Font size
WorksheetsSecurity + quiz 13
Total questions: 13
Worksheet time: 7mins
A security analyst needs to be proactive in understand the types of attacks that could potentially target the company's execute. Which of the following intelligence sources should to security analyst review?
Vulnerability feeds
Trusted automated exchange of indicator information
Structured threat information expression
Industry information-sharing and collaboration groups
A cybersecurity department purchased o new PAM solution. The team is planning to randomize the service account credentials of the Windows server first. Which of the following would be the BEST method to increase the security on the Linux server?
Randomize the shared credentials
Use only guest accounts to connect.
Use SSH keys and remove generic passwords
Remove all user accounts.
A security audit has revealed that a process control terminal is vulnerable to malicious users installing and executing software on the system. The terminal is beyond end-of-life support and cannot be upgraded, so it is placed on a projected network segment. Which of the following would be MOST effective to implement to further mitigate the reported vulnerability?
DNS sinkholding
DLP rules on the terminal
An IP blacklist
Application whitelisting
An organization has decided to host its web application and database in the cloud. Which of the following BEST describes the security concerns for this decision?
Access to the organization's servers could be exposed to other cloud-provider clients
The cloud vendor is a new attack vector within the supply chain
Outsourcing the code development adds risk to the cloud provider
Vendor support will cease when the hosting platforms reach EOL.
A user reports constant lag and performance issues with the wireless network when working at a local coffee shop. A security analyst walks the user through an installation of Wireshark and get a five-minute pcap to analyze. The analyst observes the following output:
Which of the following attacks does the analyst MOST likely see in this packet capture?
Session replay
Evil twin
Bluejacking
ARP poisoning
A user recently attended an exposition and received some digital promotional materials. The user later noticed blue boxes popping up and disappearing on the computer, and reported receiving several spam emails, which the user did not open. Which of the following is MOST likely the cause of the reported issue?
There was a drive-by download of malware
The user installed a cryptominer
The OS was corrupted
There was malicious code on the USB drive
A security analyst is performing a packet capture on a series of SOAP HTTP requests for a security assessment. The analyst redirects the output to a file After the capture is complete, the analyst needs to review the first transactions quickly and then search the entire series of requests for a particular string. Which of the following would be BEST to use to accomplish the task?
(Select TWO).
head
Tcpdump
grep
rail
curl
The Chief Executive Officer (CEO) of an organization would like staff members to have the flexibility to work from home anytime during business hours, incident during a pandemic or crisis, However, the CEO is concerned that some staff members may take advantage of the of the flexibility and work from high-risk countries while on holidays work to a third-party organization in another country. The Chief information Officer (CIO) believes the company can implement some basic to mitigate the majority of the risk. Which of the following would be BEST to mitigate CEO's concern?
(Select TWO).
Geolocation
Time-of-day restrictions
Certificates
Geotagging
Role-based access controls
A forensics investigator is examining a number of unauthorized payments the were reported on
the company's website. Some unusual log entries show users received an email for an unwanted
mailing list and clicked on a link to attempt to unsubscribe. One of the users reported the email to
the phishing team, and the forwarded email revealed the link to be:
<a href="httpx://www.company.com/payto.do?routing=00001111&@acct=22223333amount=250>click here to unsubscribe</a>
Which of the following will the forensics investigator MOST likely determine has occurred?
SQL injection
CSRF
XSS
XSRF
Which of the following allows for functional test data to be used in new systems for testing and training purposes to protect the read data?
Data encryption
Data masking
Data deduplication
Data minimization
A cybersecurity analyst reviews the log files from a web server and sees a series of files that indicates a directory-traversal attack has occurred. Which of the following is the analyst MOST likely seeing?
http://sample.url.com/<script>Please-Visit-Our-Phishing-Site,/script>
http://sample.url.com/someotherpageonsite/../../../etc/shadow
http://sample.url.com/select-from-database-where-password-null
http://redirect.sameple.url.sampleurl.com/malicious-dns-redirect
A workwide manufacturing company has been experiencing email account compromised. In one incident, a user logged in from the corporate office in France, but then seconds later, the same user account attempted a login from Brazil. Which of the following account policies would BEST prevent this type of attack?
Network location
Impossible travel time
Geolocation
Geofencing
A network administrator has been asked to design a solution to improve a company's security posture The administrator is given the following, requirements?
- The solution must be inline in the network
- The solution must be able to block known malicious traffic
- The solution must be able to stop network-based attacks
Which of the following should the network administrator implement to BEST meet these requirements?
HIDS
NIDS
HIPS
NIPS
