Quiz
SEC+ 601 Practice Exam
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (146)
1Which of the following is a known security risk associated with data archives that contain financial information?
- AData can become a liability if archived longer than required by regulatory guidance
- BData must be archived off-site to avoid breaches and meet business requirements
- CCompanies are prohibited from providing archived data to e-discovery requests
- DUnencrypted archives should be preserved as long as possible and encrypted.
2A secuirty forensics analyst is examining a virtual server. The analyst wants to preserve the present state of the virtual server, including memory contents. Which of the following backp types should be used?
- ASnapshot
- BDifferential
- CCloud
- DFull
- EIncremental
3A systems administrator is troubleshooting a server's connection to an internal web server. The administator needs to determine the correct ports to use. Which of the following tools BEST shows which ports on the web server are in a listening state?
- Aipconfig
- Bssh
- CPing
- DNetstat
4The Chief Information Security Officer (CISO) has requested that a third-party vendor provide supporting documents that show proper controls are in place to protect customer data. Which of the following would be BEST for the third-party vendor to provide to the CISO?
- AGDPR compliance attestation
- BCloud Security Alliance materials
- CSOC 2 Type 2 report
- DNIST RMF workbooks
5Which of the following is the MOST relevant security check to be performed before embedding third-pary libraries in developed code?
- ACheck to see if the third party has resources to create dedicated development and staging environments.
- BVerify the number of companies that downloaded the third-party code and the number of contributions on the code repository.
- CAssess existing vulnerabilities affecting the third-party code and the remediation efficiency of the libraries' developers.
- DRead multiple penetration-testing reports for environments running software that reused the library.
6An organization has hired a red team to simulate attacks on its security posture. Which of the following will the blue team do after detecting an IoC?
- AReimage the impacted workstations
- BActivate runbooks for incident response
- CConduct forensics on the compromised system
- DConduct passive reconnaissance to gather information
7Which biometric error would allow an unauthorized user to access a system?
- AFalse acceptance
- BFalse entrance
- CFalse rejection
- DFalse denial
8Which of the following control types is focused primarily on reducing risk before an incident occurs?
- APreventive
- BDeterrent
- CCorrective
- DDetective
9The Chief Information Security Officer directed a risk reduction in shadow IT and created a policy requiring all unsanctioned high-risk SaaS (Software as a Service) applications to be blocked from user access. Which of the following is the BEST security solution to reduce this risk?
- ACASB
- BVPN concentrator
- CMFA
- DVPC endpoint
10The board of doctors at a company contracted with an insurance firm to limit the organization's liability. Which of the following risk management practices does this BEST describe?
- ATransference
- BAvoidance
- CMitigation
- DAcknowledgement
11A DBA (database admin) reports that several production server hard drives were wiped over the weekend. The DBA also reports that several Linux servers were unavailable due to system files being deleted unexpectedly. A security analyst verifed that software was configured to delete data deliberately from those servers. No backdoors to any servers were found. Which of the following attacks was MOST likely used to cause the data toss?
- ALogic bomb
- BRansomware
- CFileless virus
- DRemote Access Trojans
- ERootkit
12An engineer wants to inspect traffic to a cluster of web servers in a cloud environment. Which of the following solutions should the engineer implement?
- AProxy server
- BWAF
- CLoad balancer
- DVPN
13A new company wants to avoid channel interference when building a WLAN. The company needs to know the radio frequency behavior, identify dead zones, and determine the best place for access points. Which of the following should be done FIRST?
- AConfigure heat maps
- BUtilize captive portal
- CConduct a site survey
- DInstall Wi-FI analyzers
14An organization discovered that files with proprietary financial data have been deleted. The files have been recovered from backup but every time the Chief Financial Officer logs in to the file server, the same files are deleted again. No other users are experiences this issue. Which of the following types of malware is MOST liekly causing this behavior?
- ALogic bomb
- BCrypto Malware
- CSpyware
- DRemote Access Trojan
15A company recently experienced a significant data loss when proprietary information was leaked to a competitor. The company took special precautions by using proper labels; however, email filter logs do not have any record of the incident. An investigation confirmed the corporate network was not breached, but documents were downloaded form an employee's COPE tablet and passed to the competitor via cloud storage. Which of the following is the BEST remediation for this data leak?
- AUser training
- BCASB
- CMDM
- DDLP
16A help desk technician receives a phone call from someone claiming to be a part of the organization's cybersecurity incident response team. The caller asks the technician to verify the network's internal firewall IP address. Which of the following is the technician's BEST course of action?
- ADirect the caller to stop by the help desk in person and hang up declining any further requests from the caller
- BAsk for the callers name, verify the persons identity in the email directory and provide the requested information over the phone
- CWrite down the phone number of the caller if possible, the name of the person requesting the information, hang up and notify the organizaion's cybersecurity officer
- DRequest the caller send an email for identity verification and provide the requested information via email to the caller
17As part of a security compliance assessment, an auditor performs automated vulnerability scans. In addition, which of the following should the auditor do to complete the assessment?
- AUser behavior analysis
- BPacket captures
- CConfiguration reviews
- DLog analysis
18A company is auditing the manner in which its European customers' personal information is handled. Which of the following should the company consult?
