Security 8

Which of the following consequences would a retail chain most likely face from customers in the event the retailer is non-compliant with PCI DSS?

• Contractual impacts

• Sanctions

• Fines

• Reputational damage

Answer explanation

The question says, 'from customers' who won't enforce the other options.

A security analyst is reviewing logs and discovers the following:

149.32.228.10 -- [28/Jan/2023:16:32:45 -0900] "GET / HTTP/1.0"

User-Agent: ${/bin/sh/ id} 200 397

Which of the following should be used to best mitigate this type of attack?

• Input sanitization

• Secure cookies

• Static code analysis

• Sandboxing

Answer explanation

The log entry in the image suggests that the system is potentially under attack, as the User-Agent header contains what looks like a shell command: ${/bin/sh/id}. This type of activity may indicate an attempted command injection attack, where an attacker is trying to execute shell commands via a vulnerable web application.

An administrator is installing an SSL certificate on a new system. During testing, errors indicate that the certificate is not trusted. The administrator has verified with the issuing CA and has validated the private key. Which of the following should the administrator check for next?

• If the wildcard certificate is configured

• If the certificate signing request is valid

• If the root certificate is installed

• If the public key is configured

Answer explanation

For an SSL/TLS certificate to be trusted, the system must have the root certificate (and any intermediate certificates) from the issuing Certificate Authority (CA) installed in its trusted certificate store. If the root or intermediate certificate is missing, the system will not recognize the SSL certificate as valid, leading to trust errors during testing.

An employee emailed a new systems administrator a malicious web link and convinced the administrator to change the email server’s password. The employee used this access to remove the mailboxes of key personnel. Which of the following security awareness concepts would help prevent this threat in the future?

• Recognizing phishing

• Providing situational awareness training

• Using password management

• Reviewing email policies

Answer explanation

This scenario describes a phishing attack, where the employee tricked the systems administrator into performing an action (changing the email server's password) by sending a malicious web link. Security awareness training that focuses on recognizing phishing attempts can help employees and administrators identify and avoid such manipulative tactics in the future. Training should include spotting suspicious links, verifying requests, and understanding social engineering techniques.

Which of the following strategies should an organization use to efficiently manage and analyze multiple types of logs?

• Deploy a SIEM solution

• Create custom scripts to aggregate and analyze logs.

• Implement EDR technology.

• Install a unified threat management appliance.

Answer explanation

A. Deploy a SIEM solution Explanation: SIEM (Security Information and Event Management) solutions are designed specifically to collect, aggregate, and analyze large volumes of logs from different sources (e.g., network devices, servers, endpoints, security systems).

A new security regulation was announced that will take effect in the coming year. A company must comply with it to remain in business. Which of the following activities should the company perform next?

• Gap analysis

• Policy review

• Security procedure evaluation

• Threat scope reduction

Answer explanation

Gap Analysis in Security: Compares what you have (existing security) vs what you need (required security) Shows what's missing Creates plan to fill the gaps Helps meet new security requirements efficiently Like a security checklist that shows:

Have ✓

Need ✗

Plan to get there →

An accountant is transferring information to a bank over FTP. Which of the following mitigations should the accountant use to protect the confidentiality of the data?

• Tokenization

• Data masking

• Encryption

• Obfuscation

Answer explanation

C. Encryption Explanation: When transferring sensitive data over FTP (File Transfer Protocol), encryption is the best method to ensure the confidentiality of the data. FTP by itself does not provide any encryption, meaning that the data is transmitted in plain text, which can be intercepted by attackers.

An organization has recently decided to implement SSO. The requirements are to leverage access tokens and focus on application authorization rather than user authentication. Which of the following solutions would the engineering team most likely configure?

• LDAP

• Federation

• SAML

• OAuth

Answer explanation

For modern web applications and APIs: OAuth is preferred for authorization SAML is preferred for authentication LDAP is often used more for internal network resources and directory services

Which of the following would most likely be used by attackers to perform credential harvesting?

• Social engineering

• Supply chain compromise

• Third-party software

• Rainbow table

A security engineer would like to enhance the use of automation and orchestration within the SIEM. Which of the following would be the primary benefit of this enhancement?

• It increases complexity.

• It removes technical debt.

• It adds additional guard rails.

• It acts as a workforce multiplier.

Answer explanation

Automation and orchestration within a SIEM system allow security teams to respond to incidents more quickly and efficiently, without requiring as much manual effort for repetitive tasks. This effectively "multiplies" the workforce's capability, enabling a smaller team to handle more incidents or data points.