601 Security+ Missed

What are the characteristic features of the Personal Information Exchange (PFX) and P12 digital certificate format? (Select 3 answers) .pfx and .p12 file extensions Generally used for Microsoft windows servers Encoded in text (ASCII Base64) format .pem, .crt, .cer and .key file extensions Encoded in binary format Generally used for Apache servers or similar configurations

.pfx and .p12 file extensions Generally used for Microsoft windows servers Encoded in binary format

Which of the following answers refers to a filename extension used in a cross-platform, general-purpose programming language? .bat .py .ps1 .vbs

.py

A strong password that meets the password complexity requirement should contain: (Select the best answer) Uppercase letters (A-Z) Digits (0-9) Non-alphanumeric characters if permitted (e.g. !, @, #, $) Lowercase letters (a-z) A combination of characters from at least 3 character groups

A combination of characters from at least 3 character groups

A rule-based access control mechanism implemented on routers, switches, and firewalls is called: ACL CSR DLP AUP

ACL

Which of the algorithms below does not fall into the category of asymmetric encryption? RSA GPG DSA AES DHE ECDHE PGP

AES

Which of the cryptographic algorithms listed below is the least vulnerable to attaccks? AES DES RC4 3DES

AES

For the purpose of encryption, WiFi Protected Access 3 (WPA3) takes advantage of: (Select 2 answers) AES-GCMP PSK TKIP with RC4 RC4 AES-CCMP SAE

AES-GCMP, AES-CCMP

Which part of the IPsec protocol suite provides authentication and integrity? CRC AH SIEM AES

AH

Which of the following terms refers to a US government initiative for real-time sharing of cyber threat indicators? NVD AIS TTP CVSS

AIS

Which of the acronyms listed below refers to a risk assessment formula defining probable financial loss due to a risk over a one-year period? ARO SLE ALE SLA

ALE

Which of the following answers refers to the correct formula for calculating probable financial loss due to a risk over a one-year period? SLE = AV x EF ALE = ARO x SLE SLE = ALE x AV SLE = AV x EF

ALE = ARO x SLE

Which of hte following enables the exchange of information between computer programs?

API

An estimate based on the historical data of how often a threat would be successful in exploiting a vulnerability is known as: ALE SLA ARO SLE

ARO

In quantitative risk assessment, this term is used for estimating the likelihood of occurrence of a future threat ALE SLA ARO SLE

ARO

An attacker managed to associate his/her MAC address with the IP address of the default gateway. In result, a targeted host is sending network traffic to the attacker's IP address instead of the IP address of the default gateway. Based on the given info, which type of attack is taking place in this scenario? ARP poisoning Replay attack Cross-site request forgery DNS poisoning

ARP poisoning

A type of document stipulating rules of behavior to be followed by users of computers, networks, and associated resources is referred to as: SLA EULA AUP BPA

AUP

What is the PKI role of Registration Authority (RA)? (Select 2 answers) Accepting requests for digital certificates Validating digital certificates Authenticating the entity making the request Providing backup source for cryptographic keys Issuing digital certificates

Accepting requests for digital certificates, Authenticating the entity making the request

Which of the following answers refer to the Rule-Based Access Control (RBAC) model? (Select 2 answers) Access to resources granted or denied depending on Access Control List (ACL) entries Every object has an owner who at his/her own discretion determines what kind of permissions other users can have to that object Implemented in network devices such as firewalls to control inbound and outbound traffic based on filtering rules Every resource has a sensitivity label matching a clearance level assigned to a user, labels and clearance levels can only be applied and changed by an administrator An access control method based on user identity

Access to resources granted or denied depending on Access Control List (ACL) entries, Implemented in network devices such as firewalls to control inbound and outbound traffic based on filtering rules

Which of the physical security control types listed below provides isolation from external computer networks? Air gap Network segmentation Hardware firewall Protected cable distribution

Air gap

Restoring data from an incremental backup requires: (Select 2 answers) Copy of the last incremental backup All copies of differential backups made since the last full backup Copy of the last differential backup All copies of incremental backups made since the last full backup Copy of the last full backup

All copies of incremental backups made since the last full backup Copy of the last full backup

Which of the answers listed below refer to examples of PKI trust models? Single CA model Hierarchical model (root CA + Intermediate CAs) Mesh model (cross-certifying CAs) Web of trust model (all CAs act as root CAs) Client-server mutual authentication model All of the above

All of the above

Which of the following answers can be used to describe the category of managerial security controls? (Select 3 answers) Also known as administrative controls Sometimes referred to as logical security controls Focused on managing risk Executed by computer systems (instead of people) Documented in written policies Focused on the day-to-day procedures of an organization

Also known as administrative controls, Focused on managing risk, Documented in written policies

Which of the following statements can be used to describe the characteristics of an on-path attack? (Select all that apply) An on-path attack is also known as MITM attack In an on-path attack, attackers place themselves on the communication route between two devices In an on-path attack, attackers intercept or modify packets sent between two communicating devices In an on-path attack, attackers do not have access to packets exchanged during the communication between two devices In an on-path attack, attackers generate forged packets and inject them in the network

An on-path attack is also known as MITM attack, In an on-path attack, attackers place themselves on the communication route between two devices, In an on-path attack, attackers intercept or modify packets sent between two communicating devices

The term "Rooting" refers to the capability of gaining administrative access to the operating system and system applications on: Android devices iOS devices Microsoft devices All type of mobile devices

Android devices

What are the characteristics features of Elliptic Curve Cryptography (ECC)? (Select 3 answers) Asymmetric encryption Low processing power requirements Suitable for small wireless devices High processing power requirements Symmetric encryption Not suitable for small wireless devices

Asymmetric encryption, Low processing power requirements, Suitable for small wireless devices

Which of the following answers refers to an open-source forensics platform that allows to examine the contents of a hard drive or mobile device and recover evidene from it? Memdump FTK imager Autopsy Metasploit

Autopsy

Which of the following answers refers to a key document governing the relationship between two business organizations? ISA ALE SLA BPA

BPA

Which of the following answers refers to an STP frame? MTU Jumbo frame BPDU Magic packet

BPDU

Which of the following answers refer to compensating security controls? (Select all that apply) Backup power system Sandboxing Temporary port blocking Fire suppression system Security audits Temporary service disablement

Backup power system, Sandboxing, temporary port blocking, temporary service disablement

Which of the following terms is used to describe a text message containing system information details displayed after connecting to a service on a server?

Banner

The practice of connecting to an open port on a remote host to gather more information about its configuration is known as

Banner grabbing

Which of the following answers describes the features of TOTP? (Select 3 answers) Vulnerable to replay attacks Based on a cryptographic hash function and a secret cryptographic key Valid for multiple login sessions Based on a shared secret key and current time Not vulnerable to replay attacks Valid for only one login session

Based on a shared secret key and current time, Not vulnerable to replay attacks, valid for only one login session

Which cryptographic attack relies on the concepts of probability theory? KPA Brute-force Dictionary Birthday

Birthday

Which of the following terms best describes threat actors whose sole intent behind breaking into a computer system or network is monetary gain? State actors Black hat hackers Criminal syndicates Advanced Persistent Threat (APT)

Black hat hackers

Gaining unauthorized access to a Bluetooth device is referred to as:

Bluesnarfing

What is the function of a C2 server?

