SecurityX Practice Exam #2 (Dion)

Question 1

An enterprise implements multifactor authentication (MFA) for all employees. A user reports being unable to complete the login process because they do not receive the second factor authentication prompt. What is the most appropriate troubleshooting step?
Reset the user’s account and disable MFA temporarily
Assign the user to a different group with no MFA requirement
Check the configuration of the user’s second-factor device or service
Verify that the user’s primary credentials are correct

Answer 1

Check the configuration of the user’s second-factor device or service

Explanation:
OBJ 3.1: MFA requires both the primary credentials and the second-factor authentication to work properly. If the second factor is not triggered, the issue is likely related to the device or service configuration (e.g., a misconfigured app, outdated device, or incorrect association with the user’s account). Verifying credentials or resetting the account without addressing the second factor will not resolve this specific issue, and bypassing MFA entirely would compromise security. For support or reporting issues, include Question ID: 67513e716a9dc9d16f2d0303 in your ticket. Thank you.

Question 2

You have been asked to help design a new architecture for Dion Training’s website. The current architecture involves a single server that hosts the website in its entirety. The company’s newest course has been creating a lot of interest on social media. The CIO is concerned that the single server will not be able to handle the increased demand that could result from this increased publicity. What technology should you implement in the new architecture to allow multiple web servers to serve up the courses and meet this expected increase in demand from new students?

Load balancer
VPN concentrator
DLP
RAID

Answer 2

Load balancer

Explanation:
OBJ 2.1: A load balancer allows for high availability and the ability to serve increased demand by splitting the workload across multiple servers. RAID is a high availability technology that allows for multiple hard disks to act logically as one to handle more throughput, but this will not solve the higher demand on the server’s limited processing power as a load balancer would. A VPN concentrator is a networking device that provides the secure creation of VPN connections and the delivery of messages between VPN nodes. A data loss prevention (DLP) system is focused on ensuring that intellectual property theft does not occur. Therefore, a DLP will not help meet the increased demand from new students. For support or reporting issues, include Question ID: 63fe07093b7322449ddbc8e2 in your ticket. Thank you.

Question 3

Dion Training wants to implement a software-defined network when installing a new enterprise network. The company prefers to use open-source software to reduce the risk of vendor lock-in. Which of the following approaches to implementing a software-defined network should Dion Training utilize?

Peering SDN
Hybrid SDN
Open SDN
SDN Overlay

Answer 3

Open SDN

Explanation:
OBJ 2.5: Open SDN uses open standards and open-source software as a strategy to reduce the risks of vendor lock-in. Hybrid SDN uses a combination of traditional and software-defined networks in the same environment to achieve its objectives. SDN Overlay allows the use of software to create and manage new virtual networks which leverage your existing hardware. All network management and configuration is performed using software and new virtual networking devices are defined within that software. This virtualized overlay moves the data across the existing physical network devices, but that hardware no longer is directly configured or managed by administrators. Peering SDN is not a real type of SDN and is therefore incorrect. For support or reporting issues, include Question ID: 63fe06fe3b7322449ddbc856 in your ticket. Thank you.

Question 4

After conducting a recent vulnerability assessment, Dion Training has decided that they need to upgrade the security of their authentication system. The current system allowed the use of a simple alphanumeric password of only 8 digits. The team is currently trying to decide between implementing a long, strong, and complex password policy and implementing two-factor authentication. While the two-factor authentication would be more secure, it is also more costly to implement. The Chief Financial Officer prefers using the complex password policy as the solution to save money, but the Chief Security Officer prefers using multi-factor authentication for higher security. They have both created their course of action and will present it to the CEO for final approval and decision. Based on the information provided, which of the following types of analysis is the team at Dion Training performing?

Tradeoff analysis
Business impact analysis
Privacy impact analysis
Gap analysis

Answer 4

Tradeoff analysis

Explanation:
OBJ 1.2: A tradeoff analysis compares potential benefits to potential risks and determines a course of action based on adjusting factors that contribute to each area. A business impact analysis describes the collaborative effort to identify those systems and software that perform essential functions, meaning the organization cannot run without them. A privacy impact assessment is conducted by an organization for it to determine where its privacy data is stored and how that privacy data moves throughout an information system. It evaluates the impacts that may be realized by a compromise to the confidentiality, integrity, and/or availability of the data. A gap analysis measures the difference between the current state and desired state to assess the scope of work included in a project. By measuring ALE, MTTR, MTBF, TCO, and other factors, the organization can identify how closely it is performing to the desired outcomes or requirements. For support or reporting issues, include Question ID: 63fe07fb3b7322449ddbd4b4 in your ticket. Thank you.

Question 5

An organization adopts a SASE framework to improve security and performance in its deperimeterized environment. Which of the following actions would align with this implementation?

Routing all user traffic through cloud-based security services for monitoring and control
Deploying physical firewalls at all remote locations to enforce security policies
Consolidating sensitive resources into a single data center for easier access control
Using IP-based access lists to manage connections to internal applications

Answer 5

Routing all user traffic through cloud-based security services for monitoring and control

Explanation:
OBJ 2.6 - SASE frameworks route all user traffic through cloud-based security services, such as SWG or CASB, ensuring consistent monitoring and policy enforcement. Physical firewalls and IP-based access lists are insufficient for dynamic, scalable environments. Consolidating resources into a single data center conflicts with the decentralized nature of deperimeterization. For support or reporting issues, include Question ID: 674f72ff25e0bdcbe9af8fa8 in your ticket. Thank yo

Question 6

William evaluates the potential impact of a confidentiality risk and determines that the disclosure of information contained on a system could have a limited adverse effect on the organization. Using FIPS 199, how should he classify the confidentiality impact?

High
Low
Moderate
Medium

Answer 6

Low

Explanation:
OBJ 1.2: FIPS 199 classifies any risk where “the unauthorized disclosure of information could be expected to have a limited adverse effect” as a low impact confidentiality risk. If there were a serious adverse effect expected, then it would be a moderate impact. If there were a severe or catastrophic adverse effect expected, then it would be a high impact. Medium is not an impact under FIPS 199. This question may seem beyond the scope of the exam. Still, the objectives allow for “other examples of technologies, processes, or tasks about each objective may also be included on the exam although not listed or covered” in the objectives’ bulletized lists. The content examples listed in the objectives are meant to clarify the test objectives and should not be construed as a comprehensive listing of this examination’s content. Therefore, questions like this are fair game on test day. That said, your goal isn’t to score 100% on the exam; it is to pass it. Don’t let questions like this throw you off on test day. If you aren’t sure, take your best guess and move on! For support or reporting issues, include Question ID: 63fe07e83b7322449ddbd3cc in your ticket. Thank you.

Question 7

Your company has just finished replacing all of its computers with brand new workstations. Colleen, one of your coworkers, has asked the company’s owner if she can have the old computers that are about to be thrown away. Colleen would like to refurbish the old computers by reinstalling a new operating system and donating them to a local community center for disadvantaged children in the neighborhood. The owner thinks this is a great idea but is concerned that the private and sensitive corporate data on the old computer’s hard drives might be placed at risk of exposure. You have been asked to choose the best solution to sanitize or destroy the data while ensuring the computers will still be usable by the community center. What type of data destruction or sanitization method do you recommend?

Shredding
Purging
Wiping
Degaussing

Answer 7

Wiping

Explanation:
OBH 4.2: Data wiping or clearing occurs by using a software tool to overwrite the data on a hard drive to destroy all electronic data on a hard disk or other media. Data wiping may be performed with a 1x, 7x, or 35x overwriting, with a higher number of times being more secure. This allows the hard drive to remain functional and allows for hardware reuse. Degaussing a hard drive involves demagnetizing a hard drive to erase its stored data. You cannot reuse a hard drive once it has been degaussed. Therefore, it is a bad solution for this scenario. Purging involves removing sensitive data from a hard drive using the device’s internal electronics or an outside source such as a degausser, or by using a cryptographic erase function if the drive supports one. Shredding involves the physical destruction of the hard drive. This is a secure method of destruction but doesn’t allow for device reuse. For support or reporting issues, include Question ID: 63fe07f53b7322449ddbd473 in your ticket. Thank you.

Question 8

Dion Training has configured a group of web servers that will expand and contract automatically based on the current workloads being experienced by their website. The company has set up maximum capacity settings to help control its costs. Which of the following BEST describes the type of action used to meet user demand?

Horizontal scaling
Autoscaling
Clustering
Vertical scaling

Answer 8

Autoscaling

Explanation:
OBJ 2.1: Autoscaling is the ability to expand and contract the performance of workloads based on policies with specific maximum and minimum capacity specifications. Autoscaling can be used with either horizontal or vertical scaling depending on your cloud service provider. Vertical scaling allows additional resources to be added to an individual system, such as adding processors, memory, and storage to an existing server. Horizontal scaling allows additional capacity to be achieved by adding servers to help process the same workload, such as adding nodes to a distributed system or adding web servers to an existing server farm. Clustering allows multiple redundant processing nodes that share data to accept connections. The cluster appears to be a single server to the clients but provides additional levels of redundancy and resiliency. For support or reporting issues, include Question ID: 63fe06cd3b7322449ddbc5f8 in your ticket. Thank you.

Question 9

You want to provide controlled remote access to the remote administration interfaces of multiple servers hosted on a private cloud. What type of segmentation security solution is the best choice for this scenario?
Airgap
Physical
Jumpbox
Bastion hosts

Answer 9

Jumpbox

Explanation:
OBJ 2.6: Installing a jumpbox as a single point of entry for the administration of servers within the cloud is the best choice for this requirement. The jumpbox only runs the necessary administrative port and protocol (typically SSH). Administrators connect to the jumpbox then use the jumpbox to connect to the admin interface on the application server. The application server’s admin interface has a single entry in its ACL (the jumpbox) and denies any other hosts’ connection attempts. A bastion host is a special-purpose computer on a network specifically designed and configured to withstand attacks. The computer generally hosts a single application. For example, a proxy server and all other services are removed or limited to reduce the threat to the computer. An airgap system is a network or single host computer with unique security requirements that may physically be separated from any other network. Physical separation would prevent a system from accessing the remote administration interface directly and require an airgap system to reach the private cloud. For support or reporting issues, include Question ID: 63fe06d23b7322449ddbc635 in your ticket. Thank you.

Question 10

A network technician is tasked with designing a firewall to improve security for an existing FTP server on the company network. The FTP server must be accessible from the Internet. The security team is concerned that the FTP server could be compromised and used to attack the domain controller hosted within the company’s internal network. What is the BEST way to mitigate this risk?
Upgrade the FTP server to an SFTP server since it is more secure
Add a deny rule to the firewall’s ACL that blocks port 21 outbound
Migrate the FTP server from the internal network to a screened subnet
Configure the firewall to utilize an implicit deny statement

Answer 10

Migrate the FTP server from the internal network to a screened subnet

Explanation:
OBJ 2.3: A screened subnet (formerly called a demilitarized zone or DMZ) is a perimeter network that protects an organization’s internal local area network (LAN) from untrusted traffic. A screened subnet is placed between the public internet and private networks. Public servers, such as the FTP server, should be installed in a screened subnet so that additional security mitigations like a web application firewall or application-aware firewall can be used to protect them. SFTP (Secure File Transfer Protocol) is a file transfer protocol that leverages a set of utilities that provide secure access to a remote computer to deliver secure communications by leveraging a secure shell (SSH) connection to encrypt the communication between the client and the server. This will prevent an attacker from eavesdropping on the communications between the SFTP server and a client, but it will not prevent an attacker from exploiting the SFTP server itself. An implicit deny is when a user or group is not granted specific permission in the security settings of an object, but they are not explicitly denied either. This is a best practice to enable, but the FTP server would still have some open ports, such as ports 20 and 21, to operate. These ports could then be used by the attacker to connect to the FTP server and exploit it. Adding a deny rule to the firewall’s ACL that blocks port 21 outbound would simply prevent internal network users and servers from accessing external FTP servers. This would in no way prevent the exploitation of the company’s FTP server since it has port 21 open and listening for inbound connections. For support or reporting issues, include Question ID: 63fe070d3b7322449ddbc914 in your ticket. Thank you.

