Cybersecurity Quiz CompTIA 2

A security engineer is concerned that the strategy for detection on endpoints is too heavily dependent on previously defined attacks. The engineer would like a tool to monitor for changes to key files and network traffic on the device. Which of the following tools BEST addresses both detection and prevention?

• NIDS(Network based intrusion detection system

• AV(antivirus)

• HIPs(Host-based intrusion prevention system)

• NGFW( Next Generation Firewall)

A forensics investigator is examining a number of unauthorized payments that were reported on the company's website. Some unusual log entries show users received an email for an unwanted mailing list and clicked on a link to attempt to unsubscribe. One of the users reported the email to the phishing team, and the forwarded email revealed the link to be: .

<a href=https://www.company.com/payto.do?routing=00001111&acct=22223334&amount=250">Click here to unsubscribe</a>

Which of the following will the forensics investigator MOST likely determine has occurred?

• SQL(structured query language) injection

• Broken authentication

• XSS(Cross site scripting)

• XSRF(Cross site request forgery)

Which of the following employee roles is responsible for protecting an organization's collected personal information?

• CTO (Chief Technology Officer)

• DPO( Data protection officer)

• CEO

• DBA (database administrator)

A company is under investigation for possible fraud. As part of the investigation, the authorities need to review all emails and ensure data is not deleted. Which of the following should the company implement to assist in the investigation?

• Legal hold

• Chain of custody

• Data loss prevention

• Content filter

Which of the following would BEST provide detective and corrective controls for thermal regulation?

• A smoke detector

• Fire Alarm

• An HVAC System

• A fire suppression system

• Guards

Which of the following terms should be included in a contract to help a company monitor the ongoing security maturity of a new vendor?

• A right-to-audit clause allowing for annual security audits

• Requirements for event logs to be kept for a minimum of 30 days

• Integration of threat intelligence in the company’s AV (Antivirus)

• A data-breach clause requiring disclosure of significant data loss

A systems administrator is troubleshooting a server's connection to an internal web server. The administrator needs to determine the correct ports to use. Which of the following tools BEST shows which ports on the web server are in a listening state?

• ipconfig

• ssh

• ping

• netstat

Employees are having issues accessing the company's website. Some employees report very slow performance, while others cannot access the website at all. The web and security administrators search the logs and find millions of half-open connections to port 443 on the web server. Further analysis reveals thousands of different source IPs initiating this traffic. Which of the following attacks is MOST likely occurring?

• DDoS. (Distributed Denial of Service)

• Man in the middle

• MAC(media access control) flooding

• Domain hijacking

An attacker has determined the best way to impact operations is to infiltrate third party software vendors. Which of the following vectors is being exploited?

• Social media

• Cloud

• Supply chain

• Social engineering

The SOC(Security operations center) for a large MSSP( Manages Security Service Provider) is meeting to discuss the lessons learned from a recent incident that took much too long to resolve. This type of incident has become more common in the recent weeks and is consuming large amounts of the analyst's time due to manual tasks being performed. Which of the following solutions should the SOC consider to be BEST improve its response time?

• Configure a NIDS(Network based intrusion detection system) appliance using a Switched Port Analyzer

• Collect OSINT( Open-source intelligence) and catalog the artifacts in a central repository

• Implement a SOAR(Security orchestration, automation, response) with customizable playbooks

• Install a SIEM( Security Information and event management) with community-driven threat intelligence