cwicz4

A web server has been compromised due to a ransomware attack. Further Investigation reveals the ransomware has been in the server for the past 72 hours. The systems administrator needs to get the services back up as soon as possible. Which of the following should the administrator use to restore services to a secure state?

• The last incremental backup that was conducted 72 hours ago
  

• The last known-good configuration stored by the operating system

• The last full backup that was conducted seven days ago
  

• The baseline OS configuration

A company recently experienced a significant data loss when proprietary information was leaked to a competitor. The company took special precautions by using proper labels; however, email filter logs do not have any record of the incident. An investigation confirmed the corporate network was not breached, but documents were downloaded from an employee's COPE tablet and passed to the competitor via cloud storage. Which of the following is the best mitigation strategy to prevent this from happening in the future?

• User training

• CAsB
  

• MDM
  

• EDR

An organization experiences a cybersecurity incident involving a command-and-control server. Which of the following

logs should be analyzed to identify the impacted host? (Select two).

• Application
  

• Authentication
  

• Network

• Firewall

• System

Which of the following is most likely to contain ranked and ordered information on the likelihood and potential impact

of catastrophic events that may affect business processes and systems, while also highlighting the residual risks that need to be managed after mitigating controls have been implemented?

• An RTO report
  

• A risk register
  

• A business impact analysis

• An asset value register
  

• A disaster recovery plan

During an assessment, a systems administrator found several hosts running FTP and decided to immediately block FTP

communications at the firewall. Which of the following describes the greatest risk associated with using FTP?

• Private data can be leaked
  

• FTP is prohibited by internal policy.
  

• Users can upload personal files

• Credentials are sent in cleartext.

A security professional wants to enhance the protection of a critical environment that is used to store and manage a company's encryption keys. The selected technology should be tamper resistant. Which of the following should the security professional implement to achieve the goal?

• DLP

• HSM

• CA

• FIM

A company's help desk has received calls about the wireless network being down and users being unable to connect to it. The network administrator says all access points are up and running One of the help desk technicians notices the affected users are working in a building near the parking lot. Which of the following is the most likely reason for the outage?

• Someone near the building is jamming the signal
  

• A user has set up a rogue access point near the building
  

• Someone set up an evil twin access point in the affected area.
  

• The APs in the affected area have been unplugged from the network

A security analyst is hardening a network infrastructure The analyst is given the following requirements • Preserve the use of public IP addresses assigned to equipment on the core router

• Enable "in transport" encryption protection to the web server with the strongest ciphers. Which of the following should the analyst implement to meet these requirements? (Select two).

• Configure VLANs on the core router
  

• Configure NAT on the core router.
  

• Configure BGP on the core router
  

• Enable AES encryption on the web server

• Enable TLSv2 encryption on the web server

Which of the following best ensures minimal downtime for organizations with critical computing equipment located in

earthquake-prone areas?

• Generators and UPS

• Off-site replication

• Additional warm site

• Local

A technician is setting up a new firewall on a network segment to allow web traffic to the internet while hardening the network. After the firewall is configured, users receive errors stating the website could not be located. Which of the following would best correct the issue?

• Setting an explicit deny to all traffic using port 80 instead of 443

• Moving the implicit deny from the bottom of the rule set to the top

• Configuring the first line in the rule set to allow all traffic
  

• Ensuring that port 53 has been explicitly allowed in the rule set