Log in
Sign up for FREE
arrow_back
Library

CompTIA Security+ SY0-701

star
star
star
star
star
Last updated over 1 year ago
318 questions
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Required
1
Question 1
1.

Question 2
2.

Question 3
3.

Question 4
4.

Question 5
5.

Question 6
6.

Question 7
7.

Question 8
8.

Question 9
9.

Question 10
10.

Question 11
11.

Question 12
12.

Question 13
13.

Question 14
14.

Question 15
15.

Question 16
16.

Required
1
Question 18
18.

Question 19
19.

Question 20
20.

Question 21
21.

Question 22
22.

Question 23
23.

Question 24
24.

Question 25
25.

Question 26
26.

Question 27
27.

Question 28
28.

Question 29
29.

Question 30
30.

Question 31
31.

Question 32
32.

Question 33
33.

Question 34
34.

Question 35
35.

Question 36
36.

Question 37
37.

Question 38
38.

Question 39
39.

Question 40
40.

Question 41
41.

Question 42
42.

Question 43
43.

Question 44
44.

Question 45
45.

Question 46
46.

Question 47
47.

Question 48
48.

Question 49
49.

Question 50
50.

Question 51
51.

Question 52
52.

Question 53
53.

Question 54
54.

Question 55
55.

Question 56
56.

Question 57
57.

Question 58
58.

Question 59
59.

Question 60
60.

Question 61
61.

Question 62
62.

Question 63
63.

Question 64
64.

Question 65
65.

Question 66
66.

Question 67
67.

Question 68
68.

Question 69
69.

Question 70
70.

Required
1
Question 72
72.

Question 73
73.

Question 74
74.

Question 75
75.

HOTSPOT - Select the appropriate attack and remediation from each drop-down list to label the corresponding attack with its remediation. INSTRUCTIONS - Not all attacks and remediation actions will be used. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Required
1
Required
1
Question 78
78.

Question 79
79.

Question 80
80.

Required
1
Question 82
82.

Question 83
83.

Question 84
84.

Question 85
85.

Question 86
86.

Question 87
87.

Question 88
88.

Question 89
89.

Question 90
90.

Question 91
91.

Question 92
92.

Question 93
93.

Question 94
94.

Question 95
95.

Question 96
96.

Question 97
97.

Question 98
98.

Question 99
99.

Question 100
100.

Question 101
101.

Question 102
102.

Question 103
103.

Question 104
104.

Question 105
105.

Question 106
106.

Question 107
107.

Question 108
108.

Question 109
109.

Question 110
110.

Question 111
111.

Question 112
112.

Question 113
113.

Question 114
114.

Question 115
115.

Question 116
116.

Question 117
117.

Question 118
118.

Question 119
119.

Question 120
120.

Question 121
121.

Question 122
122.

Question 123
123.

Question 124
124.

Question 125
125.

Question 126
126.

Question 127
127.

Question 128
128.

Question 129
129.

Question 130
130.

Question 131
131.

Question 132
132.

Question 133
133.

Question 134
134.

Question 135
135.

Question 136
136.

Question 137
137.

Question 138
138.

Question 139
139.

Question 140
140.

Question 141
141.

Question 142
142.

Question 143
143.

Question 144
144.

Question 145
145.

Question 146
146.

Question 147
147.

Question 148
148.

Question 149
149.

Question 150
150.

Question 151
151.

Question 152
152.

Question 153
153.

Question 154
154.

Question 155
155.

Question 156
156.

Question 157
157.

Question 158
158.

Question 159
159.

Question 160
160.

Question 161
161.

Question 162
162.

Question 163
163.

Question 164
164.

Question 165
165.

Question 166
166.

Question 167
167.

Question 168
168.

Question 169
169.

Question 170
170.

Question 171
171.

Question 172
172.

Question 173
173.

Question 174
174.

Question 175
175.

Question 176
176.

Question 177
177.

Question 178
178.

Question 179
179.

Question 180
180.

Question 181
181.

Question 182
182.

Question 183
183.

Question 184
184.

Question 185
185.

Question 186
186.

Question 187
187.

Question 188
188.

Question 189
189.

Question 190
190.

Question 191
191.

Question 192
192.

Question 193
193.

Question 194
194.

Question 195
195.

Question 196
196.

Question 197
197.

Question 198
198.

Question 199
199.

Question 200
200.

Question 201
201.

Question 202
202.

Question 203
203.

Question 204
204.

Question 205
205.

Question 206
206.

Question 207
207.

Question 208
208.

Question 209
209.

Question 210
210.

Question 211
211.

Question 212
212.

Question 213
213.

Question 214
214.

Question 215
215.

Question 216
216.

Question 217
217.

Question 218
218.

Question 219
219.

Question 220
220.

Question 221
221.

Question 222
222.

Question 223
223.

Question 224
224.

Question 225
225.

Question 226
226.

Question 227
227.

Question 228
228.

Question 229
229.

Question 230
230.

Question 231
231.

Question 232
232.

Question 233
233.

Question 234
234.

Question 235
235.

Question 236
236.

Question 237
237.

Question 238
238.

Question 239
239.

Question 240
240.

Question 241
241.

Question 242
242.

Question 243
243.

Question 244
244.

Question 245
245.

Question 246
246.

Question 247
247.

Question 248
248.

Question 249
249.

Question 250
250.

Question 251
251.

Question 252
252.

Question 253
253.

Question 254
254.

Question 255
255.

Question 256
256.

Question 257
257.

Question 258
258.

Question 259
259.

Question 260
260.

Question 261
261.

Question 262
262.

Question 263
263.

Question 264
264.

Question 265
265.

Question 266
266.

Question 267
267.

Question 268
268.

Question 269
269.

Question 270
270.

Question 271
271.

Question 272
272.

Question 273
273.

Question 274
274.

Question 275
275.

Question 276
276.

Question 277
277.

Question 278
278.

Question 279
279.

Question 280
280.

Question 281
281.

Question 282
282.

Question 283
283.

Question 284
284.

Question 285
285.

Question 286
286.

Question 287
287.

Question 288
288.

Question 289
289.

Question 290
290.

Question 291
291.

Question 292
292.

Question 293
293.

Question 294
294.

Question 295
295.

Question 296
296.

Question 297
297.

Question 298
298.

Question 299
299.

Question 300
300.

Question 301
301.

Question 302
302.

Question 303
303.

Question 304
304.

Question 305
305.

Question 306
306.

Question 307
307.

Question 308
308.

Question 309
309.

Question 310
310.

SIMULATION - A systems administrator is configuring a site-to-site VPN between two branch offices. Some of the settings have already been configured correctly. The systems administrator has been provided the following requirements as part of completing the configuration: • Most secure algorithms should be selected • All traffic should be encrypted over the VPN • A secret password will be used to authenticate the two VPN concentrators INSTRUCTIONS - Click on the two VPN Concentrators to configure the appropriate settings. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.







Question 311
311.

Question 312
312.

Question 313
313.

Question 314
314.

Question 315
315.

Question 316
316.

Question 317
317.

Question 318
318.

Which of the following threat actors is the most likely to be hired by a foreign government to attack critical systems located in other countries?
Unskilled attacker
Organized Crime
Hacktivist
Whistleblower
Which of the following is used to add extra complexity before using a one-way data transformation algorithm?
Steganography
Salting
Data Masking
Key Streching
An employee clicked a link in an email from a payment website that asked the employee to update contact information. The employee entered the log-in information but received a “page not found” error message. Which of the following types of social engineering attacks occurred?
Pretexting
Phishing
Typosquatting
Brand impersonation
An enterprise is trying to limit outbound DNS traffic originating from its internal network. Outbound DNS requests will only be allowed from one device with the IP address 10.50.10.25. Which of the following firewall ACLs will accomplish this goal?
Access list outbound permit 0.0.0.0/0 10.50.10.25/32 port 53 Access list outbound deny 0.0.0.0/0 0.0.0.0/0 port 53
Access list outbound permit 0.0.0.0/0 0.0.0.0/0 port 53 Access list outbound deny 0.0.0.0/0 10.50.10.25/32 port 53
Access list outbound permit 10.50.10.25/32 0.0.0.0/0 port 53 Access list outbound deny 0.0.0.0/0 0.0.0.0/0 port 53
Access list outbound permit 0.0.0.0/0 0.0.0.0/0 port 53 Access list outbound deny 10.50.10.25/32 0.0.0.0/0 port 53
A data administrator is configuring authentication for a SaaS application and would like to reduce the number of credentials employees need to maintain. The company prefers to use domain credentials to access new SaaS applications. Which of the following methods would allow this functionality?
PEAP
MFA
LEAP
SSO
Which of the following scenarios describes a possible business email compromise attack?
An employee receives an email with a link to a phishing site that is designed to look like the company’s email portal.
An employee receives a gift card request in an email that has an executive’s name in the display field of the email.
Employees who open an email attachment receive messages demanding payment in order to access files.
A service desk employee receives an email from the HR director asking for log-in credentials to a cloud administrator account.
A company prevented direct access from the database administrators’ workstations to the network segment that contains database servers. Which of the following should a database administrator use to access the database servers?
Load balancer
HSM
RADIUS
Jump server
An organization’s internet-facing website was compromised when an attacker exploited a buffer overflow. Which of the following should the organization deploy to best protect against similar attacks in the future?
SD-WAN
WAF
NGFW
TLS
An administrator notices that several users are logging in from suspicious IP addresses. After speaking with the users, the administrator determines that the employees were not logging in from those IP addresses and resets the affected users’ passwords. Which of the following should the administrator implement to prevent this type of attack from succeeding in the future?
Password complexity
Multifactor authentication
Access management
Permissions assignment
An employee receives a text message that appears to have been sent by the payroll department and is asking for credential verification. Which of the following social engineering techniques are being attempted? (Choose two.)
Smishing
Misinformation
Phishing
Vishing
Typosquatting
Impersonation
Several employees received a fraudulent text message from someone claiming to be the Chief Executive Officer (CEO). The message stated: “I’m in an airport right now with no access to email. I need you to buy gift cards for employee recognition awards. Please send the gift cards to following email address.” Which of the following are the best responses to this situation? (Choose two).
Add a smishing exercise to the annual company training.
Conduct a forensic investigation on the CEO’s phone.
Issue a general email warning to the company.
Have the CEO change phone numbers.
Cancel current employee recognition gift cards.
Implement mobile device management.
A company is required to use certified hardware when building networks. Which of the following best addresses the risks associated with procuring counterfeit hardware?
An in-depth penetration test of all suppliers and vendors
A thorough analysis of the supply chain
A legally enforceable corporate acquisition policy
A right to audit clause in vendor contracts and SOWs
Which of the following provides the details about the terms of a test with a third-party penetration tester?
Due diligence
Right to audit clause
Rules of engagement
Supply chain analysis
A penetration tester begins an engagement by performing port and service scans against the client environment according to the rules of engagement. Which of the following reconnaissance types is the tester performing?
Offensive
Defensive
Active
Passive
Which of the following is required for an organization to properly manage its restore process in the event of system failure?
SDLC
DRP
IRP
RPO
Which of the following vulnerabilities is associated with installing software outside of a manufacturer’s approved software repository?
Jailbreaking
Memory injection
Resource reuse
Side loading
Question 17
17.

