A user logs into their computer and is presented with a screen showing a Department of Justice logo indicating the computer has been locked due to the user violating federal law. The screen gives several details of the violation and indicates that the user must pay a fine of $500 within 72 hours, or a warrant will be issued for their arrest. The user cannot unlock the system. What type of malware has likely infected the computer?

What kind of malware can spread through a network without any human interaction?

You’ve traced some anomalous network activity to malware that’s infected a whole department’s computers. They’re processing a distributed task using spare CPU cycles, communicating with a remote server, and sending emails to random targets. What kind of malware is it?

You’ve found a computer infected by stealth malware. The program installed itself as part of the computer’s boot process to gain access to the entire operating system and hide from anti-malware software. What kind of malware is it?

Which Windows encryption tool can protect the entire system volume?

Your organization has a degausser in the basement. What media can it securely destroy??

What cryptographic tool is commonly built into a motherboard?

What might protect users from copying sensitive files to external media?

Your organization has a critical database full of customer PII, and a new employee was just authorized to use it. How would you best describe the role of the system administrator who configures user permissions in the database software?

What was the first version of Windows to include real-time antivirus scanning?

A company configures workstations only to run software on an approved list. What is this an example of?

Downgrades are usually easier than upgrades.

What security feature makes it more difficult for an attacker to trick you into installing a fraudulent Ethernet driver that reports on your network activities?

What potential security risk does an SD card pose that a USB thumb drive does not?

What kind of application centrally manages security policy on all company mobile devices? Choose the best response

What are essential security steps on all mobile devices? Select all that apply.

Your company allows you to use the same smartphone for both personal and work purposes, but only if it’s one of a half-dozen different models on an approved list. If you don’t have an approved device, the company will pay for part of your upgrade. What kind of deployment model does the company use?

What kind of policy governs the removal of sensitive data and credentials when a user device is no longer used for company business?

What connection type is very similar to Bluetooth but used by more specialized devices?

You’ve taken up a contract helping to upgrade the existing industrial control network for an oil refinery. What network type should you expect to work with?

You’ve been asked to provide security advice for a custom robotics project using an off-the-shelf single-board computer and a specialized Linux operating system. What technology should you research first?

The facilities manager wants to deploy IoT devices for building automation, using an open wireless standard. Which of the following should you recommend?

An attack on your web application began with a long string of numbers sent to a field that’s only supposed to hold a four-digit variable. What kind of attack was it?

What application attacks directly target the database programs sitting behind web servers? Select all that apply.

What SQL injection technique relies on unfiltered semicolons?

What XSS techniques don’t require the attacker to store data on the target server? Select all that apply

What application vulnerability can be exploited by providing a series of standard data inputs with a specific sequence and timing?

You want to test an application to make sure it doesn’t behave insecurely when it receives non-standard input. What technique should you use?

What kind of attack do synchronizer tokens help prevent?

You're researching a recent XSS attack against a web application. The developer showed you the JavaScript code used to sanitize and validate input in the browser; even if you're not a coder, it seems like it would have prevented the attack. What is the most likely reason the web application was vulnerable?

You’re reviewing a web application. Which of these features are security warning signs? Select all that apply

What automation practice keeps code created by multiple developers from diverging or conflicting?

You’re helping a software development team choose a secure cloud-based solution. The team wants to develop custom web applications but prefer the development environment itself to be provided by the hosting service. What kind of service model should you evaluate?

What kind of virtualization relies on a “master image”?

As part of a cloud transition, your team is examining IaC approaches for cloud orchestration. You’ve been asked to tell a less technical stakeholder the relative advantages of immutable infrastructure over mutable. Which of the following might you say? Select all that apply

This morning, you received a notification about an API vulnerability in your CSP’s serverless architecture technologies. Which of your cloud-based services is most likely to be directly affected by the vulnerability or subsequent API changes?

Your organization has decided to outsource several IT services to a cloud provider. They’re hosted outside your enterprise network, but you want to centrally manage all authentication, encryption, activity logging, and other security policies for connections between local computers and the cloud. What security solution would address these issues?

On a security forum you learned that a competitor suffered a data breach when an industrial spy bypassed cloud security policies by downloading sensitive data from a company Google Docs account and sharing it on a personal Google Docs account. What security controls could prevent it from happening to you?

As part of a cloud transition, you're looking for something to tie disparate services together, like the ESB in the on-premises data center. What kind of cloud service should you look for?