETWORK_TEAM group to the top of the ALLOW_ACCESS access list.
3. CDisable group nesting for ALLOW_ACCESS group in the AAA server.
4. DRemove the DOMAIN_USERS group from the ALLOW_ACCESS group.
81A security analyst is hardening a large-scale wireless network. The primary requirements are the following:
- Must use authentication through EAP-TLS certificates
- Must use an AAA server
- Must use the most secure encryption protocol
Given these requirements, which of the following should the analyst implement and recommend? (Select
TWO).
1. A802.1x
2. B802.3
3. CLDAP
4. DTKIP
5. ECCMP
6. FWPA2-PSK
82Two large organizations have signed a cooperative agreement that will require their employees to log on each
others' networks on a regular basis. Each company implements NAC. Which of the following should be
implemented if each company wants to continue using its own separate credentials while using the other
company's network?
1. AEAP-TLS
2. BWPA2-Enterprise
3. CRADIUS Federation
4. DOnline CA
83A security administrator at a large company is installing a Shibboleth component to enable its employees to
use the company's credentials when working at other peer organizations that support the same federation
model. Which of the following are required components that the administrator must install at the local
company? (Select TWO)
1. ARADIUS
2. BSSL/TLS certificate
3. CIdP
4. DTACACS+
5. EOAuth
84A systems administrator is auditing the company's Active Directory environment. It is quickly noted that the
username "company\bsmith" is interactively logged into several desktops across the organization. Which of
the following has the systems administrator MOST likely come across?
1. AShared account
2. BShared credentials
3. CFalse positive
4. DLocal account
85A security analyst is mitigating a pass-the-hash vulnerability on a Windows infrastructure. Given the
requirement, which of the following should the security analyst do to MINIMIZE the risk?
1. AEnable CHAP
2. BDisable MD5
3. CEnable Kerberos
4. DDisable PAP
86Which of the following is the MAIN disadvantage of using SSO
1. AThe architecture can introduce a single point of failure
2. BUsers need to authenticate for each resource they access.
3. CIt requires an organization to configure federation.
4. DThe authentication is transparent to the user.
87A network administrator at a large organization is reviewing methods to improve the security of the wired LAN. Any security improvement must be centrally managed and allow corporate-owned devices to have access to the intranet but limit others to Internet access only. Which of the following should the administrator
recommend?
1. A802.1X utilizing the current PKI infrastructure
2. BSSO to authenticate corporate users
3. CMAC address filtering with ACLs on the router
4. DPAM for users account management
88Which of the following is a component of multifactor authentication?
1. ARADIUS
2. BSSO
3. CTransistive trust
4. DOTP
89A company has migrated to two-factor authentication for accessing the corporate network, VPN, and SSO.
Several legacy applications cannot support multifactor authentication and must continue to use usernames
and passwords. Which of the following should be implemented to ensure the legacy applications are as secure
as possible while ensuring functionality? (Select TWO)
1. APrivileged accounts
2. BPasswords reuse restrictions
3. CPassword complexity requirements
4. DPassword recovery
5. EAccount disablement
90An organization needs to integrate with a third-party cloud application. The organization has 15000 users and
does not want to allow the cloud provider to query its LDAP authentication server directly. Which of the
following is the BEST way for the organization to integrate with the cloud application?
1. AUpload a separate list of users and passwords with a batch import.
2. BDistribute hardware tokens to the users for authentication to the cloud.
3. CImplement SAML with the organization's server acting as the identity provider.
4. DConfigure a RADIUS federation between the organization and the cloud provider.
91A security engineer at a manufacturing company is implementing a third-party cloud application. Rather than
creating users manually in the application, the engineer decides to use the SAML protocol. Which of the
following is being used for this implementation?
1. AThe manufacturing company is the service provider, and the cloud company is the identify provider.
2. BThe manufacturing company is the authorization provider, and the cloud company is the service provider.
3. CThe manufacturing company is the identity provider and the cloud company is the OAuth provider.
4. DThe manufacturing company is the identity provider, and the cloud company is the service provider.
5. EThe manufacturing company is the service provider, and the cloud company is the authorization provider.
92A security administrator is configuring a RADIUS server for wireless authentication. The configuration must
ensure client credentials are encrypted end-to-end between the client and the authenticator. Which of the
following protocols should be configured on the RADIUS server? (Select TWO).
1. APAP
2. BMSCHAP
3. CPEAP
4. DNTLM
5. ESAML
93A company has purchased a new SaaS application and is in the process of configuring it to meet the
company's needs. The director of security has requested that the SaaS application be integrated into the
company's IAM processes. Which of the following configurations should the security administrator set up in
order to complete this request?
1. ALDAP
2. BRADIUS
3. CSAML
4. DNTLM
94A systems engineer is setting up a RADIUS server to support a wireless network that uses certificate authentication. Which of the following protocols must be supported by both the RADIUS server and the WAPs?
1. ACCMP
2. BTKIP
3. CWPS
4. DEAP
95Which of the following uses tokens between the identity provider and the service provider to authenticate and authorize users to resources?
1. ARADIUS
2. BSSH
3. COAuth
4. DMSCHAP
96A systems administrator wants to implement a secure wireless network requiring wireless clients to pre-register with the company and install a PKI client certificate prior to being able to connect to the wireless network. Which of the following systems should the system administrator configure?
1. AEAP-TTLS
2. BEAP-TLS
3. CEAP-FAST
4. DEAP with PEAP
5. EEAP with MSCHAPv2
97A company wants to configure its wireless network to require username and password authentication. Which of the following should the systems administrator implement?
1. AWPS
2. BPEAP
3. CTKIP
4. DPKI
98A security analyst needs to make a recommendation for restricting access to certain segments of the network using only data-link layer security. Which of the following controls will the analyst MOST likely recommend?
1. AMAC
2. BACL
3. CBPDU
4. DARP
99A system in the network is used to store proprietary secrets and needs the highest level of security possible. Which of the following should a security administrator implement to ensure the system cannot be reached from the Internet?
1. AVLAN
2. BAir gap
3. CNAT
4. DFirewall
100A security administrator checks the table of a network switch, which shows the following output:
VLAN Physical Address Type Port