An analyst is evaluating the implementation of Zero Trust principles within the data plane. Which of the following would be most relevant for the analyst to evaluate?
Secured zones
Subject role
Adaptive identity
Threat scope reduction
An engineer needs to find a solution that creates an added layer of security by preventing unauthorized access to internal company resources. Which of the following would be the best solution?
RDP server
Jump server
Hypervisor
Proxy server
A company’s web filter is configured to scan the URL for strings and deny access when matches are found. Which of the following search strings should an analyst employ to prohibit access to non-encrypted websites?
:443
encryption=off
http://
www.*.com
During a security incident, the security operations team identified sustained network traffic from a malicious IP address: 10.1.4.9. A security analyst is creating an inbound firewall rule to block the IP address from accessing the organization’s network. Which of the following fulfills this request?
access-list inbound permit ip source 10.1.4.9/32 destination 0.0.0.0/0
access-list inbound deny ip source 10.1.4.9/32 destination 0.0.0.0/0
access-list inbound deny ip source 0.0.0.0/0 destination 10.1.4.9/32
access-list inbound permit ip source 0.0.0.0/0 destination 10.1.4.9/32
A company needs to provide administrative access to internal resources while minimizing the traffic allowed through the security boundary. Which of the following methods is most secure?
Installing a WAF
Deploying a perimeter network
Utilizing single sign-on
Implementing a bastion host
A security analyst is reviewing alerts in the SIEM related to potential malicious network traffic coming from an employee’s corporate laptop. The security analyst has determined that additional data about the executable running on the machine is necessary to continue the investigation. Which of the following logs should the analyst use as a data source?
Application
Endpoint
Network
IPS/IDS
A cyber operations team informs a security analyst about a new tactic malicious actors are using to compromise networks. SIEM alerts have not yet been configured. Which of the following best describes what the security analyst should do to identify this behavior?
Digital forensics
Threat hunting
E-discovery
Incident response
A company purchased cyber insurance to address items listed on the risk register. Which of the following strategies does this represent?
Accept
Transfer
Mitigate
Avoid
A security administrator would like to protect data on employees’ laptops. Which of the following encryption techniques should the security administrator use?
Partition
Full disk
Asymmetric
Database
Which of the following security control types does an acceptable use policy best represent?
Compensating
Detective
Preventive
Corrective
An IT manager informs the entire help desk staff that only the IT manager and the help desk lead will have access to the administrator console of the help desk software. Which of the following security techniques is the IT manager setting up?
Employee monitoring
Configuration enforcement
Least privilege
Hardening
Which of the following is the most likely to be used to document risks, responsible parties, and thresholds?
Risk register
Risk analysis
Risk tolerance
Risk transfer
Which of the following should a security administrator adhere to when setting up a new set of firewall rules?
Incident response procedure
Business continuity plan
Disaster recovery plan
Change management procedure
A company is expanding its threat surface program and allowing individuals to security test the company’s internet-facing application. The company will compensate researchers based on the vulnerabilities discovered. Which of the following best describes the program the company is setting up?
Red team
Open-source intelligence
Bug bounty
Penetration testing
Which of the following threat actors is the most likely to use large financial resources to attack critical systems located in other countries?
Nation-state
Hacktivist
Unskilled attacker
Insider
Which of the following enables the use of an input field to run commands that can view or manipulate data?
Buffer overflow
Side loading
SQL injection
Cross-site scripting
Employees in the research and development business unit receive extensive training to ensure they understand how to best protect company data. Which of the following is the type of data these employees are most likely to use in day-to-day work activities?
Critical
Encrypted
Data in transit
Intellectual property
A company has begun labeling all laptops with asset inventory stickers and associating them with employee IDs. Which of the following security benefits do these actions provide? (Choose two.)
Users can be mapped to their devices when configuring software MFA tokens.
If a security incident occurs on the device, the correct employee can be notified.
The security team will be able to send user awareness training to the appropriate device.
When conducting penetration testing, the security team will be able to target the desired laptops.
Company data can be accounted for when the employee leaves the organization.
User-based firewall policies can be correctly targeted to the appropriate laptops.
A technician wants to improve the situational and environmental awareness of existing users as they transition from remote to in-office work. Which of the following is the best option?
Modify the content of recurring training.
Send out periodic security reminders.
Update the content of new hire documentation.
Implement a phishing campaign.
A newly appointed board member with cybersecurity knowledge wants the board of directors to receive a quarterly report detailing the number of incidents that impacted the organization. The systems administrator is creating a way to present the data to the board of directors. Which of the following should the systems administrator use?
Packet captures
Dashboard
Metadata
Vulnerability scans
A systems administrator receives the following alert from a file integrity monitoring tool:
The hash of the cmd.exe file has changed.
The systems administrator checks the OS logs and notices that no patches were applied in the last two months. Which of the following most likely occurred?
The end user changed the file permissions.
A snapshot of the file system was taken.
A rootkit was deployed.
A cryptographic collision was detected.
Which of the following roles, according to the shared responsibility model, is responsible for securing the company’s database in an IaaS model for a cloud environment?
Third-party vendor
Cloud provider
Client
DBA
A client asked a security company to provide a document outlining the project, the cost, and the completion time frame. Which of the following documents should the company provide to the client?
BPA
MSA
SOW
SLA
A security team is reviewing the findings in a report that was delivered after a third party performed a penetration test. One of the findings indicated that a web application form field is vulnerable to cross-site scripting. Which of the following application security techniques should the security analyst recommend the developer implement to prevent this vulnerability?
Input validation
Version control
Code signing
Secure cookies
Which of the following must be considered when designing a high-availability network? (Choose two).
Physical isolation
Attack surface
Ease of recovery
Ability to patch
Extensible authentication
Responsiveness
A technician needs to apply a high-priority patch to a production system. Which of the following steps should be taken first?
Create a change control request.
Move the system to a different network segment.
Air gap the system.
Apply the patch to the system.
Which of the following describes the reason root cause analysis should be conducted as part of incident response?
To eradicate any trace of malware on the network
To gather IoCs for the investigation
To prevent future incidents of the same nature
To discover which systems have been affected
Which of the following is the most likely outcome if a large bank fails an internal PCI DSS compliance assessment?
Sanctions
Fines
Audit findings
Reputation damage
A company is developing a business continuity strategy and needs to determine how many staff members would be required to sustain the business in the case of a disruption. Which of the following best describes this step?
Redundancy
Capacity planning
Geographic dispersion
Tabletop exercise
A company’s legal department drafted sensitive documents in a SaaS application and wants to ensure the documents cannot be accessed by individuals in high-risk countries. Which of the following is the most effective way to limit this access?
Data masking
Geolocation policy
Data sovereignty regulation
Encryption
Which of the following is a hardware-specific vulnerability?
SQL injection
Buffer overflow
Cross-site scripting
Firmware version
While troubleshooting a firewall configuration, a technician determines that a “deny any” policy should be added to the bottom of the ACL. The technician updates the policy, but the new policy causes several company servers to become unreachable. Which of the following actions would prevent this issue?
Including an “allow any” policy above the “deny any” policy
Disabling any intrusion prevention signatures on the “deny any” policy prior to enabling the new policy
Documenting the new policy in a change request and submitting the request to change management
Testing the policy in a non-production environment before enabling the policy in the production network
An organization is building a new backup data center with cost-benefit as the primary requirement and RTO and RPO values around two days. Which of the following types of sites is the best for this scenario?
Real-time recovery
Warm
Cold
Hot
A company requires hard drives to be securely wiped before sending decommissioned systems to recycling. Which of the following best describes this policy?
Enumeration
Inventory
Sanitization
Destruction
A systems administrator works for a local hospital and needs to ensure patient data is protected and secure. Which of the following data classifications should be used to secure patient data?
Critical
Sensitive
Public
Private
A U.S.-based cloud-hosting provider wants to expand its data centers to new international locations. Which of the following should the hosting provider consider first?
Time zone differences in log correlation
Local data protection regulations
Risks from hackers residing in other countries
Impacts to existing contractual obligations
Which of the following would be the best way to block unknown programs from executing?
Host-based firewall
Access control list
Application allow list
DLP solution
A company hired a consultant to perform an offensive security assessment covering penetration testing and social engineering. Which of the following teams will conduct this assessment activity?
Purple
White
Red
Blue
A software development manager wants to ensure the authenticity of the code created by the company. Which of the following options is the most appropriate?
Testing input validation on the user input fields
Ensuring secure cookies are use
Performing static code analysis on the software
Performing code signing on company-developed software
Which of the following can be used to identify potential attacker activities without affecting production servers?
Honeypot
Zero Trust
Geofencing
Video surveillance
During an investigation, an incident response team attempts to understand the source of an incident. Which of the following incident response activities describes this process?
Lessons learned
Analysis
Containment
Detection
A security practitioner completes a vulnerability assessment on a company’s network and finds several vulnerabilities, which the operations team remediates. Which of the following should be done next?
Initiate a penetration test.
Conduct an audit
Submit a report.
Rescan the network.
An administrator was notified that a user logged in remotely after hours and copied large amounts of data to a personal device.
Which of the following best describes the user’s activity?
External audit
Insider threat
Phishing campaign
Penetration testing
Which of the following allows for the attribution of messages to individuals?
Access logs
Adaptive identity
Authentication
Non-repudiation
Which of the following is the best way to consistently determine on a daily basis whether security settings on servers have been modified?
Automation
Attestation
Manual audit
Compliance checklist
Which of the following tools can assist with detecting an employee who has accidentally emailed a file containing a customer’s PII?
NetFlow
DLP
Antivirus
SCAP
Which of the following tools can assist with detecting an employee who has accidentally emailed a file containing a customer’s PII?
Identify embedded keys
Code debugging
Static code analysis
Input validation
A security analyst and the management team are reviewing the organizational performance of a recent phishing campaign. The user click-through rate exceeded the acceptable risk threshold, and the management team wants to reduce the impact when a user clicks on a link in a phishing message. Which of the following should the analyst do?
Implement email security filters to prevent phishing emails from being delivered.
Place posters around the office to raise awareness of common phishing activities.
Create additional training for users to recognize the signs of phishing attempts.
Update the EDR policies to block automatic execution of downloaded programs.
Which of the following has been implemented when a host-based firewall on a legacy Linux system allows connections from only specific internal IP addresses?
SNMP traps
Network segmentation
Transfer of risk
Compensating control
The management team notices that new accounts that are set up manually do not always have correct access or permissions. Which of the following automation techniques should a systems administrator use to streamline account creation?
User provisioning script
Guard rail script
Escalation script
Ticketing workflow
A company is planning to set up a SIEM system and assign an analyst to review the logs on a weekly basis. Which of the following types of controls is the company setting up?
Preventive
Deterrent
Corrective
Detective
A systems administrator is looking for a low-cost application-hosting solution that is cloud-based. Which of the following meets these requirements?
SD-WAN
SDN
Serverless framework
Type 1 hypervisor
A security operations center determines that the malicious activity detected on a server is normal. Which of the following activities describes the act of ignoring detected activity in the future?
Quarantining
Archiving
Aggregating
Tuning
Question 71
71.

