Which of the following is used to add extra complexity before using a one-way data transformation algorithm?

An employee clicked a link in an email from a payment website that asked the employee to update contact information. The employee entered the log-in information but received a “page not found” error message. Which of the following types of social engineering attacks occurred?

An enterprise is trying to limit outbound DNS traffic originating from its internal network. Outbound DNS requests will only be allowed from one device with the IP address 10.50.10.25. Which of the following firewall ACLs will accomplish this goal?

A data administrator is configuring authentication for a SaaS application and would like to reduce the number of credentials employees need to maintain. The company prefers to use domain credentials to access new SaaS applications. Which of the following methods would allow this functionality?

Which of the following scenarios describes a possible business email compromise attack?

A company prevented direct access from the database administrators’ workstations to the network segment that contains database servers. Which of the following should a database administrator use to access the database servers?

An organization’s internet-facing website was compromised when an attacker exploited a buffer overflow. Which of the following should the organization deploy to best protect against similar attacks in the future?

Which of the following is NOT among the top-tier leadership in information security?

Which of the following is NOT a best practice when handling encryption keys?

Several employees received a fraudulent text message from someone claiming to be the Chief Executive Officer (CEO). The message stated: “I’m in an airport right now with no access to email. I need you to buy gift cards for employee recognition awards. Please send the gift cards to following email address.” Which of the following are the best responses to this situation? (Choose two.)

A company is required to use certified hardware when building networks. Which of the following best addresses the risks associated with procuring counterfeit hardware?

Which of the following provides the details about the terms of a test with a third-party penetration tester?

A penetration tester begins an engagement by performing port and service scans against the client environment according to the rules of engagement. Which of the following reconnaissance types is the tester performing?

Which of the following is required for an organization to properly manage its restore process in the event of system failure?

An employee receives a text message that appears to have been sent by the payroll department and is asking for credential verification. Which of the following social engineering techniques are being attempted? (Choose two.)

During a security incident, the security operations team identified sustained network traffic from a malicious IP address: 10.1.4.9. A security analyst is creating an inbound firewall rule to block the IP address from accessing the organization’s network. Which of the following fulfills this request?

A company needs to provide administrative access to internal resources while minimizing the traffic allowed through the security boundary. Which of the following methods is most secure?

A security analyst is reviewing alerts in the SIEM related to potential malicious network traffic coming from an employee’s corporate laptop. The security analyst has determined that additional data about the executable running on the machine is necessary to continue the investigation. Which of the following logs should the analyst use as a data source?

A threat hunter is performing network-based hunting using a SIEM tool. Which of the following would be needed for earlier detection?

A company is assessing regulatory compliance within the organization’s environments. Based on the assessment, the company decides to require MFA, update policies, add security devices, and document the review. Which of the following is the company best completing?

A company’s bug bounty program has relied on the same researchers for the last three years. Recently, a competing product had a huge vulnerability disclosed. The CSO is concerned that the company’s bug bounty program may be falling short and has suggested that other approaches and tools should be included to increase coverage. Which of the following would be the BEST action for the CSO to take?

Which of the following is the MOST likely reason a security analyst should review the logs from a DNS server in an investigation?

A vulnerability management team is performing discovery scans in a flat network. The team notices a lot of network rings and some scanning tools crash. Which of the following will MOST likely hyperinflate the number of findings?

Which of the following is the PRIMARY reason for implementing Zero Trust?

A company’s productivity suite has moved to a SaaS solution. The company would like to build a process by which a security analyst could review patterns of data usage and generate reportable metrics. Which of the following should the company implement?

Which of the following statements best describes threat intelligence in an organization?

A cyber operations team informs a security analyst about a new tactic malicious actors are using to compromise networks. SIEM alerts have not yet been configured. Which of the following best describes what the security analyst should do to identify this behavior?

A company purchased cyber insurance to address items listed on the risk register. Which of the following strategies does this represent?

A security administrator would like to protect data on employees’ laptops. Which of the following encryption techniques should the security administrator use?

Which of the following security control types does an acceptable use policy best represent?

An IT manager informs the entire help desk staff that only the IT manager and the help desk lead will have access to the administrator console of the help desk software. Which of the following security techniques is the IT manager setting up?

