532 PT1

NO.1 The process of passively gathering information prior to launching a cyberattack is called:

• (A). tailgating

• (B). reconnaissance

• (C). pharming

• (D). prepending

NO.2 A Chief Security Office's (CSO's) key priorities are to improve preparation, response, and

recovery practices to minimize system downtime and enhance organizational resilience to

ransomware attacks. Which of the following would BEST meet the CSO's objectives?

• (A). Use email-filtering software and centralized account management, patch high-risk systems, and

  restrict administration privileges on fileshares.

• (B). Purchase cyber insurance from a reputable provider to reduce expenses during an incident.

• (C). Invest in end-user awareness training to change the long-term culture and behavior of staff and

  executives, reducing the organization's susceptibility to phishing attacks.

• (D). Implement application whitelisting and centralized event-log management, and perform regular

  testing and validation of full backups.

NO.3 A new plug-and-play storage device was installed on a PC in the corporate environment. Which

of the following safeguards will BEST help to protect the PC from malicious files on the storage

device?

• (A). Change the default settings on the PC.

• (B). Define the PC firewall rules to limit access.

• (C). Encrypt the disk on the storage device.

• (D). Plug the storage device in to the UPS

NO.4 An organization is concerned about hackers potentially entering a facility and plugging in a

remotely accessible Kali Linux box. Which of the following should be the first lines of defense against

such an attack?

• (A). MAC filtering

• (B). Zero Trust segmentation

• (C). Network access control

• (D). Access control vestibules

NO.5 The following is an administrative control that would be MOST effective to reduce the

occurrence of malware execution?

• (A). Security awareness training

• (B). Frequency of NIDS updates

• (C). Change control procedures

• (D). EDR reporting cycle

NO.6 A security analyst is investigation an incident that was first reported as an issue connecting to

network shares and the internet, While reviewing logs and tool output, the analyst sees the

following:

Which of the following attacks has occurred?

• (A). IP conflict

• (B). Pass-the-hash

• (C). MAC flooding

• (D). Directory traversal

• (E). ARP poisoning

NO.7 Which of the following technical controls is BEST suited for the detection and prevention of

buffer overflows on hosts?

• (A). DLP

• (B). HIDS

• (C). EDR

• (D). NIPS

NO.8 A nuclear plant was the victim of a recent attack, and all the networks were air gapped. A

subsequent investigation revealed a worm as the source of the issue. Which of the following BEST

explains what happened?

• (A). A malicious USB was introduced by an unsuspecting employee.

• (B). The ICS firmware was outdated

• (C). A local machine has a RAT installed.

• (D). The HVAC was connected to the maintenance vendor.

NO.9 Which of the following ISO standards is certified for privacy?

• (A). ISO 9001

• (B). ISO 27002

• (C). ISO 27701

• (D). ISO 31000

NO.10 An incident, which is affecting dozens of systems, involves malware that reaches out to an

Internet service for rules and updates. The IP addresses for the Internet host appear to be different in

each case. The organization would like to determine a common IoC to support response and recovery

actions. Which of the following sources of information would BEST support this solution?

• (A). Web log files

• (B). Browser cache

• (C). DNS query logs

• (D). Antivirus