Botnet control

A situation in which an application writes to an area of memory it is not supposed ot have access to is referred to as:

Buffer overflow

Penetration testing: (Select all that apply) Bypasses security controls Only identifies lack of security controls Actively tests security controls Exploits vulnerabilities Passively tests security controls

Bypasses security controls, Actively tests security controls, Exploits vulnerabilities

A type of trusted third party that issues digital certificates used for creating digital signatures and public private key pairs is known as: RA IKE CA CSP

CA

Which of the following answers refers to a security policy enforcement software tool or service placed between cloud service users and cloud applications? UTM CASB NGFW DMVPN

CASB

Which of the following answers refers to a cybersecurity control framework for cloud computing? CCM CSA CSF CIS

CCM

Which of the following answers refers to a nonprofit organization focused on developing globally-recognized best practices for securing IT systems and data against cyberattacks? CIS RMF CSA SSAE

CIS

Which of the following answers refers to a U.S. government initiative that provides the details on how to ensure continued performance of essential functions during unexpected events? SLA COOP RPO COPE

COOP

In which of the mobile device deployment models employees can use corporate-owned devices both for work-related tasks and personal use? BYOD COPE VDI CYOD

COPE

Which of the following solutions allow to check whether a digital certificate has been revoked? (Select 2 answers) CIRT CRL OSCP CSR Key escrow

CRL, OSCP

Which of the answers listed below refers to a method for requesting a digital certificate? CBC CSR CFB CRL

CSR

Which of the following answers refer to vulnerability databases? (Select 2 answers) DBA CVE DBaaS NVD AIS

CVE, NVD

An industry standard for assessing the seveirty of computer system security vulnerabilities is known as: SIEM CVSS OSINT SOAR

CVSS

A mobile device deployment model in which employees select devices for work-related tasks from a company-approved device list is known as: VDI CYOD BYOD COPE

CYOD

Which of the following provides physical security measure against laptop theft? Cable lock Trusted Platform Module Geotracking LoJack for Laptops

Cable lock

Which memory type provides a CPU with the fastest access to frequently used data? Secondary storage Flash memory DRAM Cache memory

Cache memory

Which of the following answers refers to an example order of volatility for a typical computer system? Cache memory -> RAM -> Disk files -> Temporary files -> Swap/Pagefile -> Archival media Archival media -> Disk files -> Temporary files -> Swap/Pagefile -> RAM -> Cache memory Cache memory -> RAM -> Swap/Pagefile -> Temporary files -> Disk files -> Archival media Temporary files -> RAM -> Cache memory -> Swap/Pagefile -> Archival media -> Disk files

Cache memory -> RAM -> Swap/Pagefile -> Temporary files -> Disk files -> Archival media

Which of the following answers refers to a security solution that allows administrators to block network access for users until they perform required action? Honeypot Quarantine network Captive portal FIrewall

Captive portal

What is the function of the Linux chmod command? Changes file/directory access permissions Moves or renames files Changes file owner and group permissions COmpares the contents of two files or sets of files

Changes file/directory access permissions

Which of the following terms illustrate the security through obscurity concept? (Select all that apply) Code obfuscation Steganography SSID broadcast suppression Encryption

Code obfuscation, Steganography, SSID broadcast suppression

What is STIX?

Common language for describing cyber/threat information

Which of the following terms best describes threat actors that engage in illegal activities to get the know-how and gain market advantage? Insiders Nation states /APTs Criminal syndicates Competitors

Competitors

Which of the following examples fall into the category of operational security controls? (Select 3 answers) Configuration management Data backups Authentication protocols Awareness programs Vulnerability assessments

Configuration management, Data backups, Awareness programs

Which functionality allows a DLP system to fulfill its role? Biometrics Environmental monitoring Content inspection Loop protection

Content inspection

Which of the following terms refers to a modified mobile device equipped with software features that were not originally designed by the device manufacturer? Jailbreaking Custom firmware Rooting Sideloading

Custom firmware

A network protocol providing an alternative solution to the manual allocation of IP addresses is called: DNS SNMP DAT DHCP

DHCP

A security feature of a network switch that provides countermeasures against rogue DHCP servers is called: DHCP scope DHCP reservation DHCP snooping DHCP relay agent

DHCP snooping

A collection of precompiled functions designed to be used by more than one Microsoft Windows application simultaneously to save system resources is known as

DLL

Which of the following describes an application attack that relies on executing a library of code? Memory leak DLL injection Pointer dereference Buffer overflow

DLL injection

A software or hardware-based security solution designed to detect and prevent unauthorized use and transmission of confidential information outside of the corporate network (data exfiltration) is known as: DEP RADIUS DLP PGP

DLP

Which of the following would prevent using a mobile device for data exfiltration via cable connection? DLP Full device encryption Screen locks COPE

DLP

Remapping a domain name to a rogue IP address is an example of what kind of exploit? DNS poisoning Domain hijacking ARP poisoning URL hijacking

DNS poisoning

A suite of security extensions for an internet service that translates domain names into IP addresses is known as: EDNS DNSSEC Split DNS DDNS

DNSSEC

Replacing password characters in a password field with a series of asterisks is an example of Data masking Tokenization Anonymization Pseudo-anonymization

Data masking

A type of redundant source code producing an output not used anywhere in the application is commonly referred to as Inline code Dead code Code bloat Duplicate code

Dead code

A wireless disassociation attack is a type of: (Select 2 answers) Cryptographic attack Downgrade attack Deauthentication attack Brute-force attack Denial-of-Service (DoS) attack

Deauthentication attack, Denial-of-Service (DoS) attack

Netstat is a command-line utility used for: (Select 2 answers) Displaying active TCP/IP connections Testing the reachability of a remote host Displaying intermediary points on the packet route Viewing the TCP/IP configuration details Displaying network protocol statistics

Displaying active TCP/IP connections, Displaying network protocol statistics

Which of the following factors has the biggest impact on domain reputation? Domain age Missing SSL certificate Derivative content Bounce rate Distribution of spam

Distribution of spam

What are the characteristic features of a transparent proxy? (Select all that apply) Doesn't require client-side configuration Modifies client's requests and responses Redirects client's requests and responses without modifying them Clients might be unaware of the proxy service Requires client-side configuration

Doesn't require client-side configuration, Redirects client's requests and responses without modifying them, Clients might be unaware of the proxy service

SSL stripping is an example of: (Select 2 answers) Brute-force attack Downgrade attack Watering hole attack On-path attack Denial-of-Service (DOS) attack

Downgrade attack, On-path attack

Which of the following would add power redundancy on a server box? Standby UPS Backup generator Managed PDU Dual-power supply

Dual-power supply

The process of searching, collecting, and securing electronic data with the intent of using it in a legal proceeding or investigation is known as: OSINT E-discovery White-hat hacking Active reconnaissance

E-discovery

Which cryptographic solution would be best suited for low-power devices? ECC EFS SED FDE

ECC

Which of the following answers refers to an endpoint security solution that provides the capability for detection, analysis, response, and real-time monitoring of cyber threats? SWG CASB EDR NGFW