- AGDPR
- BISO
- CNIST
- DPCI DSS
19During a security incident investigation, an analyst consults the company's SIEM and sees an event concerning high traffic to a known, malicious command-and-contrl server. The analyst would like to determine the number of company workstations that may be impacted by this issue. Which of the following can provide the information?
- AWAF logs
- BDNS logs
- CSystem logs
- DApplication logs
20An organization is planning to open other data centers to sustain operations in the event of a natural disaster. Which of the following considerations would BEST support the organization's resiliency?
- AGeographic dispersal
- BGenerator power
- CFire suppression
- DFacility automation
21After multipl eon premises security solutions were migrated to the cloud, the incident response time increased. The analysts are spending a long time tracing information on different cloud consoles and correlating data in different formats. Which of the following can be used to optimize the incident response time?
- ACASB
- BVPC
- CSWG
- DCMS
22Which of the following provides a calculated value for the known vulnerabilities so organization scan prioritize mitigation steps?
- ACVSS
- BSIEM
- CSOAR
- DCVE
23Which of the following employee roles is responsible for protecting an organization's collected personal information?
- ACTO
- BDPO
- CCEO
- DDBA
24A user is attempting to navigate to a website form inside the company network using a desktop. When the user types in the URL https://www.site.com, the user is presented with a certificate mismatch warning from the browser. The user does not receive a warning when visiting http://anothersite.com. Which of the following describes this attack?
- AOn-path
- BDomain hijacking
- CDNS poisoning
- DEvil twin
25A security administrator is analyzing the corporate wireless network. The network only has to access points running on channels 1 and 11. While using airodump-ng, the administrator notices other access points are running with the same corporate ESSID on all available channels and with the same BSSID of one of the legitimate access points. Which of the following attacks are happening on the corporate network?
- AMan in the middle
- BEvil twin
- CJamming
- DRogue access point
- EDisassociation
26A technician enables full disk encryption on a laptop that will be taken on a business trip. Which of the following does this process BEST protect?
- AData in transit
- BData in processing
- CData at rest
- DData tokenization
27Which of the following would detect intrusions at the perimeter of an airport?
- ASignage
- BFencing
- CMotion sensors
- DLighting
- EBollards
28A company wants the ability to restrict web access and monitor websites that employees visit. Which of the following would BEST meet these requirements?
- AInternet proxy
- BVPN
- CWAF
- DFirewall
29Which of the following describes the continuous delivery software development methodology?
- AWaterfall
- BSpiral
- CV-shaped
- DAgile
30During a recent incident an external attacker was able to exploit an SMB vulnerability over the internet. Which of the following action items should a security analyst perform FIRST to prevent this from occurring again?
- ACheck for any recent SMB CVEs
- BInstall AV on the affected server
- CBlock unneeded TCP 445 connections
- DDeploy a NIDS in the affected subnet
31A security analyst needs to be able to search and correlate logs from multiple sources in a single tool. Which of the followign would BEST allow a security analyst to have this ability?
- ASOAR
- BSIEM
- CLog collectors
- DNetwork-attached storage
32A cloud service provider has created an environment where customer can connect existing local networks to the cloud for additional computing resources and block internal HR applications from reaching the cloud. Which of the following cloud models is being used?
- APublic
- BCommunity
- CHybrid
- DPrivate
33A company is considering transitioning to the cloud. The company employs individuals from various locations around the world. The company does not want to increase its on-premises infrastructure blueprint and only wants to pay for additional computing power required. Which of the following solutions would BEST meet the needs of the company?
- APrivate cloud
- BHybrid environment
- CManaged security service provider
- DHot backup site
34A recent security breach exploited software vulnerablilties in the firewall and within the netowrk management solution. Which of the following will MOST likely be used to identify when the breach occurred through each device?
- ASIEM correlation dashboards
- BFirewall syslog event logs
- CNetwork management solution login audit logs
- DBandwidth monitors and interface sensors
35An organization has activated an incident response plan due to a malware outbreak on its network. The organization has brought in a forensics team that has identified an internet-facing Windows server as the likely point of initial compromise. The malware family that was detected is known to be distributed by manually loggin on to the servers and running the malicious code. Which of the following actions would be BEST to prevent reinfection from the initial infection vector?
- APrevent connections over TFTP from the internal network
- BCreate a firewall rule that blocks port 22 from the internet to the server
- CDisable file sharing over port 445 to the server
- DBlock for 3389 inbound from untrusted networks
36A company is looking to migrate some servers to the cloud to minimize its technology footprint. The company has 100 databases that are on premises. Which of the following solutions will require the LEAST management and support from the company?
- ASaaS
- BIaaS
- CPaaS
- DSDN
37Which of the following should be monitored by threat intelligence researchers who search for leaked credentials?
- ACommon Weakness Enumeration
- BOSINT
- CDark web
- DVulnerability databases
38To reduce and limit software and infrastructure costs, the Chief Information Officer has requested to move email services to the cloud. The cloud provider and the organization must have security controls to protect sensitive data. Which of the following cloud services would BEST accommodate the request?
- AIaaS
- BPaaS
- CDaaS
- DSaaS
39A security analyst is working on a project to implement a solution that monitors network communications and provides alerts when abnormal behavior is detected. Which of the following is the security analyst MOST likely implementing?
