Quiz
CASP+ Practice Test 1
Crie uma conta grátis para terminar este quiz
Salve seu progresso e veja sua nota final.
Já tem uma conta? Inicie sessão
Perguntas do quiz (200)
1A developer wants to maintain integrity to each module of a program and ensure the code cannot be altered by malicious user. Which of the following would be BEST for the developer to perform? (Select two)
- AUtilize code signing by a trusted third party
- BImplement certificate-based authentication
- CVerify MD5 hashes
- DCompress the program with a password
- EMake the DACL read-only
2A satellite communications ISP frequently experiences outages and degraded modes of operation over one of its legacy satellite links due to the use of deprecated hardware and software. Three days per week, on average, a contracted company must follow a checklist of 16 different high-latency commands that must be run in serial to restore nominal performance. The ISP wants this process to be automated. Which of the following techniques would be BEST suited for this requirement?
- ADeploy SOAR utilities and runbooks
- BReplace the associated hardware
- CProvide the contractors with direct access to satellite telemetry data
- DReduce link latency on the affected ground and satellite segments
3A security analyst is trying to identify the source of a recent data loss incident. The analyst has reviewed all the for the time surrounding the identified all the assets on the network at the time of the data loss. The analyst suspects the key to finding the source was obfuscated in an application. Which of the following tools should the analyst use NEXT?
- ASoftware Decomplier
- BNetwork enurretator
- CLog reduction and analysis tool
- DStatic code analysis
4A security analyst receives an alert from the SIEM regarding unusual activity on an authorized public SSH jump server. To further investigate, the analyst pulls the event logs directly from /var/log/auth.log: graphic.ssh_auth_log. Which of the following actions would BEST address the potential risks by the activity in the logs?
- AAlerting the misconfigured services account password
- BModigying the AllowUsers configuration directive
- CRestricting external port 22 access
- DImplementing host-key preferences
5A recent data breach revealed that a company has a number of files containing customer data across its storage environments. These files are individualized for each employee and are used in tracking various customer orders, inquiries, and issues. The files are not encrypted and can be accessed by anyone. The senior management team would like to address these issues without interrupting existing processes. Which of the following should a security architect recommend?
- AA DLP program to identify which files have customer data and delete them
- BAn ERP program to identify which processes need to be tracked
- CA CMDB to report on systems that are not configured to security baselines
- DA CRM application to consolidate the data and provision access based on the process and need
6An organization recently experienced a ransomware attack. The security team leader is concerned about the attack reoccurring. However, no further security measures have been implemented. Which of the following processes can be used to identify potential prevention recommendations?
- ADetection
- BRemediation
- CPreparation
- DRecovery
7A financial institution has several that currently employ the following controls:
-The servers follow a monthly patching cycle
-All changes must go through a change management process
-Developers and systems administrators must log into a jumpbox to access the servers hosting the data using two-factor authentication
-The servers are on an isolated VLAN and cannot be directly accessed from the internal production network.
An outage recently occurred and lasted several days due to an upgrade that circumvented the approval process. Once the security team discovered an unauthorized patch was installed, they were able to resume operations within an hour. Which of the following should the security administrator recommend to reduce the time to resolution if a similar incident occurs in the future?- ARequire more than one approver for all change management requests
- BImplement file integrity monitoring with automated alerts on the servers
- CDisable automatic patch update capabilities on the servers
- DEnhanced audit logging on the jump servers and ship the logs to the SIEM
8A security administrator configured the account policies per security implementation guidelines. However, the accounts still appear to be susceptible to brute-force attacks. The following settings meet the existing compliance guidelines:
-Must have a minimum of 15 characters
-Must use one number
-Must use one capital letter
-Must not e one of the last 12 passwords used
Which of the following policies should be added to provide additional security?- AShared accounts
- BPassword complexity
- CAccount lockout
- DPassword history
- ETIme-based logins
9Which of the following terms refers to the delivery of encryption keys to a CASB or a third-party entity?
- AKey sharing
- BKey distribution
- CKey recovery
- DKey escrow
10A company’s employees are not permitted to access company systems while traveling internationally. The company email system is configured to block logins based on geographic location, but some employees report their mobile phones continue to sync email traveling. Which of the following is the MOST likely explanation? (Select two)
- AOutdated escalation attack
- BPrivilege escalation attack
- CVPN on the mobile device
- DUnrestricted email administrator accounts
- EChief use of UDP protocols
- FDisabled GPS on mobile devices
11An engineering team is developing and deploying a fleet of mobile devices to be used for specialized inventory management purposes. These devices should:
-Be based on open-source Android for user familiarity and ease
-Provide a single application for inventory management of physical assets
-Permit use of the camera be only the inventory application for the purposes of scanning
-Disallow any and all configuration baseline modifications
-Restrict all access to any device resource other than those requirement- ASet an application wrapping policy, wrap the application, distributes the inventory APK via the MAM tool, and test the application restrictions.
- BWrite a MAC sepolicy that defines domains with rules, label the inventory application, build the policy, and set to enforcing mode.
- CSwap out Android Linux kernel version for >2,4,0, but the internet build Android, remove unnecessary functions via MDL, configure to block network access, and perform integration testing
- DBuild and install an Android middleware policy with requirements added, copy the file into/ user/init, and then built the inventory application.
12A Chief Information Officer (CIO) wants to implement a cloud solution that will satisfy the following requirements:
-Support all phases of the SDLC
-Use tailored website portal software
-Allow the company to build and use its own gateway software
-Utilize its own data management platform
-Continue using agent-based security tools
Which of the following cloud-computing models should the CIO implement?- ASaaS
- BPaaS
- CMaaS
- DIaaS
13A small business requires a low-cost approach to theft detection for the audio recordings it produces and sells. Which of the following techniques will MOST likely meet the business’s needs?
- APerforming deep-packet inspection of all digital audio files
- BAdding identifying filesystem metadata to the digital audio files
- CImplementing steganography
- DPurchasing and installing a DRM suite
14A bank is working with a security architect to find the BEST solution to detect database management system compromises. The solution should meet the following requirements:
-Work at the application layer
-Send alerts on attacks from both privileged and malicious users
-Have a very low false positive
Which of the following should the architect recommend?- AFIM
- BWAF
- CNIPS
- DDAM
- EUTM
15During a system penetration test, a security engineer successfully gained access to a shell on a Linux host as a standard user and wants to elevate the privilege levels. Which of the following is a valid Linux post exploitation method to use to accomplish this goal?
- ASpawn a shell using sudo and an escape string such as sudo vim -c ‘!sh’
- BPerform ASIC password cracking on the host.
- CRead the /etc/passwd file to extract the usernames.
- DInitiate unquoted service path exploits.
- EUse the UNION operator to extract the database schema.
16The Chief information Officer (CIO) wants to establish a non-banding agreement with a third party that outlines the objectives of the mutual arrangement dealing with data transfers between both organizations before establishing a format partnership. Which of the follow would MOST likely be used?
- AMOU
- BOLA
- CNDA
- DSLA
17A small business would like to provide guests who are using mobile devices encrypted WPA3 access without first distributing PSKs or other credentials. Which of the following features will enable the business to meet this objective?
- ASimultaneous Authentication of Equals
- BEnhanced open
- CPerfect forward secrecy
- DExtensible Authentication Protocol
18Company A acquired Company B. During an audit, a security engineer found Company B’s environment was inadequately patched. In response, Company A placed a firewall between the two environments until Company B's infrastructure could be integrated into Company A’s security program. Which of the following risk-handling techniques was used?
- AAccept
- BAvoid
- CTransfer
- DMitigate
19An organization’s assessment of a third-party, non-critical vendor reveals that the vendor does not have cybersecurity insurance and IT staff turnover is high. The organization uses the vendor to move customer
office equipment from one service location to another. The vendor acquires customer data and access to the business via an API. Given this information, which of the following is a noted risk?- AFeature delay due to extended software development cycles
- BFinancial liability from a vendor data breach
- CTechnical impact to the API configuration
- DThe possibility of the vendor’s business ceasing operations
20A security analyst is performing a vulnerability assessment on behalf of a client. The analyst must define what constitutes a risk to the organization. Which of the following should be the analyst’s FIRST action?
- ACreate a full inventory of information and data assets.
- BAscertain the impact of an attack on the availability of crucial resources
- CDetermine which security compliance standards should be followed.
- DPerform a full system penetration test to determine the vulnerabilities.
21Which of the following is the BEST disaster recovery solution when resources are running in a cloud environment?
- ARemote provider BCDR
- BCloud provider BCDR
- CAlternative provider BCDR
- DPrimary provider BCDR
22A forensic investigator would use the foremost command for:
- Acloning disks.
- Banalyzing network-captured packets.
- Crecovering lost files.
- Dextracting features such as email addresses
23A security engineer is hardening a company’s multihomed SFTP server. When scanning a public-facing
network interface, the engineer finds the following ports are open:
-22
-25
-110
-137
-138
-139
-445
Internal Windows clients are used to transferring files to the server to stage them for customer download as part of the company’s distribution process. Which of the following would be the BEST solution to harden the system?- AClose ports 110, 138, and 139. Bind ports 22, 25, and 137 to only the internal interface
- BClose ports 25 and 110. Bind ports 137, 138, 139, and 445 to only the internal interface
- CClose ports 22 and 139. Bind ports 137, 138, and 445 to only the internal interface.
- DClose ports 22, 137, and 138. Bind ports 110 and 445 to only the internal interface
24A developer is creating a new mobile application for a company. The application uses REST API and TLS 1.2 to communicate securely with the external back-end server. Due to this configuration, the company is concerned about HTTPS interception attacks. Which of the following would be the BEST solution against this type of attack?
- ACookies
- BWildcard certificates
- CHSTS
- DCertificate pinning
25A company just released a new video card. Due to limited supply and nigh demand, attackers are employing automated systems to purchase the device through the company's web store so they can resell it on the secondary market. The company's Intended customers are frustrated. A security engineer suggests implementing a CAPTCHA system on the web store to help reduce the number of video cards purchased through automated systems. Which of the following now describes the level of risk?