A company is concerned about weather events causing damage to the server room and downtime. Which of the following should the company consider?
Geographic dispersion
Off-site backups
Load balancers
Clustering servers
Which of the following is a primary security concern for a company setting up a BYOD program?
VM escape
Buffer overflow
Jailbreaking
End of life
A company decided to reduce the cost of its annual cyber insurance policy by removing the coverage for ransomware attacks.

Which of the following analysis elements did the company most likely use in making this decision?
MTTR
MTBF
ARO
RTO
Which of the following is the most likely to be included as an element of communication in a security awareness program?
Verifying information when modifying wire transfer data
Detecting insider threats using anomalous behavior recognition
Performing social engineering as part of third-party penetration testing
Reporting phishing attempts or other suspicious activities
Question 76
76.
HOTSPOT - You are a security administrator investigating a potential infection on a network. INSTRUCTIONS - Click on each host and firewall. Review all logs to determine which host originated the infection and then identify if each remaining host is clean or infected. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Question 77
77.
192.168.10.22 = __________
192.168.10.37 = __________
192.168.10.41 = __________
10.10.9.12 = __________
10.10.9.18 = __________
Which of the following is the phase in the incident response process when a security analyst reviews roles and responsibilities?
Analysis
Lessons learned
Preparation
Recovery
After a recent vulnerability scan, a security engineer needs to harden the routers within the corporate network. Which of the following is the most appropriate to disable?
Routing protocols
VLANs
Console access
Web-based administration
A security administrator needs a method to secure data in an environment that includes some form of checks so track any changes. Which of the following should the administrator set up to achieve this goal?
GPO
SPF
FIM
NAC
Question 81
81.

A security engineer is implementing FDE for all laptops in an organization. Which of the following are the most important for the engineer to consider as part of the planning process? (Choose two.)
Data tokenization
Public key management
Digital signatures
Key escrow
Certificate authority linking
TPM presence
A security analyst scans a company's public network and discovers a host is running a remote desktop that can be used to access the production network. Which of the following changes should the security analyst recommend?
Changing the remote desktop port to a non-standard number
Setting up a VPN and placing the jump server inside the firewall
Connecting the remote server to the domain and increasing the password length
Using a proxy for web connections from the remote desktop server
An enterprise has been experiencing attacks focused on exploiting vulnerabilities in older browser versions with well-known exploits. Which of the following security solutions should be configured to best provide the ability to monitor and block these known signature-based attacks?
IPS
DLP
IDS
ACL
Security controls in a data center are being reviewed to ensure data is properly protected and that human life considerations are included. Which of the following best describes how the controls should be set up?
Safety controls should fail open
Logging controls should fail open
Logical security controls should fail closed
Remote access points should fail closed
Which of the following would be best suited for constantly changing environments?
Embedded systems
Containers
SCADA
RTOS
Which of the following incident response activities ensures evidence is properly handled?
E-discovery
Legal hold
Chain of custody
Preservation
An accounting clerk sent money to an attacker's bank account after receiving fraudulent instructions to use a new account. Which of the following would most likely prevent this activity in the future?
Updating processes for sending wire transfers
Standardizing security incident reporting
Implementing insider threat detection measures
Executing regular phishing campaigns
A systems administrator is creating a script that would save time and prevent human error when performing account creation for a large number of end users. Which of the following would be a good use case for this task?
Policy enforcement
Orchestration
Off-the-shelf software
Baseline
A company's marketing department collects, modifies, and stores sensitive customer data. The infrastructure team is responsible for securing the data while in transit and at rest. Which of the following data roles describes the customer?
Subject
Owner
Custodian
Processor
Which of the following describes the maximum allowance of accepted risk?
Risk level
Risk threshold
Risk score
Risk indicator
A security analyst receives alerts about an internal system sending a large amount of unusual DNS queries to systems on the internet over short periods of time during non-business hours. Which of the following is most likely occurring?
Ransomware is encrypting files.
Data is being exfiltrated.
A worm is propagating across the network.
A logic bomb is deleting data.
A technician is opening ports on a firewall for a new system being deployed and supported by a SaaS provider. Which of the following is a risk in the new system?
Vulnerable software
Default credentials
Non-segmented network
Supply chain vendor
A systems administrator is working on a solution with the following requirements:
• Provide a secure zone. • Enforce a company-wide access control policy. • Reduce the scope of threats.
Which of the following is the systems administrator setting up?
AAA
Zero Trust
CIA
Non-repudiation
Which of the following involves an attempt to take advantage of database misconfigurations?
SQL injection
Memory injection
Buffer overflow
VM escape
Which of the following is used to validate a certificate when it is presented to a user?
CSR
CRC
CA
OCSP
One of a company's vendors sent an analyst a security bulletin that recommends a BIOS update. Which of the following vulnerability types is being addressed by the patch?
Application
Virtualization
Firmware
Operating system
Which of the following is used to quantitatively measure the criticality of a vulnerability?
CIA
CVSS
CVE
CERT
Which of the following actions could a security engineer take to ensure workstations and servers are properly monitored for unauthorized changes and software?
Configure all systems to log scheduled tasks.
Collect and monitor all traffic exiting the network.
Block traffic based on known malicious signatures.
Install endpoint management software on all systems
An organization is leveraging a VPN between its headquarters and a branch location. Which of the following is the VPN protecting?
Data in use
Data in transit
Geographic restrictions
Data sovereignty
After reviewing the following vulnerability scanning report:

A security analyst performs the following test:

Which of the following would the security analyst conclude for this reported vulnerability?
It is considered noise
Compensating controls exist
A rescan is required
It is a false positive
An organization disabled unneeded services and placed a firewall in front of a business-critical legacy system. Which of the following best describes the actions taken by the organization?
Segmentation
Exception
Compensating controls
Risk transfer
A security consultant needs secure, remote access to a client environment. Which of the following should the security consultant most likely use to gain access?
EAP
NAT
DHCP
IPSec
Which of the following should a systems administrator use to ensure an easy deployment of resources within the cloud provider?
Internet of Things
Software as a service
Software-defined networking
Infrastructure as code
After a security awareness training session, a user called the IT help desk and reported a suspicious call. The suspicious caller stated that the Chief Financial Officer wanted credit card information in order to close an invoice. Which of the following topics did the user recognize from the training?
Email phishing
Insider threat
Social engineering
Executive whaling
A security administrator is deploying a DLP solution to prevent the exfiltration of sensitive customer data. Which of the following should the administrator do first?
Create a rule to block outgoing email attachments.
Apply classifications to the data.
Block access to cloud storage websites.
Remove all user permissions from shares on the file server.
An administrator assists the legal and compliance team with ensuring information about customer transactions is archived for the proper time period. Which of the following data policies is the administrator carrying out?
Compromise
Transfer
Inventory
Analysis
Retention
A company is working with a vendor to perform a penetration test. Which of the following includes an estimate about the number of hours required to complete the engagement?
BPA
SLA
NDA
SOW
A Chief Information Security Officer (CISO) wants to explicitly raise awareness about the increase of ransomware-as-a-service in a report to the management team. Which of the following best describes the threat actor in the CISO’s report?
Nation-state
Organized crime
Insider threat
Hacktivist
Which of the following practices would be best to prevent an insider from introducing malicious code into a company's development process?
Code scanning for vulnerabilities
Peer review and approval
Quality assurance testing
Open-source component usage
Which of the following can best protect against an employee inadvertently installing malware on a company system?
Host-based firewall
Application allow list
Least privilege
System isolation
A company is adding a clause to its AUP that states employees are not allowed to modify the operating system on mobile devices. Which of the following vulnerabilities is the organization addressing?
Cross-site scripting
Jailbreaking
Side loading
Buffer overflow
Which of the following would be the best ways to ensure only authorized personnel can access a secure facility? (Choose two.)
Sign-in sheet
Video surveillance
Access control vestibule
Fencing
Badge access
Sensor
An organization would like to store customer data on a separate part of the network that is not accessible to users on the main corporate network. Which of the following should the administrator use to accomplish this goal?
Encryption
Patching
Isolation
Segmentation
Which of the following is the most common data loss path for an air-gapped network?
Unsecured Bluetooth
Unpatched OS
Bastion host
Removable devices
Malware spread across a company's network after an employee visited a compromised industry blog. Which of the following best describes this type of attack?
Smishing
Disinformation
Watering-hole
Impersonation
An organization is struggling with scaling issues on its VPN concentrator and internet circuit due to remote work. The organization is looking for a software solution that will allow it to reduce traffic on the VPN and internet circuit, while still providing encrypted tunnel access to the data center and monitoring of remote employee internet traffic. Which of the following will help achieve these objectives?
Building a load-balanced VPN solution with redundant internet
Purchasing a low-cost SD-WAN solution for VPN traffic
Deploying a SASE solution to remote employees
Using a cloud provider to create additional VPN concentrators
Which of the following is the best reason to complete an audit in a banking environment?
Organizational change
Self-assessment requirement
Regulatory requirement
Service-level requirement
Which of the following security concepts is the best reason for permissions on a human resources fileshare to follow the principle of least privilege?
Integrity
Availability
Confidentiality
Non-repudiation
Which of the following are cases in which an engineer should recommend the decommissioning of a network device? (Choose two.)
The device has been moved from a production environment to a test environment.
The device is moved to an isolated segment on the enterprise network.
The device is configured to use cleartext passwords.
The device is moved to a different location in the enterprise.
The device is unable to receive authorized updates.
The device's encryption level cannot meet organizational standards.
A company is required to perform a risk assessment on an annual basis. Which of the following types of risk assessments does this requirement describe?
Continuous
Recurring
One time
Ad hoc
After a recent ransomware attack on a company's system, an administrator reviewed the log files. Which of the following control types did the administrator use?
Detective
Detective
Corrective
Compensating
Which of the following exercises should an organization use to improve its incident response process?
Tabletop
Replication
Recovery
Failover
Which of the following best ensures minimal downtime and data loss for organizations with critical computing equipment located in earthquake-prone areas?
Generators and UPS
High availability networking
Redundant cold sites
Off-site replication
A newly identified network access vulnerability has been found in the OS of legacy IoT devices. Which of the following would best mitigate this vulnerability quickly?
Segmentation
Insurance
Replacement
Patching
After an audit, an administrator discovers all users have access to confidential data on a file server. Which of the following should the administrator use to restrict access to the data quickly?
Access control lists
Group Policy
Content filtering
Data loss prevention
A client demands at least 99.99% uptime from a service provider's hosted security services. Which of the following documents includes the information the service provider should return to the client?
SOW
SLA
MOA
MOU
A company is discarding a classified storage array and hires an outside vendor to complete the disposal. Which of the following should the company request from the vendor?
Classification
Inventory list
Proof of ownership
Certification
A company is planning a disaster recovery site and needs to ensure that a single natural disaster would not result in the complete loss of regulated backup data. Which of the following should the company consider?
Hot site
Platform diversity
Geographic dispersion
Load balancing
A security analyst locates a potentially malicious video file on a server and needs to identify both the creation date and the file's creator. Which of the following actions would most likely give the security analyst the information required?
Check endpoint logs.
Query the file's metadata.
Use hexdump on the file's contents.
Obtain the file's SHA-256 hash.
Which of the following teams combines both offensive and defensive testing techniques to protect an organization's critical systems?
Yellow
Blue
Purple
Red
A small business uses kiosks on the sales floor to display product information for customers. A security team discovers the kiosks use end-of-life operating systems. Which of the following is the security team most likely to document as a security implication of the current architecture?
Patch availability
Product software compatibility
Ease of recovery
Cost of replacement
Which of the following would help ensure a security analyst is able to accurately measure the overall risk to an organization when a new vulnerability is disclosed?
Documentation of system classifications
A list of system owners and their departments
A full inventory of all hardware and software
Third-party risk assessment documentation
Which of the following best practices gives administrators a set period to perform changes to an operational system to ensure availability and minimize business impacts?
Impact analysis
Backout plan
Change management boards
Scheduled downtime
A company must ensure sensitive data at rest is rendered unreadable. Which of the following will the company most likely use?
Segmentation
Tokenization
Hashing
Encryption
A legacy device is being decommissioned and is no longer receiving updates or patches. Which of the following describes this scenario?
End of testing
End of business
End of life
End of support
A bank insists all of its vendors must prevent data loss on stolen laptops. Which of the following strategies is the bank requiring?
Permission restrictions
Encryption at rest
Data classification
Masking
A company's end users are reporting that they are unable to reach external websites. After reviewing the performance data for the DNS severs, the analyst discovers that the CPU, disk, and memory usage are minimal, but the network interface is flooded with inbound traffic. Network logs show only a small number of DNS queries sent to this server. Which of the following best describes what the security analyst is seeing?
On-path resource consumption
Secure DNS cryptographic downgrade
Concurrent session usage
Reflected denial of service
A systems administrator wants to prevent users from being able to access data based on their responsibilities. The administrator also wants to apply the required access structure via a simplified format. Which of the following should the administrator apply to the site recovery resource group?
ACL
RBAC
GPO
SAML
During the onboarding process, an employee needs to create a password for an intranet account. The password must include ten characters, numbers, and letters, and two special characters. Once the password is created, the company will grant the employee access to other company-owned websites based on the intranet profile. Which of the following access management concepts is the company most likely using to safeguard intranet accounts and grant access to multiple sites based on a user's intranet account? (Choose two.)
