Exam Winter 2023

Question 1

920.) Which of the following control types fixes a previously identified issue and mitigates a risk?

A. Detective
B. Corrective
C. Preventative
D. Finalized

Answer 1

B. Corrective

Question 2

919.) A technician enables full disk encryption on a laptop that will be taken on a business trip. Which of the following does this process BEST protect?
A. Data in transit
B. Data in processing
C. Data at rest
D. Data tokenization

Answer 2

C. Data at rest

Question 3

918.) A security analyst needs to implement an MDM solution for BYOD users that will allow the company to retain control over company emails residing on the devices and limit data exfiltration that might occur if the devices are lost or stolen. Which of the following would BEST meet these requirements? (Select TWO).
A. Full device encryption
B. Network usage rules
C. Geofencing
D. Containerization
E. Application whitelisting
F. Remote control

Answer 3

A. Full device encryption
D. Containerization

Question 4

917.) A company is working on mobile device security after a report revealed that users granted non-verified software access to corporate data. Which of the following is the MOST effective security control to mitigate this risk?
A. Block access to application stores
B. Implement OTA updates
C. Update the BYOD policy
D. Deploy a uniform firmware

Answer 4

C. Update the BYOD policy

Question 5

916.) While investigating a recent security incident, a security analyst decides to view all network connections on a particular server. Which of the following would provide the desired information?
A. arp
B. nslookup
C. netstat
D. nmap

Answer 5

C. netstat

Question 6

915.) A Chief Information Security Officer wants to ensure the organization is validating and checking the integrity of zone transfers. Which of the following solutions should be implemented?
A. DNSSEC
B. LDAPS
C. NGFW

Answer 6

A. DNSSEC

Question 7

914.) Which of the following is the MOST effective way to detect security flaws present on third-party libraries embedded on software before it is released into production?
A. Employ different techniques for server and client-side validations
B. Use a different version control system for third-party libraries
C. Implement a vulnerability scan to assess dependencies earlier on SDLC
D. Increase the number of penetration tests before software release

Answer 7

C. Implement a vulnerability scan to assess dependencies earlier on SDLC

Question 8

913.) Which of the following is a risk that is specifically associated with hosting applications in the public cloud?
A. Unsecured root accounts
B. Zero-day
C. Shared tenancy
D. Insider threat

Answer 8

C. Shared tenancy

Question 9

912.) An untrusted SSL certificate was discovered during the most recent vulnerability scan. A security analyst determines the certificate is signed properly and is a valid wildcard. This same certificate is installed on other company servers without issue. Which of the following is the MOST likely reason for this finding?
A. The required intermediate certificate is not loaded as part of the certificate chain
B. The certificate is on the CRL and is no longer valid
C. The corporate CA has expired on every server, causing the certificate to fail verification
D. The scanner is incorrectly configured to not trust this certificate when detected on the server

Answer 9

A. The required intermediate certificate is not loaded as part of the certificate chain

Question 10

911.) A security analyst is receiving several alerts per user and is trying to determine if various logins are malicious. The security analyst would like to create a baseline of normal operations and reduce noise. Which of the following actions should the security analyst perform?
A. Adjust the data flow from authentication sources to the SIEM
B. Disable email alerting and review the SIEM directly
C. Adjust the sensitivity levels of the SIEM correlation engine
D. Utilize behavioral analysis to enable the SIEMs learning mode

Answer 10

C. Adjust the sensitivity levels of the SIEM correlation engine

Question 11

910.) An organization is planning to roll out a new mobile device policy and issue each employee a new laptop. These laptops would access the users’ corporate operating system remotely and allow them to use the laptops for purposes outside of their job roles. Which of the following deployment models is being utilized?
A. MDM and application management
B. BYOD and containers
C. COPE and VDI
D. CYOD and VMs

Answer 11

C. COPE and VDI

Question 12

909.) Which of the following BEST helps to demonstrate integrity during a forensic investigation?
A. Event logs
B. Encryption
C. Hashing
D. Snapshots

Answer 12

C. Hashing

Question 13

908.) A forensic analyst needs to prove that data has not been tampered with since it was collected. Which of the following methods will the analyst MOST likely use?
A. Look for tampering on the evidence collection bag
B. Encrypt the collected data using asymmetric encryption
C. Ensure proper procedures for chain of custody are being followed
D. Calculate the checksum using a hashing algorithm

Answer 13

D. Calculate the checksum using a hashing algorithm

Question 14

907.) A SOC operator is receiving continuous alerts from multiple Linux systems indicating that unsuccessful SSH to a functional user ID have been attempted on each one of them in a short period of time. Which of the following BEST explains this behavior?
A. Rainbow table attack
B. Password spraying
C. Logic bomb
D. Malware bot

Answer 14

B. Password spraying

Question 15

906.) An enterprise has hired an outside security firm to conduct penetration testing on its network and applications. The firm has only been given the documentation available to the customers of the applications. Which of the following BEST represents the type of testing that will occur?
A. Bug bounty
B. Black-box
C. Gray-box
D. White-box

Answer 15

C. Gray-box

Question 16

905.) A major political party experienced a server breach. The hacker then publicly posted stolen internal communications concerning campaign strategies to give the opposition party an advantage. Which of the following BEST describes these threat actors?
A. Semi-authorized hackers
B. State actors
C. Script kiddies
D. Advanced persistent threats

Answer 16

B. State actors

Question 17

904.) Which of the following is the MOST likely reason for securing an air-gapped laboratory HVAC system?
A. To avoid data leakage
B. To protect surveillance logs
C. To ensure availability
D. To facilitate third-party access

