PRACTICE EXAM - 116 QUESTIONS

A new employee logs in to the email system for the first time and notices a message from human resources about onboarding. The employee hovers a few of the links and discovers that the links do not correspond to links associated with the company. Which of the following attack vectors is most likely being used?

• Social Engineering

• Default Password

• Business Email

• Unsecured Network

Answer explanation

The attack vector most likely being used is Social Engineering.

This scenario suggests a phishing attempt, where an attacker is trying to deceive the new employee by sending a fake onboarding email with malicious links that do not correspond to legitimate company links.

A company is located to an area prone to hurricanes is developing a disaster recovery plan and looking at site considerations that allow the company to immediately continue operations. Which of the following is the best type of site for this company?

• Warm

• Tertiary

• Hot

• Cold

Answer explanation

The best type of site for this company is Hot.

A hot site is a fully operational, ready-to-go site with all the necessary hardware, software, and data backups. It allows a company to immediately continue operations with minimal downtime, which is crucial for a company in a hurricane-prone area.

4o

A bank setup a new server that contains customer's PII. Which of the following should the bank use to make sure the sensitive data is not modified?

• Network access control

• Full disk encryption

• User behavior analytics

• File Integrity Monitoring

Answer explanation

The bank should use File Integrity Monitoring.

File Integrity Monitoring (FIM) is designed to ensure that sensitive data, such as customers' Personally Identifiable Information (PII), is not modified without authorization. It continuously monitors and alerts on any changes to critical files, ensuring data integrity.

An organization wants to limit potential impact to its log-in database on the event of breach. Which of the following options is the security team most likely to recommend?

• Hashing

• Tokenization

• Obfuscation

• Segmentation

Answer explanation

The security team is most likely to recommend Hashing.

Hashing is a cryptographic technique that converts passwords into a fixed-size string of characters, which is irreversible. This means that even if the login database is breached, the actual passwords are not exposed in plaintext. Proper hashing techniques, combined with salting, significantly enhance the security of stored passwords, reducing the impact of a potential breach.

Client files can only be accessed by employees who need to know the information and have specified roles in the company. Which of the following best describes this security concept?

• Availability

• Integrity

• Confidentiality

• Non-repudation

Answer explanation

The security concept that best describes this scenario is Confidentiality.

Confidentiality ensures that sensitive information is only accessible to those who are authorized to view it, based on their roles and need-to-know basis. This prevents unauthorized access to client files and protects sensitive data

The Chief Information Security Officer (CISO) at a large company would like to gain an understanding on how the company's security policies compare to the requirements imposed by external regulators. Which of the following should the CISO use?

• Internal Audit

• Attestation

• Penetration Test

• External Examination

Answer explanation

The CISO should use Attestation.

Attestation involves obtaining a formal statement or certification from an external party, often an auditor, that the company’s security policies and controls meet the requirements imposed by external regulators. This process provides assurance that the organization is compliant with regulatory standards.

A security analyst investigating a workstation that is suspected of outbound communication to a command-and-control server. During the investigation, the analyst discovered that logs on the endpoint were detailed. Which of the following logs would the analyst most likely look at next?

• IPS

• Firewall

• ACL

• Windows Security

Answer explanation

The analyst would most likely look at Firewall logs next.

Firewall logs provide detailed records of inbound and outbound network traffic. They can help the analyst identify if the workstation is communicating with known or suspected command-and-control servers, which is crucial for detecting and mitigating potential threats.

A company wants to verify that the software company came from the vendor that the company purchased the software from. Which of the following is the best for the company to confirm this information?

• Search the executable for ASCII strings

• Validate the code signature

• Generate a hash of the files

• Execute the code in a sandbox

Answer explanation

The best option for the company to confirm that the software came from the vendor is Validate the code signature.

Code signing ensures that the software has not been altered or tampered with and confirms the identity of the vendor who provided the software. By validating the code signature, the company can verify the authenticity of the software and ensure it is from the trusted vendor.

Which of the following actions should a security engineer take to ensure workstations and servers are properly monitored for unauthorized changes and software?

• Configure all systems to log scheduled tasks

• Collect and monitor all traffic exiting the network

• Block traffic on known malicious signatures

• Install endpoint management software on all systems

Answer explanation

The security engineer should Install endpoint management software on all systems.

Endpoint management software allows for centralized monitoring and management of workstations and servers. It can track and report unauthorized changes, software installations, and other critical security events across all systems, ensuring they are properly monitored.

Which of the following examples would be best mitigated by input sanitization?

• nmap -10.11.1.130

• Browser message: "Your connection is not private."

• Email message: "Click this link to get your free gift card."

• <script>alert("Warning!");</script>

Answer explanation

The example best mitigated by input sanitization is <script>alert("Warning!") ;</script>.

Input sanitization helps prevent cross-site scripting (XSS) attacks by removing or encoding potentially malicious input before it is processed or displayed. In this case, sanitizing the input would prevent the execution of the script tag and any JavaScript code it contains.