- AInherent Low
- BMitigated
- CResidual
- DTransferred
26A threat hunting team receives a report about possible APT activity in the network. Which of the following threat management frameworks should the team implement?
- ANIST SP 800-53
- BMITRE ATT&CK
- CThe Cyber Kill Chain
- DThe Diamond Model of Intrusion Analysis
27A pharmaceutical company recently experienced a security breach within its customer-facing web portal. The attackers performed a SQL injection attack and exported tables from the company’s managed database, exposing customer information. The company hosts the application with a CSP utilizing the IaaS model. Which of the following parties is ultimately responsible for the breach?
- AThe pharmaceutical company
- BThe cloud software provider
- CThe web portal software vendor
- DThe database software vendor
28Which of the following is a benefit of using steganalysis techniques in forensic response?
- ABreaking a symmetric cipher used in secure voice communications
- BDetermining the frequency of unique attacks against DRM-protected media
- CMaintaining chain of custody for acquired evidence
- DIdentifying least significant bit encoding of data in a .wav file
29A company hired a third party to develop software as part of its strategy to be quicker to market. The company’s policy outlines the following requirements:
-The credentials used to publish production software to the container registry should be stored in a secure location.
-Access should be restricted to the pipeline service account, without the ability for the third-party developer to read the credentials directly
Which of the following would be the BEST recommendation for storing and monitoring access to these shared credentials?- ATPM
- BLocal secure password file
- CMFA
- DKey vault
30Due to internal resource constraints, the management team has asked the principal security architect to recommend a solution that shifts partial responsibility for application-level controls to the cloud provider. In the shared responsibility model, which of the following levels of service meets this requirement?
- AlaaS
- BSaaS
- CFaaS
- DPaaS
31An attacker infiltrated the code base of a hardware manufacturer and inserted malware before the code was compiled. The malicious code is now running at the hardware level across a number of industries and sectors. Which of the following categories BEST describes this type of vendor risk?
- ASDLC attack
- BSide-load attack
- CRemote code signing
- DSupply chain attack
32The Chief Information Security Officer of a startup company has asked a security engineer to implement a software security program in an environment that previously had little oversight. Which of the following testing methods would be BEST for the engineer to utilize in this situation?
- ASoftware composition analysis
- BCode obfuscation
- CStatic analysis
- DDynamic analysis
33A development team created a mobile application that contacts a company’s back-end APIs housed in a PaaS environment. The APIs have been experiencing high processor utilization due to scraping activities. The security engineer needs to recommend a solution that will prevent and remedy the behavior. Which of the following would BEST safeguard the APIs? (Select two)
- ABot protection
- BOAuth 2.0
- CInput validation
- DAutoscaling endpoints
- ERate limiting
- FCSRF protection
34An organization decided to begin issuing corporate mobile device users microSD HSMs that must be installed in the mobile devices in order to access corporate resources remotely. Which of the following features of these devices MOST likely led to this decision? (Select two)
- ASoftware-backed keystore
- BEmbedded cryptoprocessor
- CHardware-backed public key storage
- DSupport for stream ciphers
- EDecentralized key management
- FTPM 2.0 attestation services
35A security engineer needs 10 implement a CASB to secure employee user web traffic. A Key requirement is mat relevant event data must be collected from existing on-premises infrastructure components and consumed by me CASB to expand traffic visibility. The solution must be nighty resilient to network outages. Which of the following architectural components would BEST meet these requirements?
- ALog collection
- BReverse proxy
- CAWAF
- DAPI mode
36A security analyst wants to keep track of alt outbound web connections from workstations. The analyst's company uses an on-premises web filtering solution that forwards the outbound traffic to a perimeter firewall. When the security analyst gets the connection events from the firewall, the source IP of the outbound web traffic is the translated IP of the web filtering solution. Considering this scenario involving source NAT. Which of the following would be the BEST option to inject in the HTTP header to include the real source IP from workstations?
- AX-Forwarded-Proto
- BX-Forwarded-For
- CCache-Control
- DStrict-Transport-Security
- EContent-Security-Policy
37A Chief information Security Officer (CISO) has launched to create a rebuts BCP/DR plan for the entire company. As part of the initiative , the security team must gather data supporting operational importance for the applications used by the business and determine the order in which the application must be back online. Which of the following be the FIRST step taken by the team?
- APerform a review of all policies an procedures related to BGP a and DR and created an educated educational module that can be assigned to at employees to provide training on BCP/DR events.
- BCreate an SLA for each application that states when the application will come back online and distribute this information to the business units.
- CHave each business unit conduct a BIA and categories the application according to the cumulative data gathered.
- DImplement replication of all servers and application data to back up detacenters that are geographically from the central datacenter and release an upload BPA to all clients.
38A DevOps team has deployed databases, event-driven services, and an API gateway as PaaS solution that will support a new billing system. Which of the following security responsibilities will the DevOps team need to perform?
- ASecurely configure the authentication mechanisms
- BPatch the infrastructure at the operating system
- CExecute port scanning against the services
- DUpgrade the service as part of life-cycle management
39A company is implementing SSL inspection. During the next six months, multiple web applications that will be separated out with subdomains will be deployed. Which of the following will allow the inspection of the data without multiple certificate deployments?
- AInclude all available cipher suites.
- BCreate a wildcard certificate.
- CUse a third-party CA.
- DImplement certificate pinning
40A user experiences an HTTPS connection error when trying to access an Internet banking website from a corporate laptop. The user then opens a browser on a mobile phone and is able to access the same Internet banking website without issue. Which of the following security configurations is MOST likely the cause of the error?
- AHSTS
- BTLS 1.2
- CCertificate pinning
- DClient authentication
41An organization requires a legacy system to incorporate reference data into a new system. The organization anticipates the legacy system will remain in operation for the next 18 to 24 months. Additionally, the legacy system has multiple critical vulnerabilities with no patches available to resolve them. Which of the following is the BEST design option to optimize security?
- ALimit access to the system using a jump box.
- BPlace the new system and legacy system on separate VLANs
- CDeploy the legacy application on an air-gapped system.
- DImplement MFA to access the legacy system.
42The Chief information Officer (CIO) wants to implement enterprise mobility throughout the organization. The goal is to allow employees access to company resources. However the CIO wants the ability to enforce configuration settings, manage data, and manage both company-owned and personal devices. Which of the following should the CIO implement to achieve this goal?
- ABYOO
- BCYOD
- CCOPE
- DMDM
43Which of the following represents the MOST significant benefit of implementing a passwordless authentication solution?
- ABiometric authenticators are immutable
- BThe likelihood of account compromise is reduced
- CZero trust is achieved.
- DPrivacy risks are minimized.
44A security compliance requirement states that specific environments that handle sensitive data must be protected by need-to-know restrictions and can only connect to authorized endpoints. The requirement also states that a DLP solution within the environment must be used to control the data from leaving the environment.
Which of the following should be implemented for privileged users so they can support the environment from their workstations while remaining compliant?- ANAC to control authorized endpoints
- BFIM on the servers storing the data
- CA jump box in the screened subnet
- DA general VPN solution to the primary network
45An attack team performed a penetration test on a new smart card system. The team demonstrated that by subjecting the smart card to high temperatures, the secret key could be revealed. Which of the following side channel attacks did the team use?
- ADifferential power analysis
- BDifferential fault analysis
- CDifferential temperature analysis
- DDifferential timing analysis
46A security architect works for a manufacturing organization that has many different branch offices. The architect is looking for a way to reduce traffic and ensure the branch offices receive the latest copy of revoked certificates issued by the CA at the organization’s headquarters location. The solution must also have the lowest power requirement on the CA. Which of the following is the BEST solution?
- ADeploy an RA on each branch office.
- BUse Delta CRLs at the branches.
- CConfigure clients to use OCSP.
- DSend the new CRLs by using GPO.
47A company's Chief Information Officer wants to Implement IDS software onto the current system's architecture to provide an additional layer of security. The software must be able to monitor system activity, provide Information on attempted attacks, and provide analysis of malicious activities to determine the processes or users Involved. Which of the following would provide this information?
- AHIPS
- BUEBA
- CHlDS
- DNIDS
48A user from the sales department opened a suspicious file attachment. The sales department then contacted the SOC to investigate a number of unresponsive systems, and the team successfully identified the file and the origin of the attack. Which of the following is t he NEXT step of the incident response plan?
- ARemediation
- BContainment
- CResponse
- DRecovery
49A system administrator at a medical imaging company discovers protected health information (PHI) on a general-purpose file server. Which of the following steps should the administrator take NEXT?
- AIsolate all of the PHI on its own VLAN and keep it segregated at Layer 2.
- BTake an MD5 hash of the server.
- CDelete all PHI from the network until the legal department is consulted.
- DConsult the legal department to determine the legal requirements.
50Leveraging cryptographic solutions to protect data that is in use ensures the data is encrypted:
- Awhen it is passed across a local network.
- Bin memory during processing
- Cwhen it is written to a system’s solid-state drive.
- Dby an enterprise hardware security module.
51A company just released a new video card. Due to limited supply and high demand, attackers are employing automated systems to purchase the device through the company's web store so they can resell it on the secondary market. The company's intended customers are frustrated. A security engineer suggests implementing a CAPTCHA system on the web store to help reduce the number of video cards purchased through automated systems. Which of the following now describes the level of risk?
- AInherent
- BLow
- CMitigated
- DResidual
- ETransferred
52An organization is assessing the security posture of a new SaaS CRM system that handles sensitive Pll and identity information, such as passport numbers. The SaaS CRM system does not meet the organization's current security standards. The assessment identifies the following:
-There will be a $20,000 per day revenue loss for each day the system is delayed going into production.
-The inherent risk is high.
-The residual risk is low
-There will be a staged deployment to the solution rollout to the contact center.
Which of the following risk-handling techniques will BEST meet the organization's requirements?- AApply for a security exemption, as the risk is too high to accept
- BTransfer the risk to the SaaS CRM vendor, as the organization is using a cloud service
- CAccept the risk, as compensating controls have been implemented to manage the risk.