EDR

Which of the terms listed below refer to a product/service that no longer receives continuing support? (Select 2 answers) ETL SDLC EOL EOF ERP EOSL

EOL, EOSL

Which part of IPsec provides authentication, integrity, and confidentiality? AES SHA AH ESP

ESP

POP3 is used for: Name resolution Sending email messages File exchange Email retrieval

Email retrieval

What are the characteristic features of the Distinguished Encoding Rules (DER) digital certificate format? (Select 3 answers) Encoded in binary format Generally used for Microsoft windows servers .der and .cer file extensions Encoded in text (ASCII Base64) format Generally used for Java servers .perm, .crt, .cer and .key file extensions

Encoded in binary format, .der and .cer file extensions, Generally used for Java servers

Which of the following answers refer to the Privacy Enhanced Email (PEM) digital certificate format? (Select 3 answers) Encoded in binary format .pfx and .p12 file extensions Generally used for Java servers Encoded in text (ASCII Base64) format .pem, .crt, .cer and .key file extensions Generally used for Apache servers or similar configurations

Encoded in text (ASCII Base64) .pem, .crt, .cer and .key file extensions Generally used for Apache servers or similar configurations

Which of the following terms applies to the concept of confidentiality? Hashing Encryption Security through obscurity MFS Digital certificate

Encryption

Which of the answers listed below refer to examples of technical security controls? (Select 3 answers) Security audits Encryption protocols Organizational security policy Configuration management Firewall ACLs Authentication protocols

Encryption protocols, Firewall ACLs, Authentication protocols

What are the characteristics of TACACS+? (Select 3 answers) Encrypts only the password in the access-request packet Combines authentication and authorization Encrypts the entire payload of the access-request packet Primarily used for device administration Separates authentication and authorization Primarily used for network access

Encrypts the entire payload of the access-request packet Primarily used for device administration Separates authentication and authorization

Which of the following answers can be used to describe characteristics of a cross-site scripting attack? (Select 3 answers) Exploits the trust a user's web browser has in a website A malicious script is injected into a trusted website User's browser executes attacker's script Exploits the trust a website has in the user's web browser A user is tricked by an attacker into submitting unauthorized web requests Website executes attacker's requests

Exploits the trust a user's web browser has in a website, A malicious script is injected into a trusted website, User's browser executes attacker's script

Which of the following answers can be used to describe characteristics of a cross-site request forgery attack? (Select 3 answers) Exploits the trust a website has in the user's web browser A user is tricked by an attacker into submitting unauthorized web requests Website executes attacker's requests Exploits the trust a user's web browser has in a website A malicious script is injected into a trusted website User's browser executes attacker's script

Exploits the trust a website has in the user's web browser, A user is tricked by an attacker into submitting unauthorized web requests, Website executes attacker's requests

Which of the following answers refers to a rule-based access control mechanism associated with files and/or directories? EFS FACL FIM NTFS

FACL

A software technology designed to provide confidentiality for an entire data storage device is known as: AES FDE EFS HSM

FDE

A measure of the likelihood that a biometric security system will incorrectly reject an access attempt by an authorized user is referred to as: FAR CER CRC FRR

FRR

Which of the following answers refers to a tool for creating forensic images of computer data? diskpart FTK Imager fsutil Autopsy

FTK Imager

Which of the following protocols allow(s) for secure file transfer? (Select all that apply) FTPS TFTP FTP SFTP

FTPS, SFTP

A dynamic code analysis allows for detecting application flaws without the need for actual execution of the application code

False

A situation where a cryptographic hash function produces two different digests for the same data input is referred to as a hash collision.

False

Code obfuscation techniques rely on encryption to protect the source code against unauthorized access

False

Examples of techniques used for encrypting information include symmetric encryption (also called public-key encryption) and asymmetric encryption (also called secret-key encryption, or session-key encryption)

False

FTPS is an extension to the Secure Shell (SSH) protocol and runs by default on port number 22.

False

High MTBF value indicates that a component or system provides low reliability and is more likely to fail.

False

In a differential backup strategy, restoring data from backup requires only a working copy of the last full backup.

False

In cybersecurity exercises, purple team combines the roles of all other teams (i.e. red, blue, and white)

False

In penetration testing, passive reconnaissance relies on gathering information on the targeted system with the use of various non-invasive software tools and techniques, such as pinging, port scanning, or OS fingerprinting

False

In the context of IT security, the term "Data minimization" refers to the process of removing all unnecessary characters from the source code to make it less intelligible for humans and faster to process by machines:

False

Secure File Transfer Protocol (SFTP) is an extension to the FTP protocol that adds support for the Transport Layer Security (TLS) and the Secure Sockets Layer (SSL) cryptographic protocols

False

Stateless inspection is a firewall technology that keeps track of the state of network connections and based on that data determines which network packets to allow through the firewall.

False

The term "DHCP snooping" refers to an exploit that enables operation of a rogue DHCP network server.

False

The term "Non-repudiation" describes the inability to deny responsibility for performing a specific action. In the context of data security, non-repudiation ensures data confidentiality, provides the proof of data integrity, and proof of data origin.

False

The term "Static code analysis" refers to the process of discovering application run-time errors

False

An authentication subsystem in which a single set of authentication credentials provides access to multiple systems across different organizations is called AAA framework Multi-factor authentication Group-based access control Federation

Federation

Which type of malware resides only in RAM? Rootkit Fileless virus Backdoor Logic bomb

Fileless virus

Which of the following answers can be used to describe the category of operational security controls (Select 3 answers) Also known as administrative controls Focused on the day-to-day procedures of an organization Executed by computer systems (instead of people) Used to ensure that the equipment continues to work as specified Focused on managing risk Primarily implemented and executed by people (as opposed to systems)

Focused on the day-to-day procedures of an organization, Used to ensure that the equipment continues to work as specified, Primarily implemented and executed by people (as opposed to systems)

Which of the following passwords is the moste complex? T$7C52WL4SU GdL3tU8wxYz @TxBL$nW@Xt G$L3tU8wY@z

G$L3tU8wY@z

Which of the block cipher modes listed below provides both data integrity and confidentiality? CBC GCM ECB CTR

GCM

Which of the following regulates personal data privacy of the European Union (EU) citizens? PHI HIPAA PCI DSS GDPR

GDPR

A mobile device's built-in functionality enabling the usage of locator applications is called: WPS GSM IMEI GPS

GPS

A person who breaks into a computer network or system for a politically or socially motivated purpose is usually described as a(n) Insider Gray hat hacker Hacktivist State actor

Hacktivist

Example of MFA attributes include (Select all that apply) USB token Retina scan Handwritten signature Gait analysis GPS reading PIN Chain of trust

Handwritten signature Gait analysis GPS reading Chain of trust

Which firewall would provide the best protection for an ingress / egress point of a corporate network? (Select 2 answers) Hardware firewall Network-based firewall Software firewall Host-based firewall

Hardware firewall Network-based firewall

Which of the following refers to the contents of a rainbow table entry? Hash/Password IP address/Domain name Username/Password Account name/Hash

Hash/Password

Which of the following terms applies to the concept of data integrity? MFA Digital certificate Hashing Security through obscurity Encryption

