Font size
Worksheets311-350
Total questions: 40
Worksheet time: 40mins
A new security engineer has started hardening systems. One of the hardening techniques the engineer is using involves disabling remote logins to the NAS. Users are now reporting the inability to use SCP to transfer files to the NAS, even though the data is still viewable from the users PCs. Which of the following is the MOST likely cause of this issue?
(A). TFTP was disabled on the local hosts
(B). SSH was turned off instead of modifying the configuration file
(C). Remote login was disabled in the networkd.config instead of using the sshd.conf
(D). Network services are no longer running on the NAS
A small business just recovered from a ransomware attack against its file servers by
purchasing the decryption keys from the attackers. The issue was triggered by a phishing email and
the IT administrator wants to ensure it does not happen again. Which of the following should the IT
administrator do FIRST after recovery?
(A). Scan the NAS for residual or dormant malware and take new daily backups that are tested on a
frequent basis
(B). Restrict administrative privileges and patch ail systems and applications.
(C). Rebuild all workstations and install new antivirus software
(D). Implement application whitelisting and perform user application hardening
An analyst is trying to identify insecure services that are running on the internal network. After performing a port scan the analyst identifies that a server has some insecure services enabled on default ports. Which of the following BEST describes the services that are currently running and the secure alternatives for replacing them' (Select THREE)
(A). SFTP FTPS
(B). SNMPv2 SNMPv3
(C). HTTP, HTTPS
(D). TFTP FTP
(F). Telnet SSH
A user enters a password to log in to a workstation and is then prompted to enter an authentication code. Which of the following MFA factors or attributes are being utilized in the authentication process? (Select TWO).
(A). Something you know
(B). Something you have
(C). Somewhere you are
(D). Someone you are
(E). Something you are
As part of the lessons-learned phase, the SOC is tasked with building methods to detect if a previous incident is happening again. Which of the following would allow the security analyst to alert the SOC if an event is reoccurring?
(A). Creating a playbook within the SOAR
(B). Implementing rules in the NGFW
(C). Updating the DLP hash database
(D). Publishing a new CRL with revoked certificates
A security engineer is installing a WAF to protect the company's website from malicious web requests over SSL. Which of the following is needed to meet the objective?
(A). A reverse proxy
(B). A decryption certificate
(C). A split-tunnel VPN
(D). Load-balanced serv
A security analyst needs to generate a server certificate to be used for 802.1X and secure RDP connections. The analyst is unsure what is required to perform the task and solicits help from a senior colleague. Which of the following is the FIRST step the senior colleague will most likely tell the analyst to perform to accomplish this task?
(A). Create an OCSP
(B). Generate a CSR
(C). Create a CRL
(D). Generate a .pfx file
An organization wants to host an externally accessible web server that will not contain sensitive user information. Any sensitive information will be hosted on file servers. Which of the following is the BEST architecture configuration for this organization?
(A). Host the web server in a DMZ and the file servers behind a firewall
(B). Host the web server and the file servers in a DMZ
(C). Host the web server behind a firewall and the file servers in a DMZ
(D). Host both the web server and file servers behind a firewall
Which of the following should be monitored by threat intelligence researchers who search for leaked credentials?
Common Weakness Enumeration
OSİNT
Dark Web
Vulnerability Databases
A customer service representative reported an unusual text message that was sent to the help desk. The message contained an unrecognized invoice number with a large balance due and a link to click for more details. Which of the following BEST describes this technique?
(A). Vishing
(B). Whaling
(C). Phishing
(D). Smishing
A security analyst has received an alert about being sent via email. The analyst's Chief information Security Officer (CISO) has made it clear that PII must be handle with extreme care From which of the following did the alert MOST likely originate?
(A). S/MIME
(B). DLP
(C). IMAP
(D). HIDS
Which of the following would be MOST effective to contain a rapidly attack that is affecting a large number of organizations?
(A). Machine learning
(B). DNS sinkhole
(C). Blocklist
(D). Honeypot
A company has determined that if its computer-based manufacturing is not functioning for 12 consecutive hours, it will lose more money that it costs to maintain the equipment. Which of the following must be less than 12 hours to maintain a positive total cost of ownership?