- DAvoid the risk by accepting the shared responsibility model with the SaaS CRM provider.
53A help desk technician just informed the security department that a user downloaded a suspicious file from internet explorer last night. The user confirmed accessing all the files and folders before going home from work. the next morning, the user was no longer able to boot the system and was presented a screen with a phone number. The technician then tries to boot the computer using wake-on-LAN, but the system would not come up. Which of the following explains why the computer would not boot?
- AThe operating system was corrupted.
- BSElinux was in enforced status.
- CA secure boot violation occurred
- DThe disk was encrypted.
54A junior developer is informed about the impact of new malware on an Advanced RISC Machine (ARM) CPU, and the code must be fixed accordingly. Based on the debug, the malware is able to insert itself in another process memory location. Which of the following technologies can the developer enable on the ARM architecture to prevent this type of malware?
- AExecute never
- BNo-execute
- CTotal memory encryption
- DVirtual memory encryption
55An organization is designing a network architecture that must meet the following requirements:
-Users will only be able to access predefined services.
-Each user will have a unique allow list defined for access.
-The system will construct one-to-one subject/object access paths dynamically.
Which of the following architectural designs should the organization use to meet these requirements?- APeer-to-peer secure communications enabled by mobile applications
- BProxied application data connections enabled by API gateways
- CMicrosegmentation enabled by software-defined networking
- DVLANs enabled by network infrastructure devices
56A company is looking to fortify its cybersecurity defenses and is focusing on its network infrastructure. The solution cannot affect the availability of the company’s services to ensure false positives do not drop legitimate traffic. Which of the following would satisfy the requirement?
- ANIDS
- BNIPS
- CWAF
- DReverse proxy
57A security architect needs to implement a CASB solution for an organization with a highly distributed remote workforce. One Of the requirements for the implementation includes the capability to discover SaaS applications and block access to those that are unapproved or identified as risky. Which of the following would BEST achieve this objective?
- ADeploy endpoint agents that monitor local web traffic to enforce DLP and encryption policies.
- BImplement cloud infrastructure to proxy all user web traffic to enforce DI-P and encryption policies.
- CImplement cloud infrastructure to proxy all user web traffic and control access according to centralized policy.
- DDeploy endpoint agents that monitor local web traffic and control access according to centralized policy.
58An organization’s hunt team thinks a persistent threats exists and already has a foothold in the enterprise network. Which of the following techniques would be BEST for the hunt team to use to entice the adversary to uncover malicious activity?
- ADeploy a SOAR tool.
- BModify user password history and length requirements.
- CApply new isolation and segmentation schemes.
- DImplement decoy files on adjacent hosts.
59During a remodel, a company’s computer equipment was moved to a secure storage room with cameras positioned on both sides of the door. The door is locked using a card reader issued by the security team, and only the security team and department managers have access to the room. The company wants to be able to identify any unauthorized individuals who enter the storage room by following an authorized employee. Which of the following processes would BEST satisfy this requirement?
- AMonitor camera footage corresponding to a valid access request.
- BRequire both security and management to open the door.
- CRequire department managers to review denied-access requests.
- DIssue new entry badges on a weekly basis.
60A security consultant needs to set up wireless security for a small office that does not have Active Directory. Despite the lack of central account management, the office manager wants to ensure a high level of defense to prevent brute-force attacks against wireless authentication. Which of the following technologies would BEST meet this need?
- AFaraday cage
- BWPA2 PSK
- CWPA3 SAE
- DWEP 128 bit
61A disaster recovery team learned of several mistakes that were made during the last disaster recovery parallel test. Computational resources ran out at 70% of restoration of critical services. Which of the following should be modified to prevent the issue from reoccurring?
- ARecovery point objective
- BRecovery time objective
- CMission-essential functions
- DRecovery service level
62In preparation for the holiday season, a company redesigned the system that manages retail sales and moved it to a cloud service provider. The new infrastructure did not meet the company’s availability requirements. During a postmortem analysis, the following issues were highlighted:
-International users reported latency when images on the web page were initially loading.
-During times of report processing, users reported issues with inventory when attempting to place orders
-Despite the fact that ten new API servers were added, the load across servers was heavy at peak times.
Which of the following infrastructure design changes would be BEST for the organization to implement to
avoid these issues in the future?- AServe static content via distributed CDNs, create a read replica of the central database and pull reports from there, and auto-scale API servers based on performance.
- BIncrease the bandwidth for the server that delivers images, use a CDN, change the database to a non-relational database, and split the ten API servers across two load balancers.
- CServe images from an object storage bucket with infrequent read times, replicate the database across different regions, and dynamically create API servers based on load.
- DServe static-content object storage across different regions, increase the instance size on the managed relational database, and distribute the ten API servers across multiple regions.
63An energy company is required to report the average pressure of natural gas used over the past quarter. A PLC sends data to a historian server that creates the required reports. Which of the following historian server locations will allow the business to get the required reports in an and IT environment?
- AIn the environment, use a VPN from the IT environment into the environment
- BIn the environment, allow IT traffic into the environment.
- CIn the IT environment, allow PLCs to send data from the environment to the IT environment.
- DUse a screened subnet between the and IT environments.
64After a security incident, a network security engineer discovers that a portion of the company’s sensitive external traffic has been redirected through a secondary ISP that is not normally used. Which of the following would BEST secure the routes while allowing the network to function in the event of a single provider failure?
- ADisable BGP and implement a single static route for each internal network.
- BImplement a BGP route reflector.
- CImplement an inbound BGP prefix list
- DDisable BGP and implement OSPF
65An organization requires a contractual document that includes:
-An overview of what is covered
-Goals and objectives
-Performance metrics for each party
-A review of how the agreement is managed by all parties
Which of the following BEST describes this type of contractual document?- ASLA
- BBAA
- CNDA
- DISA
66While investigating a security event, an analyst finds evidence that a user opened an email attachment from an unknown source. Shortly after the user opened the attachment, a group of servers experienced a large amount of network and resource activity. Upon investigating the servers, the analyst discovers the servers were encrypted by ransomware that is demanding payment within 48 hours or all data will be destroyed. The company has no response plans for ransomware. Which of the following is the NEXT step the analyst should take after reporting the incident to the management team?
- APay the ransom within 48 hours.
- BIsolate the servers to prevent the spread.
- CNotify law enforcement.
- DRequest that the affected servers be restored immediately.
67The Chief information Officer (CIO) of a large bank, which uses multiple third-party organizations to deliver a service, is concerned about the handling and security of customer data by the parties. Which of the following should be implemented to BEST manage the risk?
- AEstablish a review committee that assesses the importance of suppliers and ranks them according to contract renewals. At the time of contract renewal, incorporate designs and operational controls into the contracts and a right-to-audit clause. Regularly assess the supplier’s post-contract renewal with a dedicated risk management team.
- BEstablish a team using members from first line risk, the business unit, and vendor management to assess only design security controls of all suppliers. Store findings from the reviews in a database for all other business units and risk teams to reference.
- CEstablish an audit program that regularly reviews all suppliers regardless of the data they access, how they access the data, and the type of data, Review all design and operational controls based on best practice standard and report the finding back to upper management.
- DEstablish a governance program that rates suppliers based on their access to data, the type of data, and how they access the data Assign key controls that are reviewed and managed based on the supplier’s rating. Report finding units that rely on the suppliers and the various risk teams.
68A cybersecurity analyst receives a ticket that indicates a potential incident is occurring. There has been a large in log files generated by a generated by a website containing a ‘’Contact US’’ form. The analyst must determine if the increase in website traffic is due to a recent marketing campaign of if this is a potential incident. Which of the following would BEST assist the analyst?
- AEnsuring proper input validation is configured on the ‘’Contact US’’ form
- BDeploy a WAF in front of the public website
- CChecking for new rules from the inbound network IPS vendor
- DRunning the website log files through a log reduction and analysis tool
69A technician is reviewing the logs and notices a large number of files were transferred to remote sites over the course of three months. This activity then stopped. The files were transferred via TLS-protected HTTP sessions from systems that do not send traffic to those sites. The technician will define this threat as:
- Aa decrypting RSA using obsolete and weakened encryption attack.
- Ba zero-day attack.
- Can advanced persistent threat.
- Dan on-path attack.
70A company processes data subject to NDAs with partners that define the processing and storage constraints for the covered data. The agreements currently do not permit moving the covered data to the cloud, and the company would like to renegotiate the terms of the agreements. Which of the following would MOST likely help the company gain consensus to move the data to the cloud?
- ADesigning data protection schemes to mitigate the risk of loss due to multitenancy
- BImplementing redundant stores and services across diverse CSPs for high availability
- CEmulating OS and hardware architectures to blur operations from CSP view
- DPurchasing managed FIM services to alert on detected modifications to covered data
71A vulnerability analyst identified a zero-day vulnerability in a company’s internally developed software. Since the current vulnerability management system does not have any checks for this vulnerability, an engineer has been asked to create one. Which of the following would be BEST suited to meet these requirements?
- AARF
- BISACs
- CNode.js
- DOVAL
72An organization is assessing the security posture of a new SaaS CRM system that handles sensitive PI I and identity information, such as passport numbers. The SaaS CRM system does not meet the organization's current security standards. The assessment identifies the following:
-There will be a 520,000 per day revenue loss for each day the system is delayed going into production.
-The inherent risk is high
-The residual risk is low.
-There will be a staged deployment to the solution rollout to the contact center.
Which of the following risk-handling techniques will BEST meet the organization's requirements?- AApply for a security exemption, as the risk is too high to accept.
- BTransfer the risk to the SaaS CRM vendor, as the organization is using a cloud service.
- CAccept the risk, as compensating controls have been implemented to manage the risk.
- DAvoid the risk by accepting the shared responsibility model with the SaaS CRM provider
73A security analyst is investigating a possible buffer overflow attack. The following output was found on a user’s workstation: graphic.linux_randomization.prg. Which of the following technologies would mitigate the manipulation of memory segments?
- ANX bit
- BASLR
- CDEP
- DHSM
74A company's finance department acquired a new payment system that exports data to an unencrypted file on the system. The company implemented controls on the file so only appropriate personnel are allowed access. Which of the following risk techniques did the department use in this situation?