Hashing

Which of the following can be used to validate the origin (provenance) of digital evidence? (Select 2 answers) Hashing Tokenization Salting Metadata examination Checksums

Hashing, Checksums

An administrator needs to adjust the placement of multiple Access Points (APs) to ensure the best wireless signal coverage for the network. Which of the following would be of help while identifying areas of low signal strength? Heat map Power level controls Logical network diagram WiFi hotspots

Heat map

A NIDS/NIPS that detects intrusions by comparing network traffic against the previously established baseline can be classified as: (Select all that apply) Heuristic Anomaly-based Behavioral Signature-based

Heuristic Anomaly-based Behavioral

Which of the following enables processing data in an encrypted form? Diffusion Homomorphic encryption Obfuscation Hashing

Homomorphic encryption

Which of the following is a common firewall type used for protecting a single computer? (Select 2 answers) Host-based firewall Software firewall Network-based firewall Hardware firewall

Host-based firewall, Software firewall

Which of the following examples do not fall into the category of physical security controls (Select 3 answers) Lighting Warning signs Sensors IDS/IPS Security cameras Alarms Encryption protocols Fences/bollards/barricades Security guards Firewall ACLs Access control vestibules Door locks / cable locks

IDS/IPS, Encryption protcols, Firewall ACLs

Which of the following answers refers to an IEEE standard that can be implemented in a situation where an Ethernet switch acts as an authenticator for devices that intend to connect to a network through one of its ports? IEEE 802.1X IEEE 802.11ac IEEE 802.111D IEEE 802.11x

IEEE 802.1X

An IETF specification that defines how IP flow information is to be formatted and transferred from an exporter to a collector is called: NetFlow IPFIX sFlow NXLog

IPFIX

Which of the answers listed below refer to examples of corrective security controls? (Select all that apply) IPS Security guards Backups and system recovery Log monitoring Alternate site Fire suppression system

IPS, backups and system recovery, Alternate site, Fire suppression system

Examples of protocols used for implementing secure VPN tunnels include: (Select all that apply) bcrypt IPsec SRTP TLS L2TP

IPsec, TLS, L2TP

Which of the answers listed below refers to a short distance, line-of-sight technology used for example in home remote controls? NFC Bluetooth IR Zigbee

IR

Which of the following terms refers to a group of experts designated to handle a natural disaster or an interruption of business operations? IETF CSIRT IRT IRTF

IRT

Which of the following answers refers to an ISO/IEC standard providing code of practice for information security controls? ISO/IEC 27001 ISO/IEC 27002 ISO/IEC 27701 ISO/IEC 27701

ISO/IEC 27002

An extension to the ISO/IEC 27001 standard that focuses on privacy data management is called: ISO/IEC 27002 ISO/IEC 27701 ISO/IEC 27702 ISO/IEC 31000

ISO/IEC 27702

Which of the following answers refers to a family of standards providing principles and guidelines for risk management? ISO/IEC 27001 ISO/IEC 27002 ISO/IEC 27701 ISO/IEC 31000

ISO/IEC 31000

Which of the following answers refers to a cloud computing service model in which clients, instead of buying all the hardware and software, purchase computing resources as an outsourced service from suppliers who own and maintain all the necessary equipment and software? SaaS XaaS PaaS IaaS

IaaS

Which of the following answers refers to a trusted third-party service for validating user identity in a federated identity system? RA IdP CA Kerberos

IdP

Which of the following statements are not true? (Select 2 answers) Risk awareness is the acknowledgement of risk existence Control risk is the risk caused by improper implementation of security controls Risk appetite is the amount of risk an organization is willing to take in pursuit of its goals Inherent risk is the remaining risk after implementing controls Residual risk is the original level of risk that exist before implementing any controls

Inherent risk is the remaining risk after implementing controls, Residual risk is the original level of risk that exist before implementing any controls

Which programming aspects are critical for secure application development process? (Select 2 answers) Patch management Input validation Password protection Error and exception handling Application whitelisting

Input invalidation, Error and exception handling

Digital signatures provide: (Select 3 answers) Integrity Authentication Confidentiality Authorization Non-repudiation Accounting

Integrity, Authentication, Non-repudiation

A type of forensic evidence that can be used to detect unauthorized access attempts to other malicious activities is called: CVE IoC AIS OSINT

IoC

A type of hardened server used as a secure gateway for remote administration of devices placed in a different security zone is known as: C2 server Jump server UC server Proxy server

Jump server

Which of the following servers would be best suited to act as an intermediary between an intranet and a screened subnet? UC server Proxy server C2 server Jump server

Jump server

During a password reminder procedure the system asks security question that covers personal details that should be known only to the user (e.g. user's favorite holiday destination). This type of authentication method is an example of SAE KBA IdP PII

KBA

Which of the following are examples of hardware authentication tokens? (Select 3 answers) Key fob Cable lock Passphrase Biometric reader RFID badge Smart card

Key fob, RFID badge, Smart card

Which of the following answers refers to the concept of non-persistence? (Select 3 answers) Last known-good configuration System image Live boot media Journaling Known state reversion

Last known-good configuration, Live boot media, Known state reversion

Which of the answers listed below refers to a type of removable storage media that contains a portable, non-persistent OS?

Live boot media

Which of the following answers refer to examples of detective security controls (Select all that apply) Lighting Log monitoring Sandboxing Security audits CCTV IDS

Log monitoring, Security audits, CCTV, IDS

Which of the following fall(s) into the category of Layer 2 attacks? (Select all that apply) MAC cloning ARP poisoning MAC flooding DNS poisoning MAC spoofing

MAC cloning ARP poisoning MAC flooding MAC spoofing

Which of the following answers refers to a dedicated mobile app management software? UEM MAM RCS MDM

MAM

Which of the following terms applies to the authentication process? Digital certificate MFA Encryption Security through obscurity Hashing

MFA

Which of the following answers refer to an office equipment that combines the functionality of multiple devices (Select 2 answers) MFD IoT MFP PED MFA

MFD, MFP

A globally accessible knowledge base of Adversary Tactics, Techniques, and Procedures (TTPs) based on observations from real-world attacks is known as MITRE ATT&CK The Diamond Model of Intrusion Analysis Cyber Kill Chain

MITRE ATT&CK

Which of the following answers refer to a general document established between two or more parties to define their respective responsibilities and expectations in accomplishing a particular goal or mission? (Select 2 answers) SLA MOU SOW MOA ISA

MOU, MOA

A type of agreement that specifies generic terms to simplify the negotiation of future contracts between the signing parties is called: MOU SLA MSA SOW

MSA

Which of the following would be the best solution for a company that needs IT services that lacks any IT personnel? MSA MaaS MSP MSSP

MSP

Which of the following terms refers to a third-party vendor offering IT security management services? (Select best answer) MSP MaaS MSA MSSP

MSSP

Which of the following terms is used to describe an average time required to repair a failed component or device? MTBF RPO MTTR SLA

MTTR

Which of the following answers refers to a sequential-access backup media? Magnetic tapes Disk drives Optical discs Flash media

Magnetic tapes

Which of the following forensic utilities enables the extraction of RAM contents? Memdump Wirehex FTK Imager Autopsy