1 001a:42ff:5113 Dynamic GE0/5
1 0faa:abcf:ddee Dynamic GE0/5
1 c6a9:6616:758e Dynamic GE0/5
1 a1a3:b6a3:1212 Dynamic GE0/5
1 6025:2ad8:bca2 Dynamic GE0/5
1 b935:f995:b00b Dynamic GE0/5
Which of the following is happening to this switch?
1. AMAC Flooding
2. BDNS poisoning
3. CMAC cloning
4. DARP Poisoning
101A smart switch has the ability to monitor electrical levels and shut off power to a building in the event of power surge or other fault situation. The switch was installed on a wired network in a hospital and is monitored by the facilities department via a cloud application. The security administrator isolated the switch on a separate VLAN and set up a patch routine. Which of the following steps should also be taken to harden the smart switch?
1. ASet up an air gap for the switch.
2. BChange the default password for the switch.
3. CPlace the switch In a Faraday cage.
4. DInstall a cable lock on the switch
102A network engineer is troubleshooting wireless network connectivity issues that were reported by users. The issues are occurring only in the section of the building that is closest to the parking lot. Users are intermittently experiencing slow speeds when accessing websites and are unable to connect to network drives. The issues appear to increase when
laptop users return to their desks after using their devices in other areas of the building. There have also been reports of users being required to enter their credentials on web pages in order to gain access to them. Which of the following is the MOST likely cause of this issue?
1. AAn external access point is engaging in an evil-twin attack.
2. BThe signal on the WAP needs to be increased in that section of the building
3. CThe certificates have expired on the devices and need to be reinstalled
4. DThe users in that section of the building are on a VLAN that is being blocked by the firewall.
103After segmenting the network, the network manager wants to control the traffic between the segments. Which of the following should the manager use to control the network traffic?
1. ADMZ
2. BVPN
3. CVLAN
4. DACL
104A company has just completed a vulnerability scan of its servers. A legacy application that monitors the HVAC system is the datacenter presents several challenges, as the application vendor is no longer in business. Which of the following secure network architect concepts would BEST protect the other company if the legacy server were to be exploited?
1. AVirtualization
2. BAir gap
3. CVLAN
4. DExtranet
105The phones at a business are being replaced with VoIP phones that get plugged in-line between the switch and PC. The voice and data networks still need to be kept separate. Which of the following would allow for this?
1. ANAT
2. BIntranet
3. CSubnetting
4. DVLAN
106A law office has been leasing dark fiber from a local telecommunications company to connect a remote office to company headquarters. The telecommunications company has decided to discontinue its dark fiber product and is offering an MPLS connection, which the law office feels is too expensive. Which of the following is the BEST solution for the law office?
1. ARemote access VPN
2. BVLAN
3. CVPN concentrator
4. DSite-to-site VPN
107A network technician is setting up a new branch for a company. The users at the new branch will need to access resources securely as if they were at the main location Which of the following networking concepts would BEST accomplish this?
1. AVirtual network segmentation
2. BPhysical network segmentation
3. CSite-to-site VPN
4. DOut-of-band access
5. ELogical VLANs
108Which of the following BEST explains the difference between a credentialed scan and a non-credentialed scan?
1. AA credentialed scan sees devices in the network, including those behind NAT, while a non-credentialed scan sees outward-facing applications.
2. BA credentialed scan will not show up in systems logs because the scan is running with the necessary authorization, while non-credentialed scan activity will appear in the logs.
3. CA credentialed scan generates significantly more false positives, while a non-credential scan generates fewer false positives.
4. DA credentialed scan sees the system the way an authorized user sees the system, while a non-credentialed scan sees the system as a guest.
109In which of the following situations would it be BEST to use a detective control type for mitigation?
1. AA company implemented a network load balancer to ensure 99.999% availability of its web application.
2. BA company designed a backup solution to increase the chances of restoring services in case of a natural disaster.
3. CA company purchased an application-level firewall to isolate traffic between the accounting department and the information technology department.
4. DA company purchased an IPS system, but after reviewing the requirements, the appliance was supposed to monitor, not block, any traffic.
110Joe, a user at a company, clicked an email link led to a website that infected his workstation. Joe, was connected to the network, and the virus spread to the network shares. The protective measures failed to stop this virus, and it has continued to evade detection. Which of the following should administrator implement to protect the environment from this malware?
1. AInstall a definition-based antivirus.
2. BImplement an IDS/IPS
3. CImplement a heuristic behavior-detection solution.
4. DImplement CASB to protect the network shares.
111A network administrator has been asked to install an IDS to improve the security posture of an organization. Which of the following control types is an IDS?
1. ACorrective
2. BPhysical
3. CDetective
4. DAdministrative
112After reading a security bulletin, a network security manager is concerned that a malicious actor may have breached the network using the same software flaw. The exploit code is publicly available and has been reported as being used against other industries in the same vertical. Which of the following should the network security manager consult FIRST to determine a priority list for forensic review?
1. AThe vulnerability scan output
2. BThe IDS logs
3. CThe full packet capture data
4. DThe SIEM alerts
113An organization wants to implement a method to correct risks at the system/application layer. Which of the following is the BEST method to accomplish this goal?
1. AIDS/IPS
2. BIP tunneling
3. CWeb application firewall
4. DPatch management
114The application team within a company is asking the security team to investigate why its application is slow after an upgrade. The source of the team's application is 10.13.136.9, and the destination IP is 10.17.36.5, The security analyst pulls the logs from the endpoint security software but sees nothing is being blocked. The analyst then looks at the UTM firewall logs and sees the following:
Session Source Destination Protocol Port Action IPS DoS
12699 10.13.136.9 10.17.36.5 TCP 80 ALLOW YES NO
12699 10.13.136.9 10.17.36.5 TCP 443 ALLOW YES NO
12699 10.13.136.9 10.17.36.5 TCP 1433 DENY YES NO
12719 10.13.136.8 10.17.36.5 TCP 87 DENY YES NO
12719 10.13.136.9 10.17.36.5 TCP 88 ALLOW YES NO
12719 10.13.136.9 10.17.36.5 TCP 636 ALLOW YES NO
12899 10.13.136.6 10.17.36.9 UDP 9877 DENY NO NO