Question 11

A financial institution needs a highly secure system to manage cryptographic keys for its payment processing operations. The system must comply with strict regulatory requirements for key storage and provide hardware-based tamper resistance. Which technology should the organization implement?

HSM
Secure enclave
TPM
vTPM

Answer 11

HSM

Explanation:
OBJ 3.4: Hardware Security Modules (HSMs) are purpose-built devices for managing cryptographic keys with hardware-based security and compliance capabilities. Trusted Platform Modules (TPMs) are typically embedded in devices and lack the scalability and performance required for enterprise-level key management. Secure enclaves are designed for isolating sensitive computations, not enterprise key management. Virtual Trusted Platform Modules (vTPMs) provide virtualization of TPM functions but do not offer the physical tamper resistance of HSMs. For support or reporting issues, include Question ID: 6751acc297eb9dce4020fc13 in your ticket. Thank you.

Question 12

Which of the following layers within software-defined networking consists of the physical networking devices, such as switches and routers?

Application layer
Infrastructure layer
Management plane
Control layer

Answer 12

Infrastructure layer

Explanation:
OBJ 2.3: The infrastructure layer contains the physical networking devices that receive information from the control layer about where to move the data and then perform those movements. The application layer focuses on the communication resource requests or information about the network. The control layer uses the information from applications to decide how to route a data packet on the network and to make decisions about how traffic should be prioritized, how it should be secured, and where it should be forwarded to. The management plane is used to monitor traffic conditions, the status of the network, and allows network administrators to oversee the network and gain insight into its operations. For support or reporting issues, include Question ID: 63fe06fd3b7322449ddbc851 in your ticket. Thank you.

Question 13

A global enterprise uses context-based reauthentication in its Zero Trust architecture. A sales employee attempts to access sensitive customer data while traveling internationally. The system detects the access request coming from an unrecognized IP address and a non-typical time zone for the employee. What is the most appropriate action for the system to take?
Grant access to the requested data without any additional steps
Prompt the user for additional reauthentication steps, such as MFA
Log the event but allow the access to proceed for continuity
Your answer is incorrect
Deny the request and lock the user’s account until further verification

Answer 13

Prompt the user for additional reauthentication steps, such as MFA

Explanation:
OBJ 2.6: Context-based reauthentication dynamically evaluates access requests based on risk factors such as location, time zone, and IP address. Prompting the user for additional reauthentication ensures the legitimacy of the request without causing unnecessary disruptions. Granting access without additional steps fails to mitigate the risk. Denying the request and locking the account is overly restrictive and disrupts the user unnecessarily. Logging the event but allowing access does not align with Zero Trust principles of continuous verification. For support or reporting issues, include Question ID: 675100b223df37e1b5ec6004 in your ticket. Thank you.

Question 14

NA

Question 15

Which of the following would an adversary do during the ‘command and control’ phase of the Lockheed Martin kill chain? (SELECT TWO)

Destroy systems
Create a point of presence by adding services, scheduled tasks, or AutoRun keys
Utilize web, DNS, and email protocols to conduct control of the target
Conduct internal reconnaissance of the target network
Open up a two-way communication channel to an established infrastructure
Release of malicious email

Answer 15

Utilize web, DNS, and email protocols to conduct control of the target
Open up a two-way communication channel to an established infrastructure

Explanation:
OBJ 1.4: During the command and control (C2) phase, the adversary is testing that they have control over any implants that have been installed. This can be conducted using the web, DNS, and email protocols to control the target and relies on an established two-way communication infrastructure to control the target system using remote access. Internal reconnaissance or destructive actions occur in the actions on objectives phase. The release of malicious emails occurs in the delivery phase. For support or reporting issues, include Question ID: 63fe07953b7322449ddbcfb3 in your ticket. Thank you.

Question 16

Which protocol is paired with OAuth2 to provide authentication of users in a federated identity management solution?

SAML
ADFS
OpenID Connect
Kerberos

Answer 16

OpenID Connect

Explanation:
OBJ 2.4: OAuth 2 is explicitly designed to authorize claims and not to authenticate users. The implementation details for fields and attributes within tokens are not defined. Open ID Connect (OIDC) is an authentication protocol that can be implemented as special types of OAuth flows with precisely defined token fields. Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties, in particular, between an identity provider and a service provider. SAML is an XML-based markup language for security assertions. Active Directory Federation Services (ADFS) is a software component developed by Microsoft that can run on Windows Server operating systems to provide users with single sign-on access to systems and applications located across organizational boundaries. Kerberos is a computer network authentication protocol that works based on tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner. For support or reporting issues, include Question ID: 63fe07053b7322449ddbc8ab in your ticket. Thank you.

Question 17

A software assurance laboratory performs a dynamic assessment on an application by automatically generating random data sets and inputting them to cause an error or failure condition. Which of the following is the laboratory performing?

Stress testing
Fuzzing
Security regression testing
User acceptance testing

Answer 17

Fuzzing

Explanation:
OBJ 2.2: Fuzzing or fuzz testing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. The program is then monitored for exceptions such as crashes, failing built-in code assertions, or potential memory leaks. User Acceptance Testing is the process of verifying that a created solution/software works for the user. Security regression testing ensures that changes made to a system do not harm its security, are therefore of high significance, and the interest in such approaches has steadily increased. Stress testing verifies the system’s stability and reliability by measuring its robustness and error handling capabilities under heavy load conditions. For support or reporting issues, include Question ID: 63fe06be3b7322449ddbc53f in your ticket. Thank you.

Question 18

Which one of the following methods would provide the most current and accurate information about any vulnerabilities present in a system with a misconfigured operating system setting?

Agent-based monitoring
Scheduled vulnerability scanning
On-demand vulnerability scanning
Continuous vulnerability scanning

Answer 18

Agent-based monitoring

Explanation:
OBJ 3.6: An agent-based monitoring solution would be the best choice to meet these requirements. Agent-based monitoring provides more details of the configuration settings for a system and can provide an internal perspective. While vulnerability scans can give you a snapshot of a system’s status at a certain time, they will not remain current and accurate without continual rescanning. For support or reporting issues, include Question ID: 63fe077f3b7322449ddbce9e in your ticket. Thank you.

Question 19

An organization implements subject access control to restrict access to resources based on user roles. A user reports they cannot access a specific application necessary for their job, even though they have the correct role assigned. Which of the following is the most likely cause?

The user has not completed the multifactor authentication process
The organization uses DAC instead of RBAC
The user’s device is not compliant with corporate security policies and needs to be replaced
The application permissions are not properly mapped to the assigned role

Answer 19

The application permissions are not properly mapped to the assigned role

Explanation:
OBJ 3.1: In a role-based access control (RBAC) system, access is granted based on roles, and if the application permissions are not mapped to the correct role, the user will be unable to access it. MFA completion is unrelated to role-based permissions. Device compliance would block access at a policy level, not due to role misconfiguration. Discretionary access control (DAC) may cause inconsistencies but does not explain the issue within a role-based access control (RBAC) system. For support or reporting issues, include Question ID: 67513b7aeb96f8a01c17535f in your ticket. Thank you.

Question 20

After an employee complains that her computer is running abnormally slow, so you conduct an analysis of the NetFlow data from her workstation. Based on the NetFlow data, you identify a significant amount of traffic from her computer to an IP address in a foreign country over port 6667 (IRC). Which of the following is the most likely explanation for this?

Malware has been installed on her computer and is using the IRC protocol to communicate
The computer has likely been compromised by an APT
This is routine machine-to-machine communications in a corporate network
The employee is using IRC to communicate with her friends and family overseas

Answer 20

Malware has been installed on her computer and is using the IRC protocol to communicate

Explanation:
OBJ 4.1: Internet Relay Chat (IRC) used to be extremely popular but was replaced by modern chat applications like Facebook Messenger, Google Hangouts, Slack, and numerous others. These days, IRC traffic is infrequent on most corporate networks. Therefore, this would be classified as suspicious and require additional investigation. The unencrypted nature of the protocol makes it easy to intercept and read communications on this port. Still, even so, many types of malware use IRC as a communication channel. Due to this cleartext transmission, an APT would avoid using IRC for their C2 channel to blend in with regular network traffic and avoid detection. IRC is not normally used for machine-to-machine communications in corporate networks. Because the scenario mentioned a connection to a foreign country, as part of your investigation, you should ask the employee if they have friends or family overseas in the country to rule out the possibility that this is acceptable traffic. For support or reporting issues, include Question ID: 63fe07443b7322449ddbcbba in your ticket. Thank you.

Question 21

In the context of identity and access management (IAM), what is the primary purpose of logging and monitoring user authentication events?

To enable single sign-on (SSO) across multiple enterprise applications
To enforce password complexity requirements across the organization
To automate the revocation of expired user credentials across the network
To detect unauthorized access attempts and support forensic investigations

Answer 21

To detect unauthorized access attempts and support forensic investigations

Explanation:
OBJ 3.1 - Logging and monitoring authentication events provide visibility into user access activities, enabling the detection of unauthorized attempts and serving as a critical resource for forensic investigations following security incidents. While password complexity, SSO, and credential revocation are important IAM tasks, they are not the primary focus of logging and monitoring. For support or reporting issues, include Question ID: 675063a0f5372d1adb3df726 in your ticket. Thank you.

Question 22

Which of the following is exploited by an SQL injection to give the attacker access to a database?

Database server
Web application
Firewall
Operating system

Answer 22

Web application

Explanation:
OBJ 4.2: SQL injections target the data stored in enterprise databases by exploiting flaws in client-facing applications. These vulnerabilities being exploited are most often found in web applications. The database server or operating system would normally be exploited by a remote code execution, a buffer overflow, or another type of server-side attack. The firewall would not be subject to an SQL injection. For support or reporting issues, include Question ID: 63fe07363b7322449ddbcb10 in your ticket. Thank you.

Question 23

A user has called complaining that they have been locked out of their corporate account after attempting to log in while connected to a VPN that they often use. Upon investigation, the security team finds that the user successfully logged in from their home IP address earlier in the day and then attempted another login from an IP address associated with the VPN shortly after. Which of the following actions should the IT team take to resolve the issue while maintaining security?