- AAccept
- BAvoid
- CTransfer
- DMitigate
75A company is moving most of its customer-facing production systems to the cloud-facing production systems to the cloud. IaaS is the service model being used. The Chief Executive Officer is concerned about the type of encryption available and requires the solution must have the highest level of security. Which of the following encryption methods should the cloud security engineer select during the implementation phase?
- AInstance-based
- BStorage-based
- CProxy-based
- DArray controller-based
76An application server was recently upgraded to prefer TLS 1.3, and now users are unable to connect their clients to the server. Attempts to reproduce the error are confirmed, and clients are reporting the following: ERR_SSL_VERSION_OR_CIPHER_MISMATCH
Which of the following is MOST likely the root cause?- AThe client application is testing PFS.
- BThe client application is configured to use ECDHE.
- CThe client application is configured to use RC4.
- DThe client application is configured to use AES-256 in GCM.
77An organization is deploying a new, online digital bank and needs to ensure availability and performance. The cloud-based architecture is deployed using PaaS and SaaS solutions, and it was designed with the following considerations:
-Protection from DoS attacks against its infrastructure and web applications is in place.
-Highly available and distributed DNS is implemented.
-Static content is cached in the CDN.
-A WAF is deployed inline and is in block mode.
-Multiple public clouds are utilized in an active-passive architecture.
With the above controls in place, the bank is experiencing a slowdown on the unauthenticated payments page. Which of the following is the MOST likely cause?- AThe public cloud provider is applying QoS to the inbound customer traffic.
- BThe API gateway endpoints are being directly targeted.
- CThe site is experiencing a brute-force credential attack.
- DA DDoS attack is targeted at the CDN.
78A company based in the United States holds insurance details of EU citizens. Which of the following must be adhered to when processing EU citizens' personal, private, and confidential data?
- AThe principle of lawful, fair, and transparent processing
- BThe right to be forgotten principle of personal data erasure requests
- CThe non-repudiation and deniability principle
- DThe principle of encryption, obfuscation, and data masking
79A security team received a regulatory notice asking for information regarding collusion and pricing from staff members who are no longer with the organization. The legal department provided the security team with a list of search terms to investigate. This is an example of:
- Adue intelligence
- Be-discovery
- Cdue care
- Dlegal hold
80An organization is developing a disaster recovery plan that requires data to be backed up and available at a moment’s notice. Which of the following should the organization consider FIRST to address this requirement?
- AImplement a change management plan to ensure systems are using the appropriate versions
- BHire additional on-call staff to be deployed if an event occurs
- CDesign an appropriate warm site for business continuity
- DIdentify critical business processes and determine associated software and hardware requirements
81A company recently acquired a SaaS provider and needs to integrate its platform into the company's existing infrastructure without impact to the customer's experience. The SaaS provider does not have a mature security program A recent vulnerability scan of the SaaS provider's systems shows multiple critical vulnerabilities attributed to very old and outdated Oss. Which of the following solutions would prevent these vulnerabilities from being introduced into the company's existing infrastructure?
- ASegment the systems to reduce the attack surface if an attack occurs
- BMigrate the services to new systems with a supported and patched OS.
- CPatch the systems to the latest versions of the existing OSs
- DInstall anti-malware. HIPS, and host-based firewalls on each of the systems
82A network architect is designing a new SD-WAN architecture to connect all local sites to a central hub site. The hub is then responsible for redirecting traffic to public cloud and datacenter applications. The SD-WAN routers are managed through a SaaS, and the same security policy is applied to staff whether working in the office or at a remote location. The main requirements are the following:
-The network supports core applications that have 99.99% uptime
-Configuration updates to the SD-WAN routers can only be initiated from the management service.
-Documents downloaded from websites must be scanned for malware.
Which of the following solutions should the network architect implement to meet the requirements?- AReverse proxy, stateful firewalls, and VPNs at the local sites
- BIDSs, WAFs, and forward proxy IDS
- CDoS protection at the hub site, mutual certificate authentication, and cloud proxy
- DIPSs at the hub, Layer 4 firewalls, and DLP
83A security architect is given the following requirements to secure a rapidly changing enterprise with an increasingly distributed and remote workforce:
-Cloud-delivered services
-Full network security stack
-SaaS application security management
-Minimal latency for an optimal user experience
-Integration with the cloud 1AM platform
Which of the following is the BEST solution?- ARouting and Remote Access Service (RRAS)
- BNGFW
- CManaged Security Service Provider (MSSP)
- DSASE
84A security engineer thinks the development team has been hard-coding sensitive environment variables in its code. Which of the following would BEST secure the company’s CI/CD pipeline?
- AUtilizing a trusted secrets manager
- BPerforming DAST on a weekly basis
- CIntroducing the use of container orchestration
- DDeploying instance tagging
85A recent data breach stemmed from unauthorized access to an employee’s company account with a cloud-based productivity suite. The attacker exploited excessive permissions granted to a third-party OAuth application to collect sensitive information. Which of the following BEST mitigates inappropriate access and permissions issues?
- ASIEM
- BCASB
- CWAF
- DSOAR
86A security architect was asked to modify an existing internal network design to accommodate the following requirements for RDP:
-Enforce MFA for RDP
-Ensure RDP connections are only allowed with secure ciphers.
The existing network is extremely complex and not well segmented. Because of these limitations, the company has requested that the connections not be restricted by network-level firewalls Of ACLs. Which of the following should the security architect recommend to meet these requirements?- AImplement a reverse proxy for remote desktop with a secure cipher configuration enforced.
- BImplement a bastion host with a secure cipher configuration enforced.
- CImplement a remote desktop gateway server, enforce secure ciphers, and configure to use OTP
- DImplement a GPO that enforces TLS cipher suites and limits remote desktop access to only VPN users
87A company wants to protect its intellectual property from theft. The company has already applied ACLs and DACs. Which of the following should the company use to prevent data theft?
- AWatermarking
- BDRM
- CNDA
- DAccess logging
88A systems administrator is preparing to run a vulnerability scan on a set of information systems in the organization. The systems administrator wants to ensure that the targeted systems produce accurate information especially regarding configuration settings. Which of the following scan types will provide the systems administrator with the MOST accurate information?
- AA passive, credentialed scan
- BA passive, non-credentialed scan
- CAn active, non-credentialed scan
- DAn active, credentialed scan
89A high-severity vulnerability was found on a web application and introduced to the enterprise. The vulnerability could allow an unauthorized user to utilize an open-source library to view privileged user information. The enterprise is unwilling to accept the risk, but the developers cannot fix the issue right away. Which of the following should be implemented to reduce the risk to an acceptable level until the issue can be fixed?
- AScan the code with a static code analyzer, change privileged user passwords, and provide security training.
- BChange privileged usernames, review the OS logs, and deploy hardware tokens
- CImplement MFA, review the application logs, and deploy a WAF.
- DDeploy a VPN, configure an official open-source library repository, and perform a full application review for vulnerabilities.
90Clients are reporting slowness when attempting to access a series of load-balanced APIs that do not require authentication. The servers that host the APIs are showing heavy CPU utilization. No alerts are found on the WAFs sitting in front of the APIs. Which of the following should a security engineer recommend to BEST remedy the performance issues in a timely manner?
- AImplement rate limiting on the API.
- BImplement geoblocking on the WAF.
- CImplement OAuth 2.0 on the API.
- DImplement input validation on the API.
91Ransomware encrypted the entire human resources fileshare for a large financial institution. Security operations personnel were unaware of the activity until it was too late to stop it. The restoration will take approximately four hours, and the last backup occurred 48 hours ago. The management team has indicated that the RPO for a disaster recovery event for this data classification is 24 hours. Based on RPO requirements, which of the following recommendations should the management team make?
- ALeave the current backup schedule intact and pay the ransom to decrypt the data.
- BLeave the current backup schedule intact and make the human resources fileshare read-only.
- CIncrease the frequency of backups and create SIEM alerts for IOCs.
- DDecrease the frequency of backups and pay the ransom to decrypt the data
92Due to locality and budget constraints, an organization’s satellite office has a lower bandwidth allocation than other offices in the organization. As a result, the local security infrastructure staff is assessing architectural options that will help preserve network bandwidth and increase speed to both internal and external resources while not sacrificing threat visibility. Which of the following would be the BEST option to implement?
- ADistributed connection allocation
- BLocal caching
- CContent delivery network
- DSD-WAN vertical heterogeneity
93A company has decided to purchase a license for software that is used to operate a mission-critical process. The third-party developer is new to the industry but is delivering what the company needs at this time. Which of the following BEST describes the reason why utilizing a source code escrow will reduce the operational risk to the company if the third party stops supporting the application?
- AThe company will have access to the latest version to continue development.
- BThe company will be able to force the third-party developer to continue support.
- CThe company will be able to manage the third-party developer’s development process.
- DThe company will be paid by the third-party developer to hire a new development team.
94A company's finance department acquired a new payment system that exports data to an unencrypted file on the system. The company implemented controls on the file so only appropriate personnel are allowed access. Which of the following risk techniques did the department use in this situation?
- AAccept
- BAvoid
- CTransfer
- DMitigate
95Which of the following is the MOST important security objective when applying cryptography to control messages that tell an ICS how much electrical power to output?
- AImporting the availability of messages
- BEnsuring non-repudiation of messages
- CEnforcing protocol conformance for messages
- DAssuring the integrity of messages
96A company’s claims processed department has a mobile workforce that receives a large number of email submissions from personal email addresses. An employees recently received an email that approved to be claim form, but it installed malicious software on the employee’s laptop when was opened.
- AImpalement application whitelisting and add only the email client to the whitelist for laptop in the claims processing department.
- BRequired all laptops to connect to the VPN before accessing email.
- CImplement cloud-based content filtering with sandboxing capabilities.
- DInstall a mail gateway to scan incoming messages and strip attachments before they reach the mailbox.
97Which of the following agreements includes no penalties and can be signed by two entities that are working together toward the same goal?
