Security + quiz 13

A security analyst needs to be proactive in understand the types of attacks that could potentially target the company's execute. Which of the following intelligence sources should to security analyst review?

• Vulnerability feeds

• Trusted automated exchange of indicator information

• Structured threat information expression

• Industry information-sharing and collaboration groups

A cybersecurity department purchased o new PAM solution. The team is planning to randomize the service account credentials of the Windows server first. Which of the following would be the BEST method to increase the security on the Linux server?

• Randomize the shared credentials

• Use only guest accounts to connect.

• Use SSH keys and remove generic passwords

• Remove all user accounts.

A security audit has revealed that a process control terminal is vulnerable to malicious users installing and executing software on the system. The terminal is beyond end-of-life support and cannot be upgraded, so it is placed on a projected network segment. Which of the following would be MOST effective to implement to further mitigate the reported vulnerability?

• DNS sinkholding

• DLP rules on the terminal

• An IP blacklist

• Application whitelisting

An organization has decided to host its web application and database in the cloud. Which of the following BEST describes the security concerns for this decision?

• Access to the organization's servers could be exposed to other cloud-provider clients

• The cloud vendor is a new attack vector within the supply chain

• Outsourcing the code development adds risk to the cloud provider

• Vendor support will cease when the hosting platforms reach EOL.

A user reports constant lag and performance issues with the wireless network when working at a local coffee shop. A security analyst walks the user through an installation of Wireshark and get a five-minute pcap to analyze. The analyst observes the following output:

Which of the following attacks does the analyst MOST likely see in this packet capture?

• Session replay

• Evil twin

• Bluejacking

• ARP poisoning

A user recently attended an exposition and received some digital promotional materials. The user later noticed blue boxes popping up and disappearing on the computer, and reported receiving several spam emails, which the user did not open. Which of the following is MOST likely the cause of the reported issue?

• There was a drive-by download of malware

• The user installed a cryptominer

• The OS was corrupted

• There was malicious code on the USB drive

A security analyst is performing a packet capture on a series of SOAP HTTP requests for a security assessment. The analyst redirects the output to a file After the capture is complete, the analyst needs to review the first transactions quickly and then search the entire series of requests for a particular string. Which of the following would be BEST to use to accomplish the task?

(Select TWO).

• head

• Tcpdump

• grep

• rail

• curl

The Chief Executive Officer (CEO) of an organization would like staff members to have the flexibility to work from home anytime during business hours, incident during a pandemic or crisis, However, the CEO is concerned that some staff members may take advantage of the of the flexibility and work from high-risk countries while on holidays work to a third-party organization in another country. The Chief information Officer (CIO) believes the company can implement some basic to mitigate the majority of the risk. Which of the following would be BEST to mitigate CEO's concern?

(Select TWO).

• Geolocation

• Time-of-day restrictions

• Certificates

• Geotagging

• Role-based access controls

A forensics investigator is examining a number of unauthorized payments the were reported on

the company's website. Some unusual log entries show users received an email for an unwanted

mailing list and clicked on a link to attempt to unsubscribe. One of the users reported the email to

the phishing team, and the forwarded email revealed the link to be:

<a href="httpx://www.company.com/payto.do?routing=00001111&@acct=22223333amount=250>click here to unsubscribe</a>

Which of the following will the forensics investigator MOST likely determine has occurred?

• SQL injection

• CSRF

• XSS

• XSRF

Which of the following allows for functional test data to be used in new systems for testing and training purposes to protect the read data?

• Data encryption

• Data masking

• Data deduplication

• Data minimization