Allow the user to retry the login attempt without geographical restrictions once their identity has been verified
Modify the IAM policies to disable geographic location checks for all users
Verify the user’s identity and review the impossible travel settings to fine-tune thresholds
Temporarily suspend the user’s account to prevent further suspicious activity from occurring

Answer 23

Verify the user’s identity and review the impossible travel settings to fine-tune thresholds

Explanation:
OBJ 3.1: The “impossible travel” feature in IAM systems detects logins from geographically distant locations within an unrealistic time frame, indicating either a security risk or a false positive caused by VPN use. To resolve the issue, the IT team should verify the user’s identity to confirm the login attempt was legitimate, then fine-tune the “impossible travel” thresholds to account for cases where VPNs may trigger false positives. Temporarily suspending the account would further cause unnecessary accessibility issues for the user. Disabling geographic checks would weaken security and bypassing geographic restrictions could expose the system to real threats. For support or reporting issues, include Question ID: 6751479aee759eace74d72e1 in your ticket. Thank you.

Question 24

Which of the following will an adversary do during the final phase of the Lockheed Martin kill chain? (SELECT FOUR)

Lateral movement through the environment
Wait for a user to click on a malicious link
Exfiltrate data
Modify data
Release of malicious email
Privilege escalation

Answer 24

Lateral movement through the environment
Exfiltrate data
Modify data
Privilege escalation

Explanation:
OBJ 1.4: The last phase is the actions on objectives phase. During this phase, the targeted network is now adequately controlled by the attacker. If the system or network owner does not detect the attacker, the adversary may persist for months while gaining progressively deeper footholds into the network. This is done through privilege escalation and lateral movement. Additionally, the attacker can now exfiltrate data from the network or modify data that will remain in the network. Waiting for a user to click on a malicious link occurs during the exploitation phase. Releasing a malicious email would occur during the delivery phase. For support or reporting issues, include Question ID: 63fe07923b7322449ddbcf8b in your ticket. Thank you.

Question 25

Which of the following secure coding best practices ensures special characters like , /, and ‘ are not accepted from the user via a web form? Output encoding Session management Input validation Error handling

Answer 25

Input validation Explanation: OBJ 4.2: Input validation is performed to ensure only properly formed data is entering the workflow in an information system, preventing malformed data from persisting in the database and triggering a malfunction of various downstream components. Input validation should happen as early as possible in the data flow, preferably as soon as the data is received from the user. Improper error handling can introduce various security problems where detailed internal error messages such as stack traces, database dumps, and error codes are displayed to an attacker. The session management implementation defines the exchange mechanism that will be used between the user and the web application to share and continuously exchange the session ID. Output encoding involves translating special characters into some different but equivalent form that is no longer dangerous in the target interpreter, for example, translating the < character into the < string when writing to an HTML page. For support or reporting issues, include Question ID: 63fe07063b7322449ddbc8b5 in your ticket. Thank you.

Question 26

Dion Training installed a new router 183 days ago and it stopped working today due to a faulty power supply. The network technicians replaced the power supply and the router was returned to service within 4 hours. Which of the following terms would BEST represent the 183 days in this scenario? RPO RTO MTTR MTBF

Answer 26

MTBF Explanation: OBJ 1.2: The mean time between failures (MTBF) measures the average time between when failures occur on a device. The mean time to repair (MTTR) measures the average time it takes to repair a network device when it breaks. The recovery time objective (RTO) is the duration of time and a service level within which a business process must be restored after a disaster to avoid unacceptable consequences associated with a break in continuity. The recovery point objective (RPO) is the interval of time that might pass during a disruption before the quantity of data lost during that period exceeds the Business Continuity Plan’s maximum allowable threshold or tolerance. For support or reporting issues, include Question ID: 63fe07ec3b7322449ddbd400 in your ticket. Thank you.

Question 27

Jonathan is trying to open an encrypted and digitally-signed email he sent 3 years ago. Last month, he was issued a new public/private key pair since his old key pair had expired. When attempting to open some encrypted and digitally-signed emails he sent last week, he can read them without any issues. Which of the following errors is causing Jonathan’s issues with reading the email from 3 years ago? Mismatched key error Compromised key pair Rekeying error Incorrect name error

Answer 27

Mismatched key error Explanation: OBJ 3.3: The reason Jonathan can no longer read those encrypted emails is that his previous public/private key pair has expired and is no longer valid for use. His email client is trying to decrypt those emails using his new public/private key pair causing a mismatched key error. A mismatched key error occurs is the wrong public/private key pair is used to decrypt data. The most common forms of this error are displayed as “key mismatch” or “X509_check_private_key”. Rekeying is the process of changing an individual key during a communication session. Most communication protocols use session key rekeying to protect the data being transmitted. A rekeying is normally triggered based on the volume of data communicated or the amount of time since the last rekeying. A compromised or exposed key occurs when unauthorized access to a symmetric or private key is gained. When a key is compromised or exposed, it must be revoked and replaced. An incorrect name error is generated when the certificate’s CN name does not match the FQDN of the system that is using the certificate. For example, if the certificate is issued to diontraining.com but is being presented for www.diontraining.com or yourcyberpath.com, it will generate an incorrect name error. For support or reporting issues, include Question ID: 63fe07d23b7322449ddbd2b4 in your ticket. Thank you.

Question 28

A penetration tester hired by a bank began searching for the bank's IP ranges by performing lookups on the bank's DNS servers, reading news articles online about the bank, monitoring what times the bank's employees came into and left work, searching job postings (with a special focus on the bank's information technology jobs), and even searching the corporate office of the bank's dumpster. Based on this description, what portion of the penetration test is being conducted? Active information gathering Information reporting Passive information gathering Vulnerability assessment

Answer 28

Passive information gathering Explanation: OBJ 4.3: Passive information gathering consists of numerous activities where the penetration tester gathers open-source or publicly available information without the organization under investigation being aware that the information has been accessed. Instead, active information gathering starts to probe the organization using DNS Enumeration, Port Scanning, and OS Fingerprinting techniques. Vulnerability assessments are another form of active information gathering. Information reporting occurs after the penetration test is complete, and it involves writing a final report with the results, vulnerabilities, and lessons learned during the assessment. For support or reporting issues, include Question ID: 63fe07873b7322449ddbcf02 in your ticket. Thank you.

Question 29

A cybersecurity analyst has received an alert that sensors continuously observe well-known call home messages at their network boundary. Still, the organization's proxy firewall is properly configured to successfully drop the messages before leaving the network. Which of the following is MOST likely the cause of the call home messages being sent? Malware is running on a company workstation or server An infected workstation is attempting to reach a command and control server An attacker is performing reconnaissance of the organization's workstations A malicious insider is trying to exfiltrate information to a remote network

Answer 29

An infected workstation is attempting to reach a command and control server Explanation: OBJ 4.1: A call home message is an indicator of compromise known as beaconing. Beaconing usually occurs after a stage 1 malware program has been implanted on an organization's workstation or server, but that isn't the most correct answer to this question. Instead, beaconing indicates that a workstation or server is infected and tries to communicate with the attacker's command and control server. This beaconing will continue until the infected system (workstation or server) is found and cleared of the malware or until the botnet gives the infected host further instructions to perform (such as to attack). "Malware is running on a company workstation or server" is incorrect because we do not have positive verification of that based on this scenario. A beacon does not have to be malware. For example, it can simply be a single ping packet or DNS request being sent out every day at a certain time using the Windows task scheduler. Be careful on the exam to answer the question being asked and choose the "most" accurate answer. Since the call home signal is coming from the internal network and attempting to connect to an external server, it cannot be evidence of an attacker performing reconnaissance on your workstations. Also, nothing in the question is indicative of an insider threat trying to exfiltrate information since a call home message is generally minimal in size and not large enough to exfiltrate data. For support or reporting issues, include Question ID: 63fe07383b7322449ddbcb29 in your ticket. Thank you.

Question 30

Annah is deploying a new application that she received from a vendor, but she is unsure if the hardware is adequate to support a large number of users during peak usage periods. What type of testing could Annah perform to determine if the application will support the required number of users? Fuzz testing Regression testing Load testing User acceptance testing

Answer 30

Load testing Explanation: OBJ 2.2: Load testing or stress testing puts an application, network, or system under full load conditions to document any performance lapses. User Acceptance Testing is the process of verifying that a created solution/software works for a user. Regression testing is defined as software testing to confirm that a recent program or code change has not adversely affected existing features. Fuzz testing, or fuzzing, is a quality assurance technique used to discover coding errors and security loopholes in software, operating systems, or networks. It involves inputting massive amounts of random data to the test subject to make it crash. User acceptance testing, regression testing, and fuzz testing are not designed to test a system under heavy load conditions. Therefore, they will not be suitable for Annah's needs in this scenario. For support or reporting issues, include Question ID: 63fe06cf3b7322449ddbc616 in your ticket. Thank you.

Question 31

Which term is used in software development to refer to the method in which app and platform updates are committed to a production environment rapidly? Continuous deployment Continuous monitoring Continuous integration Continuous delivery

Answer 31

Continuous deployment Explanation: OBJ 2.2: Continuous deployment is a software development method in which app and platform updates are committed to production rapidly. Continuous delivery is a software development method in which app and platform requirements are frequently tested and validated for immediate availability. Continuous integration is a software development method in which code updates are tested and committed to development or build server/code repositories rapidly. Continuous monitoring is the technique of constantly evaluating an environment for changes so that new risks may be more quickly detected and business operations improved upon. While continuous deployment and continuous delivery sound very similar, there is one key difference. In continuous delivery, a human is still required to approve the release into the production environment. In continuous deployment, the test and release process into the production environment is automated, making the changes available for immediate release once the code is committed. For support or reporting issues, include Question ID: 63fe06ef3b7322449ddbc79d in your ticket. Thank you.

Question 32

What is the primary advantage of leveraging data perimeters in a distributed enterprise environment? They dynamically adapt access controls to protect data in transit and at rest They eliminate the need for encryption by securing the network perimeter They centralize sensitive data to reduce the attack surface They improve network performance by reducing data access delays and bottlenecks

Answer 32

They dynamically adapt access controls to protect data in transit and at rest Explanation: OBJ 2.6 - Data perimeters provide dynamic, adaptive access controls based on the sensitivity and location of data, ensuring its protection regardless of whether it is in transit or at rest. Centralizing data is not a feature of data perimeters, and encryption remains essential even within secure perimeters. Improving network performance is not the primary focus of data perimeters. For support or reporting issues, include Question ID: 674f7117be598e99e87d61fb in your ticket. Thank you.

Question 33

Which of the following vulnerabilities can be prevented by using proper input validation? (Select ANY that apply) XML injection SQL injection Directory traversal Cross-site scripting

Answer 33

XML injection SQL injection Directory traversal Cross-site scripting Explanation: OBJ 4.2: Proper input validation can prevent cross-site scripting, SQL injection, directory traversal, and XML injections from occurring. When an application accepts string input, the input should be subjected to normalization or sanitization procedures before being accepted. Normalization means that a string is stripped of illegal characters or substrings and converted to the accepted character set. This can prevent SQL and XML injections from occurring. Input validation is also good at preventing cross-site scripting (XSS) in any forms that accept user input. Directory traversals can be prevented by conducting input validation in file paths or URLs accepted from the user. This prevents a canonicalization attack from disguising the nature of the malicious input that could cause a directory traversal. For support or reporting issues, include Question ID: 63fe07133b7322449ddbc955 in your ticket. Thank you.

