SYO-701 Practice C

Last updated about 2 years ago

91 questions

1

Library

SYO-701 Practice C

Last updated about 2 years ago

91 questions

1

Option 1

1

Classify the following traffic flows as ALLOWED or BLOCKED through the firewall:

	ALLOWED	BLOCKED
Use a secure terminal to connect to 10.1.10.88
Share the desktop on server 10.1.10.120
Perform a DNS query from 10.1.10.88 to 9.9.9.9
View web pages on 10.1.10.120
Authenticate to an LDAP server at 10.1.10.61
Synchronize the clock on a server at 10.1.10.17

Match the device to the description. Some device types will not be used.

	WAF	MDM	Proxy Server	Router	Load balancer	Jump server	Sensor	IPS
Block SQL injection over an Internet connection
Intercept all browser requests and cache the results
Forward packets between separate VLANs
Configure a group of redundant web servers
Evaluate the in put to a browser-based application

Match the attack type to the characteristic:

	Phishing	Rootkit	Brute force	Injection	Replay	DDoS
A website stops responding to normal requests
Data is captured and retransmitted to a server
The malware is designed to remain hidden on a computer system
A list of passwords are attempted with a known username
An email link redirects a user to a site that requests login credentials
Permissions are circumvented by adding additional code as application input

Match the cryptography technology to the description:

	Salting	Asymmetric	Collision	Key stretching	Masking	Steganography
Create a stronger key using multiple processes
Data is hidden within another media type
Different inputs create the same hash
Sensitive data is hidden from view
A different key is used for decryption than encryption
Information is added to make a unique hash

Add the most applicable security technologies to the following scenarios:

	Sandboxing	NGFW	SD-WAN	VPN	802.1X
A field service engineer uses their corporate laptop at coffee shops and hotels
Software developers run a series of tests before deploying an application
An administrator prevents employees from visiting known-malicious websites
Directly access cloud-based services from all corporate locations
Users connecting to the network should use their corporate authentication credentials

A finance company is legally required to maintain seven years of tax records for all of their customers. Which of the following would be the BEST way to implement this requirement?

Automate a script to remove all tax information more than seven years old

Print and store all tax records in a seven-year cycle

Allow users to download tax records from their account login

Create a separate daily backup archive for all applicable tax records

A system administrator is designing a data center for an insurance company’s new public cloud and would like to automatically rotate encryption keys on a regular basis. Which of the following would provide this functionality?

TPM (Trusted Platform Module)

Key management system

Secure enclave

XDR (Extended Detection and Response)

Option 1

A newly installed IPS is flagging a legitimate corporate application as malicious network traffic. Which of the following would be the BEST way to resolve this issue?

Disable the IPS signature

Block the application

Log all IPS events

Tune the IPS alerts

A security administrator has identified an internally developed application which allows modification of SQL queries through the web-based frontend. Which of the following changes would resolve this vulnerability?

Store all credentials as salted hashes

Verify the application's digital signature

Validate all application input

Obfuscate the application's source code

A system administrator is implementing a fingerprint scanner to provide access to the data center. Which of the following authentication technologies would be associated with this access?

Digital signature

Hard authentication token

Security key

Something you are

The IT department of a transportation company maintains an on-site inventory of chassis-based network switch interface cards. If a failure occurs, the on-site technician can replace the interface card and have the system running again in sixty minutes. Which of the following BEST describes this recovery metric?

MTBF (Mean Time Between Failures)

MTTR (Mean Time To Restore)

RPO (Recovery Point Objective)

RTO (Recovery Time Objective)

A company maintains a server farm in a large data center. These servers are used internally and are not accessible from outside of the data center. The security team has discovered a group of servers was breached before the latest security patches were applied. Breach attempts were not logged on any other servers. Which of these threat actors would be MOST likely involved in this breach?