Which of the following is the most likely to be used to document risks, responsible parties, and thresholds?

Which of the following should a security administrator adhere to when setting up a new set of firewall rules?

A company is expanding its threat surface program and allowing individuals to security test the company’s internet-facing application. The company will compensate researchers based on the vulnerabilities discovered. Which of the following best describes the program the company is setting up?

Endpoint logs are the most suitable data source for gathering additional information about the executable running on the employee’s corporate laptop. These logs contain detailed information about processes, executables, and activities occurring on the endpoint, enabling the security analyst to understand the behavior of the executable and its potential impact on the system and network. Based on this explanation, which data source should the analyst consult?

Which of the following threat actors is the most likely to use large financial resources to attack critical systems located in other countries?

Which of the following enables the use of an input field to run commands that can view or manipulate data?

Employees in the research and development business unit receive extensive training to ensure they understand how to best protect company data. Which of the following is the type of data these employees are most likely to use in day-to-day work activities?

A company has begun labeling all laptops with asset inventory stickers and associating them with employee IDs. Which of the following security benefits do these actions provide? (Choose two.)

A technician wants to improve the situational and environmental awareness of existing users as they transition from remote to in-office work. Which of the following is the best option?

A newly appointed board member with cybersecurity knowledge wants the board of directors to receive a quarterly report detailing the number of incidents that impacted the organization. The systems administrator is creating a way to present the data to the board of directors. Which of the following should the systems administrator use?

A systems administrator receives the following alert from a file integrity monitoring tool: The hash of the cmd.exe file has changed. The systems administrator checks the OS logs and notices that no patches were applied in the last two months. Which of the following most likely occurred?

Which of the following roles, according to the shared responsibility model, is responsible for securing the company’s database in an IaaS model for a cloud environment?

A client asked a security company to provide a document outlining the project, the cost, and the completion time frame. Which of the following documents should the company provide to the client?

A security team is reviewing the findings in a report that was delivered after a third party performed a penetration test. One of the findings indicated that a web application form field is vulnerable to cross-site scripting. Which of the following application security techniques should the security analyst recommend the developer implement to prevent this vulnerability?

Which of the following must be considered when designing a high-availability network? (Choose two).

A technician needs to apply a high-priority patch to a production system. Which of the following steps should be taken first?

Which of the following describes the reason root cause analysis should be conducted as part of incident response?

Which of the following is the most likely outcome if a large bank fails an internal PCI DSS compliance assessment?

A company is developing a business continuity strategy and needs to determine how many staff members would be required to sustain the business in the case of a disruption. Which of the following best describes this step?

A company’s legal department drafted sensitive documents in a SaaS application and wants to ensure the documents cannot be accessed by individuals in high-risk countries. Which of the following is the most effective way to limit this access?

Which of the following is a hardware-specific vulnerability?

While troubleshooting a firewall configuration, a technician determines that a “deny any” policy should be added to the bottom of the ACL. The technician updates the policy, but the new policy causes several company servers to become unreachable. Which of the following actions would prevent this issue?

An organization is building a new backup data center with cost-benefit as the primary requirement and RTO and RPO values around two days. Which of the following types of sites is the best for this scenario?

A company requires hard drives to be securely wiped before sending decommissioned systems to recycling. Which of the following best describes this policy?

A systems administrator works for a local hospital and needs to ensure patient data is protected and secure. Which of the following data classifications should be used to secure patient data?

A U.S.-based cloud-hosting provider wants to expand its data centers to new international locations. Which of the following should the hosting provider consider first?

A company hired a consultant to perform an offensive security assessment covering penetration testing and social engineering. Which of the following teams will conduct this assessment activity?

Which of the following allows for the attribution of messages to individuals?

A systems administrator is looking for a low-cost application-hosting solution that is cloud-based. Which of the following meets these requirements?

A security operations center determines that the malicious activity detected on a server is normal. Which of the following activities describes the act of ignoring detected activity in the future?

