Comp_Sec_361-390

NO.361 A security analyst is investigating multiple hosts that are communicating to external IP addresses during the hours of 2:00 a.m - 4:00 am. The malware has evaded detection by traditional antivirus software. Which of the following types of malware is MOST likely infecting the hosts?

• A RAT

• Ransomware

• Logic bomb

• A worm

NO.362 A public relations team will be taking a group of guest on a tour through the facility of a large e-commerce company. The day before the tour, the company sends out an email to employees to ensure all whiteboars are cleaned and all desks are cleared. The company is MOST likely trying to protect against.

• Loss of proprietary information

• Damage to the company's reputation

• Social engineering

• Credential exposure

Answer explanation

In the context of information security, social engineering is the psychological manipulation of people into performing actions or divulging confidential information think phishing, spoofing. That is not being demonstrated in this question. The company is protecting themselves from loss of proprietary information by clearing it all out. so that if anyone in the tour is looking to take it they will be out of luck

NO.363 A desktop support technician recently installed a new document-scanning software program on a computer However, when the end user tried to launch the program, it did not respond. Which of the following is MOST likely the cause?

• A new firewall rule is needed to access the application.

• The system was quarantined for missing software updates

• The software was not added to the application whitelist.

• The system was isolated from the network due to infected software.

NO.364 Users reported several suspicious activities within the last two weeks that resulted in several unauthorized transactions. Upon investigation, the security analyst found the following: Multiple reports of breached credentials within that time period Traffic being redirected in certain parts of the network * Fraudulent emails being sent by various internal users without their consent Which of the following types of attacks was MOST likely used?

• Replay attack

• Race condition

• Cross site scripting

• Request forgeries

NO.365 An organization recently acquired an ISO 27001 certification. Which of the following would MOST likely be considered a benefit of this certification?

• It allows for the sharing of digital forensics data across organizations

• It provides insurance in case of a data breach

• It provides complimentary training and certification resources to IT security staff.

• It certifies the organization can work with foreign entities that require a security clearance

• It assures customers that the organization meets security standards

Answer explanation

According to the ISO https://www.iso.org/standard/54534.html ISO/IEC 27001:2013 specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system within the context of the organization. It also includes requirements for the assessment and treatment of information security risks tailored to the needs of the organization. The requirements set out in ISO/IEC 27001:2013 are generic and are intended to be applicable to all organizations, regardless of type, size or nature.

NO.366 A security analyst is configuring a large number of new company-issued laptops. The analyst received the following requirements:

* The devices will be used internationally by staff who travel extensively.

*Occasional personal use is acceptable due to the travel requirements.

*Users must be able to install and configure sanctioned programs and productivity suites.

*The devices must be encrypted

* The devices must be capable of operating in low-bandwidth environments.

Which of the following would provide the GREATEST benefit to the security posture of the devices?

• Configuring an always-on VPN

• Implementing application whitelisting

• Requiring web traffic to pass through the on-premises content filter

• Setting the antivirus DAT update schedule to weekly

NO.367 A recently discovered zero-day exploit utilizes an unknown vulnerability in the SMB network protocol to rapidly infect computers. Once infected, computers are encrypted and held for ransom. Which of the following would BEST prevent this attack from reoccurring?

• Configure the perimeter firewall to deny inbound external connections to SMB ports.

• Ensure endpoint detection and response systems are alerting on suspicious SMB connections.

• Deny unauthenticated users access to shared network folders.

• Verify computers are set to install monthly operating system, updates automatically.

NO.368 Which of the following disaster recovery tests is The LEAST time consuming for the disaster recovery team?

• Tabletop

• Parallel

• Full interruption

• Simulation

NO.369 The Chief Information Security Officer (CISO) has decided to reorganize security staff to concentrate on incident response and to outsource outbound Internet URL categorization and filtering to an outside company. Additionally, the CISO would like this solution to provide the same protections even when a company laptop or mobile device is away from a home office. Which of the following should the CISO choose?

• CASB

• Next-generation SWG

• NGFW

• Web-application firewall

Answer explanation

CASBA Next Generation Secure Web Gateway (SWG) is a new cloud-native solution for protecting enterprises from the growing volume of sophisticated cloud enabled threats and data risks. It is the logical evolution of the traditional secure web gateway, also known as a web proxy or web filter. Next-Generation SWG IT Certification Guaranteed, The Easy Way! 111 A Next Generation Secure Web Gateway (SWG) is a new cloud-native solution for protecting enterprises from the growing volume of sophisticated cloud enabled threats and data risks. It is the logical evolution of the traditional secure web gateway, also known as a web proxy or web filter. NGFW A Next-Generation Firewall (NGFW) is a cyber security solution to protect network fronts with capabilities that extend beyond traditional firewalls. Web-application firewall A WAF protects your web apps by filtering, monitoring, and blocking any malicious HTTP/S traffic traveling to the web application, and prevents any unauthorized data from leaving the app. It does this by adhering to a set of policies that help determine what traffic is malicious and what traffic is safe.

NO.370 A retail executive recently accepted a job with a major competitor. The following week, a security analyst reviews the security logs and identifies successful logon attempts to access the departed executive's accounts. Which of the following security practices would have addressed the issue?

• A non-disclosure agreement

• Least privilege

• An acceptable use policy

• Ofboarding