theese

A Chief Information Security Officer (CISO) needs to create a policy set that meets international standards for data privacy and sharing. Which of the following should the CISO read and understand before writing the policies?

GDPR

Which of the following is the MOST likely motivation for a script kiddie threat actor?

Notoriety

Which of the following is a valid multifactor authentication combination?

OTP token combined with password

In which of the following common use cases would steganography be employed?

Obfuscation

Which of the following would MOST likely support the integrity of a voting machine?

Perfect forward secrecy

Which of the following job roles would sponsor data quality and data entry initiatives that ensure business and regulatory requirements are met?

The data steward

Which of the following encryption algorithms require one encryption key? (Choose two.)

3DES RC4

A cybersecurity administrator needs to add disk redundancy for a critical server. The solution must have a two-drive failure for better fault tolerance. Which of the following RAID levels should the administrator select?

6 RAID 6: Because of parity, RAID 6 can withstand two disk failures at one time. This can be simultaneous failures or during a rebuild another drive can fail and the system will still be operational. Source:

While checking logs, a security engineer notices a number of end users suddenly downloading files with the .tar.gz extension. Closer examination of the files reveals they are PE32 files. The end users state they did not initiate any of the downloads. Further investigation reveals the end users all clicked on an external email containing an infected MHT file with an href link a week prior. Which of the following is MOST likely occurring?

A RAT was installed and is transferring additional exploit tools. RATs are typically downloaded together with a seemingly legitimate program, like a game, or are sent to the target as an email attachment. Once the attacker compromises the host's system, they can use it to distribute RATs to additional vulnerable computers, establishing a botnet.

A company recently experienced a data breach and the source was determined to be an executive who was charging a phone in a public area. Which of the following would MOST likely have prevented this breach?

A USB data blocker Explanation: Malicious USB charging cables and plugs are also a widespread problem. As with card skimming, a device may be placed over a public charging port at airports and other transit locations. A USB data blocker can provide mitigation against these juice- jacking attacks by preventing any sort of data transfer when the smartphone or laptop is connected to a charge point.

A company's Chief Information Officer (CIO) is meeting with the Chief Information Security Officer (CISO) to plan some activities to enhance the skill levels of the company's developers. Which of the following would be MOST suitable for training the developers?

A capture-the-flag competition Explanation: Capture The Flags, or CTFs, are a kind of computer security competition. Teams of competitors (or just individuals) are pitted against each other in a test of computer security skill. Very often CTFs are the beginning of one's cyber security career due to their team building nature and competitive aspect. In addition, there isn't a lot of commitment required beyond a weekend.

In which of the following situations would it be BEST to use a detective control type for mitigation?

A company purchased an IPS system, but after reviewing the requirements, the appliance was supposed to monitor, not block, any traffic.

A pharmaceutical sales representative logs on to a laptop and connects to the public WiFi to check emails and update reports. Which of the following would be BEST to prevent other devices on the network from directly accessing the laptop? (Choose two.)

A host-based firewall A VPN

A company recently moved sensitive videos between on-premises. Company-owned websites. The company then learned the videos had been uploaded and shared to the internet. Which of the following would MOST likely allow the company to find the cause?

A log analysis Explanation: https://www.sumologic.com/glossary/log-analysis/ "While companies can operate private clouds, forensics in a public cloud are complicated by the right to audit permitted to you by your service level agreement (SLA) with the cloud provider."

A nuclear plant was the victim of a recent attack, and all the networks were air gapped. A subsequent investigation revealed a worm as the source of the issue. Which of the following BEST explains what happened?

A malicious USB was introduced by an unsuspecting employee.

Which of the following represents a multifactor authentication system?

A one-time password token combined with a proximity badge

An organization needs to implement more stringent controls over administrator/root credentials and service accounts. Requirements for the project include: - Check-in/checkout of credentials - The ability to use but not know the password - Automated password changes - Logging of access to credentials Which of the following solutions would meet the requirements?

A privileged access management system

A security analyst is preparing a threat for an upcoming internal penetration test. The analyst needs to identify a method for determining the tactics, techniques, and procedures of a threat against the organization's network. Which of the following will the analyst MOST likely use to accomplish the objective?

A table exercise

An organization's Chief Security Officer (CSO) wants to validate the business's involvement in the incident response plan to ensure its validity and thoroughness. Which of the following will the CSO MOST likely use?

A tabletop exercise

Several employees return to work the day after attending an industry trade show. That same day, the security manager notices several malware alerts coming from each of the employee's workstations. The security manager investigates but finds no signs of an attack on the perimeter firewall or the NIDS. Which of the following is MOST likely causing the malware alerts?

A worm that has propagated itself across the intranet, which was initiated by presentation media

Which of the following serves to warn users against downloading and installing pirated software on company devices?

AUP

A system in the network is used to store proprietary secrets and needs the highest level of security possible. Which of the following should a security administrator implement to ensure the system cannot be reached from the Internet?

Air gap An air gap, air wall or air gapping is a network security measure employed on one or more computers to ensure that a secure computer network is physically isolated from unsecured networks, such as the public Internet or an unsecured local area network. It means a computer or network has no network interfaces connected to other networks, with a physical or conceptual air gap, analogous to the air gap used in plumbing to maintain water quality.

Which of the following would be BEST to establish between organizations that have agreed cooperate and are engaged in early discussion to define the responsibilities of each party, but do not want to establish a contractually binding agreement?

An MOU

Which of the following would be BEST to establish between organizations to define the responsibilities of each party, outline the key deliverables, and include monetary penalties for breaches to manage third-party risk?

An SLA Explanation: The keyword is "include monetary penalties for breaches". SLA includes penalties for not delivering services up to contract, BPA does not.

A user recently entered a username and password into a recruiting application website that had been forged to look like the legitimate site Upon investigation, a security analyst the identifies the following: - The legitimate websites IP address is 10.1.1.20 and eRecruit local resolves to the IP - The forged website's IP address appears to be 10.2.12.99. based on NetFtow records - AH three at the organization's DNS servers show the website correctly resolves to the legitimate IP - DNS query logs show one of the three DNS servers returned a result of 10.2.12.99 (cached) at the approximate time of the suspected compromise. Which of the following MOST likely occurred?

An SSL strip MITM attack was performed

A manufacturer creates designs for very high security products that are required to be protected and controlled by the government regulations. These designs are not accessible by corporate networks or the Internet. Which of the following is the BEST solution to protect these designs?

An air gap

Which of the following scenarios would make a DNS sinkhole effective in thwarting an attack?

An attacker is sniffing traffic to port 53, and the server is managed using unencrypted usernames and passwords.

A security audit has revealed that a process control terminal is vulnerable to malicious users installing and executing software on the system. The terminal is beyond end-of-life support and cannot be upgraded, so it is placed on a projected network segment. Which of the following would be MOST effective to implement to further mitigate the reported vulnerability?

Application whitelisting

Which of the following describes the BEST approach for deploying application patches?

Apply the patches to systems in a testing environment then to systems in a staging environment, and finally to production systems.

Local guidelines require that all information systems meet a minimum-security baseline to be compliant. Which of the following can security administrators use to assess their system configurations against the baseline?