A security analyst reviews domain activity logs and notices the following: UserID jsmith, password authentication: succeeded, MFA: failed (invalid code) UserID jsmith, password authentication: succeeded, MFA: failed (invalid code) UserID jsmith, password authentication: succeeded, MFA: failed (invalid code) UserID jsmith, password authentication: succeeded, MFA: failed (invalid code) Which of the following is the best explanation for what the security analyst has discovered?

A company is concerned about weather events causing damage to the server room and downtime. Which of the following should the company consider?

Which of the following is a primary security concern for a company setting up a BYOD program?

A company decided to reduce the cost of its annual cyber insurance policy by removing the coverage for ransomware attacks. Which of the following analysis elements did the company most likely use in making this decision?

Which of the following is the most likely to be included as an element of communication in a security awareness program?

Attack Description: An attacker sends multiple SYN packets from multiple sources. Target: Web server. Identify the attack and choose the BEST preventative or remediation action.

Attack Description: The attack establishes a connection, which allows remote commands to be executed. Target: User. Identify the attack and choose the BEST preventative or remediation action.

Attack Description: The attack is self propagating and compromises a SQL database using well-known credentials as it moves through the network. Target: Database server. Identify the attack and choose the BEST preventative or remediation action.

Attack Description: The attacker uses hardware to remotely monitor a user's input activity to harvest credentials. Target: Executive. Identify the attack and choose the BEST preventative or remediation action.

Attack Description: The attacker embeds hidden access in an internally developed application that bypasses account login. Target: Application. Identify the attack and choose the BEST preventative or remediation action.

Log excerpt for 192.168.10.22 shows scans initiated, completed with 0 files removed/quarantined, boot sector clean, and scheduled update disabled by process scvh0st.exe. Based on this log, determine the status of this host.

From the hotspot scenario instructions, what user action resets the simulation to its initial state?

In the attack-mapping hotspot, which target is affected by an attacker sending multiple SYN packets from multiple sources?

In the attack-mapping hotspot, which target is associated with a hidden access that bypasses account login?

Which workstation first quarantined the suspicious file svch0st.exe according to the endpoint logs?

On 4/18/2019 at 14:33, what event occurred on host 192.168.10.37?

What prevented host 192.168.10.41 from updating signatures on 4/18/2019 14:34?

According to the log for 192.168.10.41, what happened to svch0st.exe at 14:37 on 4/18/2019?

At the conclusion of the 4/18/2019 scans, what was the boot sector status on both hosts?

Which application is most frequently observed in the firewall log entries shown?

Based on the firewall log, which internal source communicated to destination 57.203.55.89 over port 8080 using http?

Which destination IP appears multiple times as an external address in the firewall table?

Compare the outcomes of the 14:41 scan completion events on 4/18/2019 for both hosts. Which statement is correct?

Which log entry indicates a heuristic detection rather than a signature definition match?

Based on the antivirus scan logs for host 10.10.9.12, what was the result of the 4/18/2019 scan regarding quarantined files?

According to the 10.10.9.12 log, which event occurred immediately before 'Definition update complete' on 4/18/2019?

From the 10.10.9.12 log, which file name was quarantined during the 4/18/2019 scan?

On host 10.10.9.12, what was the status of the boot sector after the scans shown?

According to the 10.10.9.18 log, why did the host not receive updated definitions on 4/18/2019?

On 10.10.9.18, what message appears when attempting to quarantine the suspicious file on 4/18/2019?

In the 10.10.9.18 log, which detection method is indicated for svch0st.exe?

Using the network diagram and logs, identify the status of host 10.10.9.12 in the Engineering Network.

Using the network diagram and logs, identify the status of host 10.10.9.18 in the Engineering Network.

Based on the diagram, which host is the likely origin of the malware?

According to the provided answer overlay in the diagram, what is the status of host 192.168.10.41?

Referencing the completed diagram answer, what is the status of host 192.168.10.37?

Which of the following is the phase in the incident response process when a security analyst reviews roles and responsibilities?

After a recent vulnerability scan, a security engineer needs to harden the routers within the corporate network. Which of the following is the most appropriate to disable?

A security administrator needs a method to secure data in an environment that includes some form of checks so track any changes. Which of the following should the administrator set up to achieve this goal?