Default password changes
Federation
Password manager
Open authentication
Password complexity
Identity proofing
Which of the following describes a security alerting and monitoring tool that collects system, application, and network logs from multiple sources in a centralized system?
SIEM
IDS
DLP
SNMP
A network manager wants to protect the company's VPN by implementing multifactor authentication that uses: Something you know - Something you have - Something you are -
Which of the following would accomplish the manager's goal?
VPN IP address, company ID, facial structure
Password, authentication token, thumbprint
Company URL, TLS certificate, home address
Domain name, PKI, GeoIP lookup
Which of the following would be the best way to handle a critical business application that is running on a legacy server?
Isolation
Hardening
Segmentation
Decommissioning
Which of the following vulnerabilities is exploited when an attacker overwrites a register with a malicious address?
Race condition
Buffer overflow
SQL injection
VM escape
After a company was compromised, customers initiated a lawsuit. The company's attorneys have requested that the security team initiate a legal hold in response to the lawsuit. Which of the following describes the action the security team will most likely be required to take?
Retain any communications between security members during the breach response.
Retain all emails from the company to affected customers for an indefinite period of time.
Retain any communications related to the security breach until further notice.
Retain the emails between the security team and affected customers for 30 days.
Which of the following describes the process of concealing code or text inside a graphical image?
Hashing
Data masking
Steganography
Symmetric encryption
An employee receives a text message from an unknown number claiming to be the company’s Chief Executive Officer and asking the employee to purchase several gift cards. Which of the following types of attacks does this describe?
Vishing
Smishing
Pretexting
Phishing
Which of the following risk management strategies should an enterprise adopt first if a legacy application is critical to business operations and there are preventative controls that are not yet implemented?
Accept
Transfer
Mitigate
Avoid
Visitors to a secured facility are required to check in with a photo ID and enter the facility through an access control vestibule. Which of the following best describes this form of security control?
Managerial
Physical
Operational
Technical
The local administrator account for a company's VPN appliance was unexpectedly used to log in to the remote management interface. Which of the following would have most likely prevented this from happening?
Assigning individual user IDs
Changing the default password
Using least privilege
Reviewing logs more frequently
Which of the following is the best way to secure an on-site data center against intrusion from an insider?
Access badgeMotion sensor
Bollards
Video surveillance
Motion Sensor
An engineer moved to another team and is unable to access the new team's shared folders while still being able to access the shared folders from the former team. After opening a ticket, the engineer discovers that the account was never moved to the new group. Which of the following access controls is most likely causing the lack of access?
Role-based
Discretionary
Least privilege
Time of day
Which of the following factors are the most important to address when formulating a training curriculum plan for a security awareness program? (Choose two.)
Channels by which the organization communicates with customers
Retraining requirements for individuals who fail phishing simulations
The reporting mechanisms for ethics violations
Cadence and duration of training events
Threat vectors based on the industry in which the organization operates
Secure software development training for all personnel
A network administrator is working on a project to deploy a load balancer in the company's cloud environment. Which of the following fundamental security requirements does this project fulfil?
Availability
Confidentiality
Privacy
Integrity
A systems administrator is changing the password policy within an enterprise environment and wants this update implemented on all systems as quickly as possible. Which of the following operating system security measures will the administrator most likely use?
Updating EDR profiles
Enabling PAP
Pushing GPO update
Deploying PowerShell scripts
Which of the following would be most useful in determining whether the long-term cost to transfer a risk is less than the impact of the risk?
RTO
SLE
ALE
RPO
ARO
In order to strengthen a password and prevent a hacker from cracking it, a random string of 36 characters was added to the password. Which of the following best describes this technique?
Salting
Key stretching
Tokenization
Data masking
A technician is deploying a new security camera. Which of the following should the technician do?
Perform a vulnerability scan.
Conduct a site survey.
Disable unnecessary ports.
Configure the correct VLAN.
A company is experiencing a web services outage on the public network. The services are up and available but inaccessible. The network logs show a sudden increase in network traffic that is causing the outage. Which of the following attacks is the organization experiencing?
Buffer overflow
ARP poisoning
DDoS
Brute force
Which of the following threat actors is the most likely to be motivated by profit?
Hacktivist
Organized crime
Insider threat
Shadow IT
An organization experiences a cybersecurity incident involving a command-and-control server. Which of the following logs should be analyzed to identify the impacted host? (Choose two.)
Database
Firewall
Authentication
Application
Network
DHCP
During a penetration test, a vendor attempts to enter an unauthorized area using an access badge. Which of the following types of tests does this represent?
Defensive
Offensive
Physical
Passive
A systems administrator uses a key to encrypt a message being sent to a peer in a different branch office. The peer then uses the same key to decrypt the message. Which of the following describes this example?
Salting
Symmetric
Hashing
Asymmetric
A visitor plugs a laptop into a network jack in the lobby and is able to connect to the company's network. Which of the following should be configured on the existing network infrastructure to best prevent this activity?
Web application firewall
Port security
Transport layer security
Virtual private network
A security administrator is reissuing a former employee's laptop. Which of the following is the best combination of data handling activities for the administrator to perform? (Choose two.)
Certification
Sanitization
Data retention
Destruction
Enumeration
Classification
A systems administrator would like to deploy a change to a production system. Which of the following must the administrator submit to demonstrate that the system can be restored to a working state in the event of a performance issue?
Backout plan
Test procedure
Approval procedure
Impact analysis
A company is redesigning its infrastructure and wants to reduce the number of physical servers in use. Which of the following architectures is best suited for this goal?
Virtualization
Segmentation
Microservices
Serverless
A bank set up a new server that contains customers' PII. Which of the following should the bank use to make sure the sensitive data is not modified?
File integrity monitoring
Full disk encryption
User behavior analytics
Network access control
Users at a company are reporting they are unable to access the URL for a new retail website because it is flagged as gambling and is being blocked. Which of the following changes would allow users to access the site?
Updating the categorization in the content filter
Configuring the IPS to allow shopping
Tuning the DLP rule that detects credit card data
Creating a firewall rule to allow HTTPS traffic
Which of the following most impacts an administrator's ability to address CVEs discovered on a server?
Patch availability
Organizational impact
Rescanning requirements
Risk tolerance
Which of the following describes effective change management procedures?
Using a spreadsheet for tracking changes
Approving the change after a successful deployment
Using an automatic change control bypass for security updates
Having a backout plan when a patch fails
The CIRT is reviewing an incident that involved a human resources recruiter exfiltrating sensitive company data. The CIRT found that the recruiter was able to use HTTP over port 53 to upload documents to a web server. Which of the following security infrastructure devices could have identified and blocked this activity?
WAF utilizing SSL decryption
UTM utilizing a threat feed
NGFW utilizing application inspection
SD-WAN utilizing IPSec
An enterprise is working with a third party and needs to allow access between the internal networks of both parties for a secure file migration. The solution needs to ensure encryption is applied to all traffic that is traversing the networks. Which of the following solutions should most likely be implemented?
EAP
IPSec
SD-WAN
TLS
An administrator has identified and fingerprinted specific files that will generate an alert if an attempt is made to email these files outside of the organization. Which of the following best describes the tool the administrator is using?
DLP
SNMP traps
SCAP
IPS
A software developer released a new application and is distributing application files via the developer's website. Which of the following should the developer post on the website to allow users to verify the integrity of the downloaded files?
Hashes
Certificates
Salting
Algorithms
An organization wants to limit potential impact to its log-in database in the event of a breach. Which of the following options is the security team most likely to recommend?
Hashing
Segmentation
Tokenization
Obfuscation
An administrator finds that all user workstations and servers are displaying a message that is associated with files containing an extension of .ryk. Which of the following types of infections is present on the systems?
Trojan
Virus
Spyware
Ransomware
A systems administrator is advised that an external web server is not functioning property. The administrator reviews the following firewall logs containing traffic going to the web server:


Which of the following attacks is likely occurring?
Brute-force
Directory traversal
HTTPS downgrade
DDoS
An organization would like to calculate the time needed to resolve a hardware issue with a server. Which of the following risk management processes describes this example?
Recovery point objective
Mean time between failures
Mean time to repair
Recovery time objective
A security engineer is installing an IPS to block signature-based attacks in the environment. Which of the following modes will best accomplish this task?
Sensor
Monitor
Audit
Active
An IT manager is increasing the security capabilities of an organization after a data classification initiative determined that sensitive data could be exfiltrated from the environment. Which of the following solutions would mitigate the risk?
DLP
XDR
DMARC
SPF
Which of the following is used to protect a computer from viruses, malware, and Trojans being installed and moving laterally across the network?
IDS
ACL
NAC
EDR
Client files can only be accessed by employees who need to know the information and have specified roles in the company. Which of the following best describes this security concept?
Availability
Confidentiality
Integrity
Non-repudiation
Which of the following describes the category of data that is most impacted when it is lost?
Confidential
Private
Critical
Public
A new employee logs in to the email system for the first time and notices a message from human resources about onboarding. The employee hovers over a few of the links within the email and discovers that the links do not correspond to links associated with the company. Which of the following attack vectors is most likely being used?
Unsecured network
Default credentials
Business email
Social engineering
Which of the following describes the understanding between a company and a client about what will be provided and the accepted time needed to provide the company with the resources?
BPA
MOA
SLA
MOU
A company that is located in an area prone to hurricanes is developing a disaster recovery plan and looking at site considerations that allow the company to immediately continue operations. Which of the following is the best type of site for this company?
Hot
Tertiary
Cold
Warm
Which of the following security controls is most likely being used when a critical legacy server is segmented into a private network?
Corrective
Preventive
Compensating
Deterrent
Which of the following best describes the practice of researching laws and regulations related to information security operations within a specific industry?
Due diligence
GDPR
Compliance reporting
Attestation
Which of the following considerations is the most important for an organization to evaluate as it establishes and maintains a data privacy program?
Reporting structure for the data privacy officer
Role as controller or processor
Request process for data subject access
Physical location of the company
A security analyst is investigating a workstation that is suspected of outbound communication to a command-and-control server. During the investigation, the analyst discovered that logs on the endpoint were deleted. Which of the following logs would the analyst most likely look at next?
IPS
Windows security
AСL
Firewall
An IT manager is putting together a documented plan describing how the organization will keep operating in the event of a global incident. Which of the following plans is the IT manager creating?
Disaster recovery
Business continuity
Physical security
Change management
A business needs a recovery site but does not require immediate failover. The business also wants to reduce the workload required to recover from an outage. Which of the following recovery sites is the best option?
Cold
Geographically dispersed
Hot
Warm
A security team is setting up a new environment for hosting the organization's on-premises software application as a cloud-based service. Which of the following should the team ensure is in place in order for the organization to follow security best practices?
Data Encryption
Strong Authentication policies
Network Segmentation
Virtualization and isolation of resources
A manager receives an email that contains a link to receive a refund. After hovering over the link, the manager notices that the domain's URL points to a suspicious link. Which of the following security practices helped the manager to identify the attack?
End user training
Policy review
URL scanning
Plain text email
A company wants to verify that the software the company is deploying came from the vendor the company purchased the software from. Which of the following is the best way for the company to confirm this information?
Execute the code in a sandbox.
Generate a hash of the files.
Search the executable for ASCII strings.
Validate the code signature.
A systems administrator notices that one of the systems critical for processing customer transactions is running an end-of-life operating system. Which of the following techniques would increase enterprise security?
Installing HIDS on the system
Encrypting the system's hard drive
Decommissioning the system
Placing the system in an isolated VLAN
The Chief Information Security Officer (CISO) at a large company would like to gain an understanding of how the company's security policies compare to the requirements imposed by external regulators. Which of the following should the CISO use?
External examination
Internal audit
Attestation
Penetration test
A systems administrator notices that the research and development department is not using the company VPN when accessing various company-related services and systems. Which of the following scenarios describes this activity?
Espionage
Shadow IT
Data exfiltration
Nation-state attack
The marketing department set up its own project management software without telling the appropriate departments. Which of the following describes this scenario?
Insider threat
Shadow IT
Service disruption
Data exfiltration
Which of the following would best explain why a security analyst is running daily vulnerability scans on all corporate endpoints?
To track the status of patching installations
To find shadow IT cloud deployments
To continuously the monitor hardware inventory
To hunt for active attackers in the network
Which of the following is classified as high availability in a cloud environment?
Load balancer
Access broker
Cloud HSM
WAF
Which of the following security measures is required when using a cloud-based platform for IoT management?
Single sign-on
Firewall
Federated identity
Encrypted connection
Which of the following threat vectors is most commonly utilized by insider threat actors attempting data exfiltration?
Impersonation of business units through typosquatting
Default network device credentials
Spear phishing emails
Unidentified removable devices
Which of the following methods to secure credit card data is best to use when a requirement is to see only the last four numbers on a credit card?
Hashing
Tokenization
Masking
Encryption
The Chief Information Security Officer (CISO) has determined the company is non-compliant with local data privacy regulations. The CISO needs to justify the budget request for more resources. Which of the following should the CISO present to the board as the direct consequence of non-compliance?
Fines
Reputational damage
Contractual implications
Sanctions
Which of the following alert types is the most likely to be ignored over time?
True positive
True negative
False positive
False negative
A security analyst is investigating an application server and discovers that software on the server is behaving abnormally. The software normally runs batch jobs locally and does not generate traffic, but the process is now generating outbound traffic over random high ports. Which of the following vulnerabilities has likely been exploited in this software?
SQL injection
Memory injection
Race condition
Side loading
An important patch for a critical application has just been released, and a systems administrator is identifying all of the systems requiring the patch. Which of the following must be maintained in order to ensure that all systems requiring the patch are updated?
Asset inventory
Data certification
Network enumeration
Procurement process
Which of the following should a security operations center use to improve its incident response procedure?
Benchmarks
Baselines
Frameworks
Playbooks
Which of the following describes an executive team that is meeting in a board room and testing the company's incident response plan?
Continuity of operations
Capacity planning
Parallel processing
Tabletop exercise
A healthcare organization wants to provide a web application that allows individuals to digitally report health emergencies. Which of the following is the most important consideration during development?
Ease of deployment
Availability
Scalability
Cost
Which of the following agreement types defines the time frame in which a vendor needs to respond?
MOA
SOW
MOU
SLA
Which of the following is a feature of a next-generation SIEM system?
Security agent deployment
Automated response actions
Virus signatures
Vulnerability scanning
To improve the security at a data center, a security administrator implements a CCTV system and posts several signs about the possibility of being filmed. Which of the following best describe these types of controls? (Choose two.)
Directive
Compensating
Detective
Deterrent
Preventive
Corrective
Which of the following examples would be best mitigated by input sanitization?
<script>alert("Warning!");</script>"
nmap - 10.11.1.130
Email message: "Click this link to get your free gift card."
Browser message: "Your connection is not private."
An attacker posing as the Chief Executive Officer calls an employee and instructs the employee to buy gift cards. Which of the following techniques is the attacker using?
Smishing
Disinformation
Whaling
Impersonating
After conducting a vulnerability scan, a systems administrator notices that one of the identified vulnerabilities is not present on the systems that were scanned. Which of the following describes this example?
False positive
True negative
True positive
False negative
A recent penetration test identified that an attacker could flood the MAC address table of network switches. Which of the following would best mitigate this type of attack?
NGFW
IPS
Load balancer
Port security
A user would like to install software and features that are not available with a smartphone's default software. Which of the following would allow the user to install unauthorized software and enable new features?
Cross-site scripting
Side loading
Jailbreaking
SQLi
Which of the following phases of an incident response involves generating reports?
Containment
Recovery
Lessons learned
Preparation
Which of the following methods would most likely be used to identify legacy systems?
Dynamic analysis
Vulnerability scan
Bug bounty program
Package monitoring
Employees located off-site must have access to company resources in order to complete their assigned tasks. These employees utilize a solution that allows remote access without interception concerns. Which of the following best describes this solution?
VPN
Proxy server
Security zone
NGFW
A company allows customers to upload PDF documents to its public e-commerce website. Which of the following would a security analyst most likely recommend?
Limiting the affected servers with a load balancer
Utilizing attack signatures in an IDS
Blocking command injections via a WAF
Enabling malware detection through a UTM
A security analyst developed a script to automate a trivial and repeatable task. Which of the following best describes the benefits of ensuring other team members understand how the script works?
To prevent a single point of failure
To remediate technical debt
To reduce implementation cost
To identify complexity
A company is decommissioning its physical servers and replacing them with an architecture that will reduce the number of individual operating systems. Which of the following strategies should the company use to achieve this security requirement?
Containerization
Microservices
Infrastructure as code
Virtualization
An administrator needs to perform server hardening before deployment. Which of the following steps should the administrator take? (Choose two.)
Document default passwords.
Join the server to the corporate domain.
Disable default accounts.
Add the server to the asset inventory.
Send server logs to the SIEM.
Remove unnecessary services.
A Chief Information Security Officer would like to conduct frequent, detailed reviews of systems and procedures to track compliance objectives. Which of the following will be the best method to achieve this objective?
Vulnerability scans
Internal auditing
Penetration testing
Third-party attestation
Which of the following security concepts is accomplished with the installation of a RADIUS server?
PEM
CIA
AAA
ACL
After creating a contract for IT contractors, the human resources department changed several clauses. The contract has gone through three revisions. Which of the following processes should the human resources department follow to track revisions?
Version validation
Version control
Version changes
Version updates
The executive management team is mandating the company develop a disaster recovery plan. The cost must be kept to a minimum, and the money to fund additional internet connections is not available. Which of the following would be the best option?
Hot site
Warm site
Cold site
Failover site
An administrator at a small business notices an increase in support calls from employees who receive a blocked page message after trying to navigate to a spoofed website. Which of the following should the administrator do?
Decrease the level of the web filter settings.
Update the acceptable use policy.
Deploy multifactor authentication.
Implement security awareness training.
Which of the following teams is best suited to determine whether a company has systems that can be exploited by a potential, identified vulnerability?
Purple team
Blue team
Red team
White team
A company is reviewing options to enforce user logins after several account takeovers. The following conditions must be met as part of the solution: • Allow employees to work remotely or from assigned offices around the world. • Provide a seamless login experience. • Limit the amount of equipment required. Which of the following best meets these conditions?
Trusted devices
Geotagging
Time-based logins
Smart cards
Which of the following methods can be used to detect attackers who have successfully infiltrated a network? (Choose two.)
Tokenization
CI/CD
Honeypots
Threat modeling
DNS sinkhole
Data obfuscation
A company wants to ensure that the software it develops will not be tampered with after the final version is completed. Which of the following should the company most likely use?
Tokenization
Hashing
Encryption
Baselines
An organization completed a project to deploy SSO across all business applications last year. Recently, the finance department selected a new cloud-based accounting software vendor. Which of the following should most likely be configured during the new software deployment?
RADIUS
OpenID
EAP
SAML
A user, who is waiting for a flight at an airport, logs in to the airline website using the public Wi-Fi, ignores a security warning and purchases an upgraded seat. When the flight lands, the user finds unauthorized credit card charges. Which of the following attacks most likely occurred?
On-path attack
Memory leak
Replay attack
Buffer overflow attack
A network engineer deployed a redundant switch stack to increase system availability. However, the budget can only cover the cost of one ISP connection. Which of the following best describes the potential risk factor?
The equipment MTBF is unknown.
The ISP has no SLA.
An RPO has not been determined.
There is a single point of failure.
A network team segmented a critical, end-of-life server to a VLAN that can only be reached by specific devices but cannot be reached by the perimeter network. Which of the following best describe the controls the team implemented? (Choose two.)
Corrective
Detective
Technical
Compensating
Managerial
Physical
Deterrent
A threat actor was able to use a username and password to log in to a stolen company mobile device. Which of the following provides the best solution to increase mobile data security on all employees' company mobile devices?
Remote wipe
Application management
Containerization
Full disk encryption
Which of the following best describes the risk present after controls and mitigating factors have been applied?
Inherent
Avoided
Operational
Residual
A software development team asked a security administrator to recommend techniques that should be used to reduce the chances of the software being reverse engineered. Which of the following should the security administrator recommend?
Limiting the use of third-party libraries
Digitally signing the software
Using compile flags
Performing code obfuscation
Which of the following is a possible factor for MFA?
Somewhere you are
Something you have
Someone you know
Something you exhibit
Easy-to-guess passwords led to an account compromise. The current password policy requires at least 12 alphanumeric characters, one uppercase character, one lowercase character, a password history of two passwords, a minimum password age of one day, and a maximum password age of 90 days. Which of the following would reduce the risk of this incident from happening again? (Choose two.)
Reducing the minimum password length to ten characters.
Upgrading the password hashing algorithm from MD5 to SHA-512.
Increasing the minimum password length to 14 characters.
Including a requirement for at least one special character.
Increasing the maximum password age to 120 days.
Reducing the minimum password age to zero days.
A user downloaded software from an online forum. After the user installed the software, the security team observed external network traffic connecting to the user's computer on an uncommon port. Which of the following is the most likely explanation of this unauthorized connection?
The software had a hidden keylogger.
The software contained a backdoor.
The user's computer had a fileless virus.
The software was ransomware.
A utility company is designing a new platform that will host all the virtual machines used by business applications. The requirements include: • A starting baseline of 50% memory utilization • Storage scalability • Single circuit failure resilience Which of the following best meets all of these requirements?
Configuring network load balancing for multiple paths
Deploying multiple large NAS devices for each host
Connecting dual PDUs to redundant power supplies
Transitioning the platform to an IaaS provider
Which of the following best describes a use case for a DNS sinkhole?
A DNS sinkhole can be set up to attract potential attackers away from a company's network resources.
Attackers can see a DNS sinkhole as a highly valuable resource to identify a company's domain structure.
A DNS sinkhole can be used to draw employees away from known-good websites to malicious ones owned by the attacker.
A DNS sinkhole can be used to capture traffic to known-malicious domains used by attackers.
An incident analyst finds several image files on a hard disk. The image files may contain geolocation coordinates. Which of the following best describes the type of information the analyst is trying to extract from the image files?
Log data
Metadata
Encrypted data
Sensitive data
Which of the following most likely describes why a security engineer would configure all outbound emails to use S/MIME digital signatures?
To meet compliance standards

