Match each NIST incident response lifecycle phase to its correct description:
1. Mitigate the impact of the incident
2. Report the cause and cost of the incident and the steps to prevent future incidents
3. Evaluates incident indicators to determine whether they are legitimate attacks and alerts the organization of the incidents
4. Establishes an incident response capability to ensure that organizational assets are sufficiently secure

What is the purpose of a hypervisor?

What enables the network security team to keep track of the operating system version, security updates, and patches on end user’s devices?

What should you create to prevent spoofing of the internal network?

Which two private IPv4 addresses would be blocked on the internet to prevent security and performance issues? (Choose 2)

While conducting a risk evaluation at your company, you identify risks that are related to the web server located in the office. The risks include hardware and software failure as well as web service interruption caused by cyber attacks. You recommend purchasing insurance and hiring another organization to maintain the web server to help mitigate the risks. What type of risk management strategy is being applied?

Which CIA Triad term corresponds to the principle that "Data should be accessed and read by authorized users only"?

Which CIA Triad term corresponds to the principle that "Data should never be altered or compromised"?

Which CIA Triad term corresponds to the principle that "Legitimate requests should have access to data at all times"?

The employees in the accounting department of a company receive an email about the latest federal regulations. The email contains a hyperlink to register for a webinar hosted by a government agency. As a security officer, you notice that the hyperlink points to an unknown party. Which type of cybersecurity threat should you investigate?

Your home network seems to have slowed down considerably. You look at the home router GUI and notice that an unknown host is attached to the network. What should you do to prevent this specific host from attaching to the network again?

Which classification of security alert is the greatest threat to an organization because it represents undetected exploits?

You are working with the senior administration team to identify potential risks. Which phase of risk management are you in?

A corporation hires a group of experienced cyber criminals to create a prolonged and in-depth presence on the network of a competitor. This presence will allow the corporation to steal or sabotage. Which type of attack does this scenario describe?

You need to allow employees to access your company’s secure network from their homes. Which type of security should you implement?

Which data type is protected through hard disk encryption?

You need to transfer configuration files to a router across an unsecured network. Which protocol should you use to encrypt the files in transit?

You are monitoring the syslog server and observe that the DNS server is sending messages with a Warning severity. What do these messages indicate about the operation of the DNS server?

You are a security technician. You just completed a full scan of a Windows 10 PC. Where should you go to view the scan result?

Your organization's SIEM system alerts you that users are connecting to an unusual URL. You need to determine whether the URL is malicious and what type of threat it represents. What should you do?

Several employees complain that the company intranet site is no longer accepting their login information. You attempt to connect by using the URL and notice some misspellings on the site. When you connect by using the IP address, the site functions normally. What should you do?

Which two actions should you take immediately to address unexplained computer crashes and unwanted pop-up messages without impacting data? (Choose 2)

A cybersecurity analyst is investigating an unknown executable file discovered on a Linux desktop computer. The analyst enters the following command in the terminal ls -l. What is the purpose of the command.

You need to filter the websites that are available to employees on the company network. Which type of device should you deploy?

A security analyst discovers that a hacker was able to gain root access to an enterprise Linux server. The hacker accessed the server as a guest, used a program to bypass the root password, and then killed essential processes as the root user. Which type of endpoint attack is this?

Which wireless encryption technology required AES to secure home wireless network?

Which three authentication factors are valid for use in a multifactor authentication scenario? (Choose 3)

True or False: A security analyst may use a disgruntled employee network credential to monitor behavior.

True or False: A security analyst may access employee data on a company server if authorized.

True or False: A security analyst may share sensitive data with unauthorized users.

What are two natural disasters that would cause a company to implement a disaster recovery plan? (Choose 2)

After an administrator installs an operating system update on a laptop, the laptop user can no longer print to their wireless printer. What should solve the issue?

Which activity is an example of active reconnaissance performed during a penetration test?

You are reviewing company remote access procedures and notice that telnet is being used to connect to the corporate database server to check on inventory levels. Which two actions should you take immediately? (Choose 2)

Which activity by an adversary is an example of an exploit that is attempting to gain credentials?

Which two basic metrics should be taken into consideration when assigning a severity to a vulnerability during an assessment? (Choose 2)

What are two disadvantages of public vulnerability databases? (Choose 2)

Which framework protects the personal information of members of the European Union?

Which framework is responsible for protecting the healthcare information of individuals?

Which framework protects the credit card information of individuals?

Which framework protects the educational records of individuals?

Which framework protects information about individuals that is stored by federal agencies?

Which command displays both the configured DNS server information and the IP address resolution for a URL?

Customers of an online shopping store are complaining that they cannot visit the website. As an IT technician, you restart the website. After 30 minutes, the website crashes again. You suspect that the website has been experiencing which type of cybersecurity threat?

You are a security analyst. You are reviewing output from the SIEM. You notice an alert concerning malicious files detected by the IDS. After reviewing the user, device, and posture information, you determine that it is a valid alert. What should you do next?

In order to do online banking, you enter a strong password and then enter the 5-digit code sent to you on your smartphone. Which type of authentication does this situation describe?

What does hashing provide for the communication?

You work for a community health care organization that uses an electronic health record (EHR) system. You have implemented the physical and technical safeguards required by HIPAA. You need to prove that the EHR system is compliant with those safeguards. Which two approaches should you use to verify the system is compliant? (Choose 2).

Move each cybersecurity tools from the list in the left to the correct location on the Vulnerability Process diagram on the right.

Clean and patch infection system

Remove or block infected system from the network

Patch uninfected systems to deprive the worm of more available targets

Compartmentalize and segment the network to limit the spread of the worm to areas already infected

People, property, or data

An action that causes a negative impact

The potential for loss, damage, or destruction

A weakness that potentially exposes organizations to cyber attacks

Discover unwanted event

Avert the occurrence of an event

Restore a system after an event