Benchmarks

A company has drafted an insider-threat policy that prohibits the use of external storage devices. Which of the following would BEST protect the company from data exfiltration via removable media?

Blocking removable-media devices and write capabilities using a host-based security tool

Which of the following would BEST identify and remediate a data-loss event in an enterprise using third-party, web-based services and file-sharing platforms?

CASB A Cloud Access Security Broker (CASB) is a security solution that sits between an enterprise's on-premises infrastructure and its cloud-based applications and services. It helps to secure the use of these cloud-based services by providing visibility, control, and protection for data in the cloud. A CASB can help to identify and remediate data-loss events by monitoring the use of cloud-based services, identifying unusual or suspicious activity, and alerting the appropriate personnel when necessary. It can also help to prevent data loss by enforcing policies to control the access and use of data in the cloud, and by providing encryption and other security measures to protect data in transit and at rest

A startup company is using multiple SaaS and IaaS platforms to stand up a corporate infrastructure and build out a customer-facing web application. Which of the following solutions would be BEST to provide security, manageability, and visibility into the platforms?

CASB A cloud access security broker is on-premises or cloud based software that sits between cloud service users and cloud applications, and monitors all activity and enforces security policies A CASB has a separate, and more distinctive role. Differing from the use case for SWG, which focuses on the broader filtering and protection against inbound threats and filtering illegitimate web traffic, a CASB is more deeply integrated and has control over your cloud application usage. It can be tied into an applications API to scan data at rest or can be used with a proxy based deployment to enforce inline policies for more real time protection.

A security analyst is reviewing information regarding recent vulnerabilities. Which of the following will the analyst MOST likely consult to validate which platforms have been affected?

CVE Explanation: CVE is simply a list of all publicly disclosed vulnerabilities that includes the CVE ID, a description, dates, and comments.

A security analyst is looking for a solution to help communicate to the leadership team the seventy levels of the organization's vulnerabilities. Which of the following would BEST meet this need?

CVSS Explanation: The Common Vulnerability Scoring System (CVSS) is a system widely used in vulnerability management programs. CVSS indicates the severity of an information security vulnerability, and is an integral component of many vulnerability scanning tools.

A company provides mobile devices to its users to permit access to email and enterprise applications. The company recently started allowing users to select from several different vendors and device models. When configuring the MDM, which of the following is a key security implication of this heterogeneous device approach?

Certain devices are inherently less secure than others, so compensatory controls will be needed to address the delta between device vendors.

An employee has been charged with fraud and is suspected of using corporate assets. As authorities collect evidence, and to preserve the admissibility of the evidence, which of the following forensic techniques should be used?

Chain of custody

A systems administrator wants to disable the use of usernames and passwords for SSH authentication and enforce key-based authentication. Which of the following should the administrator do NEXT to enforce this new configuration?

Change the default SSH port. enable TCP tunneling. and provide a pre-configured SSH client.

A smart switch has the ability to monitor electrical levels and shut off power to a building in the event of power surge or other fault situation. The switch was installed on a wired network in a hospital and is monitored by the facilities department via a cloud application. The security administrator isolated the switch on a separate VLAN and set up a patch routine. Which of the following steps should also be taken to harden the smart switch?

Change the default password for the switch.

A company is implementing a DLP solution on the file server. The file server has PII, financial information, and health information stored on it. Depending on what type of data that is hosted on the file server, the company wants different DLP rules assigned to the data. Which of the following should the company do to help to accomplish this goal?

Classify the data Ex: Data classification and typing schemas tag data assets so that they can be managed through the information life cycle. A data classification schema is a decision tree for applying one or more tags or labels to each data asset. Many data classification schemas are based on the degree of confidentiality required: Public (unclassified) - there are no restrictions on viewing the data. Public information presents no risk to an organization if it is disclosed but does present a risk if it is modified or not available. Confidential (secret)- the information is highly sensitive, for viewing only by approved persons within the owner organization, and possibly by trusted third parties under NDA. Critical (top secret)- the information is too valuable to allow any risk of its capture. Viewing is severely restricted.

A recent audit uncovered a key finding regarding the use of a specific encryption standard in a web application that is used to communicate with business customers. Due to the technical limitations of its customers the company is unable to upgrade the encryption standard. Which of the following types of controls should be used to reduce the risk created by this scenario?

Compensating

In the middle of a cybersecurity, a security engineer removes the infected devices from the network and lock down all compromised accounts. In which of the following incident response phases is the security engineer currently operating?

Containment Explanation: Isolation involves removing affected components from any environment the greater one. This can be anything from removing the server from the network after become the target of DoS attacks, to the point of placing applications in a VM sandbox outside the environment where the host usually runs. Whatever the situation, you'll want to make sure you don't there is another Interface between the affected component and the production network or the Internet.

A cybersecurity manager has scheduled biannual meetings with the IT team and department leaders to discuss how they would respond to hypothetical cyberattacks. During these meetings, the manager presents a scenario and injects additional information throughout the session to replicate what might occur in a dynamic cybersecurity event involving the company, its facilities, its data, and its staff. Which of the following describes what the manager is doing?

Conducting a tabletop exercise

A financial organization has adopted a new secure, encrypted document-sharing application to help with its customer loan process. Some important PII needs to be shared across this new platform, but it is getting blocked by the DLP systems. Which of the following actions will BEST allow the PII to be shared with the secure application without compromising the organization's security posture?

Configure the DLP policies to whitelist this application with the specific PII

A recently discovered zero-day exploit utilizes an unknown vulnerability in the SMB network protocol to rapidly infect computers. Once infected, computers are encrypted and held for ransom. Which of the following would BEST prevent this attack from reoccurring?

Configure the perimeter firewall to deny inbound external connections to SMB ports

A security modern may have occurred on the desktop PC of an organization's Chief Executive Officer (CEO) A duplicate copy of the CEO's hard drive must be stored securely to ensure appropriate forensic processes and the chain of custody are followed. Which of the following should be performed to accomplish this task?

Connect a write blocker to the hard drive Then leveraging a forensic workstation, utilize the dd command m a live Linux environment to create a duplicate copy Explanation: To obtain a forensically sound image from nonvolatile storage, you need to ensure that nothing you do alters data or metadata (properties) on the source disk or file system. A write blocker assures this process by preventing any data on the disk or volume from being changed by filtering write commands at the driver and OS level. Data acquisition would normally proceed by attaching the target device to a forensics workstation or field capture device equipped with a write blocker.

An engineer wants to access sensitive data from a corporate-owned mobile device. Personal data is not allowed on the device. Which of the following MDM configurations must be considered when the engineer travels for business?

Containerization

A root cause analysis reveals that a web application outage was caused by one of the company's developers uploading a newer version of the third-party libraries that were shared among several applications. Which of the following implementations would be BEST to prevent the issue from reoccurring?

Containerization Containerization is defined as a form of operating system virtualization, through which applications are run in isolated user spaces called containers, all using the same shared operating system (OS).

A security analyst needs to implement an MDM solution for BYOD users that will allow the company to retain control over company emails residing on the devices and limit data exfiltration that might occur if the devices are lost or stolen. Which of the following would BEST meet these requirements? (Choose two.)

