Security 6

A hosting provider needs to prove that its security controls have been in place over the last six months and have sufficiently protected customer data. Which of the following would provide the best proof that the hosting provider has met the requirements?

• NIST CSF

• SOC 2 Type 2 report

• CIS Top 20 compliance reports

• Vulnerability report

Answer explanation

ViciousAkira

Highly Voted 8 months, 3 weeks ago

B. SOC 2 Type 2 report SOC 2 stands for System and Organization Controls 2. A SOC 2 Type 2 report provides an audit of the effectiveness of security controls over a period of time (typically 6-12 months), specifically focusing on the operating effectiveness of controls related to security, availability, processing integrity, confidentiality, and privacy. This report would demonstrate that the controls were not only in place but also effectively protecting customer data over the required period.

A city municipality lost its primary data center when a tornado hit the facility. Which of the following should the city staff use immediately after the disaster to handle essential public services?

• BCP

• Communication plan

• DRP

• IRP

Answer explanation

C. DRP Disaster recovery (DR) plans define the processes and procedures that an organization will take when a disaster occurs. Unlike a BC plan, a DR plan focuses on natural and human-made disasters that may destroy facilities or infrastructure, or otherwise prevent an organization from functioning normally. A DR plan focuses on restoration or continuation of services despite a disaster.

Which of the following is considered a preventive control?

• Configuration auditing

• Log correlation

• Incident alerts

• Segregation of duties

Answer explanation

Segregation of duties is going to PREVENT users from having the ability to potentially manipulate processes within the business by splitting duties amongst others. Somewhat of a "checks and balances" kind of system.

A systems administrator notices that a testing system is down. While investigating, the systems administrator finds that the servers are online and accessible from any device on the server network. The administrator reviews the following information from the monitoring system:

Which of the following is the most likely cause of the outage?

• Denial of service

• ARP poisoning

• Jamming

• Kerberoasting

Answer explanation

A Denial of Service. This is clearly indicative of DoS attack where the two Test hosts are being overwhelmed with excessive traffic received causing them to become unresponsive and crash.

A security team has been alerted to a flood of incoming emails that have various subject lines and are addressed to multiple email inboxes. Each email contains a URL shortener link that is redirecting to a dead domain. Which of the following is the best step for the security team to take?

• Create a blocklist for all subject lines.

• Send the dead domain to a DNS sinkhole.

• Quarantine all emails received and notify all employees.

• Block the URL shortener domain in the web proxy.

Answer explanation

Block the URL shortener domain in the web proxy: Blocking the URL shortener domain in the web proxy is a good idea if you suspect that the malicious URLs lead to a harmful site, but in this case, the links are redirecting to a dead domain. The malicious domain itself is no longer active, so blocking the URL shortener might not address the immediate threat. Additionally, this step doesn't prevent other similar attacks with different shorteners or domains in the future.

A security administrator is working to secure company data on corporate laptops in case the laptops are stolen. Which of the following solutions should the administrator consider?

• Disk encryption

• Data loss prevention

• Operating system hardening

• Boot security

A company needs to keep the fewest records possible, meet compliance needs, and ensure destruction of records that are no longer needed. Which of the following best describes the policy that meets these requirements?

• Security policy

• Classification policy

• Retention policy

• Access control policy

Answer explanation

C. Retention policy. Reasoning: Security policy: While a security policy is important for protecting sensitive information, it doesn't specifically address the retention and destruction of records. Classification policy: A classification policy helps categorize information based on its sensitivity and value, but it doesn't provide guidelines for how long records should be retained or when they should be destroyed. Retention policy: A retention policy establishes rules for how long different types of records should be kept and when they can be destroyed. This is exactly what the company needs to meet compliance requirements and minimize the number of records it needs to store. Access control policy: An access control policy governs who can access different types of information. While it's important for data protection, it doesn't directly address the retention and destruction of records. Therefore, a retention policy is the best option for the company to meet its requirements of keeping the fewest records possible, meeting compliance needs, and ensuring destruction of records that are no longer needed.

Which of the following is a common source of unintentional corporate credential leakage in cloud environments?

• Code repositories

• Dark web

• Threat feeds

• State actors

• Vulnerability databases

Answer explanation

A. Code repositories Code repositories often contain hardcoded credentials, API keys, or other sensitive information that developers may accidentally commit without proper security measures. This can expose these credentials when the code is shared or made public, leading to unintentional leakage of corporate credentials in cloud environments.

Which of the following is the best reason an organization should enforce a data classification policy to help protect its most sensitive information?

• End users will be required to consider the classification of data that can be used in documents.

• The policy will result in the creation of access levels for each level of classification.

• The organization will have the ability to create security requirements based on classification levels.

• Security analysts will be able to see the classification of data within a document before opening it.

Answer explanation

The answer C is the best reason because it directly addresses the core benefit of data classification policies: Creating security requirements based on classification levels allows organizations to implement tailored, appropriate security measures for different types of data. This approach ensures that the most sensitive information receives the highest level of protection, while less critical data may have less stringent controls. This targeted approach optimizes security efforts and resource allocation, providing a more effective and efficient way to protect an organization's information assets.

An analyst is performing a vulnerability scan against the web servers exposed to the internet without a system account. Which of the following is most likely being performed?

• Non-credentialed scan

• Packet capture

• Privilege escalation

• System enumeration

• Passive scan

Answer explanation

The correct answer is: A. Non-credentialed scan A non-credentialed scan is a vulnerability scan conducted without using login credentials. This type of scan is limited to detecting vulnerabilities that are exposed without needing privileged access. It’s commonly used to assess what an external attacker could potentially see or exploit without having any system account access, which aligns with the scenario described.