Organized crime

Insider

Nation state

Unskilled attacker

An organization has received a vulnerability scan report of their Internet-facing web servers. The report shows the servers have multiple Sun Java Runtime Environment (JRE) vulnerabilities, but the server administrator has verified that JRE is not installed. Which of the following would be the BEST way to handle this report?

Install the latest version of JRE on the server

Quarantine the server and scan for malware

Harden the operating system of the web server

Ignore the JRE vulnerability alert

A user downloaded and installed a utility for compressing and decompressing files. Immediately after installing the utility, the user’s overall workstation performance degraded and it now takes twice as much time to perform any tasks on the computer. Which of the following is the BEST description of this malware infection?

Ransomware

Bloatware

Logic bomb

Trojan

Which of the following is the process for replacing sensitive data with a non-sensitive and functional placeholder?

Steganography

Tokenization

Retention

Masking

A security administrator has installed a new firewall to protect a web server VLAN. The application owner requires all web server sessions communicate over an encrypted channel. Which rule should the security administrator add to the firewall rulebase?

Source: ANY, Destination: ANY, Protocol: TCP, Port: 23, Deny

Source: ANY, Destination: ANY, Protocol: TCP, Port: 22, Allow

Source: ANY, Destination: ANY, Protocol: TCP, Port: 80, Allow

Source: ANY, Destination: ANY, Protocol: TCP, Port: 443, Allow

Which of these would be used to provide multi-factor authentication?

USB-connected storage drive with FDE

Employee policy manual

Just-in-time permissions

Smart card with picture ID

A company's network team has been asked to build an IPsec tunnel to a new business partner. Which of the following security risks would be the MOST important to consider?

Supply chain attack

Unsupported systems

Business email compromise

Typosquatting

A company's human resources team maintains a list of all employees participating in the corporate savings plan. A third-party financial company uses this information to manage stock investments for the employees. Which of the following would describe this financial company?

Processor

Owner

Controller

Custodian

A technology company is manufacturing a military-grade radar tracking system designed to identify any nearby unmanned aerial vehicles (UAVs). The UAV detector must be able to instantly identify and react to a vehicle without delay. Which of the following would BEST describe this tracking system?

RTOS (Real-Time Operating System)

IoT (Internet of Things)

ICS (Industrial Control System)

SDN (Software Defined Network)

An administrator is writing a script to convert an email message to a help desk ticket and assign the ticket to the correct department. Which of the following should be administrator use to complete this script?

Role-based access controls

Federation

Due diligence

Orchestration

A security administrator would like a report showing how many attackers are attempting to use a known vulnerability to gain access to a corporate web server. Which of the following should be used to gather this information?

Application log

Metadata

IPS log

Windows log

During a ransomware outbreak, an organization was forced to rebuild database servers from known good backup systems. In which of the following incident response phases were these database servers brought back online?

Recovery

Lessons learned

Containment

Detection

A security administrator is installing a web server with a newly built operating system. Which of the following would be the best way to harden this OS?

Create a backup schedule

Install a device certificate

Remove unnecessary software

Disable power management features

A network IPS has created this log entry: Frame 4: 937 bytes on wire (7496 bits), 937 bytes captured Ethernet II, Src: HewlettP_82:d8:31, Dst: Cisco_a1:b0:d1 Internet Protocol Version 4, Src: 172.16.22.7, Dst: 10.8.122.244 Transmission Control Protocol, Src Port: 3863, Dst Port: 1433 Application Data: SELECT * FROM users WHERE username='x' or 'x'='x' AND password='x' or 'x'='x' Which of the following would describe this log entry?

Phishing

Brute force

SQL injection

Cross-site scripting

An incident response team would like to validate their disaster recovery plans without making any changes to the infrastructure. Which of the following would be the best course of action?

