CySA+ (51-100)

NO.51 An online gaming company was impacted by a ransomware attack. An employee opened an attachment that was received via an SMS attack on a company-issued mobile device while connected to the network. Which of the following actions would help during the forensic analysis of the mobile device? (Select TWO)

• A. Resetting the phone to factory settings

  B. Rebooting the phone and installing the latest security updates

• C. Documenting the respective chain of custody

• D. Uninstalling any potentially unwanted programs

• E. Performing a memory dump of the mobile device for analysis

• F. Unlocking the device by browsing the eFuse

NO.52 An analyst receives an alert from the continuous-monitoring solution about unauthorized

changes to the firmware versions on several field devices. The asset owners confirm that no firmware

version updates were performed by authorized technicians, and customers have not reported any

performance issues or outages. Which Of the following actions would be BEST for the analyst to

recommend to the asset owners to secure the devices from further exploitation?

• A. Change the passwords on the devices.

• B. Implement BIOS passwords.

• C. Remove the assets from the production network for analysis

• D. Report the findings to the threat intel community.

NO.53 A security analyst reviews a recent network capture and notices encrypted inbound traffic on TCP port 465 was coming into the company's network from a database server. Which of the following will the security analyst MOST likely identify as the reason for the traffic on this port?

• A. The server is receiving a secure connection using the new TLS 1.3 standard

• B. Someone has configured an unauthorized SMTP application over SSL

• C. The traffic is common static data that Windows servers send to Microsoft

• D. A connection from the database to the web front end is communicating on the port

NO.54 Due to the continued support of legacy applications, an organization's enterprise password complexity rules are inadequate for its required security posture. Which of the following is the BEST compensating control to help reduce authentication compromises?

• A. Smart cards

• B. Multifactor authentication

• C. Biometrics

• D. Increased password-rotation frequency

NO.55 A security analyst identified some potentially malicious processes after capturing the contents of memory from a machine during incident response. Which of the following procedures is the NEXT step for further in investigation?

• A. Data carving

• B. Timeline construction

• C. File cloning

• D. Reverse engineering

NO.56 A company's Chief Information Officer wants to use a CASB solution to ensure policies are

being met during cloud access. Due to the nature of the company's business and risk appetite, the

management team elected to not store financial information in the cloud. A security analyst needs to

recommend a solution to mitigate the threat of financial data leakage into the cloud. Which of the

following should the analyst recommend?

• A. Utilize the CASB to enforce DLP data-at-rest protection for financial information that is stored on

  premises.

• B. Do not utilize the CASB solution for this purpose, but add DLP on premises for data in motion.

• C. Utilize the CASB to enforce DLP data-in-motion protection for financial information moving to the

  cloud.

• D. Do not utilize the CASB solution for this purpose, but add DLP on premises for data at res

NO.57 A general contractor has a list of contract documents containing critical business data that are stored at a public cloud provider. The organization's security analyst recently reviewed some of the storage containers and discovered most of the containers are not encrypted. Which of the following configurations will provide the MOST security to resolve the vulnerability?

• A. Upgrading TLS 1.2 connections to TLS 1.3

• B. Implementing AES-256 encryption on the containers

• C. Enabling SHA-256 hashing on the containers

• D. Implementing the Triple Data Encryption Algorithm at the file level

NO.58 It is important to parameterize queries to prevent:

• A. the execution of unauthorized actions against a database.

• B. a memory overflow that executes code with elevated privileges.

• C. the esrtablishment of a web shell that would allow unauthorized access.

• D. the queries from using an outdated library with security vulnerabilities.

NO.59 A cybersecurity analyst routinely checks logs, querying for login attempts. While querying for unsuccessful login attempts during a five-day period, the analyst produces the following report

• A. Users 4 and 5 are using their credentials to transfer files to multiple servers.

• B. Users 4 and 5 are using their credentials to run an unauthorized scheduled task targeting some

  servers In the cloud.

• C. An unauthorized user is using login credentials in a script.

• D. A bot is running a brute-force attack in an attempt to log in to the domain.

NO.60 A security analyst needs to assess the web server versions on a list of hosts to determine

which are running a vulnerable version of the software and output that list into an XML file named

webserverlist.xml. The host list is provided in a file named webserverlist.txt. Which of the following

IT Certification Guaranteed, The Easy Way!

Nmap commands would BEST accomplish this goal?

• A. nmap -iL webserverlist.txt -sC -p 443 -oX webserverlist.xml

• B. nmap -iL webserverlist.txt -sV -p 443 -oX webserverlist.xml

• C. nmap -iL webserverlist.txt -F -p 443 -oX webserverlist.xml

• D. nmap --takefile webserverlist.txt --outputfileasXML webserverlist.xml -scanports 443