Question #:26
Which of the following is the best reason to complete an audit in a banking environment?

• Regulatory requirement
  

• Organizational change

• Self-assessment requirement

• Service-level requirement
  

Question #:27
A security analyst reviews domain activity logs and notices the following:

Which of the following is the best explanation for what the security analyst has discovered?

• The user jsmith's account has been locked out.
  

• A keylogger is installed on [smith's workstation
  

• An attacker is attempting to brute force ismith's account.
  

• Ransomware has been deployed in the domain.
  

Question #:28
A security administrator is deploying a DLP solution to prevent the exfiltration of sensitive customer data. Which of the following should the administrator do first?

• Block access to cloud storage websites.
  

• Create a rule to block outgoing email attachments
  

• Apply classifications to the data.
  

• Remove all user permissions from shares on the file server.
  

Question #:29
Which of the following describes the process of concealing code or text inside a graphical image?

• Symmetric encryption
  

• Hashing
  

• Data masking
  

• Steganography
  

Question #:30
Which of the following must be considered when designing a high-availability network? (Select two).

• Ease of recovery
  

• Ability to patch
  

• Physical isolation
  

• Responsiveness
  

• Attack surface
  

Question #:31
A data administrator is configuring authentication for a SaaS application and would like to reduce the number of credentials employees need to maintain. The company prefers to use domain credentials to access new SaaS applications. Which of the following methods would allow this functionality?

• SSO
  

• LEAP
  
  

• MFA
  

• PEAP
  

Question #:32
Which of the following roles, according to the shared responsibility model, is responsible for securing the company’s database in an IaaS model for a cloud environment?

• Client

  
  

• Third-party vendor

• Cloud provider

• DBA

Question #:33
A systems administrator receives the following alert from a file integrity monitoring tool:

The hash of the cmd.exe file has changed.

The systems administrator checks the OS logs and notices that no patches were applied in the last two months. Which of the following most likely occurred?

• The end user changed the file permissions.
  

• A cryptographic collision was detected.
  

• A snapshot of the file system was taken.
  

• A rootkit was deployed.
  

Question #:34
A security manager created new documentation to use in response to various types of security incidents. Which of the following is the next step the manager should take?

• Set the maximum data retention policy.

• Securely store the documents on an air-gapped network.

• Review the documents' data classification policy.

• Conduct a tabletop exercise with the team.

Question #:35
A small business uses kiosks on the sales floor to display product information for customers. A security team discovers the kiosks use end-of-life operating systems. Which of the following is the security team most likely to document as a security implication of the current architecture?

• Patch availability

  
  

• Product software compatibility

• Ease of recovery

• Cost of replacement