Which of the following should the security analyst request NEXT based on the UTM firewall analysis?
1. ARequest the application team to all TCP port 87 to listen on 10.17.36.5.
2. BRequest the network team to open port 1433 from 10.13.136.9 to 10.17.36.5.
3. CRequest the network team to turn off IPS for 10.13.136.8 going to 10.17.36.5.
4. DRequest the application team to reconfigure the application and allow RPC communication.
115Joe, a user at a company, clicked an email link that led to a website that infected his workstation. Joe was connected to the network, and the virus spread to the network shares. The protective measures failed to stop this virus, and it has continued to evade detection. Which of the following should a security administrator implement to protect the environment from this malware?
1. AInstall a definition-based antivirus.
2. BImplement an IDS/IPS.
3. CImplement a heuristic behavior-detection solution.
4. DImplement CASB to protect the network shares.
116After patching computers with the latest application security patches/updates, users are unable to open certain applications. Which of the following will correct the issue?
1. AModifying the security policy for patch management tools
2. BModifying the security policy for HIDS/HIPS
3. CModifying the security policy for DLP
4. DModifying the security policy for media control
117A large industrial system's smart generator monitors the system status and sends alerts to third-party
maintenance personnel when critical failures occur. While reviewing the network logs the company's security manager notices the generator's IP is sending packets to an internal file server's IP. Which of the following mitigations would be BEST for the security manager to implement while maintaining alerting capabilities?
1. ASegmentation
2. BFirewall whitelisting
3. CContainment
4. DIsolation
118The CSIRT is reviewing the lessons learned from a recent incident. A worm was able to spread unhindered throughout the network and infect a large number of computers and servers. Which of the following recommendations would be BEST to mitigate the impacts of a similar incident in the future?
1. AInstall a NIDS device at the boundary.
2. BSegment the network with firewalls.
3. CUpdate all antivirus signatures daily.
4. DImplement application blacklisting.
119A pharmaceutical sales representative logs on to a laptop and connects to the public WiFi to check emails and update reports. Which of the following would be BEST to prevent other devices on the network from directly accessing the laptop? (Choose two.)
1. ATrusted Platform Module
2. BA host-based firewall
3. CDLP solution
4. DFull disk encryption
5. EVPN
6. FAntivirus software
120Several employees return to work the day after attending an industry trade show. That same day, the security manager notices several malware alerts coming from each of the employee's workstations. The security manager investigates but finds no signs of an attack on the perimeter firewall or the NIDS. Which of the following is MOST likely causing the malware alerts?
1. AA worm that has propagated itself across the intranet, which was initiated by presentation media
2. BA fileless virus that is contained on a vCard that is attempting to execute an attack
3. CA Trojan that has passed through and executed malicious code on the hosts
4. DA USB flash drive that is trying to run malicious code but is being blocked by the host firewall
121A company recently experienced a data breach and the source was determined to be an executive who was charging a phone in a public area. Which of the following would MOST likely have prevented this breach?
1. AFirewall
2. BDevice pin
3. CUSB data blocker
4. DBiometrics
122A company has drafted an insider-threat policy that prohibits the use of external storage devices. Which of the following would BEST protect the company from data exfiltration via removable media?
1. AMonitoring large data transfer transactions in the firewall logs
2. BDeveloping mandatory training to educate employees about the removable media policy
3. CImplementing a group policy to block user access to system files
4. DBlocking removable-media devices and write capabilities using a host-based security tool
123A financial organization has adopted a new secure, encrypted document-sharing application to help with its customer loan process. Some important PII needs to be shared across this new platform, but it is getting blocked by the DLP systems. Which of the following actions will BEST allow the PII to be shared with the secure application without compromising the organization's security posture?
1. AConfigure the DLP policies to allow all PII
2. BConfigure the firewall to allow all ports that are used by this application
3. CConfigure the antivirus software to allow the application
4. DConfigure the DLP policies to whitelist this application with the specific PII
5. EConfigure the application to encrypt the PII
124A recently discovered zero-day exploit utilizes an unknown vulnerability in the SMB network protocol to rapidly infect computers. Once infected, computers are encrypted and held for ransom. Which of the following would BEST prevent this attack from reoccurring?
1. AConfigure the perimeter firewall to deny inbound external connections to SMB ports.
2. BEnsure endpoint detection and response systems are alerting on suspicious SMB connections.
3. CDeny unauthenticated users access to shared network folders.
4. DVerify computers are set to install monthly operating system, updates automatically.
125A company needs to centralize its logs to create a baseline and have visibility on its security events. Which of the following technologies will accomplish this objective?
1. ASecurity information and event management
2. BA web application firewall
3. CA vulnerability scanner
4. DA next generation firewall
126An organization routes all of its traffic through a VPN Most users are remote and connect into a corporate datacenter that houses confidential information There is a firewall at the Internet border followed by a DLP appliance, the VPN server and the datacenter itself. Which of the following is the WEAKEST design element?
1. AThe DLP appliance should be integrated into a NGFW.
2. BSplit-tunnel connections can negatively impact the DLP appliance's performance
3. CEncrypted VPN traffic will not be inspected when entering or leaving the network
4. DAdding two hops in the VPN tunnel may slow down remote connections
127Users at an organization have been installing programs from the internet on their workstations without first proper authorization. The organization maintains a portal from which users can install standardized programs. However, some users have administrative access on their workstations to enable legacy programs to function property. Which of the following should the security administrator consider implementing to address this issue?
1. AApplication code signing
2. BApplication whitelisting
3. CData loss prevention
4. DWeb application firewalls
128A security Administrator is reviewing the following firewall configuration after receiving reports that users are unable to connect to remote websites:
10 PERMIT FROM:ANY TO:ANY PORT:80
20 PERMIT FROM:ANY TO:ANY PORT:443
30 DENY FROM:ANY TO:ANY PORT:ANY