Tabletop exercise

Hot site fail-over

Simulation

Classify the following traffic flows as ALLOWED or BLOCKED through the firewall:

ALLOWED

BLOCKED

Use a secure terminal to connect to 10.1.10.88

Share the desktop on server 10.1.10.120

Perform a DNS query from 10.1.10.88 to 9.9.9.9

View web pages on 10.1.10.120

Authenticate to an LDAP server at 10.1.10.61

Synchronize the clock on a server at 10.1.10.17

Match the device to the description. Some device types will not be used.

WAF

MDM

Proxy Server

Router

Load balancer

Jump server

Sensor

IPS

Block SQL injection over an Internet connection

Intercept all browser requests and cache the results

Forward packets between separate VLANs

Configure a group of redundant web servers

Evaluate the in put to a browser-based application

Match the attack type to the characteristic:

Phishing

Rootkit

Brute force

Injection

Replay

DDoS

A website stops responding to normal requests

Data is captured and retransmitted to a server

The malware is designed to remain hidden on a computer system

A list of passwords are attempted with a known username

An email link redirects a user to a site that requests login credentials

Permissions are circumvented by adding additional code as application input

Match the cryptography technology to the description:

Salting

Asymmetric

Collision

Key stretching

Masking

Steganography

Create a stronger key using multiple processes

Data is hidden within another media type

Different inputs create the same hash

Sensitive data is hidden from view

A different key is used for decryption than encryption

Information is added to make a unique hash

Add the most applicable security technologies to the following scenarios:

Sandboxing

NGFW

SD-WAN

VPN

802.1X

A field service engineer uses their corporate laptop at coffee shops and hotels

Software developers run a series of tests before deploying an application

An administrator prevents employees from visiting known-malicious websites

Directly access cloud-based services from all corporate locations

Users connecting to the network should use their corporate authentication credentials

A finance company is legally required to maintain seven years of tax records for all of their customers. 

Which of the following would be the BEST way to implement this requirement?

Automate a script to remove all tax information more than seven years old

Print and store all tax records in a seven-year cycle

Allow users to download tax records from their account login

Create a separate daily backup archive for all applicable tax records

A system administrator is designing a data center for an insurance company’s new public cloud and would like to automatically rotate encryption keys on a regular basis. 

Which of the following would provide this functionality?

TPM (Trusted Platform Module)

Key management system

Secure enclave

XDR (Extended Detection and Response)

A newly installed IPS is flagging a legitimate corporate application as malicious network traffic. 

Which of the following would be the BEST way to resolve this issue?

Disable the IPS signature

Block the application

Log all IPS events

Tune the IPS alerts

A security administrator has identified an internally developed application which allows modification of SQL queries through the web-based frontend. 

Which of the following changes would resolve this vulnerability?

Store all credentials as salted hashes

Verify the application's digital signature

Validate all application input

Obfuscate the application's source code

A system administrator is implementing a fingerprint scanner to provide access to the data center. 

Which of the following authentication technologies would be associated with this access?

Digital signature

Hard authentication token

Security key

Something you are

The IT department of a transportation company maintains an on-site inventory of chassis-based network switch interface cards. If a failure occurs, the on-site technician can replace the interface card and have the system running again in sixty minutes. 

Which of the following BEST describes this recovery metric?

MTBF (Mean Time Between Failures)

MTTR (Mean Time To Restore)

RPO (Recovery Point Objective)

RTO (Recovery Time Objective)

A company maintains a server farm in a large data center. These servers are used internally and are not accessible from outside of the data center. The security team has discovered a group of servers was breached before the latest security patches were applied. Breach attempts were not logged on any other servers. 

Which of these threat actors would be MOST likely involved in this breach?

Organized crime

Insider

Nation state

Unskilled attacker

An organization has received a vulnerability scan report of their Internet-facing web servers. The report shows the servers have multiple Sun Java Runtime Environment (JRE) vulnerabilities, but the server administrator has verified that JRE is not installed. 

Which of the following would be the BEST way to handle this report?