- AMOU
- BNDA
- CSLA
- DISA
98The Chief information Officer (CIO) asks the system administrator to improve email security at the company based on the following requirements:
-Transaction being requested by unauthorized individuals.
-Complete discretion regarding client names, account numbers, and investment information
-Malicious attackers using email to malware and ransomeware.
-Exfiltration of sensitive company information.
The cloud-based email solution will provide anti-malware reputation-based scanning, signature-based scanning, and sandboxing. Which of the following is the BEST option to resolve the boar’s concerns for this email migration?- AData loss prevention
- BEndpoint detection response
- CSSL VPN
- DApplication whitelisting
99A company provides guest WiFi access to the internet and physically separates the guest network from the company’s internal WIFI. Due to a recent incident in which an attacker gained access to the company's intend WIFI, the company plans to configure WPA2 Enterprise in an EAP-TLS configuration. Which of the following must be installed on authorized hosts for this new configuration to work properly?
- AActive Directory OPOs
- BPKI certificates
- CHost-based firewall
- DNAC persistent agent
100A company was recently infected by malware. During the root cause analysis. The company determined that several users were installing their own applications. To prevent further compromises, the company has decided it will only allow authorized applications to run on its systems. Which of the following should the company implement?
- ASigning
- BAccess control
- CHIPS
- DPermit listing
101The OS on several servers crashed around the same time for an unknown reason. The servers were restored to working condition, and all file integrity was verified. Which of the following should the incident response team perform to understand the crash and prevent it in the future?
- ARoot cause analysis
- BContinuity of operations plan
- CAfter-action report
- DLessons learned
102A company created an external application for its customers. A security researcher now reports that the application has a serious LDAP injection vulnerability that could be leveraged to bypass authentication and authorization. Which of the following actions would BEST resolve the issue? (Select two)
- AConduct input sanitization.
- BDeploy a SIEM.
- CUse containers.
- DPatch the OS
- EDeploy a WAF
- FDeploy a reverse proxy
- GDeploy an IDS.
103A company’s SOC has received threat intelligence about an active campaign utilizing a specific vulnerability. The company would like to determine whether it is vulnerable to this active campaign. Which of the following should the company use to make this determination?
- AThreat hunting
- BA system penetration test
- CLog analysis within the SIEM tool
- DThe Cyber Kill Chain
104A networking team asked a security administrator to enable Flash on its web browser. The networking team explained that an important legacy embedded system gathers SNMP information from various devices. The system can only be managed through a web browser running Flash. The embedded system will be replaced within the year but is still critical at the moment. Which of the following should the security administrator do to mitigate the risk?
- AExplain to the networking team the reason Flash is no longer available and insist the team move up the timetable for replacement.
- BAir gap the legacy system from the network and dedicate a laptop with an end-of-life OS on it to connect to the system via crossover cable for management.
- CSuggest that the networking team contact the original embedded system’s vendor to get an update to the system that does not require Flash.
- DIsolate the management interface to a private VLAN where a legacy browser in a VM can be used as needed to manage the system.
105A cybersecurity analyst discovered a private key that could have been exposed. Which of the following is the BEST way for the analyst to determine if the key has been compromised?
- AHSTS
- BCRL
- CCSRs
- DOCSP
106A company that all mobile devices be encrypted, commensurate with the full disk encryption scheme of assets, such as workstation, servers, and laptops. Which of the following will MOST likely be a limiting factor when selecting mobile device managers for the company?
- AIncreased network latency
- BUnavailable of key escrow
- CInability to selected AES-256 encryption
- DRemoval of user authentication requirements
107A security consultant needs to protect a network of electrical relays that are used for monitoring and controlling the energy used in a manufacturing facility. Which of the following systems should the consultant review before making a recommendation?
- ACAN
- BASIC
- CFPGA
- DSCADA
108A company launched a new service and created a landing page within its website network for users to access the service. Per company policy, all websites must utilize encryption for any authentication pages. A junior network administrator proceeded to use an outdated procedure to order new certificates. Afterward, customers are reporting the following error when accessing a new web page: NET:ERR_CERT_COMMON_NAME_INVALID. Which of the following BEST describes what the administrator should do NEXT?
- ARequest a new certificate with the correct subject alternative name that includes the new websites.
- BRequest a new certificate with the correct organizational unit for the company's website.
- CRequest a new certificate with a stronger encryption strength and the latest cipher suite.
- DRequest a new certificate with the same information but including the old certificate on the CRL.
109A company is preparing to deploy a global service. Which of the following must the company do to ensure GDPR compliance? (Select two)
- AInform users regarding what data is stored
- BProvide opt-in/out for marketing messages
- CProvide data deletion capabilities.
- DProvide optional data encryption.
- EGrant data access to third parties
- FProvide alternative authentication techniques.
110Which of the following BEST sets expectation between the security team and business units within an organization?
- ARisk assessment
- BMemorandum of understanding
- CBusiness impact analysis
- DBusiness partnership agreement
- EServices level agreement
111A healthcare system recently suffered from a ransomware incident As a result the board of directors decided to hire a security consultant to improve existing network security. The security consultant found that the healthcare network was completely flat, had no privileged access limits and had open RDP access to servers with personal health information. As the consultant builds the remediation plan, which of the following solutions would BEST solve these challenges? (Select three)
- ASD-WAN
- BPAM
- CRemote access VPN
- DMFA
- ENetwork segmentation
- FBGP
- GNAC
112A university issues badges through a homegrown identity management system to all staff and students. Each week during the summer, temporary summer school students arrive and need to be issued a badge to access minimal campus resources. The security team received a report from an outside auditor indicating the homegrown system is not consistent with best practices in the security field and leaves the institution vulnerable. Which of the following should the security team recommend FIRST?
- AInvestigating a potential threat identified in logs related to the identity management system
- BUpdating the identity management system to use discretionary access control
- CBeginning research on two-factor authentication to later introduce into the identity management system
- DWorking with procurement and creating a requirements document to select a new IAM system/vendor
113An auditor needs to scan documents at rest for sensitive text. These documents contain both text and Images. Which of the following software functionalities must be enabled in the DLP solution for the auditor to be able to fully read these documents? (Select two)
- ADocument interpolation
- BRegular expression pattern matching
- COptical character recognition functionality
- DBaseline image matching
- EAdvanced rasterization
- FWatermarking
114A company is outsourcing to an MSSP that performs managed detection and response services. The MSSP requires a server to be placed inside the network as a log aggregate and allows remote access to MSSP analyst. Critical devices send logs to the log aggregator, where data is stored for 12 months locally before being archived to a multitenant cloud. The data is then sent from the log aggregate to a public IP address in the MSSP datacenter for analysis. A security engineer is concerned about the security of the solution and notes the following:
-The critical devise send cleartext logs to the aggregator.
-The log aggregator utilize full disk encryption.
-The log aggregator sends to the analysis server via port 80.
-MSSP analysis utilize an SSL VPN with MFA to access the log aggregator remotely.
-The data is compressed and encrypted prior to being achieved in the cloud.
Which of the following should be the engineer’s GREATEST concern?- AHardware vulnerabilities introduced by the log aggregate server
- BNetwork bridging from a remote access VPN
- CEncryption of data in transit
- DMultinancy and data remnants in the cloud
115An organization is implementing a new identity and access management architecture with the following objectives:
-Supporting MFA against on-premises infrastructure
-Improving the user experience by integrating with SaaS applications
-Applying risk-based policies based on location
-Performing just-in-time provisioning
Which of the following authentication protocols should the organization implement to support these requirements?- AKerberos and TACACS
- BSAML and RADIUS
- COAuth and OpenID
- DOTP and 802.1X
116An e-commerce company is running a web server on premises, and the resource utilization is usually less than 30%. During the last two holiday seasons, the server experienced performance issues because of too many connections, and several customers were not able to finalize purchase orders. The company is looking to change the server configuration to avoid this kind of performance issue. Which of the following is the MOST cost-effective solution?
- AMove the server to a cloud provider.
- BChange the operating system.
- CBuy a new server and create an active-active cluster.
- DUpgrade the server with a new one
117Which of the following protocols is a low power, low data rate that allows for the creation of PAN networks?
- AZigbee
- BCAN
- CDNP3
- DModbus
118A small company needs to reduce its operating costs. vendors have proposed solutions, which all focus on management of the company’s website and services. The Chief information Security Officer (CISO) insist all available resources in the proposal must be dedicated, but managing a private cloud is not an option. Which of the following is the BEST solution for this company?
- ACommunity cloud service model
- BMultinency SaaS
- CSingle-tenancy SaaS
- DOn-premises cloud service model
119A small company recently developed prototype technology for a military program. The company’s security engineer is concerned about potential theft of the newly developed, proprietary information. Which of the following should the security engineer do to BEST manage the threats proactively?
- AJoin an information-sharing community that is relevant to the company.
- BLeverage the MITRE ATT&CK framework to map the TTR.
- CUse OSINT techniques to evaluate and analyze the threats.
- DUpdate security awareness training to address new threats, such as best practices for data security.
120A security architect is implementing a web application that uses a database back end. Prior to the production, the architect is concerned about the possibility of XSS attacks and wants to identify security controls that could be put in place to prevent these attacks. Which of the following sources could the architect consult to address this security concern?
- ASDLC
- BOVAL
- CIEEE
- DOWASP
121A company requires a task to be carried by more than one person concurrently. This is an example of:
- Aseparation of duties
- Bdual control
- Cleast privilege
- Djob rotation
122An auditor needs to scan documents at rest for sensitive text. These documents contain both text and images. Which of the following software functionalities must be enabled in the DLP solution for the auditor to be able to fully read these documents? (Select two)
- ADocument interpolation
- BRegular expression pattern matching
- COptical character recognition functionality
- DBaseline image matching
- EAdvanced rasterization
- FWatermarking
123An organization is considering a BYOD standard to support remote working. The first iteration of the solution will utilize only approved collaboration applications and the ability to move corporate data between those applications. The security team has concerns about the following:
-Unstructured data being exfiltrated after an employee leaves the organization
-Data being exfiltrated as a result of compromised credentials
-Sensitive information in emails being exfiltrated
Which of the following solutions should the security team implement to mitigate the risk of data loss?- AMobile device management, remote wipe, and data loss detection
- BConditional access, DoH, and full disk encryption
- CMobile application management, MFA, and DRM
- DCertificates, DLP, and geofencing
124Immediately following the report of a potential breach, a security engineer creates a forensic image of the server in question as part of the organization incident response procedure. Which of the must occur to ensure the integrity of the image?