Containerization Remote control Explanation: Containerization and remote control are two solutions that can help a security analyst implement an MDM (Mobile Device Management) solution for BYOD (Bring Your Own Device) users that will allow the company to retain control over company emails residing on the devices and limit data exfiltration if the devices are lost or stolen. Containerization allows the company to create a secure and isolated environment (container) on the user's device to store company data, including email. This container can be managed and secured independently from the user's personal environment on the device, ensuring that company data is protected. Remote control enables the security analyst to remotely access and manage the user's device. This allows the analyst to remotely wipe company data from the device if it is lost or stolen, or to lock or locate the device. Additionally, remote control can be used to enforce security policies and configurations on the device to ensure it complies with the company's security requirements.

A company recently transitioned to a strictly BYOD culture due to the cost of replacing lost or damaged corporate-owned mobile devices. Which of the following technologies would be BEST to balance the BYOD culture while also protecting the company's data?

Containerization You cannot run a Full Disk Encryption on a Staff's Device. Rather you place the official application in a container.

Which of the following incident response steps involves actions to protect critical systems while maintaining business operations?

Containment

A development team employs a practice of bringing all the code changes from multiple team members into the same development project through automation. A tool is utilized to validate the code and track source code through version control. Which of the following BEST describes this process?

Continuous integration

A consultant is configuring a vulnerability scanner for a large, global organization in multiple countries. The consultant will be using a service account to scan systems with administrative privileges on a weekly basis, but there is a concern that hackers could gain access to account to the account and pivot through the global network. Which of the following would be BEST to help mitigate this concern?

Create different accounts for each region. limit their logon times, and alert on risky logins

A security analyst is reviewing a new website that will soon be made publicly available. The analyst sees the following in the URL: http://dev-site.comptia.org/home/show.php?sessionID=77276554&loc=us The analyst then sends an internal user a link to the new website for testing purposes, and when the user clicks the link, the analyst is able to browse the website with the following URL: http://dev-site.comptia.org/home/show.php?sessionID=98988475&loc=us Which of the following application attacks is being tested?

Cross-site request forgery

A security administrator has received multiple calls from the help desk about customers who are unable to access the organization's web server. Upon reviewing the log files. the security administrator determines multiple open requests have been made from multiple IP addresses, which is consuming system resources. Which of the following attack types does this BEST describe?

DDoS

Employees are having issues accessing the company's website. Some employees report very slow performance, while others cannot the website at all. The web and security administrators search the logs and find millions of half-open connections to port 443 on the web server. Further analysis reveals thousands of different source IPs initiating this traffic. Which of the following attacks is MOST likely occurring?

DDoS

Which of the following algorithms has the SMALLEST key size?

DES

A security analyst has received an alert about being sent via email. The analyst's Chief information Security Officer (CISO) has made it clear that PII must be handle with extreme care From which of the following did the alert MOST likely originate?

DLP Explanation: Network-based DLP monitors outgoing data looking for sensitive data. Network-based DLP systems monitor outgoing email to detect and block unauthorized data transfers and monitor data stored in the cloud.

An employee opens a web browser and types a URL into the address bar. Instead of reaching the requested site, the browser opens a completely different site. Which of the following types of attacks have MOST likely occurred? (Choose two.)

DNS hijacking Man-in-the-browser

Which of the following provides the BEST protection for sensitive information and data stored in cloud-based services but still allows for full functionality and searchability of data within the cloudbased services?

Data encryption

An organization has implemented a policy requiring the use of conductive metal lockboxes for personal electronic devices outside of a secure research lab. Which of the following did the organization determine to be the GREATEST risk to intellectual property when creating this policy?

Data exfiltration over a mobile hotspot

Which of the following allows for functional test data to be used in new systems for testing and training purposes to protect the read data?

Data masking Ex: The main reason for applying masking to a data field is to protect data that is classified as personally identifiable information, sensitive personal data, or commercially sensitive data. However, the data must remain usable for the purposes of undertaking valid test cycles. It must also look real and appear consistent. It is more common to have masking applied to data that is represented outside of a corporate production system. In other words, where data is needed for the purpose of application development, building program extensions and conducting various test cycles

A network administrator has been asked to install an IDS to improve the security posture of an organization. Which of the following control types is an IDS?

Detective

A company posts a sign indicating its server room is under video surveillance. Which of the following control types is represented?

Deterrent

A document that appears to be malicious has been discovered in an email that was sent to a company's Chief Financial Officer (CFO). Which of the following would be BEST to allow a security analyst to gather information and confirm it is a malicious document without executing any code it may contain?

Detonate the document in an analysis sandbox

An organization is developing a plan in the event of a complete loss of critical systems and data. Which of the following plans is the organization MOST likely developing?

Disaster recovery

A system administrator needs to implement an access control scheme that will allow an object's access policy be determined by its owner. Which of the following access control schemes BEST fits the requirements?

Discretionary access control Explanation: Discretionary access control (DAC) is a model of access control based on access being determined "by the owner" of the resource in question. The owner of the resource can decide who does and does not have access, and exactly what access they are allowed to have.

A university with remote campuses, which all use different service providers, loses Internet connectivity across all locations. After a few minutes, Internet and VoIP services are restored, only to go offline again at random intervals, typically within four minutes of services being restored. Outages continue throughout the day, impacting all inbound and outbound connections and services. Services that are limited to the local LAN or WiFi network are not impacted, but all WAN and VoIP services are affected. Later that day, the edge-router manufacturer releases a CVE outlining the ability of an attacker to exploit the SIP protocol handling on devices, leading to resource exhaustion and system reloads. Which of the following BEST describe this type of attack? (Choose two.)

DoS Race condition

An incident response technician collected a mobile device during an investigation. Which of the following should the technician do to maintain chain of custody?

Document the collection and require a sign-off when possession changes. Explanation: Document the collection and require a sign-off when possession changes is the correct option to maintain chain of custody when collecting a mobile device during an investigation. It is important to document the collection process, including who collected the device, when and where it was collected, and any other relevant details. It is also necessary to require a sign-off when possession changes, to ensure accountability and track the device's movement. This helps maintain the integrity of the evidence and ensures that it can be used in legal proceedings.

An organization's help desk is flooded with phone calls from users stating they can no longer access certain websites. The help desk escalates the issue to the security team, as these websites were accessible the previous day. The security analysts run the following command: ipconfig /flushdns, but the issue persists. Finally, an analyst changes the DNS server for an impacted machine, and the issue goes away. Which of the following attacks MOST likely occurred on the original DNS server?

Domain Hijacking

A technician needs to prevent data loss in a laboratory. The laboratory is not connected to any external networks. Which of the following methods would BEST prevent data? (Select TWO)

Drive encryption USB blocker

A network administrator needs to build out a new datacenter, with a focus on resiliency and uptime. Which of the following would BEST meet this objective? (Choose two.)

Dual power supply Off-site backups

A remote user recently took a two-week vacation abroad and brought along a corporate-owned laptop. Upon returning to work, the user has been unable to connect the laptop to the VPN. Which of the following is the MOST likely reason for the user's inability to connect the laptop to the VPN?

Due to foreign travel, the user's laptop was isolated from the network.

A malicious actor recently penetration a company's network and moved laterally to the datacenter. Upon investigation, a forensics firm wants to know was in the memory on the compromised server. Which of the following files should be given to the forensics firm?

