Security test 2

A security administrator has performed an audit of the

organization’s production web servers, and the results

have identified banner information leakage, web services

running from a privileged account, and inconsistencies

with SSL certificates. Which of the following would be

the BEST way to resolve these issues?

• Server hardening

• Multi-factor authentication

• Enable HTTPS

• Run operating system updates

A shipping company stores information in small regional

warehouses around the country. The company keeps an

IPS online at each warehouse to watch for suspicious

traffic patterns. Which of the following would BEST

describe the security control used at the warehouse?

• Managerial

• Compensating

• Physical

• Detective

The Vice President of Sales has asked the IT team to

create daily backups of the sales data. The Vice President

is an example of a:

• Data owner

• Data protection officer

• Data steward

• Data processor

A security engineer is preparing to conduct a penetration

test. Part of the preparation involves reading through

social media posts for information about a third-party

website. Which of the following describes this practice?

• Partially known environment

• OSINT

• Exfiltration

• Active footprinting

A company would like to automate their response when

a virus is detected on company devices. Which of the

following would be the BEST way to implement

this function?

• Active footprinting

• IaaS

• Vulnerability scan

• SOAR

A user in the accounting department has received an

email from the CEO requesting payment for a recently

purchased tablet. However, there doesn't appear to be a

purchase order associated with this request. Which of the

following would be the MOST likely attack associated

with this email?

• Spear phishing

• Watering hole attack

• Invoice scam

• Credential harvesting

A company has been informed of a hypervisor

vulnerability that could allow users on one virtual

machine to access resources on another virtual machine.

Which of the following would BEST describe this

vulnerability?

• Containerization

• Service integration

• SDN

• VM escape

While working from home, users are attending a project

meeting over a web conference. When typing in the

meeting link, the browser is unexpectedly directed to a

different website than the web conference. Users in the

office do not have any issues accessing the conference

site. Which of the following would be the MOST likely

reason for this issue?

• Bluejacking

• Wireless disassociation

• DDoS

• DNS poisoning

A company is launching a new internal application that

will not start until a username and password is entered

and a smart card is plugged into the computer. Which of

the following BEST describes this process?

• Federation

• Accounting

• Authentication

• Authorization

An online retailer is planning a penetration test as part

of their PCI DSS validation. A third-party organization

will be performing the test, and the online retailer has

provided the Internet-facing IP addresses for their public

web servers but no other details. What penetration

testing methodology is the online retailer using?

• Known environment

• Passive footprinting

• Partially known environment

• Ping scan