401-460

NO.401 Which of the following represents a biometric FRR?

• A. Authorized users being denied access

• B. Users failing to enter the correct PIN

• C. The denied and authorized numbers being equal

• D. The number of unauthorized users being granted access

NO.402 During a security assessment, a security finds a file with overly permissive permissions. Which of the following tools will allow the analyst to reduce the permission for the existing users and groups and remove the set-user-ID from the file?

• A. 1a

• B. chflags

• C. chmod

• D. leof

• E. setuid

NO.403 When implementing automation with loT devices, which of the following should be considered FIRST to keep the network secure?

• A. Z-Wave compatibility

• B. Network range

• C. Zigbee configuration

• D. Communication protocols

NO.404 Which of the following describes the ability of code to target a hypervisor from inside

• A. Fog computing

• B. VM escape

• C. Software-defined networking

• D. Image forgery

• E. Container breakout

NO.405 Users at organization have been installing programs from the internet on their workstations without first proper authorization. The organization maintains a portal from which users can install standardized programs. However, some users have administrative access on their workstations to enable legacy programs to function property. Which of the following should the security administrator consider implementing to address this issue?

• A. Application code signing

• B. Application whitellsting

• C. Data loss prevention

• D. Web application firewalls

Answer explanation

Explanation Application whitelisting is the practice of specifying an index of approved software applications or executable files that are permitted to be present and active on a computer system. The goal of whitelisting is to protect computers and networks from potentially harmful applications. In general, a whitelist is an index of approved entities. In information security (infosec), whitelisting works best in centrally managed environments, where systems are subject to a consistent workload.

NO.406 A company is implementing a new SIEM to log and send alerts whenever malicious activity is blocked by its antivirus and web content filters. Which of the following is the primary use case for this scenario?

• A. Implementation of preventive controls

• B. Implementation of detective controls

• C. Implementation of deterrent controls

• D. Implementation of corrective controls

NO.407 Which of the following types of controls is a CCTV camera that is not being monitored?

• A. Detective

• B. Deterrent

• C. Physical

• D. Preventive

NO.408 In which of the following common use cases would steganography be employed?

• A. Obfuscation

• B. Integrity

• C. Non-repudiation

• D. Blockchain

NO.409 An engineer is setting up a VDI environment for a factory location, and the business wants to deploy a low-cost solution to enable users on the shop floor to log in to the VDI environment directly. Which of the following should the engineer select to meet these requirements?

• A. Laptops

• B. Containers

• C. Thin clients

• D. Workstations

NO.410 The SOC is reviewing process and procedures after a recent incident. The review indicates it took more than 30 minutes to determine that quarantining an infected host was the best course of action. The allowed the malware to spread to additional hosts before it was contained. Which of the following would be BEST to improve the incident response process?

• A. Updating the playbooks with better decision points

• B. Dividing the network into trusted and untrusted zones

• C. Providing additional end-user training on acceptable use

• D. Implementing manual quarantining of infected hosts