- AVulnerability scans
- BUser behavior analysis
- CSecurity orchestration, automation, and response
- DThreat hunting
40A customer service representative reported an unusual text message that was sent to the help desk. The message contained an unrecognized invoice number with a large balance due and a link to click for more details. Which of the following BEST describes this technique?
- AVishing
- BWhaling
- CPhising
- DSmishing
41A Chief Security Officer (CSO) is concerned that cloud-based services are not adequately protected from advanced threats and malware. The CSO believes there is a high risk that a data breach could occur in the near future due to the lack of detective and preventive controls. Which of the following should be implemented to BEST address the CSO's concerns?
- ACASB and Segmentation
- BWAF and Encryption
- CAn NG-SWG
- DContainerization
42A security policy states that common words should not be used as passwords. A security auditor was able to perform a dictionary attack against corporate credentials. Which of the following controls was being violated?
- APassword complexity
- BPassword history
- CPassword reuse
- DPassword length
43Which of the following is a benefit of including a risk management framework into an organization's security approach?
- AIt defines expected service levels from participating supply chain partners to ensure system outages are remediated in a timely manner
- BIt identifies specific vendor products that have been tested and approved for use in a secure environment
- CIt provides legal assurances and remedies in the event a data breach occurs
- DIt incorporates control, development, policy, and management activities into IT operations
44An organization implemented a process that compares the settings currently configured on systems against secure configuration guidelines in order to identify any gaps. Which of the following control types has the organization implemented?
- ACompensating
- BCorrective
- CPreventive
- DDetective
45An IT manager is estimating the mobile device budget for the upcoming year Over the last five years, the number of devices that were replaced due to loss damage or theft steadily increased by 10%. Which of the following would BEST describe the estimated number of devices to be replaced next year?
- AALE
- BARO
- CRPO
- DSLE
46Which of the following is assured when a user signs an email using a private key?
- ANon-repudiation
- BConfidentiality
- CAvailability
- DAuthentication
47A company suspects that some corporate accounts were compromised. The number of suspicious logins from locations not recognized by the users is increasing. Employees who travel need their accounts protected without the risk of blocking legitimate login requests that may be made over new sign-in properties. Which of the following security controls can be implemented?
- AEnforce MFA when an account request reaches a risk threshold
- BImplement geofencing to only allow access from headquarters
- CEnforce time-based login requests that align with business hours
- DShift the access control scheme to a discretionary access control
48Multiple business accounts were compromised a few days after a public website had its credentials database leaked on the internet. No business emails were identified in the breach, but the security team thinks that the list of passwords exposed was later used to compromise business acounts. Which of the following would mitigate the issue?
- AComplexity requirements
- BPassword history
- CAcceptable use policy
- DShared accounts
49An organization wants to particiapte in threat intelligence information sharing with peer groups. Which of the following would MOST likely meet the organization's requirement?
- APerform OSINT investigations
- BSubscribe to threat intelligence feeds
- CSubmit RFCs
- DImplement a TAXII server
50A forensic analyst needs to prove that data has not been tampered with since it was collected. Which of the following methods will the analyst MOST likely use?
- ALook for tampering on the evidence collection bag
- BEncrypt the collected data using asymmetric encryption
- CEnsure proper procedures for chain of custody are being followed
- DCalculate the checksum using a hashing algorithm
51A Chief Information Security Officer wants to ensure the organization is validating and checking the integrity of zone transfers. Which of the following solutions should be implemented?
- ADNSSEC
- BLDAPS
- CNGFW
- DDLP
52After returning from a conference, a user's laptop has been operating slower than normal and overheating and the fans have been running constantly. During the diagnosis process, and unknown piece of hardware is found connected to the laptop's motherboard. Which of the following attack vectors was exploited to install the hardware?
- ARemovable media
- BSpear phishing
- CSupply chain
- DDirect access
53During a recent penetration test, the tester discovers large amounts of data were exfiltrated over the course of 12 months via the internet. The penetration tester stops the test to inform the client of the findings. Which of the following should be the client's NEXT step to mitigate the issue?
- AConduct a full vulnerability scan to identify possible vulnerabilities
- BPerform containment on the critical servers and resources
- CReview the firewall and identify the source of the active connection
- DDisconnect the entire infrastructure from the internet
54Which of the following would be the BEST way to analyze diskless malware that has infected a VDI?
- AShut down the VDI and copy off the event logs.
- BTake a memory snapshot of the running system
- CUse NetFlow to identify command-and-control IPs
- DRun a full on-demand scan of the root volume.
55An administrator is experiencing issues when trying to upload a support file to a vendor. A pop-up message reveals that a payment card number was found in the file, and upload was blocked. Which of the following controls is most likely causing this issue and should be checked FIRST?
- ADLP
- BFirewall rule
- CContent filter
- DMDM
- EApplication allow list
56An organization is building backup server rooms in geographically diverse locations. The Chief Information Security Officer implemented a requirement on the project that states the new hardware cannot be susceptible to the same vulnerabilities in the exsiting server room. Which of the following should the systems engineer consider?
