You are a security professional, and you want a SIEM tool that will require both on-site infrastructure and internet-based solutions. What type of tool do you choose?

Fill in the blank: SIEM tools are used to search, analyze, and _____ an organization's log data to provide security information and alerts in real-time.

A security analyst receives an alert about hundreds of login attempts from unusual geographic locations within the last few minutes. What can the analyst use to review a timeline of the login attempts, locations, and time of activity?

Which type of tool typically requires users to pay for usage?

Fill in the blank: A security team _____ their playbook frequently by learning from past security incidents, then refining policies and procedures.

Fill in the blank: Incident response playbooks are _____ used to help mitigate and manage security incidents from beginning to end.

An organization has successfully responded to a security incident. According to their established standards, the organization must share information about the incident to a specific government agency. What phase of an incident response playbook does this scenario describe?

Why is the containment phase of an incident response playbook a high priority for organizations?

Fill in the blank: During the post-incident activity phase, security teams may conduct a full-scale analysis to determine the _____ of an incident and use what they learn to improve the company’s overall security posture.

A security analyst wants to set the foundation for successful incident response. They outline roles and responsibilities of each security team member. What phase of an incident response playbook does this scenario describe?

What is the term for a group of connected devices?

A _____ broadcasts information to every device on the network.

What is the purpose of the protocol number of a data packet?

Fill in the blank: _____ refers to the practice of using remote servers, applications, and network services that are hosted on the internet, instead of in a physical location owned by a company.

Which port is used for secure internet communication?

Fill in the blank: The ___ layer is used to determine how data packets will interact with receiving devices, including file transfers and email services.

A security analyst runs a command to discover a local IP address. The analyst receives the following result: 169.254.255.249. What type of address is this?

Fill in the blank: fe80::ab12:cd34:ef56:0023:2345 is an example of an accurate ___ address.

What network protocol helps data get to the right place by determining the MAC address of the next router or device on its path?

Which type of firewall analyzes network traffic for suspicious characteristics and behavior and stops them from entering the network?

Which firewall offers the most security features?

What network security service masks a device’s virtual location to keep data private while using a public network?

What network security service masks a device’s virtual location to keep data private while using a public network?

What does a VPN service use to transfer encrypted data between a device and the VPN server?

What network zone contains the internet and other services that are outside of an organization’s control?

What network zone acts as a network perimeter to the internal network by isolating servers that are exposed to the internet?

Fill in the blank: A _____ fulfills the requests of its clients by forwarding them to other servers

What happens during a Denial of Service (DoS) attack?

A security team discovers that an attacker has taken advantage of the handshake process that is used to establish a TCP connection between a device and their server. Which DoS attack does this scenario describe?

Fill in the blank: The maximum size of a correctly formatted IPv4 ICMP packet is _____, as opposed to the oversized packet that is sent during a Ping of Death attack.

As a security professional, you implement safeguards against attackers changing the source IP of a data packet in order to communicate over your company’s network. What type of network attack are you trying to avoid?

Fill in the blank: To reduce the chances of an IP spoofing attack, a security analyst can configure a _____ to reject all incoming traffic with the same source IP addresses as those owned by the organization.

In which attack would malicious actors gain access to a network, put themselves between a web browser and a web server, then sniff the packet to learn the devices’ IP and MAC addresses?

Fill in the blank: The _____ network attack occurs when a malicious actor takes a network transmission that was sent by an authorized user and repeats it at a later time to impersonate that user.

Which attack is a combination of a DDoS and an IP spoofing attack, during which the malicious actor overwhelms a target computer?

Fill in the blank: ____ is the process of strengthening a system to reduce its vulnerability and attack surface.

What is the relationship between security hardening and an attack surface?

Fill in the blank: Installing security cameras is an example of a _____ security hardening practice.

An organization’s in-house security team has been authorized to simulate an attack on the organization’s website. The objective is to identify any vulnerabilities that are present. What does this scenario describe?

A security analyst reviews documentation about a firewall rule that includes a list of allowed and disallowed network ports. They compare it to the current firewall to ensure no changes have been made. What does this scenario describe?

Which OS hardening practice requires users to verify their identity in two or more ways to access a system or network?