Install the latest version of JRE on the server

Quarantine the server and scan for malware

Harden the operating system of the web server

Ignore the JRE vulnerability alert

A user downloaded and installed a utility for compressing and decompressing files. Immediately after installing the utility, the user’s overall workstation performance degraded and it now takes twice as much time to perform any tasks on the computer. 

Which of the following is the BEST description of this malware infection?

Ransomware

Bloatware

Logic bomb

Trojan

Which of the following is the process for replacing sensitive data with a non-sensitive and functional placeholder?

Steganography

Tokenization

Retention

Masking

A security administrator has installed a new firewall to protect a web server VLAN. The application owner requires all web server sessions communicate over an encrypted channel. 

Which rule should the security administrator add to the firewall rulebase?

Source: ANY, Destination: ANY, Protocol: TCP, Port: 23, Deny

Source: ANY, Destination: ANY, Protocol: TCP, Port: 22, Allow

Source: ANY, Destination: ANY, Protocol: TCP, Port: 80, Allow

Source: ANY, Destination: ANY, Protocol: TCP, Port: 443, Allow

Which of these would be used to provide multi-factor authentication?

USB-connected storage drive with FDE

Employee policy manual

Just-in-time permissions

Smart card with picture ID

A company's network team has been asked to build an IPsec tunnel to a new business partner. 

Which of the following security risks would be the MOST important to consider?

Supply chain attack

Unsupported systems

Business email compromise

Typosquatting

A company's human resources team maintains a list of all employees participating in the corporate savings plan. A third-party financial company uses this information to manage stock investments for the employees. 

Which of the following would describe this financial company?

Processor

Owner

Controller

Custodian

A technology company is manufacturing a military-grade radar tracking system designed to identify any nearby unmanned aerial vehicles (UAVs). The UAV detector must be able to instantly identify and react to a vehicle without delay. 

Which of the following would BEST describe this tracking system?

RTOS (Real-Time Operating System)

IoT (Internet of Things)

ICS (Industrial Control System)

SDN (Software Defined Network)

An administrator is writing a script to convert an email message to a help desk ticket and assign the ticket to the correct department. 

Which of the following should be administrator use to complete this script?

Role-based access controls

Federation

Due diligence

Orchestration

A security administrator would like a report showing how many attackers are attempting to use a known vulnerability to gain access to a corporate web server. 

Which of the following should be used to gather this information?

Application log

Metadata

IPS log

Windows log

During a ransomware outbreak, an organization was forced to rebuild database servers from known good backup systems. 

In which of the following incident response phases were these database servers brought back online?

Recovery

Lessons learned

Containment

Detection

A security administrator is installing a web server with a newly built operating system. 

Which of the following would be the best way to harden this OS?

Create a backup schedule

Install a device certificate

Remove unnecessary software

Disable power management features

A network IPS has created this log entry: 

Frame 4: 937 bytes on wire (7496 bits), 937 bytes captured Ethernet II, Src: HewlettP_82:d8:31, Dst: Cisco_a1:b0:d1 Internet Protocol Version 4, Src: 172.16.22.7, Dst: 10.8.122.244 Transmission Control Protocol, Src Port: 3863, Dst Port: 1433 Application Data: SELECT * FROM users WHERE username='x' or 'x'='x' AND password='x' or 'x'='x' 

Which of the following would describe this log entry?

Phishing

Brute force

SQL injection

Cross-site scripting

An incident response team would like to validate their disaster recovery plans without making any changes to the infrastructure. 

Which of the following would be the best course of action?

Tabletop exercise

Hot site fail-over

Simulation

Penetration test

A system administrator has installed a new firewall between the corporate user network and the data center network. When the firewall is turned on with the default settings, users complain the application in the data center is no longer working. 

Which of the following would be the BEST way to correct this application issue?

Create a single firewall rule with an explicit deny

Build a separate VLAN for the application

Create firewall rules that match the application traffic flow

Enable firewall threat blocking

Which of these would be used to provide HA for a web-based database application?