Question 34

A firewall administrator has configured a new screened subnet to allow public systems to be segmented from the organization's internal network. The firewall now has three security zones set: Untrusted (Internet) [143.27.43.0/24]; DMZ (Screened Subnet) [161.212.71.0/24]; Trusted (Intranet) [10.10.0.0/24]. The firewall administrator has been asked to enable remote desktop access from a fixed IP on the remote network to a remote desktop server in the screened subnet for the Chief Security Officer to work from his home office after hours. The CSO's home internet uses a static IP of 143.27.43.32. The remote desktop server is assigned a public-facing IP of 161.212.71.14. What rule should the administrator add to the firewall? Permit 143.27.43.0/24 161.212.71.0/24 RDP 3389 Permit 143.27.43.0/24 161.212.71.14 RDP 3389 Permit 143.27.43.32 161.212.71.14 RDP 3389 Permit 143.27.43.32 161.212.71.0/24 RDP 3389

Answer 34

Permit 143.27.43.32 161.212.71.14 RDP 3389 Explanation: OBJ 2.3: Due to the requirement to allow a single remote IP to enter the firewall, the permit statement must start with a single IP in the Untrusted (Internet) zone. Based on the options provided, only 143.27.43.32 could be correct. Next, the destination is a single server in the DMZ (screened subnet), so only 161.212.71.14 could be correct. The destination port should be 3389, which is the port for the Remote Desktop Protocol. Combining these three facts, only "permit 143.27.43.32 161.212.71.14 RDP 3389" could be correct. For support or reporting issues, include Question ID: 63fe06d63b7322449ddbc66c in your ticket. Thank you.

Question 35

Dion Training issues two different digital certificates for each team member and embeds them onto a smart card. One of the digital certificates is used for identity verification while the second is used for the digital signing of the team member’s emails. Jason is trying to log in to the SharePoint server on the company’s intranet using his smart card. When he clicks the login button, a window pops up asking for him to select a certificate from his smart card. Jason selects a certificate and then receives an error stating “Your session could not be established. Access was denied by the access policy.” Which of the following is MOST likely causing this error? There is a validity date error on the certificate The incorrect name is on the certificate The wrong certificate type was presented A chain issue occurred with intermediate CA

Answer 35

The wrong certificate type was presented Explanation: OBJ 3.1: The most likely cause of this error is that Jason selected the email certificate instead of his identity certificate from his smart card during the login process. A wrong certificate type error is generated when a certificate designed for a specific use case is used for a different reason. For example, if a user attempts to log in to a website using an email certificate instead of an identification certificate, a wrong certificate type error will be generated. A validity date error occurs when a certificate is presented for use on a date that is already past the expiration date. An incorrect name error is generated when the certificate’s CN name does not match the FQDN of the system that is using the certificate. For example, if the certificate is issued to diontraining.com but is being presented for www.diontraining.com or yourcyberpath.com, it will generate an incorrect name error. Chain issues occur when the root, subordinate, or leaf certificate fails to pass a validity check. Since the certificate authorities must all pass the validity checks for the certification issued to be considered valid, if any of these are invalid then the entire chain is considered invalid, too. For support or reporting issues, include Question ID: 63fe07bb3b7322449ddbd197 in your ticket. Thank you.

Question 36

Which file on a Linux system contains the passwords for each user on the system? shadow passwd users password

Answer 36

shadow Explanation: OBJ 3.3: The shadow file stores the actual password in an encrypted format (more like the hash of the password) for the user’s account with additional properties related to the user password. Basically, it stores secure user account information. All fields are separated by a colon (:) symbol. It contains one entry per line for each user listed in passwd file. For support or reporting issues, include Question ID: 63fe06e13b7322449ddbc6f3 in your ticket. Thank you.

Question 37

Which of the following will an adversary do during the exploitation phase of the Lockheed Martin kill chain? (SELECT THREE) Wait for a malicious email attachment to be opened A webshell is installed on a web server Wait for a user to click on a malicious link Take advantage of a software, hardware, or human vulnerability Select backdoor implant and appropriate command and control infrastructure for operation A backdoor/implant is placed on a victim's client

Answer 37

Wait for a malicious email attachment to be opened Wait for a user to click on a malicious link Take advantage of a software, hardware, or human vulnerability Explanation: OBJ 1.4: During this phase, activities taken during the exploitation phase are conducted against the target's system. Taking advantage of or exploiting an accessible vulnerability, waiting for a malicious email attached to be opened, or waiting for a user to click on a malicious link is all part of the exploitation phase. The installation of a web shell, backdoor, or implant is all performed during the installation phase. Selecting a backdoor implant and appropriate command and control infrastructure occurs during the weaponization phase. For support or reporting issues, include Question ID: 63fe07953b7322449ddbcfba in your ticket. Thank you.

Question 38

Your organization is preparing for its required quarterly PCI DSS external vulnerability scan. Who is authorized to perform this scan? Any qualified individual Only employees of the company Only an approved scanning vendor Anyone

Answer 38

Only an approved scanning vendor Explanation: OBJ 1.3: The Payment Card Industry Data Security Standard (PCI-DSS) is a prescriptive framework. It is not a law but a formal policy created by the credit card industry that organizations must follow to accept credit and bank cards for payment. Quarterly required external vulnerability scans must be run by a PCI-DSS approved scanning vendor (ASV). This question may seem beyond the scope of the exam. Still, the objectives allow for "other examples of technologies, processes, or tasks about each objective may also be included on the exam although not listed or covered" in the objectives' bulletized lists. The content examples listed in the objectives are meant to clarify the test objectives and should not be construed as a comprehensive listing of this examination's content. Therefore, questions like this are fair game on test day. That said, your goal isn’t to score 100% on the exam; it is to pass it. Don't let questions like this throw you off on test day. If you aren't sure, take your best guess and move on! For support or reporting issues, include Question ID: 63fe080f3b7322449ddbd5b8 in your ticket. Thank you.

Question 39

Which of the following would a virtual private cloud (VPC) infrastructure be classified as? Function as a Service Software as a Service Platform as a Service Infrastructure as a Service

Answer 39

Infrastructure as a Service Explanation: OBJ 2.5: Infrastructure as a Service (IaaS) is a computing method that uses the cloud to provide any or all infrastructure needs. In a VPC environment, an organization may provision virtual servers in a cloud-hosted network. The service consumer is still responsible for maintaining the IP address space and routing internally to the cloud. Platform as a Service (PaaS) is a computing method that uses the cloud to provide any platform-type services. Software as a Service (SaaS) is a computing method that uses the cloud to provide users with application services. Function as a Service (FaaS) is a cloud service model that supports serverless software architecture by provisioning runtime containers to execute code in a particular programming language. For support or reporting issues, include Question ID: 63fe06c13b7322449ddbc569 in your ticket. Thank you.

Question 40

You have just completed identifying, analyzing, and containing an incident. You have verified that the company uses older unencrypted SSDs as part of their default configuration, and the manufacturer does not provide a SE utility for the devices. The storage devices contained top-secret data that would bankrupt the company if it fell into a competitor’s hands. After safely extracting the device's data and saving it to a new self-encrypting drive, you have been asked to dispose of the SSDs securely. Which of the following methods should you use? Conduct zero-fill on the storage devices Perform a cryptographic erase (CE) on the storage devices Physically destroy the storage devices Use a secure erase (SE) utility on the storage devices

Answer 40

Physically destroy the storage devices Explanation: OBJ 3.4: Physical destruction is the only option that will meet the requirements of this scenario. Sanitizing a hard drive can be done using cryptographic erase (CE), secure erase (SE), zero-fill, or physical destruction. In this scenario, the SSDs were not self-encrypting drives (SED) and did not have a SE utility available, so the CE or SE methods cannot be used. The cryptographic erase (CE) method sanitizes a self-encrypting drive by erasing the media encryption key and then reimaging the drive. A secure erase (SE) is used to perform the sanitization of flash-based devices (such as SSDs or USB devices) when cryptographic erase is not available. The zero-fill method relies on overwriting a storage device by setting all bits to the value of zero (0), but this is not effective on SSDs or hybrid drives. The best option is to conduct physical destruction since the scenario states that the storage device was already replaced with a new self-encrypting drive (SED). The old SSD contained top-secret data crucial to maintaining a corporate advantage over the company's competitors. Physical destruction occurs by mechanical shredding, incineration, or degaussing magnetic hard drives. For support or reporting issues, include Question ID: 63fe07e93b7322449ddbd3dc in your ticket. Thank you.

Question 41

Which of the following policies or plans would dictate how an organization would respond to an unplanned outage of their primary internet connection? Disaster recovery plan Business continuity plan Incident response plan System life cycle plan

Answer 41

Business continuity plan Explanation: OBJ 1.1: A business continuity plan is a document that outlines how a business will continue operating during an unplanned service disruption. A business continuity plan is more comprehensive than a disaster recovery plan and contains contingencies for business processes, assets, human capital and business partners, and essentially every other aspect of the business that might be affected. A disaster recovery plan is a documented, structured approach that documents how an organization can quickly resume work after an unplanned incident. These unplanned incidents include things like natural disasters, power outages, cyber attacks, and other disruptive events. An incident response plan contains a set of instructions to help our network and system administrators detect, respond to, and recover from network security incidents. These types of plans address issues like cybercrime, data loss, and service outages that threaten daily work. System life cycle plans, also known as life cycle planning, describe the approach to maintaining an asset from creation to disposal. In the information technology world, we normally have a 5-phase lifecycle that is used for all of our systems and networks: Planning, Design, Transition, Operations, and Retirement. For support or reporting issues, include Question ID: 63fe07eb3b7322449ddbd3f6 in your ticket. Thank you.

Question 42

Why are explainable AI models often preferred in industries with strict regulatory requirements? They minimize the need for human oversight They offer greater insight into decision-making processes They require less computational power to operate They are less expensive to implement than non-explainable models

Answer 42

They offer greater insight into decision-making processes Explanation: OBJ 1.5: Explainable AI models are preferred in regulated industries (e.g., healthcare, finance) because they allow stakeholders to understand and justify the decision-making processes. This transparency is essential for meeting regulatory requirements and addressing compliance concerns. Less computational power is not inherently linked to explainable AI models. Minimizing human oversight is inaccurate, as explainable models often require human review to validate decisions. Cost considerations vary and are not directly tied to whether a model is explainable. For support or reporting issues, include Question ID: 674fec4adb3fddf57c662c33 in your ticket. Thank you.

Question 43

A network administrator wants to increase the speed and fault tolerance of a connection between two network switches. To achieve this, which protocol should the administrator use? LLDP LDAP L2TP LACP

Answer 43

LACP Explanation: OBJ 3.3: The Link Aggregation Control Protocol (LACP) provides a method to control the bonding of several physical ports to form a single logical channel. The LACP is defined in the 802.3ad standard. The Link Layer Discovery Protocol (LLDP) is a vendor-neutral link layer protocol used by network devices for advertising their identity, capabilities, and neighbors on an IEEE 802 local area network, principally wired Ethernet. The Layer 2 Tunneling Protocol (L2TP) is a tunneling protocol used to support virtual private networks (VPNs) or as part of the delivery of services by ISPs. The Lightweight Directory Access Protocol (LDAP) is an open, vendor-neutral, industry-standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol network. For support or reporting issues, include Question ID: 63fe06c93b7322449ddbc5ca in your ticket. Thank you.