Dump Explanation: Dump files are a special type of files that store information about your computer, the software on it, and the data loaded in the memory when something bad happens. They are usually automatically generated by Windows or by the apps that crash, but you can also manually generate them.

Which of the following attacks can be mitigated by proper data retention policies?

Dumpster diving Dumpster diving risks would be mitigated by proper data SANITATION policies...isn't data RETNETION about how we keep data secure through backups, legal hold, etc.

A recent malware outbreak across a subnet included successful rootkit installations on many PCs, ensuring persistence by rendering remediation efforts ineffective. Which of the following would BEST detect the presence of a rootkit in the future?

EDR

Which of the following technical controls is BEST suited for the detection and prevention of buffer overflows on hosts?

EDR

A security analyst receives the configuration of a current VPN profile and notices the authentication is only applied to the IP datagram portion of the packet. Which of the following should the analyst implement to authenticate the entire packet?

ESP

A network administrator would like to configure a site-to-site VPN utilizing iPSec. The administrator wants the tunnel to be established with data integrity encryption, authentication and anti- replay functions. Which of the following should the administrator use when configuring the VPN?

ESP Explanation: Encapsulating Security Payload (ESP) is a member of the Internet Protocol Security (IPsec) set of protocols that encrypt and authenticate the packets of data between computers using a Virtual Private Network (VPN). The focus and layer on which ESP operates makes it possible for VPNs to function securely

To secure an application after a large data breach, an e-commerce site will be resetting all users' credentials. Which of the following will BEST ensure the site's users are not compromised after the reset?

Encrypted credentials in transit

A RAT that was used to compromise an organization's banking credentials was found on a user's computer. The RAT evaded antivirus detection. It was installed by a user who has local administrator rights to the system as part of a remote management tool set. Which of the following recommendations would BEST prevent this from reoccurring?

Enforce application whitelisting

Which of the following should a technician use to protect a cellular phone that is needed for an investigation, to ensure the data will not be removed remotely?

Faraday cage

A user contacts the help desk to report the following: - Two days ago, a pop-up browser window prompted the user for a name and password after connecting to the corporate wireless SSID. This had never happened before, but the user entered the information as requested. - The user was able to access the Internet but had trouble accessing the department share until the next day. - The user is now getting notifications from the bank about unauthorized transactions. Which of the following attack vectors was MOST likely used in this scenario?

Evil twin

Phishing and spear-phishing attacks have been occurring more frequently against a company's staff. Which of the following would MOST likely help mitigate this issue?

Exact mail exchanger records in the DNS

An organization wants to implement a third factor to an existing multifactor authentication. The organization already uses a smart card and password. Which of the following would meet the organization's needs for a third factor?

Fingerprints

Which of the following would be the BEST method for creating a detailed diagram of wireless access points and hotspots?

Footprinting

A company moved into a new building next to a sugar mill. Cracks have been discovered in the walls of the server room, which is located on the same side as the sugar mill loading docks. The cracks are believed to have been caused by heavy trucks. Moisture has begun to seep into the server room, causing extreme humidification problems and equipment failure. Which of the following BEST describes the type of threat the organization faces?

Foundational

A user is concerned that a web application will not be able to handle unexpected or random input without crashing. Which of the following BEST describes the type of testing the user should perform?

Fuzzing

An organization is developing an authentication service for use at the entry and exit ports of country borders. The service will use data feeds obtained from passport systems, passenger manifests, and high-definition video feeds from CCTV systems that are located at the ports. The service will incorporate machine-learning techniques to eliminate biometric enrollment processes while still allowing authorities to identify passengers with increasing accuracy over time. The more frequently passengers travel, the more accurately the service will identify them. Which of the following biometrics will MOST likely be used, without the need for enrollment?

Gait Facial

A nationwide company is experiencing unauthorized logins at all hours of the day. The logins appear to originate from countries in which the company has no employees. Which of the following controls should the company consider using as part of its IAM strategy? (Choose two.)

Geofencing Time-based logins

The Chief Executive Officer (CEO) of an organization would like staff members to have the flexibility to work from home anytime during business hours, incident during a pandemic or crisis, However, the CEO is concerned that some staff members may take advantage of the of the flexibility and work from high-risk countries while on holidays work to a third-party organization in another country. The Chief information Officer (CIO) believes the company can implement some basic to mitigate the majority of the risk. Which of the following would be BEST to mitigate CEO's concern? (Choose two.)

Geolocation Time-of-day restrictions Ex: Geolocation reveals more specific data relating to their location, such as their current city or state. Time of Day to prevents someone in a another time zone to perform outsourced work. Geotagging labels your location for purpose of adding geographical details to a photo, a video, or any media in the form of metadata.

An enterprise has hired an outside security firm to conduct penetration testing on its network and applications. The firm has only been given the documentation available to the customers of the applications. Which of the following BEST represents the type of testing that will occur?

Gray-box Explanation: In White Box testing internal structure (code) is known. In Black Box testing internal structure (code) is unknown. In Grey Box Testing internal structure (code) is partially known.

A company network is currently under attack. Although security controls are in place to stop the attack, the security administrator needs more information about the types of attacks being used. Which of the following network types would BEST help the administrator gather this information?

Honeynet

An organization wants to host an externally accessible web server that will not contain sensitive user information. Any sensitive information will be hosted on file servers. Which of the following is the BEST architecture configuration for this organization?

Host the web server in a DMZ and the file servers behind a firewall

Which of the following ISO standards is certified for privacy?

ISO 27701 Explanation: ISO 27701 also abbreviated as PIMS (Privacy Information Management System) outlines a framework for Personally Identifiable Information (PII) Controllers and PII Processors to manage data privacy. Privacy information management systems are sometimes referred to as personal information management systems.

Which of the following cloud models provides clients with servers, storage, and networks but nothing else?

IaaS

An organization has a growing workforce that is mostly driven by additions to the sales department. Each newly hired salesperson relies on a mobile device to conduct business. The Chief Information Officer (CIO) is wondering it the organization may need to scale down just as quickly as it scaled up. The ClO is also concerned about the organization's security and customer privacy. Which of the following would be BEST to address the ClO's concerns?

Implement BYOD for the sates department while leveraging the MDM

A Chief Information Security Officer (CISO) is concerned about the organization's ability to continue business operation in the event of a prolonged DDoS attack on its local datacenter that consumes database resources. Which of the following will the CISO MOST likely recommend to mitigate this risk?

Implement a hot-site failover location

A Chief Security Office's (CSO's) key priorities are to improve preparation, response, and recovery practices to minimize system downtime and enhance organizational resilience to ransomware attacks. Which of the following would BEST meet the CSO's objectives?

Implement application whitelisting and centralized event-log management, and perform regular testing and validation of full backups.

A company has limited storage space available and an online presence that cannot be down for more than four hours. Which of the following backup methodologies should the company implement to allow for the FASTEST database restore time in the event of a failure, while being mindful of the limited available storage space?

Implement full backups every Sunday at 8:00 p.m. and nightly differential backups at 8:00 p.m. Explanation: Do not combine differential and incremental backups. Use full backups interspersed with differential backups or full backups interspersed with incremental backups.