- APurchasing hardware from different vendors
- BMigrating workloads to public cloud infrastructure
- CImplementing a robust patch management solution
- DDesigning new detective security controls
57Digital signatures use asymmetric encryption. This means the message is encrypted with:
- AThe sender's private key and decrypted with the sender's public key
- BThe sender's public key and decrypted with the sender's private key
- CThe sender's private key and decrypted with the recipient's public key
- DThe sender's public key and decrypted with the recipient's private key
58A security analyst is concerned about critical vulnerabilities that have been deteced on some applications running inside containers. Which of the following is the BEST remediation strategy?
- AUpdate the base container image and redeploy the environment
- BInclude the containers in the regular patching schedule for servers
- CPatch each running container individually and test the application
- DUpdate the host in which the containers are running
59Which of the following is the BEST example of a cost-effective physical control to enforce a USB removable media restriction policy?
- APutting security/anti tamper tape over USB ports logging the port numbers and regularly inspecting the ports
- BImplementing a GPO that will restrict access to authorized USB removable media and regularly verifying that it is enforced
- CPlacing systems into locked key-controlled containers with no access to the USB ports
- DInstalling an endpoint agent to detect connectivity of USB and removable media
60An employee received a word processing file that was delivered as an email attachment. The subject line and email content enticed the employee to open the attachment. Which of the following attack vectors BEST matches this malware?
- AEmbedded Python code
- BMacro-enabled file
- CBash scripting
- DCredential-harvesting website
61The Chief Information Security Officer wants to prevent exfiltration of sensitive information from employee cell phones when using public USB power charging stations. Which of the following would be the BEST solution to implement?
- ADLP
- BUSB data blocker
- CUSB OTG
- DDisabling USB ports
62The database administration team is requesting guidance for a secure solution that will ensure confidentiality of cardholder data at rest in certain fields in the database schema. The requirement is to substitute a sensitive data field with a non-sensitive field that is rendered useless if a data breach occurs. Which of the following is the BEST solution to meet the requirement?
- ATokenization
- BMasking
- CFull disk encryption
- DMirroring
63A security analyst wants to fingerprint a web server. Which of the following tools will the security analyst MOST likely use to accomplish this task?
- Anmap-p1-65S35 192.168.0.10
- Bdig 192.168.0.10
- Ccurl--htad
- Dping 192.168.0.10
64The Chief Compliance Officer from a bank has approved a background check policy for all new hires. Which of the following is the policy MOST likely protecting against?
- APreventing any current employees' siblings from working at the bank to prevent nepotism
- BHiring an employee who has been convicted of theft to adhere to industry compliance
- CFiltering applicants who have added false information to resumes so they appear better qualified
- DEnsuring no new hires have worked at other banks that may be trying to steal customer information
65A company is implementing BYOD (bring your own device) and wants to ensure all users have access to the same cloud-based services. Which of the following would BEST allow the company to meet this requirement?
- AIaaS
- BPaaS
- CMaaS
- DSaaS
66A tax organization is working on a solution to validate the online submission of documents. The solution should be stored on a portable USB device that should be inserted on any computer that is transmitting a transaction securely. Which of the following is the BEST certificate for these requirements?
- AUser certificate
- BSelf-signed certificate
- CComputer certificate
- DRoot certificate
67An organization wants to implement a biometric system with the highest likelihood that an unauthorized user will be denied access. Which of the following should the organization use to compare biometric solutions?
- AFRR
- BDifficulty of use
- CCost
- DFAR
- ECER
68An application developer accidentally uploaded a company's code-signing certificate private key to a public web server. The company is cerned about malicious use of its certificate. Which of the following should the company do FIRST?
- ADelete the private key from the repository
- BVerify the public key is not exposed as well
- CUpdate the DLP solution to check for private keys
- DRevoke the code-signing certificate
69A security proposal was set up to track requests for remote access by creating a baseline of the users' common sign-in properties. When a baseline deviation is detected, an MFA challenge will be triggered. Which of the following should be configured in order to deploy the proposal?
- AContext-aware authentication
- BSimultaneous authentication of equals
- CExtensive authentication protocol
- DAgentless network access control
70During an incident response process involving a laptop, a host was identified as the entry point for malware. The management team would like to have the laptop restored and igven back to the user. The cybersecurity analyst would like to continue investigating the intrusion on the host. Which of the following would allow the analyst to continue the investigation and also return the laptop to the user as soon as posssible?
- Adiscdump (dd)
- Bmemdump
- Ctcpdump
- Dhead
71A business operations manager is concerned that a PC that is critical to business operations will have a costly hardware failure soon. The manager is looking for options to continue business operations without incurring large costs. Which of the following would mitigate the manager's concerns?
- AImplement a full system upgrade
- BPerform a physical-to-virtual migration
- CInstall uninterruptible power supplies
- DPurchase cybersecurity insurance
72A user enters a username and a password at the login screen for a web portal. A few seconds later the following message appears on the screen: "Please use a combination of numbers, special characters, and letters in the password field". Which of the following concepts does this message describe?
- APassword complexity
- BPassword reuse
- CPassword history
- DPassword age
73An organization has decided to purchase an insurance policy because a risk assessment determined that the cost to remediate the risk is greater than the five-year cost of the insurance policy. The organization is enabling risk _____.
- Aavoidance
- Bacceptance
- Cmitigation
- Dtransference
74Which of the following is the GREATEST security concern when outsourcing code development to third-party contractors for an internet-facing application?