Question 44

While conducting a static analysis source code review of a program, you see the following line of code: String query = "SELECT * FROM CUSTOMER WHERE CUST_ID='" + request.getParameter("id") + "'"; What is the issue with the largest security issue with this line of code? An SQL injection could occur because input validation is not being used on the id parameter The code is using parameterized queries This code is vulnerable to a buffer overflow attack The * operator will allow retrieval of every data field about this customer in the CUSTOMER table

Answer 44

An SQL injection could occur because input validation is not being used on the id parameter Explanation: OBJ 4.2: This code takes the input of “id” directly from a user or other program without conducting any input validation. This could be exploited and used as an attack vector for an SQL injection. If a malicious user can alter the ID source, it might get replaced with something like’ or ‘1’ ='1. This will cause the SQL statement to become: "SELECT * FROM CUSTOMER WHERE CUST_ID='' or '1'='1'". Because ‘1’ always equals ‘1’, the where clause will always return ‘true,’ meaning that EVERY record in the database could now become available to the attacker. When creating SQL statements, there are reasons for and against the use of the * operator. Its presence alone does not necessarily indicate a weakness. With only one line of code being reviewed, you cannot make any statement about whether it is vulnerable to a buffer overflow attack. You do not see the declaration values for the initialization of the id variable. This code is not using parameterized queries, but if it did, then it would eliminate this vulnerability. A parameterized query is a type of output encoding that relies on prepared statements to reduce the risk of an SQL injection. For support or reporting issues, include Question ID: 63fe07653b7322449ddbcd59 in your ticket. Thank you.

Question 45

An organization’s public-facing database experiences frequent crashes and downtime. Monitoring logs indicate a high volume of complex queries originating from automated scripts, significantly consuming CPU and memory resources. The organization suspects resource exhaustion due to poorly optimized or malicious query patterns. What is the best long-term strategy to protect the database against resource exhaustion? Optimize the database to handle complex queries more efficiently Deploy a web application firewall (WAF) with rules to block high-frequency or complex query patterns Restrict database access to trusted IP addresses to block unauthorized users Implement query throttling to limit the number of resource-intensive queries per user

Answer 45

Implement query throttling to limit the number of resource-intensive queries per user Explanation: OBJ 3.3 - Query throttling effectively prevents resource exhaustion by limiting the number of complex queries a single user or script can execute within a given timeframe. While restricting access or using a WAF may block some malicious traffic, they do not address the root issue of legitimate users overloading the system. Database optimization improves performance but cannot fully mitigate resource-intensive query abuse. For support or reporting issues, include Question ID: 675073b53af44d9e9e56c80b in your ticket. Thank you.

Question 46

Dion Training is trying to define key performance indicators for their recently released voucher management system. The CIO has stated that the voucher management system must be built on serverless architecture to support up to 1 million students per hour while maintaining a 3-second latency or less when issuing vouchers. To monitor this requirement, the analysts have created a metric to measure the number of students per hour using the system and another metric to measure the latency when issuing vouchers to those students. Which of the following types of key performance indicators would these metrics be classified as? Availability Reliability Scalability Usability

Answer 46

Scalability Explanation: OBJ 1.2: Scalability metrics measure the ability of a system to handle an increase in workload while maintaining a consistent level of performance. Reliability metrics measure the ability of a system to perform without error or to avoid, detect, and/or repair component or integrity failures. Availability metrics measure the probability that a system will be operating as expected at any given point in time. The most common availability metric used is known as uptime. Usability metrics measure the effectiveness, efficiency, and satisfaction of users working with a given system. For support or reporting issues, include Question ID: 63fe07f03b7322449ddbd42d in your ticket. Thank you.

Question 47

Which of the following layers is NOT used in a three-tiered data center network architecture? Core layer Access/edge layer Distribution/aggregation layer Control layer

Answer 47

Control layer Explanation: OBJ 2.3: The control layer is used in software-defined networking (SDN), not the three-tiered data center network architecture. The Core Layer is considered the backbone of our network and is used to merge geographically separated networks back into one logical and cohesive unit. In general, you will have at least two routers at the core level, operating in a redundant configuration. The distribution or aggregation layer is located under the core layer and it provides boundary definition by implementing access lists and filters to define the policies for the network at large. The access or edge layer is located beneath the distribution or aggregation layer and is used to connect all the endpoint devices like computers, laptops, servers, printers, wireless access points, and others. For support or reporting issues, include Question ID: 63fe06fd3b7322449ddbc84c in your ticket. Thank you.

Question 48

Dion Training has developed a complex software as a service product and is moving into the testing phase. The architecture contains individual elements that were developed by different teams in the organization and tested by each team individually. Which of the following types of testing should Dion Training utilize to ensure all of the individual elements are interacting properly when configured into the final product? CI/CD Regression testing Integration testing Unit testing

Answer 48

Integration testing Explanation: OBJ 4.3: Integration testing is used to test individual components of a system together to ensure that they interact as expected. Unit testing is used to test a particular block of code performs the exact action intended and provides the exact output expected. Normally, unit testing is coded into the software using simply pass/no pass tests for each block of code. Regression testing is the process of testing an application after changes are made to see if these changes have triggered problems in older areas of code. Continuous integration/continuous delivery (CI/CD) is a software development methodology in which code updates are tested and committed to a development or build server/code repository rapidly. For support or reporting issues, include Question ID: 63fe06cd3b7322449ddbc5fd in your ticket. Thank you.

Question 49

Which of the following will an adversary do during the delivery phase of the Lockheed Martin kill chain? (SELECT THREE) Release of malicious email Deliberate social media interactions with the target's personnel Adversary triggering exploits for non-public facing servers Select a decoy document to present to the victim Direct action against public-facing servers Collect press releases, contract awards, and conference attendee lists

Answer 49

Release of malicious email Deliberate social media interactions with the target's personnel Direct action against public-facing servers Explanation: OBJ 1.4: During the delivery phase, the adversary is firing whatever exploits they have prepared during the weaponization phase. At this stage, they still do not have access to their target, though. Therefore, taking direct action against a public-facing web server, sending a spear phishing email, placing a USB drive with malware, or starting a conversation on social media all fit within this phase. internet-facing servers were enumerated during reconnaissance. Selecting a decoy document to present to the victim occurs during weaponization. Collecting press releases, contract awards, and conference attendee lists occur during the reconnaissance phase. For support or reporting issues, include Question ID: 63fe07973b7322449ddbcfc8 in your ticket. Thank you.

Question 50

What type of scan will measure the size or distance of a person's external features with a digital video camera? Iris scan Facial recognition scan Retinal scan Signature kinetics scan

Answer 50

Facial recognition scan Explanation: OBJ 3.3: A face recognition system is a computer application capable of identifying or verifying a person from a digital image or a video frame from a video source. One way to do this is by comparing selected facial features from the image and a face database. By measuring the external facial features, such as the distance between your eyes and nose, you can uniquely identify the user. A retinal scan is a biometric technique that uses unique patterns on a person's retina blood vessels. Iris recognition or iris scanning is the process of using visible and near-infrared light to take a high-contrast photograph of a person's iris. A signature kinetics scan measures a user’s action when signing their name and compares it against a known-good example or baseline. For support or reporting issues, include Question ID: 63fe06f23b7322449ddbc7ca in your ticket. Thank you.

Question 51

NA

Question 52

BrightBytez is a multinational organization that uses a signature-based IDS to monitor its internal network for known threats. However, the security team has noticed an increase in undetected attacks involving zero-day vulnerabilities. What should the organization do to improve the IDS’s ability to detect such threats? Deploy additional IDS devices at each branch office to increase traffic coverage Add more signatures to the database to cover a broader range of known threats Switch to an anomaly-based IDS to identify deviations from normal traffic patterns Increase the sampling interval to reduce the processing burden on the IDS

Answer 52

Switch to an anomaly-based IDS to identify deviations from normal traffic patterns Explanation: OBJ 2.1: Anomaly-based IDS solutions are better suited for detecting unknown or zero-day threats because they identify unusual behavior rather than relying on predefined signatures. Adding more signatures only addresses known threats and does not solve the issue of detecting zero-day attacks. Deploying additional IDS devices may increase coverage but does not enhance detection capabilities for zero-day vulnerabilities. Increasing the sampling interval reduces detection accuracy and may allow threats to go unnoticed. For support or reporting issues, include Question ID: 6750f18cec280b7d2c7fa1df in your ticket. Thank you.

Question 53

CodeSprout Programming is an organization that is developing a critical financial application and needs to define non-functional security requirements. The application must meet the following objectives: Ensure high availability to support 24/7 operations Maintain a maximum downtime of 10 minutes per month Protect sensitive data even during unexpected system failures Which of the following non-functional security requirements best aligns with these objectives? Enforce database query validation and secure session management policies Schedule and conduct regular vulnerability scans and penetration tests Design the application with fault-tolerant architecture and data-at-rest encryption Implement role-based access controls and strong encryption methods to secure sensitive data

Answer 53

Design the application with fault-tolerant architecture and data-at-rest encryption Explanation: OBJ 2.2: Non-functional security requirements focus on system qualities like availability, reliability, and resilience. A fault-tolerant architecture ensures high availability by minimizing downtime during failures. Data-at-rest encryption protects sensitive information even if the system is compromised during a failure. Role-based Access Control (RBAC) and encryption are functional security requirements addressing access control and data security. Database query validation and secure session management focus on operational security but do not address high availability or downtime limits. Vulnerability scans and penetration tests are security practices, not design elements ensuring availability or resilience. For support or reporting issues, include Question ID: 6750fb2223df37e1b5ec5f72 in your ticket. Thank you.

Question 54

You are planning to exploit a network-based vulnerability against a Windows server. As part of your planning, you use the auxiliary scanner in Metasploit against the network and receive the following results: Based on the output above, which of the following exploits are you preparing to use? SMTP exploit SMB exploit SNMP exploit FTP exploit

Answer 54

SNMP exploit Explanation: OBJ 4.2: SNMP provides a lot of information about different target devices on the network. Based on the output shown, you should identify that this is an SNMP scan based on the "community string" keyword. From your Network+ and Security+ studies, you should remember that SNMP uses community strings as a basic authentication mechanism before allowing you to access a network device's statistics. In this scan, two devices are found on this network with default public and private community strings. This makes these devices vulnerable to an SNMP attack for further exploitation. For support or reporting issues, include Question ID: 63fe072d3b7322449ddbcaa2 in your ticket. Thank you.

Question 55

A development team is building a financial application using third-party libraries to save time. During a security review, they discovered one library has unresolved vulnerabilities and has not been updated in two years. The team must ensure the application meets compliance requirements for a secure software supply chain. What should the team prioritize to address supply chain risks from the vulnerable library? Replace the library with custom code to eliminate external risks Trust the vendor's judgment for patching and proceed to avoid project delays Scan the final application for vulnerabilities before deployment Use an SCA tool to identify and mitigate third-party vulnerabilities

Answer 55

Use an SCA tool to identify and mitigate third-party vulnerabilities Explanation: OBJ 2.2 - Using a software composition analysis (SCA) tool ensures that vulnerabilities in third-party libraries are identified and addressed early, supporting compliance and reducing supply chain risks. Replacing the library with custom code is inefficient and costly. Scanning only the final application delays vulnerability detection. Trusting the vendor without additional verification does not address the risks of unresolved vulnerabilities. For support or reporting issues, include Question ID: 674f6dfb7a4b195c66838b41 in your ticket. Thank you.