A Chief Security Officer (CSO) is concerned about the amount of PII that is stored locally on each salesperson's laptop. The sales department has a higher-than-average rate of lost equipment. Which of the following recommendations would BEST address the CSO's concern?

Implement managed FDE.

A security analyst discovers that a company username and password database was posted on an internet forum. The username and passwords are stored in plan text. Which of the following would mitigate the damage done by this type of data exfiltration in the future?

Implement salting and hashing Explanation: Salting and hashing are techniques used to protect the security of passwords stored in a database. Salting involves adding random data, known as a "salt," to each password before it is hashed. This makes it more difficult for attackers to crack the passwords by using pre-computed hash tables, known as "rainbow tables." Hashing involves applying a one-way mathematical function, known as a "hash algorithm," to the salted password to produce a fixed-length output, known as a "hash value." This makes it impossible to determine the original password from the hash value, even if the attacker has access to the database. By implementing salting and hashing, the company can ensure that its passwords are protected even if the database is compromised

A workwide manufacturing company has been experiencing email account compromised. In one A workwide manufacturing company has been experiencing email account compromised. In one

Impossible travel time Explanation: It states it is a worldwide company so you cannot set up a geofencing perimeter. However you could have impossible travel time alerts.

Which of the following are the MOST likely vectors for the unauthorized inclusion of vulnerable code in a software company's final software releases? (Choose two.)

Included third-party libraries Vendors/supply chain Explanation: Plenty of example for vulnerabilities introduced by insecure third party libraries.

An organization's RPO for a critical system is two hours. The system is used Monday through Friday, from 9:00 am to 5:00 pm. Currently, the organization performs a full backup every Saturday that takes four hours to complete. Which of the following additional backup implementations would be the BEST way for the analyst to meet the business requirements?

Incremental backups Monday through Friday at 6:00 p.m and differential backups hourly

A security analyst needs to be proactive in understand the types of attacks that could potentially target the company's execute. Which of the following intelligence sources should to security analyst review?

Industry information-sharing and collaboration groups

A network engineer needs to build a solution that will allow guests at the company's headquarters to access the Internet via WiFi. This solution should not allow access to the internal corporate network, but it should require guests to sign off on the acceptable use policy before accessing the Internet. Which of the following should the engineer employ to meet these requirements?

Install a captive portal

A security administrator has generated an SSH key pair to authenticate to a new server. Which of the following should the security administrator do NEXT to use the keys securely for authentication? Choose 2

Install the private key on the server. Encrypt the public key.

A company employee recently retired, and there was a schedule delay because no one was capable of filling the employee's position. Which of the following practices would BEST help to prevent this situation in the future?

Job rotation

A security engineer needs to enhance MFA access to sensitive areas in a building. A key card and fingerprint scan are already in use. Which of the following would add another factor of authentication?

Keypad PIN

A security analyst needs to produce a document that details how a security incident occurred, the steps that were taken for recovery, and how future incidents can be avoided. During which of the following stages of the response process will this activity take place?

Lessons learned Explanation: Lessons learned or remediation step is the final phase of the incident response. It examines and documents how well the team responded, discovers what caused the incident, and determines how the incident can be avoided in the future. Phases of the Incident Response Plan: 1. Preparation - Preparing for an attack and how to respond 2. Identification - Identifying the threat 3. Containment - Containing the threat 4. Eradication - Removing the threat 5. Recovery - Recovering affected systems 6. Lessons Learned - Evaluating the incident response, see where there can be improvements for a future incident.

An organization has been experiencing outages during holiday sales and needs to ensure availability of its point-of-sale systems. The IT administrator has been asked to improve both server-data fault tolerance and site availability under high consumer load. Which of the following are the BEST options to accomplish this objective? (Select TWO)

Load balancing RAID

A company is experiencing an increasing number of systems that are locking up on Windows startup. The security analyst clones a machine, enters into safe mode, and discovers a file in the startup process that runs Wstart.bat. @echo off :asdhbawdhbasdhbawdhb start notepad.exe start notepad.exe start calculator.exe start calculator.exe goto asdhbawdhbasdhbawdhb Given the file contents and the system's issues, which of the following types of malware is present?

Logic bomb

A public relations team will be taking a group of guests on a tour through the facility of a large ecommerce company. The day before the tour, the company sends out an email to employees to ensure all whiteboards are cleaned and all desks are cleared. The company is MOST likely trying to protect against:

Loss of proprietary information Explanation: In the context of information security, social engineering is the psychological manipulation of people into performing actions or divulging confidential information think phishing, spoofing. That is not being demonstrated in this question. The company is protecting themselves from loss of proprietary information by clearing it all out. so that if anyone in the tour is looking to take it they will be out of luck.

A security administrator is seeking a solution to prevent unauthorized access to the internal network. Which of the following security solutions should the administrator choose?

MAC filtering MAC filtering is a security method based on access control. In this, each address is assigned a 48-bit address which is used to determine whether we can access a network or not.

A small company that does not have security staff wants to improve its security posture. Which of the following would BEST assist the company?

MSSP The company doesn't have IT Staff. So if they want security, they need a MSSP (Managed Security Service Provider). Managed Security Services Provider (MSSP) - a means of fully outsourcing responsibility for information assurance to a third party. This type of solution is expensive but can be a good fit for an SME that has experienced rapid growth and has no in-house security capability. Of course, this type of outsourcing places a huge amount of trust in the MSSP. Maintaining effective oversight of the MSSP requires a good degree of internal security awareness and expertise. There could also be significant challenges in industries exposed to high degrees of regulation in terms of information processing. A SOAR (Security Orchestration, Automation, and Response) would improve your security, but it's more oriented to the automation of an existing Incident Response plan. If you're thinking of implement a SOAR you're to likely already have a SOC (Security Operations Center), which it is, in a way, IT Staff.

A company processes highly sensitive data and senior management wants to protect the sensitive data by utilizing classification labels. Which of the following access control schemes would be BEST for the company to implement?

Mandatory

Which of the following organizational policies are MOST likely to detect fraud that is being conducted by existing employees? (Choose two.)

Mandatory vacation Job rotation

A company is adopting a BYOD policy and is looking for a comprehensive solution to protect company information on user devices. Which of the following solutions would BEST support the policy?

Mobile device management

A network administrator has been asked to design a solution to improve a company's security posture The administrator is given the following, requirements? - The solution must be inline in the network - The solution must be able to block known malicious traffic - The solution must be able to stop network-based attacks Which of the following should the network administrator implement to BEST meet these requirements?

NIPS

A network engineer needs to create a plan for upgrading the wireless infrastructure in a large office Priority must be given to areas that are currently experiencing latency and connection issues. Which of the following would be the BEST resource for determining the order of priority?

Network diagrams

A security administrator suspects there may be unnecessary services running on a server. Which of the following tools will the administrator MOST likely use to confirm the suspicions?

Nmap Nmap, or Network Mapper, is a network scanning and security auditing tool that is commonly used to discover and map network resources, such as servers and devices, and to identify the services running on those resources. It can be used to scan a single host or a range of hosts to determine which ports are open and which services are running on those ports. This information can be used to identify services that may be unnecessary or potentially insecure, and to take appropriate action to mitigate any security risks. In this case, the administrator can use Nmap to scan the server and confirm whether there are any unnecessary services running on it.