- AIntellectual property theft
- BElevated privileges
- CUnknown backdoor
- DQuality assurance
75Which of the following control types would be BEST to use in an accounting department to reduce losses from fraudulent transactions?
- ARecovery
- BDeterrent
- CCorrective
- DDetective
76A routine audit of medical billing claims revealed that several claims were submitted without the subscriber's knowledge. A review of the audit logs for the medical billing company's system indicated a company employee downloaded customer records and adjusted the direct deposit information to a personal bank account. Which of the following does this action describe?
- AInsider threat
- BSocial engineering
- CThird-party risk
- DData breach
77Two organizations plan to collaborate the evaluation of new SIEM solutions for their respective companies. A combined effort from both organizations' SOC teams would speed up the effort. Which of the following can be written to document this agreement?
- AMOU
- BISA
- CSLA
- DNDA
78Which of the following components can be used to consolidate and forward inbound Internet traffic to multiple cloud environments through a single firewall?
- ATransit gateway
- BCloud hot site
- CEdge computing
- DDNS sinkhole
79A recent audit cited a risk involving numerous low-criticality vulnerabilities created by a web application using a third-party library. The development staff state there are still customers using the application even though it is end of life and it would be a substantial burden to update the application for compatibility with more secure libraries. Which of the following would be the MOST prudent course of action?
- AAccept the risk if there is a clear road map for timely decommission
- BDeny the risk due to the end-of-life status of the application
- CUse containerization to segment the applicaiton from other applications to eliminate the risk
- DOutsource the application to a third-party developer group
80An attacker was eavesdropping on a user who was shopping online. The attacker was able to spoof the IP address associated with the shopping site. Later, the user received an email regarding the credit card statement with unusual purchases. Which of the following attacks took place?
- AOn-path attack
- BProtocol poisoning
- CDomain hijacking
- DBluejacking
81After a recent security breach a security analyst reports that several administrative usernames and passwords are being sent via cleartext across the network to access network devices over port 23. Which of the following should be implemented so all credentials sent over the network are encrypted when remotely accessing and configuring network devices?
- ASSH
- BSNMPv3
- CSFTP
- DTelnet
- EFTP
82DDoS attacks are causing an overload on the cluster of cloud servers. A security architect is researching alternatives ot make the cloud environment respond to load fluctuation is a cost-effective war. Which of the following options BEST fulfills the architect's requirements?
- AAn orchestration solution that can adjust scalability of cloud assets
- BUse of multipath by adding more connections to cloud storage
- CCloud assets replicated on geographically distributed regions
- DAn on-site backup that is deployed and only used when the load increases
83Which of the following documents provides expectations at a technical level for quality, availability, and responsibilities?
- AEOL
- BSLA
- CMOU
- DEOSL
84An organization would like to give remote workers the ability to use applications hosted inside the corporate network. Users will be allowed to use their personal computers or they will be provided organization assets. Either way no data or applications will be installed locally on any user systems. Which of the following mobile solutions would accomplish these goals?
- AVDI
- BMDM
- CCOPE
- DUTM
85Server administrators want to configure a cloud solution so that computing memory and processor usage is maximized most efficiently across a number of virtual servers. They also need to avoid potential denial-of-service situations caused by availability. Which of the following should an administrator configure to maximize system availability while efficiently utilizing available computing power?
- ADynamic resource allocation
- BHigh availability
- CSegmentation
- DContainer security
86The Chief Information Security Officer wants to prevent exfiltration of sensitive information from employee cell phones when using public USB power charging stations. Which of the following would be the BEST solution to implement?
- ADLP
- BUSB data blocker
- CUSB OTG
- DDisabling USB ports
87An organization has developed and application that needs a patch to fix a critical vulnerability. In which of the following envrionments should the patch be deployed LAST?
- ATest
- BStaging
- CDevelopment
- DProduction
88During an incident response, an analyst applied rules to all inbound traffic on the border firewall and implemented ACLs on each critical server. Follow an investigation, the company realizes it is still vulnerable because outbound traffic is not restricted and the adversary is able to maintain a presense in the network. In which of the following stages of the Cyber Kill Chain is the adversary current operating?
- AReconnaissance
- BCommand and control
- CActoins on objective
- DExploitation
89Which of the following is the MOST effective control against zero-day vulnerabilities?
- ANetwork segmentation
- BPatch management
- CIntrusion prevention system
- DMultiple vulnerability scanners
90Which of the following terms describes a broad range of information that is sensitive to a specific organization?
- APublic
- BTop secret
- CProprietary
- DOpen-source
91Field workers in an organization are issued phones on a daily basis. All the work if performed within one city and the mobile phones are not used for any purpose other than work. The organization does not want these phones used for personal purposes. The organization would like to issue the phones to workers as permanent devices to the phones do not need to be reissued every day. Given the conditions described, which of the following technologies would BEST meet these requirements?
- AGeofencing
- BMobile device management
- CContainerization
- DRemote wiping
92An organization is migrating sever SaaS applications that support SSO. The security manager wants to ensure the migration is completed securely. Which of the following should the organization consider before implementation?
- AThe back-end directory source and Identity federation protocol
- BThe hashing method and encryption method
- CThe registration authority and certificate authority
93Which of the following is an example of transference of risk?