- AThe image must be password protected against changes.
- BA hash value of the image must be computed.
- CThe disk containing the image must be placed in a seated container.
- DA duplicate copy of the image must be maintained
125A cybersecurity engineer analyst a system for vulnerabilities. The tool created an OVAL. Results document as output. Which of the following would enable the engineer to interpret the results in a human readable form? (Select two)
- AText editor
- BOOXML editor
- CEvent Viewer
- DXML style sheet
- ESCAP tool
- FDebugging utility
126A penetration tester obtained root access on a Windows server and, according to the rules of engagement, is permitted to perform post-exploitation for persistence. Which of the following techniques would BEST support this?
- AConfiguring system services to run automatically at startup
- BCreating a backdoor
- CExploiting an arbitrary code execution exploit
- DMoving laterally to a more authoritative server/service
127A forensic expert working on a fraud investigation for a US-based company collected a few disk images as evidence. Which of the following offers an authoritative decision about whether the evidence was obtained legally?
- ALawyers
- BCourt
- CUpper management team
- DPolice
128A security analyst is researching containerization concepts for an organization. The analyst is concerned about potential resource exhaustion scenarios on the Docker host due to a single application that is overconsuming available resources. Which of the following core Linux concepts BEST reflects the ability to limit resource allocation to containers?
- AUnion filesystem overlay
- BCgroups
- CLinux namespaces
- DDevice mapper
129A software development company makes Its software version available to customers from a web portal. On several occasions, hackers were able to access the software repository to change the package that is automatically published on the website. Which of the following would be the BEST technique to ensure the software the users download is the official software released by the company?
- ADistribute the software via a third-party repository.
- BClose the web repository and deliver the software via email.
- CEmail the software link to all customers.
- DDisplay the SHA checksum on the website.
130Which of the following technologies allows CSPs to add encryption across multiple data storages?
- ASymmetric encryption
- BHomomorphic encryption
- CData dispersion
- DBit splitting
131An HVAC contractor requested network connectivity permission to remotely support/troubleshoot equipment issues at a company location. Currently, the company does not have a process that allows vendors remote access to the corporate network. Which of the following solutions represents the BEST course of action to allow the contractor access?
- AAdd the vendor's equipment to the existing network Give the vendor access through the standard corporate VPN
- BGive the vendor a standard desktop PC to attach the equipment to Give the vendor access through the standard corporate VPN
- CEstablish a certification process for the vendor Allow certified vendors access to the VDI to monitor and maintain the HVAC equipment
- DCreate a dedicated segment with no access to the corporate network Implement dedicated VPN hardware for vendor access
132Which of the following is the MOST important cloud-specific risk from the CSP’s viewpoint?
- AIsolation control failure
- BManagement plane breach
- CInsecure data deletion
- DResource exhaustion
133A software house is developing a new application. The application has the following requirements:
-Reduce the number of credential requests as much as possible
-Integrate with social networks
-Authenticate users
Which of the following is the BEST federation method to use for the application?- AWS-Federation
- BOpenID
- COAuth
- DSAML
134A host on a company’s network has been infected by a worm that appears to be spreading via SMB. A security analyst has been tasked with containing the incident while also maintaining evidence for a subsequent investigation and malware analysis. Which of the following steps would be best to perform FIRST?
- ATurn off the infected host immediately.
- BRun a full anti-malware scan on the infected host.
- CModify the smb.conf file of the host to prevent outgoing SMB connections.
- DIsolate the infected host from the network by removing all network connections.
135A security engineer needs to recommend a solution that will meet the following requirements:
-Identify sensitive data in the provider’s network
-Maintain compliance with company and regulatory guidelines
-Detect and respond to insider threats, privileged user threats, and compromised accounts
-Enforce datacentric security, such as encryption, tokenization, and access control
Which of the following solutions should the security engineer recommend to address these requirements?- AWAF
- BCASB
- CSWG
- DDLP
136A company is looking for a solution to hide data stored in databases. The solution must meet the following requirements:
-Be efficient at protecting the production environment
-Not require any change to the application
-Act at the presentation layer
Which of the following techniques should be used?- AMasking
- BTokenization
- CAlgorithmic
- DRandom substitution
137The goal of a Chief information Security Officer (CISO) providing up-to-date metrics to a bank’s risk committee is to ensure:
- ABudgeting for cybersecurity increases year over year.
- BThe committee knows how much work is being done.
- CBusiness units are responsible for their own mitigation.
- DThe bank is aware of the status of cybersecurity risks.
138A home automation company just purchased and installed tools for its SOC to enable incident identification and response on software the company develops. The company would like to prioritize defenses against the following attack scenarios:
-Unauthorized insertions into application development environments
-Authorized insiders making unauthorized changes to environment configurations
Which of the following actions will enable the data feeds needed to detect these types of attacks on development environments? (Select two)- APerform static code analysis of committed code and generate summary reports
- BImplement an XML gateway and monitor for policy violations
- CMonitor dependency management tools and report on susceptible third-party libraries
- DInstall an IDS on the development subnet and passively monitor for vulnerable services.
- EModel user behavior and monitor for deviations from normal
- FContinuously monitor code commits to repositories and generate summary logs.
139A large telecommunications equipment manufacturer needs to evaluate the strengths of security controls in a new telephone network supporting first responders. Which of the following techniques would the company use to evaluate data confidentiality controls?
- AEavesdropping
- BOn-path
- CCryptanalysis
- DCode signing
- ERF sidelobe sniffing
140An organization recently started processing, transmitting, and storing its customers’ credit card information. Within a week of doing so, the organization suffered a massive breach that resulted in the exposure of the customers’ information. Which of the following provides the BEST guidance for protecting such information while it is at rest and in transit?
- ANIST
- BGDPR
- CPCI DSS
- DISO
141An IT administrator is reviewing all the servers in an organization and notices that a server is missing crucial practice against a recent exploit that could gain root access. Which of the following describes the administrator’s discovery?
- AA vulnerability
- BA threat
- CA breach
- DA risk
142A security engineer estimates the company’s popular web application experiences 100 attempted breaches per day. In the past four years, the company’s data has been breached two times. Which of the following should the engineer report as the ARO for successful breaches?
- A0.5
- B8
- C50
- D36,500
143An organization’s existing infrastructure includes site-to-site VPNs between datacenters. In the past year, a sophisticated attacker exploited a zero-day vulnerability on the VPN concentrator. Consequently, the Chief Information Security Officer (CISO) is making infrastructure changes to mitigate the risk of service loss should another zero-day exploit be used against the VPN solution. Which of the following designs would be BEST for the CISO to use?
- AAdding a second redundant layer of alternate vendor VPN concentrators
- BUsing Base64 encoding within the existing site-to-site VPN connections
- CDistributing security resources across VPN sites
- DImplementing IDS services with each VPN concentrator
- ETransitioning to a container-based architecture for site-based services
144A municipal department receives telemetry data from a third-party provider The server collecting telemetry sits in the municipal departments screened network and accepts connections from the third party over HTTPS. The daemon has a code execution vulnerability from a lack of input sanitization of out of-bound messages, and therefore, the cybersecurity engineers would like to Implement risk mitigations. Which of the following actions, if combined, would BEST prevent exploitation of this vulnerability? (Select two)
- AImplementing a TLS inspection proxy on-path to enable monitoring and policy enforcement
- BCreating a Linux namespace on the telemetry server and adding to it the servicing HTTP daemon
- CInstalling and configuring filesystem integrity monitoring service on the telemetry server
- DImplementing an EDR and alert on Identified privilege escalation attempts to the SIEM
- ESubscribing to a UTM service that enforces privacy controls between the internal network and the screened subnet
- FUsing the published data schema to monitor and block off nominal telemetry messages
145Based on PCI DSS v3.4, One Particular database field can store data, but the data must be unreadable. which of the following data objects meets this requirement?
- APAN
- BCVV2
- CCardholder name
- DExpiration date
146An organization recently recovered from an attack that featured an adversary injecting Malicious logic into OS bootloaders on endpoint devices Therefore, the organization decided to require the use of TPM for measured boot and attestation, monitoring each component from the IJEFI through the full loading of OS components. Which of the following TPM structures enables this storage functionality?
- AEndorsement tickets
- BClock/counter structures
- CCommand tag structures with MAC schemes
- DPlatform configuration registers
147A company wants to quantify and communicate the effectiveness of its security controls but must establish
measures. Which of the following is MOST likely to be included in an effective assessment roadmap for these
controls?- ACreate a change management process.
- BEstablish key performance indicators.
- CCreate an integrated master schedule.
- DDevelop a communication plan
- EPerform a security control assessment.
148Which of the following allows computation and analysis of data within a ciphertext without knowledge of the
plaintext?- ALattice-based cryptography
- BQuantum computing
- CAsymmetric cryptography
- DHomomorphic encryption
149A security architect for a large, multinational manufacturer needs to design and implement a security solution to monitor traffic. When designing the solution, which of the following threats should the security architect focus on to prevent attacks against the network?
- APackets that are the wrong size or length
- BUse of any non-DNP3 communication on a DNP3 port
- CMultiple solicited responses over time
- DApplication of an unsupported encryption algorithm
150A company Is adopting a new artificial-intelligence-based analytics SaaS solution. This Is the company's first
attempt at using a SaaS solution, and a security architect has been asked to determine any future risks. Which
of the following would be the GREATEST risk In adopting this solution?- AThe inability to assign access controls to comply with company policy
- BThe inability to require the service provider process data in a specific country
- CThe inability to obtain company data when migrating to another service
- DThe inability to conduct security assessments against a service provider
151An organization is preparing to migrate its production environment systems from an on-premises environment to a cloud service. The lead security architect is concerned that the organization's current methods for addressing risk may not be possible in the cloud environment. Which of the following BEST describes the reason why traditional methods of addressing risk may not be possible in the cloud?