Which of the following secure coding techniques makes compromised code more difficult for hackers to use?

Obfuscation Explanation: Obfuscation is the action of making something obscure, unclear, or unintelligible. In software development, obfuscation is the act of creating code that is difficult for humans or computers to understand.

A retail executive recently accepted a job with a major competitor. The following week, a security analyst reviews the security logs and identifies successful logon attempts to access the departed executive's accounts. Which of the following security practices would have addressed the issue?

Offboarding

A company recently set up an e-commerce portal to sell its product online. The company wants to start accepting credit cards for payment, which requires compliance with a security standard. Which of the following standards must the company comply with before accepting credit cards on its e-commerce platform?

PCI DSS Additionally, many organizations should abide by certain standards. For example, organizations handling credit card information need to comply with the Payment Card Industry Data Security Standard (PCI DSS). PCI DSS includes six control objectives and 12 specific requirements that help prevent fraud.

An analyst needs to identify the applications a user was running and the files that were open before the user's computer was shut off by holding down the power button. Which of the following would MOST likely contain that information?

Pagefile In Digital Forensics, sometimes an investigator will literally pull the plug out of the wall to cause a hard shutdown and then access the drive for the pagefile because if you shut the PC down normally, the pagefile is cleared.

A network engineer has been asked to investigate why several wireless barcode scanners and wireless computers in a warehouse have intermittent connectivity to the shipping server. The barcode scanners and computers are all on forklift trucks and move around the warehouse during their regular use. Which of the following should the engineer do to determine the issue? (Choose two.)

Perform a site survey Create a heat map

Joe, an employee, receives an email stating he won the lottery. The email includes a link that requests a name, mobile phone number, address, and date of birth be provided to confirm Joe's identity before sending him the prize. Which of the following BEST describes this type of email?

Phishing "The email includes a link that requests a name, mobile phone number, address, and date of birth" its way to vague for it to be spear phishing. If it was a spear phishing, then the attacker should already know his name and Joe just need to fill out mobile phone number, address, and date of birth.

Which of the following types of controls is a turnstile?

Physical

Which of the following would MOST likely be a result of improperly configured user accounts?

Privilege escalation

A healthcare company is revamping its IT strategy in light of recent regulations. The company is concerned about compliance and wants to use a pay-per-use model. Which of the following is the BEST solution?

Public SaaS Ex: "Pay per use" in this regard is like your electric Bill where you pay for how much of their services you use. You have to pay for Software as a Service and it must be public as well.

A smart retail business has a local store and a newly established and growing online storefront. A recent storm caused a power outage to the business and the local ISP, resulting in several hours of lost sales and delayed order processing. The business owner now needs to ensure two things: - Protection from power outages - Always-available connectivity In case of an outage The owner has decided to implement battery backups for the computer equipment Which of the following would BEST fulfill the owner's second need?

Purchase services from a cloud provider for high availability

A company is implementing MFA for all applications that store sensitive data. The IT manager wants MFA to be non-disruptive and user friendly. Which of the following technologies should the IT manager use when implementing MFA?

Push notifications

A security administrator needs to create a RAIS configuration that is focused on high read speeds and fault tolerance. It is unlikely that multiple drivers will fail simultaneously. Which of the following RAID configurations should the administration use?

RAID 5

A critical file server is being upgraded and the systems administrator must determine which RAID level the new server will need to achieve parity and handle two simultaneous disk failures. Which of the following RAID levels meets this requirements?

RAID 6

A junior systems administrator noticed that one of two hard drives in a server room had a red error notification. The administrator removed the hard drive to replace it but was unaware that the server was configured in an array. Which of the following configurations would ensure no data is lost?

RAID 1

An organization suffered an outage and a critical system took 90 minutes to come back online. Though there was no data loss during the outage, the expectation was that the critical system would be available again within 60 minutes. Which of the following is the 60- minute expectation an example of:

RTO

Which of the following is a team of people dedicated testing the effectiveness of organizational security programs by emulating the techniques of potential attackers?

Red team Explanation: Red team--performs the offensive role to try to infiltrate the target.

A company recently implemented a new security system. In the course of configuration, the security administrator adds the following entry: #Whitelist USB\VID13FE&PID_4127&REV_0100 Which of the following security technologies is MOST likely being configured?

Removable media control

A cybersecurity analyst needs to implement secure authentication to third-party websites without users' passwords. Which of the following would be the BEST way to achieve this objective?

SAML

An organization with a low tolerance for user inconvenience wants to protect laptop hard drives against loss or data theft. Which of the following would be the MOST acceptable?

SED SED (self-encrypting drive) would be the most acceptable option for an organization with a low tolerance for user inconvenience that wants to protect laptop hard drives against loss or data theft. SEDs are hardware-based encryption devices that automatically encrypt data on a hard drive without requiring any additional input or configuration from the user. This means that the user does not have to perform any additional steps to encrypt their data, which can help to prevent data loss or theft. By contrast, other options like HSM (hardware security module), DLP (data loss prevention), and TPM (trusted platform module) may require more user involvement and may not be as convenient for users.

Which of the following should be put in place when negotiating with a new vendor about the timeliness of the response to a significant outage or incident?

SLA

A security administrator currently spends a large amount of time on common security tasks, such aa report generation, phishing investigations, and user provisioning and deprovisioning This prevents the administrator from spending time on other security projects. The business does not have the budget to add more staff members. Which of the following should the administrator implement?

SOAR

Which of the following is MOST likely to outline the roles and responsibilities of data controllers and data processors?

SSAE SOC 2 Statement on Standards for Attestation Engagements. This AICPA-developed auditing report assesses how well organizations handle data security, system privacy, data confidentiality and data processing processes.

The Chief Security Officer (CSO) at a major hospital wants to implement SSO to help improve in the environment patient data, particularly at shared terminals. The Chief Risk Officer (CRO) is concerned that training and guidance have been provided to frontline staff, and a risk analysis has not been performed. Which of the following is the MOST likely cause of the CRO's concerns?

SSO would reduce the resilience and availability of system if the provider goes offline.

A small business just recovered from a ransomware attack against its file servers by purchasing the decryption keys from the attackers. The issue was triggered by a phishing email and the IT administrator wants to ensure it does not happen again. Which of the following should the IT administrator do FIRST after recovery?

Scan the NAS for residual or dormant malware and take new daily backups that are tested on a frequent basis Explanation: The reason the company had to pay the ransom is because they did not have valid backups, otherwise they would have just restored their data. If your company just had to pay ransom and your boss says, "Don't let this happen again", what is the first thing you are going to do. The only action after a ransomware attack is "restore from backup".

The CSIRT is reviewing the lessons learned from a recent incident. A worm was able to spread unhindered throughout the network and infect a large number of computers and servers. Which of the following recommendations would be BEST to mitigate the impacts of a similar incident in the future?

Segment the network with firewalls.

An organization is concerned about video emissions from users' desktops. Which of the following is the BEST solution to implement?

Screen filters

The following is an administrative control that would be MOST effective to reduce the occurrence of malware execution?

