CYSA + (351-400)

NO.351 A security analyst notices the following entry while reviewing the server togs OR 1=1' ADDUSER attacker' PW 1337password' ---- Which of the following events occurred?

• A. CSRF

• B. XSS

• C. SQLi

• D. RCE

NO.352 Which of the following is MOST dangerous to the client environment during a vulnerabilityassessment penetration test?

• A. There is a longer period of time to assess the environment.

• B. The testing is outside the contractual scope

• C. There is a shorter period of time to assess the environment

• D. No status reports are included with the assessment.

NO.353 A security analyst for a large pharmaceutical company was given credentials from a threatintelligence resources organisation for Internal users, which contain usernames and valid passwordsfor company accounts. Which of the following is the FIRST action the analyst should take as part ofsecurity operations monitoring?

• A. Run scheduled antivirus scans on all employees' machines to look for malicious processes

• B. Reimage the machines of all users within the group in case of a malware infection.

• C. Change all the user passwords to ensure the malicious actors cannot use them

• D. Search the event logs for event identifiers that indicate Mimikatz was used

NO.354 When attempting to do a stealth scan against a system that does not respond to ping, whichof the following Nmap commands BEST accomplishes that goal?

• A. nmap -sA -O <system> -noping

• B. nmap -sT -O <system> -P0

• C. nmap -sS -O <system> -P0

• D. nmap -sQ -O <system> -P0

NO.355 Due to a rise m cyberattackers seeking PHI, a healthcare company that collects highlysensitive data from millions of customers is deploying a solution that will ensure the customers' datais protected by the organization internally and externally Which of the following countermeasurescan BEST prevent the loss of customers' sensitive data?

• A. Implement privileged access management.

• B. Implement a risk management process.

• C. Implement multifactor authentication.

• D. Add more security resources to the environment

NO.356 A security analyst inspects the header of an email that is presumed to be malicious and seesthe following: Which of the following is inconsistent with the rest of the header and should be treated assuspicious?

• A. The subject line

• B. The sender's email address

• C. The destination email server

• D. The use of a TLS cipher

NO.357 Which of the following is a best practice when sending a file/data to another individual in anorganization?

• A. Encrypt the file but do not compress it

• B. When encrypting, split the file: and then compress each file

• C. Compress and then encrypt the file.

• D. Encrypt and then compress the file.

NO.358 When investigating a report of a system compromise, a security analyst views the following/var/log/secure log file:Which of the following can the analyst conclude from viewing the log file?

• A. The comptia user knows the sudo password.

• B. The comptia user executed the sudo su command.

• C. The comptia user knows the root password.

• D. The comptia user added himself or herself to the /etc/sudoers file.

NO.359 An organization has several systems that require specific logons Over the past few months,the security analyst has noticed numerous failed logon attempts followed by password resets. Whichof the following should the analyst do to reduce the occurrence of legitimate failed logons andpassword resets?

• A. Use SSO across all applications

• B. Perform a manual privilege review

• C. Adjust the current monitoring and logging rules

• D. Implement multifactor authentication

NO.360 You are a penetration tester who is reviewing the system hardening guidelines for acompany. Hardening guidelines indicate the following.There must be one primary server or service per device.Only default port should be usedNon- secure protocols should be disabled.IT Certification Guaranteed, The Easy Way!119The corporate internet presence should be placed in a protected subnetInstructions :Using the available tools, discover devices on the corporate network and the services running onthese devices.You must determineip address of each deviceThe primary server or service each deviceThe protocols that should be disabled based on the hardening guidelines

• 
•