A security analyst is running a vulnerability scan to check for missing patches during a suspected security rodent During

which of the following phases of the response process is this activity MOST likely occurring?

A security engineer needs to create a network segment that can be used for servers that require connections from

untrusted networks. Which of the following should the engineer implement?

A systems engineer is building a new system for production. Which of the following is the FINAL step to be performed prior to promotion to production?

A major clothing company recently lost a large amount of proprietary information. The security officer must find a solution to ensure this never happens again. Which of the following is the BEST technical implementation to prevent this from happening again?

Which of the following would be BEST for a technician to review to determine the total risk an organization can bear

when assessing a "cloud-first" adoption strategy?

Ann, a customer, received a notification from her mortgage company stating her PII may be shared with partners,

affiliates, and associates to maintain day-to-day business operations.

Which of the following documents did Ann receive?

The help desk has received calls from users in multiple locations who are unable to access core network services. The

network team has identified and turned off the network switches using remote commands. Which of the following

actions should the network team take NEXT?

A company would like to set up a secure way to transfer data between users via their mobile phones. The company's top

priority is utilizing technology that requires users to be in as close proximity as possible to each other. Which of the

following connection methods would BEST fulfill this need?

A security analyst has been tasked with creating a new WiFi network for the company. The requirements received by

the analyst are as follows:

•Must be able to differentiate between users connected to WiFi

•The encryption keys need to change routinely without interrupting the users or forcing reauthentication

•Must be able to integrate with RADIUS

•Must not have any open SSIDs

Which of the following options BEST accommodates these requirements?

Which of the following describes a maintenance metric that measures the average time required to troubleshoot and

restore failed equipment?

A company recently experienced an attack during which its main website was directed to the attacker's web server,

allowing the attacker to harvest credentials from unsuspecting customers. Which of the following should the company

implement to prevent this type of attack from occurring in the future?

Which of the following are the MOST likely vectors for the unauthorized inclusion of vulnerable code in a software

company’s final software releases? (Select TWO.)

A backdoor was detected in the containerized application environment. The investigation detected that a zero-day

vulnerability was introduced when the latest container image version was downloaded from a public registry. Which of

the following is the BEST solution to prevent this type of incident from occurring again?

A company wants to modify its current backup strategy to minimize the number of backups that would need to be

restored in case of data loss. Which of the following would be the BEST backup strategy

Which of the following roles would MOST likely have direct access to the senior management team?

Which of the following incident response steps occurs before containment?

A dynamic application vulnerability scan identified code injection could be performed using a web form.

Which of the following will be BEST remediation to prevent this vulnerability?

A network engineer and a security engineer are discussing ways to monitor network operations. Which of the following

is the BEST method?

Which of the following involves the inclusion of code in the main codebase as soon as it is written?

During a forensic investigation, a security analyst discovered that the following command was run on a compromised

host:

crackmapexec smb 192.168.10.232 -u localadmin -H 0A3CE8D07A46E5C51070F03593E0A5E6

Which of the following attacks occurred?

An attacker replaces a digitally signed document with another version that goes unnoticed. Upon reviewing the

document’s contents, the author notices some additional verbiage that was not originally in the document but can’t

validate an integrity issue. Which of the following attacks was used?

A security analyst notices several attacks are being blocked by the NIPS but does not see anything on the boundary

firewall logs. The attack seems to have been thwarted. Which of the following resiliency techniques was applied to the

network to prevent this attack?

During an incident, a company’s CSIRT determines it is necessary to observe the continued network-based transactions

between a callback domain and the malware running on an enterprise PC. Which of the following techniques would be

BEST to enable this activity while reducing the risk of lateral spread and the risk that the adversary would notice any

changes?

If a current private key is compromised, which of the following would ensure it cannot be used to decrypt any

historical data?

A security analyst is responding to an alert from the SIEM. The alert states that malware was discovered on a host and

was not automatically deleted. Which of the following would be BEST for the analyst to perform?