Memdump

A nontransparent proxy: (Select 2 answers) Modifies client's requests and responses Doesn't require client-side configuration Requires client-side configuration Redirects client's requests and responses without modifying them

Modifies client's requests and responses, Requires client-side configuration

A solution that alleviates the problem of depleting IPv4 address space by allowing multiple hosts on the same private LAN to share a single public IP address is known as: DNS APIPA NAT DHCP

NAT

A very short-range communication method where a wireless signal is sent between two devices that are touching or nearly touching each other is a characteristic feature of: RFID NFC Infrared(IR) Bluetooth

NFC

What is the name of a technology used for contactless payment transactions? NFC SDN PED WAP

NFC

Which of the following answers refers to a firewall type that improves upon first- and second- generation firewalls by offering additional features, such as more in-depth inspection of network traffic and application-level inspection? IDS Packet filter NGFW Stateful firewall

NGFW

The process of combining multiple physical network adapters into a single logical interface for increased throughput and redundancy is called: Device pairing Multipath I/O Route aggregation NIC teaming

NIC teaming

Which protocol ensures the reliability of the Kerberos authentication process? EAP NTP IPsec RTP

NTP

Which of the following is a cross-platform log-managing tool? Netflow rsyslog NXLog sFlow syslog-ng

NXLog

Which of the following tools offers the functionality of a configuration compliance scanner? Zenmap Roo Nessus DBAN

Nessus

Which of the following is a Cisco-designed IP traffic collection method that by default does not offer packet sampling? IPFIX NetFlow NXLog sFlow

NetFlow

Which of the following answers refer(s) to wireless threat vector(s)? (Select all that apply) Network protocol vulnerabilities (WEP/WPA) Rogue AP/ Evil twin Default security configurations Malicious email attachments Vulnerabilities in network security standards (WPS)

Network protocol vulnerabilities (WEP/WPA), Rogue AP / Evil twin, Default security configurations, Vulnerabilties in network security standards (WPS)

What is the most common form of a DDoS attack?

Network-based

In a round-robin load balancing method, each consecutive request is handled by: (Select best answer) FIrst server in a cluster Next server in a cluster Least utilized server in a cluster Last server in a cluster

Next server in a cluster

What is the fastest way for checking the validity of a digital certificate? CRL Key escrow OSCP CSR

OSCP

Which type of DDoS attack targets industrial equipment and infrastructure? IoT ATT&CK OT IoC

OT

Mobile device updates delivered over a wireless connection are known as: WAP UAV OTA RAS

OTA

Which technology enables establishing direct communication links between two USB devices? VDE GRE OTG DHE

OTG

Which of the following answers refer to IMAP? (Select 2 answers) Offers improved functionality in comparison to POP3 Serves the same function as POP3 Enables sending email messages from client devices Offers less functions than POP3 Enables email exchange between mail servers

Offers improved functionality in comparison to POP3, Serves the same function as POP3

Which of the following answers refers to a common antenna type used as a standard equipment on most Access Points (APs) for indoor Wireless Local Area Network (WLAN) deployments? Omnidirectional antenna Dish antenna Unidirectional antenna Yagi antenna

Omnidirectional antenna

Which wireless antenna type provides a 360-degree horizontal signal coverage? Dish antenna Unidirectional antenna Yagi antenna Omnidirectional antenna

Omnidirectional antenna

A security solution that provides control over elevated (i.e. administrative type) accounts is known as: MAC PAM ICS FACL

PAM

Which of the following answers refers to a solution designed to strengthen the security of session keys? ECB PFS EFS PFX

PFS

The US Health Insurance Portability and Accountability Act (HIPAA) provides privacy protection for: (Select best answer) PII ESN PHI PIV

PHI

Which of the following acronyms refers to any type of information pertaining to an individual that can be used to uniquely identify that person? PHI Biometrics PII PKI

PII

Which of the following fall into the category of MFA factors? (Select 3 answers) GPS reading Handwritten signature PIN Chain of trust USB token Gait analysis Retina scan

PIN, USB token, Retina scan

Which of the following answers refers to a hierarchical system for the creation, management, storage, distribution, and revocation of digital certificates? Web of trust PKI IaaS CA

PKI

Which of the following answers refers to a deprecated method for implementing Virtual Private Networks (VPNs)? GRE PPTP OpenVPN SSTP

PPTP

Which of the following acronyms refers to a client authorization method used in WPA2 Personal mode? AES RC4 IKE PSK SAE

PSK

Which cloud service model would provide the best solution for a web developer intending to create a web app? XaaS SaaS PaaS IaaS

PaaS

Which of the following can be used as an extension of RAM? (Select 2 answers) Pagefile Extended partition Swap partition Primary storage Archive file

Pagefile, Swap partition

A security administrator configured a NIDS to receive traffic from network switch via port mirroring. Which of the following terms can be used to describe the operation mode of the NIDS? (Select 2 answers) In-band Passive Inline Out-of-band

Passive, Out-of-band

URL redirection is a characteristic feature of: Pharming Directory traversal attacks On-path attacks Typosquatting

Pharming

Which of the following answers refer(s) to the characteristic feature(s) of Faraday cage? (Select all that apply) Physical security control type Provides protection against RFI Technical security control type Provides protection against EMI Administrative security control type

Physical security control type, Provides protection against RFI, provides protection against EMI

Which of the following allows an administrator to inspect traffic passing through a network switch? VLAN tagging Port mirroring Fault-tolerant mode Port scanner

Port mirroring

802.1X is an IEEE standard for implementing: VLAN tagging Token ring networks Port-based NAC Wireless networks

Port-based NAC

According to predictions, the most future-proof cryptographic solution should be: Quantum cryptography Symmetric-key cryptography Post-quantum cryptography Asymmetric-key cryptography Public-key cryptography

Post-quantum cryptography

Which of the following is used in data URL phishing? Prepending Typosquatting Pretexting Domain hijacking

Prepending (prepending refers to when an attacker prepends, or attaches, a trustworthy value like "RE:" or "MAILSAFE: PASSED" to a message in order to make the message appear more trustworthy. You would do URL phishing in an email or some form of communication. Typosquatting refers to registering slightly misspelled domains of company url's, pretexting is a social engineering technique that abuses a user's trust in a familiar situation, and domain hijacking is when registration of a domain name is transferred away from the rightful owner)

What are the characteristic features of RADIUS? (Select 3 answers) Primarily used for network access Encrypts the entire payload of the access-request packet Combines authentication and authorization Encrypts only the password in the access-request packet Primarily used for device administration Separates authentication and authorization

Primarily used for network access Combines authentication and authorization Encrypts only the password in the access-request packet

A type of contactless smart card that can be read at a close range from a reader device is commonly referred to as: MicroSD card Common Access Card (CAC) Proximity card Personal Identity Verification (PIV) card

Proximity card

What type of preventive physical access controls would provide a basic means for securing a door access? (Select 2 answers) Air gap Proximity card reader CCTV Industrial camouflage Smart card reader

Proximity card reader, Smart card reader

What is the name of a cloud computing deployment model in which the cloud infrastructure is provisioned for open use by the general public? Hybrid cloud Private cloud Community cloud Public cloud

Public cloud

Assessment of risk probability and its impact based on subjective judgement falls into the category of: Risk acceptance Quantitative risk assessment Risk transference Qualitative risk assessment

Qualitative risk assessment

Which of the following solutions is used for controlling network resources and assigning priority to different types of traffic? Measured service Acceptable Use Policy (AUP) Fair access policy Quality of Service (QoS)

Quality of Service (QoS)

A calculation of the Single Loss Expectancy (SLE) is an example of: Quantitative risk assessment Risk deterrence Qualitative risk assessment Risk acceptance

Quantitative risk assessment

Which of the following RAID levels does not offer fault tolerance?