Which of the following is MOST secure solution the administrator can implement to fix this issue?
1. AAdd the following rule to the firewall: 5 PERMIT FROM:ANY TO:ANY PORT:53
2. BReplace rule number 10 with the following: 10 PERMIT FROM:ANY TO:ANY PORT:22
3. CInsert the following rule in the firewall: 25 PERMIT FROM:ANY TO:ANY PORTS:ANY
4. DRemove the following rule from the firewall: 30 DENY FROM:ANY TO:ANY PORT:ANY
129An employee workstation with an IP address of 201.211.38.211/24 reports it is unable to submit print jobs to a network printer at 204.211.38.52/24 after a firewall upgrade. The active firewall rules are as follows:
IP Address Protocol Port Number Action
204.211.38.1/24 ALL ALL Permit
204.211.38.211/24 ALL ALL Permit
204.211.38.52/24 UDP 631 Permit
204.211.38.52/24 TCP 25 Deny
Assuming port numbers have not been changed from their defaults, which of the following should be modified to allow printing to the network printer?
1. AThe permit statement for 204.211.38.52/24 should be changed to TCP port 631 instead of UDP.
2. BThe deny statement for 204.211.38.52/24 should be changed to a permit statement.
3. CThe permit statement for 204.211.38.52/24 should be changed to UDP port 443 instead of 631.
4. DThe permit statement for 204.211.38.211/24 should be changed to TCP port 631 only instead of ALL.
130An organization's research department uses workstations in an air-gapped network. A computer released products based on files that originated in the research department. Which of the following should management do to improve the security and confidentiality of the research files?
1. AImplement multifactor authentication on the workstations
2. BConfigure removable media controls on the workstations
3. CInstall a web application firewall in the research department
4. DInstall HIDS on each of the research workstations
131A customer calls a technician and needs to remotely connect to a web server to change some code manually. The technician needs to configure the user’s machine with protocols to connect to the UNIX web server, which is behind a firewall. Which of the following protocols does the technician MOST likely need to configure?
1. ASSH
2. BSFTP
3. CHTTPS
4. DSNMP
132A member of the human resources department is searching for candidate resumes and encounters the following error message when attempting to access popular job search websites:

Site Cannot Be Displayed: Unauthorized Access
Policy Violation: Job Search
User Group: Retail_Employee_Access
Client Address: 10.13.78.145
DNS Server: 10.1.1.9
Proxy IP Address: 10.1.1.29
Contact your systems administrator for assistance.

Which of the following would resolve this issue without compromising the company’s security policy?
1. ARenew the DNS settings and IP address on the employee’s computer.
2. BAdd the employee to a less restrictive group on the content filter.
3. CRemove the proxy settings from the employee’s web browser
4. DCreate an exception for the job search sites in the host-based firewall on the employee’s computer.
133A security analyst wants to limit the use of USB and external drives to protect against malware, as well as protect files leaving a user’s computer. Which of the following is the BEST method to use?
1. AFirewall
2. BRouter
3. CAntivirus software
4. DData loss prevention
134A member of the human resources department received the following email message after sending an email containing benefit and tax information to a candidate:
"Your message has been quarantined for the following policy violation: external_potential_PII. Please contact
the IT security administrator for further details."

Which of the following BEST describes why the message was received?
1. AThe DLP system flagged the message
2. BThe mail gateway prevented the message from being sent to personal email addresses
3. CThe company firewall blocked the recipient's IP address
4. DThe file integrity check failed for the attached files
135A Chief Security Officer (CSO) is concerned about the amount of PII that is stored locally on each salesperson's laptop. The sales department has a higher-than-average rate of lost equipment. Which of the following recommendations would BEST address the CSO's concern?
1. ADeploy an MDM solution
2. BImplement managed FDE
3. CReplace all hard drives with SEDs
4. DInstall DLP agents on each laptop
136An organization with a low tolerance for user inconvenience wants to protect laptop hard drives against loss or data theft. Which of the following would be the MOST acceptable?
1. ASED
2. BHSM
3. CDLP
4. DTPM
137A startup company is using multiple SaaS and IaaS platforms to stand up a corporate infrastructure and build out a customer-facing web application. Which of the following solutions would be BEST to provide security, manageability, and visibility into the platforms?
1. ASIEM
2. BDLP
3. CCASB
4. DSWG
138A security audit has revealed that a process control terminal is vulnerable to malicious users installing and
executing software on the system. The terminal is beyond end-of-life support and cannot be upgraded, so it is
placed on a protected network segment. Which of the following would be MOST effective to implement to
further mitigate the reported vulnerability?
1. ADNS sinkholing
2. BDLP rules on the terminal
3. CAn IP blacklist
4. DApplication whitelisting
139A security analyst has received an alert about being sent via email. The analyst's Chief information Security Officer (CISO) has made it clear that PII must be handled with extreme care From which of the following did the alert MOST likely originate?
1. AS/MIME
2. BDLP
3. CIMAP
4. DHIDS
140A RAT that was used to compromise an organization's banking credentials was found on a user's computer. The RAT evaded antivirus detection. It was installed by a user who has local administrator rights to the system as part of a remote management tool set. Which of the following recommendations would BEST prevent this from reoccurring?
1. ACreate a new acceptable use policy
2. BSegment the network into trusted and untrusted zones
3. CEnforce application whitelisting
4. DImplement DLP at the network boundary
141Which of the following would BEST identify and remediate a data-loss event in an enterprise using third-party, web-based services and file-sharing platforms?
1. ASIEM
2. BCASB
3. CUTM
4. DDLP
142During a recent audit, several undocumented and unpatched devices were discovered on the internal network. Which of the following can be done to prevent similar occurrences?
1. ARun weekly vulnerability scans and remediate any missing patches on all company devices.
2. BImplement rogue system detection and configure automated alerts for new devices.
3. CInstall DLP controls and prevent the use of USB drives on devices.
4. DConfigure the WAPs to use NAC and refuse connections that do not pass the health check.
143A salesperson often uses a USB drive to save and move files from a corporate laptop. The corporate laptop was recently updated, and now the files on the USB are read-only. Which of the following was recently added to the laptop?
1. AAntivirus software
2. BFile integrity check
3. CHIPS
4. DDLP
144A user attempts to send an email to an external domain and quickly receives a bounce-back message. The user then contacts the help desk stating the message is important and needs to be delivered immediately. While digging through the email logs, a systems administrator finds the email and bounce-back details:
Your email has been rejected because it appears to contain SSN information.
Sending SSN information via email to external recipients violates company policy.

Which of the following technologies successfully stopped the email from being sent?
1. ADLP
2. BUTM
3. CWAF
4. DDEP
145The director of information security at a company has recently directed the security engineering team to implement new security technologies aimed at reducing the impact of insider threats. Which of the following tools has the team MOST likely deployed? (Select TWO)
1. ADLP
2. BUTM
3. CSFTP
4. DSSH
5. ESSL
146A root cause analysis reveals that a web application outage was caused by one of the company's developers uploading a newer version of the third-party libraries that were shared among several applications. Which of the following implementations would be BEST to prevent the issue from reoccurring?
1. ACASB
2. BSWG
3. CContainerization
4. DAutomated failover
147A company has decided to move its operations to the cloud. It wants to utilize technology that will prevent users from downloading company applications for personal use, restrict data that is uploaded, and have visibility into which applications are being used across the company. Which of the following solutions will BEST meet these requirements?
1. AAn NGFW
2. BA CASB
3. CApplication whitelisting
4. DAn NG-SWG
148A network administrator is concerned about users being exposed to malicious content when accessing company cloud applications. The administrator wants to be able to block access to sites based on an AUP. The users must also be protected because many of them work from home or at remote locations, providing on-site technical support. Which of the following should the administrator employ to meet these criteria?
1. AImplement NAC
2. BImplement a SWG
3. CImplement an URL filter
4. DImplement an MDM
149A network engineer needs to build a solution that will allow guests at the company's headquarters to access the Internet via WiFi. This solution should not allow access to the internal corporate network, but it should require guests to sign off on the acceptable use policy before accessing the Internet. Which of the following should the engineer employ to meet these requirements?
1. AImplement open PSK on the APs
2. BDeploy a WAF
3. CConfigure WIPS on the APs
4. DInstall a captive portal
150A security engineer is installing a WAF to protect the company's website from malicious web requests over SSL. Which of the following is needed to meet the objective?
1. AA reverse proxy
2. BA decryption certificate
3. CA split-tunnel VPN
4. DLoad balanced servers
151A user recently entered a username and password into a recruiting application website that had been forged to look like the legitimate site Upon investigation, a security analyst the identifies the following:
* The legitimate websites IP address is 10.1.1.20 and eRecruit local resolves to the IP
* The forged website's IP address appears to be 10.2.12.99. based on NetFlow records
* AH three at the organization's DNS servers show the website correctly resolves to the legitimate IP
* DNS query logs show one of the three DNS servers returned a result of 10.2.12.99 (cached) at the approximate time of the suspected compromise.