SIEM (Security Information and Event Management)

UPS (Uninterruptible Power Supply)

DLP (Data Loss Prevention)

VPN (Virtual Private Network) concentrator

Each year, a certain number of laptops are lost or stolen and must be replaced by the company. 

Which of the following would describe the total cost the company spends each year on laptop replacements?

SLE (Single Loss Expectancy)

SLA (Service Level Agreement)

ALE (Annual Loss Expectancy)

ARO (Annualized Rate of Occurrence)

A network administrator is viewing a log file from a web server: 

https://www.example.com/?s=/Index/think/ app/invokefunction&function=call_user_func_ array&vars[0]=md5&vars[1][0]=__HelloThinkPHP 

Which of the following would be the BEST way to prevent this attack?

Static code analyzer

Input validation

Allow list

Secure cookies

Sam would like to send an email to Jack and have Jack verify that Sam was the sender of the email. 

Which of these should Sam use to provide this verification?

Digitally sign with Sam’s private key

Digitally sign with Sam’s public key

Digitally sign with Jack’s private key

Digitally sign with Jack’s public key

The contract of a long-term temporary employee is ending. Which of these would be the MOST important part of the off-boarding process?

Perform an on-demand audit of the user’s privileges

Archive the decryption keys associated with the user account

Document the user’s outstanding tasks

Obtain a signed copy of the Acceptable Use Policies

A cybersecurity analyst has been asked to respond to a denial of service attack against a web server, and the analyst has collected the log files and data from the server. 

Which of the following would allow a future analyst to verify the data as original and unaltered?

E-discovery

Root cause analysis

Legal hold

Data hashing

A security administrator is reviewing authentication logs. The logs show a large number of accounts with at least three failed authentication attempts during the previous week. 

Which of the following would BEST explain this report data?

Downgrade attack

Phishing

Injection

Spraying

A security administrator has been asked to block all browsing to casino gaming websites. 

Which of the following would be the BEST way to implement this requirement?

Tune the IPS signatures

Block port tcp/443 on the firewall

Configure 802.1X for web browsing

Add a content filter rule

A company is experiencing downtime and outages when application patches and updates are deployed during the week. 

Which of the following would help to resolve these issues?

Onboarding considerations

Incident response policies

Change management procedures

Decentralized governance

A company is implementing a series of steps to follow when responding to a security event. 

Which of the following would provide this set of processes and procedures?

MDM (Mobile Device Management)

DLP (Data Loss Prevention)

Playbook

Zero trust

A transportation company maintains a scheduling application and a database in a virtualized cloud-based environment. 

Which of the following would be the BEST way to backup these services?

Journaling

Snapshot

RTOS (Real-Time Operating System)

Containerization

In an environment using discretionary access controls, which of these would control the rights and permissions associated with a file or directory?

Administrator

Owner

Group

System

A security administrator has installed a network-based DLP solution to determine if file transfers contain PII. 

Which of the following describes the data during the file transfer?

In-use

In-transit

Highly available

At-rest

A medical imaging company would like to connect all remote locations together with high speed network links. The network connections must maintain high throughput rates and must always be available during working hours. 

In which of the following should these requirements be enforced with the network provider?

Service level agreement

Memorandum of understanding

Non-disclosure agreement

Acceptable use policy

A company is implementing a security awareness program for their user community. Which of the following should be included for additional user guidance and training?

Daily firewall exception reporting

Information on proper password management

Periodic vulnerability scanning of external services

Adjustments to annualized loss expectancy

A security administrator is preparing a phishing email as part of a periodic employee security awareness campaign. The email is spoofed to appear as an unknown third-party and asks employees to immediately click a link or their state licensing will be revoked. 

Which of the following should be the expected response from the users?

Delete the message

Click the link and make a note of the URL

Forward the message to others in the department

Report the suspicious link to the help desk

A security administrator would like to minimize the number of certificate status checks made by web site clients to the certificate authority. 

Which of the following would be the BEST option for this requirement?