Security awareness training Explanation: Security awareness training is the administrative control that would be MOST effective to reduce the occurrence of malware execution. Malware is often introduced to an organization's network through human error, such as clicking on a malicious link or downloading an infected file. Security awareness training can help educate employees on how to identify and avoid common malware threats, such as phishing attacks, and provide best practices for safe browsing and downloading.

A company needs to centralize its logs to create a baseline and have visibility on its security events. Which of the following technologies will accomplish this objective?

Security information and event management

A large industrial system's smart generator monitors the system status and sends alerts to thirdparty maintenance personnel when critical failures occur. While reviewing the network logs the company's security manager notices the generator's IP is sending packets to an internal file server's IP. Which of the following mitigations would be BEST for the security manager to implement while maintaining alerting capabilities?

Segmentation

Which of the following policies would help an organization identify and mitigate potential single points of failure in the company's IT/security operations?

Separation of duties

Which of the following refers to applications and systems that are used within an organization without consent or approval?

Shadow IT

The IT department at a university is concerned about professors placing servers on the university network in an attempt to bypass security controls. Which of the following BEST represents this type of threat?

Shadow IT Shadow IT is the use of information technology systems, devices, software, applications, and services without explicit IT department approval.

A user recent an SMS on a mobile phone that asked for bank delays. Which of the following social-engineering techniques was used in this case?

Smishing Explanation: SPIM is unwanted messages sent over instant messaging (IM) channels, Vishing is VOIP, Spear phishing is targeting a specific group or individual via email.

The president of a company that specializes in military contracts receives a request for an interview. During the interview, the reporter seems more interested in discussing the president's family life and personal history than the details of a recent company success. Which of the following security concerns is this MOST likely an example of?

Social engineering

An organization discovers that unauthorized applications have been installed on companyprovided mobile phones. The organization issues these devices, but some users have managed to bypass the security controls. Which of the following is the MOST likely issue, and how can the organization BEST prevent this from happening?

Some advanced users are jailbreaking the OS and bypassing the controls. Implement an MDM solution to control access to company resources.

A network engineer notices the VPN concentrator overloaded and crashes on days when there are a lot of remote workers. Senior management has placed greater importance on the availability of VPN resources for the remote workers than the security of the end users' traffic. Which of the following would be BEST to solve this issue?

Split tunneling Explanation: Some programs need VPN protection, while others can directly access the internet. Split tunneling is an advanced VPN feature that lets you choose which programs and apps should have a secure VPN tunnel and which could benefit from faster speeds and access to local services. This feature reduces traffic overload on HQ servers and company data centers and helps save costs for hardware.

The IT department's on-site developer has been with the team for many years. Each time an application is released, the security team is able to identify multiple vulnerabilities. Which of the following would BEST help the team ensure the application is ready to be released to production?

Submit the application to QA before releasing it.

During a security audit of a company's network, unsecure protocols were found to be in use.

TLS1.2

A host was infected with malware. During the incident response, Joe, a user, reported that he did not receive any emails with links, but he had been browsing the Internet all day. Which of the following would MOST likely show where the malware originated?

The DNS logs Why is DNS Monitoring Important? An effective system of DNS monitoring is critical to the reliability of your website, as well as the security and trust of your users. Because the DNS is a popular target for hackers, it's important to keep a close eye for any malicious attacks on your domains and services.

A financial analyst is expecting an email containing sensitive information from a client. When the email arrives, the analyst receives an error and is unable to open the encrypted message. Which of the following is the MOST likely cause of the issue?

The S/MME plug-in is not enabled.

A company's bank has reported that multiple corporate credit cards have been stolen over the past several weeks. The bank has provided the names of the affected cardholders to the company's forensics team to assist in the cyber-incident investigation. An incident responder learns the following information: - The timeline of stolen card numbers corresponds closely with affected users making Internet-based purchases from diverse websites via enterprise desktop PCs. - All purchase connections were encrypted, and the company uses an SSL inspection proxy for the inspection of encrypted traffic of the hardwired network. - Purchases made with corporate cards over the corporate guest WiFi network, where no SSL inspection occurs, were unaffected. Which of the following is the MOST likely root cause?

The SSL inspection proxy is feeding events to a compromised SIEM

An organization has decided to host its web application and database in the cloud. Which of the following BEST describes the security concerns for this decision?

The cloud vendor is a new attack vector within the supply chain

An organization's policy requires users to create passwords with an uppercase letter, lowercase letter, number, and symbol. This policy is enforced with technical controls, which also prevents users from using any of their previous 12 passwords. The quantization does not use single sign-on, nor does it centralize storage of passwords. The incident response team recently discovered that passwords for one system were compromised. Passwords for a completely separate system have NOT been compromised, but unusual login activity has been detected fc that separate system. Account login has been detected for users who are on vacation. Which of the following BEST describes what is happening?

The compromised password file has been brute-force hacked, and the complexity requirements are not adequate to mitigate this risk.

A Chief Executive Officer's (CEO) personal information was stolen in a social engineering attack. Which of the following sources would reveal if the CEO's personal information is for sale?

The dark web Explanation: The dark web is where you go for the purchase of illegal items.

Under GDPR, which of the following is MOST responsible for the protection of privacy and website user rights?

The data controller Explanation: In GDPR and other privacy laws, the data controller has the most responsibility when it comes to protecting the privacy and rights of the data's subject, such as the user of a website.

Which of the following BEST explains the difference between a data owner and a data custodian?

The data owner is responsible for determining how the data may be used, while the data custodian is responsible for implementing the protection to the data

Which of the following BEST explains the reason why a server administrator would place a document named password.txt on the desktop of an administrator account on a server?

The document is a honeyfile and is meant to attract the attention of a cyberintruder.

After a ransomware attack a forensics company needs to review a cryptocurrency transaction between the victim and the attacker. Which of the following will the company MOST likely review to trace this transaction?

The public ledger

A security auditor is reviewing vulnerability scan data provided by an internal security team. Which of the following BEST indicates that valid credentials were used?

The scan enumerated software versions of installed programs

An auditor is performing an assessment of a security appliance with an embedded OS that was vulnerable during the last two assessments. Which of the following BEST explains the appliance's vulnerable state?

The vendor has not supplied a patch for the appliance.

After reading a security bulletin, a network security manager is concerned that a malicious actor may have breached the network using the same software flaw. The exploit code is publicly available and has been reported as being used against other industries in the same vertical. Which of the following should the network security manager consult FIRST to determine a priority list for forensic review?

The vulnerability scan output

A user recently attended an exposition and received some digital promotional materials. The user later noticed blue boxes popping up and disappearing on the computer, and reported receiving several spam emails, which the user did not open. Which of the following is MOST likely the cause of the reported issue?

There was malicious code on the USB drive

A security analyst is using a recently released security advisory to review historical logs, looking for the specific activity that was outlined in the advisory. Which of the following is the analyst doing?

Threat hunting

Which of the following is the purpose of a risk register?

To identify the risk, the risk owner, and the risk measures The Risk Register displays a list of all risks recorded and displays various risk details, including the residual risk level, risk source, risk owner, risk stage, and the treatment status of the risk. The question ask for purpose. So C is the purpose, while A is only part of the risk register work.

Which of the following is the BEST use of a WAF?