Which of the following MOST likely occurred?
1. AA reverse proxy was used to redirect network traffic
2. BAn SSL strip MITM attack was performed
3. CAn attacker temporarily pawned a name server
4. DAn ARP poisoning attack was successfully executed
152Which of the following are requirements that must be configured for PCI DSS compliance? (Select TWO).
1. ATesting security systems and processes regularly
2. BInstalling and maintaining a web proxy to protect cardholder data
3. CAssigning a unique ID to each person with computer access
4. DEncrypting transmission of cardholder data across private networks
5. EBenchmarking security awareness training for contractors
6. FUsing vendor-supplied default passwords for system passwords
153Ann, a user, reports she is receiving emails that appear to be from organizations to which she belongs, but the emails contain links to websites that do not belong to those organizations. Which of the following security scenarios does this describe?
1. AA hacker is using Ann’s social media information to create a spear phishing attack.
2. BThe DNS servers for the organizations have been hacked and are pointing to malicious sites.
3. CThe company’s mail system has changed the organization’s links to point to a proxy server for security.
4. DAnn’s computer is infected with adware that has changed the email links.
154A company recently experienced data exfiltration via the corporate network. In response to the breach, a security analyst recommends deploying an out-of-band IDS solution. The analyst says the solution can be implemented without purchasing any additional network hardware. Which of the following solutions will be used to deploy the IDS?
1. ANetwork tap
2. BNetwork proxy
3. CHoneypot
4. DPort mirroring
155An incident response analyst at a large corporation is reviewing proxy log data. The analyst believes a malware infection may have occurred. Upon further review, the analyst determines the computer responsible for the suspicious network traffic is used by the Chief Executive Officer (CEO). Which of the following is the best NEXT step for the analyst to take?
1. ACall the CEO directly to ensure awareness of the event.
2. BRun a malware scan on the CEO's workstation.
3. CReimage the CEO's workstation.
4. DDisconnect the CEO's workstation from the network.
156Which of the following development models entails several iterative and incremental software development methodologies such as Scrum?
1. ASpiral
2. BWaterfall
3. CAgile
4. DRapid
157Which of the following models is considered as iterative approach with frequent testing?
1. AAgile
2. BWaterfall
3. CDevOps
4. DSandboxing
158A security analyst has been asked to investigate a situation after the SOC started to receive alerts from the SIEM. The analyst first looks at the domain controller and finds the following events (see 1st photo)
To better understand what is going on, the analyst runs a command and receives the following output (see 2nd photo)
Based on the analyst's findings, which of the following attacks is being executed?
1. ACredential harvesting
2. BKeylogger
3. CBrute-force
4. DSpraying
159A security analyst is looking for a solution to help communicate to the leadership team the severity levels of the organization's vulnerabilities. Which of the following would BEST meet this need?
1. ACVE
2. BSIEM
3. CSOAR
4. DCVSS
160A security analyst receives a SIEM alert that someone logged in to the appadmin test account, which is only used for the early detection of attacks. The security analyst then reviews the following application log:

Which of the following can the security analyst conclude?
1. AA replay attack is being conducted against the application.
2. BAn injection attack is being conducted against a user authentication system.
3. CA service account password may have been changed, resulting in continuous failed logins within the application.
4. DA credentialed vulnerability scanner attack is testing several CVEs against the application.
161A security analyst is reviewing information regarding recent vulnerabilities. Which of the following will the analyst MOST likely consult to validate which platforms have been affected?
1. AOSINT
2. BSIEM
3. CCVSS
4. DCVE
162A security analyst is investigating an incident to determine what an attacker was able to do on a compromised laptop. The analyst reviews the following SIEM log:

Which of the following describes the method that was used to compromise the laptop?
1. AAn attacker was able to move laterally from PC1 to PC2 using a pass-the-hash attack
2. BAn attacker was able to bypass application whitelisting by emailing a spreadsheet attachment with an embedded PowerShell in the file
3. CAn attacker was able to install malware to the CAasdf234 folder and use it to gain administrator nights and launch Outlook
4. DAn attacker was able to phish user credentials successfully from an Outlook user profile
163A penetration tester was able to connect to a company’s internal network and perform scans and staged attacks for the duration of the testing period without being noticed. The SIEM didn’t alert the security team to the presence of the penetration tester’s devices on the network. Which of the following would provide the security team with notification in a timely manner?
1. AImplement rogue system detection and sensors.
2. BCreate a trigger on the IPS and alert the security team when unsuccessful logins occur.
3. CDecrease the correlation threshold for alerts on the SIEM.
4. DRun a credentialed vulnerability scan.
164A security administrator is implementing a SIEM and needs to ensure events can be compared against each other based on when the events occurred and were collected. Which of the following does the administrator need to implement to ensure this can be accomplished?
1. ATOTP
2. BTKIP
3. CNTP
4. DHOTP
165Which of the following describes the ability of code to target a hypervisor from inside?
1. AFog computing
2. BVM escape
3. CImage forgery
4. DContainer breakout
166A company is planning to utilize its legacy desktop systems by converting them into dummy terminals and moving all heavy applications and storage to a centralized server that hosts all of the company’s required desktop applications. Which of the following describes the BEST deployment method to meet these requirements?
1. AIaaS
2. BVM Sprawl
3. CVDI
4. DPaaS
167Which of the following BEST explains why sandboxing is a best practice of testing software from an untrusted vendor prior to an enterprise deployment?
1. AIt allows the software to run in an unconstrained environment with full network access.
2. BIt eliminates the possibility of privilege escalation attacks against the local VM host.
3. CIt facilitates the analysis of possible malware by allowing it to run until resources are exhausted.
4. DIt restricts the access of the software to a contained logical space and limits possible damage.
168Which of the cloud model provides clients with servers, storage, and networks, but nothing else?
1. ASaaS
2. BPaaS
3. CIaaS
4. DDaaS
169A small retail business has a local store and a newly established and growing online storefront. A recent storm caused a power outage to the business and the local ISP, resulting in several hours of lost sales and delayed order processing. The business owner now needs to ensure two things:
- Protection from power outages
- Always-available connectivity in case of an outage.

The owner has decided to implement battery backup for the computer equipment. Which of the following would BEST fulfill the owner's second need?
1. ALease a telecommunications line to provide POTS for dial-up access
2. BConnect the business router to its own dedicated UPS
3. CPurchase services from a cloud provider for high availability
4. DReplace the business's wired network with a wireless network
170A Chief Information Security Officer (CISO) is concerned about the organization’s ability to continue business operations in the event of a prolonged DDoS attack on its local datacenter that consumes server resources. Which of the following will the CISO MOST likely recommend to mitigate this risk?
1. AUpgrade the bandwidth available into the datacenter.
2. BImplement a hot-site failover location.
3. CSwitch to complete SaaS offering to customers.
4. DImplement a challenge response test on all end-user queries.
5. EMigrate to a geographically dispersed cloud datacenter.
171An organization had implemented a two-step verification process to protect user access to data that is stored
in the cloud. Each employee now uses an email address or mobile number to receive a code to access the
data. Which of the following authentication methods did the organization implement?
1. AToken key
2. BStatic code
3. CPush notification
4. DHOTP
172To reduce costs and overhead, an organization wants to move from an on-premises email solution to a cloud-based email solution. At this time, no other services will be moving. Which of the following cloud models would BEST meet the needs of the organization?
1. AMaaS
2. BIaaS
3. CSaaS
4. DPaaS
173address the following:
- Centrally managing mobile devices
- Data loss prevention
Which of the following recommendations should the administrator include in the assessment? (Select TWO).
1. AImplement encryption.
2. BImplement hashing.
3. CImplement an MDM with mobile device hardening.
4. DImplement a VPN with secure connection to webmail.
5. EImplement and allow cloud storage features on the network.
174A financial institution would like to store its customer data in the cloud but still allow the data to be accessed and manipulated while encrypted. Doing so would prevent the cloud service provider from being able to decipher the data due to its sensitivity. The financial institution is not concerned about computational overheads and slow speeds. Which of the following cryptographic techniques would BEST meet the requirements?
1. AAsymmetric
2. BSymmetric
3. CHomomorphic
4. DEphereal
175Which of the following is a risk that is specifically associated with hosting applications in the public cloud?
1. AUnsecured root accounts
2. BZero-day
3. CShared tenancy
4. DInsider threat
176An organization has decided to host its web application and database in the cloud. Which of the following BEST describes the security concerns for this decision?
1. AAccess to the organization’s servers could be exposed to other cloud-provider clients.
2. BThe cloud vendor is a new attack vector within the supply chain.
3. COutsourcing the code development adds risk to the cloud provider.
4. DVendor support will cease when the hosting platforms reach EOL.
177SSH (Secure Shell)

Port# = [blank_start]22[blank_end]
Protocol = [blank_start]TCP[blank_end]
1. A22
2. BTCP
178Telnet

Port # = [blank_start]23[blank_end]
Protocol = [blank_start]TCP[blank_end]
1. A23
2. BTCP
179HTTP (HyperText Transfer Protocol)

Port# = [blank_start]80[blank_end]
Protocol = [blank_start]TCP[blank_end]
1. A80
2. BTCP
180HTTPS (Secure HTTP)