To block phishing attacks
To ensure non-repudiation
During a recent company safety stand-down, the cyber-awareness team gave a presentation on the importance of cyber hygiene. One topic the team covered was best practices for printing centers. Which of the following describes an attack method that relates to printing centers?
Whaling
Prepending
Credential harvesting
Dumpster diving
Which of the following considerations is the most important regarding cryptography used in an IoT device?
Resource constraints
The compatibility of the TLS version
The use of block ciphers
Available bandwidth
A coffee shop owner wants to restrict internet access to only paying customers by prompting them for a receipt number. Which of the following is the best method to use given this requirement?

Captive portal
IEEE 802.1X
WPA3
While performing digital forensics, which of the following is considered the most volatile and should have the contents collected first?
RAM
Hard drive
SSD
Temporary files
A hosting provider needs to prove that its security controls have been in place over the last six months and have sufficiently protected customer data. Which of the following would provide the best proof that the hosting provider has met the requirements?
CIS Top 20 compliance reports
SOC 2 Type 2 report
Vulnerability report
NIST CSF
A city municipality lost its primary data center when a tornado hit the facility. Which of the following should the city staff use immediately after the disaster to handle essential public services?
BCP
DRP
IRP
Communication plan
Which of the following is considered a preventive control?
Segregation of duties
Log correlation
Configuration auditing
Incident alerts
A systems administrator notices that a testing system is down. While investigating, the systems administrator finds that the servers are online and accessible from any device on the server network. The administrator reviews the following information from the monitoring system:


Which of the following is the most likely cause of the outage?
Jamming
ARP poisoning
Kerberoasting
Denial of service
A security team has been alerted to a flood of incoming emails that have various subject lines and are addressed to multiple email inboxes. Each email contains a URL shortener link that is redirecting to a dead domain. Which of the following is the best step for the security team to take?
Quarantine all emails received and notify all employees.
Block the URL shortener domain in the web proxy.
Create a blocklist for all subject lines.
Send the dead domain to a DNS sinkhole.
A security administrator is working to secure company data on corporate laptops in case the laptops are stolen. Which of the following solutions should the administrator consider?
Operating system hardening
Boot security
Data loss prevention
Disk encryption
A company needs to keep the fewest records possible, meet compliance needs, and ensure destruction of records that are no longer needed. Which of the following best describes the policy that meets these requirements?
Access control policy
Security policy
Retention policy
Classification policy
Which of the following is a common source of unintentional corporate credential leakage in cloud environments?
State actors
Code repositories
Vulnerability databases
Threat feeds
Dark web
Which of the following is the best reason an organization should enforce a data classification policy to help protect its most sensitive information?
The organization will have the ability to create security requirements based on classification levels.
The policy will result in the creation of access levels for each level of classification.
Security analysts will be able to see the classification of data within a document before opening it.
End users will be required to consider the classification of data that can be used in documents.
An analyst is performing a vulnerability scan against the web servers exposed to the internet without a system account. Which of the following is most likely being performed?
Privilege escalation
System enumeration
Passive scan
Packet capture
Non-credentialed scan
A security administrator is hardening corporate systems and applying appropriate mitigations by consulting a real-world knowledge base for adversary behavior. Which of the following would be best for the administrator to reference?
CVSS
SOAR
CSIRT
MITRE ATT&CK
An architect has a request to increase the speed of data transfer using JSON requests externally. Currently, the organization uses SFTP to transfer data files. Which of the following will most likely meet the requirements?
A secure email solution
Microservices using API
A website-hosted solution
Cloud shared storage
Which of the following addresses individual rights such as the right to be informed, the right of access, and the right to be forgotten?
PCI DSS
NIST
ISO
GDPR
An administrator is installing an LDAP browser tool in order to view objects in the corporate LDAP directory. Secure connections to the LDAP server are required. When the browser connects to the server, certificate errors are being displayed, and then the connection is terminated. Which of the following is the most likely solution?
The administrator needs to install the server certificate into the local truststore.
The administrator should request that the secure LDAP port be opened to the server.
The administrator should allow SAN certificates in the browser configuration.
The administrator needs to increase the TLS version on the organization's RA.
Which of the following is the most important security concern when using legacy systems to provide production service?
Instability
Use of insecure protocols
Loss of availability
Lack of vendor support
A security investigation revealed that malicious software was installed on a server using a server administrator's credentials. During the investigation, the server administrator explained that Telnet was regularly used to log in. Which of the following most likely occurred?
A spraying attack was used to determine which credentials to use.
A packet capture tool was used to steal the password.
A dictionary attack was used to log in as the server administrator.
A remote-access Trojan was used to install the malware.
A user is requesting Telnet access to manage a remote development web server. Insecure protocols are not allowed for use within any environment. Which of the following should be configured to allow remote access to this server?
SSH
SMTP
HTTPS
SNMPv3
RDP
A security administrator is working to find a cost-effective solution to implement certificates for a large number of domains and subdomains owned by the company. Which of the following types of certificates should the administrator implement?
Wildcard
Code signing
Self-signed
Client certificate
An auditor discovered multiple insecure ports on some servers. Other servers were found to have legacy protocols enabled. Which of the following tools did the auditor use to discover these issues?
Nessus
curl
Wireshark
netcat
A security analyst received a tip that sensitive proprietary information was leaked to the public. The analyst is reviewing the PCAP and notices traffic between an internal server and an external host that includes the following: ... 12:47:22.327233 PPPoE [ses 0x8122] IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto IPv6 (41), length 331) 10.5.1.1 > 52.165.16.154: IP6 (hlim E3, next-header TCP (6) paylcad length: 271) 2001:67c:2158:a019::ace.53104 > 2001:0:5ef5:79fd:380c:dddd:a601:24fa.13788: Flags [P.], cksum 0xd7ee (correct), seq 97:348, ack 102, win 16444, length 251 ... Which of the following was most likely used to exfiltrate the data?
Steganography
Sniffing via on-path position
Encapsulation
MAC address spoofing
Broken encryption
A company wants to reduce the time and expense associated with code deployment. Which of the following technologies should the company utilize?
Thin clients
Serverless architecture
Virtual machines
Private cloud
A security administrator is performing an audit on a stand-alone UNIX server, and the following message is immediately displayed: (Error 13): /etc/shadow: Permission denied. Which of the following best describes the type of tool that is being used?
File integrity monitor
Pass-the-hash monitor
Password cracker
Forensic analysis
A security administrator needs to create firewall rules for the following protocols: RTP, SIP, H.323. and SRTP. Which of the following does this rule set support?
VoIP
HVAC
SoC
RTOS
Which of the following best describes a social engineering attack that uses a targeted electronic messaging campaign aimed at a Chief Executive Officer?
Whaling
Impersonation
Spear phishing
Identity fraud
During a penetration test, a flaw in the internal PKI was exploited to gain domain administrator rights using specially crafted certificates. Which of the following remediation tasks should be completed as part of the cleanup phase?
Implementing SOAR
Updating the CRL
Patching the CA
Changing passwords
A company wants to implement MFA. Which of the following enables the additional factor while using a smart card?
PIN
Hardware token
User ID
SMS
A company hired an external consultant to assist with required system upgrades to a critical business application. A systems administrator needs to secure the consultant's access without sharing passwords to critical systems. Which of the following solutions should most likely be utilized?
SAML
PAM software
An SSO platform
TACACS+
Role-based access control
A newly implemented wireless network is designed so that visitors can connect to the wireless network for business activities. The legal department is concerned that visitors might connect to the network and perform illicit activities. Which of the following should the security team implement to address this concern?
Configure a RADIUS server to manage device authentication.
Add a guest captive portal requiring visitors to accept terms and conditions.
Allow for new devices to be connected via WPS.
Use 802.1X on all devices connecting to wireless.
Which of the following data roles is responsible for identifying risks and appropriate access to data?
Custodian
Owner
Controller
Steward
Which of the following physical controls can be used to both detect and deter? (Choose two.)
Lock
Fencing
Bollard
Lighting
Sensor
Signage
A multinational bank hosts several servers in its data center. These servers run a business-critical application used by customers to access their account information. Which of the following should the bank use to ensure accessibility during peak usage times?
Load balancer
Geographic dispersal
Cloud backups
Disk multipathing
The author of a software package is concerned about bad actors repackaging and inserting malware into the software. The software download is hosted on a website, and the author exclusively controls the website's contents. Which of the following techniques would best ensure the software's integrity?
Code signing
Input validation
Secure cookies
Fuzzing
A third-party vendor is moving a particular application to the end-of-life stage at the end of the current year. Which of the following is the most critical risk if the company chooses to continue running the application?
Lack of new features
Lack of security updates
Lack of support
Lack of source code access
A security analyst recently read a report about a flaw in several of the organization's printer models that causes credentials to be sent over the network in cleartext, regardless of the encryption settings. Which of the following would be best to use to validate this finding?
Wireshark
Nmap
netcat
Nessus
A development team is launching a new public-facing web product. The Chief Information Security Officer has asked that the product be protected from attackers who use malformed or invalid inputs to destabilize the system. Which of the following practices should the development team implement?
Static code analysis
Continuous deployment
Fuzzing
Manual peer review
During an annual review of the system design, an engineer identified a few issues with the currently released design. Which of the following should be performed next according to best practices?
Change control process
Product design process
Risk management process
Design review process
Which of the following is best to use when determining the severity of a vulnerability?
CVSS
SOAR
CVE
OSINT
An organization experienced a security breach that allowed an attacker to send fraudulent wire transfers from a hardened PC exclusively to the attacker's bank through remote connections. A security analyst is creating a timeline of events and has found a different PC on the network containing malware. Upon reviewing the command history, the analyst finds the following: PS>.\mimikatz.exe "sekurlsa::pth /user:localadmin /domain:corp-domain.com /ntlm:B4B9B02E1F29A3CF193EAB28C8D617D3F327 Which of the following best describes how the attacker gained access to the hardened PC?
The attacker performed a pass-the-hash attack using a shared support account.
The attacker socially engineered the accountant into performing bad transfers.
The attacker created fileless malware that was hosted by the banking platform.
The attacker utilized living-off-the-land binaries to evade endpoint detection and response software.
Which of the following is the best resource to consult for information on the most common application exploitation methods?
STIX
OVAL
Threat intelligence feed
OWASP
Common Vulnerabilities and Exposures
A security analyst is reviewing the logs on an organization's DNS server and notices the following unusual snippet:



Which of the following attack techniques was most likely used?
Determining the organization's ISP-assigned address space
Footprinting the internal network
Exfiltrating data from fshare.int.complia.org
Bypassing the organization's DNS sinkholing
Attempting to achieve initial access to the DNS server
A security analyst at an organization observed several user logins from outside the organization's network. The analyst determined that these logins were not performed by individuals within the organization. Which of the following recommendations would reduce the likelihood of future attacks? (Choose two.)
Disciplinary actions for users
Conditional access policies
More regular account audits
Implementation of additional authentication factors
Enforcement of content filtering policies
A review of user account permissions
A security team is addressing a risk associated with the attack surface of the organization's web application over port 443. Currently, no advanced network security capabilities are in place. Which of the following would be best to set up? (Choose two.)
NIDS
SIEM
Honeypot
WAF
Certificate revocation list
HIPS
A systems administrator would like to create a point-in-time backup of a virtual machine. Which of the following should the administrator use?
Replication
Snapshot
Containerization
Simulation
A security administrator notices numerous unused, non-compliant desktops are connected to the network. Which of the following actions would the administrator most likely recommend to the management team?
Monitoring
Isolating
Patching
Decommissioning
Which of the following is a common data removal option for companies that want to wipe sensitive data from hard drives in a repeatable manner but allow the hard drives to be reused?
Formatting
Defragmentation
Degaussing
Sanitization
An organization wants to improve the company's security authentication method for remote employees. Given the following requirements: • Must work across SaaS and internal network applications • Must be device manufacturer agnostic • Must have offline capabilities Which of the following would be the most appropriate authentication method?
Biometrics
SMS verification
Username and password
Time-based tokens
A security officer is implementing a security awareness program and has placed security-themed posters around the building and assigned online user training. Which of the following will the security officer most likely implement?

Phishing campaign
Password policy
Risk assessment
A malicious update was distributed to a common software platform and disabled services at many organizations. Which of the following best describes this type of vulnerability?
Rogue employee
DDoS attack
Supply chain
Insider threat
A company web server is initiating outbound traffic to a low-reputation, public IP on non-standard pat. The web server is used to present an unauthenticated page to clients who upload images the company. An analyst notices a suspicious process running on the server that was not created by the company development team. Which of the following is the most likely explanation for his security incident?
Malicious insiders are using the server to mine cryptocurrency.
A vulnerability has been exploited to deploy a worm to the server.
A web shell has been deployed to the server through the page.
Attackers have deployed a rootkit Trojan to the server over an exposed RDP port.
An organization requests a third-party full-spectrum analysis of its supply chain. Which of the following would the analysis team use to meet this requirement?
SCAP
Illumination tool
Vulnerability scanner
Penetration test
A systems administrator deployed a monitoring solution that does not require installation on the endpoints that the solution is monitoring. Which of the following is described in this scenario?
Agentless solution
Client-based soon
Open port
File-based solution
A security analyst is reviewing the source code of an application in order to identify misconfigurations and vulnerabilities. Which of the following kinds of analysis best describes this review?
Gap
Impact
Static
Dynamic
Which of the following agreement types is used to limit external discussions?
SLA
NDA
BPA
MSA
A security analyst is evaluating a SaaS application that the human resources department would like to implement. The analyst requests a SOC 2 report from the SaaS vendor. Which of the following processes is the analyst most likely conducting?
Internal audit
Penetration testing
Attestation
Due diligence
Which of the following is used to conceal credit card information in a database log file?
Masking
Obfuscation
Hashing
Tokenization
An organization recently started hosting a new service that customers access through a web portal. A security engineer needs to add to the existing security devices a new solution to protect this new service. Which of the following is the engineer most likely to deploy?
UTM
NGFW
Layer 4 firewall
WAF
Which of the following topics would most likely be included within an organization's SDLC?
Branch protection requirements
Penetration testing methodology
Information security policy
Service-level agreements
Which of the following control types is AUP an example of?
Which of the following control types is AUP an example of?
Technical
Operational
Managerial
An organization is adopting cloud services at a rapid pace and now has multiple SaaS applications in use. Each application has a separate log-in, so the security team wants to reduce the number of credentials each employee must maintain. Which of the following is the first step the security team should take?
Select an IdP.
Enable SAML.
Create OAuth tokens.
Use password vaulting.
A company's online shopping website became unusable shortly after midnight on January 30, 2023. When a security analyst reviewed the database server, the analyst noticed the following code used for backing up data:


Which of the following should the analyst do next?
Search the web server for ransomware notes.
Review WAF logs for evidence of command injection.
Scan the database server for malware.
Check for recently terminated DBAs.
Which of the following would be the best way to test resiliency in the event of a primary power failure?
Parallel processing
Tabletop exercise
Simulation testing
Production failover
Which of the following would be the most appropriate way to protect data in transit?
TLS 1.3
AES-256
SSL3.0
SHA-256
Which of the following is a common, passive reconnaissance technique employed by penetration testers in the early phases of an engagement?
Exploit validation
Pivoting
Port scanning
Open-source intelligence
Which of the following attacks is most likely occurring?
Account forgery
Password spraying
Brute-force
Pass-the-hash
A security analyst reviews domain activity logs and notices the following:

Which of the following is the best explanation for what the security analyst has discovered?
An attacker is attempting to brute force jsmith’s account.
Ransomware has been deployed in the domain.
The user jsmith’s account has been locked out.
A keylogger is installed on jsmith’s workstation.
1.) An attacker sends multiple SYN packets from multiple sources.

Attack Identified __________
BEST Preventative or Remedication Action __________

2.) The attack estabishes a connecton, which allows remote commands to be executed.

Attack Identified __________
BEST Preventative or Remedication Action __________

3.) The attack is seif propagating and compromises a SQL database using well-known credentials as it moves through the network

Attack Identified __________
BEST Preventative or Remedication Action__________

4.) The attacker uses hardware to remotely monitor a user's input activity to harvest credentials

Attack Identified __________
BEST Preventative or Remedication Action __________

5.) The attacker embeds hidden access in an internally developed application that bypasses account login.

Attack Identified __________
BEST Preventative or Remedication Action __________
An administrator is reviewing a single server's security logs and discovers the following:

Which of the following best describes the action captured in this log file?
Brute-force attack
Privilege escalation
Failed password audit
Forgotten password by the user