An administrator is reviewing a single server's security logs and discovers the following: Keywords Date and Time Source Event ID Task Category Audit 09/16/2022 Microsoft 4625 Logon Failure 11:13:05 AM Windows security 4625 Logon Audit 09/16/2022 Microsoft 4625 Logon Failure 11:13:07 AM Windows security 4625 Logon Audit 09/16/2022 Microsoft 4625 Logon Failure 11:13:09 AM Windows security 4625 Logon Audit 09/16/2022 Microsoft 4625 Logon Failure 11:13:11 AM Windows security 4625 Logon Audit 09/16/2022 Microsoft 4625 Logon Failure 11:13:13 AM Windows security 4625 Logon Audit 09/16/2022 Microsoft 4625 Logon Failure 11:13:15 AM Windows security 4625 Logon Audit 09/16/2022 Microsoft 4625 Logon Failure 11:13:17 AM Windows security 4625 Logon Audit 09/16/2022 Microsoft 4625 Logon Failure 11:13:19 AM Windows security 4625 Logon Audit 09/16/2022 Microsoft 4625 Logon Failure 11:13:21 AM Windows security 4625 Logon Audit 09/16/2022 Microsoft 4625 Logon Failure 11:13:23 AM Windows security 4625 Logon Audit 09/16/2022 Microsoft 4625 Logon Failure 11:13:25 AM Windows security 4625 Logon Audit 09/16/2022 Microsoft 4625 Logon Failure 11:13:27 AM Windows security 4625 Logon Which of the following best describes the action captured in this log file?

A security engineer is implementing FDE for all laptops in an organization. Which of the following are the most important for the engineer to consider as part of the planning process? (Choose two.)

Security controls in a data center are being reviewed to ensure data is properly protected and that human life considerations are included. Which of the following best describes how the controls should be set up?

Which of the following would be best suited for constantly changing environments?

Which of the following incident response activities ensures evidence is properly handled?

An accounting clerk sent money to an attacker's bank account after receiving fraudulent instructions to use a new account. Which of the following would most likely prevent this activity in the future?

A systems administrator is creating a script that would save time and prevent human error when performing account creation for a large number of end users. Which of the following would be a good use case for this task?

A company's marketing department collects, modifies, and stores sensitive customer data. The infrastructure team is responsible for securing the data while in transit and at rest. Which of the following data roles describes the customer?

Which of the following describes the maximum allowance of accepted risk?

A security analyst receives alerts about an internal system sending a large amount of unusual DNS queries to systems on the internet over short periods of time during non-business hours. Which of the following is most likely occurring?

Which of the following would be the best control configuration to ensure human safety during system failures in a data center?

To reduce the chance of fraudulent wire transfers, which procedural change is most effective?

The role responsible for protecting stored and transmitted data for a department is best described as which of the following?

A technician is opening ports on a firewall for a new system being deployed and supported by a SaaS provider. Which of the following is a risk in the new system?

A systems administrator is working on a solution with the following requirements: • Provide a secure zone. • Enforce a company-wide access control policy. • Reduce the scope of threats. Which of the following is the systems administrator setting up?

Which of the following involves an attempt to take advantage of database misconfigurations?

Which of the following is used to validate a certificate when it is presented to a user?

One of a company’s vendors sent an analyst a security bulletin that recommends a BIOS update. Which of the following vulnerability types is being addressed by the patch?

Which of the following is used to quantitatively measure the criticality of a vulnerability?

Which of the following actions could a security engineer take to ensure workstations and servers are properly monitored for unauthorized changes and software?

An organization is leveraging a VPN between its headquarters and a branch location. Which of the following is the VPN protecting?

Which of the following would the security analyst conclude for this reported vulnerability?

An organization disabled unneeded services and placed a firewall in front of a business-critical legacy system. Which of the following best describes the actions taken by the organization?

A security consultant needs secure, remote access to a client environment. Which of the following should the security consultant most likely use to gain access?

Which of the following should a systems administrator use to ensure an easy deployment of resources within the cloud provider?

After a security awareness training session, a user called the IT help desk and reported a suspicious call. The suspicious caller stated that the Chief Financial Officer wanted credit card information in order to close an invoice. Which of the following topics did the user recognize from the training?