- APurchasing insurance
- BPatching vulnerable servers
- CRetiring outdated applications
- DApplications owner risk sign-off
94Which of the following organizations sets frameworks and controls for optimal security configurations on systems?
- AISO
- BGDPR
- CPCI DSS
- DNIST
95Certain users are reporting their accounts are being used to send unauthorized emails and conduct suspicious activities. After further investigation a security analyst notices the following: All users share workstations throughout the day, Endpoint protection was disabled on several workstations throughout the network, Travel times on logins from the affected users are impossible, Sensitive data is being uploaded to external sites, and All user account passwords were forced to be reset and the issue continued. Which of the following attacks is being used to compromise the user accounts?
- ABrute-force
- BKeylogger
- CDictionary
- DRainbow
96The SOC for a large MSSP is meeting to discuss the lessons learned from a recent incident that ook much too long to resolve. This type of incident has become more common in recent weeks and is consuming large amounts of the analysts' time due to manual tasks being performed. Which of the following solutions should th SOC consider to BEST improve its response time?
- AConfigure a NIDS appliance using a Switched Port Analyzer
- BCollect OSINT and catalog the artifacts in a central repository
- CImplement a SOAR with customizable playbooks
- DInstall a SIEM with community-driven threat intelligence
97Business partners are working on a security mechanism to validate transactions securely. The requirement is for one compnay to be responsible for deploying a trusted solution that will register and issue artifacts used to sign, encrypt, and decrypt transaction files. Which of the following is the BEST solution to adopt?
- APKI
- BBlockchain
- CSAML
- DOAuth
98A company wants to improve end users' experiences when they login to a trused partner website. The company does not want the users to be issues separate credentials for the partner website. Which of the following should be implemented to allow users to authenticate using their own credentials to log in to the trusted partner's website?
- ADirectory service
- BAAA server
- CFederation
- DMulifactor authentication
99A Chief Information Security Officer has defined resiliency requirements for a new data center architecture. The requirements are as follows: "Critical fileshares will remain accessible during and after a natural disaster, Five percent of hard disks can fail at any given time without impacting the data, Systems will be forced to shut down gracefully when battery levels are below 20%". Which of the following are required to BEST meet these objectives?
- ARAID, UPS, Geographical dispersal
- BFiber switching, NAS, Snapshots
- CIaC, Redundant power supplies, Load balancing
100A security analyst generated a file name host1.pcap and shared it with a team member who is going to use it for further incident analysis. Which of the following tools will the other team member MOST lieky use to open this file?
- AAutopsy
- BMemdump
- CFTK imager
- DWireshark
101A security manager has tasked the security operations center with locating all web servers that respond to an unsecure protocol. Which of the following command could an analyst run to find requested servers?
- Anslookup 10.10.10.0
- Bnmap -p 80 10.10.10.0/24
- Cpathping 10.10.10.0 -p 80
- Dno -1 -p 80
102A company wants to restrict emailing of PHI documents. The company is implementing a DLP solution. In order to restrict PHI documents, which of the following should be performed FIRST?
- ARetention
- BGovernance
- CClassification
- DChange management
103A security incident has been resolved. Which of the followign BEST describes the importance of the final phase of the incident response plan?
- AIt examines and documents how well the team responded discovers what caused the incident, and determines how the incident can be avoided in the future
- BIt returns the affected systems back into production once systems have been fully patched, data restored and vulnerabilities addressed
- CIt identifies the incident and the scope of the breach how it affects the production envionment, and the ingress point
- DIt contains the affected systems and disconnects them from the network, preventing further spread of the attack or breach
104A security analyst was called to investigate a file received directly from a hardware manufacturer. The analyst is trying to determine whether the file was modified in transit before installation on the user's computer. Which of the following can be used to safely assess the file?
- ACheck the hash of the installation file
- BMatch the file names
- CVerify the URL download location
- DVerify the code-signing certificate
105Server administrators want to configure a cloud solution so that computing memory and processor usage is maximized most efficiently across a number of virtual servers. They also need to avoid potential denial-of-service situations caused by availability. Which of the following should administrators configure to maximize system availability while efficiently utilizing available computing power?
- ADynamic resource allocation
- BHigh availably
- CSegmentation
- DContainer security
106An engineer recently deployed a group of 100 web servers in a cloud environment. Per the security policy, all web-server ports except 443 should be disabled. Which of the following can be used to accomplish this task?
- AApplication allow list
- BSWG
- CHost-based firewall
- DVPN
107A company is receiving emails with links to phishing sites that look very similar to the company's own website address and content. Which of the following is the BEST way for the company to mitigate this attack?
- ACreate a honeynet to trap attackers who access the VPN with credentials obtained by phishing
- BGenerate a list of domains similar to the company's own and implement a DNS sinkhole for each
- CDisable POP and IMAP on all Internet-facing email servers and implement SMTPS
- DUse and automated tool to flood the phishing websites with fake usernames and passwords
108Which of the following would BEST provide a systems administrator with the ability to more efficiently identify systems and manage permissions and policies based on location, role, and service level?
- AStandard naming conventions
- BDomain services
- CBaseline configurations
- DDiagrams
109A company labeled some documents with the public sensitivity classification. This means the documents can be accessed by:
- Aemployees of other companies and the press
- Ball members of the department that created the documents
- Conly the company's employees and those listed in the document
- Donly the indidual listed in the documents
110The Chief Information Security Officer (CISO) requested a report on potential areas of improvement following a security incident. Which of the following incident response processes is the CISO requesting?