(A). MTBF
(B). RPO
(C). RTO
(D). MTTR
After segmenting the network, the network manager wants to control the traffic between the segments. Which of the following should the manager use to control the network traffic?
(A). A DMZ
(B). A VPN
(C). A VLAN
(D). An ACL
A company has discovered unauthorized devices are using its WiFi network, and it wants to harden the access point to improve security. Which of the following configuration should an analyst enable to improve security? (Select Two)
(A). RADIUS
(B). PEAP
(C). WPS
(D). WEP-TKIP
(E). WPA2-PSK
An employee has been charged with fraud and is suspected of using corporate assets. As authorities collect evidence, and to preserve the admissibility of the evidence, which of the following forensic techniques should be used?
(A). Order of volatility
(B). Data recovery
(C). Chain of custody
(D). Non-repudiation
An organization has decided to host its web application and database in the cloud.
Which of the following BEST describes the security concerns for this decision?
(A). Access to the organization's servers could be exposed to other cloud-provider clients
(B). The cloud vendor is a new attack vector within the supply chain
(C). Outsourcing the code development adds risk to the cloud provider
(D). Vendor support will cease when the hosting platforms reach EOL.
Which of the following BEST explains the difference between a data owner and a data custodian?
(A). The data owner is responsible for adhering to the rules for using the data, while the data
custodian is responsible for determining the corporate governance regarding the data
(B). The data owner is responsible for determining how the data may be used, while the data
custodian is responsible for implementing the protection to the data
(C). The data owner is responsible for controlling the data, while the data custodian is responsible for
maintaining the chain of custody when handling the data
(D). The data owner grants the technical permissions for data access, while the data custodian
maintains the database access controls to the data
A security administrator is analyzing the corporate wireless network The network only has two access points running on channels 1 and 11. While using airodump-ng. the administrator notices other access points are running with the same corporate ESSID on all available channels and with the same BSSID of one of the legitimate access ports Which erf the following attacks in happening on the corporate network?
(A). Man in the middle
(B). Evil twin
(C). Jamming
(D). Rogue access point
(E). Disassociation
An organization has expanded its operations by opening a remote office. The new office is fully furnished with office resources to support up to 50 employees working on any given day. Which of the following VPN solutions would BEST support the new office?
(A). Always On
(B). Remote access
(C). Site-to-site
(D). Full tunnel
A junior systems administrator noticed that one of two hard drives in a server room had a red error notification. The administrator removed the hard drive to replace it but was unaware that the server was configured in an array. Which of the following configurations would ensure no data is lost?
(A). RAID 0
(B). RAID 1
(C). RAID 2
(D). RAID 3
A website developer who is concerned about theft cf the company's user database warns to protect weak passwords from offline brute-force attacks. Which of the following be the BEST solution?
(A). Lock accounts after five failed logons
(B). Precompute passwords with rainbow tables
(C). Use a key-stretching technique
(D). Hash passwords with the MD5 algorithm
An organization suffered an outage and a critical system took 90 minutes to come back online. Though there was no data loss during the outage, the expectation was that the critical system would be available again within 60 minutes. Which of the following is the 60- minute expectation an example of:
(A). MTBF
(B). RPO
(C). MTTR
(D). RTO
Which of the following will MOST likely cause machine learning and Al-enabled systems to operate with unintended consequences?
(A). Stored procedures
(B). Buffer overflows
(C). Data bias
(D). Code reuse
A company labeled some documents with the public sensitivity classification. This means the documents can be accessed by?
(A). employees of other companies press
(B). all members of the department that created the documents
(C). only the company's employees and those listed in the document
(D). only the individuals listed in the documents
A company recently experienced an attack in which a malicious actor was able to exfiltrate data by cracking stolen passwords, using a rainbow table the sensitive data. Which of the following should a security engineer do to prevent such an attack in the future?
(A). Use password hashing.
(B). Enforce password complexity.
(C). Implement password salting.
(D). Disable password reuse.
Which of the following environments would MOST likely be used to assess the execution of component parts of a system at both the hardware and software levels and to measure performance characteristics?
Test
Staging
Development
Production
Which of the following is the correct order of volatility from MOST to LEAST volatile?