To protect sites on web servers that are publicly accessible

A website developer is working on a new e-commerce website and has asked an information security expert for the most appropriate way to store credit card numbers to create an easy reordering process. Which of the following methods would BEST accomplish this goal?

Tokenizing the credit cards in the database Explanation: Credit card tokenization is the process of de-identifying sensitive cardholder data by converting it to a string of randomly generated numbers called a "token." Similar to encryption, tokenization obfuscates the original data to render it unreadable in the event of a data breach or other exposure.

In which of the following risk management strategies would cybersecurity insurance be used?

Transference

When selecting a technical solution for identity management, an architect chooses to go from an in-house to a third-party SaaS provider. Which of the following risk management strategies is this an example of?

Transference Explanation: Risk Transference refers to the shifting of the burden of loss for a risk to another party through legislation, contract, insurance or other means.

A company has just experienced a malware attack affecting a large number of desktop users. The antivirus solution was not able to block the malware, but the HIDS alerted to C2 calls as 'Troj.Generic'. Once the security team found a solution to remove the malware, they were able to remove the malware files successfully, and the HIDS stopped alerting. The next morning, however, the HIDS once again started alerting on the same desktops, and the security team discovered the files were back. Which of the following BEST describes the type of malware infecting this company's network?

Trojan

After entering a username and password, and administrator must gesture on a touch screen. Which of the following demonstrates what the administrator is providing?

Two-factor authentication

The SOC is reviewing process and procedures after a recent incident. The review indicates it took more than 30 minutes to determine that quarantining an infected host was the best course of action. The allowed the malware to spread to additional hosts before it was contained. Which of the following would be BEST to improve the incident response process?

Updating the playbooks with better decision points

A cybersecurity department purchased o new PAM solution. The team is planning to randomize the service account credentials of the Windows server first. Which of the following would be the BEST method to increase the security on the Linux server?

Use SSH keys and remove generic passwords

Which of the following is an example of federated access management?

Using a popular website login to provide access to another website

Which of the following describes the ability of code to target a hypervisor from inside a guest OS?

VM escape Virtual machine escape is an exploit in which the attacker runs code on a VM that allows an operating system running within it to break out and interact directly with the hypervisor.

On which of the following is the live acquisition of data for forensic analysis MOST dependent? (Choose two.)

Value and volatility of data Right-to-audit clauses

A company uses wireless tor all laptops and keeps a very detailed record of its assets, along with a comprehensive list of devices that are authorized to be on the wireless network. The Chief Information Officer (CIO) is concerned about a script kiddie potentially using an unauthorized device to brute force the wireless PSK and obtain access to the internal network. Which of the following should the company implement to BEST prevent this from occurring?

WPA-EAP Explanation: "EAP is in wide use. For example, in IEEE 802.11 (WiFi) the WPA and WPA2 standards have adopted IEEE 802.1X (with various EAP types) as the canonical authentication mechanism." https://en.wikipedia.org/wiki/Extensible_Authentication_Protocol The Wi-Fi Alliance added EAP-FAST (along with EAP-TLS and EAP-TTLS) to its list of supported protocols for WPA/WPA2 in 2010. Source: https://jaimelightfoot.com/blog/comptia-securitywireless-security/ "EAP has been expanded into multiple versions." · "The Wi-Fi Alliance added PEAP to its list of supported protocols for WPA/WPA2/WPA3." · "The Wi-Fi Alliance added EAPFAST to its list of supported protocols for WPA/WPA2/WPA3." · "The Wi-Fi Alliance added EAPTTLS to its list of supported protocols for WPA/WPA2/WPA3."

Company engineers regularly participate in a public Internet forum with other engineers throughout the industry. Which of the following tactics would an attacker MOST likely use in this scenario?

Watering-hole attack Explanation: An attack in which an attacker targets specific groups or organizations, discovers which websites they frequent, and injects malicious code into those sites.

A security assessment determines DES and 3DES at still being used on recently deployed production servers. Which of the following did the assessment identify?

Weak encryption

Which of the following will MOST likely adversely impact the operations of unpatched traditional programmable-logic controllers, running a back-end LAMP server and OT systems with human management interfaces that are accessible over the Internet via a web interface? (Choose two.)

Weak encryption Server-side request forgery

The Chief Financial Officer (CFO) of an insurance company received an email from Ann, the company's Chief Executive Officer (CEO), requesting a transfer of $10,000 to an account. The email states Ann is on vacation and has lost her purse, containing cash and credit cards. Which of the following social- engineering techniques is the attacker using?

Whaling

A company wants to deploy PKI on its Internet-facing website. The applications that are currently deployed are: - www.company.com (main website) - contactus.company.com (for locating a nearby location) - quotes.company.com (for requesting a price quote) The company wants to purchase one SSL certificate that will work for all the existing applications and any future applications that follow the same naming conventions, such as store.company.com. Which of the following certificate types would BEST meet the requirements?

Wildcard

An organization has hired a security analyst to perform a penetration test. The analyst captures 1Gb worth of inbound network traffic to the server and transfer the pcap back to the machine for analysis. Which of the following tools should the analyst use to further review the pcap?

Wireshark

Which of the following BEST describes a security exploit for which a vendor patch is not readily available?

Zero-day

A commercial cyber-threat intelligence organization observes IoCs across a variety of unrelated customers. Prior to releasing specific threat intelligence to other paid subscribers, the organization is MOST likely obligated by contracts to:

anonymize any PII that is observed within the IoC data.

The exploitation of a buffer-overrun vulnerability in an application will MOST likely lead to:

arbitrary code execution.

A security administrator suspects an employee has been emailing proprietary information to a competitor. Company policy requires the administrator to capture an exact copy of the employee's hard disk. Which of the following should the administrator use?

dd

A preventive control differs from a compensating control in that a preventive control is:

designed to specifically mitigate a risk. Ex: Preventative controls are designed to be implemented prior to a threat event and reduce and/or avoid the likelihood and potential impact of a successful threat event. Examples of preventative controls include policies, standards, processes, procedures, encryption, firewalls, and physical barriers.

A security analyst is performing a packet capture on a series of SOAP HTTP requests for a security assessment. The analyst redirects the output to a file After the capture is complete, the analyst needs to review the first transactions quickly and then search the entire series of requests for a particular string. Which of the following would be BEST to use to accomplish the task? (Choose two.)

head grep Ex: "Head" to display the first transactions

A cybersecurity analyst reviews the log files from a web server and sees a series of files that indicates a directory-traversal attack has occurred. Which of the following is the analyst MOST likely seeing?

http://sample.url.com/someotherpageonsite/../../../etc/shadow Explanation: According to Dion Training, whenever you see "../../../../.." is directory traversal

A transitive trust:

is automatically established between a parent and a child.

Moving laterally within a network once an initial exploit is used to gain persistent access for the purpose of establishing further control of a system is known as:

persistence

A symmetric encryption algorithm is BEST suited for:

protecting large amounts of data. Explanation: Symmetric encryption is a means of protecting data using a secret key to encrypt (lock) and decrypt (unlock) it. The sender and recipient share the key or password to gain access to the information. The key can be a word; a phrase; or a nonsensical or random string of letters, numbers, and symbols.