OCSP (Online Certificate Status Protocol) stapling

Self-signed certificates

CRL (Certificate Revocation List)

Wildcards

A company is concerned their EDR solution will not be able to stop more advanced ransomware variants. Technicians have created a backup and restore utility to get most systems up and running less than an hour after an attack. 

What type of security control is associated with this restore process?

Directive

Compensating

Preventive

Detective

To upgrade an internal application, the development team provides the operations team with instructions for backing up, patching the application, and reverting the patch if needed. The operations team schedules a date for the upgrade, informs the business divisions, and tests the upgrade process after completion. 

Which of the following describes this process?

Code signing

Continuity planning

Usage auditing

Change management

A company is implementing a public file-storage and cloud-based sharing service, and would like users to authenticate with an existing account on a trusted third-party web site. 

Which of the following should the company implement?

SSO (Single Sign-On)

Federation

Least privilege

Discretionary access controls

A system administrator is viewing this output from a file integrity monitoring report: 

15:43:01 - Repairing corrupted file C:\Windows\System32\kernel32.dll 15:43:03 - Repairing corrupted file C:\Windows\System32\netapi32.dll 15:43:07 - Repairing corrupted file C:\Windows\System32\user32.dll 15:43:43 - Repair complete   

Which of the following malware types is the MOST likely cause of this output?

Ransomware

Logic bomb

Rootkit

Keylogger

What type of vulnerability would be associated with this log information?

GET http://example.com/show.asp?view=../../Windows/ system.ini HTTP/1.1

Buffer overflow

Directory traversal

DoS (Denial of Service)

Cross-site scripting

A developer has created an application to store password information in a database. 

Which of the following BEST describes a way of protecting these credentials by adding random data to the password?

Hashing

Data masking

Salting

Asymmetric encryption

Which of the following processes provides ongoing building and testing of newly written code?

Continuous integration

Continuity of operations

Version control

Race condition

Which of the following BEST describes a responsibility matrix?

A visual summary of cloud provider accountability

Identification of tasks at each step of a project plan

A list of cybersecurity requirements based on the identified risks

Ongoing group discussions regarding cybersecurity

A security administrator is implementing an authentication system for the company. 

Which of the following would be the best choice for validating login credentials for all usernames and passwords in the authentication system?

CA (Certificate Authority)

SIEM (Security and Information Management)

LDAP (Lightweight Directory Access Protocol)

WAF (Web Application Firewall)

A technician is reviewing this information from an IPS log:

MAIN_IPS: 22June2023 09:02:50 reject 10.1.111.7 Alert: HTTP Suspicious Webdav OPTIONS Method Request; Host: Server Severity: medium; Performance Impact:3; Category: info-leak; Packet capture; disable Proto:tcp; dst:192.168.11.1; src:10.1.111.7

Which of the following can be associated with this log information? (Select TWO)

The attacker sent a non-authenticated BGP packet to trigger the IPS

The source of the attack is 192.168.11.1

The event was logged but no packets were dropped

The source of the attack is 10.1.111.7

The attacker sent an unusual HTTP packet to trigger the IPS

A company has contracted with a third-party to provide penetration testing services. The service includes a port scan of each externally-facing device. This is an example of:

Initial exploitation

Privilege escalation

Known environment

Active reconnaissance

An access point in a corporate headquarters office has the following configuration:

IP address: 10.1.10.1 Subnet mask: 255.255.255.0 DHCPv4 Server: Enabled SSID: Wireless Wireless Mode: 802.11n Security Mode: WEP-PSK Frequency band: 2.4 GHz Software revision: 2.1 MAC Address: 60:3D:26:71:FF:AA IPv4 Firewall: Enabled 

Which of the following would apply to this configuration?

Invalid frequency band

Weak encryption

Incorrect IP address and subnet mask

Invalid software version

An attacker has gained access to an application through the use of packet captures. 

Which of the following would be MOST likely used by the attacker?