RAID 0

Which of the solutions listed below add(s) redundancy in areas identified as single points of failure (Select all that apply) RAID Dual-power supply Virtualization Failover clustering Load balancing

RAID, Dual-power supply, Fallover clustering, Load balancing

Which type of Trojan enables unauthorized remote access to a compromised system? pcap RAT MaaS pfSense

RAT

Group-based access control in MS Windows environments is an example of: RBAC DAC ABAC MAC

RBAC

Which of the following answers refers to a technology designated as a successor to SMS and MMS? RCS S/MIME IM CMS

RCS

Which of the following answers refer(s) to (an) example(s) of physical authentication token(s)? (Select all that apply) RFID badge Password key Password vault Key fob Smart card

RFID badge, Password key, Key fob, Smart card

A mandatory IT security and risk management framework for U.S. federal government developed by NIST is known as: SSAE CSF RMF CSA

RMF

Which of the algorithms listed below does not belong to the category of symmetric ciphers? RC4 DES RSA AES BLowfish 3DES Twofish

RSA

Which of the acronyms listed below refers to a maximum tolerable period of time required for restoring business functions after a failure or disaster? SLA RTO AUP RPO

RTO

A type of OS characterized by low delay between the execution of tasks required in specific applications such as in military missile guidance systems or in automotive braking systems, is known: UNIX Windows NT POSIX RTOS

RTOS

A malfunction in a preprogrammed sequential access to a shared resource is described as:

Race condition

Examples of embedded systems include: (Select all that apply) Android OS Raspberry PI iOS Arduino Field Programmable Gate Array (FPGA) Mainframe computer system

Raspberry Pi, Arduino, Field Programmable Gate Array (FPGA)

The practice of modifying an application's code without changing its external behavior is referred to as:

Refactoring

Which of the following terms refer to software/hardware driver manipulation techniques (Select 2 answers) Prepending Fuzz testing Refactoring Shimming Sideloading

Refactoring, Shimming

Which VPN type is used for connecting computers to a network? (Select all that apply) Remote access Intranet-based Client-to-site Site-to-site Extranet-based

Remote access, Client-to-site

Hardware RAID Level 0: (Select all that apply) Requires a minimum of 2 drives to implement Is also known as disk striping Decreases reliability (failure of any disk in the array destroys the entire array) Is also referred to as disk mirroring Offers less volume capacity in comparison to RAID 1 Requires at least 3 drives to implement Is suitable for systems where performance has higher priority than fault tolerance Offers improved reliability by creating identical data sets on each drive (failure of one drive does not destroy the array as each drive contains identical copy of the data)

Requires a minimum of 2 drives to implement Is also known as disk striping Decreases reliability (failure of any disk in the array destroys the entire array)

Hardware RAID Level 10 (a.k.a. RAID 1+0): (Select 3 answers) Requires a minimum of 4 drives to implement Is referred to as stripe of mirrors, i.e. a combination of RAID 1 (disk mirroring) and RAID 0 (disk striping) Requires a minimum of 5 drives to implement Offers increased performance and fault tolerance (failure of one drive in each mirrored pair of disk drives does not destroy the array) Requires a minimum of 3 drives to implement Continues to operate in case of failure of more than 2 drives

Requires a minimum of 4 drives to implement, Is referred to as stripe of mirrors, i.e. a combination of RAID 1 (disk morroring) and RAID 0 (disk striping), Offers increased performance and fault tolerance (failure of one drive in each mirrored pair of disk drives does not destroy the array)

Hardware RAID level 1: (Select 3 answers) Requires at least 2 drives to implement Is also known as disk striping Offers improved performance in comparison to RAID 0 Requires at least 3 drives to implement Offers improved reliability by creating identical data sets on each drive (failure of one drive does not destroy the array as each drive contains identical copy of the data) Is also referred to as disk mirroring

Requires at least 2 drives to implement, Offers improved reliability by creating identical data sets on each drive contains identical copy of the data) Is also referred to as disk mirroring

Hardware RAID Level 5: (Select 2 answers) Requires at least 2 drives to implement Continues to operate in case of failure of more than 1 drive Requires at least 3 drives to implement Offers increased performance and fault tolerance (single drive failure does not destroy the array and lost data can be re-created by the remaining drives) Requires at least 4 drives to implement

Requires at least 3 drives to implement, Offers increased performance and fault tolerance (single drive failure does not destroy the array and lost data can be re-created by the remaining drives)

Which of the following answers refer to an assessment tool used for prioritizing the severity of different risks? (Select 2 answers) Risk register Quantitative risk assessment Risk heat map Disaster Recovery Plan (DRP) Risk matrix

Risk heat map, Risk matrix

Which of the following answers refers to a document containing detailed information on potential cybersecurity risks? Risk register Risk heat map Risk matrix Risk repository

Risk register

Cybersecurity insurance is an example of which risk management strategy? Risk avoidance Risk deterrence Risk transferrence Risk acceptance

Risk transference

A collection of software tools used by a hacker to mask intrusion and obtain administrator-level access to a computer or computer network is known as a:

Rootkit

An access control model in which access to resources is granted or denied depending on the contents of Access Control List (ACL) entries is called: Role-Based Access Control Mandatory Access Control Rule-Based Access Control Lattice-Based Access Control

Rule-Based Access Control

Which of the following acronyms refers to a client authentication method used in WPA3 Personal mode? SAE IKE RC4 PSK AES

SAE

Which of the answers listed below refers to an XML-based markup language for exchanging authentication and authorization data? SAML OpenID Connect Shibboleth OAuth

SAML

Which of the following answers refer to software technologies designed to simplify network infrastructure management? (Select 2 answers) SDP SSP SDV SEH SDN

SDV, SDN

Which of the following answers refers to a data storage device equipped with hardware-level encryption functionality? SSP SEH SDN SED

SED

A security solution designed to detect anomalies in the log and event data collected from multiple network devices is called SNMP PCAP HPS SIEM

SIEM

A correlation engine used for processing various types of log data into an actionable information is a feature of: REST API SIEM dashboard Syslog server SOAR

SIEM dashboard

Which of the following answers refers to a protocol used for managing real-time session that include voice, video, application sharing, or instant messaging services? L2TP BGP RSTP SIP

SIP

An agreement between a service provider and users defining the nature, availability, quality, and scope of the service to be provided is known as: SOW MSA SLA MOU

SLA

Which of the following terms refers to an agreement that specifies performance requirements for a vendor? MSA SLA MOU SOW

SLA

Which term describes the predicted loss of value to an asset based on a single security incident? SLE ARO ALE SLA

SLE

Which of the answers listed below refers to a deprecated TLS-based method for securing SMTP IMAPS STARTTLS POP3S SMTPS

SMTPS

Which version(s) of the SNMP protocol offer(s) authentication based on community strings sent in an unencrypted form? (Select all that apply) SNMPv1 SNMPv2 SNMPv3 SNMPv4

SNMPv1, SNMPv2

Which of the following tools enables automated response to security incidents? NIDS SOAR HIDS SIEM

SOAR

Which protocol enables secure, real-time delivery of audio and video over an IP network? S/MIME RTP SIP SRTP

SRTP

Which type of exploit allows an attacker to take control over a server and use it as a proxy for unauthorized actions?