Question 56

Julie was just hired to conduct a security assessment of Dion Training’s security policies. During her assessment, she noticed that many users were sharing group accounts to conduct their work roles. Julie recommended that the group accounts be eliminated and instead have an account created for each user. What improvement will this recommended action provide for the company? More efficient baseline management More routing auditing Increase password security Increase individual accountability

Answer 56

Increase individual accountability Explanation: OBJ 3.1: To adequately provide accountability, the use of shared or group accounts should be disabled. This allows you to log and track individual user actions based on individual user accounts. This enables the organization to hold users accountable for their actions, too. For support or reporting issues, include Question ID: 63fe06f53b7322449ddbc7e8 in your ticket. Thank you.

Question 57

Which of the following technologies allows a network to be abstracted from the physical hardware by creating a virtualized network overlay? MPLS mGRE WLAN SDWAN

Answer 57

SDWAN Explanation: OBJ 2.5: A software-defined wide area network (SDWAN) is a network that is abstracted from its hardware which creates a virtualized network overlay. Multipoint GRE (mGRE) is a protocol that can be used to enable one node to communicate with many nodes by encapsulating layer 3 protocols to create tunnels over another network. The mGRE protocol is often used in Dynamic Multipoint VPN (DMVPN) connections. Multiprotocol Label Switching (MPLS) is a routing technique in telecommunications networks that directs data from one node to the next based on short path labels rather than long network addresses, thus avoiding complex lookups in a routing table and speeding traffic flows. A wireless local area network (WLAN) is a wireless computer network that links two or more devices using wireless communication to form a local area network within a limited area such as a home, school, computer laboratory, campus, or office building. For support or reporting issues, include Question ID: 63fe06e33b7322449ddbc711 in your ticket. Thank you.

Question 58

Dion Consulting Group has recently received a contract to develop a networked control system for a self-driving car. The company's CIO is concerned about the liability of a security vulnerability being exploited that may result in the death of a passenger or an innocent bystander. Which of the following methodologies would provide the single greatest mitigation if successfully implemented? Formal methods of verification Peer review of source code Rigorous user acceptance testing DevSecOps

Answer 58

Formal methods of verification Explanation: OBJ 1.2: Formal verification methods use a mathematical model of the inputs and outputs of a system to prove that the system works as specified in all cases. Given the level of certainty achieved through formal verification methods, this approach provides the single greatest mitigation against this threat. Formal methods are designed for use in critical software in which corner cases must be eliminated. For example, what should the car do if a child jumps out in front of it, and the only way to avoid the child is to swear off the road (which might kill the driver)? This is a classic corner case that needs to be considered for a self-driving car. User acceptance testing (UAT) is a beta phase of software testing. When the developers have tested the software, it is installed to a limited set of users who follow test schemes and report findings. DevSecOps is a combination of software development, security operations, and systems operations and integrates each discipline with the others. Peer review of source code allows for the review of uncompiled source code by other developers. While DevSecOps, peer review, and user acceptance testing help bring down the system's risk, only a formal method of verification could limit the liability involved with such a critical application as a self-driving car. For support or reporting issues, include Question ID: 63fe06d43b7322449ddbc653 in your ticket. Thank you.

Question 59

A software development team wants to ensure the integrity of files downloaded by customers. They decide to publish a unique value derived from each file that customers can use to verify that the file has not been altered during transmission or compromised by an attacker. Which cryptographic technique should the team use? Symmetric encryption Hashing PKI Forward secrecy

Answer 59

Hashing Explanation: OBJ 3.8: Hashing generates unique values (hashes) for data, enabling users to verify file integrity. Symmetric encryption secures data but does not verify integrity alone. Public key infrastructure (PKI) facilitates key and certificate management but is not suitable for generating unique file values. Forward secrecy ensures confidentiality for past communications but is unrelated to file verification. For support or reporting issues, include Question ID: 6751b6a89192dec49e1159ba in your ticket. Thank you.

Question 60

What type of threat occurs when an attacker alters the input data to manipulate an AI model’s output without compromising the model itself? Model inversion Adversarial attack Supply chain vulnerability Prompt injection

Answer 60

Adversarial attack Explanation: OBJ 1.5: Adversarial attacks involve subtly altering input data, such as adding noise or modifying images, to cause an AI model to produce incorrect outputs. These attacks exploit weaknesses in the model's interpretation of input data without directly tampering with the model. Supply chain vulnerability pertains to risks in acquiring or integrating AI components, not direct manipulation of inputs. Model inversion focuses on extracting sensitive data, not altering inputs. Prompt injection manipulates AI outputs via malicious prompts but is distinct from adversarial attacks. For support or reporting issues, include Question ID: 674fefefdb3fddf57c662ca8 in your ticket. Thank you.

Question 61

Dion Training utilizes a wired network throughout the building to provide network connectivity. Jason is concerned that a visitor might plug their laptop into a CAT 5e wall jack in the lobby and access the corporate network. What technology should be utilized to prevent users from gaining access to network resources if they can plug their laptops into the network? DMZ NAC VPN UTM

Answer 61

NAC Explanation: OBJ 2.4: Network Access Control (NAC) is an approach to computer security that attempts to unify endpoint security technology, the user or system authentication, and network security enforcement. NAC restricts the data that each particular user can access and implements anti-threat applications such as firewalls, anti-virus software, and spyware detection programs. NAC also regulates and restricts the things individual subscribers or users can do once they are connected. If a user is unknown, the NAC can quarantine the device from the network upon connection. A DMZ (demilitarized zone), a type of screened subnet, is a physical or logical subnetwork that contains and exposes an organization's external-facing services to an untrusted network such as the Internet. A virtual private network (VPN) extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. Unified threat management (UTM) provides multiple security features (anti-virus, anti-spam, content filtering, and web filtering) in a single device or network appliance. For support or reporting issues, include Question ID: 63fe06d83b7322449ddbc685 in your ticket. Thank you.

Question 62

You are planning to exploit a network-based vulnerability against an organization as part of a penetration test. You attempted to connect your laptop to a port in their conference room. You were redirected to a captive portal for not meeting the organization's approved security baseline for a Windows 10 laptop. Which of the following types of exploits should you use to bypass NAC and access the network? Conduct a denial of service attack against the network policy server Harvest the user credentials of an employee and use those to connect Perform a remote code execution on the NAC controller Spoof the MAC address of the room's VOIP phone to your laptop

Answer 62

Spoof the MAC address of the room's VOIP phone to your laptop Explanation: OBJ 4.2: Network access control (NAC) is used to prevent unhealthy devices from accessing an organization's internal network. To break into a network that uses NAC, you must perform a NAC bypass attack. One popular NAC bypass method is to spoof the MAC or IP address of a printer or VOIP device since they cannot natively participate in NAC and are often allow listed by administrators. Another method is to configure your attacking device to use IPv6 instead of IPv4. Most routers and switches support IPv4 and IPv6, but many system administrators only configure NAC for their IPv4 devices out of habit. The final method would be to set up a rogue wireless access point to create an on-path condition. This would allow an authorized device to connect to your wireless access point and then use its authorized status to connect to the network. For support or reporting issues, include Question ID: 63fe07513b7322449ddbcc5f in your ticket. Thank you.

Question 63

Which of the following techniques would be the most appropriate solution to implementing a multi-factor authentication system? Password and security question Fingerprint and retinal scan Username and password Smartcard and PIN

Answer 63

Smartcard and PIN Explanation: OBJ 2.4: Multi-factor authentication (MFA) creates multiple security layers to help increase the confidence that the user requesting access is who they claim to be by requiring two distinct factors for authentication. These factors can be something you know (knowledge factor), something you have (possession factor), something you are (inheritance factor), something you do (action factor), or somewhere you are (location factor). By selecting a smartcard (something you have) and a PIN (something you know), you have implemented multi-factor authentication. Choosing a fingerprint and retinal scan would instead use only one factor (inheritance). Choosing a username, password, and security question would also be only using one factor (knowledge). For something to be considered multi-factor, you need items from at least two different authentication factor categories: knowledge, possession, inheritance, location, or action. For support or reporting issues, include Question ID: 63fe06ee3b7322449ddbc793 in your ticket. Thank you.

Question 64

A cybersecurity analyst reviews the logs of a proxy server and saw the following URL, https://www.google.com/search?q=*%40diontraining.com. Which of the following is true about the results of this search? Returns all web pages containing the text diontraining.com Returns no useful results for an attacker Returns all web pages hosted at diontraining.com Returns all web pages containing an email address affiliated with diontraining.com

Answer 64

Returns all web pages containing an email address affiliated with diontraining.com Explanation: OBJ 4.1: Google interprets this statement as @diontraining.com and understands that the user is searching for email addresses since %40 is the hex code for the @ symbol. The * is a wild card character meaning that any text could be substituted for the * in the query. This type of search would provide an attacker with a list of email addresses associated with diontraining.com, which could be used as part of a spear phishing campaign. To return all web pages hosted at diontraining.com, you should use the "site:" modifier in the query. To return all web pages with the text diontraining.com, enter "diontraining.com" into the Google search bar with no modifiers to return those results. For support or reporting issues, include Question ID: 63fe07663b7322449ddbcd68 in your ticket. Thank you.

Question 65

You are planning to exploit a network-based vulnerability against a Windows server. You have determined that it is vulnerable to the EternalBlue exploit because the system hasn't installed the MS17-010 security patch. From your research, you know that this exploit would allow you to conduct arbitrary remote code execution by exploiting a fault in the communication protocol used by Windows file and print servers. Which of the following types of exploits are you planning? SMB exploit SMTP exploit SNMP exploit FTP exploit

Answer 65

SMB exploit Explanation: OBJ 4.2: Server Message Block (SMB) allows clients to read from and write to a server service, providing core authentication and communications for Windows file and print servers. The EternalBlue exploit was released in early 2017, and it can be used against Windows (Vista SP2 through Server 2016, both 32-bit and 64-bit versions). For support or reporting issues, include Question ID: 63fe07783b7322449ddbce49 in your ticket. Thank you.

Question 66

Which of the following compliance standards focuses on ensuring accurate financial reporting and internal controls for publicly traded companies in the United States? PCI DSS HIPAA NIST CSF SOX

Answer 66

SOX Explanation: OBJ 1.3: The Sarbanes-Oxley Act (SOX) is a U.S. federal law that establishes requirements for accurate financial reporting and internal controls in publicly traded companies. It was enacted to prevent corporate fraud and enhance financial disclosures. HIPAA is related to healthcare information security and privacy, not financial reporting. PCI DSS governs payment card security, not corporate financial reporting. NIST CSF is a cybersecurity framework for managing and reducing cybersecurity risks, not financial accountability. For support or reporting issues, include Question ID: 674feadfec1a5f7ce5d83872 in your ticket. Thank you.