- ALessons learned
- BPreparation
- CDetection
- DContainment
- ERoot cause analysis
111Which of the following actions would be recommended to improve an incident response process?
- ATrain the team to identify the difference between events and incidents
- BModify access so the IT team has full access to the compromised assets
- CContact the authorities if a cybercrime is suspected
- DRestrict communication surrounding the response to the IT team
112During a trial, a judge determined evidence gathered from a dark drive was not admissible. Which of the following BEST expmlains this reasoning?
- AThe forensic investifator forgot to run a checksum on the disk image after creation
- BThe chain of custody from did not note time zone offsets between transportation regions
- CThe computer was turned off, and a RAM image could not be taken at the same time
- DThe hard drive was not properly kept in an antistatic bag when it was moved
113A company is providing security awareness training regarding the importance of not forwarding socail media messages from unverified sources. Which of the following risks would this training help to prevent?
- AHoaxes
- BSPIMs
- CIdentity fraud
- DCredential harvesting
114A security analyst is receiving numerous alerts reporting that the response time of an internet-facing application has been degraded. However, the internal network performance was not degraded. Which of the following MOST likely explains this behavior?
- ADNS poisoning
- BMAC flooding
- CDDoS attack
- DARP poisoning
115An audit identified PII being utilized in the development environment of a critical application. The Chief Privacy Officer (CPO) is adamant that this data must be removed; however, the developers are concerned that without real data they cannot perform functionality tests and search for specific data. Which of the following should a security professional implement to BEST satisfy both the CPO's and the development team's requirements?
- AData anonymization
- BData encryption
- CData masking
- DData tokenization
116Which of the following will increase cryptographic security?
- AHigh data entropy
- BAlgorithms that require less computing power
- CLonger key longevity
- DHashing
117Which of the following tools is effective in preventing a user from accessing unauthorized removable media?
- AUSB data blocker
- BFaraday cage
- CProximity reader
- DCable lock
118A database administrator wants to grant access to an application that will be reading and writing data to a database. The database is shared by other applications also used by the finance department. Which of the following account types is MOST appropriate for this purpose?
- AService
- BShared
- CGeneric
- DAdmin
119A security analyst identified malware spreading through the corporate network and has activiated the CSIRT. Which of the following should the analyst do NEXT?
- AReview how the malware was introduced to the network
- BAttempt to quarantinve all infected hosts to limit further spread
- CCreate help desk tickets to get infected systems reimaged
- DUpdate all endpoint antivirus solutions with the latest updates
120A company is implementing a DLP solution on the file server. The file server has PII, financial information, and health information stored on it. Depending on what type of data that is hosted on the file server, the company wants different DLP rules assigned to the data. Which of the following should the company do to help accomplish this goal?
- AClassify the data
- BMask the data
- CAssign an application owner
- DPerform a risk analysis
121After gaining access to a dual-homes (i.e. wired and wireless) multifunction device by exploiting a vulnerability in the device's firmware, a penetration tester then gains shell access on another networked asset. This technique is an example of:
- APrivilege escalation
- Bfootprinting
- Cpersistence
- Dpivoting
122Due to unexpected circumstances, an IT compnay must vacate its main office, forcing all operations to alternate, off-site locations. Which of the following will the company MOST likely reference for guidance during this change?
- AThe business continuity plan
- BThe retention policy
- CThe disaster recovery plan
- DThe incidnet response plan
123Which of the following are common VoIP-associated vulnerabilities?
- ASPIM and Credential harvesting
- BHopping and Tailgating
- CVishing and Phishing
124A security engineer is deploying a new wireless infrastructure for a company. The company shares office space with multiple tenants. Which of the following should the engineer configure on the wireless network to ensure that confidential data is not exposed to unauthorized users?
- AEAP
- BTLS
- CHTTPS
- DAES
125An organization maintains several environments in which patches are developed and tested before deployed to an operation status. Which of the following is the environment in which patches will be deployed just prior to being put into an operational status?
- ADevelopment
- BTest
- CProduction
- DStaging
126A security analyst receives an alert from the company's SIEM that anomalous activity is coming from a local source IP address of 192.168.34.26. The Chief Information Security Officer asks the analyst to block the originating source. Several days later, another employee opens an internal ticket stating that vulnerability scans are no longer being perfomred properly. The IP address the employee provides is 192.168.34.26. Which of the following describes this type of alert?
- ATrue positive
- BTrue negative
- CFalse positive
- DFalse negative
127An administrator needs to protect user passwords and has been advised to hash the passwords. Which of the following BEST describes what the administrator is being advised to do?
- APerform a mathematical operation on the passwords that will convert them into unique strings.
- BAdd extra data to the passwords so their length is increased, making them harder to brute force
- CStore all passwords in the system in a rainbow table that has a centralized location
- DEnforce the use of one-time passwords that are changed for every login session
128A security analyst is designing the appropriate controls to limit unauthorized access to a physical site. The analyst has a directive to utilize the lowest possible budget. Which of the following would BEST meet the requirements?
