CySA + (301-350)

NO.301 The security team decides to meet informally to discuss and test the response plan for potential security breaches and emergency situations. Which of the following types of training will the security team perform?

• A. Tabletop exercise

• B. Red-team attack

• C. System assessment implementation

• D. Blue-team training

• E. White-team engagement

NO.302 A company creates digitally signed packages for its devices. Which of the following BEST describes the method by which the security packages are delivered to the company's customers?

• A. Trusted firmware updates

• B. SELinux

• C. eFuse

• D. Anti-tamper mechanism

NO.303 A security analyst is investigating a reported phishing attempt that was received by many users throughout the company The text of one of the emails is shown below:

Return-Path: <[e-mail]>

Received: from [122.167.40.119]

Message-ID: <[e-mail]>

Date:23 May 2020 11:40:36 -0400

From: [e-mail]

X-Accept-Language: en-us,en

MIME-Version: 1.0

To: Paul Vieira <[e-mail]>

Subject: Account Lockout

Content- Type: HTML;

Office 365 User. It looks like you account has been locked out Please click this link and follow the pfompts to restore access Regards. Security Team Due to the size of the company and the high storage requirements, the company does not log DNS requests or perform packet captures of network traffic, but rt does log network flow data Which of the following commands will the analyst most likely execute NEXT?

• A. telnet office365.com 25

• B. tracert 122.167.40.119

• C. curl http:// accountfix-office365.com/login. php

• D. nslookup accountfix-office365.com

NO.304 A security is reviewing a vulnerability scan report and notes the following finding:

As part of the detection and analysis procedures, which of the following should the analyst do NEXT?

• A. Patch or reimage the device to complete the recovery

• B. Restart the antiviruses running processes

• C. Isolate the host from the network to prevent exposure

• D. Confirm the workstation's signatures against the most current signatures.

NO.305 Which of the following software assessment methods would be BEST for gathering data related to an application's availability during peak times?

• A. Security regression testing

• B. Stress testing

• C. Static analysis testing

• D. Dynamic analysis testing

• E. User acceptance testing

NO.306 A system administrator is doing network reconnaissance of a company's external network to determine the vulnerability of various services that are running. Sending some sample traffic to the external host, the administrator obtains the following packet capture:

Based on the output, which of the following services should be further tested for vulnerabilities?

• A. SSH

• B. HTTP

• C. SMB

• D. HTTPS

NO.307 A cybersecurity analyst is currently checking a newly deployed server that has an access control list applied. When conducting the scan, the analyst received the following code snippet of results:

Which of the following describes the output of this scan?

• A. The analyst has discovered a False Positive, and the status code is incorrect providing an OK message.

• B. The analyst has discovered a True Positive, and the status code is correct providing a file not found error message.

• C. The analyst has discovered a True Positive, and the status code is incorrect providing a forbidden message.

• D. The analyst has discovered a False Positive, and the status code is incorrect providing a server error message.

NO.308 According to a static analysis report for a web application, a dynamic code evaluation script injection vulnerability was found. Which of the following actions is the BEST option to fix the vulnerability in the source code?

• A. Delete the vulnerable section of the code immediately.

• B. Create a custom rule on the web application firewall.

• C. Validate user input before execution and interpretation.

• D. Use parameterized queries.

NO.309 During an incident investigation, a security analyst acquired a malicious file that was used as a backdoor but was not detected by the antivirus application. After performing a reverse-engineering procedure, the analyst found that part of the code was obfuscated to avoid signature detection. Which of the following types of instructions should the analyst use to understand how the malware was obfuscated and to help deobfuscate it?

• A. MOV

• B. ADD

• C. XOR

• D. SUB

• E. MOVL

NO.310 In web application scanning, static analysis refers to scanning:

• A. the system for vulnerabilities before installing the application.

• B. the compiled code of the application to detect possible issues.

• C. an application that is installed and active on a system.

• D. an application that is installed on a system that is assigned a static IP.