Question 67

A company's internal web application is displaying security warnings in users' browsers when they attempt to access it. The issue persists across multiple devices and browsers, and the administrator confirms that the server’s TLS certificate is active. However, further investigation reveals validation issues related to certificate handling. What is the most likely cause of this issue? TLS version incompatibility Cipher suite mismatch Expired root certificate Incorrect certificate configuration

Answer 67

Incorrect certificate configuration Explanation: OBJ 3.3: Incorrect certificate chain configuration prevents proper validation by client browsers, leading to security warnings despite the certificate being active. Cipher suite mismatch and TLS version incompatibility typically cause connection failures without triggering certificate-related warnings. An expired root certificate would affect certificates across multiple systems, which is not indicated here. For support or reporting issues, include Question ID: 6751ab4897eb9dce4020fc04 in your ticket. Thank you.

Question 68

Dion Training's security team recently discovered a bug in their software’s code. The development team released a software patch to remove the vulnerability caused by the bug. What type of test should a software tester perform on the application to ensure that it is still functioning properly after the patch is installed? Penetration testing User acceptance testing Fuzzing Regression testing

Answer 68

Regression testing Explanation: OBJ 2.2: Regression testing is re-running functional and non-functional tests to ensure that previously developed and tested software still performs after a change. After installing any patch, it is important to conduct regression testing to confirm that a recent program or code change has not adversely affected existing features or functionality. Fuzzing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. The program is then monitored for exceptions such as crashes, failing built-in code assertions, or potential memory leaks. User acceptance testing is a test conducted to determine if the specifications or contract requirements have been met. A penetration test is an authorized simulated cyberattack on a computer system, performed to evaluate the system's security. For support or reporting issues, include Question ID: 63fe06e93b7322449ddbc752 in your ticket. Thank you.

Question 69

A cybersecurity analyst is reviewing the logs of a proxy server and saw the following URL, http://test.diontraining.com/index.php?id=1%20OR%2017-7%3d10. What type of attack has likely occurred? Session hijacking Buffer overflow SQL injection XML injection

Answer 69

SQL injection Explanation: OBJ 4.2: This is an example of a Boolean-based SQL injection. This occurs when data input by a user is interpreted as a SQL command rather than as normal data by the backend database. In this example, notice that the statement being parsed as part of the URL after the equal sign is equivalent to 1 or 17-7=10. This means the portion of the statement that is 17-7=10 would return a value of 1 (since it is true). Then, we are left to compute if 1 = 1, and since it does, the SQL database will treat this as a positive authentication. This is simply an obfuscation technique of a 1=1 SQL injection technique. A buffer overflow is an exploit that attempts to write data to a buffer and exceed that buffer's boundary to overwrite an adjacent memory location. A session hijacking attack consists of exploiting the web session control mechanism, normally managed for a session token. XML Injection is an attack technique used to manipulate or compromise an XML application or service's logic. For support or reporting issues, include Question ID: 63fe07373b7322449ddbcb1a in your ticket. Thank you.

Question 70

A cybersecurity company is deploying virtualization technology to consolidate its server infrastructure. To ensure the virtual machines are isolated and secure, they decide to leverage a computing feature that provides hardware-assisted memory encryption and protection against unauthorized access. Which technology is most likely being used? Hardware-assisted virtualization CPU security extensions TPM Secure enclave

Answer 70

CPU security extensions Explanation: OBJ 3.4: Central processing unit (CPU) security extensions provide hardware-based features such as memory encryption and enhanced isolation for virtual machines, ensuring secure operation in virtualized environments. Trusted Platform Modules (TPMs) are used for secure key storage and cryptographic operations but are not directly involved in memory encryption. Secure enclaves isolate sensitive computations but do not offer comprehensive virtualization security. Hardware-assisted virtualization enhances performance but requires CPU security extensions to provide strong security guarantees. For support or reporting issues, include Question ID: 6751ad7697eb9dce4020fc18 in your ticket. Thank you.

Question 71

A coworker is conducting open-source intelligence gathering for an upcoming penetration test against Dion Training. You look over their shoulder and see them enter the following URL, https://www.google.com/search?q=*%40diontraining.com. Which of the following is true about the results of this search? Returns no useful results for an attacker Returns all web pages containing an email address affiliated with diontraining.com Returns all web pages containing the text diontraining.com Returns all web pages hosted at diontraining.com

Answer 71

Returns all web pages containing an email address affiliated with diontraining.com Explanation: OBJ 1.4: Google interprets this statement as @diontraining.com and understands that the user is searching for email addresses since %40 is the hex code for the @ symbol. The * is a wild card character meaning that any text could be substituted for the * in the query. This type of search would provide an attacker with a list of email addresses associated with diontraining.com, which could be used as part of a spear phishing campaign. To return all web pages hosted at diontraining.com, you should use the "site:" modifier in the query. To return all web pages with the text diontraining.com, enter "diontraining.com" into the Google search bar with no modifiers to return those results. For support or reporting issues, include Question ID: 63fe07783b7322449ddbce44 in your ticket. Thank you.

Question 72

A company’s security team is evaluating endpoint privilege management tools to enhance security on its servers. The team needs a solution that allows temporary elevation of privileges without granting permanent administrative rights to users. Which of the following should they prioritize? Implementing JIT access features Static assignment of administrator roles Session logging without permission modifications Implementing RBAC for all applications

Answer 72

Implementing JIT access features Explanation; OBJ 3.2: Just-in-time (JIT) privilege escalation enables users to temporarily elevate their privileges for specific, approved tasks, reducing the risk of misuse or persistent vulnerabilities associated with permanent administrative rights. Static role assignments and session logging do not dynamically address privilege needs, and while role-based access control (RBAC) is beneficial, it does not offer time-based elevation functionality. For support or reporting issues, include Question ID: 67514370b702e8776b8d551f in your ticket. Thank you.

Question 73

A recent vulnerability scan found several vulnerabilities on an organization’s public-facing IP addresses. To reduce the risk of a breach, which of the following vulnerabilities should be prioritized for remediation? An HTTP response that reveals an internal IP address A website utilizing a self-signed SSL certificate A cryptographically weak encryption cipher A buffer overflow that is known to allow remote code execution

Answer 73

A buffer overflow that is known to allow remote code execution Explanation: OBJ 3.6: The most serious vulnerability discovered is one that could allow remote code execution to occur. Since this buffer overflow vulnerability is known to allow remote code execution, it must be mitigated first to prevent a security breach most effectively. While the other issues should be addressed eventually, you need to prioritize the most critical one (remote code execution) on a public-facing IP address. A public-facing IP address means the device is accessible from the internet. For support or reporting issues, include Question ID: 63fe075d3b7322449ddbccf5 in your ticket. Thank you.

Question 74

Which term defines the collection of all points from which an adversary could interact with a system and cause it to function in a way other than how it was designed? Attack surface Threat model Adversary capability set Attack vector

Answer 74

Attack surface Explanation: OBJ 1.4: The collection of all points from which an adversary may attack is considered the attack surface. The attack vector represents the specific points an adversary has chosen for a particular attack. The threat model defines the behavior of the adversary. An adversary capability set is the list of items an adversary can use to conduct its attack. For support or reporting issues, include Question ID: 63fe07243b7322449ddbca2a in your ticket. Thank you.

Question 75

Assuming that Dion Training trusts Thor Teaches, and Thor Teaches trusts Udemy, then we can assume Dion Training also trusts Udemy. What concept of IAM does the previous statement represent? Domain level trust Public key trust Transitive trust Certificate authority trust

Answer 75

Transitive trust Explanation: OBJ 2.4: Transitive trust occurs when X trusts Y, and Y trusts Z; therefore, X trusts Z. This is because the trust flows from the first part (Dion Training) through the second party (Thor Teaches) to the third party (Udemy). For support or reporting issues, include Question ID: 63fe070a3b7322449ddbc8e7 in your ticket. Thank you.

Question 76

Taylor needs to sanitize hard drives from some leased workstations before returning them to a supplier at the end of the lease period. The workstations' hard drives contained sensitive corporate data. Which is the most appropriate choice to ensure that data exposure doesn’t occur during this process? Purge, validate, and document the sanitization of the drives Clear, validate, and document the sanitization of the drives The drives must be destroyed to ensure no data loss Clear the drives

Answer 76

Purge, validate, and document the sanitization of the drives Explanation OBJ 4.2: Purging the drives, validating that the purge was effective, and documenting the sanitization is the best response. Purging includes methods that eliminate information from being feasibly recovered even in a lab environment. For example, performing a cryptographic erasure (CE) would sanitize and purge the drives' data without harming the drives themselves. Clearing them leaves the possibility that some tools would allow data recovery. Since the scenario indicates that these were leased drives that must be returned at the end of a lease, they cannot be destroyed. For support or reporting issues, include Question ID: 63fe08013b7322449ddbd504 in your ticket. Thank you.

Question 77

Dion Training is developing a new system and needs to determine which features to implement as part of its data protection scheme. The lead security engineering has recommended an implementation that would use a form of encryption that allows the data to have integrity and authenticity checks performed upon it during the encryption process. Which cryptographic concept is the programmer referring to in his implementation? Cipher block chaining Forward secrecy Key stretching AEAD

Answer 77

AEAD Explanation: OBJ 3.7: Authenticated encryption with associated data (AEAD) is a form of encryption that provides confidentiality of the plaintext, a way to check its integrity, and a method of verifying its authenticity. Forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that session keys will not be compromised even if long-term secrets used in the session key exchange are compromised. Key stretching is a technique that strengthens potentially weak input for cryptographic key generation, such as passwords or passphrases created by people, against brute force attacks. Cipher block chaining (CBC) is a simple mode of enabling symmetric block ciphers to work with large sets of data. CBC is an older method that is vulnerable to the padding-oracle attack and should therefore not be used. For support or reporting issues, include Question ID: 63fe07a73b7322449ddbd09c in your ticket. Thank you.

Question 78

A financial institution is partnering with a cloud provider to process encrypted customer data for advanced analytics. However, the institution must ensure that the cloud provider cannot view the data in plaintext at any stage of the process due to strict regulatory requirements. The institution also needs to maintain the ability to compute on the encrypted data to derive insights while preserving privacy. What cryptographic method should be implemented? PKI Homomorphic encryption Data tokenization Symmetric encryption

Answer 78

Homomorphic encryption Explanation: OBJ 3.8: Homomorphic encryption allows computations to be performed directly on encrypted data, enabling analytics while maintaining confidentiality. Symmetric encryption provides data protection but does not support encrypted computations. Public key infrastructure (PKI) is a framework for managing digital certificates and keys but does not allow encrypted operations. Tokenization obscures sensitive data but cannot support computational use cases on the obfuscated data. For support or reporting issues, include Question ID: 6751b4b6fd8b34c81216adce in your ticket. Thank you.

Question 79

Riverside’s Riveting Innovations has recently applied several updates to its network devices across multiple locations. Some devices are experiencing performance degradation, while others continue to operate normally. Which of the following problems is most likely responsible for these issues? ACL misalignment Configuration drift Insecure routing protocols VLAN segmentation errors

Answer 79

Configuration drift Explanation: OBJ 3.3: Configuration drift occurs when changes are applied inconsistently across network devices, leading to performance issues. Insecure routing protocols compromise security, not performance. VLAN segmentation errors and ACL misalignment are unrelated to inconsistent updates as they primarily affect security and data segmentation. For support or reporting issues, include Question ID: 675148d0ee759eace74d72e6 in your ticket. Thank you.