- AMigrating operations assumes the acceptance of all risk.
- BCloud providers are unable to avoid risk.
- CSpecific risks cannot be transferred to the cloud provider.
- DRisks to data in the cloud cannot be mitigated.
152A shipping company that is trying to eliminate entire classes of threats is developing an SELinux policy to
ensure its custom Android devices are used exclusively for package tracking. After compiling and implementing the policy, in which of the following modes must the company ensure the devices are configured to run?- AProtecting
- BPermissive
- CEnforcing
- DMandatory
153A company security engineer arrives at work to face the following scenario:
-Website defacement
-Calls from the company president indicating the website needs to be fixed Immediately because It Is
damaging the brand
-A Job offer from the company's competitor
-A security analyst's investigative report, based on logs from the past six months, describing how lateral
movement across the network from various IP addresses originating from a foreign adversary country resulted in exfiltrated data
Which of the following threat actors Is MOST likely involved?- AOrganized crime
- BScript kiddie
- CAPT/nation-state
- DCompetitor
154A security analyst is reviewing network connectivity on a Linux workstation and examining the active TCP
connections using the command line. Which of the following commands would be the BEST to run to view only active Internet connections?- Asudo netstat -antu | grep “LISTEN” | awk ‘{print$5}’
- Bsudo netstat -nlt -p | grep “ESTABLISHED”
- Csudo netstat -plntu | grep -v “Foreign Address”
- Dsudo netstat -pnut -w | column -t -s $’\w’
- Esudo netstat -pnut | grep -P ^tcp
155As part of the customer registration process to access a new bank account, customers are required to upload a number of documents, including their passports and driver’s licenses. The process also requires customers to take a current photo of themselves to be compared against provided documentation. Which of the following BEST describes this process?
- ADeepfake
- BKnow your customer
- CIdentity proofing
- DPasswordless
156An enterprise is deploying APIs that utilize a private key and a public key to ensure the connection string is
protected. To connect to the API, customers must use the private key. Which of the following would BEST secure the REST API connection to the database while preventing the use of a hard-coded string in the request string?- AImplement a VPN for all APIs.
- BSign the key with DSA.
- CDeploy MFA for the service accounts.
- DUtilize HMAC for the keys.
157A company plans to build an entirely remote workforce that utilizes a cloud-based infrastructure. The Chief
Information Security Officer asks the security engineer to design connectivity to meet the following requirements:
-Only users with corporate-owned devices can directly access servers hosted by the cloud provider
-The company can control what SaaS applications each individual user can access
-User browser activity can be monitored.
Which of the following solutions would BEST meet these requirements?- AIAM gateway, MDM, and reverse proxy
- BVPN, CASB, and secure web gateway
- CSSL tunnel, DLP, and host-based firewall
- DAPI gateway, UEM, and forward proxy
158A company is looking at sending historical backups containing customer PII to a cloud service provider to
save on storage costs. Which of the following is the MOST important consideration before making this
decision?- AAvailability
- BData sovereignty
- CGeography
- DVendor lock-in
159As part of its risk strategy, a company is considering buying insurance for cybersecurity incidents. Which of the following BEST describes this kind of risk response?
- ARisk rejection
- BRisk mitigation
- CRisk transference
- DRisk avoidance
160An application developer is including third-party background security fixes in an application. The fixes seem to resolve a currently identified security issue. However, when the application is released to the public, report come In that a previously vulnerability has returned. Which of the following should the developer integrate into the process to BEST prevent this type of behavior?
- APeer review
- BRegression testing
- CUser acceptance
- DDynamic analysis
161An organization is researching the automation capabilities for systems within an OT network. A security
analyst wants to assist with creating secure coding practices and would like to learn about the programming
languages used on the PLCs. Which of the following programming languages is the MOST relevant for PLCs?- ALadder logic
- BRust
- CPython
- DJava
162An organization wants to perform a scan of all its systems against best practice security configurations. Which of the following SCAP standards, when combined, will enable the organization to view each of the
configuration checks in a machine-readable checklist format for fill automation? (Select two)- AARF
- BXCCDF
- CCPE
- DCVE
- ECVSS
- FOVAL
163A Chief Information Officer is considering migrating all company data to the cloud to save money on
expensive SAN storage. Which of the following is a security concern that will MOST likely need to be addressed during migration?- ALatency
- BData exposure
- CData loss
- DData dispersion
164An organization is prioritizing efforts to remediate or mitigate risks identified during the latest assessment. For one of the risks, a full remediation was not possible, but the organization was able to successfully apply
mitigations to reduce the likelihood of impact. Which of the following should the organization perform NEXT?- AAssess the residual risk.
- BUpdate the organization’s threat model.
- CMove to the next risk in the register.
- DRecalculate the magnitude of impact.
165An administrator at a software development company would like to protect the integrity Of the company's
applications with digital signatures. The developers report that the signing process keeps failing on all
applications. The same key pair used for signing, however, is working properly on the website, is valid, and is issued by a trusted CA. Which of the following is MOST likely the cause of the signature failing?- AThe NTP server is set incorrectly for the developers.
- BThe CA has included the certificate in its CRL
- CThe certificate is set for the wrong key usage.
- DEach application is missing a SAN or wildcard entry on the certificate.
166A company’s Chief Information Security Officer is concerned that the company’s proposed move to the cloud
could lead to a lack of visibility into network traffic flow logs within the VPC. Which of the following compensating controls would be BEST to implement in this situation?- AEDR
- BSIEM
- CHIDS
- DUEBA
167A security is assisting the marketing department with ensuring the security of the organization’s social media
platforms. The two main concerns are:
-The Chief marketing officer (CMO) email is being used department wide as the username
-The password has been shared within the department
Which of the following controls would be BEST for the analyst to recommend?- AConfigure MFA for all users to decrease their reliance on other authentication
- BHave periodic, scheduled reviews to determine which OAuth configuration are set for each media platform.
- CCreate multiple social media accounts for all marketing user to separate their actions.
- DEnsue the password being shared is sufficiently and not written down anywhere
168A SOC analyst is reviewing malicious activity on an external, exposed web server. During the investigation,
the analyst determines specific traffic is not being logged, and there is no visibility from the WAF for the web
application. Which of the following is the MOST likely cause?- AThe user agent client is not compatible with the WAF.
- BA certificate on the WAF is expired.
- CHTTP traffic is not forwarding to HTTPS to decrypt.
- DOld, vulnerable cipher suites are still being used.
169A company has hired a security architect to address several service outages on the endpoints due to new
malware. The Chief Executive Officer’s laptop was impacted while working from home. The goal is to
prevent further endpoint disruption. The edge network is protected by a web proxy. Which of the following solutions should the security architect recommend?- AReplace the current antivirus with an EDR solution.
- BRemove the web proxy and install a UTM appliance.
- CImplement a deny list feature on the endpoints.
- DAdd a firewall module on the current antivirus solution.
170An organization developed a social media application that is used by customers in multiple remote geographic locations around the world. The organization’s headquarters and only datacenter are located in New York City. The Chief Information Security Officer wants to ensure the following requirements are met for the social media application:
-Low latency for all mobile users to improve the users’ experience
-SSL offloading to improve web server performance
-Protection against DoS and DDoS attacks
-High availability
Which of the following should the organization implement to BEST ensure all requirements are met?- AA cache server farm in its datacenter
- BA load-balanced group of reverse proxy servers with SSL acceleration
- CA CDN with the origin set to its datacenter
- DDual gigabit-speed Internet connections with managed DDoS prevention
171A company in the financial sector receives a substantial number of customer transaction requests via email. While doing a root-cause analysis conceding a security breach, the CIRT correlates an unusual spike in port 80 traffic from the IP address of a desktop used by a customer relations employee who has access to several of the compromised accounts. Subsequent antivirus scans of the device do not return an findings, but the CIRT finds undocumented services running on the device. Which of the following controls would reduce the discovery time for similar in the future.
- AImplementing application blacklisting
- BConfiguring the mall to quarantine incoming attachment automatically
- CDeploying host-based firewalls and shipping the logs to the SIEM
- DIncreasing the cadence for antivirus DAT updates to twice daily
172An organization is referencing NIST best practices for BCP creation while reviewing current internal organizational processes for mission-essential items. Which of the following phases establishes the identification and prioritization of critical systems and functions?
- AReview a recent gap analysis.
- BPerform a cost-benefit analysis
- CConduct a business impact analysis.
- DDevelop an exposure factor matrix.
173A business wants to migrate its workloads from an exclusively on-premises IT infrastructure to the cloud but cannot implement all the required controls. Which of the following BEST describes the risk associated with this implementation?
- ALoss of governance
- BVendor lockout
- CCompliance risk
- DVendor lock-in
174A company wants to improve Its active protection capabilities against unknown and zero-day malware. Which of the following Is the MOST secure solution?
- ANIDS
- BApplication allow list
- CSandbox detonation
- DEndpoint log collection
- EHIDS
175A security engineer is troubleshooting an issue in which an employee is getting an IP address in the range on the wired network. The engineer plus another PC into the same port, and that PC gets an IP address in the correct range. The engineer then puts the employee’ PC on the wireless network and finds the PC still not get an IP address in the proper range. The PC is up to date on all software and antivirus definitions, and the IP address is not an APIPA address. Which of the following is MOST likely the problem?
- AThe company is using 802.1x for VLAN assignment, and the user or computer is in the wrong group.
- BThe DHCP server has a reservation for the PC’s MAC address for the wired interface.
- CThe WiFi network is using WPA2 Enterprise, and the computer certificate has the wrong IP address in the SAN field
- DThe DHCP server is unavailable, so no IP address is being sent back to the PC.
