Q 0-200 Flashcards
(54 cards)
A company prevented direct access from the database administrators’ workstations to the network segment that contains database servers. Which of the following should a database administrator use to access the database servers?
A.Jump server
B.RADIUS
C.HSM
D.Load balancer
Answer: Jump Server
Which of the following is required for an organization to properly manage its restore process in the event of system failure?
A.IRP
B.DRP
C.RPO
D.SDLC
Answer: DRP (Disaster Recovery Plan)
A security analyst is reviewing alerts in the SIEM related to potential malicious network traffic coming from an employee’s corporate laptop. The security analyst has determined that additional data about the executable running on the machine is necessary to continue the investigation. Which of the following logs should the analyst use as a data source?
A.Application
B.IPS/IDS
C.Network
D.Endpoint
Answer : Endpoint
Which of the following is the most likely to be used to document risks, responsible parties, and thresholds?
A.Risk tolerance
B.Risk transfer
C.Risk register
D.Risk analysis
Answer: Risk Register
Which of the following roles, according to the shared responsibility model, is responsible for securing the company’s database in an IaaS model for a cloud environment?
A.Client
B.Third-party vendor
C.Cloud provider
D.DBA
Answer: Client
Which of the following must be considered when designing a high-availability network? (Choose two).
A.Ease of recovery
B.Ability to patch
C.Physical isolation
D.Responsiveness
E.Attack surface
F.Extensible authentication
Answer: Ease Of Recovery and Responsiveness
Which of the following is the most likely outcome if a large bank fails an internal PCI DSS compliance assessment?
A.Fines
B.Audit findings
C.Sanctions
D.Reputation damage
Answer: Audit Findings
A company is developing a business continuity strategy and needs to determine how many staff members would be required to sustain the business in the case of a disruption. Which of the following best describes this step?
A.Capacity planning
B.Redundancy
C.Geographic dispersion
D.Tabletop exercise
Answer: Capacity Planning
While troubleshooting a firewall configuration, a technician determines that a “deny any” policy should be added to the bottom of the ACL. The technician updates the policy, but the new policy causes several company servers to become unreachable.
Which of the following actions would prevent this issue?
A.Documenting the new policy in a change request and submitting the request to change management
B.Testing the policy in a non-production environment before enabling the policy in the production network
C.Disabling any intrusion prevention signatures on the “deny any” policy prior to enabling the new policy
D.Including an “allow any” policy above the “deny any” policy
Answer : Testing the policy in a non-production environment before enabling the policy in the production network.
A U.S.-based cloud-hosting provider wants to expand its data centers to new international locations. Which of the following should the hosting provider consider first?
A.Local data protection regulations
B.Risks from hackers residing in other countries
C.Impacts to existing contractual obligations
D.Time zone differences in log correlation
answer is A. Local data protection regulations.
A security practitioner completes a vulnerability assessment on a company’s network and finds several vulnerabilities, which the operations team remediates. Which of the following should be done next?
A.Conduct an audit.
B.Initiate a penetration test.
C.Rescan the network.
D.Submit a report.
Answer: Rescan the network
Which of the following allows for the attribution of messages to individuals?
A.Adaptive identity
B.Non-repudiation
C.Authentication
D.Access logs
answer is Non-repudiation.
Which of the following tools can assist with detecting an employee who has accidentally emailed a file containing a customer’s PII?
A.SCAP
B.NetFlow
C.Antivirus
D.DLP
answer is DLP (Data Loss Prevention).
An organization recently updated its security policy to include the following statement:
Regular expressions are included in source code to remove special characters such as $, |, ;. &, `, and ? from variables set by forms in a web application.
Which of the following best explains the security technique the organization adopted by making this addition to the policy?
A.Identify embedded keys
B.Code debugging
C.Input validation
D.Static code analysis
answer is C. Input validation.
A security analyst and the management team are reviewing the organizational performance of a recent phishing campaign. The user click-through rate exceeded the acceptable risk threshold, and the management team wants to reduce the impact when a user clicks on a link in a phishing message. Which of the following should the analyst do?
A.Place posters around the office to raise awareness of common phishing activities.
B.Implement email security filters to prevent phishing emails from being delivered.
C.Update the EDR policies to block automatic execution of downloaded programs.
D.Create additional training for users to recognize the signs of phishing attempts
answer is C: Update the EDR policies to block automatic execution of downloaded programs.
A security operations center determines that the malicious activity detected on a server is normal. Which of the following activities describes the act of ignoring detected activity in the future?
A.Tuning
B.Aggregating
C.Quarantining
D.Archiving
answer is A. Tuning.
Which of the following is the most likely to be included as an element of communication in a security awareness program?
A.Reporting phishing attempts or other suspicious activities
B.Detecting insider threats using anomalous behavior recognition
C.Verifying information when modifying wire transfer data
D.Performing social engineering as part of third-party penetration testing
answer is A. Reporting phishing attempts or other suspicious activities.
Which of the following is the phase in the incident response process when a security analyst reviews roles and responsibilities?
A.Preparation
B.Recovery
C.Lessons learned
D.Analysis
The correct answer is A. Preparation.
After a recent vulnerability scan, a security engineer needs to harden the routers within the corporate network. Which of the following is the most appropriate to disable?
A.Console access
B.Routing protocols
C.VLANs
D.Web-based administration
Answer: Web-based administration
A security administrator needs a method to secure data in an environment that includes some form of checks so track any changes. Which of the following should the administrator set up to achieve this goal?
A.SPF
B.GPO
C.NAC
D.FIM
Answer: FIM (File Integrity Monitoring)
A security engineer is implementing FDE for all laptops in an organization. Which of the following are the most important for the engineer to consider as part of the planning process? (Choose two.)
A.Key escrow
B.TPM presence
C.Digital signatures
D.Data tokenization
E.Public key management
F.Certificate authority linking
Answer is :Key escrow and TPM presence
Security controls in a data center are being reviewed to ensure data is properly protected and that human life considerations are included. Which of the following best describes how the controls should be set up?
A.Remote access points should fail closed.
B.Logging controls should fail open.
C.Safety controls should fail open.
D.Logical security controls should fail closed.
The correct answer is Safety controls should fail open
Which of the following would be best suited for constantly changing environments?
A.RTOS
B.Containers
C.Embedded systems
D.SCADA
Answer: Containers
A technician is opening ports on a firewall for a new system being deployed and supported by a SaaS provider. Which of the following is a risk in the new system?
A.Default credentials
B.Non-segmented network
C.Supply chain vendor
D.Vulnerable software
The correct answer is Vulnerable software.