- APreventive controls
- BCompensating controls
- CDeterrent controls
- DDetective controls
129Several universities are participating in a collaborative research project and need to share compute and storage resources. Which of the following cloud deployment strategies would BEST meet this need?
- ACommunity
- BPrivate
- CPublic
- DHybrid
130Which of the following describes the exploitation of an interactive process to gain access to restricted areas?
- APersistence
- BBuffer overflow
- CPrivilege escalation
- DPharming
131A forensics investigator is examining a number of unauthorized payments that were reported on the company's website. Some unusual log entries show users received an email for an unwanted mailing list and clicked on a link to attempt to unsubscribe. One of the users reported the email to the phishing team, and the forwarded email revealed the link to be:
<a href- "https://company.com/payto.do?routing=00001111&accc=2222334&amount-250">Click here to unsubscribe</a>
Which of the following will the forensics investigator MOST likely determine has occurred?- ASQL Injection
- BCSRF
- CXSS
- DXSRF
132Which of the following statements BEST describes zero-day exploits?
- AWhen a zero-day exploit is discovered, the system cannot be protected by any means
- BZero-day exploits have their own scoring category in CVSS
- CA zero-day exploit is initially undetectable and no patch for it exists
- DDiscovering zero-day exploits is always performed via bug bounty programs
133Data exfiltration analysis indicates that an attacker managed to download system configuration notes from a web server. The web-server logs have been deleted, but analysts have determined that the system configuration notes were stored in the database administrator's folder on the web server. Which of the following attacks explains what occured?
- ADirectory traversal and Privilege escalation
- BPass-the-hash and Cross-site scripting
- CRequest forgery and SQL injection
134Which of the following risk management strategies would an organization use to maintain a legacy system with known risks for operational purposes?
- AAcceptance
- BTransference
- CAvoidance
- DMitigation
135A penetration tester was able to compromise an internal server and is now trying to pivot the current session in a network lateral movement. Which of the following fools, if available on the server, will provide the MOST useful information for the next assessment step?
- AAutopsy
- BCuckoo
- CMemdump
- DNmap
136Which of the following BEST reduces the security risks introduced when running systems that have expired vendor support and lack an immediate replacement?
- AImplement proper network access restrictions
- BInitiate a bug bounty program
- CClassify the system as shadow IT
- DIncrease the frequency of vulnerablility scans
137A report delivered to the Chief Information Security Officer (CISO) shows that some user credentials could be exfiltrated. The report also indicated that users tend to choose the same credentials on different systems and applications. Which of the following policies should the CISO use to prevent someone from using the exfiltrated credentials?
- AMFA
- BLockout
- CTime-based logins
- DPassword history
138A security analyst is evaluating solutions to deploy an additional layer of protection for a web application. The goal is to allow only encrypted communications without relying on netowrk devices. Which of the following can be implemented?
- AHTTP security header
- BDNSSEC implementation
- CSRTP
- DS/MIME
139A large bank with two geographically dispersed data centers is concerned about major power disruptions at both locations. Every day each location experiences very brief outages that last for a few seconds. However, during the summer a high risk of intentional brownouts that last up to an hour exists particularly at one of the locations near an industrial smelter. Which of the following is the BEST solution to reduce the risk of data loss?
- ADual supply
- BGenerator
- CUPS
- DPDU
- EDaily backups
140A security engineer was assigned to implement a solution to prevent attackers from gaining access by pretending to be authorized users. Which of the following technologies meets the requirement?
- ASSO
- BIDS
- CMFA
- DTPM
141A company needs to validate its updated incident response plan using a real-world scenario that will test decision points and relevant incident response actions without interrupting daily operations. Which of the following would BEST meet the company's requirements?
- ARed-team exercise
- BCapture-the-flag exercise
- CTabletop exercise
- DPhishing exercise
142Which of the following would BEST provide detective and corrective controls for thermal regulation?
- AA smoke detector
- BA fire alarm
- CAn HVAC system
- DA fire suppression system
- EGuards
143Which of the following would be indicative of a hidden audio file found inside of a piece of source code?
- ASteganography
- BHomomorphic encryption
- CCipher suite
- DBlockchain
144A security analyst has been asked by the Chief Information Security Officer to:
develop a secure method of providing centralized management of infrastructure, reduce the need to contently replace aging end user machines, and provide a consistent user desktop experience
Which of the following BEST meets these requirements?- ABYOD
- BMobile device management
- CVDI
- DContainerization
145A social media company based in North America is looking to expand into new global markets and needs to maintain compliance with international standards. With which of the following is the company's data protection officer MOST likely concerned?
- ANIST Framework
- BISO 27001
- CGDPR
- DPCI-DSS
146An amusement park is implementing a biometric system that validates customers' fingerprints to ensure they are not sharing tickets. The park's owner values customers above all and would prefer customers' convenience over security. For this reason which of the following features should the security team prioritize FIRST?
- ALow FAR
- BLow efficacy
- CLow FRR
- DLow CER
Information
- Description
- Tests Computer Studies Quiz on SEC+ 601 Practice Exam, created by Skyler Rogers on 27/07/2022.
- Author
- Skyler Rogers
- Language
- English
- Views
- 12
- History
- Created on 27 Jul 2022 · updated on 30 Apr 2025
- Tags
- Rating
- No ratings yet Rate this quiz