SSRF

Which of the following answers refers to a deprecated encryption protocol? SSH TLS S/MIME SSL IPsec PGP

SSl

Which of the following protocols provide protection against broadcast storms and switching loops? (Select 2 answers) RPT SRTP RDP STP RSTP

STP, RSTP

A cloud computing service model offering remote access to applications based on monthly or annual subscription fee is called PaaS SaaS IaaS XaaS

SaaS

Which of the following answers to a type of additional input that increases password complexity and provides better protection against brute-force, dictionary, and rainbow table attacks? Seed IV Salt Shim

Salt

Which of the following provide randomization during encryption process? (Select 2 answers) Salting Rainbow tables Obfuscation Initialization Vector (IV) Shimming

Salting Initialization Vector (IV)

What are the countermeasures against VM escape? (Select 2 answers) Group policy Sandboxing User training Patch management Asset documentation

Sandboxing, Patch management

A lightly protected subnet (previously known as a DMZ) consisting of publicly available servers placed on the outside of the company's firewall is called:

Screened subnet

What are the characteristic features of the secure version of IMAP? (Select all that apply) TCP port 143 Secure Sockets Layer (SSL) TCP port 993 Transport Layer Security (TLS) TCP port 995

Secure Sockets Layer (SSL), TCP port 993, Transport Layer Security (TLS)

Which of the following answers refer(s) to POP3S encrypted communication? (Select all that apply) TCP port 993 Secure Sockets Layer (SSL) TCP port 995 Transport Layer Security (TLS) TCP port 110

Secure Sockets Layer (SSL), TCP port 995, Transport Layer Security (TLS)

LDAPS is an example of: Authentication protocol Secure directory access protocol Address resolution protocol File exchange protocol

Secure directory access protocol

What are the examples of preventive security controls? (Select 3 answers) Security guards Fire suppression system System hardening Login banners CCTV Separation of duties

Security guards, System hardening, Separation of duties

Which of the answers listed below refers to a concept of having more than one person required to complete a given task? Job rotation Role-Based Access Control (RBAC) Multitasking Separation of duties

Separation of duties

A type of encryption scheme where the same key is used to encrypt and decrypt data is referred to as: (Select 3 answers) Session-key encryption Public-key encryption Symmetric encryption Asymmetric encryption Secret-key encryption

Session-key encryption Public-key encryption Symmetric encryption Asymmetric encryption Secret-key encryption

Which of the following alters the external behavior of an application and at the same time does not introduce any changes to the application's code? Shimming Refactoring API call Sideloading

Shimming

Allowing "Unknown Sources" in Android Security Settings enables: Rooting Carrier unlocking Sideloading Jailbreaking

Sideloading

Installing mobile apps from websites and app stores other than the official marketplaces is referred to as: Jailbreaking Rooting Sideloading Carrier unlocking

Sideloading

Which of the following answers does not refer to an email communication threat vector? Skimming Malicious attachment Social engineering Malicious URL Phishing

Skimming

Which of the following answers refers to an example implementation of certificate-based authentication? Smart card ID badge PIN code Biometric lock

Smart card

Which of the following devices best illustrates the concept of edge computing? Router Smartwatch Thin client Server

Smartwatch

Which of the following answers refer to smishing? (Select 2 answers) Social engineering technique Email communication Spam over Internet Telephony Text messaging Spam over Internet Messaging (SPIM)

Social engineering technique, Text messaging (Smishing is a form of social engineering that uses text messages (SMS) to trick people into revealing sensitive information or downloading malware, aka SMS phishing)

Which of the following answers can be used to describe the category of technical security controls (Select 3 answers) Focused on managing risk Sometimes called logical security controls Executed by computer systems (instead of people) Also known as administrative controls Implemented with technology Primarily implemented and executed by people (as opposed to systems)

Sometimes called logical security controls, Executed by computer systems (instead of people), Implemented with technology

A short list of commonly used passwords tried against large number of user accounts is a characteristic feature of a: Replay attack Dictionary attack Spraying attack Birthday attack

Spraying attack

Which of the terms listed below refers to the dynamic packet filtering concept? Port mirroring Stateful inspection Out-of-band management Stateless inspection

Stateful inspection

Which of the following terms refers to an automated or manual code review process aimed at discovering logic and syntax errors in the application's source code? Input validation Dynamic code analysis Fuzzing Static code analysis

Static code analysis

What are the countermeasures against SQL injection attacks? (Select 2 answers) Code obfuscation Database normalization Stored procedures Code signing Input validation

Stored procedures, Input validation

What are the characteristic features of WPA2/WPA3 Enterprise mode? (Select 3 answers) Suitable for large corporate networks IEEE 802.1D Does not require an authentication server IEEE 802.1X Suitable for all types of wireless LANs Requires RADIUS authentication server

Suitable for large corporate networks, IEEE 802.1X, Requires RADIUS authentication server

A type of file that an OS uses to hold parts of programs and data files that cannot be stored in RAM due to insufficient memory space is called: (Select 2 answers) Swap file Temporary file Pagefile Signature file Archive file

Swap file, Pagefile

Which of the following terms refers to an embedded cryptoprocessor that can be found on the motherboards of newer PCs and laptops? CFB AHCI UEFI TPM

TPM

Which of the following answers list examples of hardware root of trust? (Select 2 answers) EFS TPM SED HSM FDE

TPM, HSM

Which of the following describes the behavior of a threat actor? PII TTPs IPS MaaS

TTPs

Which of the following answers refers to a Command-Line Interface (CLI) packet-crafting tool? tcpdump theHarvester Tcpreplay WireShark

Tcpreplay

Which of the following tools enables sending custom packets that can be used to evaluate the security of a network device? WireShark Tcpreplay tcpdump theHarvester

Tcpreplay

A mobile device's capability to share its internet connection with other devices is referred to as: Pairing Clustering Tethering Bonding

Tethering

Which of the following answers refers to a methodology framework for intrusion analysis developed by U.S. government intelligence community? MITRE ATT&CK The Diamond Model of Intrusion Analysis Cyber Kill Chain

The Diamond Model of Intrusion Analysis

Which of the following terms refers to a vulnerability caused by race conditions? Mean time to failure Replay attack Mean time between failures Time-of-check to time-of-use

Time-of-check to time-of-use

Which of the following security solutions can be used to protect database contents? (Select all that apply) Fuzzing Tokenization Salting Normalization Hashing

Tokenization Salting Hashing

Which part of the IPsec modes provides entire packet encryption? Tunnel Payload Transport Default