Overflow

Forgery

Replay

Injection

A company is receiving complaints of slowness and disconnections to their Internet-facing web server. A network administrator monitors the Internet link and finds excessive bandwidth utilization from thousands of different IP addresses. 

Which of the following would be the MOST likely reason for these performance issues?

DDoS (Distributed Denial of Service)

DNS (Domain Name System) spoofing

RFID (Radio Frequency Identification) cloning

Wireless jamming

A company has created an itemized list of tasks to be completed by a third-party service provider. After the services are complete, this document will be used to validate the completion of the services. 

Which of the following would describe this agreement type?

SLA (Service Level Agreement)

SOW (Statement of Work)

NDA (Non-Disclosure Agreement)

BPA (Business Partners Agreement)

A company is deploying a series of internal applications to different cloud providers. 

Which of the following connection types should be deployed for this configuration?

Air-gapped

802.1X

Site-to-site IPsec VPN

Jump server

SD-WAN (Software Defined Networking in a Wide Area Network)

A company is updating components within the control plane of their zero-trust implementation. Which of the following would be part of this update?

Policy engine

Subjects

Policy enforcement point

Zone configurations

Which of the following malware types would cause a workstation to participate in a DDoS?

Bot

Logic bomb

Ransomware

Keylogger

Which of these are used to force the preservation of data for later use in court?

Chain of custody

Data loss prevention

Legal hold

E-discovery

A company would like to automatically monitor and report on any movement occurring in an open field at the data center. 

Which of the following would be the BEST choice for this task?

Bollard

Microwave sensor

Access control vestibule

Fencing

A company is releasing a new product, and part of the release includes the installation of load balancers to the public web site. 

Which of the following would best describe this process?

Platform diversity

Capacity planning

Multi-cloud systems

Permission restrictions

A system administrator would like to prove an email message was sent by a specific person. 

Which of the following describes the verification of this message source?

Non-repudiation

Key escrow

Asymmetric encryption

Steganography

A security administrator has created a policy to alert if a user modifies the hosts file on their system. 

Which of the following behaviors does this policy address?

Unexpected

Self-assessment

Unintentional

Risky

A company has identified a web server data breach resulting in the theft of financial records from 150 million customers. A security update to the company’s web server software was available for two months prior to the breach. 

Which of the following would have prevented this breach from occurring?

Patch management

Full disk encryption

Disabling unnecessary services

Application allow lists

During the onboarding process, the IT department requires a list of software applications associated with the new employee's job functions. 

 Which of the following would describe the use of this information?

Access control configuration

Encryption settings

Physical security requirements

Change management

A system administrator has identified an unexpected username on a database server, and the user has been transferring database files to an external server over the company’s Internet connection. The administrator then performed these tasks: 

• Physically disconnected the Ethernet cable on the database server 
• Disabled the unknown account 
• Configured a firewall rule to prevent file transfers from the server 

Which of the following would BEST describe this part of the incident response process?

Eradication

Containment

Lessons learned

Preparation

Which of the following would be the MOST effective use of asymmetric encryption?

Real-time video encryption

Securely store passwords

Protect data on mobile devices

Create a shared session key

Each salesperson in a company receives a laptop with applications and data to support their sales efforts. The IT manager would like to prevent third-parties from gaining access to this information if the laptop is stolen. 

Which of the following would be the BEST way to protect this data?

Remote wipe

Full disk encryption

Biometrics

VPN (Virtual Private Network)

A security administrator has compiled a list of all information stored and managed by an organization. 

Which of the following would best describe this list?

Sanitization

Metadata

Known environment

Data inventory

A security administrator would like to monitor all outbound Internet connections for malicious software. 

Which of the following would provide this functionality?

Jump server

IPsec tunnel

Forward proxy

Load balancer

What type of security control would be associated with corporate security policies?

Technical

Operational

Managerial

Physical

Which of the following would be the MOST significant security concern when protecting against organized crime?

