Security+ - 03

A nuclear plant was the victim of a recent attack, and all the networks were air gapped. A subsequent investigation revealed a worm as the source of the issue. Which of the following BEST explains what happened?

• A malicious USB was introduced by an unsuspecting employee.

• The ICS firmware was outdated

• A local machine had a RAT installed

• The HVAC was connected to the maintenance vendor

A malicious actor recently penetrated a company's network and moved laterally to the datacenter. Upon investigation, a forensics firm wants to know what was in the memory on the compromised server. Which of the following files should be given to the forensics firm?

• Security

• Application

• Dump

• Syslog

A security analyst receives the configuration of a current VPN profile and notices the authentication is only applied to the IP datagram portion of the packet. Which of the following should the analyst implement to authenticate the entire packet?

• AH

• ESP

• SRTP

• LDAP

A smart switch has the ability to monitor electrical levels and shut off power to a building in the event of power surge or other fault situation. The switch was installed on a wired network in a hospital and is monitored by the facilities department via a cloud application. The security administrator isolated the switch on a separate VLAN and set up a patching routine. Which of the following steps should also be taken to harden the smart switch?

• Set up an air gap for the switch,

• Change the default password for the switch.

• Place the switch in a Faraday cage.

• Install a cable lock on the switch

A user recently entered a username and password into a recruiting application website that had been forged to look like the legitimate site. upon investigation, a security analyst identifies the following:

1. The legitimate website's IP address is 10.1.1.20 and resolves to this IP.

2. The forged website's IP address appears to be 10.2.12.99, based on NetFlow records.

3. All three to the organization's DNS servers show the website correctly resolves to the legitimate IP.

4. DNS query logs show one of the three DNS servers returned a result of 10.2.12.99 (cached) at the approximate time of the suspected compromise.

Which of the following MOST likely occurred?

• A reverse proxy was used to redirect network traffic.

• An SSL strip MITM attack was performed

• An attacker temporarily poisoned a name server.

• An ARP poisoning attack was successfully executed.

Which of the following allows for functional test data to be used in new systems for testing and training purposes to protect the real data?

• Data encryption

• Data masking

• Data deduplication

• Data minimization

A security administrator needs to create a RAID configuration that is focused on high read speeds and fault tolerance. It is unlikely that multiple drives will fail simultaneously. Which of the following RAID configurations should the administrator use?

• RAID 0

• RAID 1

• RAID 5

• RAID 10

A security analyst needs to be proactive in understanding the types of attacks that could potentially target the company's executives. Which of the following intelligence sources should the security analyst review?

• Vulnerability feeds

• Trusted automated exchange Of indicator information

• Structured threat information expression

• Industry information-sharing and collaboration groups

Which of the following ISO standards is certified for privacy?

• ISO 9001

• ISO 27002

• ISO 27701

• ISO 31000

A small business just recovered from a ransomware attack against its file servers by purchasing the decryption keys from the attackers. The issue was triggered by a phishing email and the IT administrator wants to ensure it does not happen again. Which of the following should the IT administrator do FIRST after recovery?

• Scan the NAS for residual or dormant malware and take new daily backups that are tested on a frequent basis

• Restrict administrative privileges and patch all systems and applications

• Rebuild all workstations and install new antivirus software

• Implement application Whitelisting and perform user application hardening