(A). Memory, temporary filesystems, routing tables, disk, network storage
(B). Cache, memory, temporary filesystems, disk, archival media
(C). Memory, disk, temporary filesystems, cache, archival media
(D). Cache, disk, temporary filesystems, network storage, archival media
Some laptops recently went missing from a locked storage area that is protected by keyless
RFID-enabled locks. There is no obvious damage to the physical space. The security manager
identifies who unlocked the door, however, human resources confirms the employee was on
vacation at the time of the incident. Which of the following describes what MOST likely occurred?
(A). The employee's physical access card was cloned.
(B). The employee is colluding with human resources
(C). The employee's biometrics were harvested
(D). A criminal used lock picking tools to open the door.
A small company that does not have security staff wants to improve its security posture. Which of the following would BEST assist the company?
(A). MSSP
(B). SOAR
(C). IaaS
(D). PaaS
An organization routes all of its traffic through a VPN Most users are remote and connect into a corporate datacenter that houses confidential information There is a firewall at the Internet border followed by a DIP appliance, the VPN server and the datacenter itself. Which of the following is the WEAKEST design element?
(A). The DLP appliance should be integrated into a NGFW.
(B). Split-tunnel connections can negatively impact the DLP appliance's performance
(C). Encrypted VPN traffic will not be inspected when entering or leaving the network
(D). Adding two hops in the VPN tunnel may slow down remote connections
A retail company that is launching a new website to showcase the company's product line
and other information for online shoppers registered the following URLs:
* secure-logon.companysite.com
Which of the following should the company use to secure its website if the company is concerned with convenience and cost?
(A). A self-signed certificate
(B). A root certificate
(C). A code-signing certificate
(D). A wildcard certificate
(E). An extended validation certificate
A Chief Information Officer receives an email stating a database will be encrypted within 24 hours unless a payment of $20,000 is credited to the account mentioned In the email. This BEST describes a scenario related to:
(A). whaling.
(B). smishing.
(C). spear phishing
(D). vishing
After a phishing scam for a user's credentials, the red team was able to craft a payload to deploy on a server. The attack allowed the installation of malicious software that initiates a new remote session. Which of the following types of attacks has occurred?
(A). Privilege escalation
(B). Session replay
(C). Application programming interface
(D). Directory traversal
The Chief Executive Officer (CEO) of an organization would like staff members to have the
flexibility to work from home anytime during business hours, incident during a pandemic or crisis,
However, the CEO is concerned that some staff members may take advantage of the of the flexibility
and work from high-risk countries while on holidays work to a third-party organization in another
country. The Chief information Officer (CIO) believes the company can implement some basic to
mitigate the majority of the risk. Which of the following would be BEST to mitigate CEO's concern? (Select TWO).
(A). Geolocation
(B). Time-of-day restrictions
(C). Certificates
(D). Tokens
(E). Geotagging
A company wants to restrict emailing of PHI documents. The company is implementing a DLP solution. In order to restrict PHI documents, which of the following should be performed FIRST?
Retention
Governance
Classification
Change Management
A security administrator is trying to determine whether a server is vulnerable to a range of attacks. After using a tool, the administrator obtains the following output:
Which of the following attacks was successfully implemented based on the output?
(A). Memory leak
(B). Race conditions
(C). SQL injection
(D). Directory traversal
An employee opens a web browser and types a URL into the address bar. Instead of reaching the requested site, the browser opens a completely different site. Which of the following types of attacks have MOST likely occurred? (Select TWO).
(A). DNS hijacking
(B). Cross-site scripting
(C). Domain hijacking
(D). Man-in-the-browser
(E). Session hijacking
An organization's Chief Information Security Officer is creating a position that will be responsible for implementing technical controls to protect data, including ensuring backups are properly maintained. Which of the following roles would MOST likely include these responsibilities?
(A). Data protection officer
(B). Data owner
(C). Backup administrator
(D). Data custodian
(E). Internal auditor
A Chief Security Officer (CSO) is concerned about the amount of PII that is stored locally on each salesperson's laptop. The sales department has a higher-than-average rate of lost equipment. Which of the following recommendations would BEST address the CSO's concern?
(A). Deploy an MDM solution.
(B). Implement managed FDE.
(C). Replace all hard drives with SEDs.
(D). Install DLP agents on each laptop.
