A security analyst is receiving numerous alerts reporting that the response time of an internet-facing application has been degraded. However, the internal network performance was not degraded. Which of the following MOST likely explains this behavior?

• DNS poisoning

• MAC flooding

• DDoS attack

• ARP poisoning

Which of the following would BEST provide a systems administrator with the ability to more efficiently identify systems and manage permissions and policies based on location, role, and service level?

• Standard naming conventions

• Domain services

• Baseline configurations

• Diagrams

An administrator is experiencing issues when trying to upload a support file to a vendor. A pop-up message reveals that a payment card number was found in the file, and the file upload was mocked. Which of the following controls is most likely causing this issue and should be checked FIRST?

• DLP

• Firewall rule

• Content filter

• MDM

• Application allow list

During a trial, a judge determined evidence gathered from a hard drive was not admissible. Which of the following BEST explains this reasoning?

• The forensic investigator forgot to run a checksum on the disk image after creation.

• The chain of custody form did not note time zone offsets between transportation regions.

• The computer was turned off. and a RAM image could not be taken at the same time.

• The hard drive was not properly kept in an antistatic bag when rt was moved.

A tax organization is working on a solution to validate the online submission of documents. The solution should be carried out on a portable USB device that should be inserted on any computer that is transmitting a transaction securely. Which of the following is the BEST certificate for these requirements?

• User certificate

• Self-signed certificate

• Computer certificate

• Root certificate

Which of the following will increase cryptographic security?

• High data entropy

• Algorithms that require less computing power

• Longer key longevity

• Hashing

A company needs to validate its updated incident response plan using a real-world scenario that will test decision points and relevant incident response actions without interrupting daily operations. Which of the following would BEST meet the company's requirements?

• Red-team exercise

• Capture-the-flag exercise

• Tabletop exercise

• Phishing exercise

A help desk technician receives a phone call from someone claiming to be a part of the organization's cybersecurity modem response team. The caller asks the technician to verify the network's internal firewall IP address. Which of the following is the technician's BEST course of action?

• Direct the caller to stop by the help desk in person and hang up declining any further requests from the caller.

• Ask for the callers name, verify the person's identity in the email directory and provide the requested information over the phone.

• Write down the phone number of the caller if possible, the name of the person requesting the information, hang up. and notify the organization's cybersecurity officer.

• Request the caller send an email for identity verification and provide the requested information via email to the caller.

During an incident response, an analyst applied rules to all inbound traffic on the border firewall and implemented ACLs on each critical server. Following an investigation, the company realizes it is still vulnerable because outbound traffic is not restricted and the adversary is able to maintain a presence in the network. In which of the following stages of the Cyber Kill Chain is the adversary currently operating?, and

• Reconnaissance

• Command and control

• Actions on objective

• Exploitation

Business partners are working on a security mechanism to validate transactions securely. The requirement is for one company to be responsible for deploying a trusted solution that will register and issue artifacts used to sign, encrypt, and decrypt transaction files. Which of the following is the BEST solution to adopt?

• PKI

• Blockchain

• SAML

• OAuth