Port# = [blank_start]443[blank_end]
Protocol = [blank_start]TCP[blank_end]
1. A443
2. BTCP
181SMTP

Port# = [blank_start]25[blank_end]
Protocol = [blank_start]TCP[blank_end]
1. A25
2. BTCP
182POP

Port# = [blank_start]110[blank_end]
Protocol = [blank_start]TCP[blank_end]
1. A110
2. BTCP
183IMAP

Port# = [blank_start]143[blank_end]
Protocol = [blank_start]TCP[blank_end]
1. A143
2. BTCP
184LDAP

Port# = [blank_start]389[blank_end]
Protocol = [blank_start]both[blank_end]
1. A389
2. Bboth
185LDAPS (Secure LDAP)

Port# = [blank_start]636[blank_end]
Protocol = [blank_start]both[blank_end]
1. A636
2. Bboth
186RADIUS

Port # = [blank_start]1812[blank_end]
Protocol = [blank_start]both[blank_end]
1. A1812
2. Bboth
187NTP

Port # = [blank_start]123[blank_end]
Protocol = [blank_start]UDP[blank_end]
1. A123
2. BUDP
188DHCP

Server Port # = [blank_start]67[blank_end]
Client Port # = [blank_start]68[blank_end]
Protocol = [blank_start]UDP[blank_end]
1. A67
2. B68
3. CUDP
189DNS

Port# = [blank_start]53[blank_end]
Protocol = [blank_start]UDP[blank_end]
1. A53
2. BUDP
190SIP (Session Initiation Protocol)

Non-TLS Port# = [blank_start]5060[blank_end]
TLS Port# = [blank_start]5061[blank_end]
Protocol = [blank_start]both[blank_end]
1. A5060
2. B5061
3. Cboth
191H.323

Port# = [blank_start]1720[blank_end]
Protocol = [blank_start]TCP[blank_end]
1. A1720
2. BTCP
192A network administrator would like to configure a site-to-site VPN utilizing iPSec. The administrator wants the tunnel to be established with data integrity encryption, authentication and anti- replay functions Which of the following should the administrator use when configuring the VPN?
1. AAH
2. BEDR
3. CESP
4. DDNSSEC
193Phishing and spear-phishing attacks have been occurring more frequently against a company's staff. Which of the following would MOST likely help mitigate this issue?
1. ADNSSEC and DMARC
2. BDNS query logging
3. CExact mail exchanger records in the DNS
4. DThe addition of DNS conditional forwarders
194An organization’s Chief Information Officer (CIO) read an article that identified leading hacker trends and attacks, one of which is the alteration of URLs to IP addresses resulting in users being redirected to malicious websites. To reduce the chances of this happening in the organization, which of the following secure protocols should be implemented?
1. ADNSSEC
2. BIPSec
3. CLDAPS
4. DHTTPS
195As part of a corporate merger, two companies are combining resources. As a result, they must transfer files through the Internet in a secure manner. Which of the following protocols would BEST meet this objective? (Select TWO).
1. ALDAPS
2. BSFTP
3. CHTTPS
4. DDNSSEC
5. ESRTP
196Users are attempting to access a company's website but are transparently redirected to another website. The users confirm the URL is correct. Which of the following would BEST prevent this issue in the future?
1. ADNSSEC
2. BHTTPS
3. CIPSec
4. DTLS/SSL
197A security analyst has been asked to implement secure protocols to prevent cleartext credentials from being transmitted over the internal network. Which of the following protocols is the security analyst MOST likely to implement? (Select TWO).
1. ASNMPv3
2. BS/MIME
3. CDNSSEC
4. DSSH
5. ESFTP
198A systems administrator recently issued a public/private key pair that will be used for the company’s DNSSEC implementation. Which of the following configurations should the systems administrator implement NEXT?
1. ACreate a DNSKEY resource with the public key.
2. BInstall the private key using the RRSIG record.
3. CPoint the DS record to the company authoritative servers.
4. DAdd TCP port 443 to the DNS listener.
199A document that appears to be malicious has been discovered in an email that was sent to a company's Chief Financial Officer (CFO). Which of the following would be BEST to allow a security analyst to gather information and confirm it is a malicious document without executing any code it may contain?
1. AOpen the document on an air-gapped network
2. BView the document's metadata for origin clues
3. CSearch for matching file hashes on malware websites
4. DDetonate the document in an analysis sandbox
200A well-known organization has been experiencing attacks from APTs. The organization is concerned that custom malware is being created and emailed into the company or installed on USB sticks that are dropped in parking lots. Which of the following is the BEST defense against this scenario?
1. AConfiguring signature-based antivirus io update every 30 minutes
2. BEnforcing S/MIME for email and automatically encrypting USB drives upon insertion.
3. CImplementing application execution in a sandbox for unknown software.
4. DFuzzing new files for vulnerabilities if they are not digitally signed

Informationen

Beschreibung: Security+ Computer Studies Quiz am Sec+, erstellt von Andrew C am 04/05/2021.
Autor: Andrew C
Sprache: English
Aufrufe: 10
Schlagwörter: computer studies security+
Bewertung: Noch keine Bewertungen
Bewerte dieses Quiz
Bewerte dieses Quiz

Sec+

Fragen in diesem Quiz (200)

Informationen

Feedback

Wie gefällt dir das neue Design?