CySA + (201-250)

Q:201- The steering committee for information security management annually reviews the security

incident register for the organization to look for trends and systematic issues.The steering committee wants to rank the risks based on past incidents to improve the security program for next year. Below is the incident register for the organization.

Which of the following should the organization consider investing in FIRST due to the potential

impact of availability?

• A. Hire a managed service provider to help with vulnerability management

• B. Build a warm site in case of system outages

• C. Invest in a failover and redundant system, as necessary

• D. Hire additional staff for the IT department to assist with vulnerability management and log review

NO.202 A security administrator needs to provide access from partners to an Isolated laboratory network inside an organization that meets the following requirements:

*The partners' PCs must not connect directly to the laboratory network.

*The tools the partners need to access while on the laboratory network must be available to all partners

*The partners must be able to run analyses on the laboratory network, which may take hours to complete

Which of the following capabilities will MOST likely meet the security objectives of the request?

(ExamTopic'e gore guncellendi)

• A. Deployment of a jump box to allow access to the laboratory network and use of VDI in persistent mode to provide the necessary tools for analysis

• B. Deployment of a firewall to allow access to the laboratory network and use of VDI in nonpersistent mode to provide the necessary tools tor analysis

• C. Deployment of a firewall to allow access to the laboratory network and use of VDI In persistent mode to provide the necessary tools for analysis

• D. Deployment of a jump box to allow access to the Laboratory network and use of VDI in nonpersistent mode to provide the necessary tools for analysi

Q: 203 - A remote code execution vulnerability was discovered in the RDP. An organization currently uses RDP for remote access to a portion of its VDI environment. The analyst verified network-level authentication is enabled. Which of the following is the BEST remediation for this vulnerability?

• A. Verify the latest endpoint-protection signature is in place.

• B. Verify the corresponding patch for the vulnerability is installed

• C. Verify the system logs do not contain indicator of compromise.

• D. Verify the threat intelligence feed is updated with the latest solutions

Q: 204 A security analyst is reviewing the logs from an internal chat server.

The chat.log file is too

large to review manually, so the analyst wants to create a shorter log file that only includes lines associated with a user demonstrating anomalous activity. Below is a snippet of the log:

• A. grep -v chatter14 chat.log

• B. grep -i pythonfun chat.log

• C. grep -i javashark chat.log

• D. grep -v javashark chat.log

• E. grep -v pythonfun chat.log

  F. grep -i chatter14 chat.log

Q: 206 - A storage area network (SAN) was inadvertently powered off while power maintenance was being performed in a datacenter. None of the systems should have lost all power during the maintenance. Upon review, it is discovered that a SAN administrator moved a power plug when

testing the SAN's fault notification features.

Which of the following should be done to prevent this issue from reoccurring?

• A. Ensure both power supplies on the SAN are serviced by separate circuits, so that if one circuit goes down, the other remains powered.

• B. Install additional batteries in the SAN power supplies with enough capacity to keep the system

  powered on during maintenance operations.

• C. Ensure power configuration is covered in the datacenter change management policy and have the

  SAN administrator review this policy.

• D. Install a third power supply in the SAN so loss of any power intuit does not result in the SAN

  completely powering off.

Q: 207 - While conoXicting a cloud assessment, a security analyst performs a Prowler scan, which

generates the following within the report:

Based on the Prowler report, which of the following is the BEST recommendation?

• A. Delete Cloud Dev access key 1

• B. Delete BusinessUsr access key 1.

• C. Delete access key 1.

• D. Delete access key 2.

Q: 208 -A security analyst needs to perform a search for connections with a suspicious IP on the network traffic. The company collects full packet captures at the Internet gateway and retains them for one week. Which of the following will enable the analyst to obtain the BEST results?

• A. tcpdump -n -r internet.pcap host <suspicious ip>

• B. strings internet.pcap | grep <suspicious ip>

• C. grep -a <suspicious ip> internet.pcap

• D. npcapd internet.pcap | grep <suspicious ip>

Q: 209 - A security analyst receives an alert from the SIEM about a possible attack happening on the network The analyst opens the alert and sees the IP address of the suspected server as 192.168.54.66. which is part of the network 192 168 54 0/24. The analyst then pulls all the command

history logs from that server and sees the following

Which of the following activities is MOST likely happening on the server?

(ExamTopic'e gore guncellendi)

• A. A MITM attack

• B. Enumeration

• C. Fuzzing

• D. A vulnerability scan

Q: 210 - An analyst determines a security incident has occurred Which of the following is the most appropnate NEXT step in an incident response plan?

• A. Consult the malware analysis process

• B. Consult the disaster recovery plan

• C. Consult the data classification process

• D. Consult the communications plan

Q: 211 - A large organization wants to move account registration services to the cloud to benefit from faster processing and elasticity. Which of the following should be done FIRST to determine the potential risk to the organization?

• A. Establish a recovery time objective and a recovery point objective for the systems being moved

• B. Calculate the resource requirements for moving the systems to the cloud

• C. Determine recovery priorities for the assets being moved to the cloud-based systems

• D. Identify the business processes that will be migrated and the criticality of each one

• E. Perform an inventory of the servers that will be moving and assign priority to each one