Prevent users from posting passwords near their workstations

Require identification cards for all employees and guests

Maintain reliable backup data

Use access control vestibules at all data center locations

An application team has been provided with a hardened version of Linux to use with a new application installation, and this includes installing a web service and the application code on the server. 

Which of the following would BEST protect the application from attacks?

Build a backup server for the application

Run the application in a cloud-based environment

Implement a secure configuration of the web service

Send application logs to the SIEM via syslog

A system administrator has configured MAC filtering on their corporate access point, but access logs show unauthorized users accessing the network. 

Which of the following should the administrator configure to prevent future unauthorized use?

Enable WPA3 encryption

Remove unauthorized MAC addresses from the filter

Modify the SSID name

Modify the channel frequencies

A system administrator has been tasked with performing an application upgrade, but the upgrade has been delayed due to a different scheduled installation of an outdated device driver. 

Which of the following issues would best describe this change management delay?

Deny list

Legacy application

Dependency

Restricted activity

During an initial network connection, a supplicant communicates to an authenticator, which then sends an authentication request to an Active Directory database. 

Which of the following would BEST describe this authentication technology?

Federation

UTM (Unified Threat Management)

802.1X

PKI (Public Key Infrastructure)

A security researcher has been notified of a potential hardware vulnerability. 

Which of the following should the researcher evaluate as a potential security issue?

Firmware versions

Firewall configuration

SQL (Structured Query Language) requests

XSS (Cross-site Scripting) attachments

Visitors to a corporate data center must enter through the main doors of the building. 

Which of the following security controls would be the BEST choice to successfully guide people to the front door? (Select TWO)

Infrared sensors

Bollards

Biometrics

Fencing

Access badges

Video surveillance

A company's employees are required to authenticate each time a file share, printer, or SAN imaging system is accessed. 

Which of the following should be used to minimize the number of employee authentication requests?

SSO (Single Sign-On)

OSINT (Open Source Intelligence)

MFA (Multi-factor authentication)

SCAP (Security Content Automation Protocol)

A company has recently moved from one accounting system to another, and the new system includes integration with many other divisions of the organization. 

Which of the following would ensure that the correct access has been provided to the proper employees in each division?

Geolocation

Onboarding process

Account de-provisioning

Internal self-assessment

An attacker has circumvented a web-based application to send commands directly to a database. 

Which of the following would describe this attack type?

Downgrade

SQL injection

Cross-site scripting

On-path

A group of business partners is using blockchain technology to monitor and track raw materials and parts as they are transferred between companies. 

Where would a partner find these tracking details?

Ledger

HSM (Hardware Security Module)

SIEM (Security Information and Event Manager)

HIPS (Host-based Intrusion Prevention System)

A network technician at a bank has noticed a significant decrease in traffic to the bank's public website. After additional investigation, the technician finds that users are being directed to a web site which looks similar to the bank's site but is not under the bank's control. Flushing the local DNS cache and changing the DNS entry does not have any effect. 

Which of the following has most likely occurred?

DDoS (Distributed Denial of Service)

Disassociation attack

Buffer overflow

Domain hijacking

A company runs two separate applications in their data center. The security administrator has been tasked with preventing all communication between these applications. 

Which of the following would be the BEST way to implement this security requirement?

Firewall

SDN (Software Defined Networking)

Air gap

VLANs (Virtual Local Area Network)

A receptionist at a manufacturing company recently received an email from the CEO asking for a copy of the internal corporate employee directory. It was later determined that the email address was not sent from the CEO and the domain associated with the email address was not a corporate domain name. 

What type of training could help identify this type of attack in the future?

Recognizing social engineering

Proper password management

Securing remote work environments

Understanding insider threats

Which of the following deployment models would a company follow if they require individuals to use their personal phones for work purposes?

CYOD (Choose Your Own Device)

MDM (Mobile Device Manager)

BYOD (Bring Your Own Device)

COPE (Corporately Owned, Personally Enabled)