361 - 390

NO.361 A security analyst is investigating multiple hosts that are communicating to external IP addresses during the hours of 2:00 a.m - 4:00 am. The malware has evaded detection by traditional antivirus software. Which of the following types of malware is MOST likely infecting the hosts?

• (A). A RAT

• (B). Ransomware

• (C). Logic bomb

• (D). A worm

NO.362 A public relations team will be taking a group of guest on a tour through the facility of a large e-commerce company. The day before the tour, the company sends out an email to employees to ensure all whiteboars are cleaned and all desks are cleared. The company is MOST likely trying to protect against

• A). Loss of proprietary information

• (B). Damage to the company's reputation

• (C). Social engineering

• (D). Credential exposure

NO.363 A desktop support technician recently installed a new document-scanning software program on a computer However, when the end user tried to launch the program, it did not respond. Which of the following is MOST likely the cause?

• (A). A new firewall rule is needed to access the application.

• B). The system was quarantined for missing software updates

• (C). The software was not added to the application whitelist.

• (D). The system was isolated from the network due to infected software.

NO.364 Users reported several suspicious activities within the last two weeks that resulted in several unauthorized transactions. Upon investigation, the security analyst found the following: Multiple reports of breached credentials within that time period Traffic being redirected in certain parts of the network * Fraudulent emails being sent by various internal users without their consent Which of the following types of attacks was MOST likely used?

• (A). Replay attack

• (B). Race condition

• C). Cross site scripting

• D). Request forgeries

NO.365 An organization recently acquired an ISO 27001 certification. Which of the following would MOST likely be considered a benefit of this certification?

• (A). It allows for the sharing of digital forensics data across organizations

• (B). It provides insurance in case of a data breach

• (C). It provides complimentary training and certification resources to IT security staff

• (D). It certifies the organization can work with foreign entities that require a security clearance

• (E). It assures customers that the organization meets security standards

NO.366 A security analyst is configuring a large number of new company-issued laptops. The analyst received the following requirements: The devices will be used internationally by staff who travel extensively. Occasional personal use is acceptable due to the travel requirements. Users must be able to install and configure sanctioned programs and productivity suites. The devices must be encrypted The devices must be capable of operating in low-bandwidth environments. Which of the following would provide the GREATEST benefit to the security posture of the devices?

• (A). Configuring an always-on VPN

• (B). Implementing application whitelisting

• (C). Requiring web traffic to pass through the on-premises content filter

• (D). Setting the antivirus DAT update schedule to weekly

NO.367 A recently discovered zero-day exploit utilizes an unknown vulnerability in the SMB network protocol to rapidly infect computers. Once infected, computers are encrypted and held for ransom. Which of the following would BEST prevent this attack from reoccurring?

• (A). Configure the perimeter firewall to deny inbound external connections to SMB ports.

• (B). Ensure endpoint detection and response systems are alerting on suspicious SMB connections.

• (C). Deny unauthenticated users access to shared network folders

• (D). Verify computers are set to install monthly operating system, updates automatically.

NO.368 Which of the following disaster recovery tests is The LEAST time consuming for the disaster recovery team?

• A). Tabletop

• (B). Parallel

• (C). Full interruption

• (D). Simulation

NO.369 The Chief Information Security Officer (CISO) has decided to reorganize security staff to concentrate on incident response and to outsource outbound Internet URL categorization and filtering to an outside company. Additionally, the CISO would like this solution to provide the same protections even when a company laptop or mobile device is away from a home office. Which of the following should the CISO choose?

• (A). CASB

• (B). Next-generation SWG

• (C). NGFW

• D). Web-application firewall

NO.370 A retail executive recently accepted a job with a major competitor. The following week, a security analyst reviews the security logs and identifies successful logon attempts to access the departed executive's accounts. Which of the following security practices would have addressed the issue?

• (A) A non-disclosure agreement

• (B) Least privilege

• (C) An acceptable use policy

• (D) Ofboarding