Tunnel

Examples of key stretching algorithms include: (Select 2 answers) ROT13, Twofish, Bcrypt, DSA, PBKDF2

Twofish, Bcrypt, PBKDF2

Which of the following answers refers to a software tool that provides a single management interface for mobile devices, PCs, printers, IoT devices and wearables? MDM RCS UEM MAM

UEM

What is the name of a device that can provide short-term emergency power during an unexpected main power source outage? UPS PoE SVC PSU

UPS

Examples of application software designed to selectively block access to websites include: (Select 2 answers) URL filter Captive portal FIrewall Content filter Proxy server

URL filter, Content filter

Which of the following physical security controls can be implemented as DLP solution? USB data blocker Visitor logs CCTV Motion detection

USB data blocker

An attacker impersonates a company's managing staff member to manipulate a lower rank employee into disclosing confidential data. The attacker informs the victim that the information is essential for a task that needs to be completed within the business hours on the same day and mentions potential financial losses for the company in case the victim refuses to comply. Which social engineering principles apply to this attack scenario? (Select 3 answer) Urgency Familiarity Authority Consensus Intimidation Scarcity

Urgency, Authority, Intimidation

Which of the following security measures can be used to prevent VM sprawl? (Select 2 answers) Patch management Usage audit Physical security controls Sandboxing Asset documentation

Usage audit Asset documentation

Which of the following answers list the characteristic features of the Mandatory Access Control (MAC) model? (Select 3 answers) Users are not allowed to change access policies at their own discretion Labels and clearance levels can only be applied and changed by an administrator Every object has an owner who at his/her own discretion determines what kind of permissions other users can have to that object Access to resources based on user identity Every resource has a sensitivity label matching a clearance level assigned to a user

Users are not allowed to change access policies at their own discretion, Labels and clearance levels can only be applied and changed by an administrator, Every resource has a sensitivity label matching a clearance level assigned to a user

Which of the following enables running macros in Microsoft Office applications? DOM VBA SDK RAD

VBA

A logical grouping of computers that allow computer hosts to act as if they were attached to the same broadcast domain regardless of their physical location is known as: VLN Screened subnet Intranet SAN

VLAN

Which of the following answers refer to the characteristics of HOTP? (Select 3 answers) Valid for only one login session Based on a shared secret key and current time Vulnerable to replay attacks Based on a cryptographic hash function and a secret cryp

Valid for only one login session, Based on a cryptographic hash function and a secret cryptographic key, Not vulnerable to replay attacks

The practice of using a telephone system to manipulate user into disclosing confidential information is known as:

Vishing (Voicemail phishing)

Which of the acronyms listed below refers to a firewall controlling access to a web server? WEP WAP WPS WAF

WAF

Which of the following would be of help in troubleshooting wireless signal loss and low wireless network signal coverage? (Select 2 answers) Protocol analyzer WAP power level controls WiFi analyzer Logical network diagram Network mapper

WAP power level controls, WiFi analzyer

Which of the wireless security protocols listed below has been deprecated in favor of newer standards due to known vulnerabilities resulting from implementation flaws? EAP AES WPA2 WEP

WEP

A solution that simplifies configuration of new wireless networks by allowing non-technical users to easily configure network security settings and add new devices to an existing network is known as: WPA WPS WEP WAP

WPS

Which of the wireless technologies listed below are deprecated and should not be used due to their known vulnerabilities? (Select 2 answers) WPS WAP WPA2 WAF WEP

WPS, WEP

An optimal Wireless Access Point (WAP) antenna placement provides a countermeasure against: War chalking Spoofing War driving Insider threat

War driving

Which of the terms listed below refers to a platform used for watering hole attacks? Mail gateways Websites PBX systems Web browsers

Websites (A watering hole attack is a targeted attack designed to compromise users within a specific industry or group of users by infecting websites they typically visit and luring them to a malicious site)

Which of the following answers refers to a diagnostic tool that can be used for measuring wireless signal strength? Tone generator Multimeter WiFi analyzer Network mapper

WiFi analyzer

Which digital certificate allows multiple subdomains to be protected by a single certificate? Root signing certificate Subject Alternative Name (SAN) certificate Extended Validation (EV) certificate Wildcard certificate

Wildcard certificate

The process of planning and designing new WLANs for optimal performance, security and compliance typically involves: Penetration testing Wireless site survey Vulnerability scanning End user awareness and training

Wireless site survey

Which of the following answers refers to a command-line tool used to download or upload data to a server via any of the supported protocols, such as FTP, HTTP, SMTP, IMAP, POP3, or LDAP? theHarvester curl sn1per memdump

curl

A Linux command-line utility that can be used in the forensic process for creating and copying image files is called: fsutil diskpart dd format

dd

Which of the following answers refers to network administration command-line utilities used for DNS queries? (Select 2 answers) dig tracert nslookup ping pathping

dig, nslookup

Which of the following tools would be best suited for gathering information about a domain? FTK Imager dnsenum scanless Wireshark

dnsenum

Which of the following enables client-side URL redirection? host hosts hostname localhost

hosts

Which of the following answers refers to a command-line tool used for security auditing and testing of firewalls and networks? pathping netstat nslookup hping

hping

Which of the following answers refers to a Linux utility for querying and displaying logs that are stored in binary form? logger uncompress read journalctl

journalctl

Which of the following commands enables adding messages to the /var/log/syslog file in Linux? paste logger write printf

logger

A Linux command-line command for displaying routing table contents is called: print route netstat -r route print netstat -a

netstat -r

Which network command-line utility in MS Windows combines the features of ping and tracert? nbtstat pathping traceroute netstat

pathping

Which of the following command-line commands in MS Windows are used to display the contents of a routing table? (Select 2 answers) netstat -p route print netstat -a print route netstat -r

route print, netstat -r

Which of the following answers refers to a cross-platform IP traffic collection method that takes advantage of packet sampling to optimize bandwidth and hardware resources usage? sFlow NXLog NetFlow IPFIX

sFlow

Which of the following answers refers to an advanced network exploration and penetration testing tool integrating functionalities from multiple other tools, such as ping, whois, or nmap? sn1per dnsenum curl scanless

sn1per

Examples of utilities that enable logging of data from different types of systems in a central repository include: (Select all that apply) syslog rsyslog journalctl syslog-ng NXLog

syslog rsyslog syslog-ng NXLog

Which of the following are log managing utilities for Unix and Unix-like systems that implement the basic syslog protocol and extend it with additional functionalities? (Select 2 answers) NXLog syslog-ng NetFlow rsyslog sFlow

syslog-ng, rsyslog

Which of the following is a Command-Line Interface (CLI) packet-capturing tool used in Unix-like operating systems? tcpdump Wireshark theHarvester Tcpreplay

tcpdump

Which of the following tools is used for gathering OSINT? Wireshark theHarvester Nessus FTK Imager

theHarvester

A Linux command-line utility for displaying intermediary points (routers) the IPv4 packet is passed through on tis way to another network node is known as: nbtstat traceroute netstat tracert

traceroute

A network command-line utility in MS Windows that tracks and displays the route taken by IPv4 packets on their way to another host is called ping traceroute nslookup tracert

tracert