176An organization is establishing a new software assurance program to vet applications before they are
introduced into the production environment, Unfortunately. many Of the applications are provided only as
compiled binaries. Which Of the following should the organization use to analyze these applications? (Select two)- ARegression testing
- BSAST
- CThird-party dependency management
- DIDE SAST
- EFuzz testing
- FIAST
177A company is migrating from company-owned phones to a BYOD strategy for mobile devices. The pilot
program will start with the executive management team and be rolled out to the rest of the staff in phases. The company’s Chief Financial Officer loses a phone multiple times a year. Which of the following will MOST likely secure the data on the lost device?- ARequire a VPN to be active to access company data.
- BSet up different profiles based on the person’s risk
- CRemotely wipe the device.
- DRequire MFA to access company applications.
178Which of the following are risks associated with vendor lock-in? (Select two)
- AThe client can seamlessly move data.
- BThe vendor can change product offerings
- CThe client receives a sufficient level of service
- DThe client experiences decreased quality of service.
- EThe client can leverage a multicloud approach
- FThe client experiences increased interoperability.
179A company is repeatedly being breached by hackers who valid credentials. The company’s Chief information Security Officer (CISO) has installed multiple controls for authenticating users, including biometric and token-based factors. Each successive control has increased overhead and complexity but has failed to stop further breaches. An external consultant is evaluating the process currently in place to support the authentication controls. Which of the following recommendation would MOST likely reduce the risk of unauthorized access?
- AImplement strict three-factor authentication.
- BImplement least privilege policies
- CSwitch to one-time or all user authorizations.
- DStrengthen identify-proofing procedures
180A financial services company wants to migrate its email services from on-premises servers to a cloud-based email solution. The Chief information Security Officer (CISO) must brief board of directors on the potential security concerns related to this migration. The board is concerned about the following:
-Transactions being required by unauthorized individual
-Complete discretion regarding client names, account numbers, and investment information
-Malicious attacker using email to distribute malware and ransom ware.
-Exfiltration of sensitivity company information.
The cloud-based email solution will provide an6-malware, reputation-based scanning, signature-based
scanning, and sandboxing. Which of the following is the BEST option to resolve the board’s concerns for this email migration?- AData loss prevention
- BEndpoint detection response
- CSSL VPN
- DApplication whitelisting
181An attacker infiltrated an electricity-generation site and disabled the safety instrumented system. Ransomware was also deployed on the engineering workstation. The environment has back-to-back firewalls separating the corporate and OT systems. Which of the following is the MOST likely security consequence of this attack?
- AA turbine would overheat and cause physical harm.
- BThe engineers would need to go to the historian.
- CThe SCADA equipment could not be maintained
- DData would be exfiltrated through the data diodes.
182All staff at a company have started working remotely due to a global pandemic. To transition to remote work, the company has migrated to SaaS collaboration tools. The human resources department wants to use these tools to process sensitive information but is concerned the data could be:
-Leaked to the media via printing of the documents
-Sent to a personal email address
-Accessed and viewed by systems administrators
-Uploaded to a file storage site
Which of the following would mitigate the department’s concerns?- AData loss detection, reverse proxy, EDR, and PGP
- BVDI, proxy, CASB, and DRM
- CWatermarking, forward proxy, DLP, and MFA
- DProxy, secure VPN, endpoint encryption, and AV
183A vulnerability assessment endpoint generated a report of the latest findings. A security analyst needs to
review the report and create a priority list of items that must be addressed. Which of the following should the
analyst use to create the list quickly?- ABusiness impact rating
- BCVE dates
- CCVSS scores
- DOVAL
184A business stores personal client data of individuals residing in the EU in order to process requests for
mortgage loan approvals. Which of the following does the business’s IT manager need to consider?- AThe availability of personal data
- BThe right to personal data erasure
- CThe company’s annual revenue
- DThe language of the web application
185Company A is establishing a contractual with Company B. The terms of the agreement are formalized in a
document covering the payment terms, limitation of liability, and intellectual property rights. Which of the
following documents will MOST likely contain these elements.- ACompany A-B SLA v2.docx
- BCompany A OLA v1b.docx
- CCompany A MSA v3.docx
- DCompany A MOU v1.docx
- ECompany A-B NDA v03.docx
186Which of the following controls primarily detects abuse of privilege but does not prevent it?
- AOff-boarding
- BSeparation of duties
- CLeast privilege
- DJob rotation
187A company publishes several APIs for customers and is required to use keys to segregate customer data sets. Which of the following would be BEST to use to store customer keys?
- AA trusted platform module
- BA hardware security module
- CA localized key store
- DA public key infrastructure
188A security engineer was auditing an organization’s current software development practice and discovered that multiple open-source libraries were Integrated into the organization’s software. The organization currently performs SAST and DAST on the software it develops. Which of the following should the organization incorporate into the SDLC to ensure the security of the open-source libraries?
- APerform additional SAST/DAST on the open-source libraries
- BImplement the SDLC security guidelines.
- CTrack the library versions and monitor the CVE website for related vulnerabilities.
- DPerform unit testing of the open-source libraries.
189A security analyst detected a malicious PowerShell attack on a single server. The malware used the
Invoke-Expression function to execute an external malicious script. The security analyst scanned the disk with an antivirus application and did not find any IOCs. The security analyst now needs to deploy a protection solution against this type of malware. Which of the following BEST describes the type of malware the solution should protect against?- AWorm
- BLogic bomb
- CFileless
- DRootkit
190The Chief information Security Officer (CISO) of a small locate bank has a compliance requirement that a
third-party penetration test of the core banking application must be conducted annually. Which of the
following services would fulfill the compliance requirement with the LOWEST resource usage?- ABlack-box testing
- BGray-box testing
- CRed-team hunting
- DWhite-box testing
- EBlue-learn exercises
191A local government that is investigating a data exfiltration claim was asked to review the fingerprint of the
malicious user's actions. An investigator took a forensic image of the VM an downloaded the image to a
secured USB drive to share with the government. Which of the following should be taken into consideration during the process of releasing the drive to the government?- AEncryption in transit
- BLegal issues
- CChain of custody
- DOrder of volatility
- EKey exchange
192Due to adverse events, a medium-sized corporation suffered a major operational disruption that caused its
servers to crash and experience a major power outage. Which of the following should be created to prevent
this type of issue in the future?- ASLA
- BBIA
- CBCM
- DBCP
- ERTO
193Ann, a CIRT member, is conducting incident response activities on a network that consists of several hundred virtual servers and thousands of endpoints and users. The network generates more than 10,000 log messages per second. The enterprise belong to a large, web-based cryptocurrency startup, Ann has distilled the relevant information into an easily digestible report for executive management . However, she still needs to collect evidence of the intrusion that caused the incident. Which of the following should Ann use to gather the required information?
- ATraffic interceptor log analysis
- BLog reduction and visualization tools
- CProof of work analysis
- DLedger analysis software
194A company Invested a total of $10 million lor a new storage solution Installed across live on-site datacenters. Fitly percent of the cost of this Investment was for solid-state storage. Due to the high rate of wear on this storage, the company Is estimating that 5% will need to be replaced per year. Which of the following is the ALE due to storage replacement?
- A$50,000
- B$125,000
- C$250,000
- D$500.000
- E$51,000,000
195A security analyst is validating the MAC policy on a set of Android devices. The policy was written to ensure
non-critical applications are unable to access certain resources. When reviewing dmesg, the analyst notes
many entries. Despite the deny message, this action was still permit following is the MOST likely fix for this issue?- AAdd the objects of concern to the default context.
- BSet the devices to enforcing
- CCreate separate domain and context files for irc
- DRebuild the policy, reinstall, and test.
196A company undergoing digital transformation is reviewing the resiliency of a CSP and is concerned about
meeting SLA requirements in the event of a CSP incident. Which of the following would be BEST to proceed with the transformation?- AAn on-premises solution as a backup
- BA load balancer with a round-robin configuration
- CA multicloud provider solution
- DAn active-active solution within the same tenant
197A company’s product site recently had failed API calls, resulting in customers being unable to check out and purchase products. This type of failure could lead to the loss of customers and damage to the company’s reputation in the market. Which of the following should the company implement to address the risk of system unavailability?
- AUser and entity behavior analytics
- BRedundant reporting systems
- CA self-healing system
- DApplication controls
198An organization mat provides a SaaS solution recently experienced an incident involving customer data loss. The system has a level of sell-healing that includes monitoring performance and available resources. When me system detects an issue, the self-healing process is supposed to restart pans of me software. During the incident, when me self-healing system attempted to restart the services, available disk space on the data drive to restart all the services was inadequate. The self-healing system did not detect that some services did not fully restart and declared me system as fully operational. Which of the following BEST describes me reason why the silent failure occurred?
- AThe system logs rotated prematurely.
- BThe disk utilization alarms are higher than what me service restarts require.
- CThe number of nodes in me self-healing cluster was healthy
- DConditional checks prior to the service restart succeeded
199A security engineer is reviewing a record of events after a recent data breach incident that Involved the
following:
-A hacker conducted reconnaissance and developed a footprint of the company s Internet-facing web
application assets
-A vulnerability in a third-party horary was exploited by the hacker, resulting in the compromise of a local
account.
-The hacker took advantage of the account's excessive privileges to access a data store and exfilltrate the data without detection.
Which of the following is the BEST solution to help prevent this type of attack from being successful in the
future?- ADynamic analysis
- BSecure web gateway
- CSoftware composition analysis
- DUser behavior analysis
- EWeb application firewall
200A networking team was asked to provide secure remote access to all company employees. The team decided to use client-to-site VPN as a solution. During a discussion, the Chief Information Security Officer raised a security concern and asked the networking team to route the Internet traffic of remote users through the main office infrastructure. Doing this would prevent remote users from accessing the Internet through their local networks while connected to the VPN. Which of the following solutions does this describe?
- AFull tunneling
- BAsymmetric routing
- CSSH tunneling
- DSplit tunneling
Informações
- Descrição
- Quiz sobre CASP+ Practice Test 1, criado por Skyler Rogers em 02-03-2023.
- Autor
- Skyler Rogers
- Idioma
- English
- Visualizações
- 4
- Etiquetas
- Avaliação
- Ainda sem avaliações Avalie este quiz