Question 80

You are attending a cybersecurity conference and just watched a security researcher demonstrating the exploitation of a web interface on a SCADA/ICS component. This caused the device to malfunction and be destroyed. You recognize that the same component is used throughout your company’s manufacturing plants. Which of the following mitigation strategies would provide you with the most immediate protection against this emergent threat? Demand that the manufacturer of the component release a patch immediately and deploy the patch as soon as possible Evaluate if the web interface must remain open for the system to function; if it isn’t needed, block the web interface Replace the affected SCADA/ICS components with more secure models from a different manufacturer Logically or physically isolate the SCADA/ICS component from the enterprise network

Answer 80

Evaluate if the web interface must remain open for the system to function; if it isn’t needed, block the web interface Explanation: OBJ 3.5: The most immediate protection against this emergent threat would be to block the web interface from being accessible over the network. Before doing this, you must evaluate whether the interface needs to remain open for the system to function properly. If it is not needed, you should block it to minimize the SCADA/ICS component's attack surface. Ideally, your SCADA/ICS components should already be logically or physically isolated from the enterprise network. Since the question doesn’t mention the networks as an area of concern, we can assume they are already following the industry best practice of logical or physical segmentation between the SCADA/ICS network and the enterprise network. On the exam, make sure you focus on the question being asked. In this case, the question focuses on the web interface. Developing a patch can be a time-consuming process, therefore waiting for the manufacturer to provide a patch will not provide immediate protection to your components. The same is true for replacing the affected components. Even if you could get the company to authorize the funding for such a purchase, it would take time to order, ship, receive, and install the new components. Additionally, you would cause unwanted downtime in the factory during the installation of the components, making it an ineffective option when simply blocking the web interface is free, quick, and effective. For support or reporting issues, include Question ID: 63fe07c43b7322449ddbd205 in your ticket. Thank you.

Question 81

Which of the following types of information is protected by rules in the United States that specify the minimum frequency of vulnerability scanning required for devices that process it? Medical records Insurance records Driver’s license numbers Credit card data

Answer 81

Credit card data Explanation: OBJ 1.3: The Payment Card Industry Data Security Standard (PCI DSS) is an information security standard for organizations that handle branded credit cards from the major card schemes. The PCI Standard is mandated by the card brands but administered by the Payment Card Industry Security Standards Council. As part of PCI DSS compliance, organizations must conduct internal and external scans at prescribed intervals on any devices or systems that process credit card data. HIPAA protects medical and insurance records, but this law doesn't define a frequency for vulnerability scanning requirements. Driver's license numbers are considered PII, but again, there is no defined frequency scanning requirement regarding protecting PII under law, regulation, or rule. For support or reporting issues, include Question ID: 63fe08033b7322449ddbd51d in your ticket. Thank you.

Question 82

An organization deploys self-encrypted drives (SEDs) across its fleet of laptops to ensure data protection. During a routine audit, IT discovers that several devices fail to encrypt newly stored data. Further investigation reveals that users had disabled the SED encryption feature to improve system performance. What is the best way for the organization to prevent similar issues while maintaining SED functionality? Schedule periodic re-encryption of all devices to ensure compliance with encryption policies Transition to software-based encryption to centralize data protection controls Restrict administrative access to prevent users from disabling encryption settings Enforce mandatory encryption policies using endpoint management tools

Answer 82

Enforce mandatory encryption policies using endpoint management tools Explanation: OBJ 3.4 - Enforcing mandatory encryption policies ensures that SED functionality is consistently applied across devices and cannot be disabled by users. Transitioning to software-based encryption reduces performance benefits and the security of SEDs. Restricting administrative access helps but does not guarantee compliance. Periodic re-encryption is unnecessary for SEDs, which operate in real-time encryption. For support or reporting issues, include Question ID: 6750749a3af44d9e9e56c815 in your ticket. Thank you.

Question 83

Which of the following functions is not provided by a TPM? Secure generation of cryptographic keys Sealing User authentication Random number generation Binding Remote attestation

Answer 83

User authentication Explanation: OBJ 3.4: User authentication is performed at a much higher level in the operating system. Trusted Platform Module (TPM) technology is designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper-resistant, and malicious software cannot tamper with the security functions of the TPM. The TPM provides random number generation, secure generation of cryptographic keys, remote attestation, binding, and sealing functions securely. For support or reporting issues, include Question ID: 63fe07e33b7322449ddbd386 in your ticket. Thank you.

Question 84

Dion Training is choosing an encryption algorithm to use in providing confidentiality of the data stored on its mobile devices. Which of the following cryptographic algorithms should the company choose to provide the equivalent level of security with a smaller key size? SHA-256 MD5 AES ECC

Answer 84

ECC Explanation OBJ 3.7: To ensure confidentiality, you should always use an encrypting function. ECC and AES are both encrypting functions, but ECC requires a smaller key size to provide equivalent levels of protection. Elliptic curve cryptography is a public-key cryptographic algorithm based on the algebraic structure of elliptic curves over finite fields. ECC allows smaller key sizes compared to non-elliptic curve cryptography methods while still providing the equivalent level of security. ECC is heavily used in mobile devices and low-powered device encryption. The advanced encryption standard (AES) is a cryptographic algorithm used to perform symmetric data encryption using a 128-bit, 192-bit, or 256-bit key. Message Digest Algorithm (MD5) is a one-way cryptographic function that accepts a message of any length as input and returns as output a fixed-length 128-bit hash digest value to be used for authenticating the original message. MD5 can be easily brute-forced and has a high chance of collision. Secure Hashing Algorithm (SHA-256) is a one-way cryptographic function that accepts a message of any length as input and returns as output a fixed-length 256-bit hash digest value to be used for authenticating the original message. For support or reporting issues, include Question ID: 63fe07df3b7322449ddbd359 in your ticket. Thank you.

Question 85

Dion Training is designing a new practice exam application that will be hosted in the cloud. The company knows there will be periods of higher and lower demands based on an analysis of historical usage patterns. The programmers have created the code using distributed programming techniques so that the jobs can be distributed over numerous machines across the virtual private cloud (VPC) containing each of the servers. To help control costs, any new servers added to the pool must be added by a system administrator after verifying the current demand. Which of the following BEST describes the type of action used to meet the increasing demands on the server? Autoscaling Horizontal scaling Content delivery network Vertical scaling

Answer 85

Horizontal scaling Explanation: OBJ 2.1: Horizontal scaling allows additional capacity to be achieved by adding servers to help process the same workload, such as adding nodes to a distributed system or adding web servers to an existing server farm. Vertical scaling allows additional resources to be added to an individual system, such as adding processors, memory, and storage to an existing server. Autoscaling is the ability to expand and contract the performance of workloads based on policies with specific maximum and minimum capacity specifications. Autoscaling can be used with either horizontal or vertical scaling depending on your cloud service provider. A content delivery network (CDN) distributes and replicates the components of any service (such as web apps, media, and storage) across all the key service areas needing access to the content. For support or reporting issues, include Question ID: 63fe07123b7322449ddbc94b in your ticket. Thank you.

Question 86

You are performing a web application security test, notice that the site is dynamic, and must be using a back-end database. You decide you want to determine if the site is susceptible to an SQL injection. What is the first character that you should attempt to use in breaking a valid SQL request? Semicolon Double quote Exclamation mark Single quote

Answer 86

Single quote Explanation: OBJ 4.2: The single quote character (') is the character limiter in SQL. With a single quote,' you delimit strings, and therefore you can test whether the programmer has properly escaped the strings in the targeted application. If not escaped directly, you can end any string supplied to the application and add other SQL code after it. This is a common technique for SQL injections. A semicolon is a commonly used character at the end of a line of code or command in many programming languages. An exclamation mark comments a line of code in several languages. Double quotes contain a string that is passed to a variable. For support or reporting issues, include Question ID: 63fe06d63b7322449ddbc667 in your ticket. Thank you.

Question 87

The local electric power plant contains both business networks and ICS/SCADA networks to control their equipment. Which technology should the power plant’s security administrators look to implement first as part of configuring better defenses for the ICS/SCADA systems? Log consolidation Anti-virus software Intrusion prevention system

Answer 87

Intrusion prevention system Explanation: OBJ 3.5: Since this question is focused on the ICS/SCADA network, the best solution would be implementing an Intrusion Prevention System. ICS/SCADA machines utilize very specific commands to control the equipment and to prevent malicious activity. You could set up strict IPS rules to prevent unknown types of actions from being allowed to occur. Log consolidation is a good idea, but it won't prevent an issue and therefore isn't the most critical thing to add first. Automated patch management should not be conducted, as ICS/SCADA systems must be tested before conducting any patches. Often, patches will break ICS/SCADA functionality. Antivirus software may or may not be able to run on the equipment, as well, since some ICS/SCADA systems often do not rely on standard operating systems like Windows. For support or reporting issues, include Question ID: 63fe079f3b7322449ddbd03b in your ticket. Thank you.

Question 88

During an ongoing investigation of a suspected insider threat, a cybersecurity team collects a memory dump from an active server. They identify running processes, active network connections, and encryption keys that are crucial for understanding the scope of the incident. What type of storage analysis is being performed in this scenario? Forensic disk imaging Volatile storage analysis Metadata analysis Non-volatile storage analysis

Answer 88

Volatile storage analysis Explanation: OBJ 4.4: Volatile storage analysis focuses on the contents of a system's memory (RAM) to gather evidence such as running processes, network connections, and encryption keys, which are lost when the system powers down. Non-volatile storage analysis examines persistent data like hard drives; forensic disk imaging creates exact copies of storage devices; and metadata analysis focuses on file properties like timestamps. For support or reporting issues, include Question ID: 6751ba0272f8a45d44021765 in your ticket. Thank you.

Question 89

Which analysis framework makes no allowance for an adversary retreat in its analysis? MITRE ATT&CK framework AlienVault (AT&T Cybersecurity) Cyber Kill Chain Diamond Model of Intrusion Analysis Lockheed Martin cyber kill chain

Answer 89

Lockheed Martin cyber kill chain Explanation: OBJ 1.4: The Lockheed Martin cyber kill chain implicitly assumes a unidirectional workflow. Therefore, it fails to consider that an adversary may retreat during an attack. MITRE and Diamond's models are more dynamic systems that allow for a broader range of adversary behaviors. AlienVault was specifically designed to avoid the rigidity of the Lockheed Martin cyber kill chain. For support or reporting issues, include Question ID: 63fe07663b7322449ddbcd63 in your ticket. Thank you.

Question 90

What SCAP component provides a list of entries that contains an identification number, a description, and a public reference for each publicly known weakness in a piece of software? CCE CPE CVE XCCDF

Answer 90

CVE Explanation: OBJ 3.6: The Common Vulnerabilities and Exposures (CVE) system provides a reference method for publicly known information-security vulnerabilities and exposures. XCCDF (extensible configuration checklist description format) is a language that is used in creating checklists for reporting results. The Common Configuration Enumeration (CCE) provides unique identifiers to system configuration issues to facilitate fast and accurate correlation of configuration data across multiple information sources and tools. Common Platform Enumeration (CPE) is a standardized method of describing and identifying classes of applications, operating systems, and hardware devices present among an enterprise's computing assets. For support or reporting issues, include Question ID: 63fe07813b7322449ddbcebc in your ticket. Thank you.