Rich recently configured new vulnerability scans for his organization’s business intelligence systems. The scans run late at night when users are not present. Rich received complaints from the business intelligence team that the performance burden imposed by the scanning is causing their overnight ETL jobs to run too slowly and they are not completing before business hours. How should Rich handle this situation?

Javier ran a vulnerability scan of a new web application created by developers on his team and received the report shown here. The developers inspected their code carefully and do not believe that the issue exists. They do have a strong understanding of SQL injection issues and have corrected similar vulnerabilities in other applications. What is the most likely scenario in this case?

During an incident investigation, Mateo is able to identify the IP address of the system that was used to compromise multiple systems belonging to his company. What can Mateo determine from this information?

After a major compromise involving what appears to be an APT, Jaime needs to conduct a forensic examination of the compromised systems. Which containment method should he recommend to ensure that he can fully investigate the systems that were involved while minimizing the risk to his organization’s other production systems?

Piper is attempting to remediate a security vulnerability and must apply a patch to a production database server. The database administration team is concerned that the patch will disrupt business operations. How should Piper proceed?

Kent ran a vulnerability scan of an internal CRM server that is routinely used by employees, and the scan reported that no services were accessible on the server. Employees continued to use the CRM application over the Web without difficulty during the scan. What is the most likely source of Kent’s result?

Steve needs to perform an Nmap scan of a remote network and wants to be as stealthy as

possible. Which of the following nmap commands will provide the stealthiest approach to

his scan?

After performing threat hunting, Lakshman determines that it would be appropriate to disable some services on his organization’s database servers. What activity is Lakshman engaging in?

Jenna is configuring the scanning frequency for her organization’s vulnerability scanning program. Which one of the following is the least important criteria for Jenna to consider?

Donna is interpreting a vulnerability scan from her organization’s network, shown here. She would like to determine which vulnerability to remediate first. Donna would like to focus on the most critical vulnerability according to the potential impact if exploited. Assuming the firewall is properly configured, which one of the following vulnerabilities should Donna give the highest priority?

Which one of the following document categories provides the highest-level authority for an organization’s cybersecurity program?

Mateo is planning a vulnerability scanning program for his organization and is scheduling weekly scans of all the servers in his environment. He was approached by a group of system administrators who asked that they be given direct access to the scan reports without going through the security team. How should Mateo respond?

While reviewing a report from a vulnerability scan of a web server, Paul encountered the vulnerability shown here. What is the easiest way for Paul to correct this vulnerability with minimal impact on the business?

A log showing a successful user authentication is classified as what type of occurrence in NIST’s definitions?

Fran is trying to run a vulnerability scan of a web server from an external network, and the scanner is reporting that there are no services running on the web server. She verified the scan configuration and attempted to access the website running on that server using a web browser on a computer located on the same external network and experienced no difficulty. What is the most likely issue with the scan?

During a regulatory compliance assessment, Manish discovers that his organization has implemented a multifactor authentication requirement for systems that store and handle highly sensitive data. The system requires that users provide both a password and a four-digit PIN. What should Manish note in his findings about this system?

Which one of the following mechanisms may be used to enhance security in a context-based authentication system?

Latisha’s organization has faced a significant increase in successful phishing attacks, resulting in compromised accounts. She knows that she needs to implement additional technical controls to prevent successful attacks. Which of the following controls will be the most effective while remaining relatively simple and inexpensive to deploy?

Lauren downloads a new security tool and checks its MD5. What does she know about the

software she downloaded if she receives the following message?

root@demo:~# md5sum -c

demo.md5

demo.txt: FAILED

md5sum: WARNING: 1 computed checksum did not match

Peter works for an organization that is joining a consortium of similar organizations that use a federated identity management (FIM) system. He is configuring his identity management system to participate in the federation. Specifically, he wants to ensure that users at his organization will be able to use their credentials to access federated services. What role is Peter configuring?

Mika uses a security token like the unit shown here and a password to authenticate to her PayPal account. What two types of factors is she using?

During the account setup for her bank, Deepa is asked to answer a series of questions about her past home addresses, financial transactions, and her credit history. What type of authentication factor is Deepa being asked for?

Charles is worried about users conducting SQL injection attacks. Which of the following

solutions will best address his concerns?

Which of the following risks is most commonly associated with vulnerability scanning

activities?

Adam finds entries in his authentication logs for many of the systems in his network that all have logins for the same userID with a variety of passwords. What type of attack has he discovered?

You are reviewing the methods that your organization uses to communicate with the media

during an incident response effort. Which one of the following is not a commonly accepted

practice?

Charles reviews the source code for a web application for vulnerabilities. What type of software

assessment is this?

Isaac sees the following entry in his web logs. What type of attack has been attempted?

http://example.com/../../../../../etc/shadow

Precompiled SQL statements that only require variables to be input are an example of what

type of application security control?

Rob would like to perform a root-cause analysis in the wake of an incident. He will be

including the results of that analysis in his incident report. What action should he take first?

What are activities like disabling unnecessary processes, moving systems to internal IP

addresses, and using firewalls and other network security devices to protect hosts known as

in the context of threat hunting?

Bob is creating a report to management summarizing the result of a recent vulnerability scan.

He would like to prioritize the results. Which one of the following tools would provide the

most comprehensive assessment of the risk posed by each vulnerability?

Kelly’s organization recently suffered a security incident where the attacker was present on

her network for several months before the SOC identified the attack. Once they saw evidence,

they quickly reacted to contain the incident. Which incident response metric would

suffer most as a result of this performance?

Seth is trying to identify activities in his organization that might be automated to improve

efficiency. Which one of the following activities is least likely to benefit from automation?

Rae wants to detect forged sender addresses to decrease the amount of spam that her

organization receives. Which of the following techniques or methods will most directly fit

her needs?

Your organization recently suffered a series of serious vulnerabilities as a result of the use of

legacy software that is no longer supported by the vendor. This software is critical to your

organization and can’t be removed for at least six more months. What action plan would best

address this risk during that six month period?

Yolanda received a threat intelligence report and is evaluating it to determine whether her

organization runs any of the software affected by the threat. What type of confidence is

Yolanda attempting to gain?

Gabby’s organization captures sensitive customer information, and salespeople and others

often work with that data on local workstations and laptops. After a recent inadvertent

breach where a salesperson accidentally sent a spreadsheet of customer information to

another customer, her organization is seeking a technology solution that can help prevent

similar problems. What should Gabby recommend?

Fred is reviewing a checklist used in the automation of his security program and sees the

following code:

--View Image--

What file type from the following list is he most likely reviewing?

Cynthia’s organization receives a letter from a company they are a service provider for, notifying

them of a pending legal case and telling them not to delete or discard documents related

to the case. What term describes this?

As part of his forensic investigation, Alex signs and notes in his log when the drive copy he

prepared is transferred to legal counsel. What is this process known as?