Answer 17

A. To avoid data leakage

Question 18

903.) After gaining access to a dual-homed multifunction device by exploiting a vulnerability in the device’s firmware, a penetration tester then gains shell access on another networked asset. This technique is an example of:
A. privilege escalation
B. footprinting
C. persistence
D. pivoting

Answer 18

A. privilege escalation

Question 19

902.) Which of the following is used to ensure that evidence is admissible in legal proceedings when it is collected and provided to the authorities?
A. Chain of custody
B. Legal hold
C. Event log
D. Artifacts

Answer 19

A. Chain of custody

Question 20

901.) The Chief Information Security Officer (CISO) of a bank recently updated the incident response policy. The CISO is concerned that members of the incident response team do not understand their roles. The bank wants to test the policy but with the least amount of resources or impact. Which of the following BEST meets the requirements?
A. Warm site failover
B. Tabletop walk-through
C. Parallel path testing
D. Full outage simulation

Answer 20

B. Tabletop walk-through

Question 21

900.) Which of the following processes will eliminate data using a method that will allow the storage device to be reused after the process is complete?
A. Pulverizing
B. Overwriting
C. Shredding
D. Degaussing

Answer 21

B. Overwriting

Question 22

899.) The database administration team is requesting guidance for a secure solution that will ensure confidentiality of cardholder data at rest only in certain fields in the database schema. The requirement is to substitute a sensitive data field with an non-sensitive field that is rendered useless if a data breach occurs. Which of the following is the BEST solution to meet the requirement?
A. Tokenization
B. Masking
C. Full disk encryption
D. Mirroring

Answer 22

A. Tokenization

Question 23

898.) Which of the following can work as an authentication method and as an alerting mechanism for unauthorized access attempts?
A. Smart card
B. Push notifications
C. Attestation service
D. HMAC-based, one-time password

Answer 23

D. HMAC-based, one-time password

Question 24

897.) A recent phishing campaign resulted in several compromised user accounts. The security incident response team has been tasked with reducing the manual labor of filtering through all the phishing emails as they arrive and blocking the sender’s email address, along with other time-consuming mitigation actions. Which of the following can be configured to streamline those tasks?
A. SOAR playbook
B. MDM policy
C. Firewall rules
D. URL filter
E. SIEM data collection

Answer 24

A. SOAR playbook

Question 25

896.) During a security incident investigation, an analyst consults the company’s SIEM and sees an event concerning high traffic to a known, malicious command-and-control server. The analyst would like to determine the number of company workstations that may be impacted by this issue. Which of the following can provide this information? A. WAF logs B. DNS logs C. System logs D. Application logs

Answer 25

C. System logs

Question 26

895.) Which of the following is an effective tool to stop or prevent the exfiltration of data from a network? A. DLP B. NIDS C. TPM D. FDE

Answer 26

A. DLP

Question 27

894.) Which of the following is a security best practice that ensures the integrity of aggregated log files within a SIEM? A. Set up hashing on the source log file servers that complies with local regulatory requirements. B. Back up the aggregated log files at least two times a day or as stated by local regulatory requirements. C. Write protect the aggregated log files and move them to an isolated server with limited access D. Back up the source log files and archive them for at least six years or in accordance with local regulatory requirements

Answer 27

A. Set up hashing on the source log file servers that complies with local regulatory requirements.

Question 28

893.) Which of the following technologies is used to actively monitor for specific file types being transmitted on the network? A. File integrity monitoring B. Honeynets C. Tcpreplay D. Data loss prevention

Answer 28

A. File integrity monitoring

Question 29

892.) Which of the following secure coding techniques makes compromised code more difficult for hackers to use? A. Obfuscation B. Normalization C. Execution D. Reuse

Answer 29

A. Obfuscation

Question 30

891.) A company is implementing BYOD and wants to ensure all users have access to the same cloud-based services. Which of the following would BEST allow the company to meet this requirement? A. IaaS B. PaaS C. MaaS D. SaaS

Answer 30

B. PaaS

Question 31

890.) A company was recently breached. Part of the company’s new cybersecurity strategy is to centralize the logs from all security devices. Which of the following components forwards the logs to a central source? A. Log enrichment B. Log aggregation C. Log parser D. Log collector

Answer 31

D. Log collector

Question 32

889.) After a recent external audit, the compliance team provided a list of several non-compliant, in-scope hosts that were not encrypting cardholder data at rest. Which of the following compliance frameworks would address the compliance team’s GREATEST concern? A. PCI DSS B. GDPR C. ISO 27001 D. NIST CSF

Answer 32

A. PCI DSS

Question 33

888.) Which of the following actions would be recommended to improve an incident response process? A. Train the team to identify the difference between events and incidents B. Modify access so the IT team has full access to the compromised assets C. Contact the authorities if a cybercrime is suspected D. Restrict communication surrounding the response to the IT team

Answer 33

A. Train the team to identify the difference between events and incidents

Question 34

887.) A Chief Security Officer is looking for a solution that can provide increased scalability and flexibility for back-end infrastructure, allowing it to be updated and modified without disruption to services. The security architect would like the solution selected to reduce the back-end server resources and has highlighted that session persistence is not important for the applications running on the back-end servers. Which of the following would BEST meet the requirements? A. Reverse proxy B. Automated patch management C. Snapshots D. NIC teaming

Answer 34

A. Reverse proxy

Question 35

886.) A cybersecurity analyst reviews the log files from a web server and sees a series of files that indicate a directory-traversal attack has occurred. Which of the following is the analyst MOST likely seeing? A. http://sample.url.com/